VPN Setup

Set up Cloud1VPN on iOS with IKEv2/IPsec

Install or open the IKEv2 client, import your Cloud1VPN certificate profile, connect, and verify your public IP.

IKEv2/IPsec setup for iOS

Choose a VPN protocol

Before you begin

You need an active Cloud1VPN server configured for IKEv2/IPsec. Open My Servers and retrieve the issued certificate or configuration profile before importing it into your client.

Get your IKEv2/IPsec configuration

iOS setup

Connect with IKEv2/IPsec

Use iOS built-in VPN with the certificate and connection details generated for your Cloud1VPN server.

  1. Prepare iOS built-in VPN

    No additional app is required. iOS installs an IKEv2 configuration profile and client certificate through Settings.

    View the official IKEv2 client guidance

  2. Download your IKEv2 credentials

    Open My Servers and download the issued client certificate or configuration profile. Keep the private key and export password secure.

  3. Import the certificate and settings

    Open the issued profile, approve it in Settings, and confirm the IKEv2 VPN configuration using the values shown in Cloud1VPN.

  4. Connect

    Start the IKEv2 connection and confirm iOS trusts the Cloud1VPN server certificate and identity.

  5. Verify your connection

    Confirm the IKEv2 connection is active, then verify that your public IP matches the Cloud1VPN server.

    Open What's My IP?

Frequently Asked Questions

iOS IKEv2/IPsec setup & troubleshooting

Why is my client certificate not available to the VPN connection?

Finish installing the downloaded profile in Settings. If an older profile exists for the same server, remove it before installing the replacement so iOS does not select stale credentials. If the certificate has expired, lacks its private key, or belongs to an earlier server deployment, download and import the current credential bundle.

What does a server identity or certificate-name mismatch mean?

The client expected one authenticated server name but received or was configured with another. Compare the server address and identity with the values in My Servers. Do not disable certificate validation or substitute an IP address unless the Cloud1VPN profile explicitly uses it as the identity.

Why does IKEv2 fail immediately after importing the profile?

Check the iOS date, time, and timezone first. Then confirm the full certificate chain and private key were imported and that the selected authentication method matches the issued profile. Clock and trust failures can stop the connection before a tunnel is created.

What do “authentication failed” or “no proposal chosen” mean?

Authentication failed usually points to the certificate, private key, identity, or stale credentials. No proposal chosen means the client and server did not agree on the IKE or IPsec settings. In either case, download a current profile rather than weakening or guessing the cryptographic settings.

IKEv2 says connected, but websites do not load. What should I check?

Disconnect other VPN and proxy software, reconnect IKEv2, and open What's My IP?. If the Cloud1VPN address appears but domains fail, check DNS. If no traffic works, check the installed routes and local firewall before replacing certificates.

Why is my normal public IP still visible?

The connection may not be using the default internet route, or another VPN may have higher priority. Confirm the imported Cloud1VPN profile is intended for full-tunnel access, disconnect competing profiles, and reconnect before testing again.

Why did IKEv2 stop working after a rebuild or relocation?

The previous profile can contain an obsolete server address, identity, or certificate. Remove the old VPN connection and its superseded client profile, then install the new configuration from My Servers instead of editing the old connection.

What should I send support for an IKEv2 problem?

Record the message shown in Settings and whether the failure happens on both Wi-Fi and cellular. Include the iOS version, Cloud1VPN server name, and time and timezone. Never send the private key, certificate export password, configuration profile, or account password.