4

Is it possible on iOS to activate a non-leaking always-on VPN? I've heard this can only be done through supervised mode and with a VPN provider that supports "IKEv2", is this correct? Are there any downsides to this approach, for day to day use on a personal phone?

Also, is supervised mode configurable on Windows / Linux?

  • none of that is true, you just need to install a profile that forces vpn on demand. once I have the time, i can detail the conf file. I am on iphone, please answer tagging me so I will track the question in my computer tomorrow morning – Rui F Ribeiro Aug 11 '16 at 18:57
  • Ok, thanks! The reason I was under the impression it's not possible to do this the "regular" way on IOS, is because in the OpenVPN IOS FAQ (docs.openvpn.net/docs/openvpn-connect/…), it says: "During pause, resume, and reconnect states (for example when transitioning between WiFi and Cellular data), the VPN tunnel may temporarily disengage, allowing network traffic to bypass the tunnel and route directly to the internet." – oaiwjefj Aug 11 '16 at 22:32
  • @RuiFRibeiro An "on-demand" VPN is different from "always on". The phone user can disable an on-demand VPN, whereas an always-on VPN profile cannot be disabled. – augurar Apr 25 '17 at 2:42
3

It is rather possible to activate "always-on" VPN activating the "Connect on demand" option via a VPN profile both in iOS and OSX/MacOS.

For instance, some commercial VPN providers do that.

However that only applies to any kind of VPN done/configured via the native client, and not 3rd party VPNs like OpenVPN.

The behaviour of the Connect on demand VPNs, is that as soon a TCP/IP packets try to leave the iDevice, the VPN goes up.

I have been using it with VPNs with IPsec with IKEv1 in iOS 8 and iOS 9, so the IKEv2 requirement does not seem to apply. I also been using it without supervised mode.

The profile file is a xml file, that can be written by hand, or with the help of Apple tools. The file has to have an extension .mobileconfig, and has to be loaded by the Safari browser in iOS.

As an example, I am using this file, for a full VPN tunnel, "Cisco" IPsec with group password and user XAUTH authentication.

I put "Cisco", because in my case, the VPN servers are respectively, a PfSense firewall, and a Linux Debian server.

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>PayloadContent</key>
    <array>
        <dict>
            <key>IPSec</key>
            <dict>
                <key>AuthenticationMethod</key>
                <string>SharedSecret</string>
                <key>LocalIdentifier</key>
                <string>*group_name*</string>
                <key>LocalIdentifierType</key>
                <string>KeyID</string>
                <key>RemoteAddress</key>
                <string>*11.11.11.11*</string>
                <key>SharedSecret</key>
                <data>
                *ksjksdjksdf*
                </data>
                <key>XAuthEnabled</key>
                <integer>1</integer>
                <key>XAuthName</key>
                <string>*username*</string>
                <key>XAuthPassword</key>
                <string>*password*</string>
                <key>DisconnectOnIdle</key>
                        <integer>0</integer>
                <key>OnDemandEnabled</key>
                        <integer>1</integer>
                <key>OnDemandRules</key>
                <array>
                    <dict>
                    <key>Action</key>
                    <string>Connect</string>
                    </dict>
                </array>
            </dict>
            <key>IPv4</key>
            <dict>
                <key>OverridePrimary</key>
                <integer>1</integer>
            </dict>
            <key>PayloadDescription</key>
            <string>Configures VPN settings, including authentication.</string>
            <key>PayloadDisplayName</key>
            <string>*VPN (MyHOME)*</string>
            <key>PayloadIdentifier</key>
            <string>*com.myhome.pt.vpn*</string>
            <key>PayloadOrganization</key>
            <string>*MY-HOME*</string>
            <key>PayloadType</key>
            <string>com.apple.vpn.managed</string>
            <key>PayloadUUID</key>
            <string>D758D99C-7CCE-44DC-8CAE-B2A5FFC86985</string>
            <key>PayloadVersion</key>
            <integer>1</integer>
            <key>Proxies</key>
            <dict/>
            <key>UserDefinedName</key>
            <string>*VPN My-HOME*</string>
            <key>VPNType</key>
            <string>IPSec</string>
        </dict>
    </array>
    <key>PayloadDescription</key>
    <string>*VPN provisioning for My-HOME*</string>
    <key>PayloadDisplayName</key>
    <string>*MY-HOME*</string>
    <key>PayloadIdentifier</key>
    <string>*com.myhome.pt*</string>
    <key>PayloadOrganization</key>
    <string>*MY-HOME*</string>
    <key>PayloadRemovalDisallowed</key>
    <false/>
    <key>PayloadType</key>
    <string>Configuration</string>
    <key>PayloadUUID</key>
    <string>A8E086BE-C9B1-4EA8-9E6A-F25001E0A293</string>
    <key>PayloadVersion</key>
    <integer>1</integer>
</dict>
</plist>

As you correctly suspect, there are downsides to this approach. While the connect on demand profile is active, the regular wake ups for fetching data seem not be done (at least until iOS 9, still have to test iOS 10), and as such FaceTime calls are not always received while the device is "sleeping").

The Apple documentation about this directives is here. "IPSec Dictionary Keys" is of particular interest.

  • Thanks. Now I assume, a regular VPN service that only supports the OpenVPN protocol would not work with this solution? Also, is this guaranteed to be leak-free, even during startup or while switching to a different network? – oaiwjefj Aug 12 '16 at 10:55
  • The native client does not support OpenVPN, and always on demand only affects the native client. It appears to be leak free, I also have tested it with tcpdump in my router at home. – Rui F Ribeiro Aug 12 '16 at 10:57
  • (added the downsides and link to apple dev site link to the answer) – Rui F Ribeiro Aug 12 '16 at 11:01
0

Yes you need IKEv2 and your iDevice need to be supervised by a mac. Always on VPN and on demand is not the same.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .