Shadowrocket VPN Setup on iPhone: Why It Asks to Add a VPN Configuration

Add VPN Configuration: Granting System Permission to Connect

The connection toggle on Shadowrocket’s Home screen is more than a regular page setting. Connecting uses Apple’s network extension framework to save a VPN configuration in iOS and start the associated tunnel. That’s why the first connection usually brings up an “Add VPN Configuration” prompt. On an English-language device, you may see “Would Like to Add VPN Configurations.” This is a system permission request—not a purchase prompt, and not confirmation that the server has connected.

After you allow it, iOS saves a VPN entry associated with Shadowrocket and may ask you to authenticate your device. The network activity notice explains the scope of VPN access: when enabled, traffic routed through the tunnel is handled by the corresponding network extension. Continue only if you recognize Shadowrocket as the app you just opened and understand where the current configuration came from.

VPN Configuration Profile vs. Config and the Connection Toggle

In this context, “VPN profile” usually means the VPN entry created by the app in the system VPN list. It is different from a general profile installed through device management, and from a Config file in Shadowrocket. The similar names can make it seem as though all three should be deleted together, but they need to be checked separately.

On iPhone and iPad, find the entry in Settings → General → VPN & Device Management → VPN. Some versions of iOS also provide a VPN shortcut, and its name and location may vary with the system language and layout. If you can’t find it, search for “VPN” in Settings.

The in-app toggle requests that the VPN start or stop; the system VPN page shows the actual status of the corresponding configuration. These are not two unrelated connections. Status changes may take a moment, so wait for the transition to finish before checking. If there are multiple VPN entries, make sure you identify the one that is active rather than relying on a general toggle.

First Connection: Grant System Permission Step by Step

Before you begin, go to Home and confirm that the selected server is from a service provider you already use and that its settings are saved. System authorization only controls whether the connection can start; it does not fill in the address, port, or authentication details. Start with a manual connection while troubleshooting to keep automatic triggers from affecting the results.

1. Pause automatic connection

   Open Shadowrocket → Settings → On Demand, note the current settings, and temporarily turn off automatic connection. This makes it possible to run a repeatable manual test. Restore your preferred settings after troubleshooting.

2. Check the selected server

   Return to Home and confirm that the server you want to test is selected. Compare Type, server address, port, and authentication fields with the details from your provider. For example, if the provider specifies port 443, make sure that’s the saved value. Don’t change the port just because an authorization prompt appeared.

3. Turn on the connection

   Turn on the connection toggle on Home and wait for the system’s Add VPN Configuration prompt. Don’t tap the toggle repeatedly or switch to another app as soon as the prompt appears.

4. Authenticate your device

   Confirm the request is from Shadowrocket, tap Allow, and complete device authentication as prompted. Enter your device passcode only in the system authentication screen—not in a server password or subscription field.

5. Check the connection status

   Return to Home and wait for the connection result. Then go to Settings → General → VPN & Device Management → VPN and check the Shadowrocket entry. Note separately whether the entry exists and whether it shows as connected, then test a known working website.

Restore Access After Declining or Deleting a VPN Entry

If you tapped Don’t Allow the first time, the request to save a VPN configuration probably wasn’t completed. This does not mean your server settings in the app were deleted. Return to Shadowrocket → Home and try connecting again. If the system prompt reappears, follow the authorization steps above. VPN configuration access is not a regular notification permission, so there’s no need to look for it in notification settings.

If you manually deleted the Shadowrocket entry from the system VPN page, the app may need to create a new configuration and request permission again the next time you connect. First check that the server is still listed on Home and that the required configuration is still in Config. Don’t immediately import everything again; duplicate imports can create multiple entries with similar names and make troubleshooting harder.

• No VPN entry: Go to Home and try connecting, then check whether the system prompt appears. If it doesn’t, turn the in-app connection toggle off, reopen the app, and try again. Also check whether the device is subject to management restrictions.
• Entry exists but isn’t connected: Try connecting manually once and see whether the toggle switches off immediately. An existing entry means the configuration was saved; it doesn’t confirm that authentication, server reachability, or tunnel startup succeeded.
• Multiple similar entries: Disconnect first and identify which configuration belongs to which app. Only remove an entry if you’ve confirmed it belongs to Shadowrocket and you no longer use it. Don’t delete other VPN configurations in bulk.
• Rebuild the configuration only if needed: Save any necessary in-app settings first, then turn off On Demand and disconnect. Delete only the VPN entry you’ve confirmed belongs to Shadowrocket. Return to the app, connect manually, and grant permission again.

