iPhone network question for you:

I have a VPN server at home to access my local LAN when not at home.
It works correctly from Windows, OSX, and Android.

When I connect to it using my iPhone VPN built-in client, my iPhone decides to route ALL traffic through that VPN tunnel. This is not a welcome behavior because my VPN server is configured NOT to route traffic back to the internet (that's not what my VPN server is there for), but to confine it to my LAN.
So, when connected to my LAN via my VPN server, the iPhone correctly reaches all local resources (i.e. file shares, cams, home automation various devices, etc.), but stops being able to go anywhere on the internet - so, no browsing, no email, no social media, no messaging of any sort.
Of course, by disconnecting from my VPN, all goes back to normal.

Not ideal.

My guess is that the iPhone stops using the correct gateways it must have in its routing table (WiFi's and/or Cellular Network).

Any suggestion on how to solve this? I can't even find a way in IOS to see the iPhone routing table. Let alone configure it.

Repeated searches online did not help much.

Thanks! And Happy 2020!


P.S.: I did, as an experiment, try reconfigure my VPN server to allow routing traffic to the internet, and it "worked", so to speak. My VPN server can push routes to the clients' routing tables, and the iPhone seems to get those. So I did, and my iPhone could access the internet via my home network/isp, of course; that had some side effects on Windows and OSX (did not test with Android) which I had to fix, but still, I don't particularly like the idea of hav ing my iphone route all Internet traffic through my home network and ISP when connected to the VPN.
Ideally, I'd like to simply configure the iPhone's routing table.

There is no direct access to the routing tables.

With some (one) of the built in VPN types you get an option to only route traffic destined for the remote LAN. The option is on the L2TP VPN type, called "Send All Traffic".

I've not used the two other builtin VPN types, but I'd always assumed that with those you could control the behaviour from the server end, like you can do with an OpenVPN setup.

I use OpenVPN endpoints and the OpenVPN iOS app for my VPN needs.

Unfortunately I don't see any change in behavior when I enable or disable the "Send All Traffic" option.

Just to provide more details, this is in short the behavior that I see in every non-iPhone VPN client I have used with my home VPN Server (SoftEther, FYI):
If I configure the server to push to clients routing table changes (defined by me server side), such changes will be added to the client routing table as expected.
If I configure the server NOT to push any route changes to clients, clients will simply retain their original routing table, also as expected.

In the case of the iPhone VPN client it seems to me (no way to find out, apparently, unless I find an app to show me) that
- it drops entirely its own original routing table
- it creates a new routing table entirely, which routes all traffic through the VPN tunnel AND, also, fortunately, includes all additional routes I push from server side, if I do push them.

Also, still to clarify further:

By combining the following two features:
- Pushing specific routing table changes to clients, server side.
- Using a feature in the SoftEther client that prevents such routing changes to be applied locally.

... I can in fact make sure that, when connected to my home VPN, routing changes only get used by the iPhone, so non-iPhone clients behave as desired, and the iPhone does reach the Internet - but ONLY through my VPN Server ->LAN -> Home ISP, which is what I'd like to avoid in the first place.

The “Send all traffic” option has definitely worked for me to toggle the behaviour when I’ve used L2TP links in the past. I’ve not needed it for a few years though, I’ve only used OpenVPN recently.

I don't know why it doesn't here.
When I first realized the iPhone was sending all traffic to the VPN tunnel I did assume I had that option enabled, but it wasn't. If I do enable it, no change.

I am looking for Apps to show me the active routing table on the iPhone. Maybe I'll get some clude there.

Thanks Andy anyway.

It could have something to do with "corporate" requirements. When businesses have remote employees, or people on the go, accessing the corporate VPNs, they tend to want to disable all non-VPN traffic. This avoids possibilities of malicious internet actors tunnelling through the remote machine, through the VPN, to inside of the corporate firewalls.

There may be some other setting or app on the device which is triggering this "corporate mode", so think about what that might be.

Cheers

It turns out you can still see the routing table and I already have an app installed that shows it.

https://apps.apple.com/gb/app/he-net-network-tools/id858241710

My wife has this problem. We have to connect her work laptop to our printer via usb as the local network access for printing is disabled.

-jk

I have been looking at the routing table via that App, and that is confusing to me.

So, here's more details for you guys to enjoy this puzzle.

To make it simpler, I disconnected my iPhone from the WIFi, and left it only connected to the cellular (LTE) network.
What you see below are the routing tables returned by the app before and after connecting to my home VPN.

