When you first connect with Shadowrocket, iOS asks you to approve adding a VPN configuration. This is not a subscription import and does not mean the connection is ready to use. This guide for iPhone and iPad explains what to check before granting permission, how the system VPN entry differs from Config in the app, and how to recover if permission is denied or the entry is deleted. It assumes you already have your own service details, connection parameters, or subscription.
1. Add VPN Configuration: System Permission on First Connection
In short: If the prompt appears after you start a connection in Shadowrocket and names Shadowrocket, check the details and allow it. It usually appears when the app first attempts to connect—not necessarily the first time you open the app. Once a valid configuration exists in iOS, you typically won't need to approve it again for later connections.
On an English-language device, the prompt may read “Shadowrocket” Would Like to Add VPN Configurations. The wording in other languages varies with the system language and interface. Allowing this request lets the app register a VPN connection configuration with iOS so its network extension can establish a tunnel. It is not a purchase confirmation or a check of your subscription.
The system warning that network activity may be filtered or monitored describes what VPN access can do. How traffic is handled depends on the current routing mode, rules, DNS settings, and selected connection. Approving the prompt does not mean every request will use a proxy, nor does it confirm that the remote connection is working.
2. The System VPN Entry and Config Are Separate
“VPN profile” is often used informally to mean a VPN entry saved in iOS. For troubleshooting, distinguish this from a device management profile and from the app's configuration area. On iPhone and iPad, open Settings → General → VPN & Device Management → VPN and look for the entry associated with Shadowrocket. Names and menu paths may vary by system version.
| What to check | Where to find it | What it does |
|---|---|---|
| System VPN entry | Settings → General → VPN & Device Management → VPN | Stores a connection configuration recognized by iOS and shows its status and related options. |
| Existing connections and subscriptions | Shadowrocket → Home | Select an existing connection and view or update subscription details you imported. |
| Rule configuration | Shadowrocket → Config | Manage rules and configuration files that determine how traffic is matched and handled in rule mode. |
| On-demand connection | Shadowrocket → Settings → On Demand | Set when a connection starts automatically; check this when troubleshooting unexpected reconnects. |
Deleting only the system VPN entry generally does not remove connection details under Home or rule files under Config in Shadowrocket, but the system connection entry must be created again. Importing a Config file, in turn, does not replace system authorization. Uninstalling the app is a separate action and may remove local data, so it should not be your first troubleshooting step.
Bottom line: Identify which layer is missing
If the Shadowrocket entry is missing from iOS, return to the app and try to recreate the authorization. If the entry is present and the connection starts but you still can't access a site, check routing, DNS, and your existing connection details instead of repeatedly deleting the same system entry.
3. First-Time Authorization: Five Checks to Make in Order
These steps are for personally managed iPhone and iPad devices. Shadowrocket is a closed-source commercial app for Apple platforms, primarily used on iPhone and iPad, and is available exclusively through the App Store. Refer to the App Store listing for system requirements. Buying the app and setting up your own connection are separate: the one-time app purchase does not include a connection plan.
-
Verify the app
Use the official app verification page to check the official icon, developer Shadow Launch Technology Limited, and app ID
932747118. Make sure you're opening Shadowrocket obtained from the App Store. -
Check your existing connection
Go to Shadowrocket → Home and confirm that your connection has been imported and selected. System VPN authorization does not fill in a server address, port, password, or protocol settings. Get those details from your existing service information.
-
Start a connection yourself
Turn on the connection switch on Home and wait for the system authorization prompt. Don't toggle the switch repeatedly or start another VPN session in a different connection app at the same time; doing so can make the current state harder to diagnose.
-
Approve the system request
Check that the prompt names Shadowrocket, tap Allow, and complete any authentication required by iOS. The system determines the authentication method; you don't need to provide an access token for your existing subscription.
-
Test access
Return to Home and check the connection status, then confirm that the corresponding entry appears on the system VPN page. Finally, try the page you need to access. Seeing a VPN status alone doesn't prove that the remote connection and rules are working correctly.
4. Restore the VPN Configuration After Denying or Deleting It
If you tapped Don’t Allow, iOS did not complete the request. Go to Shadowrocket → Home, turn the connection switch off, then turn it on again to retry. If nothing changes, return to the Home Screen, reopen the app, and try again. No prompt does not necessarily mean something is wrong; a usable entry may still exist, so check the system VPN page first.
If the system entry was deleted
- Open Shadowrocket → Home, confirm your existing connection is still there, and note which connection is selected.
