When Shadowrocket connects for the first time, iOS needs to save a VPN configuration on your iPhone or iPad. This guide is for anyone who sees an authorization prompt, tapped Don’t Allow by mistake, or can’t connect after deleting the VPN configuration. Learn how to distinguish system authorization from in-app settings, authorize again, and determine whether the issue lies with connection details or rules. These steps assume you already have your own service and subscription.
First-time prompt: What is iOS asking permission to do?
The first time you turn on the connection switch on Shadowrocket’s Home screen, iOS may ask to add a VPN configuration. This system prompt lets the app save and use the corresponding VPN configuration. It is not a request to purchase the app again or import a subscription. After you tap Allow, iOS may ask you to confirm with your device passcode or another supported authentication method.
Prompt: Would Like to Add VPN Configurations
Why it appears: The app is requesting permission to add a VPN configuration to iOS. This is a normal permission prompt, not a connection error.
What to do: Confirm the prompt names Shadowrocket and appears right after you turn on the connection switch, then tap Allow and complete system verification. If you don’t plan to connect, tap Don’t Allow.
The prompt’s wording depends on your system language. iOS’s notice that network activity may be filtered or monitored describes what a VPN can do: data routed through the tunnel is handled by the configured network extension. It does not mean all traffic is already being sent to a remote server, and the prompt alone cannot confirm that your current rules, DNS, or remote service are configured correctly.
Authorization allows the corresponding network tunnel to be established; it does not guarantee that a webpage will load. Confirm these separately: the system configuration was saved, the tunnel started, and the destination website is reachable. If you tapped Allow but the connection still fails, repeatedly approving the prompt is not a general fix.
Authorize for the first time: From Home to system confirmation
Before you begin, make sure Shadowrocket was obtained from the App Store and that you have your own connection details ready. Buying the client and obtaining a network service are separate things; allowing a system VPN configuration does not create a working remote connection. These steps mainly apply to iPhone and iPad. Check the App Store listing for system requirements.
-
Check the connection entry
Open Shadowrocket → Home, confirm your own connection details have been imported, and select the entry you intend to use. Don’t assume a subscription is valid just because system authorization succeeded.
-
Turn on the connection
On Home, turn on the connection switch at the top. Stay on the page while iOS responds. Avoid rapidly toggling the switch, which can make it harder to tell what state the connection is in.
-
Approve the permission
On the system prompt to add a VPN configuration, confirm Shadowrocket and tap Allow. If device verification appears, complete it as requested. This requires device verification, not your service provider’s password.
-
Check the system entry
Go to system Settings → General → VPN & Device Management → VPN and check for the corresponding Shadowrocket entry. Menu names and locations can vary slightly across system versions; you can search for VPN in system Settings.
-
Test access
Return to Home and check the connection status, then visit a website that normally loads for you. If the system entry exists but the site still won’t load, note your current network and Global Routing selection, then troubleshoot the connection and rules.
If you tapped Don’t Allow the first time, iOS did not finish adding the configuration. Return to Home and try connecting again, then follow the system prompt if it appears. If no prompt appears, first check whether the app’s configuration is already listed under VPN in system Settings instead of deleting the app right away.
VPN configurations, Config, and device management profiles
The everyday phrase “VPN profile” can refer to several different things. The system VPN configuration used by Shadowrocket is an iOS record for managing the tunnel. Config inside the app stores settings such as traffic-routing rules. A device management profile in the same system settings area may be used by an organization to manage the device. These are different items and should not be treated as interchangeable or deleted together.
| Item | Where to check | Purpose |
|---|---|---|
| System VPN configuration | System Settings → General → VPN & Device Management → VPN | Stores the app’s tunnel configuration so iOS can establish and manage the connection. |
| Config in the app | Shadowrocket → Config | Manages the configuration files used by the app, including applicable rules and related settings. |
| Device management profile | System Settings → General → VPN & Device Management | May include restrictions or settings deployed by an organization. This is not something this guide recommends deleting. |
Rule of thumb: Only change a VPN entry clearly associated with Shadowrocket
If you need to set up authorization again, check the name and associated app in the VPN list first. Ask your device administrator to handle any organization-managed item you can’t identify. Don’t remove an entire management profile to reset a connection.
Deleting a system VPN entry usually won’t also erase your connection details on Shadowrocket’s Home screen or files in Config, but this is no substitute for a backup. Before proceeding, make sure you can restore your original subscription or configuration. Don’t confuse deleting a VPN configuration with deleting the app and its data; the latter can affect more local content.
