When Shadowrocket connects for the first time, it needs permission to add a VPN configuration to iOS. This guide distinguishes the system VPN configuration from in-app rule files and provider subscriptions, shows where to find the configuration on iPhone and iPad, and explains what to do if you tap “Don’t Allow,” delete the configuration by mistake, see it reconnect automatically, or connect but can’t access the internet. Check system permission first, then troubleshoot the in-app connection and routing. Not every issue is caused by the VPN profile.
What does adding a VPN configuration authorize?
Shadowrocket handles connections using Apple’s Network Extension framework. When you turn on the connection switch in Home for the first time, iOS asks for confirmation if the corresponding VPN configuration isn’t already present. This authorizes the creation of a system network configuration; it isn’t a purchase confirmation or a prompt to import a subscription. Opening the app, browsing Home, or viewing Config doesn’t complete this step.
Once you allow it, iOS saves a VPN configuration associated with the app. The corresponding Network Extension handles connections when they start. iOS warns that a VPN may filter or monitor network activity on your device, so decide based on the app’s source and the configuration you use. Permission alone doesn’t prove that a remote connection is working, nor does it mean all websites will use a remote proxy.
Prompt: “Shadowrocket” Would Like to Add VPN Configurations
Why it appears and what to do: iOS is asking permission to create a VPN configuration; this doesn’t mean the connection has failed. Check that the app name in the prompt matches the app you’re using, then tap Allow. If iOS asks for your device passcode or authentication, follow the on-screen instructions. The localized wording may vary with your system language.
Shadowrocket is a closed-source commercial app available as a one-time purchase on the App Store. The developer is Shadow Launch Technology Limited. Buying the app doesn’t include a connection plan; any remote connection discussed below assumes you already have your own provider and subscription. Check the App Store listing for system requirements and purchase availability.
VPN configurations, Config, and subscriptions: what’s the difference?
In this context, “VPN profile” usually refers to an entry in the system’s VPN list. It isn’t the same as a configuration profile installed by an organization to manage a device, and it shouldn’t be confused with Shadowrocket’s Config. Before troubleshooting, identify which item was deleted or changed. That determines whether you need to authorize the system configuration again, restore rules, or check your own provider details.
| Item | Where to find it | Purpose |
|---|---|---|
| System VPN configuration | Settings → General → VPN & Device Management → VPN | Stores the VPN settings associated with the app so iOS can start the corresponding connection. |
| In-app rule file | Shadowrocket → Config | Stores settings such as routing rules for connections handled in Config mode. |
| Provider subscription | Shadowrocket → Home, in the corresponding subscription group | Stores and updates connection entries provided by a provider you already use. |
| On-demand connection settings | Shadowrocket → Settings → On Demand | Starts a connection when configured conditions are met and may affect the connection after you disconnect manually. |
Restore the item that’s actually missing
If the system VPN entry is gone but your Home and Config content is still there, trigger the authorization flow again. Don’t reimport the entire subscription or overwrite your existing rule file.
Deleting the system VPN entry usually doesn’t also erase data saved in the app. Deleting the app is a separate action and may remove local configurations. Don’t delete the app just to make the system prompt appear again. Before changing rules or subscriptions, note which configuration and connection entry are selected, and keep your own configuration details safe.
Find the VPN entry in Settings
Settings labels and navigation on iPhone and iPad may vary by system version, device management status, and language. A common path is Settings → General → VPN & Device Management → VPN. Some devices also show a VPN shortcut elsewhere in Settings; open the VPN list to verify the specific entry.
-
Disconnect first
Go to Shadowrocket → Home and turn off the connection switch. This makes it easier to observe changes in Settings and avoid mistaking an active connection for a configuration that wasn’t saved.
-
Open the VPN list
Go to Settings → General → VPN & Device Management → VPN and look for the configuration associated with Shadowrocket. If you can’t find the menu, use Settings search and search for VPN.
-
Check the entry details
Open the entry’s information page and check its name, connection status, and associated details. If your device has multiple VPN configurations, don’t assume the first entry in the list is the one currently in use.
-
Return to the app and check
Go back to Home and turn the connection on again. Check whether the system VPN status changes. If the entry exists but isn’t connected, saving the configuration and starting the connection are separate steps to check.
How to recover after tapping “Don’t Allow” or deleting the entry
Choosing “Don’t Allow” on the first prompt means you didn’t authorize iOS to add a VPN configuration that time; it doesn’t invalidate your purchase. If you deleted the system VPN entry, trigger the creation flow again from the app. Don’t try to replace Shadowrocket’s Network Extension by manually adding a generic VPN type in Settings.
-
Check your app data
Open Shadowrocket → Home and confirm that your existing connection entries are still there. Open Config to check the current configuration. You don’t need to delete this data just to restore system permission.
