Private Orchards

Always-On VPN on iPhone: Three Ways to Keep It Connected

A VPN only helps while it's connected. Here are three ways to keep one on an iPhone, what a kill switch really does, and where every option leaks.

Your iPhone Encrypted tunnel Your Wi-Fi or carrier sees only that you use a VPN VPN server Websites

Whenever your iPhone joins a network, someone else can see where your traffic goes. On cellular, that’s your carrier. On café or hotel Wi-Fi, it’s whoever runs the network. Every site you visit also sees your IP address, which shows roughly where you are and links your visits together over time.

A VPN changes who can see that. Your traffic travels through an encrypted tunnel to the VPN provider, so your network only sees “this phone talks to a VPN”. The trade-off: you now trust the VPN provider instead of your network. Choose one with independent audits and a clear track record.

The catch is that a VPN only protects you while it’s connected. Phones switch networks constantly, from home Wi-Fi to cellular to a hotel captive portal. A tunnel that quietly drops for thirty seconds can leak exactly the traffic you cared about. That’s why always-on and a kill switch matter more than which server you pick.

What a kill switch does (and doesn’t)

A kill switch blocks internet traffic when the VPN drops, so apps can’t fall back to your normal connection. On iPhone it helps, but it isn’t perfect: since iOS 16.1, some Apple services can still reach the internet outside the tunnel, even with a kill switch on. Treat any iPhone VPN as mostly sealed, not leak-proof.

VPN connected iPhone VPN server Traffic goes through the tunnel VPN drops, kill switch on iPhone VPN server Traffic is blocked until it reconnects VPN drops, no kill switch iPhone Your network Traffic leaks over your usual network Even with a kill switch, some Apple services can bypass the tunnel (iOS 16.1+).
What happens to your traffic when the tunnel drops.

One side effect: kill switches that use Apple’s “include all networks” setting can make Personal Hotspot unavailable while the VPN is on.

Here are three ways to set it up, from easiest to most hands-on.

Option A: The Proton VPN app with its kill switch

This is the right choice for most people. Proton VPN has a usable free tier, open-source apps and independent audits, and its app is the only option here with a real kill switch.

  1. Install Proton VPN, sign in, tap Connect, and allow the VPN configuration.
  2. In the app, go to Settings → Security Options and turn on Kill switch.

There’s no separate always-on switch to find: it’s built into the iOS app.

The trade-offs: the current kill switch also blocks devices on your local network, such as printers and casting to a TV. Proton says its beta improves this and adds an Advanced kill-switch mode that blocks more traffic when the tunnel drops. The app needs iOS 17 or later.

Option B: The WireGuard app with On-Demand

If you’d rather use the small, open-source WireGuard app, or your iPhone can’t run the Proton app, load a WireGuard configuration file from your VPN provider instead.

  1. Install the official WireGuard app.
  2. In a browser, sign in to your VPN account and download a WireGuard .conf file. Proton offers these in its account dashboard.
  3. In WireGuard, tap Add a tunnel → Create from file or archive, choose the file and allow it.
  4. Edit the tunnel and, under On-Demand Activation, turn on Cellular and Wi-Fi.

On-Demand brings the tunnel back on every network, so in practice it stays up. But there’s no kill switch: if the tunnel fails, nothing stops your traffic. Each file also connects to the one server you chose, so to change location, download another file.

Option C: No app at all (manual IKEv2)

iOS has a built-in VPN client, so you can set up an IKEv2 connection in Settings without installing anything. It’s tidy, but it’s the most limited option. Proton no longer supports IKEv2 on iPhone. IVPN still documents a manual setup, which needs a paid account.

  1. Pick a server from IVPN’s server list. The IKEv2 servers have gw in the name.
  2. Go to Settings → General → VPN & Device Management → VPN → Add VPN Configuration.
  3. Set Type to IKEv2, then enter the server, remote ID and account details from IVPN’s setup page.
  4. Tap Done and switch the VPN on.

Know the limits before you rely on it:

  • No kill switch. If the VPN drops, traffic flows normally.
  • Don’t count on it reconnecting. Neither Apple nor IVPN documents an on-demand option for a VPN you add by hand, so after a network change, check that it’s still on.
  • Apple services can leak outside the tunnel, as with every option here.

iPhone also can’t open .ovpn files on its own. OpenVPN configs always need an OpenVPN app.

The OSINT angle

Your IP address is one of the strongest links between your accounts. Log in to a forum, a shopping site and a burner social profile from home, and they all share the same address. A VPN breaks that link, but only if the tunnel is up every time. That’s the whole point of always-on.

A VPN doesn’t make you anonymous, though. If you sign in with the same email, phone number or browser everywhere, your accounts are still easy to connect. Pair it with email aliases and a tidy browser, and it does a lot more.

All posts · RSS feed