When Shadowrocket connects for the first time, iOS asks for permission to add a VPN configuration. This authorizes a system tunnel; it does not import a Config or confirm that a server is available. This guide focuses on iPhone and iPad and explains how to check authorization, distinguish a VPN entry from a device management profile, restore a deleted entry, and troubleshoot interference from another VPN connecting automatically.
1. Add VPN Configuration: Authorize a System Tunnel
In brief: If you just turned on the connection switch on Shadowrocket’s Home screen and iOS then asks to add a VPN configuration, you can allow it after verifying the app’s source, then complete any authentication requested by iOS. This lets the app register a VPN configuration with the system so iOS can start the corresponding network extension and handle the traffic it is configured to process.
After you allow it, a VPN entry associated with Shadowrocket appears in Settings. It represents the connection endpoint, not the remote service itself. If you already have a provider and subscription, the server address, port, and authentication parameters are still determined by your existing configuration. Authorization does not supply these details or replace checking them.
The system prompt may say that network activity can be filtered or monitored. This describes what a VPN configuration can do with traffic. Check which app initiated the request and what you were doing; the prompt alone does not indicate a network problem. Allowing authorization does not decrypt all HTTPS traffic. Certificate trust and related settings for HTTPS decryption are separate steps.
2. VPN Entries, Config, and Profiles Are Different Things
“VPN profile” is often used as a general term for VPN settings in iOS, but troubleshooting requires distinguishing three things: the system VPN entry, a Config inside Shadowrocket, and a configuration profile in device management. They may appear in nearby areas of Settings, but they serve different purposes and removing them has different effects.
| Item | Where to find it | Purpose and what happens when removed |
|---|---|---|
| System VPN entry | System Settings → General → VPN & Device Management → VPN | Allows iOS to start the corresponding VPN connection. If removed, the app must create it again or request authorization. |
| Config in the app | Shadowrocket → Config | Stores settings such as routing rules. It is not a system authorization record, so removing the system VPN entry usually does not delete this file. |
| Configuration profile | The profiles section under System Settings → General → VPN & Device Management | May include certificates, network settings, or management settings. Profiles deployed by an organization may be restricted and should not be removed like an ordinary VPN entry. |
The table uses the English names shown in iOS. Entry names and visible options vary with system language, iOS version, and device management status. If you cannot find the section, search for “VPN” in Settings and check the VPN list. For Shadowrocket’s system requirements, refer to the App Store listing.
Bottom line: Identify what was removed
If only the system VPN entry is missing, return to Home and try connecting again. If a file is also missing from Config, restore it from a copy you saved. Do not remove a device management profile to fix a problem with in-app rules.
3. What to Do After Allowing or Accidentally Canceling
If authorization was canceled, the app cannot add the system configuration just by switching the connection on. Leave your existing servers and Config unchanged, then try connecting again. This makes it easier to tell whether the problem is limited to system authorization instead of introducing several changes at once.
-
Verify the app
Make sure you are using Shadowrocket from the App Store. The developer is Shadow Launch Technology Limited, and the app ID is 932747118. See the genuine app verification guide.
-
Return to Home
Open Shadowrocket → Home and make sure your existing servers are still there. If the switch is on but no connection is established, turn it off, then on again to initiate a new connection.
-
Complete authorization
When iOS asks to add a VPN configuration, tap Allow and complete any authentication it requests. Do not switch to another app to enter your device passcode, and do not confuse system authorization with signing in to a subscription.
-
Check the VPN entry
Go to System Settings → General → VPN & Device Management → VPN. Confirm that an entry for Shadowrocket is present, then return to the app and check the connection status.
-
Test a request
Open a website you can normally access and check the app’s connection logs to see whether requests are passing through. A connected status in iOS confirms the tunnel state, but does not by itself prove that every destination is reachable.
Prompt: “Shadowrocket” Would Like to Add VPN Configurations
Why it appears: The app is requesting permission to add a VPN configuration to iOS. This is an authorization prompt, not a server error. The wording may vary with the system language.
What to do: If the prompt appears right after you turn on the connection in Home, verify the app, then allow it and complete system authentication. If you previously tapped Cancel, return to Home, turn the switch off, and turn it on again.
If no prompt appears the next time you turn the connection on, that does not necessarily mean authorization failed. A valid entry may already be saved in iOS. Check the VPN list and actual connection status first. Investigate device management restrictions and existing configurations only if the entry cannot be created, the action is restricted, or the connection keeps failing.
