When Shadowrocket asks to add a VPN configuration, it is asking iOS to save and manage a VPN connection entry for the app. This does not import a provider’s configuration or mean the connection is active. This guide is for first-time authorization, accidental denial, or connection problems after deleting the system entry. Follow these steps: verify the app, authorize it, check the system entry, then test the connection.
Adding a VPN Configuration Grants System-Level Connection Access
On iPhone or iPad, Shadowrocket needs to ask iOS to save a VPN configuration when you start a connection for the first time. The system prompt identifies the app making the request and explains how VPN access affects network traffic. Continue only if you just initiated this action in Shadowrocket. If the prompt appears unexpectedly, cancel and verify the app first.
Choosing “Allow” lets the app create a system VPN entry. It does not purchase a service or fill in server addresses or account details. Whether the connection works depends on the connection settings already in the app, your current network, and the selected configuration. This guide assumes you already have your own provider and subscription. This site does not provide, sell, or recommend nodes or subscriptions.
These steps are not interchangeable. An authorization prompt means the app is requesting permission. A system entry means the configuration was saved. A change in connection status means it is time to check whether the tunnel is running. Even when iOS shows Connected, verify that the websites or apps you need are actually accessible.
A VPN Entry, Configuration Profile, and Config Are Different Things
Searches for “Shadowrocket VPN profile” can lead to confusion between a system VPN entry, a device management profile, and an in-app Config. All three may be called a “configuration,” but they are stored in different places and serve different purposes. Deleting each one has different consequences. For a typical first connection, Shadowrocket requests system authorization; you do not need to create a generic VPN type manually in Settings first.
| Item | Where to find it | What it does | What it does not confirm |
|---|---|---|---|
| System VPN entry | Settings → General → VPN & Device Management → VPN | Stores the VPN connection configuration created by the app and its connection status | Whether provider settings are correct or the remote service is available |
| Device management profile | The Profiles section under Settings → General → VPN & Device Management | Contains device settings or management policies provided by an organization, for example | Whether Shadowrocket is configured in the app |
| In-app Config | Shadowrocket → Config | Stores and selects app configuration, including rules | Whether the system has granted permission to add a VPN configuration |
| Existing subscriptions and connection entries | Shadowrocket → Home | Manages connection details imported by the user | Whether the system tunnel has started |
Menu labels may vary with your system language and iOS version. The table uses English labels to help you find them. Check the App Store listing for system requirements. The absence of a separate profile in one section does not mean VPN access is unavailable; check the VPN list for the actual connection entry.
First, Identify Which Layer Is Missing
If your connection entry is still in Home and your Config is still available, but the corresponding entry is missing from the system VPN list, try triggering system authorization again. Don’t clear your subscription or overwrite existing rules first.
Allow the First Request, Then Check Settings
Before you begin, make sure you got Shadowrocket from the App Store and verify that the developer is Shadow Launch Technology Limited. Shadowrocket is primarily for iPhone and iPad. Compatibility with other Apple devices, system requirements, and purchase availability are as listed on the App Store page. The steps below are for iPhone and iPad; you do not need to look for identically named controls in settings on other devices.
-
Check your connection details
Open Shadowrocket → Home and make sure your own connection entry is saved and selected. If you use Config, confirm that the intended configuration is selected. Authorization does not import connection details.
-
Start the connection
Turn on the connection switch at the top of Home. If iOS has not saved the required VPN configuration, it will ask you to add one. If a valid entry already exists, the prompt may not appear again.
-
Authorize the request
Check the app name in the prompt, then tap Allow. If iOS asks you to authenticate by unlocking your device, follow the on-screen instructions. The required verification method depends on your device.
-
Check the system entry
Go to Settings → General → VPN & Device Management → VPN and check the entry for Shadowrocket and its status. Don’t rely on the status bar icon alone.
-
Test access
Return to Shadowrocket and check the connection status on Home, then visit a website you need to use. If iOS shows Connected but access is still not working, check your connection details, DNS, and rules. Don’t keep deleting the system entry.
If the app still shows Not Connected after authorization, that does not necessarily mean permission was not saved. The app may not have finished starting, the selected connection details may be unavailable, or another network setting may be affecting the connection. First check whether the system entry exists, then determine whether the issue is saving the configuration or starting the connection.
Declined the Prompt or Deleted the Entry? Request Authorization Again
If you declined the request to add a VPN configuration, buying the app does not automatically grant permission. In most cases, return to Shadowrocket and turn on the connection again to request that the configuration be saved. If the prompt does not appear, make sure the switch is off before trying again. Avoid repeated taps, which can make the current state harder to identify.
