{"id":18,"date":"2026-04-23T13:45:40","date_gmt":"2026-04-23T13:45:40","guid":{"rendered":"https:\/\/opsecinsider.com\/?p=18"},"modified":"2026-04-23T13:47:56","modified_gmt":"2026-04-23T13:47:56","slug":"mullvad-to-add-feature-that-forces-all-ios-traffic-through-the-vpn-tunnel","status":"publish","type":"post","link":"https:\/\/opsecinsider.com\/?p=18","title":{"rendered":"Mullvad to add feature that forces all iOS traffic through the VPN tunnel"},"content":{"rendered":"\n<p>Mullvad has announced a new feature that forces all iOS app traffic through its VPN tunnel, accepting significant usability trade-offs to close long-standing traffic leak risks caused by Apple\u2019s networking limitations.<\/p>\n\n\n\n<p>The VPN provider&nbsp;<a href=\"https:\/\/mullvad.net\/en\/blog\/force-all-app-traffic-into-the-tunnel\" target=\"_blank\" rel=\"noreferrer noopener\">explained<\/a>&nbsp;that unresolved issues in Apple\u2019s NetworkExtension framework have prevented it from fully securing its iOS app for over a year. Despite previously holding back on enabling Apple\u2019s includeAllNetworks flag due to severe side effects, Mullvad now says it has implemented safeguards that allow it to roll out the feature in a controlled manner. The new option, called \u201cForce all apps,\u201d will soon be available in its iOS client and is designed to ensure that all device traffic is routed exclusively through the VPN tunnel.<\/p>\n\n\n\n<blockquote class=\"twitter-tweet\"><p lang=\"en\" dir=\"ltr\">Apple&#39;s networking stack is preventing the iOS app from being as secure as possible, we have now secured our app to mitigate this despite the rough edges around the update procedure.<br><br>Read more here: <a href=\"https:\/\/t.co\/sbX72s2O7m\">https:\/\/t.co\/sbX72s2O7m<\/a><\/p>&mdash; Mullvad.net (@mullvadnet) <a href=\"https:\/\/twitter.com\/mullvadnet\/status\/2046854293219635560?ref_src=twsrc%5Etfw\">April 22, 2026<\/a><\/blockquote> <script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\"><\/blockquote>\n\n\n\n<p>Mullvad\u2019s engineers\u00a0had earlier documented\u00a0how enabling includeAllNetworks=true could cause critical failures during app updates, effectively breaking the device\u2019s networking stack. When triggered, the issue causes the VPN to disconnect while simultaneously preventing the App Store from downloading updates, leaving users without internet access until a reboot. This behavior creates a loop in which the system repeatedly attempts to update the app and fails, locking users into a cycle of connectivity loss.<\/p>\n\n\n\n<p>Mullvad is a Swedish\u00a0VPN provider\u00a0known for its strict no-logs policy and transparency-focused approach, offering open-source clients across major platforms. The company has built a reputation for prioritizing privacy over convenience, often implementing experimental defenses such as quantum-resistant tunneling and advanced traffic obfuscation techniques.<\/p>\n\n\n\n<p>Mullvad says it is no longer willing to delay stronger protections, even if the user experience suffers. The upcoming \u201cForce all apps\u201d feature deliberately enables the problematic includeAllNetworks configuration, ensuring that even system-level and Apple-specific traffic cannot bypass the VPN. To mitigate the update-loop issue, the app will now notify users before automatic updates occur, allowing them to take preventive action.<\/p>\n\n\n\n<p>However, the workaround introduces friction. Users must either disconnect the VPN before updating the app or temporarily disable the \u201cForce all apps\u201d feature. In both cases, Mullvad warns that traffic may leak during the update process, as no reliable workaround exists to maintain full tunnel enforcement during updates. Additionally, a subset of users may still encounter a broken networking stack, requiring manual recovery steps such as rebooting the device.<\/p>\n\n\n\n<p>Another unresolved limitation involves the VPN tunnel process itself. With includeAllNetworks enabled, Mullvad\u2019s tunnel cannot properly bind sockets to the tunnel interface due to iOS restrictions. To address this, the company continues to rely on a userspace networking implementation, allowing it to generate TCP and ICMP traffic internally without depending on the system\u2019s networking stack.