iOS Vulnerability Prevents VPNs From Encrypting All Traffic

This is 100% fake and not a bug. All VPNs, such as those on the desktop, do this by default unless specifically configured, as to not interrupt ongoing downloads, or worse, cause UDP-based services to silently fail.

I don’t think so.
iOS used to handle this correctly, then stopped.
Not tearing down existing connections completely undermines the point of a VPN.

Nope. I have two full tunnels on two different clients (Cisco Anyconnect, and Pulse Secure)

Well, I can tell you that Anyconnect will tear down any active connections, assuming it’s configured correctly. My work VPN certainly does.

TCP is designed to retry after being torn down. It’s no biggie.

The fact is, this is an iOS bug, which was introduced recently.

I feel like we need more info here.

As others have said, it would be problematic to silently kill existing connections when connecting to a VPN. That's certainly not the behavior I would expect. I suppose it depends on whether you use a VPN to add certain networks (such as your corporate office), or to globally route all your traffic (such as for privacy reasons). In the former case, I don't want my non-office connections to be reset.

If GeekWebGuides is reporting this right and VPN apps cannot reset connections, that makes me wonder what changed here. Did iOS previously indeed terminate any open socket when connecting?

I feel that people need to learn about the expected behaviour of VPNs before commenting.
There’s actually two types on iOS. Split vpn and full tunnel. Split allows some stuff to be routed elsewhere. Full tunnel tunnels everything.

I’m sometimes stunned by the upvotes people get for posting incorrect information.

If a VPN is configured to send all network traffic through the VPN when it’s running - which is typically what‘s done - then all traffic should be routing through it from the moment it’s enabled. Not just connections to new end points established afterward - all traffic.

Even if a VPN is configured to just carry traffic to a few specific end points (such as the OpenVPN tunnel to our servers, which I’m relying on heavily right now due to the stay at home order currently in place here in Washington): if you’re already connected to one of those end points before establishing the tunnel, you would expect all further traffic to go through the tunnel. The idea that you wouldn’t is ludicrous.

This is 100% fake and not a bug. All VPNs, such as those on the desktop, do this by default unless specifically configured, as to not interrupt ongoing downloads, or worse, cause UDP-based services to silently fail. Windows built-in VPN client has this exact same behavior.

This is 100% fake and not a bug. All VPNs, such as those on the desktop, do this by default unless specifically configured, as to not interrupt ongoing downloads, or worse, cause UDP-based services to silently fail. Windows built-in VPN client has this exact same behavior.

Could we clean up on the use of the word "fake". It's not fake. It may be irrelevant. If you think it's irrelevant, say it's irrelevant. The whole of your post states clearly that it is not fake. And downvoting someone for daring to correct your incorrect use of language is very bad style.

Oops... Has iOS gotten too complicated, or is it just lazy programmers?

Neither. If you have a connection _before_ VPN is turned on, then changing that connection to use VPN will break it. Users will not be happy. Most applications are not clever enough to switch to another connection when VPN is turned on (most are not aware of VPN at all).

Everything you did before you turned on VPN is unprotected obviously. Nobody complains. Everything you start after you turn on VPN is protected. The few connections that you started before you started VPN have been unprotected all the time, and the stay unprotected. Like you make a phone call. If you turn on VPN halfway through the call, the first half is unprotected anyway. The second half of the call _works_. You just need to know that you can't protect the second half of a call with VPN. The whole call, or nothing.

Oops... Has iOS gotten too complicated, or is it just lazy programmers?

Neither. If you have a connection _before_ VPN is turned on, then changing that connection to use VPN will break it. Users will not be happy. Most applications are not clever enough to switch to another connection when VPN is turned on (most are not aware of VPN at all).

Everything you did before you turned on VPN is unprotected obviously. Nobody complains. Everything you start after you turn on VPN is protected. The few connections that you started before you started VPN have been unprotected all the time, and the stay unprotected. Like you make a phone call. If you turn on VPN halfway through the call, the first half is unprotected anyway. The second half of the call _works_. You just need to know that you can't protect the second half of a call with VPN. The whole call, or nothing.