Before Shadowrocket can connect for the first time, iOS must authorize it to add a VPN configuration. This system configuration provides the connection entry point; it is not the app’s Config file and does not include a ready-to-use connection service. For iPhone and iPad users who already have their own service and configuration but are stuck on authorization or VPN settings, this guide covers four cases: allowing access for the first time, tapping Don’t Allow by mistake, restoring a deleted entry, and dealing with repeated disconnections.
1. Why Shadowrocket Needs to Add a VPN Configuration
In short: if the prompt appears after you turn on the connection switch in Shadowrocket’s Home screen, and it names the correct app, it is the system’s authorization step for creating a VPN configuration. Installing the app, importing a subscription, or selecting a connection does not mean iOS has already authorized the app to create a network tunnel.
Shadowrocket uses the system’s network extension capabilities to handle traffic. The system VPN configuration links the app’s network extension to the VPN connection entry on your device. The app then uses the current Global Routing setting and its configuration to determine how requests entering the tunnel are handled. The system’s use of the term VPN does not mean every request goes to the same remote endpoint or uses the same outbound route.
After you allow the configuration, the system may ask you to confirm with your device passcode or another system authentication method. The exact prompt depends on iOS. Use your device’s authentication method—not a subscription password—and never enter a connection password from your service provider into a system authentication prompt. Proceed only when you initiated the connection. If you’re unsure why or when the prompt appeared, cancel it and check the app first.
2. System VPN Configurations, Device Profiles, and Config Files
People often refer to any VPN entry in Settings as a “VPN profile.” For troubleshooting, distinguish three separate things: the system VPN configuration, a device configuration profile, and Shadowrocket’s Config. They may appear in nearby Settings screens, but they serve different purposes and are not interchangeable.
| Item | Where to find it | Purpose |
|---|---|---|
| System VPN configuration | Settings → General → VPN & Device Management → VPN | Stores the link between the system connection entry and its network extension, so iOS can start, stop, or trigger the connection on demand. |
| Device configuration profile | Settings → General → VPN & Device Management | An organization can use this to install managed settings, certificates, or VPN configurations. It is not a file you need to install every time an app connects. |
| In-app Config | Shadowrocket → Config | Controls app-level behavior such as rules and DNS. Check Global Routing as well to determine how traffic is routed. |
On devices set to Chinese, these paths usually appear as Settings → General → VPN & Device Management → VPN. Some iOS versions also provide a more direct VPN entry; follow the labels shown on your device. When you open an entry, check its name and associated app rather than assuming any VPN in the list is the right one.
First, Identify Which Layer Is Missing
If the system list has no entry for Shadowrocket, return to the app and trigger authorization again. If the entry exists and connects but a website behaves unexpectedly, check Global Routing and Config. Repeatedly deleting the system entry will not fix routing rules.
3. Allow the Configuration for the First Time
These steps assume you already have your own service and a working configuration. Buying the app and obtaining a connection service are separate things; system authorization does not supply a server address, port, credentials, or rules. For the first attempt, keep your current in-app configuration unchanged so you don’t alter several variables at once.
-
Check Your Existing Configuration
Open Shadowrocket → Home, make sure your connection entry has been imported, and select the one you want to use. Importing a Config alone does not guarantee that you have usable remote connection parameters.
-
Turn On the Connection Switch
Turn on the connection switch on Home and wait for the system prompt to add a VPN configuration. Don’t toggle the switch repeatedly while the prompt is still pending.
-
Authorize the System Configuration
Check that the prompt names Shadowrocket, then tap Allow. If the system asks you to authenticate, follow the on-screen instructions. If you cancel authentication, the configuration may not be added.
-
Check the System Entry
Go to Settings → General → VPN & Device Management → VPN and check the corresponding entry and its status. Then return to Home and check the connection status.
-
Test Access
Visit a page you know and are authorized to access, and note whether it loads. A system status of Connected confirms the tunnel state, but does not verify DNS, routing rules, or the remote service.
After the initial authorization, subsequent connections usually reuse the saved system configuration instead of asking you to add it again. If the prompt keeps appearing, first check whether the system entry was deleted, whether the app can save its settings, and whether device management policies restrict changes.
4. Recover After Tapping Don’t Allow or Deleting an Entry
Tapping Don’t Allow usually means the configuration was not added this time; it does not mean your subscription is invalid. Return to Shadowrocket → Home and make sure the connection switch is off, then turn it on again to have the app retry creating or saving the system VPN configuration. If no prompt appears, check the system VPN list first: the entry may already exist, in which case there is no need to add it again.
- If the prompt appears again: Check that it names the app, tap Allow, complete system authentication if requested, and then check the connection status.
- If you deleted the system VPN entry: Keep your in-app data, return to Home, and turn on the connection switch again so the app can recreate the linked configuration.
- If you deleted the in-app Config: The system VPN entry will not restore your rules file. Restore it from your own backup or original configuration source, then check which item is selected.
- If you deleted a connection from Home: Reimport it using your existing service details or subscription. Reauthorizing the system VPN alone will not restore the connection entry.
