Shadowrocket VPN Permission: Add VPN Configuration on iPhone

In this guide

The first time you connect with Shadowrocket on an iPhone or iPad, iOS asks you to allow it to add a VPN configuration. This guide covers the initial approval, checking the system settings, retrying after a denial, and restoring a deleted configuration. It also explains the difference between the system VPN configuration, Config files, and subscriptions. Useful if you’re stuck at the permission prompt, can’t find the VPN entry in Settings, or find that the connection turns back on after you switch it off.

First connection: trigger the system permission prompt from Home

Open Shadowrocket and go to Home. Select a connection entry supplied by your own service provider, then turn on the connection switch at the top. When the system VPN configuration is created for the first time, iOS or iPadOS displays a prompt to add it. Confirm that the request is for Shadowrocket, tap “Allow,” and complete device authentication if prompted. The exact wording may vary by system language and version.

Check the selected entry

Select an existing connection entry on Home. The address, port, and protocol settings come from your own service provider; purchasing the app does not generate them.
Turn on the connection switch

Turn on the switch at the top of Home and wait for the system prompt to add a VPN configuration. The “+” in the upper-right corner of Home is not the system permission control.
Allow and authenticate

Tap “Allow” and authenticate as prompted by the system. Enter your device passcode only in the system authentication screen—not in the connection entry’s password field.
Check the connection status

Return to Home to check the status, then open the system VPN settings and confirm that a Shadowrocket entry is listed. The entry confirms that the configuration was added; only a “Connected” status confirms that the tunnel is running.

Permission approval does not mean the remote service is available. Allowing the system to establish a tunnel and connecting to the remote address with valid protocol settings are separate steps. First confirm that the configuration was added, then check the connection and web access. This helps avoid repeatedly deleting the configuration without changing the cause of the problem.

System VPN configuration vs. Config and subscriptions

The VPN configuration in the system prompt is a record iOS uses to register and manage a VPN connection, linked to Shadowrocket’s network extension. It is often called a “VPN profile,” but it is not the same as a device management profile installed from a file, nor is it a file you need to obtain from a website. During normal first-time setup, the app can request to add it directly.

System VPN configuration

How to add: Home → connection switch at the top → allow in the system prompt
Where to find it: System Settings → General → VPN & Device Management → VPN
Purpose: Registers and manages Shadowrocket’s VPN connection with the system
How to confirm: The corresponding entry appears in the VPN list; check the connection status separately

If you delete this record, Shadowrocket must request permission to add it again.

In-app Config and subscriptions

Config: Select and manage configuration content such as rules and DNS
Home: Select connection entries and manage your existing subscriptions and connection settings
Subscription updates: Applies entry changes published by your service provider; does not replace system permission
Billing: One-time app purchase ≠ connection plan

Check system permission, rule files, and remote service separately; none replaces the others.

The permission prompt explains that the VPN may handle network activity on your device. This describes the scope of network access; it does not mean every request will pass through a remote proxy server. Actual traffic routing depends on Global Routing, the rules in the current Config, and the connection settings. DIRECT and PROXY requests follow different paths. A VPN indicator alone cannot show which route a particular website’s traffic took.

Find the Shadowrocket entry in Settings

On your iPhone or iPad, open system Settings and go to General → VPN & Device Management → VPN to find the Shadowrocket entry. Some system versions also show a VPN shortcut in Settings; a different menu layout does not mean the configuration is missing. If you can’t find it, search for “VPN” using the search field at the top of Settings, then check the VPN list.

Entry listed, not connected: The configuration has been added, but the tunnel is not running. Return to Home and connect manually, then check the status again.
Entry listed, connected: The system tunnel is running. Next, test web access or use in-app diagnostics to check whether the remote service is reachable.
No matching entry: You may not have allowed the configuration to be added, or the record may have been deleted. Return to Home and start the connection again; check whether the system permission prompt appears.
Managed device: If the page shows organization management details and restricts VPN actions, check with your device administrator. Don’t delete management records you don’t recognize.

Don’t rely only on whether “VPN” appears in the status bar. Its layout varies by device and screen; the matching entry and connection status in system VPN settings are more reliable checks. Record three results—whether an entry exists, whether it connects, and whether you can access websites afterward—to help pinpoint the issue.

Denied the prompt or deleted the configuration? Restore permission

If you tapped “Don’t Allow” on the first prompt, the system VPN configuration usually just wasn’t added that time. Return to Home, make sure the connection switch is off, then turn it on again. If Shadowrocket displays an error, dismiss it before retrying. You don’t need to buy the app again or update a subscription to restore system permission.

