“Add VPN Configurations” is Apple’s request for permission to create a local VPN configuration. It is not a prompt to import a subscription, nor does it mean a remote connection has succeeded. If this is your first connection, you previously denied the request, or you deleted the system configuration, follow the steps below to check Home, the system VPN list, and Settings → On Demand. Restore the configuration, then test connectivity.
Why does the first connection require adding a VPN configuration?
Shadowrocket uses the system’s network extension to handle connections. The first time you turn on the connection switch in Home, if no matching VPN configuration is available on your device, the app asks iOS to save one, and the system displays an authorization prompt. In English, the alert title is “Shadowrocket” Would Like to Add VPN Configurations
. The wording may vary with your system language.
After you tap “Allow,” the system may ask you to confirm with your device passcode or biometric authentication. This confirmation is handled by iOS; you do not need to enter your device passcode in a subscription, server, or connection settings. Once the configuration is saved, Shadowrocket can proceed with starting the tunnel. Access to a website still depends on your connection details, current network, and routing settings.
The authorization alert warns that a VPN may handle network activity. This is a system notice about the capability; it does not tell you whether your remote connection details are trustworthy or whether every request will use the same remote exit. Actual traffic handling depends on Global Routing, the active Config, and its rules. Check how your sensitive data will be handled before connecting.
The system VPN entry and Config are not the same configuration
On iPhone or iPad, the usual path is Settings → General → VPN & Device Management → VPN. Look for the entry associated with Shadowrocket and check its connection status. Menu labels may vary slightly between iOS versions. You can also search for “VPN” in Settings and open the configuration list rather than relying only on the search result’s master switch.
“VPN profile” is often used to describe two different things: a VPN configuration saved by an app through the system interface, and a configuration profile installed separately from Device Management. Shadowrocket’s first-time VPN authorization is not the same as installing a device management profile or trusting a certificate. Do not assume every entry on nearby settings screens should be removed or reinstalled just because they appear together.
| Where to check | What it saves or controls | What it cannot tell you |
|---|---|---|
| VPN list in Settings | The app’s system VPN configuration, connection status, and related system options. | Whether your existing subscription is valid or the remote server is reachable. |
| Shadowrocket → Home | Existing connection details, the current selection, and the connection switch. | An entry in the list alone does not confirm that system VPN authorization is complete. |
| Shadowrocket → Config | Configuration used for rule-based routing, such as traffic rules. | Selecting a Config does not create a system VPN entry. |
| Shadowrocket → Settings → On Demand | Settings that trigger a connection automatically under specific conditions. | Automatic triggers do not replace first-time system authorization or fix incorrect connection details. |
For example, DOMAIN-SUFFIX, GEOIP, IP-CIDR, and FINAL are rule configuration entries, not options in the system VPN authorization alert. Editing these rules will not grant system permission again. Likewise, recreating the system VPN configuration will not automatically fix existing rules.
How to authorize again after tapping “Don’t Allow”
Denying the request usually means iOS did not save the required VPN configuration. It does not mean your existing Shadowrocket data was erased. Go back to Home and check the connection switch and current selection. Don’t delete the app right away or repeatedly tap the connection switch just to make the prompt appear again.
- Stop the current connection attempt. If the Home switch still shows that it is connecting, turn it off and wait for the status to settle before continuing.
- Check your existing details. Make sure your own connection details are still listed in Home. Don’t mistake an empty list or missing parameters for an authorization issue.
- Turn the connection switch in Home on again. If no valid system configuration exists, the app can request permission again. When the system prompt appears, confirm that it comes from Shadowrocket, then tap “Allow.”
- Complete the system confirmation. If iOS asks you to verify your identity, do so in the system interface. Canceling midway may prevent the configuration from being saved.
- Check the system VPN list. Confirm that the relevant entry appears, then return to Home to check the connection status and test access.
System alert: “Shadowrocket” Would Like to Add VPN Configurations
Why it appears and what to do: The app is asking iOS to save a VPN configuration. This is not a server error. If you tapped “Don’t Allow” last time, return to Home, turn the connection switch off and back on, then tap “Allow” in the system prompt and complete the device identity check.
If no prompt appears when you try again, first check whether the corresponding entry is already in the system VPN list. You don’t need to authorize it again if the configuration is already there. If the entry is missing and your device is managed by your workplace or school, check whether a management policy blocks adding VPNs. Changing a subscription or switching protocols will not bypass such a restriction; ask your device administrator.