Deleting the system VPN entry usually does not also delete Shadowrocket’s Home entries or Config, but open the app to check rather than assuming that removing it from Settings erased all app data. Conversely, reinstalling the app may affect local data, so don’t make that your first step. Before attempting recovery, save any configuration you’re entitled to keep so an authorization issue doesn’t turn into a data recovery problem.
5. Troubleshoot Authorization and Connection Problems Separately
An authorization problem means the system configuration could not be added or enabled. A connection problem means an existing configuration starts but cannot stay connected, or requests cannot complete. These require different checks. First, see whether the corresponding entry appears in the system VPN list. Then note whether the Home switch turns off immediately, whether the system continues to show Connected, and whether pages load.
Error: The VPN configuration is invalid.
Cause and fix: This is an English description of an invalid system VPN configuration; the wording and location may vary by system language. If you see this message in diagnostics, stop the connection and check the corresponding entry in Settings. Save your in-app configuration, then rebuild only Shadowrocket’s system VPN entry and authorize it again. Don’t change a subscription URL or remote port based on this error alone.
Tapping Don’t Allow is an authorization choice, not the invalid-configuration error described above. When troubleshooting, preserve the exact text shown on screen. If no error message appeared, record what you observed—for example, “The entry appeared in the list after I tapped Allow, but the connection switch turned off immediately.” Don’t assign an error message or code that wasn’t shown.
| What you observe | Check first | Next step |
|---|---|---|
| No system entry after tapping Don’t Allow | Whether authorization to add the configuration was completed | Return to Home, turn on the connection switch, and respond to the system prompt. |
| Entry exists, but the switch turns off immediately | System configuration, network extension startup, and diagnostic logs | Record the exact error text, stop other personal VPN connections, and test Shadowrocket by itself. |
| System says Connected, but pages won’t load | Remote connection details, DNS, Global Routing, and rules | Check the status of your existing service and the app’s current configuration. Don’t delete the system entry first. |
| Connection resumes automatically after you turn it off | On Demand and other automatic connection policies | First check Settings → On Demand. Temporarily turn it off, then test the switch manually. |
If Global Routing is set to Config, check the rules in Config too. Proxy and Direct apply different global routing behavior; an enabled connection switch does not mean every request goes through a proxy. On Demand controls whether a connection starts automatically when its conditions are met; it is not a workaround for failed authorization. Note the current settings before testing and change one setting at a time so you can identify what affected the result.
6. Common Questions About Permissions and VPN Profiles
Does tapping Allow make my subscription work?
No. Tapping Allow only authorizes the system connection entry. Return to Home and check your connection entry, then use your existing service details to verify the address, port, credentials, and current status. A subscription that updates successfully does not guarantee that every connection in it can currently connect.
Why can’t I find a VPN profile to download?
When you turn on the connection switch, Shadowrocket asks iOS to add the VPN configuration. You don’t need to obtain a separate profile. Check the system VPN list and the Home status first; don’t mistake a certificate or device management profile requested by a website for this system authorization step.
If it reconnects after I turn it off, does that mean authorization is still enabled?
A saved system configuration and an active connection are separate things. In Shadowrocket → Settings → On Demand, check the on-demand connection setting. Also check the corresponding VPN entry in Settings for an on-demand option, if available. Pause automatic connections, turn the connection off manually, and see whether it reconnects.
Will I need to authorize it again after restarting my device?
Restarting your device usually does not delete a saved system VPN configuration. If you’re asked to add it again, check whether the entry is still in the system VPN list. Note whether you deleted the entry, reinstalled the app, or changed device management settings; don’t assume the configuration is damaged just because you restarted.
There are other VPNs in the list. Should I delete them all?
No need to delete them in bulk. Disconnect other personal VPNs to avoid switching between them during testing, then start only Shadowrocket. Ask your administrator about work- or school-managed connections. Rebuild an entry only when you’ve identified it as Shadowrocket’s and confirmed it needs to be recreated.
7. What to Record If the Problem Persists
If the steps above don’t resolve the issue, collecting details is more useful than repeatedly allowing, deleting, or reinstalling. Record “configuration not added,” “connection failed to start,” and “connected but unable to access sites” as separate symptoms so the right part of the setup can be checked. For more help troubleshooting, see the site’s Troubleshooting guide.
- Device and system: Record your iPhone or iPad model and the system details shown on your device. Refer to the App Store page for system requirements.
- Steps that triggered the issue: After turning on the connection from Home, note whether the prompt never appeared, the connection failed after you tapped Allow, or it disconnected after being connected for a while.
- System status: Note whether the corresponding entry appears in the system VPN list, its connection status, and whether Settings → On Demand is enabled.
- Diagnostic details: Keep the exact error text and when it occurred. Before sharing, remove the full subscription URL, access tokens, passwords, server details, and other personal data.
Shadowrocket is a paid app sold on the App Store as a one-time purchase; buying the app does not include a connection service. Before purchasing, check the developer, Shadow Launch Technology Limited, and app ID 932747118. These system authorization steps are primarily for iPhone and iPad. See the App Store page for compatibility and system requirements.