When connecting with Shadowrocket for the first time, check that the prompt was triggered by the app you just opened, then allow iOS to add the VPN configuration. This creates a system tunnel; it does not purchase a connection service or install a website certificate. This guide covers initial authorization, identifying the system entry, recovery after declining or deleting it, and troubleshooting after connecting. It is intended for iPhone and iPad users.
1. Why the first connection requires a VPN configuration
Shadowrocket uses Apple’s Network Extension framework to receive and process network traffic. The first time you turn on the connection switch in Home, the app asks iOS to save a VPN configuration. iOS requires your approval because this configuration lets the app handle device network traffic. Even if the service address, port, and password are correct, they cannot replace this authorization step.
Here, VPN refers to the system’s network tunneling capability. It does not mean that every request is forwarded to a remote server. Once connected, how each request is handled depends on Global Routing, the active configuration, and its matching rules. Choosing Direct and disconnecting the system tunnel are also two different things.
The system prompt asks for permission before the tunnel is established; server availability is checked later during connection. So “I tapped Allow” and “the website loads” are two separate checks. Troubleshoot authorization first, then check the service configuration to avoid mistaking a permission issue for a password or DNS problem.
2. What to do when the prompt first appears
First, confirm that you got Shadowrocket from the App Store and that the prompt appeared after you deliberately turned on the connection switch in Home. If you did not initiate a connection, do not approve the prompt based on the app name alone. Cancel it and return to the app to check what you were doing. The wording varies by iOS language and version, but the prompt asks to add a VPN configuration.
- Check Home: Make sure you already have your own connection configuration. Get subscription links from your service provider. Allowing iOS to add a VPN configuration does not create a working connection service.
- Turn on the connection switch: Start a connection from Home and wait for the iOS authorization prompt. Do not toggle the switch rapidly or repeatedly.
- Confirm the app: Check that the prompt names Shadowrocket, then tap “Allow.” If iOS asks you to authenticate, follow the system prompt. Do not enter your device passcode on a service provider’s website.
- Return to the app: Wait for the connection status to stabilize. If the switch turns off immediately, note the prompt you see and determine whether authorization failed or the server connection failed.
- Test access: Open a website you know to check the connection. Seeing the VPN indicator alone does not confirm that DNS, rules, and the remote connection are all working.
“Shadowrocket” Would Like to Add VPN Configurations
Why it appears and what to do: This is an authorization prompt shown when saving a system VPN configuration for the first time, not a server error. If you initiated the connection, tap “Allow” and complete any authentication requested by iOS. If you tapped “Don’t Allow,” return to Home and start a connection again to retry the authorization flow.
Do not confuse this system prompt with importing a subscription. Importing a subscription provides connection settings; system authorization lets the app establish a tunnel. The former is managed in the app, while the latter is controlled by iOS. Changing one does not automatically fix the other.
3. VPN entries and configuration profiles in Settings
After you allow the request, you can view the related connection entry in Settings → General → VPN & Device Management → VPN. The exact menu names and layout may vary slightly by iOS version. You can also search for VPN in Settings.
People often refer to this entry as a “VPN profile,” but a VPN configuration, a device management profile, and a certificate are different things. They may appear in nearby sections of Settings, but they are not interchangeable. Normal VPN authorization does not require trusting a root certificate or enrolling the device in organization management.
| Item | Purpose | How to check |
|---|---|---|
| System VPN configuration | Stores the system association and connection settings needed to establish a tunnel | Open the system VPN list and look for the entry associated with Shadowrocket |
| Servers and subscriptions in Home | Stores addresses, ports, authentication details, and existing subscriptions | Check these in Shadowrocket’s Home; do not edit these settings in the system VPN list |
| Configuration in Config | Defines settings such as rules and DNS | Check the active configuration in Config; do not confuse it with system authorization |
| Device management profiles or certificates | Used for their respective device policies or trust settings | Check their source and purpose separately. Do not delete other entries to fix VPN issues |
Bottom line: identify the item before deciding whether to delete it
If the system VPN entry is present but the connection settings are missing from Home, restore your existing service configuration. Do not delete certificates or device management entries to fix the server list.
4. Recovering after tapping “Don’t Allow” or deleting the configuration
If you tapped “Don’t Allow” by mistake, you usually do not need to reinstall the app. Return to Shadowrocket’s Home, turn the connection switch off, then start a connection again and see whether iOS asks for authorization. If the prompt does not reappear, first check the system VPN list for an existing usable entry. Not seeing the prompt again does not necessarily mean authorization is still denied.
- Keep your in-app data: First check that your servers and subscriptions in Home and your active configuration in Config are still there. Avoid reinstalling as a first step, since it can add extra work to restore your data.
- Stop automatic connections: If the connection turns on automatically, check Settings → On Demand and temporarily disable the relevant automatic connection settings. Also check whether Connect On Demand is enabled in the system VPN entry’s details.
