--- title: "VPN breaks Messages, iCloud or FaceTime on Mac: what to check · Kilobat Guides" url: "https://kilobat.app/guides/vpn-blocks-apple-services-mac" description: "Messages, FaceTime or iCloud stop working on a Mac while a VPN is on. Find what the tunnel blocks and which VPN setting to change." --- # VPN blocks Messages, iCloud or FaceTime on a Mac Messages, FaceTime and iCloud use Apple Push Notification service and other Apple servers. A VPN can send that traffic into a tunnel that blocks or slows it. This guide finds which part fails and which setting controls it. **Fix this with your agent**Copies a prompt for Claude Code, Codex or any agent that can use Terminal. My Mac has this problem: VPN blocks Messages, iCloud or FaceTime on a Mac. Read https://kilobat.app/guides/vpn-blocks-apple-services-mac.md and work through it with me. Install the Kilobat CLI if it’s missing: brew install seifip/kilobat/kilobat. Run the guide’s Terminal and kilobat checks yourself and tell me what you find. List the steps only I can do. Ask before you change any setting. Applies to: macOS 13.3 Ventura and later for the VPN exclusion settings. The Terminal commands work on all current versions. · Checked: 7 November 2026 ## Symptoms - Messages shows “Not Delivered”, or new messages arrive only after you turn the VPN off. - FaceTime calls do not connect, or stay on “Connecting”, with the VPN on. - iCloud Drive, Photos or Notes stop syncing while the VPN is connected. - Everything works again a few seconds after you disconnect the VPN. ## Likely causes - **The VPN sends push traffic into the tunnel.** Apple’s VPN framework has an “include all networks” mode. In that mode, a VPN app can also choose to put Apple Push Notification service traffic in the tunnel. - **The VPN server or its firewall blocks Apple’s ports.** Apple lists TCP 5223 for push notifications, FaceTime and iMessage. FaceTime and Messages calls also use UDP ports. A VPN that only passes web traffic breaks them. - **The VPN or a security product inspects encrypted traffic.** Apple says that its services fail any connection that uses HTTPS interception, also known as SSL inspection. - **A kill switch or lockdown mode in the VPN app.** When the tunnel reconnects, the app blocks traffic. Open push connections then drop and must start again. - **An old VPN client after a macOS update.** The VPN app’s network extension can behave differently after an update until the vendor releases a fix. ## How to check 1. Turn the VPN off. Send a message and start a FaceTime call. If both work, the VPN path is the cause. 2. Turn the VPN on again. Show which VPN configurations macOS knows and which one is connected. ``` scutil --nc list ``` 3. Show the default route. An interface name that starts with `utun` means that all traffic uses the tunnel. ``` route -n get default ``` 4. Look at Apple’s system status page. Make sure that iMessage, FaceTime and iCloud have no outage. 5. If you are at work, ask your administrator if the VPN or a proxy inspects TLS traffic. ## How to fix it 1. Update the VPN app to its latest version. Then update macOS in System Settings > General > Software Update. 2. In the VPN app, look for split tunnelling or app exclusion settings. Exclude Messages, FaceTime and the iCloud apps, if the app allows this. 3. If the VPN app has a setting for local network or Apple services traffic outside the tunnel, turn it on. 4. If the VPN app has a kill switch or lockdown option, turn it off for a test. Turn it on again after the test. 5. Try a different VPN protocol in the app, such as IKEv2, WireGuard or OpenVPN, if the app offers them. 6. Ask your VPN provider or administrator to allow TCP 5223 and Apple’s network `17.0.0.0/8`. 7. For a managed VPN, give your administrator Apple’s enterprise network page. It lists the hosts and ports that Apple services need. 8. If the VPN app has no exclusion setting, disconnect it while you use FaceTime. ## With Kilobat 1. Show the VPN, where DNS goes and if IPv6 skips the tunnel. ``` kilobat vpn ``` 2. Show which interface the default route uses, and whether a VPN carries all traffic or only some. ``` kilobat ip ``` 3. Read Apple’s status page for iMessage, FaceTime and iCloud from Terminal. ``` kilobat down imessage facetime icloud ``` 4. Compare the direct path with the VPN path for an iCloud host. This checks HTTPS on port 443, not port 5223. ``` kilobat why www.icloud.com ``` 5. The Kilobat app’s History lists when a VPN went on or off. Compare those times with failed messages. ## Questions **What changes when I exclude Apple services from the VPN?** The excluded traffic uses your normal network instead of the tunnel. Your network provider can then see that you connect to Apple servers. **Is there a macOS setting to exclude Apple services from every VPN?** No. Apple gives the setting to the VPN app or the device management profile. The VPN app or your administrator must change it. ## Sources - [Apple Support: Use Apple products on enterprise networks](https://support.apple.com/en-us/101555) - [Apple Support: TCP and UDP ports used by Apple software products](https://support.apple.com/en-us/103229) - [Apple Developer: includeAllNetworks](https://developer.apple.com/documentation/networkextension/nevpnprotocol/includeallnetworks) - [Apple Developer: excludeAPNs](https://developer.apple.com/documentation/networkextension/nevpnprotocol/excludeapns) - [Apple Support: System Status](https://www.apple.com/support/systemstatus/) - scutil(8) and route(8), man pages installed with macOS 27.2 Checked on 7 November 2026. ## Related guides - [VPN connected but no internet on a Mac](https://kilobat.app/guides/vpn-connected-no-internet): A VPN sends traffic through a tunnel. - [DNS queries go outside the VPN on a Mac](https://kilobat.app/guides/vpn-dns-leak-mac): With a VPN on, you usually want DNS queries to go to the VPN's servers. - [Little Snitch, LuLu and other network extensions conflict on a Mac](https://kilobat.app/guides/network-extension-conflicts): Firewalls, VPNs and content filters on macOS use network extensions. - [Corporate proxy certificates break Terminal tools on a Mac](https://kilobat.app/guides/corporate-proxy-certificates): Some company networks inspect HTTPS traffic. - [How much data does FaceTime use on a Mac?](https://kilobat.app/guides/facetime-data-usage): FaceTime data use depends on what you do and the settings you choose. - [Find why one site or API won't connect](https://kilobat.app/guides/recipes/why-cant-it-connect): When the internet works but one address fails, Kilobat checks each layer in turn.