- Go to Shadowrocket → Settings → On Demand and temporarily pause any enabled on-demand settings to prevent automatic connection attempts while troubleshooting.
- Return to Home, turn the connection off, then turn it back on. If iOS asks to add a VPN configuration, verify the name, allow the request, and complete authentication.
- Open Settings → General → VPN & Device Management → VPN and confirm that the Shadowrocket entry has reappeared.
- After manual connection and access are working again, restore On Demand if needed and test what happens after switching networks.
If the entry exists but the connection won't start, first check whether another VPN session is active, then try connecting manually again. Only consider deleting the Shadowrocket entry and recreating it using the steps above if you've confirmed the system entry is the problem and recorded any necessary information. Don't delete VPN entries or device management items used for other purposes.
5. Tell Authorization Issues from Connection Issues
When noting what happened, separate three questions: Was the system allowed to add the configuration? Did the tunnel start? Can you access the destination? Authorization resolves only the first. The English system prompt is shown below for reference on devices using English; it isn't an error message.
Prompt: “Shadowrocket” Would Like to Add VPN Configurations
Why it appears and what to do: The app is asking iOS to add a VPN configuration. If you initiated this connection, tap Allow and complete system authentication. If you denied the request earlier, return to Home and start the connection again.
| What you see | Check first | What to do next |
|---|---|---|
| Connection wasn't established after denying the request | Whether a valid entry already exists in iOS | Check the system VPN page, then return to Home and start the connection again. |
| The switch turns off immediately after you allow the request | Network extension status, existing connection details, and other VPN sessions | Stop other VPN sessions, check the protocol, address, and port for your connection, then try once more. |
| Connected, but pages won't load | Global Routing, DNS, and remote connectivity | Check that the current routing mode matches your expectations and that your connection is still available. |
| Connection resumes after you turn it off manually | On Demand and the corresponding system on-demand options | Pause on-demand triggers, disconnect manually, and see whether it reconnects. |
| Add or delete options are restricted | Device management policies | Ask the device administrator to confirm your permissions; don't remove management profiles. |
When checking Global Routing, keep the interface terms Proxy, Direct, Config, and Scene in mind. Proxy and Direct handle traffic differently; Config follows the rules in the active configuration; and Scene depends on the current scene settings. Changing the routing mode does not renew system authorization—it changes how traffic is handled, not whether iOS allows a VPN to be created.
For example, DOMAIN-SUFFIX in Config matches domain suffixes, while FINAL determines where traffic goes if no earlier rule matches. If authorization and the connection are working but a site still takes an unexpected route, check rule order and policy names rather than approving the VPN prompt again.
6. Frequently Asked Questions: Certificates, Repeated Prompts, and Auto-Reconnect
Does allowing a VPN configuration install a certificate too?
No. System VPN authorization creates a connection configuration; it does not install or trust a root certificate. You don't need to enable certificate trust to troubleshoot a standard connection. Features involving HTTPS decryption have separate purposes and effects, and are not a required step for connecting for the first time.
Why do I have to approve it every time I open the app?
First confirm that you tapped Allow and completed system authentication the last time. Then check whether the entry is still on the system VPN page. If it was deleted, replaced, or never saved, the app may ask to add it again. Note what you did just before the prompt appeared; that is more useful than repeatedly tapping Allow.
Why does the VPN reconnect after I turn it off in Settings?
Check the On Demand settings under Shadowrocket → Settings → On Demand, then look for a corresponding on-demand option in the system VPN entry. Pause the trigger conditions before disconnecting. If your device is managed, a management policy may also control automatic connections.
Do I have to buy the app again after restoring the configuration?
Recreating the system VPN configuration is not a new app purchase and does not restore access to a remote service. Check your purchase status in the App Store. If your own subscription or connection has expired, contact your existing service provider. Handle these as separate issues.
What should I share when asking someone to troubleshoot this?
Share the exact system prompt, whether a Shadowrocket VPN entry is present, the status after a manual connection, and whether the issue happens before or after you allow the request. Before sharing a screenshot, hide server addresses, account details, passwords, and subscription tokens. Don't share a complete subscription URL or connection QR code.
To verify the fix, check the app identity, system authorization, manual connection, actual access, and restored on-demand settings—in that order. Troubleshooting only the layer where the problem occurs helps avoid mistaking a subscription issue for a system permission issue and prevents unnecessary configuration deletion.