How to restore a deleted system VPN configuration
Deleting a system VPN entry is not the same as deleting the Shadowrocket app. If the system entry disappears, your Home connection records and Config contents will usually remain in the app; verify what is actually still there. To restore service, have the app recreate the system configuration rather than clearing your local data first.
- Check Home and Config. Make sure your existing records are still there, and note the names of the connection and Config you were using. If those are also gone, restoring system authorization alone will not bring them back; restore them from your own saved details or backup.
- Temporarily pause automatic triggers. If your device keeps attempting to connect, pause the relevant settings in Settings → On Demand to prevent automatic behavior from interrupting the manual recovery steps.
- Start a connection from Home. Let Shadowrocket request permission to add the VPN configuration, tap “Allow,” and complete the system confirmation. Don’t create a different type of VPN entry manually just because it has the same name.
- Check the system entry and status. Go to Settings → General → VPN & Device Management → VPN and confirm that the matching configuration has reappeared.
- Restore On Demand after testing. First complete a manual connection and test access. Then restore your automatic connection conditions as needed.
Uninstalling and reinstalling the app is not the first fix to try, as it may affect locally saved data. If only the system VPN configuration is missing, follow the recreation steps above first. Only troubleshoot the app itself if there is a clear reason to do so, and back up your data before proceeding.
Allowed, but still can’t connect? Check these three areas
If authorization is complete and Home stays connected but a website still won’t load, shift your troubleshooting from “Was permission granted?” to “Are the connection and rules correct?” Repeatedly deleting the system VPN configuration will not usually fix an incorrect remote address, port, authentication parameter, or rule.
If the system entry is already there, test the connection instead of recreating it
Pause On Demand and try one manual connection first. If the corresponding system VPN status stays connected, check Connectivity Test in Home and review Global Routing. Return to the authorization recovery steps only if you confirm that the configuration is missing or failed to save.
In Global Routing, Proxy, Direct, Config, and Scene are different routing modes, not levels of authorization. Proxy routes traffic through a proxy by default; Direct handles traffic as a direct connection; Config routes traffic according to the selected configuration. For Scene, check the configuration associated with the selected scene. Note the current selection before troubleshooting, and don’t switch modes based on the name alone if you don’t know what the scene contains.
- Connectivity Test fails: Check the address, port, and protocol settings for your existing connection, and make sure your current network is working. The port must match your own service configuration. Don’t change every connection to port
443just because HTTPS commonly uses it. - Only some websites fail: In Config mode, check the rules matching the relevant domain or IP address, as well as how
FINALhandles traffic that does not match a rule. Don’t recreate the system configuration instead of checking the rules. - It reconnects after you disconnect manually: Check Settings → On Demand and the on-demand status of the corresponding system VPN entry. Pause the trigger conditions before testing again so automatic reconnection isn’t mistaken for a failure to disconnect.
- Subscription update fails: Updating retrieves your existing connection details; it is separate from system VPN authorization. Check your own subscription URL and network access. Don’t delete the system entry just because an update failed.
FAQ: Permissions, certificates, and automatic connections
Do I have to tap “Allow” every time I connect?
Usually not. Once iOS has saved a valid configuration, you can use it for everyday connections. If the add-configuration prompt appears every time, check whether the entry was actually saved in the system VPN list and whether a device management policy or another action is removing it.
Does allowing a VPN configuration also allow certificate installation?
No. VPN configuration authorization, certificate installation, and certificate trust are separate actions. You don’t need to import a certificate as a general fix for restoring a regular VPN connection. If a specific feature you use requires one, verify its purpose and the scope of trust separately.
If iOS says Connected, does all traffic go through a proxy?
Not necessarily. Check Global Routing in Shadowrocket. If you use Config, also check the selected rule configuration. The system’s “Connected” status reflects the tunnel state; it does not show whether each request is handled by Direct or a proxy.
Why is my subscription still there after I deleted the configuration?
The system VPN configuration and connection details saved in the app are managed separately. Check for existing records in Home, then use the connection switch to request system authorization again. You don’t need to re-import the same details just to restore permission.
Do I need to authorize again on another iPhone or iPad?
Check the actual VPN configuration status on the new device. If iOS asks to add a configuration the first time you connect, complete the confirmation on that device. Authorization on your old device does not mean the new one is authorized. Check the App Store page for compatibility and system requirements.