<\/p>\n\n\n\n<p>Mullvad acknowledges that its decision may expose more users to Apple\u2019s underlying bugs, but hopes that increased visibility and user feedback will pressure Apple to address the issues at the platform level. The company explicitly encourages affected users to submit feedback reports to Apple to help drive a resolution.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Mullvad has announced a new feature that forces all iOS app traffic through its VPN tunnel, accepting significant usability trade-offs to close&hellip;<\/p>\n","protected":false},"author":1,"featured_media":19,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_uag_custom_page_level_css":"","footnotes":""},"categories":[3],"tags":[],"class_list":["post-18","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-privacy"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v27.4 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>Mullvad to add feature that forces all iOS traffic through the VPN tunnel - OpSec Insider<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/opsecinsider.com\/?p=18\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Mullvad to add feature that forces all iOS traffic through the VPN tunnel - OpSec Insider\" \/>\n<meta property=\"og:description\" content=\"Mullvad has announced a new feature that forces all iOS app traffic through its VPN tunnel, accepting significant usability trade-offs to close&hellip;\" \/>\n<meta property=\"og:url\" content=\"https:\/\/opsecinsider.com\/?p=18\" \/>\n<meta property=\"og:site_name\" content=\"OpSec Insider\" \/>\n<meta property=\"article:published_time\" content=\"2026-04-23T13:45:40+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-04-23T13:47:56+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/opsecinsider.com\/wp-content\/uploads\/2026\/04\/Mullvad-to-add-feature-that-forces-all-iOS-traffic-through-the-VPN-tunnel.png\" \/>\n\t<meta property=\"og:image:width\" content=\"950\" \/>\n\t<meta property=\"og:image:height\" content=\"500\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"vladkotov\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@arvssianboy\" \/>\n<meta name=\"twitter:site\" content=\"@arvssianboy\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"vladkotov\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/opsecinsider.com\\\/?p=18#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/opsecinsider.com\\\/?p=18\"},\"author\":{\"name\":\"vladkotov\",\"@id\":\"https:\\\/\\\/opsecinsider.com\\\/#\\\/schema\\\/person\\\/5e168fb0dde4bab8595e2597dfbde496\"},\"headline\":\"Mullvad to add feature that forces all iOS traffic through the VPN tunnel\",\"datePublished\":\"2026-04-23T13:45:40+00:00\",\"dateModified\":\"2026-04-23T13:47:56+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/opsecinsider.com\\\/?p=18\"},\"wordCount\":541,\"commentCount\":0,\"image\":{\"@id\":\"https:\\\/\\\/opsecinsider.com\\\/?p=18#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/opsecinsider.com\\\/wp-content\\\/uploads\\\/2026\\\/04\\\/Mullvad-to-add-feature-that-forces-all-iOS-traffic-through-the-VPN-tunnel.png\",\"articleSection\":[\"Privacy\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/opsecinsider.com\\\/?p=18#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/opsecinsider.com\\\/?p=18\",\"url\":\"https:\\\/\\\/opsecinsider.com\\\/?p=18\",\"name\":\"Mullvad to add feature that forces all iOS traffic through the VPN tunnel - OpSec Insider\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/opsecinsider.com\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/opsecinsider.com\\\/?p=18#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/opsecinsider.com\\\/?p=18#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/opsecinsider.com\\\/wp-content\\\/uploads\\\/2026\\\/04\\\/Mullvad-to-add-feature-that-forces-all-iOS-traffic-through-the-VPN-tunnel.png\",\"datePublished\":\"2026-04-23T13:45:40+00:00\",\"dateModified\":\"2026-04-23T13:47:56+00:00\",\"author\":{\"@id\":\"https:\\\/\\\/opsecinsider.com\\\/#\\\/schema\\\/person\\\/5e168fb0dde4bab8595e2597dfbde496\"},\"breadcrumb\":{\"@id\":\"https:\\\/\\\/opsecinsider.com\\\/?p=18#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/opsecinsider.com\\\/?p=18\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/opsecinsider.com\\\/?p=18#primaryimage\",\"url\":\"https:\\\/\\\/opsecinsider.com\\\/wp-content\\\/uploads\\\/2026\\\/04\\\/Mullvad-to-add-feature-that-forces-all-iOS-traffic-through-the-VPN-tunnel.png\",\"contentUrl\":\"https:\\\/\\\/opsecinsider.com\\\/wp-content\\\/uploads\\\/2026\\\/04\\\/Mullvad-to-add-feature-that-forces-all-iOS-traffic-through-the-VPN-tunnel.png\",\"width\":950,\"height\":500},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/opsecinsider.com\\\/?p=18#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/opsecinsider.com\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Mullvad