When you connect for the first time, Shadowrocket may need system permission to create a VPN configuration. This guide covers iPhone and iPad: learn the difference between a system VPN configuration and an in-app Config file, what to do if you allow or deny the prompt or accidentally delete the configuration, and how to troubleshoot in three stages: configuration, tunnel connection, and access to your destination.
What the Add VPN Configuration prompt means
Shadowrocket uses the VPN capabilities provided by iOS. The first time you turn on the connection switch in Home, iOS may ask whether Shadowrocket can add VPN configurations. This registers a VPN connection managed by the app on your device. It is not a purchase confirmation or a subscription update prompt.
Read the prompt’s explanation about network traffic before granting permission. Once allowed, the app can create the configuration needed to establish a VPN connection. Whether connections use Proxy, Direct, or configuration rules is still determined by Shadowrocket’s settings. Tapping Allow does not add server addresses, ports, or authentication details from your existing provider.
Prompt text: “Shadowrocket” Would Like to Add VPN Configurations
Why it appears: On devices set to English, you may see this system permission prompt to add VPN configurations. It is a standard authorization request, not an indication of a connection problem.
What to do: Check that the app named in the prompt is Shadowrocket, then tap Allow. If you’re not ready to grant permission, tap Don’t Allow and try connecting again from the app later. Devices set to Chinese display the corresponding localized text.
Grant permission only when you initiated the connection and can verify the app’s source. Shadowrocket is a closed-source commercial app available exclusively on the App Store, from developer Shadow Launch Technology Limited. It is a one-time purchase; check the App Store listing for the price and system requirements. Buying the app does not include a service plan.
Allow for the first time: from Home to system approval
The steps below assume you already have your own provider and connection details. Check that the details are saved in Home before connecting to distinguish a permission issue from incorrect connection settings. If you haven’t imported your details yet, see the Getting Started guide.
-
Check your saved details
Open Shadowrocket → Home and check the server entry you plan to use. Verify that its address, port, protocol, and authentication details came from your existing provider. Don’t guess at these values.
-
Start the connection
In Home, select the entry you want to use, then turn on the connection switch at the top. When the system configuration is created for the first time, iOS displays a prompt asking for permission to add a VPN configuration.
-
Approve the system prompt
Check the app name, then tap Allow. If iOS asks for your device passcode or authentication, follow the method shown on screen. Don’t enter your device passcode in the server authentication fields.
-
Check the connection status
Return to Home to check the connection status. Then open Settings → General → VPN & Device Management → VPN and look for the corresponding entry. Menu names may vary slightly depending on the system language and version.
Granting permission does not guarantee access to every destination. The system configuration being added, the tunnel connecting, and a request reaching its destination are three separate checks. If iOS shows a connection but a website still fails, troubleshoot your connection details, DNS, and rules rather than repeatedly deleting the system configuration.
What appears in Settings: system VPN entries vs. Config files
After you grant permission, the system VPN list usually shows an entry created by Shadowrocket. This lets iOS recognize and manage the VPN connection. Here, “VPN profile” refers primarily to this system connection configuration. It is not the same as a device management profile, certificate, or in-app rules file.
Diagnose the issue by layer
If the corresponding entry is missing from the system list, start by granting permission to add it again. If the entry exists but the connection fails, check the details in Home. Reauthorizing the app is not a substitute for checking server settings.
| Item | Where to find it | What it does |
|---|---|---|
| System VPN configuration | System Settings → General → VPN & Device Management → VPN | Registers the VPN connection and links it to the app; displays the system connection status. |
| In-app configuration file | Shadowrocket → Config | Stores configuration such as routing rules, including DOMAIN-SUFFIX, IP-CIDR, GEOIP, and FINAL rules. |
| Connection details | Shadowrocket → Home | Stores your existing server entries and related authentication settings. |
| On-demand connection settings | Shadowrocket → Settings → On Demand | Starts a connection under specified conditions; check these separately when troubleshooting automatic reconnections. |
Proxy, Direct, Config, and Scene in Global Routing are not four separate system permissions. They are in-app routing options. Changing them does not add a system VPN configuration again. When troubleshooting a permission issue, note the current options first so you can isolate the cause without changing several things at once.
