This guide is for people using Shadowrocket on an iPhone or iPad for the first time, those who previously denied VPN authorization, or anyone who accidentally deleted the system VPN configuration. It explains the difference between the system VPN configuration, in-app Config, and subscriptions, then walks you through granting permission, checking the system entry, and restoring the connection. Allowing a configuration only creates a system connection entry; it does not provide a working server or route all traffic through a proxy.
1. What Allowing a VPN Configuration Does
On iPhone and iPad, Shadowrocket uses the system VPN extension to handle network traffic. When you connect for the first time, iOS asks whether to allow a VPN configuration. Tap Allow to save the connection configuration. If prompted, confirm using your device passcode or the authentication method shown on screen.
This is not a prompt to import a subscription, nor is it a permission you need to grant every time you open a webpage. It allows the app to create a system-level network tunnel, which is why the system warns that network activity may be filtered or monitored. Check the app name in the prompt, and grant permission only when you initiated a Shadowrocket connection. Never enter your device passcode in a subscription URL or server password field.
System authorization does not include a service plan. You still need your own service details or subscription, and must select an available server in Home. This site covers client configuration and troubleshooting only. Once authorization is complete, traffic routing depends on Global Routing and the active rules. The VPN indicator alone does not tell you whether a particular site is routed through a proxy.
2. Granting Permission for the First Time or After Denying It
Import your server details before connecting so you can distinguish permission issues from service configuration issues. Use Home to select a server and manage the connection, Config to choose a configuration file, and Settings to adjust app behavior. These steps cover system VPN authorization; you do not need to create a server manually in Settings.
-
Check the server
Open Shadowrocket → Home, confirm that a server entry exists, and select it. Use your own service details. If there are no entries, import one using the parameters supplied by your service provider.
-
Start the connection
Turn on the connection switch at the top of Home. Keep the app in the foreground and wait for the system VPN configuration prompt. Avoid toggling the switch repeatedly.
-
Grant permission
Check that the app is named Shadowrocket, then tap Allow. If the system requests device authentication, follow the on-screen instructions. Do not enter your service password as your device passcode.
-
Check the status
Return to Home to check the connection status. Then go to system Settings → General → VPN & Device Management → VPN and check for a Shadowrocket entry.
If you tapped Don't Allow the first time, it usually means only that the current request was canceled; the app has not been permanently blocked. Return to Home, turn the connection switch off, then turn it on again to trigger a new request. If the switch does not reset, exit the current connection flow, then close and reopen the app. Do not delete all subscriptions or reset the device's network settings to fix this.
System prompt: “Shadowrocket” Would Like to Add VPN Configurations
Why it appears: The system has not saved a usable Shadowrocket VPN configuration yet, so the app is requesting permission to add one. This prompt is not a server error, and its wording may vary with the system language.
What to do: Start the connection yourself, verify the app name, then tap Allow and complete any system authentication. Check the connection afterward. If you just denied the request, start the connection again from Home.
3. Where to Find It in Settings
Open your device's Settings, not Settings inside Shadowrocket. Go to General → VPN & Device Management → VPN. Find the Shadowrocket entry and tap its information button for details. Menu names and layouts may vary slightly by system version; you can also search for “VPN” at the top of Settings.
- Check whether it is listed: If you can find a Shadowrocket entry, the system has retained the corresponding VPN configuration. It does not need to be connected at all times.
- Check the connection: Connected and Not Connected show the current tunnel status; they are not ratings of whether the configuration was installed successfully.
- Check automatic connection: If Connect On Demand appears in the details, check its triggers alongside Settings → On Demand in the app.
- Distinguish device management: A management profile and a VPN entry on the same screen are different things. Do not remove a work or school device management profile to restore Shadowrocket.
People often refer to this as a “VPN profile,” but Shadowrocket requests system permission to create a VPN configuration; you do not need to download a separate profile from a website. The system details screen is also not where you edit Shadowsocks, VMess, VLESS, or Trojan server settings. Check server addresses, ports, and credentials in the app.
