This guide is for iPhone and iPad users setting up Shadowrocket for the first time, accidentally denying system authorization, or unable to connect after deleting a VPN configuration. First, distinguish the system VPN configuration from Config in the app and the connection toggle on Home. Then check authorization, startup, and traffic handling in that order. The steps assume you already have your own provider and connection configuration; they do not provide or recommend configuration sources.
1. What the “Add VPN Configuration” Prompt Means
Shadowrocket uses the system’s VPN functionality to start a connection. The first time you initiate one, iOS or iPadOS asks you to confirm that the app can add a VPN configuration. This authorization lets the system save and use the app’s VPN connection configuration. It does not purchase a connection service or mean the app has connected to a remote server successfully.
On devices set to Chinese, the prompt typically asks to add a VPN configuration; on devices set to English, you may see the message below. This is an authorization request, not a connection error. Check that the request was triggered by the Shadowrocket app you are using before deciding whether to allow it. Never enter your device passcode in a pop-up from an unknown source.
Prompt: “Shadowrocket” Would Like to Add VPN Configurations
Why it appears and what to do: The app is requesting permission to add a system VPN configuration. If you’re starting a connection for the first time or recreating the configuration, tap Allow and complete any device authentication required by the system. If you tap Don’t Allow, the configuration won’t be added; return to Home and try connecting again.
The system may then ask for your device passcode or another form of authentication; the exact screen varies by device. This is not a request for your connection configuration password or your App Store purchase credentials. After authenticating, return to the app and check the actual connection status.
2. System VPN Configuration, Config, and the Connection Toggle
People often call the VPN entry in system settings a “VPN profile.” For troubleshooting, “system VPN configuration” is more precise: it passes the app’s connection request to the system. It is not a complete Shadowrocket backup and cannot replace connection parameters or rule files in the app.
The toggle on Home starts or stops a connection; it is not a permanent authorization switch. Files in Config control related behavior within the app—for example, when Global Routing is set to Config, requests are handled according to the rules. The system VPN configuration exists at the system level. Deleting one of these items does not necessarily delete the other two.
Diagnosis: Identify Where the Process Stops
If Shadowrocket is missing from the system’s VPN list, check authorization first. If the entry exists but the connection won’t stay active, check the startup stage. If the connection stays active but pages fail to load, check your existing configuration, rules, and DNS. Don’t keep changing rules before authorization is complete.
3. What to Check After Tapping Allow
For the first connection, start from Home in Shadowrocket rather than repeatedly toggling VPN in system settings. This makes it easier to match the selected connection, the app’s feedback, and the system status. Menu names may vary by language and OS version; use the paths below as a guide and follow the labels on your device.
- Open Home and confirm that an existing connection is listed and selected. If the list is empty, import or enter details using your existing configuration information. System authorization does not populate the list.
- Turn on the connection toggle and wait for the system’s request to add a VPN configuration. Verify the app name, tap “Allow,” and complete authentication if prompted. Don’t tap the toggle repeatedly while this is in progress.
- Return to Home and check whether the connection stays active. If the toggle switches off immediately, note any message that appears, then check system settings to see whether the VPN entry was saved.
- On your device, open Settings → General → VPN & Device Management → VPN and look for the Shadowrocket entry. Some system versions may also provide a more direct VPN menu.
- Once the connection stays active, test a website you can normally access. Record “system shows connected” and “the destination page loads” as two separate checks.
The VPN icon in the status bar alone is not enough to determine connection status; its position can vary by device and display context. Check both Home and the system VPN page. A connected status in system settings also does not mean every destination uses the same route.
4. Recreate a VPN Configuration After Denying Permission or Deleting It
Tapping “Don’t Allow” by mistake does not mean you need to buy the app again or reinstall it. Return to Home and turn on the connection toggle again to see whether the system requests authorization. If no prompt appears, don’t assume permission was granted; first check whether the system VPN list already contains an entry.
- First, turn off the connection toggle on Home. If the connection starts again automatically, open Settings → On Demand in Shadowrocket and temporarily turn off on-demand connection, then return to Home and stop the connection.
- Check whether your existing connections on Home and files in Config are still there. Deleting a system VPN entry usually does not delete in-app data, but check the lists on your device to confirm.
- Return to Home and start a connection so the app can request a new system VPN configuration. Complete the authorization prompt if it appears, then check whether the corresponding entry has returned to the system list.
- If there’s still no response, quit the app normally, reopen it, and try again. Note the status on the system VPN page and any messages in the app. Don’t delete the app as a first step; you could lose local settings that haven’t been backed up.
Only consider removing and recreating the Shadowrocket VPN entry in system settings if you’ve confirmed it is faulty, know how to restore it, and have safely saved your configuration. Check the entry name carefully to avoid removing another VPN configuration. Removing a system entry does not replace a rule file or fix an incorrect server address or port.