Don’t start with Reset Network Settings. It can also affect saved Wi-Fi and other network settings, creating extra work to restore them. If the problem occurs with just one server and the system VPN entry connects normally, check that server’s settings and network conditions instead of resetting the device’s network settings.

Common Prompts and a Toggle That Turns Off: Troubleshoot by Symptom

An authorization prompt, a disconnected status, and an actual connection error are different kinds of information. The examples below retain key phrases from common English-language prompts; the wording may vary with your system language. The first two items are not server errors. When noting what happened, also record whether it was before allowing access, after allowing it, or after connecting and trying to open a webpage.

The toggle switches off immediately, but there’s no new prompt

First check whether the system VPN entry is still there, then review the error Shadowrocket shows for that connection attempt. Once authorization is complete, a later failure may occur while starting the network extension, establishing the connection, or authenticating. Note the exact error instead of assuming what went wrong based only on the toggle switching off.

• Check the settings: Make sure the protocol matches the details from your provider, then check the port, password, or UUID. For TLS connections, also check the relevant settings against your provider’s instructions. Don’t hide a configuration error by turning off verification.
• Compare networks: Keep the same server and configuration, and switch once between Wi-Fi and Cellular. If the connection fails on only one network, focus on that network’s restrictions and connectivity.
• Check for conflicting connections: See whether another VPN configuration or automatic connection behavior is starting a connection. Stop anything not involved in this test, then test Shadowrocket on its own.

Connected, but websites won’t load

At this point, the issue is usually no longer about whether the system configuration can be added. Check the current mode under Home → Global Routing, along with the rules and DNS in Config. Don’t repeatedly grant system permission to fix webpage access, and don’t assume that a successful server latency test means every request will work.

• Proxy, Direct, Config, and Scene are different traffic-handling modes in Global Routing, not levels of system authorization.
• When using Config, check which configuration file is selected and which rule actually matches the request. The system VPN toggle shows the connection status, not where each request ultimately goes.
• Keep the settings as they were when the error occurred, then change one variable at a time. Restore the original settings after testing so temporary changes aren’t left in place.

VPN Reconnects After You Turn It Off: Check On Demand

If the VPN reconnects after you turn it off manually, the toggle may be working as expected. Automatic connection settings under Shadowrocket → Settings → On Demand may request a new connection when network conditions match. The system VPN entry may also show Connect On Demand. Check both the app settings and the options shown in iOS.

1. In Settings → On Demand, note the existing conditions and temporarily turn off automatic connection.
2. Return to Home, turn off the connection, and wait until the system VPN page shows that it’s disconnected.
3. On the same network, open a regular webpage and see whether the connection starts by itself. If you need to switch between Wi-Fi and Cellular, record the result of each separately.
4. If it no longer reconnects automatically, restore the On Demand conditions you need and test them again. If it still reconnects, check for other VPN entries or device management policies.

What to Record Before Reporting a Problem

If the steps above don’t resolve the issue, a reproducible sequence is more useful than simply saying “it won’t connect.” Include the authorization prompt, system status, and app status—but don’t share secrets that could let someone else use your connection service.

• Steps taken: For example, “Turned on the connection in Home → allowed the system request → completed authentication → toggle switched off.” Note whether a system VPN entry was created.
• Device details: Record the device model, the actual system version, whether you were on Wi-Fi or Cellular, and whether the device is managed. Don’t guess the system version from memory.
• Configuration status: Record the current Global Routing mode, whether On Demand is enabled, the protocol type, and the exact error shown in the app.
• Protect your privacy: Hide server authentication details, UUIDs, passwords, tokens in subscription URLs, and personal network information. Don’t share a complete configuration or subscription link.

Shadowrocket is a paid client for Apple platforms, primarily used on iPhone and iPad, and is available exclusively from the App Store. A one-time app purchase does not include connection service. Check the App Store listing for pricing, system requirements, and compatibility with other Apple devices.