- Check the system entry: Open the system VPN list and view the details for the Shadowrocket entry. Use Delete VPN only if you have confirmed the entry belongs to Shadowrocket and need to rebuild it. Do not delete entries used for organization management or other purposes.
- Start a new connection: Return to Home and turn on the connection switch so the app can create the required system configuration. Tap “Allow” if the system prompt appears.
- Verify before re-enabling automation: First confirm the connection works manually, then restore any On Demand conditions you need. This prevents automatic reconnections from obscuring the results of your test.
If your device is managed by a school or organization, system policies may restrict adding or changing VPN settings. If a button is unavailable, an entry cannot be deleted, or authorization is blocked, check with your device administrator about what is allowed. Do not repeatedly delete device management profiles. Check the App Store page for system requirements and compatibility.
5. Allowed the request, but the connection fails or websites won’t load
A system VPN entry means the configuration was saved; a connection status only indicates the tunnel’s current state. Neither confirms that your service provider account, remote address, DNS, or rules are correct. Narrow down the cause in the order below, changing one setting at a time and noting what happens before and after each change.
- Check your basic network first: Disconnect Shadowrocket and see whether your current Wi-Fi or cellular network can access the internet normally. If public Wi-Fi requires a sign-in page, complete that network authentication first.
- Check the service settings: In Home, check the selected server’s protocol, address, Port, and authentication fields. For example, if your service provider specifies Port
443, enter that exact value. The same port does not make different protocols, such as Shadowsocks and Trojan, interchangeable. - Check Global Routing: Config applies the rules in your active configuration; Proxy uses a proxy routing mode, while Direct uses a direct connection mode. Switching modes temporarily can help isolate an issue, but it does not fix incorrect settings. Restore your original selection when troubleshooting is complete.
- Tell DNS issues apart from connection failures: If a latency test returns a result but websites do not load by domain name, check the DNS settings actually in use in Config and review the access records. A latency test is not a full website access test.
- Check rule order: When using Config, rules are matched from top to bottom according to the active configuration. The first matching rule determines how traffic is handled;
FINALis the fallback. Do not assume a domain is using the proxy just because the VPN indicator is visible.
If another VPN app is connecting automatically, pause any connections and automatic triggers not involved in this test, then check Shadowrocket again. Do not mistake alternating connection states for repeated authorization failures. Rebuild the system entry only if it cannot be saved or is clearly damaged; a website failing to load is not enough to justify rebuilding it.
6. Common questions about authorization and automatic connections
After I tap “Allow,” does all traffic go through a remote server?
No. Check Global Routing in Home, then review the active rules in Config. System authorization enables the tunnel; the selected mode and configuration determine how traffic is handled. You cannot tell Direct from rule-based direct connections by looking at the status bar indicator alone.
Why does the connection turn back on after I turn it off?
Check automatic connection conditions in Settings → On Demand, then check Connect On Demand in the system VPN entry’s details. While troubleshooting, temporarily disable automatic triggers, disconnect manually, and observe what happens. Restore the conditions you need once the behavior is as expected.
Do I need to install a certificate to access the internet after authorization?
Adding a VPN configuration does not require installing a root certificate. If you are setting up your first connection, return to Home and check the connection settings and status. Do not treat a certificate installation prompt from a website as a follow-up step to system VPN authorization.
Will deleting the system VPN entry cancel my app purchase?
No. System connection settings and App Store purchase records are managed separately. If you still have the app, return to Home and reconnect to authorize again. For restoring a purchase or getting the app again, follow the official purchase verification guide and the instructions on the App Store.
Is it normal to see the add configuration prompt every time I connect?
A saved configuration that has not been removed usually does not need to be added again each time. Check whether the authorized entry is still in the system VPN list and whether it was manually deleted or removed by a device management policy. Then note the exact steps that trigger the prompt instead of repeatedly reinstalling the app.
7. What to record after troubleshooting
After restoring the connection, keep a record of your checks without sensitive settings. This makes it easier to distinguish permission issues from network problems next time. If you report a connection issue to your service provider, precise symptoms are more helpful than saying “VPN doesn’t work.” Do not share full subscription links, passwords, private keys, or QR codes containing them.
- Authorization: Is there a Shadowrocket entry in the system VPN list? Does the system still ask to add a configuration when you connect?
- What triggered the issue: Did it happen when connecting manually from Home, switching networks, or after an On Demand trigger?
- Test environment: Were you using Wi-Fi or cellular? Did the basic network work with the tunnel disconnected?
- App state: Which Global Routing option and protocol were active? Did the failure occur before the connection was established or when loading a website?
Shadowrocket is a paid, closed-source app available exclusively on the App Store, primarily for iPhone and iPad. The app is a one-time purchase; check the App Store page for current pricing and purchase terms. Buying the app does not include a connection service, and system authorization does not include one either. Get any existing subscription from your service provider.