iOS firewall between phone and VPN

I work in IT and in the past I have submitted bugs in apple's software that were acknowledged by apple and got fixed in subsequent OS releases. I just mention this to show I have a certain experience.

I setup VPN's as part of my job, but I also set up the VPN servers and firewalls, and you are totally correct that when you connect to a VPN server, that VPN server can connect back to your device.

In case of a computer, it is really important to activate a firewall on the device itself, because the usual (low cost/low quality) firewall of your home will typically not see the traffic going over the VPN, and if you have activated sharing services, the VPN provider could see those same services and abuse of them.

iPhone's/iPad, iWatch are a different story: when you use the device on the mobile network, depending on your operator you could receive a public IP address. Some operators do not give you a public IP address, and have their own routers and firewalls that separate your phone from the rest of the internet. So the problem of an inbound network attack is always there, even without VPN. But typically, iphone's don't have many ports/services open: you don't run a webserver or SSH server on an iphone: apple secured these parts rather well.

But most attacks these days are not direct network attacks:

Very recently apple patched what I think was one of the most serious security issues in recent years - details: About the security content of iOS 16.1 and iPadOS 16 - Apple Support, and I think I've seen these being exploited before the update came out. The use of VPN or firewall would not have protected users from these exploits. I've seem these exploits used on telegram channels discussing the "Military Operation" in Ukraine... so one can guess who's behind them.

If you really need a VPN, I suggest you setup and amazon account, and you manage your locations, VPN servers and security yourself: that way you control everything up to the VPN server. But you can't control what happens after the VPN server. If your connecting using telnet, ftp or any non or weakly encrypted protocol, then the VPN only provides about 50% protection.

Best, Peter

If you have a good VPN there should be a firewall. Incidents have occurred where some VPNs were breached and there are also cases where the VPN was harvesting data from their users. I wouldn't use a "free" VPN at all.

Is your employer having you use this VPN or are you trying to access sites in other countries that wouldn't otherwise be available to you?

No... it's like any "smart device": these are vulnerable to network attacks. The smarter they are the more vulnerable.

Applications on the phone can also open ports, which may lead to vulnerabilities too.