Mullvad's "Force all apps" for iOS: what it fixes, and the update trap to avoid
Mullvad is adding an optional iOS mode that pushes every app's traffic through the VPN tunnel. It closes a leak caused by Apple's networking framework, but updating the app while it is switched on can leave your phone offline.
By Andrew Ingleton · Published
VPN apps on iPhone have a long-standing weak spot: under some circumstances, traffic can slip around the tunnel. In a blog post dated 21 April 2026, Mullvad explained that bugs in Apple's NetworkExtension framework were behind some of these leaks, and that it is preparing an optional setting called Force all apps to deal with them. The post describes the release as coming soon, so check your App Store version before looking for the switch.
What the setting does
When enabled, the app sets the iOS configuration option includeAllNetworks to true. In plain terms, that tells the operating system to send all app traffic through the VPN tunnel rather than letting some of it travel outside. It is the stronger of the two behaviours, and Mullvad says it knew about the fix for some time but held back because of a nasty side effect.
The catch: app updates
According to Mullvad, with the stronger setting on, updating the VPN app itself could leave the device's networking stack unusable, causing a loop of failed updates and reboots. Mullvad decided to offer the protection anyway, and to warn users in advance. You will be told about a new app version before it updates automatically, so you can prepare.
To avoid the loop, Mullvad says you must do one of two things when the app updates:
- Disconnect the VPN during the update. The app will not reconnect on its own afterwards, but Force all apps stays enabled.
- Switch Force all apps off during the update. The app reconnects automatically, but you will have to turn the setting on again by hand.
Mullvad adds that traffic can leak during the update itself, and that it knows of no workaround. It also says a minority of users could still end up with a broken networking stack, which it cannot fix; it encourages affected people to send feedback to Apple. A note at the top of the post says automatic updates now work, but the device still loses its internet connection until it is rebooted.
Should you switch it on?
That depends on what you need to protect. If a leak could expose something sensitive, such as a journalist's or activist's location, the stronger mode is the safer choice, provided you follow the update routine. If you simply want a VPN for public Wi-Fi, the trade-off is less obvious, and the inconvenience of managing updates may not be worth it. Mullvad's post gives no performance figures, so we cannot say whether the setting affects speed or battery life.
Related reading
The same theme of traffic escaping a VPN runs through our coverage of Android: see Your Android VPN can still leak your real IP address and Android 16 can leak your real IP address past a VPN. For another way a VPN can be linked back to you, read Mullvad's exit-IP fingerprinting.
Source: Mullvad blog, 21 April 2026 (Force all app traffic into the tunnel). The behaviour described is Mullvad's own account; we have not tested it.
