Whenever you find yourself on a sketchy public WiFi hotspot or a heavily-filtered network, using a VPN is a relatively sure way to tunnel your traffic to a safe location. It’s probably best not to trust a free provider, who will be selling your traffic information to advertisers, and why pay for a VPN when you can create one yourself with little to no bandwidth limitation and a trustworthy host? Setting up a VPN can be challenging, however, with a myriad of incompatible protocols and lots of outdated information. Most guides online are for either OpenVPN or PPTP, neither of which are supported on modern iOS (10+).
As usual, the OpenBSD folks are here to help with a sanely designed IKEv2 server (and client) in the form of OpenIKED, which conveniently comes in the base system. We also get to use the not-insanely-braindead PF firewall, which is always a plus.
After a long time searching the web for a pre-made solution to this problem (because I was feeling lazy), I found an article that had a perfect solution to the problem. In an attempt to get the word out about the world’s easiest way to make an IKEv2 VPN, I’ll reproduce it here. Calum MacRae on Medium created an Ansible playbook to automate this task, which I very slightly modified into the following:
Save this as ipsec.yml and run Ansible on your workstation with ansible-playbook -i vpn.example.com, -u root -k -e ansible_network_os=openbsd ipsec.yml. You may need to install sshpass on the machine you’re running Ansible from.
The only changes I made were to use a password stored in the playbook (instead of Ansible Vault), for simplicity, and to replace the DNS server with Cloudflare’s DNS offering.
On the iOS device, head to General, VPN, Add VPN Configuration. Use IKEv2 as the type, enter whatever in the Description box, add the (internet-facing) hostname of your server in the Server and Remote ID boxes, keep Local ID blank, and turn User Authentication to None. Disable Use Certificate and type your password (from the top of the playbook) into the Secret box. When you’re done, connect to your VPN and enjoy.