VPN Not Working on iPhone or iPad after iOS 26? What Apple Removed, and the Fixes (2026)

A VPN that worked before an iOS update and does not after it is rarely a coincidence, and on iOS 26 it is usually not a bug either. Apple removed things on purpose, and the removals are the kind that produce a connection which simply never completes rather than an error explaining itself.

The removals that break old profiles

iOS 26 and iPadOS 26 dropped support for several legacy algorithms in the built-in VPN client. If a profile relies on 3DES, SHA-1 or Diffie-Hellman group 2, it will not connect through iOS' own IKEv2 or L2TP/IPsec support any more. macOS 26 did the same thing at the same time, which is why a Mac and an iPhone on the same corporate VPN often stopped working together.

• The symptom is a profile that spins at “Connecting” and returns to off, with nothing useful in Settings.
• Nothing on the device fixes it. The server has to offer a modern proposal — AES-GCM with SHA-256 and a group of 14 or higher.
• A third-party app with its own tunnel implementation is unaffected, because it does not use Apple's IKEv2 stack at all. That is the fastest workaround if the server cannot be changed.

“VPN configuration cannot be added” or the profile will not install

There was a genuine defect in the iOS 26 betas where adding a VPN configuration failed on any device with a passcode set — fixed before release, but the same message appears for several other reasons on shipping builds.

1. 1Check Settings → General → VPN & Device Management for an old configuration from the same provider and remove it. Two profiles competing for the same tunnel type is the most common cause.
2. 2If the device is supervised or managed by an employer, a configuration profile can forbid adding VPNs. It will not say so; installation simply fails.
3. 3Restart the device before trying again. The relevant daemon can get wedged after a failed install, and a second attempt then fails for a reason unrelated to the first.
4. 4Install the profile over Wi-Fi rather than mobile data if the provider serves it as a download — a partially fetched .mobileconfig fails with the same unhelpful message.

Connecting, disconnected, connecting: the on-demand loop

VPN On Demand asks iOS to bring the tunnel up automatically by network or by domain. When the session behind it expires — typically after about a day — some clients cannot re-establish it without a fresh login, and iOS keeps retrying instead of asking. You see the status alternate every few seconds with no prompt and no error.

1. 1Turn Connect On Demand off in the VPN entry, then connect manually once. If it comes straight up, the loop was an expired session rather than a broken configuration.
2. 2Sign out and back in inside the provider's app, so a new session is issued, before re-enabling on demand.
3. 3If your provider issues a subscription link rather than a login, re-import it — the profile may be pointing at an address that no longer answers.

That last point matters more than it sounds. A subscription link is fetched periodically and refreshed in the background, and a client that has not refreshed will keep dialling a server address that was retired weeks ago. How that mechanism works, and why re-importing is the standard first move, is in what a subscription link actually is.

iCloud Private Relay in the same lane

Private Relay is not a VPN, but it occupies similar ground: it sends Safari traffic and some DNS through Apple's relays. It is supposed to switch itself off when a VPN is active, and mostly does. When it does not, you get the confusing half-state where Safari resolves through Apple while everything else goes through your tunnel.

1. 1Settings → your name → iCloud → Private Relay — turn it off while testing.
2. 2Re-test the site that was misbehaving. If it now works, decide which of the two you want; running both adds nothing.

Low Data Mode and Wi-Fi Assist

Two settings that cause symptoms nobody attributes to them. Low Data Mode suspends background activity, which includes a VPN client refreshing its configuration or maintaining a tunnel while the screen is off. Wi-Fi Assist silently moves you to mobile data when Wi-Fi is weak — the network changes underneath the tunnel, and a client that does not handle the transition reconnects, or does not.

• Low Data Mode lives per network: Settings → Wi-Fi → (i) next to the network, and separately under Mobile Data → Mobile Data Options.
• Wi-Fi Assist is at the very bottom of Settings → Mobile Data.
• If the tunnel drops specifically when you leave the house or walk between rooms, this pair is the first suspect, not the server.

Reset Network Settings: what it actually does

It is the standard advice and it is often correct, but people are told to run it without being told what it costs. It clears every saved Wi-Fi network and password, all VPN configurations, cellular settings and DNS caches. It does not touch your apps, photos or accounts. After it, you will re-enter Wi-Fi passwords and re-add the VPN — so do it when you have those to hand, not on a train.

It is the right move when the device behaves inconsistently across networks, when a removed VPN profile still seems to affect routing, or when DNS answers are stale in a way flushing has not fixed. It is the wrong move as a first step, because it destroys the evidence that would have told you which of those was happening.

One check worth doing before any of this

Open a browser and load any what-is-my-IP page with the tunnel connected. If it shows the VPN's country, the tunnel is working and your problem is one specific app or site rather than the connection. That single check redirects half of all iPhone VPN troubleshooting away from the VPN entirely — towards an app that blocks datacenter addresses, or a site that has flagged the exit you happen to be on.

Frequently asked