Can I allow VPN access after tapping “Don’t Allow”?
Return to Home and try connecting again, then check whether the system displays the request again. If it doesn’t, check the VPN list in device settings to see whether an entry already exists, and continue based on what you find.
Does deleting the VPN entry in Settings also delete my subscription?
The system VPN configuration and subscriptions or connections saved on Home are separate items. Open Home and check what’s still there before importing anything again. If your in-app data remains, recreate the system authorization first.
Do I have to buy the app again to recreate the VPN configuration?
Recreating a system VPN configuration is a connection authorization step, not an app purchase. If you need to get the app again, first check your current Apple Account’s purchase history in the App Store. Purchase eligibility is as shown on the App Store page.
Why does the connection turn back on after I switch it off? Is the toggle broken?
Check Settings → On Demand and the on-demand connection setting for the VPN entry in system settings. Temporarily turn off on-demand behavior and test manually to distinguish automatic activation from a problem with the manual toggle.
5. Troubleshoot an Unresponsive Connection Toggle by Symptom
“Unresponsive” could mean no authorization prompt appears, the toggle switches off immediately, the connection stays in progress, or the connection succeeds but websites don’t load. Each points to a different stage. Change one condition at a time and note the original selection and messages so you can tell what affected the result.
| What you see | Check first | Next step |
|---|---|---|
| First attempt; no authorization prompt | Whether the system VPN list already contains a Shadowrocket entry | If an entry exists, check its connection status. If not, reopen the app and start a connection; also check for device management restrictions. |
| Toggle switches off immediately after tapping Allow | App messages, selected connection, and system VPN entry | Note the message, verify the existing configuration is complete, then try connecting manually once |
| Connection resumes automatically after you turn it off | Settings → On Demand and system on-demand connection settings | Temporarily turn off on-demand connection and see whether the manual toggle stays off |
| Another VPN is connecting | The active connection shown on the system VPN page | Stop the other connection manually, then test again from Home to avoid confusion from switching back and forth |
| System says connected, but websites fail to load | Existing connection parameters, Global Routing, DNS, and the destination address | Continue with traffic troubleshooting. Don’t delete the system VPN configuration just because a website won’t load. |
If the problem occurs only on a particular Wi-Fi network, try another network when available and compare the results. Don’t change the protocol, DNS, and rules at the same time as switching networks, or you won’t know whether the cause was the network or a configuration change. When reporting the issue to support, describe it as “toggle switches off” or “connected, but can’t access the site” rather than simply “it doesn’t work.”
6. Connected but Unable to Browse? Don’t Repeat Authorization Steps
If the system VPN entry exists and the connection stays active, you’ve usually passed the configuration step. Next, check the selected item on Home and Global Routing. Proxy, Direct, Config, and Scene are routing options, not four types of system authorization; switching between them does not replace tapping “Allow” to add a VPN configuration. Scene also depends on your existing scene settings, so it isn’t a general-purpose fix when the conditions are unknown.
- Check connection parameters: Verify the server address, port, and authentication details against your existing information. Parameters for Shadowsocks, VMess, VLESS, Trojan, Hysteria2, and WireGuard are not interchangeable. Don’t switch protocols at random when troubleshooting an authorization issue.
- Check routing: Direct connects directly, Proxy routes through a proxy, and Config applies the selected configuration. If the result isn’t what you expected, note the current mode before checking its settings.
- Check rule files: In Config, DOMAIN-SUFFIX matches domain suffixes; GEOIP and IP-CIDR are used to evaluate destination addresses; FINAL handles traffic that matches none of the preceding rules. A rule issue is separate from system authorization.
- Check DNS: A latency test returning a result only shows that a response was received under those test conditions. It doesn’t guarantee that website domains resolve, the destination can be reached, or subsequent traffic works. Note the domain that failed and the network conditions during the test, then check DNS settings.
- Update subscriptions with care: First confirm that the issue is actually caused by an outdated existing configuration, then update your own subscription. Updating a subscription does not recreate system VPN authorization and should not be a routine fix for every toggle issue.
When reporting an issue, note your device type, OS version, whether an authorization prompt appeared, whether the system entry exists, the status on Home, the selected Global Routing mode, and any differences before and after switching networks. Don’t share full subscription URLs, authentication passwords, or private keys. Redact sensitive fields in screenshots. System requirements and compatibility are as listed on the App Store page.
Conclusion: Separate Authorization Checks from Access Checks
First confirm both that the system entry exists and that the connection stays active. Then adjust traffic-related settings. If both are true, check your existing configuration and the destination that failed instead of repeatedly deleting the VPN entry.