When Shadowrocket connects for the first time, iOS requires permission to create a VPN configuration. This configuration lets the app use the system network tunnel; it is not a subscription or an in-app .conf file. This guide is for anyone who sees the authorization prompt, tapped Don’t Allow, or finds an unexpected VPN entry. Follow the steps in order: identify the configuration, request permission again, rebuild it if needed, then verify the connection. Avoid deleting unrelated data.
1. Add VPN Configuration: Permission for the System Network Tunnel
In short: if the prompt was triggered by Shadowrocket, which you just opened, and you’ve verified the app’s name and source, you can allow the configuration to be added. The system then saves a VPN configuration for the app to use. To connect, the app must still start the tunnel and use valid connection details you already have. Tapping Allow does not mean the remote connection succeeded.
iPhone and iPad use the system VPN mechanism for this type of network connection. The prompt explains that a VPN may handle network traffic and asks for your explicit permission; it is not a standard notification permission. If device verification is required, complete it in the system prompt. Don’t enter your device passcode in the app’s server password field.
There are two separate things to check: whether iOS allows the VPN to be created and started, and whether your existing connection details work. If the first fails, check permissions and the system entry. If the second fails, check connection settings, network access, and routing. Repeatedly approving the prompt won’t fix an incorrect server address or credentials.
2. VPN Configurations, Configuration Profiles, and .conf Files Are Different
“VPN profile” is often used as a catch-all term for VPN entries in iOS, but these items should be distinguished when troubleshooting. The VPN configuration Shadowrocket requests can be viewed in the system VPN list. It is not the same as a configuration profile installed through an organization or a website. Both may appear in the same area of Settings, but they have different sources and purposes.
| Item | Where to find it | What to check |
|---|---|---|
| System VPN configuration | Settings → General → VPN & Device Management → VPN | Check the entry associated with Shadowrocket, its current status, and any available details or actions. |
| Configuration profile | The profiles section under Settings → General → VPN & Device Management | Check its source and management purpose. Don’t delete an organization’s management profile thinking it’s the app’s VPN entry. |
| In-app .conf file | Shadowrocket → Config | Check the selected file and its rules, DNS, and other settings. This file does not grant system VPN permission. |
| Existing server and subscription details | Shadowrocket → Home | Check the imported details and current selection. Updating them does not replace system authorization. |
System menu names and locations can change with the interface. If you don’t see the path above, search for “VPN” in Settings. Check the entry name first. The “VPN & Device Management” heading alone doesn’t mean a management profile is installed, nor does content in that section prove the device is managed by an organization.
Decision guide: Check the right place for each item
If the system entry is missing, return to Home to trigger authorization. If rules aren’t behaving as expected, check Config. Identify which layer is causing the problem before changing its settings; don’t delete both the system configuration and in-app data at once.
3. If You Tapped Don’t Allow: Request Permission Again
Denying the prompt usually means the VPN configuration wasn’t created that time; it doesn’t permanently prevent the app from requesting permission again. Return to Home and try to start the connection again, then see whether iOS shows the prompt. You don’t need to uninstall the app or delete a subscription first.
Verify the app
Open Shadowrocket from the App Store and make sure you’re working in the app’s Home, not the details page for another VPN in Settings.
Check your connection details
On Home, check your existing connection details and current selection. If you haven’t configured them yet, set up the details you already have first. Don’t mistake missing connection details for a system authorization issue.
Try connecting again
On Home, use the connection toggle. When the Add VPN Configuration prompt appears, verify the app name, tap Allow, and complete any device verification requested by iOS.
Check the VPN entry
Go to Settings → General → VPN & Device Management → VPN and see whether the configuration associated with Shadowrocket appears.
Check the status
Return to Home and check the connection status. If it still says Not Connected, note whether a new prompt appeared. The disappearance of the authorization prompt alone doesn’t mean you’re connected.
If no prompt appears when you try again, first check whether the corresponding configuration already exists. If it does, iOS may not ask again. If the interface seems unresponsive, close and reopen the app, then check again. Reopening is not the same as uninstalling; they affect existing data differently.
4. When to Delete and Rebuild the System VPN Configuration
Rebuilding is appropriate when the problem clearly points to the system entry—for example, its status repeatedly differs from the app’s, or the app can’t complete configuration whenever you try to connect. A website failing to load, a subscription update failing, or one address being unreachable doesn’t by itself mean the system configuration is damaged. Before you begin, record the current status and error so you can compare what changes afterward.
Keep a record of your settings
Note the selected connection, Global Routing mode, and Config file. Back up any in-app configuration you need to keep. Don’t share subscription links or credentials.
Turn off automatic connections
In Shadowrocket, go to Settings → On Demand and temporarily turn off on-demand connections. Then return to Home and disconnect to prevent iOS from starting a connection during troubleshooting.
