Shadowrocket VPN Configuration Prompt: How to Add or Reset a VPN Profile

1. What kind of configuration is being added?

When you turn on the connection switch on Shadowrocket’s Home screen, iOS or iPadOS may ask whether to allow a VPN configuration to be added. This is the operating system granting permission to a network extension—not the result of importing a subscription or a request to buy the app again. Once allowed, the system saves a VPN entry associated with the app so it can start the corresponding network tunnel.

In troubleshooting, “VPN profile” often refers to this system entry, but it is not the same as a configuration profile installed through device management. System Settings may list both under VPN and Device Management. Don’t delete every entry just because the section names look similar.

This permission lets the app handle traffic through the network extension provided by the system. Which connections use the proxy still depends on Global Routing, the rules in Config, and other network settings. The system prompt grants the ability to handle network traffic; it does not mean every request will go to the same remote server.

2. What happens if you allow or deny the request?

Continue only if you just turned on Shadowrocket’s connection switch yourself and the app named in the prompt is Shadowrocket. The system prompt may appear in English or another language, depending on your device settings. Check which app made the request and when it appeared; don’t rely on the wording alone.

• If you allow it: The system can create the VPN configuration, but connecting to the server still depends on the address, port, authentication details, current network, and routing settings.
• If you deny it: The configuration won’t be added. Without an available system VPN configuration, the app can’t start the corresponding tunnel. You can usually still open Home, manage existing servers, and edit Config.
• If you cancel authentication midway: Permission has not been granted. After returning to the app, check whether the system VPN entry exists and whether a connection can start.

Denying the request once doesn’t mean you need to uninstall the app. Return to Home, turn the connection switch off, then try turning it on again and follow the system prompt if it appears. If it doesn’t, check the VPN list first: the system may already have a usable entry. In that case, check the connection instead of repeatedly looking for the prompt.

3. Check the connection after granting permission

These steps apply to iPhone and iPad. The system navigation below uses the Simplified Chinese interface as a reference; menu locations and labels may vary by OS version. You can also search for “VPN” in Settings. Don’t confuse Shadowrocket’s in-app Settings with your device’s system Settings.

1. Check that a configuration is available

   In Shadowrocket → Home, select your own server and check that its address, port, and authentication details are filled in. If you haven’t imported your own subscription yet, import it first; VPN permission does not generate server details.

2. Start the connection

   Turn on the connection switch on Home. When the system asks to add a VPN configuration, check the app name, tap Allow, and complete device authentication if prompted.

3. Check the system entry

   Open Settings → General → VPN & Device Management → VPN. Check for an entry associated with Shadowrocket and review the current connection status.

4. Check the routing mode

   Return to Shadowrocket → Home → Global Routing and note whether the current mode is Config, Proxy, Direct, or Scene. Granting permission does not mean all current traffic will use the selected server.

5. Test an actual request

   Open a website you can normally access, then check the in-app connection log. If the switch is on but requests fail, check the server, DNS, and rules. Don’t rely on the status bar icon alone to confirm that a service is working.

In Global Routing, Config applies the rules in your configuration, Proxy routes typical traffic through the proxy, and Direct uses a direct connection. Scene switches routing based on a scene; check the scene settings to confirm what it does. Change one setting at a time, note what happens before and after, and restore your preferred mode when testing is complete.

4. Restore a missing or malfunctioning VPN entry

If the system VPN list no longer has an entry for Shadowrocket, starting a connection in the app will usually prompt you to add one again. If the entry is still there but every attempt returns to disconnected, first turn off automatic connections and quit any other active VPN. Then decide whether to remove and recreate the entry. Repeatedly deleting the configuration won’t fix an incorrect server password or an expired subscription.