to add feature that forces all iOS traffic through the VPN tunnel\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/opsecinsider.com\\\/#website\",\"url\":\"https:\\\/\\\/opsecinsider.com\\\/\",\"name\":\"OPSEC Insider\",\"description\":\"vladkotov\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/opsecinsider.com\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/opsecinsider.com\\\/#\\\/schema\\\/person\\\/5e168fb0dde4bab8595e2597dfbde496\",\"name\":\"vladkotov\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/3e539f0f106723b9f6f0a29a5bde2bf62d893d253c9f5bc13633db871ce400dc?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/3e539f0f106723b9f6f0a29a5bde2bf62d893d253c9f5bc13633db871ce400dc?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/3e539f0f106723b9f6f0a29a5bde2bf62d893d253c9f5bc13633db871ce400dc?s=96&d=mm&r=g\",\"caption\":\"vladkotov\"},\"sameAs\":[\"https:\\\/\\\/opsecinsider.com\"],\"url\":\"https:\\\/\\\/opsecinsider.com\\\/?author=1\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Mullvad to add feature that forces all iOS traffic through the VPN tunnel - OpSec Insider","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/opsecinsider.com\/?p=18","og_locale":"en_US","og_type":"article","og_title":"Mullvad to add feature that forces all iOS traffic through the VPN tunnel - OpSec Insider","og_description":"Mullvad has announced a new feature that forces all iOS app traffic through its VPN tunnel, accepting significant usability trade-offs to close&hellip;","og_url":"https:\/\/opsecinsider.com\/?p=18","og_site_name":"OpSec Insider","article_published_time":"2026-04-23T13:45:40+00:00","article_modified_time":"2026-04-23T13:47:56+00:00","og_image":[{"width":950,"height":500,"url":"https:\/\/opsecinsider.com\/wp-content\/uploads\/2026\/04\/Mullvad-to-add-feature-that-forces-all-iOS-traffic-through-the-VPN-tunnel.png","type":"image\/png"}],"author":"vladkotov","twitter_card":"summary_large_image","twitter_creator":"@arvssianboy","twitter_site":"@arvssianboy","twitter_misc":{"Written by":"vladkotov","Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/opsecinsider.com\/?p=18#article","isPartOf":{"@id":"https:\/\/opsecinsider.com\/?p=18"},"author":{"name":"vladkotov","@id":"https:\/\/opsecinsider.com\/#\/schema\/person\/5e168fb0dde4bab8595e2597dfbde496"},"headline":"Mullvad to add feature that forces all iOS traffic through the VPN tunnel","datePublished":"2026-04-23T13:45:40+00:00","dateModified":"2026-04-23T13:47:56+00:00","mainEntityOfPage":{"@id":"https:\/\/opsecinsider.com\/?p=18"},"wordCount":541,"commentCount":0,"image":{"@id":"https:\/\/opsecinsider.com\/?p=18#primaryimage"},"thumbnailUrl":"https:\/\/opsecinsider.com\/wp-content\/uploads\/2026\/04\/Mullvad-to-add-feature-that-forces-all-iOS-traffic-through-the-VPN-tunnel.png","articleSection":["Privacy"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/opsecinsider.com\/?p=18#respond"]}]},{"@type":"WebPage","@id":"https:\/\/opsecinsider.com\/?p=18","url":"https:\/\/opsecinsider.com\/?p=18","name":"Mullvad to add feature that forces all iOS traffic through the VPN tunnel - OpSec Insider","isPartOf":{"@id":"https:\/\/opsecinsider.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/opsecinsider.com\/?p=18#primaryimage"},"image":{"@id":"https:\/\/opsecinsider.com\/?p=18#primaryimage"},"thumbnailUrl":"https:\/\/opsecinsider.com\/wp-content\/uploads\/2026\/04\/Mullvad-to-add-feature-that-forces-all-iOS-traffic-through-the-VPN-tunnel.png","datePublished":"2026-04-23T13:45:40+00:00","dateModified":"2026-04-23T13:47:56+00:00","author":{"@id":"https:\/\/opsecinsider.com\/#\/schema\/person\/5e168fb0dde4bab8595e2597dfbde496"},"breadcrumb":{"@id":"https:\/\/opsecinsider.com\/?p=18#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/opsecinsider.com\/?p=18"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/opsecinsider.com\/?p=18#primaryimage","url":"https:\/\/opsecinsider.com\/wp-content\/uploads\/2026\/04\/Mullvad-to-add-feature-that-forces-all-iOS-traffic-through-the-VPN-tunnel.png","contentUrl":"https:\/\/opsecinsider.com\/wp-content\/uploads\/2026\/04\/Mullvad-to-add-feature-that-forces-all-iOS-traffic-through-the-VPN-tunnel.png","width":950,"height":500},{"@type":"BreadcrumbList","@id":"https:\/\/opsecinsider.com\/?p=18#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/opsecinsider.com\/"},{"@type":"ListItem","position":2,"name":"Mullvad