Tapped Don’t Allow? Request permission again
If you tap Don’t Allow, the app can’t use that request to add a system VPN configuration. Your Home entries usually remain intact. Denying system permission does not delete your server details, and you don’t need to buy the app again.
-
Return to Home
Cancel the incomplete connection attempt. Check that the entry you want is still in Home, then turn on the connection switch again so the app can request the required system configuration.
-
Check the system VPN list
If the prompt doesn’t appear again, open Settings → General → VPN & Device Management → VPN. If a configuration already exists, it may be normal for the first-time permission prompt not to appear again.
-
Check device restrictions
If you can’t edit the list or iOS says the action is restricted, check whether the device is managed by an organization. For managed devices, ask the administrator to confirm VPN permissions. Don’t delete configurations installed by your organization.
-
Retry and note what happens
Leave the current Settings screen, then open Shadowrocket and try connecting again. If it still fails, note the exact system prompt, whether a VPN entry already exists, and the connection status in Home.
Don’t manually create a regular VPN entry with the same name to replace the configuration created by the app. Matching names do not mean the connection type or app association is the same. Don’t install extra certificates to obtain permission either: adding a VPN configuration and trusting a certificate are separate actions.
Deleted a VPN configuration? Keep your details and recreate it
If you deleted only the Shadowrocket entry from the system VPN list, you usually removed the system connection configuration—not the server entry in Home or the rules file in Config. Open the app and check that your details are still there, then turn on the connection again to let Shadowrocket recreate the required system configuration.
- Turn off automatic connections first: Before removing a configuration yourself, pause on-demand connections in Shadowrocket → Settings → On Demand and disconnect the current session to prevent repeated automatic reconnects while troubleshooting.
- Remove only the relevant entry: Open the system VPN list and tap the information button for the entry to view its details. Remove it only after confirming it belongs to Shadowrocket. Don’t bulk-delete other configurations.
- Recreate it in the app: Turn on the connection again from Home. If iOS asks to add a VPN configuration, confirm the app name and grant permission.
- Check both locations: Confirm the system VPN entry has reappeared, then check the existing content in Home and Config. Recreating the system configuration will not restore provider details you’ve lost.
If you also deleted the app or removed its in-app data, this is no longer just an accidentally deleted system VPN configuration. Reconfigure using details you saved or an existing backup. Don’t make reinstalling your first step, as it may increase what you need to restore.
Allowed access but still can’t connect? Troubleshoot by symptom
Granting permission only lets iOS save and use the VPN configuration. Protocols such as Shadowsocks, VMess, VLESS, Trojan, Hysteria2, and WireGuard each require their own settings. Allowing the system configuration does not verify those settings or check whether your provider account is active.
| What you see | Check first | Next step |
|---|---|---|
| Still stuck at the permission prompt after tapping Connect | Whether you tapped Allow and completed any authentication required by iOS | Check the system VPN list to see whether an entry was created, and note the exact prompt text. |
| The system entry exists, but the connection ends immediately | The selected entry, server address, port, authentication settings, and current network | Check each setting against the details from your existing provider. Change one thing at a time. |
| Shows connected, but some destinations fail | The current Global Routing selection, Config rules, and DNS settings | Note the failed destinations and the rules they match. Don’t delete a system configuration that’s working normally. |
| Reconnects after you disconnect manually | Settings → On Demand and automatic connection settings for other VPNs in iOS | Pause the relevant automatic connection conditions and reproduce the issue to distinguish a manual action from a rule-triggered connection. |
When reporting a problem, include the steps that led to it, the exact prompt text, whether a system VPN entry exists, and whether the issue occurs only on a particular network. Redact subscription links, passwords, private keys, and authentication tokens from screenshots or logs. For more connection help, see the Troubleshooting section in the FAQ.
How to tell when recovery is completeRecovery is complete only when the system VPN entry exists, Home can establish the expected connection, and your test destinations are accessible under the current routing settings. The disappearance of the permission prompt alone doesn’t mean the connection is working again.