Configure IKEv2 VPN with always-on

Question

Created Jun ’20

Replies 7

Boosts 0

Views 2.4k

Participants 3

I want to let my users configure IKEv2 VPN with always-on. I know this is possible using Apple Configurator + the native system's IKEv2 VPN.

But I want to have a "wrapper" app - some values will be defined at the Apple Configurator, and other values will be defined at my app, which will trigger the system's IKEv2.
Is it possible to use VPN payload for a 'personal' VPN app (without Packet Tunnel Provider)?

Is it possible to do it with the VPN payload for 'Custom SSL'?
Can I create an app, that creates a 'Personal VPN' of type IKEv2, gets the payload from Apple Configurator, sets some values, and starts the VPN? If yes, is it possible to configure the always-on in this case?

Or is the 'Custom SSL' is meant only for 'Packet Tunnel Providers' (and then I can't have always-on)?

Answered by Engineer in 613354022

Currently, AlwaysON VPN is only supported on supervised iOS devices. It is configuration profile based only, and is limited to the built-in IKEv2 provider. There is no app-based customization support.

It sounds like you want to have your own app with your own custom SSL provider, but with the alwaysOn-VPN-like behavior (forcing all traffic onto tunnel to avoid traffic leakage).

On iOS 14, check out the new key, includeAllNetworks, in the NEVPNProtocol.h file. If VPN is enabled and this includeAllNetworks is set, VPN will make sure all traffic must be tunneled. If tunnel is not up yet, all traffic will be dropped. If tunnel is enabled manually, this key will continuously keep the tunnel up. If tunnel is onDemand, then tunnel will be brought up by onDemand.

https://developer.apple.com/documentation/networkextension/nevpnprotocol/3131931-includeallnetworks

Boost

Answer 1

Systems Engineer OP

Apple

Jun ’20

Is this a MDM managed app because VPN.AlwaysOn is a MDM specific key and is not supported outside the context of managed devices?

Matt Eaton
DTS Engineering, CoreOS
xxxxxx@xxxxx.com

1

Answer 2

Systems Engineer OP

Apple

Jun ’20

Here is the documentation link for the VPN.AlwaysOn profile specific payload is key.

Matt Eaton
DTS Engineering, CoreOS
meaton@apple.com

0

Answer 3

Engineer OP

Apple

Jun ’20

Accepted Answer

Currently, AlwaysON VPN is only supported on supervised iOS devices. It is configuration profile based only, and is limited to the built-in IKEv2 provider. There is no app-based customization support.

It sounds like you want to have your own app with your own custom SSL provider, but with the alwaysOn-VPN-like behavior (forcing all traffic onto tunnel to avoid traffic leakage).

On iOS 14, check out the new key, includeAllNetworks, in the NEVPNProtocol.h file. If VPN is enabled and this includeAllNetworks is set, VPN will make sure all traffic must be tunneled. If tunnel is not up yet, all traffic will be dropped. If tunnel is enabled manually, this key will continuously keep the tunnel up. If tunnel is onDemand, then tunnel will be brought up by onDemand.

https://developer.apple.com/documentation/networkextension/nevpnprotocol/3131931-includeallnetworks

2

Answer 4

roee84 OP

Jun ’20

Thanks for both of you for the answers!

And regarding to 'includeAllNetworks' - it sounds similar to always-on, but I want to force the user to always use the VPN, or he won't have traffic, but without letting him the option to disable this behaviour (so he won't be able to uncheck the on-demand for example). Is it possible? This way it will behave just like always-on when the user is not allowed to stop automatic connections.

0

Answer 5

roee84 OP

Jun ’20

And 'one more thing' ;) - the above questions I asked are relevant both for iOS and macOS

0

Answer 6

Engineer OP

Apple

Jun ’20

For AlwaysON VPN, to lock down the VPN, the iOS device is supervised and the AlwaysON VPN profile will be marked as non-removable by user. There is no UI option for user to turn off the VPN to allow traffic to pass.

With VPN IncludeAllNetworks, you can put the device in supervised mode and also marked the profile as non-removable. But the VPN UI will allow the user to turn the VPN on/off, allowing users to bypass VPN. Sounds like you need an option to disallow user to be able to turn off VPN via UI. Please file a radar for the request.

1

Answer 7

roee84 OP

Jun ’20

Thanks for the answer, I've submitted a feedback - FB7772323

0