Always-On VPN on iPhone: What On-Demand Really Gives You

An iPhone can't do a true always-on VPN in the way Android can — not on a normal, personal device. What iOS gives you instead is Connect On Demand, a feature that automatically reconnects the VPN whenever your iPhone has an internet connection. It's close to always-on in practice, but it works by re-establishing the tunnel rather than by blocking traffic when the tunnel is down, and that difference is worth understanding before you rely on it.

Why iPhone has no traffic-blocking kill switch

iOS doesn't expose a user-facing kill switch because Apple doesn't let third-party VPN apps hard-block all device traffic the way Android's operating system can. On a personal iPhone, the closest a consumer app can get is Connect On Demand rules, which the app installs as part of its VPN configuration. A genuine "block everything unless the VPN is up" mode does exist on iOS, but only as a supervised/managed-device feature configured through Mobile Device Management — the kind of setup a company or school pushes to a fleet of phones, not something you toggle at home. For everyday users, on-demand is the tool you have.

What Connect On Demand actually protects

Connect On Demand keeps you covered for the situations most people worry about: joining a new Wi-Fi network, waking the phone, or switching between Wi-Fi and cellular. In each case iOS re-triggers the VPN, so the tunnel is re-established quickly and your traffic goes back through it. For a phone that's constantly moving between networks, that's most of the value of always-on. The honest caveat is timing: there can be a very brief window during a network change where a packet or two slips out before the tunnel is back. For ordinary privacy needs that's a minor gap; for a threat model where a single leaked request is unacceptable, iOS isn't the right platform and a managed configuration is required.

How to turn on always-on behaviour on iPhone

Most good VPN apps set this up for you with a single toggle. Open your VPN app's settings and look for "Connect On Demand", "Auto-connect", or "Always-on" — different apps label it differently. Turn it on, and choose whether it should apply to all networks or only untrusted Wi-Fi. Some apps let you mark your home network as trusted so the VPN doesn't run there. If your app installs an on-demand rule, iOS will handle the reconnection automatically from then on. You can confirm the configuration exists under Settings, General, VPN & Device Management.

• In the VPN app, enable Connect On Demand or Auto-connect.
• Choose all networks, or untrusted Wi-Fi only, depending on how aggressive you want it.
• Optionally mark your home Wi-Fi as trusted so the tunnel doesn't run there.

When it keeps turning itself back on

If you're trying to disconnect and the VPN keeps coming back, on-demand is doing exactly what you told it to. To actually turn it off, disable Connect On Demand or Auto-connect in the app first, then disconnect — otherwise iOS reconnects within seconds. This is the most common source of the "my iPhone VPN won't turn off" complaint, and it's a setting, not a bug. Our guide to what a VPN is on your iPhone covers the on/off basics if you want the full picture.

Which iPhone VPNs handle on-demand best

In practice the polished mainstream apps set on-demand up cleanly and reconnect quickly after a network change, which is the whole game on a phone that's always moving. The apps we recommend in our best VPNs for iPhone and Android roundup all support it, and pairing on-demand with a WireGuard-style protocol gives you the fastest reconnection and the least battery cost. Just don't expect any iPhone app to fully match Android's hard, traffic-blocking kill switch — that's an operating-system limit, not an app one.

All networks, or untrusted Wi-Fi only?

When you enable on-demand, most apps let you decide how aggressive it should be, and the right answer depends on why you're using a VPN. "All networks" keeps the tunnel up everywhere, including your home Wi-Fi and mobile data — the most protective option, and the one to pick if you want your carrier and every network kept out of your browsing. "Untrusted Wi-Fi only" runs the VPN when you join unfamiliar networks but stands down on networks you've marked as trusted, which saves battery and avoids VPN-related hiccups at home. For most people, connecting on untrusted Wi-Fi while leaving mobile data untouched is a sensible middle ground; privacy-focused users who don't want their carrier logging domains will prefer all networks. There's no single correct choice — it's a trade between coverage and convenience.

Why it sometimes still shows a brief disconnect

Even with on-demand set up well, you may occasionally glimpse the VPN badge disappear for a second when your iPhone changes networks or wakes from deep sleep, before it reconnects. That's the expected behaviour of a reconnect-based system rather than a fault, and it's the honest limitation to keep in mind: on-demand re-establishes the tunnel quickly, but it doesn't freeze your traffic in the meantime the way Android's block-connections setting does. For everyday privacy this gap is trivial. If your situation is one where a single unencrypted request could genuinely put you at risk, an ordinary iPhone isn't the tool — that calls for a managed device with an enforced always-on policy, or a different platform entirely. Being clear about that is more useful than pretending iOS on-demand is a hard kill switch.