IKEv2/IPsec
Updated 21 September 2026 · How we research
IKEv2/IPsec is the protocol to reach for when a device keeps changing networks. Its mobility extension lets an established tunnel survive moving from Wi-Fi to cellular without renegotiating from scratch.
How it is put together
IKEv2 is the key exchange, defined in RFC 7296. It authenticates both ends and establishes the security associations. IPsec then carries the actual data, normally using ESP with an AEAD cipher such as AES-GCM. The two are almost always described together because neither is useful alone.
Why it suits phones
The MOBIKE extension (RFC 4555) lets either end change IP address while keeping the same security association. When your phone leaves the house and drops to cellular, the tunnel updates its endpoint instead of tearing down and rebuilding. In practice this is the difference between a brief stall and a visible disconnect — which matters if a kill switch would otherwise cut your traffic.
Platform support
IKEv2/IPsec is implemented natively in Windows, macOS, iOS and Android, so a client can use the operating system's own VPN stack rather than shipping a driver. That tends to mean lower overhead and better integration with system-level always-on VPN settings.
The limitation
Fixed ports are easy to block
IKEv2/IPsec at a glance.
| Strength | Weakness |
|---|---|
| Survives network changes via MOBIKE | Fixed, easily blocked UDP ports |
| Native support on all major operating systems | No built-in obfuscation |
| Fast reconnection after sleep | Fewer router firmware implementations than OpenVPN |
| Efficient on mobile hardware | Less configurable than OpenVPN |
According to ZoogVPN