I removed plenty of IPv6 entries for simplicity. Not sure they do have a role here. I wonder why IPv6 routes are there in the first place as I am not aware of anything needing IPv6 on my iPhone. They are more than the IPv4 entries below. So, that is a big question mark to me, at present.

Anyway, as to IPv4 entries:

No VPN.




VPN.


The above is very confusing to me.

10.60.x.x is mobile data link from my mobile isp (Wind Italy)

10.10.10.x/24 is my home LAN network.
10.10.11.x/24 is my VPN network
I decided to have the two above in two separate IP spaces back in the day when I configured my home VPN server.
VPN server routes from 10.10.11.x to 10.10.10.x and vice versa.

10.10.10.100 is my Gateway to the Internet for all clients in the 10.10.10.x/24 IP space (again, Home LAN).
10.10.11.1 is the VPN server and gateway for all clients in 10.10.11.x/24 IP space (VPN network).

So, VPN clients (including my iPhone) receive an IP in the 10.10.11.x space
They also receive the following two routes as they connect to my VPN server:
10.10.10.0/255.255.255.0/10.10.11.1 --> This to tell clients that they can access my LAN (10.10.10.x) via 10.10.11.1 .
0.0.0.0/0.0.0.0/10.10.10.100 --> This is to tell the clients that in order to access the Internet, they need to route through my home Gateway, in my LAN obviously. This route is designed for the iPhone specifically, otherwise there's no way the iPhone reaches the Internet while connected to my VPN.

For the records, this means that Windows or MacOS clients (and Android, I'd assume. Not tested) - but not the iPhone - would end up with two gateways for 0.0.0.0 (that is all traffic other than my home LAN). By configuring interface metrics, I can easily insure they do not use my home gateway (10.10.10.100) to get to the internet, and keep using whatever gateway they would use otherwise (my office network, or any other network I happen to be in).

Now, please notice that in the above iPhone routing tables I see no reference to 10.10.10.1 or 10.10.10.100 .
The two routes I push to the iPhone do not show.
But, I know they must be there somewhere, because:
- If I don't configure my VPN server to push the 10.10.10.0/255.255.255.0/10.10.11.1 route, my iPhone won't get to my home LAN
- If I don't configure my VPN server to push the 0.0.0.0/0.0.0.0/10.10.10.100 route, my iPhone won't get to the Internet.

So, they do affect the iPhone behavior. But, they do not show.

I suspect the app is not returning the routing table correctly. Or, I can't read it correctly.

Your second routing table (fifth line) sends 10/8 over ppp0. But 10/8 also matches your cell connection 10.60.x.y, so those packets get sent to your VPN instead. You should find whatever part of your VPN setup is advertising 10/8, and make it advertise 10.10/16 instead.

Basically your cell ISP and your VPN are fighting over who owns 10/8. If you can't straighten it out, you might need to change your VPN to use a different RFC1918 range e.g. 172.16/16.

Peter

Yes.

I have no idea where 10/8 is coming from. Curious that the iPhone seems to get it from my VPN server, while no other client does.

Edit:
I wonder if the use of 10.x.y/24 is somehow confusing for the iPhone. Maybe a bug makes the device only expect 10. to be used as /8 ?
I'll try few changes as you suggested Peter. I don't really care what IP space is used by my VPN setup, provided all is routed correctly.

I changed the VPN IP network to
192.168.11.0/255.255.255.0
192.168.11.1 is the Gaetway

My home LAN is of course unchanged: 10.10.10.0/255.255.255.0, 10.10.10.100 gateway.

I push to VPN client the following routes:

1) 10.10.10.0/255.255.255.0/192.168.11.1
2) 0.0.0.0/0.0.0.0/192.168.11.1

iPhone routing Table looks like this.

VPN-Change1


The two routes I push are not there, as far as I can see.

If I don't push the second one, the iPhone simply does not know how to get to the internet. I also noticed it is significantly slower in reaching what it does eventually reach inside my LAN, as if the first route I push was not there.

So, essentially, no change.

Also, I am guessing that the fact that my ISP is assigning me 10.x.x.x.x address and my home LAN is also 10.x.x.x.x is causing some confusion for the iPhone.

What happens if you pull your local 10./x subnets out of the vpn entirely? Could you set up a test network in one of the private 172 or 192 subnets with a local device or two on it?

-jk

Good idea. I am thinking of a quick way to do that and see what happens.

I also want to try to put the VPN subet in 10.10.10.x, so it is IN the LAN subnet. I'll have to work on client IP assignment (DHCP relaying maybe). And see what happens too.