4. Restore a Deleted System VPN Entry
Removing only the system VPN entry generally does not also remove servers, subscription records, or Config files already in Shadowrocket. Before restoring it, check that this data is still there; do not uninstall the app as a first step. Uninstalling creates an additional risk of data loss and can turn a simple authorization issue into a configuration recovery problem.
- First, stop automatic connections: In Shadowrocket → Settings → On Demand, check for enabled automatic connection settings and temporarily turn them off. This prevents network conditions from triggering another connection while you troubleshoot.
- Check app data: Check your existing servers in Home and your current configuration file in Config. If both are present, do not re-import a subscription or overwrite Config yet.
- Re-create the connection entry: Return to Home, turn on the connection, and allow the VPN configuration when iOS prompts you. If no prompt appears, check whether the corresponding entry is already back in the VPN list.
- Check what has been restored: Separately verify that the system entry exists, the connection succeeds, and websites are reachable. Treat these as three distinct checks; having tapped Allow does not mean network access is restored.
On a school- or organization-managed device, creating, changing, or removing VPN configurations may be restricted. If an option is unavailable or iOS displays a management notice, ask the device administrator to confirm the policy. Do not remove an unfamiliar management profile; it may include work network settings, certificates, and device management requirements.
5. Using Multiple VPN Entries: Saved Does Not Mean Connected
The system VPN list can store multiple entries, but having several saved does not mean they can all handle the same traffic at once. When troubleshooting a standard device-wide VPN, assume that only one should be active at a time. Managed per-app VPNs and other configurations work differently; they do not mean ordinary connections can be freely stacked.
If another connection replaces Shadowrocket right after you turn it on, or a connection comes back on soon after you turn it off, check automatic connection conditions first instead of repeatedly tapping the switch. Shadowrocket’s Settings → On Demand and automatic connection settings for other entries can both affect what you observe. Turn them off one at a time and test each change separately.
| Observed state | What to check first | Recommended action |
|---|---|---|
| Multiple entries are listed, but only one is connected | Is the active entry from the app you expect? | Leave the other entries in place; there is no need to delete them just to tidy the list. |
| The connection comes back on automatically after you turn it off | On Demand or another automatic connection condition | Temporarily turn off automatic connections, then toggle the connection manually to test. |
| Another entry takes over after the connection starts | Is another app still initiating a connection? | Stop the other connections first and test with Shadowrocket as the only active one. |
| Settings are locked or cannot be changed | Is the device subject to organization management restrictions? | Ask the device administrator which connection methods are permitted. |
After testing, restore On Demand if needed. Record the Wi-Fi or cellular network in use, the active connection entry, and the automatic connection status before and after. If the issue occurs only after switching networks, check the trigger conditions first rather than assuming the authorization record is damaged.
6. Authorized but Still Offline? Troubleshoot the Connection
Once the system VPN entry exists and is connected, focus on the app configuration and network rather than authorization. Global Routing on Home determines how traffic is handled: Proxy, Direct, Config, and Scene are not different authorization levels. In particular, Config relies on the rules in the selected configuration. The VPN icon in iOS does not mean every request is being routed through a proxy.
With Config selected, rules such as DOMAIN-SUFFIX, IP-CIDR, and GEOIP, along with the FINAL fallback, affect where requests go. Check the selected configuration and the rule matched by the request instead of looking for the system authorization prompt again. Verify server addresses, ports, authentication details, and protocol settings against the original information you saved. Do not change ports at random while troubleshooting.
I tapped Allow. Why still can’t I open websites?
First, confirm that the connected entry in the system VPN list belongs to Shadowrocket. Then check the server selected in Home and the Global Routing mode. Authorization only creates the tunnel entry. If Config rules route a destination to an unavailable outbound, access can still fail.
Do I have to approve the VPN prompt every time I connect?
A valid system VPN entry usually remains saved, so you do not need to recreate it for each connection. If the authorization prompt keeps appearing, check whether the entry was removed, whether creation completed, and whether the device is managed. Reinstalling repeatedly is not a substitute for checking these things.
If I deleted the VPN entry, do I have to buy the app again?
Deleting a system entry does not delete your purchase. Open the installed copy of Shadowrocket, turn on the connection in Home, and complete authorization again. If the app is still installed, there is no need to acquire it again just to recreate the entry.
Does allowing the VPN mean I trust its HTTPS certificates?
No. Authorizing a VPN configuration and installing or trusting a certificate are separate actions. You do not need to change certificate trust just to restore a system VPN entry. If the device already has related settings, find out what they are for before changing them.
When you finish troubleshooting, check three things separately: the system entry exists, the expected entry is connected, and requests are handled as intended. To check your configuration further, read the setup guide or settings guide. Keep a record before each change and change only one thing at a time.