diff --git a/ios/MullvadTypes/Protocols/EphemeralPeerReceiver.swift b/ios/MullvadTypes/Protocols/EphemeralPeerReceiver.swift
index 9c8c53441cf8..5104b86ae535 100644
--- a/ios/MullvadTypes/Protocols/EphemeralPeerReceiver.swift
+++ b/ios/MullvadTypes/Protocols/EphemeralPeerReceiver.swift
@@ -20,25 +20,24 @@ public class EphemeralPeerReceiver: EphemeralPeerReceiving, TunnelProvider {
     }
 
     unowned let tunnelProvider: any TunnelProvider
+    let keyReceiver: any EphemeralPeerReceiving
 
-    public init(tunnelProvider: TunnelProvider, keyReceiver: any EphemeralPeerReceiving) {
+    public init(tunnelProvider: TunnelProvider, keyReceiver: any EphemeralPeerReceiving ) {
         self.tunnelProvider = tunnelProvider
+        self.keyReceiver = keyReceiver
     }
 
     // MARK: - EphemeralPeerReceiving
 
     public func receivePostQuantumKey(_ key: PreSharedKey, ephemeralKey: PrivateKey) {
-        guard let receiver = tunnelProvider as? EphemeralPeerReceiving else { return }
-        receiver.receivePostQuantumKey(key, ephemeralKey: ephemeralKey)
+        keyReceiver.receivePostQuantumKey(key, ephemeralKey: ephemeralKey)
     }
 
     public func receiveEphemeralPeerPrivateKey(_ ephemeralPeerPrivateKey: PrivateKey) {
-        guard let receiver = tunnelProvider as? EphemeralPeerReceiving else { return }
-        receiver.receiveEphemeralPeerPrivateKey(ephemeralPeerPrivateKey)
+        keyReceiver.receiveEphemeralPeerPrivateKey(ephemeralPeerPrivateKey)
     }
 
     public func ephemeralPeerExchangeFailed() {
-        guard let receiver = tunnelProvider as? EphemeralPeerReceiving else { return }
-        receiver.ephemeralPeerExchangeFailed()
+        keyReceiver.ephemeralPeerExchangeFailed()
     }
 }
diff --git a/ios/MullvadVPN/TunnelManager/StartTunnelOperation.swift b/ios/MullvadVPN/TunnelManager/StartTunnelOperation.swift
index c6b712061ccc..6a32e1192ffd 100644
--- a/ios/MullvadVPN/TunnelManager/StartTunnelOperation.swift
+++ b/ios/MullvadVPN/TunnelManager/StartTunnelOperation.swift
@@ -115,6 +115,8 @@ class StartTunnelOperation: ResultOperation<Void> {
         let protocolConfig = NETunnelProviderProtocol()
         protocolConfig.providerBundleIdentifier = ApplicationTarget.packetTunnel.bundleIdentifier
         protocolConfig.serverAddress = ""
+        protocolConfig.includeAllNetworks = true
+        protocolConfig.excludeLocalNetworks = false
 
         let alwaysOnRule = NEOnDemandRuleConnect()
         alwaysOnRule.interfaceTypeMatch = .any