VPN Gateway:Connect an iOS device to a VPC

Overview

Architecture

You will create a VPN gateway and an IPsec Server on Alibaba Cloud, then configure the native iOS VPN client to establish the connection.

Example Planning

The following resources and settings are used in this tutorial:

Prerequisites

Check Region Support

The IPsec Server feature is supported in specific regions, including China (Hangzhou), China (Shanghai), Germany (Frankfurt), and others.

If your VPC is in an unsupported region, consider using Cross-VPC connectivity.

Step 1: Create a VPN gateway

1. Log in to the VPN gateway Console.

2. Click Create VPN Gateway and configure the following parameters.

   Note

   If you want to use an existing VPN gateway, ensure that the SSL-VPN feature is enabled and the gateway is upgraded to the latest version. The IPsec Server feature relies on the Point-to-Site capabilities provided by the SSL-VPN feature set.

   Parameter	Example Value	Description
   Name	vpn-demo
   Region	China (Hangzhou)	Must match the VPC region.
   VPC	vpc-demo	The target VPC.
   VSwitch	vsw1, vsw2	Select vSwitches in different zones for High Availability (HA).
   Maximum Bandwidth	10 Mbps	Adjust based on throughput requirements.
   VPN Type	Standard
   IPsec-VPN	Disable	You can leave this disabled if you do not need Site-to-Site connections.
   SSL-VPN	Enable	Required. Enables the necessary resources for the IPsec Server feature.
   SSL Connections	5	Maximum concurrent client connections.

3. Complete the payment. Wait 1–5 minutes for the status to change to Normal.

Step 2: Create an IPsec Server

1. In the left navigation pane, choose Interconnections > VPN > IPsec Servers.

2. Select the region China (Hangzhou).

3. Click Create IPsec Server and configure the parameters.

   Parameter	Example Value	Description
   Name	server-demo
   VPN Gateway	vpn-demo	Select the gateway created in Step 1.
   Local Network	10.0.0.0/16	The CIDR block of the VPC (or subnets) the client needs to access.
   Client CIDR Block	10.222.222.0/24	Virtual IP pool for clients. Warning: Must not overlap with the Local Network or the client's physical network (e.g., 172.16.0.0/16).
   Pre-Shared Key	AliyunVPN123!	Maps to the Secret field in iOS. Note: Use a strong key (16+ chars, mixed case, numbers, symbols).
   Effective Immediately	Yes

4. Click OK.

5. In the IPsec Servers list, note the public IP Address of your server (e.g., 47.xx.xx.xx).

Step 3: Configure the iOS Device

1. On the iOS device, go to Settings > General > VPN & Device Management > VPN.

2. Tap Add VPN Configuration... and enter the following settings.

   Field	Value	Notes
   Type	IKEv2
   Description	AliyunVPC	Any display name.
   Server	<IPsec Server Public IP>	The IP noted in Step 2.
   Remote ID	<IPsec Server Public IP>	Important: Must strictly match the Server IP.
   Local ID	/	Leave this parameter empty.
   User Authentication	None
   Use Certificate	Off	Toggle disabled.
   Secret	AliyunVPN123!	The Pre-Shared Key set in Step 2.
   Proxy	Off

3. Tap Done.

4. Find the AliyunVPC profile and toggle the switch to Connected.

Step 4: Verify Connectivity

1. Configure Security Group

Ensure the Security Group of your target ECS instance allows inbound traffic from the VPN clients.

• Protocol: TCP

• Port: 80 (or your service port)

• Source: 10.222.222.0/24 (The Client CIDR defined in Step 2)

2. Prepare Web Server

Ensure a web server is running on the target ECS (10.0.0.1).

# Example: Install Nginx on Alibaba Cloud Linux 3
sudo yum install -y nginx
sudo systemctl start nginx

3. Test Access

1. Open Safari on the connected iOS device.

2. Access the private IP: http://10.0.0.1.

3. A successful connection will display the Nginx welcome page.

Troubleshooting