Sudden Malfunction of iOS using ikev2 always on vpn. Cannot make or receive calls. Tested on multiple devices.

[sanketshahc]

Suddenly, cannot make calls on iphones with config profile....

A clear and concise description of what the bug is.

[sanketshahc]

So I think I've resolved this....if youre using Always On Vpn on ios, you need to add this to the vpn config dictionary:

<key>Tunnel Configurations</key>
.....

<key>ServiceExceptions</key>
	<array>
		<dict>
			<key>ServiceName</key>
			<string>CellularServices</string>
			<key>Action</key>
			<string>Allow</string>
		</dict>
	</array>

otherwise calls fail.

[dguido]

Thanks for reporting this issue and providing the solution! After researching Apple's Configuration Profile documentation and iOS VPN behavior, I can explain exactly what's happening and why your fix works.

Technical Background

The Problem

When using Always-On VPN with IKEv2 on iOS, all network traffic is routed through the VPN tunnel by default. However, some cellular networks cannot maintain data connections during voice calls, which causes the VPN to interfere with phone functionality.

Apple's Design Intent

According to Apple's documentation, certain system services are intentionally exempt from Always-On VPN by default, including:

• Voicemail
• AirPrint
• Cellular Services (voice calls)

However, in some configurations or network conditions, these built-in exceptions may not work properly, requiring explicit configuration.

Your Solution Explained

The ServiceExceptions configuration you added does the following:

<key>ServiceExceptions</key>
<array>
    <dict>
        <key>ServiceName</key>
        <string>CellularServices</string>
        <key>Action</key>
        <string>Allow</string>
    </dict>
</array>

What This Does:

1. Explicitly allows CellularServices to bypass the VPN tunnel
2. Ensures voice calls use direct cellular connection instead of routing through VPN
3. Maintains VPN protection for data traffic while preserving call functionality
4. Follows Apple's recommended practice for Always-On VPN configurations

Why It's Necessary:

• Some cellular networks drop data connections during voice calls
• Always-On VPN can conflict with this network behavior
• The explicit exception ensures proper voice call handling
• Prevents the VPN from pausing/resuming during calls

Current Algo Status

Our current mobileconfig templates do not include this ServiceExceptions configuration, which explains why you encountered this issue. Your solution aligns perfectly with Apple's documentation and best practices for Always-On VPN.

Security Impact

This change has minimal security impact:

• ✅ Data traffic still routes through VPN (web browsing, apps, etc.)
• ✅ VPN protection maintained for all non-voice services
• ✅ Only affects voice calls - allows direct cellular connection
• ✅ Follows Apple's design patterns for system service exceptions

Next Steps

We should consider adding this ServiceExceptions configuration to Algo's default mobileconfig templates to prevent other users from experiencing the same issue. This would make Always-On VPN more reliable while maintaining security.

Thank you for the detailed bug report and solution - this is exactly the kind of real-world feedback that helps improve Algo for everyone!