-
Keep your app data
First, check Home and Config to see whether your existing details are still there. Deleting the system VPN entry does not clear app data, and you do not need to uninstall the app to restore permission.
-
Pause automatic connections
If automatic connection is enabled, go to Shadowrocket → Settings → On Demand and temporarily turn off the relevant settings. Then stop the current connection to prevent it from restarting automatically while you troubleshoot.
-
Start again
Return to Home and turn the connection switch on again. When the Add VPN Configuration prompt appears, tap Allow and complete any system verification. If the system entry was deleted, this lets the app create a new one.
-
Check for system restrictions
If the configuration still cannot be saved, check the system VPN list and device management information. Organization-managed devices may restrict VPN configurations. Ask the device administrator to check the policy; do not remove an organization’s profile yourself.
Deleting the system entry does not delete subscriptions or Config files in Home. Conversely, creating a new system entry will not restore an expired subscription. Handle these separately. Only consider further action on a clearly damaged entry after confirming the connection is stopped and your existing details are safely saved.
Authorized but Still Can’t Connect? Check Permission, Status, and Access Separately
First, note where the problem occurs: no prompt, prompt canceled, entry saved but connection failed to start, or iOS shows Connected but websites won’t load. Recording the exact message and what you did makes troubleshooting more effective than simply saying “VPN isn’t working.” Don’t assume every startup error is caused by the provider or every access problem by system authorization.
Error: permission denied
What it means and what to do: If this exact message appears in the error details while starting or saving the configuration, the operation was denied. The message alone does not identify who denied it. Return to Home and retry authorization, check for device management restrictions, and keep the full error context.
Error: Authentication failed
What it means and what to do: If this exact message appears in the connection log, check the authentication step and the connection entry it refers to. It does not mean that permission to add a VPN configuration was denied. First confirm that the system entry exists, then check the authentication details for your existing connection. Repeatedly granting system authorization will not fix incorrect settings.
These examples help identify the exact text in error details; not every failure displays the same message. The text varies depending on where the failure occurs, so refer to the system prompt or app log for that attempt. Not Connected in the system list is a status, not an error code that identifies a specific cause.
- No matching system entry: Return to Home and start a connection. Check whether the system authorization prompt appears. If the entry cannot be created, check for device restrictions.
- Entry exists, but startup keeps failing: Stop toggling the connection repeatedly. Save the exact error message and confirm the selected connection entry and network meet its requirements.
- Connected, but the destination is inaccessible: Check the current selection under Home → Global Routing, then review the rules and DNS settings in Config.
- Reconnects after you turn it off: Check Settings → On Demand and the Connect On Demand setting for the corresponding system VPN entry. Repeatedly deleting the entry is not a troubleshooting step.
Direct and Config handle traffic differently in Global Routing. Under Config, rules may also send different destinations to different policies. For example, FINAL,DIRECT means DIRECT is used when no earlier rule matches. This rule does not grant system VPN permission or prove that all traffic uses the same route. Note the current setup while troubleshooting; don’t change authorization, rules, and connection details all at once.
Common Questions: Passcodes, Auto-Connect, and Reinstalling
Why does iOS ask for my device passcode when I allow the request?
This is the system’s confirmation process for a configuration change. Enter verification details only when prompted by the system authorization screen. Do not enter your device passcode in the connection password or subscription URL fields on Home. Connection passwords and device unlock passcodes serve different purposes.
Will all my traffic go through a proxy after I allow it?
Allowing the request alone does not determine how traffic is routed. Check Home → Global Routing. If you use Config, also review its rules and the policy actually matched. The system VPN status describes the tunnel; it does not mean every request uses PROXY.
Why does it reconnect a while after I turn it off?
First check Shadowrocket → Settings → On Demand, then check Connect On Demand for the system VPN entry. Automatic connection conditions and the manual switch are separate settings. You can temporarily disable automatic connections while troubleshooting, then test starting and stopping the connection manually.
Will reinstalling the app restore all my settings?
Don’t make reinstalling your first recovery step. It may affect details saved in the app, and you may need to complete system authorization again. First make sure your own configuration backup, subscription source, and authentication details are available, then decide whether to reinstall. Restoring a purchase does not restore connection details.
My organization-managed device won’t allow a VPN configuration. Should I remove the management profile?
Do not remove it yourself. Go to Settings → General → VPN & Device Management to check whether the device is managed. Give the administrator the error message, steps you took, and the time it occurred so they can review the VPN policy.
After resolving the issue, verify the result with a repeatable test: turn off the connection and confirm the system status changes; start it again from Home and confirm the status changes normally without another authorization prompt; then test access. If only one website fails, keep a record of Global Routing, the selected Config, and the error details, and continue checking the access path rather than repeating first-time authorization.