Since iOS 8 has been released, Apple has been working on making it easier to use VPN via the iPhone. However, the Always-On VPN mode allows you to force all of your apps to connect via the VPN. The problem is the feature is hidden; therefore, it is difficult to access via the normal methods. That being said, taking the time to configure your iPhone to Always-On VPN mode is a great way to keep your phone safe regardless of what network you are connected to.
What is Needed
Unfortunately, you are not able to simply go to your settings menu on your iPhone and flip a switch. The reality is you need a specific VPN for iPhone and your iPhone will have to be in what’s calledwill have to be in what’s called “Supervised Mode.” At that point, the only way that this option can be selection is through a mobile device management server or a configuration profile. Here are the different things you need in order to make Always-On VPN work.
- IKEv2 VPN: The iPhone requires this type of VPN whether you are setting up your own server or not. The reality is this is the type of system that works on the Mac OS varieties. An example of this type of VPN is StrongSwan. The open source VPNs like this one support the IKEv2 protocol, which is a bit different than the Windows protocols.
- Supervised iPad: As stated above, you need to have your iPhone in a “supervised” mode and that does require you to completely reset your iPhone, unfortunately. That said, once you get that done, running the VPN in “Always-On” mode becomes fairly straightforward.
- Mobile Device Management Server/Configuration Profile: After the iPhone becomes supervised, the next step is using a profile created through Apple Configurator or the mobile device management server. The good part about the MDM is you can use remote access to activate the option if you already have your iPhone managed this way.
Supervise iPhone and then Install the Profile
The first step is to supervise your iPhone, You will need a Mac for this. The first thing to do is in the iCloud settings, be sure to disable the “Find My iPhone” setting. Failure to do so will result in error messages and a lack of device supervision.
Before you get ready to Supervise your iPhone, make sure to back up everything onto iTunes. Your iPhone’s storage will get wiped. Having a backup is critical to using the iPhone the way you want with Always-On VPN.
Once that is done, connect the iPhone to the Mac and open Apple Configurator. Name the device, e.g. “Dave’s iPhone” and flip the “Supervision” slider into the On position. At this point, click the Organization Info button and then create a name for your organization. After that is completed, select the Prepare button.
At this point, Apple Configurator will take over and supervise the device. This means there is a new iOS being copied and everything is being started from scratch. Your internet connection is the variable, so expect around 15-20 minutes for this process to complete.
Once that part of the process is done, just set up the iPhone normally including restoring it from an existing backup.
The way to do this is to head into Settings>General>Profile. It is at this point you will notice that your iPhone is now a Supervised device.
Always-On VPN Profile Creation
So now that your iPhone is supervised, we need to apply the Always-On VPN setting via the Configuration. The reality is you can’t simply create the profile and install it, unfortunately, but the good news is this is not too difficult to do.
Make your you have not disconnected your device from that same Mac you used at first. When looking at the Apple Configurator window, select the device that is connected, click on the + button at the bottom of the list of profiles, then click on “Create New Profile.”
The next step is heading over to the VPN category. This is where you go back to that connection referenced earlier. Find “Connection Type” and in that area choose IKEv2. This is when you can select the “Always-On VPN (Supervised Only)” setting. There is going to be some more information that you will have to complete, but the reality is the hard part is pretty much over – and it wasn’t that hard.
You will need to provide server and connection information that the VPN requires, and if there are certificates required by the server, just click the “Certificates” category and make sure that all of the certificates are provided so that you can get ready to use your iPhone with the VPN in the Always-On mode.
Now that the profile has been created and the VPN information has been provided, make sure to Enable It in the list and once that is done, select the Apply button and that will roll out the profile with the Always-On VPN will be sent out to the Supervised iPhone. Once you have selected apply, the iPhone connected to the Mac will be all set. Once this is done you can disconnect your iPhone from the Mac.
The one issue we have is that iOS does not allow other types of VPNs to be in the “Always-On” setting except for the IKEv2 indicated above. The good news is your iPhone will stay connected to a VPN when a screen is off, but the problem there is the Always-On setting keeps app data from getting sent over the typical data networks and Wi-Fi connections.
Always-On VPN is a great option for people who do not want their data being shared over these networks. Just having a VPN does not solve the problem, and that is why the “Always-On” mode is the ideal way to avoid this issue. It also means you have to have a Mac, and that only makes your iPhone that much more versatile.