Find the entry
Go to Settings → General → VPN & Device Management → VPN. Open the details for the Shadowrocket entry and make sure it isn’t a VPN used for something else.
Delete the configuration
If the details page offers “Delete VPN,” delete only the entry you’ve confirmed belongs to Shadowrocket. If iOS doesn’t offer a delete option, check for device management restrictions and don’t remove anything else.
Authorize again
Return to Shadowrocket → Home and try to connect again. Allow iOS to add the VPN configuration, then check whether the corresponding entry reappears in the system list.
Test manually first
First verify the connection manually. Once it’s stable, restore only the On Demand settings you need. Change one thing at a time so you can tell what made a difference.
Deleting the system VPN configuration is meant to rebuild the system entry; it doesn’t clear your Home connection details or rule files in Config. Still, keep important data safe beforehand—“usually doesn’t affect other data” is no reason to skip a backup. Uninstalling the app, clearing app data, and deleting the system VPN are separate actions; don’t combine them into one troubleshooting step.
5. Authorized but Still Not Working? Identify the Problem Layer
A system VPN entry means the configuration was saved; even a Connected status doesn’t prove every destination is reachable. Track three things separately: whether the connection starts, whether destinations are accessible, and whether it reconnects automatically. Don’t group all three under a permission issue. The English system prompt title is shown below; it may vary with your system language.
Prompt title: VPN Connection
What it means and what to do: This is the title of an iOS VPN connection prompt. The title alone doesn’t identify the cause of a failure. Record the full message beneath it, then check the Home connection status and the system VPN entry to determine whether configuration setup or the connection itself failed.
| What you see | Check first | Next step |
|---|---|---|
| Home shows Not Connected | Check whether the system entry exists and whether you just denied authorization | Try the connection toggle again and note any system prompt. Not Connected is a status, not a specific error. |
| Shows Connected, but a destination won’t load | Home → Global Routing and the selected connection details | Run Home → Connectivity Test, then check access to the destination. A test result doesn’t mean every request is working. |
| Reconnects after you disconnect | Settings → On Demand | Temporarily turn off On Demand, then disconnect manually to tell automatic activation apart from a faulty connection toggle. |
| Only some websites have issues | Current Global Routing mode and rules in Config | If you use Config, check the relevant rules and policies instead of repeatedly rebuilding the VPN. |
Proxy, Direct, Config, and Scene under Global Routing are routing choices, not four types of VPN authorization. In particular, when using Config, rules and policies determine how specific requests are handled. In Direct mode, the system VPN indicator alone doesn’t prove a request went through a remote proxy. Note the current mode before troubleshooting so you have a baseline for comparison.
Bottom line: Once the entry exists, check the connection and rules
If the system entry is created successfully after authorizing again but the same destination still fails, check your existing connection settings, Global Routing, and relevant rules. Don’t keep deleting the VPN configuration.
6. FAQ: What Authorization Covers and How to Restore Access
Does allowing a VPN configuration also install a certificate?
No. This permission does not automatically install and trust a root certificate. A VPN configuration and certificate trust are separate system actions. You don’t need to install a certificate just to restore a basic connection. If another prompt appears, check its purpose and source separately.
Why does Home still show Not Connected when a VPN appears in Settings?
A saved system configuration and an active connection are two different states. Return to Home and use the connection toggle. If it fails, record the full message. An existing configuration doesn’t prove the server is reachable, the credentials are valid, or the tunnel has started—and it doesn’t mean you need to authorize again.
Do I need to re-import my subscription after deleting the system VPN?
First check Home to see whether your existing details are still there; don’t re-import them preemptively. The system VPN entry and subscription details serve different purposes. If your existing details are intact, just start the connection again and complete system authorization. If you genuinely need to update them, use your existing subscription and verify the update separately.
Is it normal to see the Add VPN Configuration prompt every time I connect?
A configuration that was saved successfully usually doesn’t need to be added again each time. First check whether you completed system verification last time and whether the entry is still there. If it keeps disappearing, check for device management restrictions and record the full process. Repeatedly tapping Allow is not a substitute for troubleshooting.
Do I need to reset all network settings to fix this?
That shouldn’t be your first step. First try requesting authorization again, checking the individual entry, and rebuilding it if needed. Resetting network settings affects more than the VPN and may require you to set up existing networks again. If the problem remains unclear, collect the system prompt, steps that trigger it, and device management status before deciding what to do next.
After troubleshooting, keep a record without sensitive information: whether the system VPN entry exists, the status shown on Home, the Global Routing mode, whether On Demand is enabled, and the exact steps that trigger the failure. Don’t expose subscription URLs, server passwords, or other credentials in public screenshots or text. This record is more useful for diagnosing the issue than “I allowed it, but it doesn’t work.”