Shadowrocket VPN Configuration Prompt: Profiles and iPhone VPN Settings

1. What does adding a VPN configuration authorize?

Shadowrocket uses the system’s network extension to handle traffic according to your settings. The first time you connect, if the device has no corresponding configuration, you must allow Shadowrocket to add one. This system prompt is not part of a subscription page. Once allowed, iOS saves a configuration entry that the app uses to start a network tunnel.

Allowing a configuration does not mean the server is ready or that a subscription has been imported. Server addresses, ports, protocols, and authentication details still come from your existing provider or subscription. Access to a particular site also depends on the selected server, Global Routing, Config rules, DNS, and other settings.

2. Authorize the first connection

These steps assume you have already added your own server or subscription. If there is no server to select on Home, import one first. To add a server manually, go to Home → Add Server and enter the protocol and port from your existing service details. Don’t change them just to get past the authorization prompt.

1. Verify the app

   Open Shadowrocket and go to Home. Make sure you’re using the intended app and an existing server entry. Don’t start a supposed VPN authorization from an unfamiliar website.

2. Select a server

   On Home, select the server you want to use. If you route traffic by rules, check Global Routing → Config and make sure the intended configuration file is selected on the Config screen.

3. Turn on the connection

   Turn on the connection switch on Home. When iOS asks to add a VPN configuration, verify that the app name shown is Shadowrocket, then tap Allow.

4. Complete verification

   Follow the system prompts to verify your device. If asked for a password, enter your device passcode—not your subscription password, server password, or App Store account password.

5. Check the status

   Return to Home and check the connection status, then try a website you need to access. If the switch turns off soon after you turn it on, first check whether iOS created the configuration, then troubleshoot the connection settings.

Switching apps during verification, canceling the passcode prompt, or locking the device may prevent authorization from completing. Don’t assume it worked just because you tapped Allow. Check that the VPN entry appears in iOS Settings and that the app can attempt to connect. The VPN icon in the status bar depends on the device layout, so don’t rely on it as the only confirmation.

3. System VPN, profiles, and Config: what’s the difference?

On Chinese-language systems, several management options appear close together, which can make “Add VPN Configuration” sound like “Install a Profile.” They are not the same. A normal Shadowrocket connection authorization does not require downloading a device management profile from a website.

The system path in the table corresponds to “Settings → General → VPN & Device Management → VPN” on a Chinese-language device. Menu names can vary slightly by system version; you can search for VPN in Settings. If there is no profile on your device, the page may show only available options such as VPN. You don’t need to install a file just to fill out the page.

For example, DOMAIN-SUFFIX,example.com,DIRECT in a Config file sets the policy for matching domains, while FINAL,DIRECT sets the policy for connections that don’t match earlier rules. These rules control traffic handling; they don’t grant system permissions or suppress the first-connection authorization prompt.

4. Try again if you tapped Don’t Allow

Denying or canceling the request usually just means that no usable VPN configuration was created this time. It doesn’t mean your subscription is invalid. First, try starting the connection again; there’s no need to delete the subscription, reset network settings, or reinstall the app.

1. Return to Shadowrocket → Home, make sure the connection switch is off, then turn it on again. Check whether iOS displays the configuration prompt.
2. If the prompt appears, tap Allow and complete system verification. If it doesn’t, go to System Settings → General → VPN & Device Management → VPN and check whether the corresponding configuration already exists.
3. If the configuration is already there, return to the app and try connecting. It’s normal for iOS not to show the first-time prompt again when a usable configuration already exists.
4. If the configuration is missing and the prompt still doesn’t appear, quit and reopen the app, then try again. If nothing changes, restart the device and check whether it’s managed by an organization.

If iOS explicitly says the action is restricted, or a managed device won’t allow VPN changes, don’t keep deleting the app to try to work around it. Check the management status under System Settings → General → VPN & Device Management and ask your device administrator which configurations are allowed. A disabled button in Settings does not, by itself, point to a subscription or protocol problem.

5. Find, remove, and recreate a VPN configuration

Delete the configuration only when you’ve confirmed it needs to be recreated. Before removing it, keep your subscription link, any required server details, and Config files. Deleting the system VPN configuration is not a way to clear all app data, nor should you rely on it as a backup.

1. First, open Shadowrocket → Settings → On Demand and check whether automatic connection conditions are enabled. If you need to stop connections completely, disable the relevant conditions first, then return to Home and turn off the connection switch.
2. Go to System Settings → General → VPN & Device Management → VPN. Find the entry for Shadowrocket and make sure it isn’t a configuration for another app or one managed by your organization.
3. Tap the details button next to the entry and find Delete VPN. On a Chinese-language system, look for the equivalent localized label. Confirm when prompted, taking care not to delete a device management profile on the same screen.
4. Return to Shadowrocket → Home, turn on the connection switch again, allow the VPN configuration to be added, and complete verification. Then check the connection status.

Deleting a system VPN entry removes the system connection configuration. It does not remove a server from Home or delete a .conf file from Config. After recreating the entry, check your selected server, Global Routing, and current Config separately. Don’t rely only on whether the authorization prompt reappears.

6. What to check if you allowed access but can’t connect

If the system VPN page lists a configuration and Home can start a connection, focus on the connection itself. Authorization, establishing a tunnel, and accessing a website are separate stages. Repeating authorization won’t fix an incorrect port, failed authentication, DNS resolution issues, or rule-matching problems.

• The switch turns off right away: First, confirm that system verification completed. Then check the selected server’s address, port, protocol, and authentication details. Use the port in your existing service information; don’t change it to 443 across the board.
• Connected, but websites won’t load: Check whether Global Routing is set to Proxy, Direct, Config, or Scene. Config applies rules, while Direct connects without a proxy; neither one proves that the server is working.
• Only some websites fail: Check the matching rules for the affected domains and your DNS settings. Reviewing rule order and the FINAL fallback policy is more useful than deleting the system VPN configuration.
• Subscription update fails: Check that your existing subscription link is valid and that the network is working. System VPN authorization does not extend a subscription or fix its contents.

When contacting support, include your device type, whether a VPN entry appears in Settings, whether the issue happened before or after you tapped Allow, and how the Home switch behaves. You can quote the prompt, but don’t share your full subscription link, authentication password, or screenshots containing tokens.

7. VPN authorization and Settings: FAQs