VPN blocks Messages, iCloud or FaceTime on a Mac

Messages, FaceTime and iCloud use Apple Push Notification service and other Apple servers. A VPN can send that traffic into a tunnel that blocks or slows it. This guide finds which part fails and which setting controls it.

Fix this with your agentCopies a prompt for Claude Code, Codex or any agent that can use Terminal.

My Mac has this problem: VPN blocks Messages, iCloud or FaceTime on a Mac. Read https://kilobat.app/guides/vpn-blocks-apple-services-mac.md and work through it with me. Install the Kilobat CLI if it’s missing: brew install seifip/kilobat/kilobat. Run the guide’s Terminal and kilobat checks yourself and tell me what you find. List the steps only I can do. Ask before you change any setting.

Applies to: macOS 13.3 Ventura and later for the VPN exclusion settings. The Terminal commands work on all current versions.Checked: 7 November 2026

Symptoms

Messages shows “Not Delivered”, or new messages arrive only after you turn the VPN off.
FaceTime calls do not connect, or stay on “Connecting”, with the VPN on.
iCloud Drive, Photos or Notes stop syncing while the VPN is connected.
Everything works again a few seconds after you disconnect the VPN.

Likely causes

The VPN sends push traffic into the tunnel. Apple’s VPN framework has an “include all networks” mode. In that mode, a VPN app can also choose to put Apple Push Notification service traffic in the tunnel.
The VPN server or its firewall blocks Apple’s ports. Apple lists TCP 5223 for push notifications, FaceTime and iMessage. FaceTime and Messages calls also use UDP ports. A VPN that only passes web traffic breaks them.
The VPN or a security product inspects encrypted traffic. Apple says that its services fail any connection that uses HTTPS interception, also known as SSL inspection.
A kill switch or lockdown mode in the VPN app. When the tunnel reconnects, the app blocks traffic. Open push connections then drop and must start again.
An old VPN client after a macOS update. The VPN app’s network extension can behave differently after an update until the vendor releases a fix.

How to check

Turn the VPN off. Send a message and start a FaceTime call. If both work, the VPN path is the cause.
Turn the VPN on again. Show which VPN configurations macOS knows and which one is connected.
```
scutil --nc list
```
Show the default route. An interface name that starts with utun means that all traffic uses the tunnel.
```
route -n get default
```
Look at Apple’s system status page. Make sure that iMessage, FaceTime and iCloud have no outage.
If you are at work, ask your administrator if the VPN or a proxy inspects TLS traffic.

How to fix it

Update the VPN app to its latest version. Then update macOS in System Settings > General > Software Update.
In the VPN app, look for split tunnelling or app exclusion settings. Exclude Messages, FaceTime and the iCloud apps, if the app allows this.
If the VPN app has a setting for local network or Apple services traffic outside the tunnel, turn it on.
If the VPN app has a kill switch or lockdown option, turn it off for a test. Turn it on again after the test.
Try a different VPN protocol in the app, such as IKEv2, WireGuard or OpenVPN, if the app offers them.
Ask your VPN provider or administrator to allow TCP 5223 and Apple’s network 17.0.0.0/8.
For a managed VPN, give your administrator Apple’s enterprise network page. It lists the hosts and ports that Apple services need.
If the VPN app has no exclusion setting, disconnect it while you use FaceTime.

With Kilobat

Show the VPN, where DNS goes and if IPv6 skips the tunnel.
```
kilobat vpn
```
Show which interface the default route uses, and whether a VPN carries all traffic or only some.
```
kilobat ip
```
Read Apple’s status page for iMessage, FaceTime and iCloud from Terminal.
```
kilobat down imessage facetime icloud
```
Compare the direct path with the VPN path for an iCloud host. This checks HTTPS on port 443, not port 5223.
```
kilobat why www.icloud.com
```
The Kilobat app’s History lists when a VPN went on or off. Compare those times with failed messages.

Questions

What changes when I exclude Apple services from the VPN?

The excluded traffic uses your normal network instead of the tunnel. Your network provider can then see that you connect to Apple servers.

Is there a macOS setting to exclude Apple services from every VPN?

No. Apple gives the setting to the VPN app or the device management profile. The VPN app or your administrator must change it.

Sources

Apple Support: Use Apple products on enterprise networks
Apple Support: TCP and UDP ports used by Apple software products
Apple Developer: includeAllNetworks
Apple Developer: excludeAPNs
Apple Support: System Status
scutil(8) and route(8), man pages installed with macOS 27.2

Checked on 7 November 2026.