4. Restore a Deleted VPN Configuration
Choosing Delete VPN in the system VPN details removes the system connection configuration. It usually does not also erase servers, subscriptions, or Config files in Shadowrocket. Open the app and check whether your data is still there. Deleting the system configuration is not the same as deleting the app and its data.
-
Pause automatic connections
If Settings → On Demand is enabled in the app, note the current conditions and temporarily turn it off to prevent network changes from repeatedly triggering connections while you troubleshoot.
-
Keep your existing data
Go to Home to check your servers and subscriptions, then check the active configuration in Config. If your entries are still there, keep using them; there is no need to import them again or uninstall the app.
-
Add the configuration again
Return to Home. Turn off any lingering connection switch, then turn it on again. When the system asks to add a VPN configuration, tap Allow and complete device authentication if requested.
-
Verify, then restore
Check that the entry has reappeared in the system VPN list. Connect manually first and visit a website you know works. Once manual connection is working, restore any On Demand conditions you need.
If you deleted the entire app, recovery is different. Reinstalling the app does not guarantee that local servers or configuration files will return automatically. Reimport them from a backup you kept or a subscription you already have. Subscription URLs often contain access credentials, so hide the full link, passwords, and identifying details before sharing a screenshot.
5. No Prompt, Automatic Reconnection, or No Internet: What's the Difference?
Check three things in order: whether the system has a configuration, whether the tunnel connects, and whether the destination is reachable. If a system configuration already exists, it is normal for the authorization prompt not to appear again. Check system restrictions if the configuration is gone and the request cannot be completed. If the connection succeeds but websites do not load, do not keep adding the same VPN configuration.
The switch is on, but why didn't the permission prompt appear again?
First go to system Settings → General → VPN & Device Management → VPN. If a Shadowrocket entry is already there, the system will usually use the existing configuration. Return to Home and check the connection result. No prompt by itself does not mean authorization failed.
I just turned off the VPN. Why did it reconnect by itself?
Open Shadowrocket → Settings → On Demand and check whether any enabled triggers match your current network. Temporarily turn off On Demand, then disconnect from Home. When you want it back, re-enable the conditions you noted. Do not keep toggling the switch in the system list.
The entry is deleted, but it still won't add when I reconnect. What should I do?
Reopen the app and try connecting manually again, then check whether the device is managed by an organization. Managed devices may restrict VPN configurations; contact your administrator to confirm what is allowed. If a system option is unavailable, note the exact prompt and steps you took. Do not remove a management profile to bypass restrictions.
It says Connected, so why won't websites open?
Disconnect Shadowrocket and confirm that your Wi-Fi or cellular connection works on its own. Reconnect and check which server is selected in Home. Then check Global Routing and the active Config, followed by DNS. Change and retest one setting at a time so you can identify what made a difference.
Proxy, Direct, Config, and Scene under Global Routing determine how traffic is routed; they do not replace system authorization. In particular, Direct does not mean the VPN configuration has been deleted. Rules such as DOMAIN-SUFFIX, IP-CIDR, GEOIP, and FINAL under Config may route different destinations in different ways. When troubleshooting authorization, leave your existing rules in place to avoid introducing new variables.
6. Checklist After Restoring the Connection
The goal is to make the system configuration, app connection status, and actual browsing results line up—not to keep the VPN icon visible at all times. Status bar indicators vary by device layout, so do not rely on an icon alone. Once you have completed the checks below, troubleshoot subscription updates or access to specific sites separately.
- Shadowrocket appears in the system VPN list, and you have not accidentally removed configurations needed by other services.
- The correct server is selected in Home, and the connection switch turns on and off as expected.
- Your basic network works when disconnected, and the selected routing behavior lets you reach the intended destinations when connected.
- The expected file is still selected in Config; troubleshooting has not cleared your rules or DNS settings.
- If you use On Demand, restore its conditions and test a network change once to confirm automatic connections work as expected.
If you still need help, note your device and system details, the exact prompt, whether the system VPN entry exists, and whether the problem occurs before authorization, while connecting, or after connection. This is more useful for troubleshooting than simply saying it does not work. Before sharing screenshots, hide server addresses, subscription credentials, and personal information. Never share your device passcode.