1. Note your in-app settings. Check that your own server is still listed on Home, and note the Config and Global Routing modes in use. If you need a backup, use the relevant feature in the app and store any data containing credentials securely.
2. Turn off automatic triggers. In Shadowrocket → Settings → On Demand, check and temporarily disable on-demand connections. If the system VPN details also show an on-demand setting, check its status to prevent a rule from reconnecting immediately after you disconnect.
3. Disconnect the current session. Turn off the connection switch on Home and confirm that the system no longer shows the tunnel as connected.
4. Remove only the relevant entry. Go to Settings → General → VPN & Device Management → VPN, tap the info button next to the Shadowrocket entry, then choose “Delete VPN” and confirm as prompted. If there’s no delete option or the entry is managed, contact your device administrator.
5. Recreate it from the app. Turn on the connection switch on Shadowrocket → Home again and allow the VPN configuration to be added. Then follow the previous section to check the system entry and test an actual request.

Deleting a system VPN entry and uninstalling Shadowrocket are different actions. Deleting the entry usually won’t clear the server list in the app, but check On Demand and connection settings again after recreating it. Don’t uninstall the app just to restore a VPN entry; doing so may affect locally stored data and make recovery more difficult.

• Entry exists but won’t connect: Check your server address, port, authentication details, and network reachability first.
• Entry was missing and permission was granted again: Test one connection. No further system-level reset is needed.
• Can’t save the configuration after allowing it: Restart the device and check for system restrictions. On a managed device, ask the administrator to confirm the VPN policy.

5. Conflicts with multiple VPNs and On Demand

A device can store multiple VPN configurations, but that doesn’t mean multiple standard personal VPN tunnels can handle the same traffic at once. In typical personal use, starting another VPN may replace the active connection. Managed devices, per-app VPNs, and some network extensions are subject to additional system restrictions, so the number of entries in the list alone doesn’t indicate whether there’s a conflict.

Also check local filtering, security, or other apps that use the system VPN mechanism. Even without connecting to a remote proxy, they may occupy the same system connection slot. If another app connects automatically, switching it off once may not be enough to reproduce the issue reliably.

• Symptom: The connection drops immediately. Check whether the system VPN list now shows another configuration as connected. If it does, turn off automatic connections in the other app and test Shadowrocket on its own.
• Symptom: It reconnects after switching Wi-Fi networks. Check Shadowrocket → Settings → On Demand and the on-demand triggers for other VPN configurations. Look for conditions triggered by network changes.
• Symptom: It reconnects after you disconnect manually. Turn off On Demand before disconnecting, then compare the results. Don’t assume the system VPN entry is damaged.
• Symptom: The issue occurs only on a company network. Check your organization’s network policies and managed-device restrictions. Don’t delete organization-issued management settings to try to bypass them.

6. What else to check beyond VPN permission

System permission determines whether the app can establish a tunnel. Subscriptions and Config determine which servers to use and how requests are handled. These layers work together but aren’t interchangeable. If you already have your own subscription, first check that it imported and updated successfully. Recreating the system VPN entry alone won’t refresh addresses or credentials in the subscription.

• Home: Check that the selected server is still valid. A latency test can indicate connectivity, but it doesn’t guarantee that every website, UDP traffic, or domain lookup will work.
• Config: Check the active rule configuration. DOMAIN-SUFFIX matches domain suffixes, IP-CIDR matches address ranges, GEOIP matches IP addresses by geographic classification, and FINAL handles requests that don’t match earlier rules. Check the actual match log to see what happened.
• Settings: Check automation settings, especially On Demand. Don’t change DNS or protocol settings at random to fix a system permission issue.
• System Settings: Check whether the VPN configuration exists, whether it’s managed by an organization, and whether the active connection belongs to the expected app.

When reporting an issue, describe exactly what happened—for example, “what happened after I tapped Allow,” “whether the system VPN entry appeared,” or “whether the problem only returns after switching networks.” That’s more useful than saying only “VPN doesn’t work.” You can share redacted status screenshots and error messages, but hide full subscription URLs, passwords, keys, QR codes, and other authentication details.