-
Trigger the authorization prompt again
Go to Home and switch the connection from off to on. If the required VPN configuration is missing from iOS, watch for the prompt to add it again.
-
Confirm with iOS
Check that the prompt is from Shadowrocket, then allow the configuration and complete any authentication iOS requires. Don’t switch to another app or dismiss the prompt during confirmation.
-
Check that the configuration was saved
Check the system VPN list for the entry, then return to Home to check the connection status. Note whether the entry wasn’t created or exists but the connection failed; these call for different troubleshooting steps.
-
If no prompt appears
First check whether the VPN entry is already in the list; if it is, not seeing the authorization prompt again may be normal. If there’s no entry, quit and reopen the app, then try again and check for device management restrictions. If the issue persists, restart your device and check once more.
Only consider deleting an old system VPN configuration that clearly belongs to Shadowrocket if you’ve confirmed it’s damaged, need to recreate it, and have kept your in-app data. Don’t delete multiple VPN entries or reset all network settings as a first step. A network settings reset affects other network data on your device and won’t identify the cause.
Connected, but webpages won’t load? Here’s how to check
A VPN status of Connected means the system VPN session is established. It doesn’t confirm that your provider’s address, authentication, DNS, or destination website is working. Repeatedly deleting the system configuration usually won’t help. Return to Home and Config to distinguish between starting the system tunnel and completing a specific request.
- Check Global Routing first: If you use rules, check whether the selected mode is Config. Proxy, Direct, Config, and Scene are different modes; the VPN icon alone doesn’t show how traffic is routed.
- Next, check the selected connection: In Home, make sure the selected entry is the one you intend to use. Use the address, port, and authentication details provided by your own provider. Don’t switch to a seemingly common port at random.
- Then check the rule results: In Config, review the current configuration.
DOMAIN-SUFFIXmatches domain suffixes,IP-CIDRmatches IP ranges,GEOIPmatches based on IP location data, andFINALhandles connections that don’t match earlier rules. None of these is a system permission switch. - Finally, check how widespread the issue is: Test a page that worked before and the specific destination that’s failing. Note the time, domain, and connection result. A single failing website and all requests failing aren’t the same issue.
If Home has a subscription but a connection entry has expired or your provider details have changed, update the details using your own valid subscription. The system VPN configuration doesn’t replace subscription updates. Avoid changing routing mode, subscription, and DNS at the same time; even if access returns, you won’t know which change fixed it.
Troubleshoot based on the system VPN session
If there’s no VPN entry in Settings, start with authorization. If the entry exists but the session won’t stay connected, check startup and conflicts. If the session stays connected but specific requests fail, check connection details, rules, and DNS.
Common questions about automatic reconnection and authorization prompts
During troubleshooting, distinguish between a configuration being created again and an existing configuration connecting automatically. The first involves permission to add a configuration; the second may be related to On Demand conditions. Recording system status before and after each action is more useful than simply saying “the VPN came back.”
Why does it reconnect after I turn it off?
In Shadowrocket, go to Settings → On Demand and check whether on-demand connections are enabled and what conditions are set. For troubleshooting, turn off On Demand, disconnect from Home, and see whether the system VPN reconnects automatically. If your device is organization-managed, also check whether a management policy requires the connection.
Do I need to allow the configuration every time I connect?
If the configuration is retained normally, you usually won’t need to confirm its addition each time. If the prompt keeps appearing, check whether you manually deleted the system entry, reinstalled the app, or have a management policy that changes the configuration. After authorizing, go straight to the VPN list and confirm that the entry was saved.
What should I do if connecting another VPN disconnects Shadowrocket?
For typical users, device-level VPN connections from multiple apps may replace one another or conflict. Stop the other VPN connection first, then start Shadowrocket on its own and check which entry is actually connected in the system list. Don’t test by repeatedly turning on multiple VPN switches.
Will deleting the VPN configuration erase rules and subscriptions?
Don’t use this as a way to clear in-app data. The system configuration, Config files, and subscriptions in Home are separate items. To remove in-app data, check and remove each item in its own location. Before restoring a connection, confirm whether those items are still there.
What information should I include when reporting an issue?
Include your device and system details, the exact prompt text, what you did before it appeared, whether the VPN entry exists, and the connection status in Home. Hide subscription addresses, authentication passwords, and other credentials in screenshots or notes. Share only the necessary status information, not the full subscription.
After troubleshooting, restore the Global Routing and On Demand settings you need, then test connecting, accessing a site, and disconnecting. If you still can’t add a system configuration, keep the exact prompt text and check device permissions. If the session starts but requests fail, continue troubleshooting the in-app configuration and provider connection instead of repeating the system authorization steps.