Issues with IKEv2 IPSec VPN on Rogers LTE/3G

[JP1204]

This is on an iPhone 7 connected to Rogers LTE or 3G wireless networks. 

I'm having an issue when using IKEv2 IPSec on NordVPN. The VPN connection gets established properly and connections through the VPN appear to work, speedtest works, many sites come up fine, etc. But some websites just never connect (e.g. https://us.opinio.net) through the VPN, others like https://www.reddit.com work 50% of the time. 

Using OpenVPN UDP port 1194 on the same NordVPN server instead of IPSec, there is no issue at all, so it's not a matter of the NordVPN server being blocked by the sites, or itself blocking requests. 

To rule out my phone or NordVPN, I switched the SIM card to TELUS LTE and both VPN modes work just fine, IPSec and OpenVPN. There is also no issues over WiFi.

There really seems to be an issue with Rogers and the connection through IPSec.

Do you guys have an idea what's going on? 

I found a thread where RogersDave suggest switching PDP Type to IPv4 instead of IPv6, but I see no options to do that on an iPhone 7. 

Thank you! 

[nigelncwong]

Hi all,

For those who are on iOS and NordVPN you can try this method.  It works perfectly for me.

https://support.nordvpn.com/Connectivity/iOS/1086536932/Manual-connection-setup-on-iPad-iPhone.htm

I am still hoping Rogers can fix this in the near future though.

Take care,

Nigel

[drlarsen]

As of July 2019, the IPv4 trick doesn't work, at least not in my area.

If I have IPv4/IPv6 selected (the default), I get both addresses and then the VPN doesn't work.
If I have just IPv4 selected, I get no addresses and therefore no data.

As a workaround, I've found that forcing the network to Rogers-EXT and IPv4 allows the VPN to work, although I think Rogers might take issue with people being permanently on the extended network.

I'm on a corporate plan and accessing my employer's VPN, so maybe I should bring this issue up with our corporate contact.

[RogersCorey]

Greetings and welcome to our Community @drlarsen!

I am sorry to hear the workaround doesn't work for you. You are correct that operating on the EXT network all the time isn't ideal.

If the IPv4 workaround doesn't work for you, then it would be up to your VPN vendor to update their VPN software to be compliant with our network operating standards. IPv6 isn't going away so all VPNs will have to support IPv6 sooner or later and it is in their best interests to get on board sooner rather than later.

Regards,

RogersCorey

[drlarsen]

That's one way to look at it. The reality is IPv6 adoption in Canada is only at 22% as of January 2019. My organization is in the other 78%.

[RogersCorey]

Hi @drlarsen!

I wish I had an alternate solution for you but we only offer the IPv4 workaround. 

Regards,

RogersCorey

[ianwday]

I've stopped being able to connect to our corporate VPN over LTE again.  I've asked that the workaround be re-applied.

I'm surprised that you're asking us to convince our VPN vendors to support IPv6.  Our VPN provider is Cisco Meraki.  I don't have much sway with them.

Please support your customers until the vendors have made the switch to IPv6.  I'm not sure why Rogers is trying to move this forward by denying service to its paying customers. 

[RogersMoin]

Hello, @ianwday.

Welcome to Rogers Community Forums and thank you for joining this conversation. I can certainly appreciate your situation; not able to connect to work can be disruptive.

Thank you for your PM, you shall get the updates on the ticket submitted for you. 

Cheers,

RogersMoin

[ianwday]

If Rogers is not willing to support its paying customers using an IPv4 VPN on LTE for the time being, Bell seems to be.  Would you please be clear about what your are and are not willing to support for us?  This will allow us to make our decisions to stay with Rogers or not.

[RogersMaude]

Hello again @ianwday,

I can imagine the inconveniences caused by the issues you're experiencing with your IPV4 VPN on LTE. Thank you for your feedback!

Have you been notified that the fix was deployed to your device since you reached out to us via private message?

Let us know if you need more help!

RogersMaude

[VHS]

Who do I message to have a “fix” applied? I do/did have the IPv4 fix applied but since July 2019, this doesn’t seem to be working. I can only connect to my VPN if I manually select the Rogers-EXT service.

[ianwday]

I’ve had the fix applied twice but it stopped working again last week.  I sent a Private Message to @CommunityHelps and asked them to re-apply the fix.  It’s working again.

[ddeacon22]

I think I have found a solution for this for iPhones but I'm thinking it also needs work from Rogers. When I originally had the fix applied to my phones I was told that they blacklisted my devices from using IPv6. Recently when my phones stopped working I've been asking Rogers to reply the fix and they keep telling me they have but it has not resolved any issues for any of my phones. On a call yesterday with support I was told devices by default have only IPv6 on them but they add devices to their list to use both IPv4 and IPv6. This is different than blacklisting IPv6 which is what I was originally told the solution was. So this got me looking at options I could implement and I found options in Apple Configurator to force the iPhone to only use IPv4 APN. In the cellular profile section I set a configuration with the following settings:

Configured APN Type: Default APN

Default APN Name: ltedata.apn

Default APN Authentication Type: PAP

Default APN User Name: left blank

Default APN Password: left blank

Default APN Supported IP Versions: IPv4. <---this is the important part.

I saved the profile and emailed it to my self and as soon as I installed it (double click from email then go into Settings->General->Profiles & Device Management then click the profile and trust/install it) my VPN started working again.

So not sure if you still need Rogers to enable IPv4 on your device or not as they may have enabled both IPv4/IPv6 before for me but the phone was still using IPv6 until I did this.

[RogersCorey]

Greetings @ddeacon22!

That's an interesting fix! Thank you for sharing.

All I wish to add is that this is an unsupported fix. Should any unforeseen connectivity issues happen in the future, resetting your APN settings to default should be your first step.

Regards,

RogersCorey

[rr21]

My VPN has also been down for a couple months. How can this be fixed?

[RogersZia]

Hello @rr21,

Welcome to the Rogers Community Forums!

I see you've reached out to us via PM. We'll be happy to continue the conversation on there :).

RogersZia

[VHS]

I was just told by Rogers mod on this board that it is impossible to access an IPv4 vpn on their network. However, just until last week, I was able to do just that. The IPv4 “fix” that has been applied a couple times to my account has always resolved the issue and now I’m being told this fix cannot be applied. Does anyone have any similar experience?

[drlarsen]

My "fix" is to force roaming onto Rogers-EXT. Those are currently giving out IPv4 address, at least around here anyway (I believe they are owned by Telus).

It's a bit of a hassle switching back and forth, but at least it works for now. If it ever stops working, I'll probably switch providers.

[Baucor]

I am having having the same issue.  I can connect to my work VPN via any other broadband internet but I cannot connect via my Sister's home which uses a rocket hub/wireless internet. She is able to access her office network via the same rocket hub but for some reason I cannot connect on my laptop.  I also tried connecting via a hotspot from my cell phone, which is also Rogers, and it cannot connect either.  Just wondering if this is a setting that needs to be applied to my VPN. Not sure how to troubleshoot but any assitance is appreciated.

[VHS]

Anyone having issues since Rogers' switch to IPv6 could try to connect to the IPv4 address as apposed to a FQDN. For whatever reason, when connecting directly to an IP address on an iPhone, the translation between IPv4 and IPv6 functions without issue. However, if one connects to a FQDN, it's either not correctly resolving or an issue with the translation. Regardless, it doesn't work. Try the IP, see how that goes 🙂