to add feature that forces all iOS traffic through the VPN tunnel"}]},{"@type":"WebSite","@id":"https:\/\/opsecinsider.com\/#website","url":"https:\/\/opsecinsider.com\/","name":"OPSEC Insider","description":"vladkotov","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/opsecinsider.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/opsecinsider.com\/#\/schema\/person\/5e168fb0dde4bab8595e2597dfbde496","name":"vladkotov","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/3e539f0f106723b9f6f0a29a5bde2bf62d893d253c9f5bc13633db871ce400dc?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/3e539f0f106723b9f6f0a29a5bde2bf62d893d253c9f5bc13633db871ce400dc?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/3e539f0f106723b9f6f0a29a5bde2bf62d893d253c9f5bc13633db871ce400dc?s=96&d=mm&r=g","caption":"vladkotov"},"sameAs":["https:\/\/opsecinsider.com"],"url":"https:\/\/opsecinsider.com\/?author=1"}]}},"uagb_featured_image_src":{"full":["https:\/\/opsecinsider.com\/wp-content\/uploads\/2026\/04\/Mullvad-to-add-feature-that-forces-all-iOS-traffic-through-the-VPN-tunnel.png",950,500,false],"thumbnail":["https:\/\/opsecinsider.com\/wp-content\/uploads\/2026\/04\/Mullvad-to-add-feature-that-forces-all-iOS-traffic-through-the-VPN-tunnel-150x150.png",150,150,true],"medium":["https:\/\/opsecinsider.com\/wp-content\/uploads\/2026\/04\/Mullvad-to-add-feature-that-forces-all-iOS-traffic-through-the-VPN-tunnel-300x158.png",300,158,true],"medium_large":["https:\/\/opsecinsider.com\/wp-content\/uploads\/2026\/04\/Mullvad-to-add-feature-that-forces-all-iOS-traffic-through-the-VPN-tunnel-768x404.png",768,404,true],"large":["https:\/\/opsecinsider.com\/wp-content\/uploads\/2026\/04\/Mullvad-to-add-feature-that-forces-all-iOS-traffic-through-the-VPN-tunnel.png",950,500,false],"1536x1536":["https:\/\/opsecinsider.com\/wp-content\/uploads\/2026\/04\/Mullvad-to-add-feature-that-forces-all-iOS-traffic-through-the-VPN-tunnel.png",950,500,false],"2048x2048":["https:\/\/opsecinsider.com\/wp-content\/uploads\/2026\/04\/Mullvad-to-add-feature-that-forces-all-iOS-traffic-through-the-VPN-tunnel.png",950,500,false],"opsecinsider-card":["https:\/\/opsecinsider.com\/wp-content\/uploads\/2026\/04\/Mullvad-to-add-feature-that-forces-all-iOS-traffic-through-the-VPN-tunnel.png",800,421,false],"opsecinsider-square":["https:\/\/opsecinsider.com\/wp-content\/uploads\/2026\/04\/Mullvad-to-add-feature-that-forces-all-iOS-traffic-through-the-VPN-tunnel.png",200,105,false]},"uagb_author_info":{"display_name":"vladkotov","author_link":"https:\/\/opsecinsider.com\/?author=1"},"uagb_comment_info":0,"uagb_excerpt":"Mullvad has announced a new feature that forces all iOS app traffic through its VPN tunnel, accepting significant usability trade-offs to close&hellip;","_links":{"self":[{"href":"https:\/\/opsecinsider.com\/index.php?rest_route=\/wp\/v2\/posts\/18","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/opsecinsider.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/opsecinsider.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/opsecinsider.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/opsecinsider.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=18"}],"version-history":[{"count":3,"href":"https:\/\/opsecinsider.com\/index.php?rest_route=\/wp\/v2\/posts\/18\/revisions"}],"predecessor-version":[{"id":23,"href":"https:\/\/opsecinsider.com\/index.php?rest_route=\/wp\/v2\/posts\/18\/revisions\/23"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/opsecinsider.com\/index.php?rest_route=\/wp\/v2\/media\/19"}],"wp:attachment":[{"href":"https:\/\/opsecinsider.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=18"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/opsecinsider.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=18"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/opsecinsider.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=18"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}