On Home, stop the current connection attempt and make sure the switch is off.
Open the system VPN list and check whether the Shadowrocket entry is there, so you don’t mistake a connection failure for incomplete authorization.
Return to Shadowrocket’s Home and turn on the connection switch. When the system prompt to add the VPN appears, tap “Allow” and complete authentication.
If you deleted the entry in system settings, follow the same reconnection steps to let the app create the record again.
If there’s still no prompt or entry, quit and reopen the app normally, then try again. If the system explicitly reports a restriction, check your device management requirements first.

If the system entry is already there but the connection drops immediately, check the connection settings and network instead. There’s no point waiting for another permission prompt: a configuration that has already been authorized does not require approval every time you connect.

Connection turns back on after switching it off: check On Demand

In Shadowrocket, go to Settings → On Demand and check whether on-demand connections are enabled and what triggers them. “Allow adding a VPN configuration” and “Allow automatic connections under specified conditions” are separate: the first creates a system connection record; the second determines whether a connection starts automatically on particular networks. Initial permission does not enable every automatic connection condition.

To observe manual connection behavior, first pause on-demand connections in Settings → On Demand, then return to Home and turn off the connection.
Open the system VPN list and tap the info button next to the entry. If the page offers an “On Demand” option, check its status too.
Stay on the same network and check that the connection no longer starts automatically before restoring any conditions you need, one at a time.
When testing switches between Wi-Fi and cellular, change one condition at a time and note the status before and after each switch. This helps distinguish automatic reconnection from a failure to disconnect.

On Demand lets the system start a connection when specified conditions are met; it does not guarantee that the remote service is reachable. Even if the connection starts automatically, incorrect service settings or a network that can’t reach the remote host can still cause it to fail. When troubleshooting is complete, restore settings to suit your needs rather than leaving one setting enabled or disabled by default.

Allowed but can’t access the web? Check permission and traffic routing separately

“Connected” in system VPN settings means the tunnel is running; it does not mean every request is routed through a proxy. Check the current Global Routing selection on Home, then check which Config is selected. Note the original settings, review each item, and restore it afterward to avoid disrupting your existing local network or domain-based routing setup.

4 items

Global Routing：Proxy / Direct / Config / Scene

2 places

Cross-check connection status on Home and in system VPN settings

Proxy: Handles requests using the global proxy mode. Also confirm that the selected remote connection entry is available.
Direct: Handles requests using direct connections. A connected VPN alone does not mean traffic passes through a remote proxy.
Config: Handles requests according to the rules in the selected configuration. Check the matching policy and rule order instead of requesting permission again.
Scene: Check which scene settings are active; Scene is not another name for Config.

For example, DOMAIN-SUFFIX,example.com,DIRECT in Config routes matching domain suffixes to DIRECT. The final rule, FINAL,PROXY, handles requests that did not match earlier rules. These rules determine traffic routing and are unrelated to whether system permission has been granted. For rule fields, see the configuration field reference. For the first-connection steps, see the setup guide.

FAQ: configuration, permission scope, and recovery

Do I need to tap Allow every time I connect?

If the system record is retained, you usually don’t need to add it again each time. If the prompt keeps appearing, check whether the entry remains in the system VPN list after each attempt, and look for device management restrictions or actions that may have deleted the configuration.

Do I need to install a separate profile?

Shadowrocket requests the system VPN configuration needed for the first connection. Start a connection from Home and complete system authorization; you don’t need to find a separate file for this prompt. Ask your administrator about restrictions on organization-managed devices.

Will deleting the VPN entry delete my subscription?

The system VPN record and in-app subscriptions are separate. First check that the subscription is still on Home, then reconnect to add the system record. Don’t clear the app’s data just because the system entry is missing.

Does tapping Allow encrypt all my traffic?

Permission allows the system tunnel to be established; it does not guarantee encryption across every network route. Check Global Routing and the rules that match your traffic, then verify the protocol in use and the destination website’s HTTPS status. Don’t draw conclusions from the VPN indicator alone.

Shadowrocket is a closed-source commercial app for Apple platforms, primarily used on iPhone and iPad. App Store is the only way to get it. Refer to the App Store listing for system requirements. The one-time app purchase and your own connection plan are billed separately; this site does not provide, sell, or recommend nodes or subscriptions. For questions about your remote account, expiration date, or connection settings, contact your own service provider.