Linux solution for VPN on-demand for iOS devices

Cisco IPSec, Juniper Junos Pulse, and Cisco AnyConnect can be configured for VPN on-demand for certain destination hosts/networks as they are part of the route and can realize the need to establish a VPN connection first in order to connect to those hosts/networks;

So in case of your Linux based PPTP VPN server, as far as that server is not your default routing gateway, VPN on Demand is meaningless. In this configuration your server should be a Cisco IPSEC compatible Gateway on linux and your iOS devices' default routing gateway too.

In case of Apple iOS device, VPN on Demand allows iOS device to establish a transparent and secure connectivity to a remote enterprise network with no more manual configuration at user side.

This VPN on Demand feature cannot be manually configured on the iOS device and requires a certificate-based authentication and is currently supported on Cisco IPSec, Juniper Junos Pulse, and Cisco AnyConnect.

In order to activate and configure it on iOS devices, you must create a configuration profile and then provision the device.

Another form of VPN on Demand is available on Mac OSX devices where Safari decides to establish a VPN connection to connect to certain domains/networks (e.g. vpn.mycompany.com) that you have already listed as VPN on Demand and configured its connection settings profile (password/certificate).

More Info:

iOS VPN on Demand: http://www.0x8847.net/2010/07/iphone-os-vpn-on-demand/ http://manuals.info.apple.com/en_US/Enterprise_Deployment_Guide.pdf

OSX VPN on Demand: http://docs.info.apple.com/article.html?path=Mac/10.6/en/15575.html

For a Cisco IPSec Gateway on Linux, I recommend you use Open source package StrongSwan for your iOS VPN on Demand

http://www.strongswan.org/

Use --enable-cisco-quirks parameter to build StrongSwan to make it compatible with Cisco IPSEC. It is a stable certification based, IPsec Gateway on linux that is compatible with iOS VPN on Demand requirements.

Check following link for setup iOS on StrongSwan:

http://wiki.strongswan.org/projects/strongswan/wiki/IOS_(Apple)

Authentication uses XAUTH and certificates (authby=xauthrsasig).The described setup has been tested and confirmed working on an iPad 2 with iOS 4.3.1, but is expected to work on all other iOS devices (iPhone, iPad, iPod Touch) running an up to date iOS version.

As already mentioned in @Reza's answer you basically just need a profile to make this work. One thing Reza didn't mention though is the actual question I think you were asking. To make this work on linux you need some sort of IPSec support. There are several tools available that can do this, how to configure several of them is available here:

http://www.ipsec-howto.org/t1.html

I've used Openswan for this myself:

http://www.openswan.org/

Once you get the VPN configuration profile working and setup the realm correctly the iOS device will establish the IPSec tunnel on demand and free beers will be had by all (you're buying!)

We use the PPTP Linux package on CentOS, and it works very well for OSX, Windows, and iOS. I know it has its limitations with regards to security, but for most people it is more than adequate.