After deleting it by mistake: Re-create the system VPN configuration
After the system VPN configuration is deleted, the app needs to save a valid system configuration again before it can start the tunnel. Start the process in Shadowrocket; you don’t need to manually enter a server address, account, or protocol in system Settings. A generic VPN entry created manually cannot replace the app’s network extension configuration.
-
Pause On Demand
Go to Shadowrocket → Settings → On Demand and temporarily turn off any enabled On Demand options. Then return to Home and turn off the connection. This reduces interference from automatic reconnections while you troubleshoot.
-
Check the entry to delete
If the original configuration has already been deleted, continue to the next step. If you’re deliberately setting it up again, open the system VPN list, select the details for an entry clearly associated with Shadowrocket, and tap Delete VPN. Don’t delete an entry with an unclear name or association.
-
Reconnect
Return to Shadowrocket → Home, confirm your existing connection entry is still there, then turn on the connection switch so the app can request that iOS save its VPN configuration again.
-
Verify the setup
If iOS displays the prompt to add a VPN configuration again, tap Allow and complete device verification. Then check that the corresponding entry has reappeared in the system VPN list and verify the connection status on Home.
-
Restore On Demand
First verify a manual connection and website access. Then restore Settings → On Demand according to your usual needs. Don’t change multiple On Demand conditions while a manual connection is still failing.
If the switch immediately turns off again, first check whether authorization was canceled and whether the system VPN list can save the corresponding entry. If the device is managed by an organization and you don’t have permission to add or delete entries, ask the administrator about restrictions on network extensions. Repeatedly deleting, reinstalling, or restarting won’t replace checking the management policy.
After authorization: How the system tunnel and rules work together
System authorization determines whether the app can establish the corresponding tunnel. How traffic is handled also depends on Shadowrocket’s current Global Routing selection and configuration. The flow below explains the general idea when using Config for rule-based routing; it does not mean every request passes through a remote proxy.
- Proxy: Routes traffic through a proxy. If the system has authorized the tunnel but the remote connection details are incorrect, you may still be unable to connect.
- Direct: Routes traffic directly. A connected status in system VPN settings alone doesn’t prove that traffic is passing through a remote proxy.
- Config: Applies rules from the selected configuration, such as
DOMAIN-SUFFIX,IP-CIDR,GEOIP, and the fallbackFINAL. Check the actual rule order and target policy. - Scene: Applies the settings configured for the selected scene. When troubleshooting, check which scene is active rather than just noting the option’s name.
If the system VPN entry exists but websites still fail to load, check the local network, selected connection entry, DNS, and routing policy separately. Reauthorizing won’t correct a server address, port, authentication details, or transport settings. Changing those settings won’t replace system authorization either. Change one thing at a time so you can tell what affects the result.
Common cases: Canceling, repeated prompts, and automatic reconnections
I tapped Don’t Allow. Do I need to buy the app again?
No. Your purchase record and system VPN authorization are separate. Return to Home and turn on the connection switch again, then follow the system prompt if it appears. If it doesn’t, first check whether the configuration is already saved in the system VPN list.
Why does the prompt appear every time I connect?
After authorizing once, check the system VPN list right away to confirm the entry was actually saved. If it wasn’t, check whether device verification was completed and whether the device has management restrictions. If it was saved, note what you did before the prompt appeared again; don’t keep deleting the configuration without checking.
I turned off the connection. Why did it reconnect by itself?
Go to Shadowrocket → Settings → On Demand and check the On Demand options. Pause them while troubleshooting, then see whether a manual disconnect stays disconnected. On Demand controls when a connection starts; it isn’t another subscription and doesn’t confirm that your connection details are correct.
Do I need to trust a certificate after tapping Allow?
A standard VPN connection does not require installing and trusting an additional root certificate. Certificate trust and system VPN authorization are separate actions. Don’t change certificate trust settings just to dismiss the prompt to add a VPN configuration.
Shadowrocket shows Connected, but websites won’t load. What should I do?
First confirm that your current network can access the internet, then note the connection entry selected on Home and your Global Routing selection. If the system tunnel is established, continue by checking the connection details, DNS, and rules. When contacting support, hide subscription links, passwords, and authentication details.
When reporting an issue, include these three useful observations: whether the system VPN entry exists after authorization, whether the Home connection switch stays on, and whether the failure affects all websites or only specific destinations. Note the test conditions, such as Wi-Fi or cellular, and say whether On Demand was paused. This helps distinguish a problem saving permissions from a connection issue without exposing your full configuration.