Known issues

The main limitations of ironkeel we know of, in plain words. A limitation stays on this page until the release that fixes it. Security vulnerabilities do not go here: report them as the security policy says.

The official WireGuard apps, every platform

• Traffic is protected only while the tunnel is up. While it connects, after an error, at start-up before the tunnel is up, or if the WireGuard app stops, nothing is blocked and traffic leaves unprotected. Android's Always-on VPN and the on-demand option on iPhone, iPad and Mac shorten that time. They are settings of your system, not ours, and vary by version.
• iPhone and iPad: hostile local networks. A network that pushes its own routes (DHCP option 121), or someone on the same network, can make some traffic leave outside the tunnel. Avoid untrusted Wi-Fi for anything sensitive.

Every device

• Local networks numbered 10.64.0.0 to 10.127.255.255. Our tunnel addresses use that range, so while you are connected a local device in it cannot be reached, and on some systems DNS can fail. Renumber the local network outside it, or disconnect while you need that device.
• The account service sees your address when you are not connected. When you use this website, or when the ironkeel app calls us from outside the tunnel (to log in, create an account, add a device, act on your account while disconnected, or check your account or fetch the server list while it connects, blocks or changes server), the account service sees your real IP address, together with your account whenever the request carries your account number or a login session. Through the tunnel it sees our VPN server's address instead, together with your account when the request carries it. Your address is not stored or logged, but our server holds it in memory for a few minutes after we answer, as the privacy policy says.

Android

• Traffic Android sends outside any VPN, even with Always-on VPN and "Block connections without VPN" on: its connectivity checks, its time sync and the traffic of devices using your hotspot. On GrapheneOS it looks up its location-assistance (SUPL) server through the local network's resolver at start-up, and perhaps later; GrapheneOS lets you change or turn off both the connectivity check and SUPL in Settings. Other devices on the local network can tell your phone is there, and can learn its tunnel address and recognise your phone by it until it changes: the ironkeel app changes it about every 30 days, but with the official WireGuard app it stays the same until you replace the device's key. On stock Android, apps can also make the system send some packets outside the tunnel even with both settings on; an up-to-date GrapheneOS has fixed these.
• The official WireGuard app rebuilds its tunnel for every change, and traffic can leave outside it for a moment while it does, even with "Block connections without VPN" on. The ironkeel app keeps one tunnel, except at the moment described last on this page.
• Private DNS set to a host name. Android then sends every DNS lookup to that host instead of to ours. The lookups still go through the tunnel, but that host sees every name your phone looks up. Turn Private DNS off, as GrapheneOS recommends.
• Stock Android can switch Always-on VPN off, for example when the VPN app updates, and with it "Block connections without VPN": the VPN then no longer starts with the phone, and nothing is blocked while it is not running. Check both after an update. GrapheneOS has fixed this.
• Without "Block connections without VPN". If ironkeel stops, traffic leaves outside the tunnel until it runs again, which after a force-stop can be until you switch it on; after a restart, it does so until you first unlock the phone. Even while ironkeel shows Connected, any app, without special permission, can send its traffic outside the tunnel, without the tunnel's encryption, by tying its connection to the Wi-Fi or mobile network. We recommend turning the setting on; GrapheneOS turns it on for a VPN by default. With it on, GrapheneOS refused such connections in our one test so far; on stock Android it may not.
• The moment the ironkeel app replaces its tunnel (about every 30 days when it changes its key, and when you log in or set the phone up again while it blocks), a packet sent at that instant may leave outside the tunnel. We have not measured it yet.