Troubleshooting

By default iOS will tunnel all traffic over the VPN, including traffic going to the Internet. If Internet sites are inacces- sible once connected, a DNS server may need to be pushed to the client for it to use, such as the LAN IP address of the firewall if the DNS forwarder is enabled, or a public DNS server such as 8.8.8.8/8.8.4.4.

The reason for the above is that the 3G provider is likely giving mobile devices DNS servers that are only accessible from their network. Once connected to the VPN the DNS servers are now being accessed via the VPN instead of the 3G network, and the queries are likely to be dropped. Supplying a local/public DNS server will work around that.