Shadowrocket VPN Configuration Permission Prompt and VPN Profile Guide

Adding a VPN Configuration: What You’re Allowing

In short, if the prompt was triggered by the Shadowrocket connection action you just started, tap Allow and complete device authentication as prompted. Once authorized, the app can create its system VPN configuration and attempt to start a connection. Allowing this does not confirm that a subscription is valid or that a server can connect.

Shadowrocket uses the system-provided VPN network extension to receive and process traffic. Here, VPN is the system’s way of managing a network tunnel, not a specific server protocol. Your connection may use Shadowsocks, VMess, VLESS, Trojan, Hysteria2, or WireGuard. Whether the system tunnel can start and whether the server parameters are correct are separate checks.

The system prompt may say that network activity could be filtered or monitored. This is a permission notice for setting up a VPN configuration; assess it in light of your configuration and trust in your service provider. It does not mean all traffic will necessarily go to the same remote server. Actual routing also depends on Global Routing, the selected Config, and the matching rules.

The System VPN Configuration and the App’s Config Are Different

On iPhone and iPad, go to Settings → General → VPN & Device Management → VPN to view system VPN entries. Some iOS versions also show a VPN shortcut on the main Settings screen. The system VPN configuration described here is an entry created by the app so iOS can start its network extension; it is not a profile you need to download separately.

The in-app Config organizes rules and related settings, such as DOMAIN-SUFFIX, GEOIP, IP-CIDR, and FINAL. Subscriptions and servers in Home provide connection parameters. The system VPN entry links the app to iOS networking. These three are related, but they are not interchangeable.

• Deleting only the system VPN entry: This does not delete the subscription in Home, but the app must recreate the system configuration before it can start the tunnel again.
• Changing only the Config: This does not revoke system permission. Syntax errors or rule-selection issues should not be attributed to authorization.
• Seeing a device management profile: This does not mean it is Shadowrocket’s VPN entry. Profiles managed by a company or school may include multiple policies; don’t remove the entire management profile to troubleshoot this app.

So first clarify what “missing VPN profile” means: Is Shadowrocket absent from the system VPN list, are the rules missing from the app’s Config, or is there no server in Home? Only the first case calls for the system configuration steps in this guide.

First Connection: Follow the System Prompt

First, make sure Home contains a server you can use and note which Config is selected. Get your subscription link from your service provider. Without server parameters, completing system authorization cannot establish that a proxy connection will work. Repeatedly adding a VPN configuration will not provide connection parameters.

1. Confirm a server is available

   Open Shadowrocket → Home and select an imported server. To import a subscription, tap “+” in the top-right corner of Home, choose Subscribe under Type, enter the link from your service provider, and save.

2. Start the connection

   Turn on the connection switch in Home. If no system configuration has been created yet, the app will ask to add one. Check the app name in the system prompt first.

3. Allow the configuration

   If the request came from Shadowrocket, tap Allow and complete device authentication if prompted. Don’t enter your device passcode in the subscription URL field.

4. Check the status

   Check the connection status in Home, then go to Settings → General → VPN & Device Management → VPN to verify the entry. If the entry exists but the connection won’t start, check the server and network instead of authorizing again.

The authorization prompt’s language depends on your device settings, so the buttons and wording may appear in English or another language. iOS handles device authentication. You don’t need to give your passcode to your service provider or activate VPN permission through a website.

Tapped Don’t Allow? Try Again Before Reinstalling

Tapping Don’t Allow usually means the configuration wasn’t created this time; it doesn’t permanently disable a regular app permission switch. VPN authorization also doesn’t appear in the Camera or Photos permission lists. First try connecting again in Shadowrocket rather than looking for a generic VPN permission button in Privacy settings.

1. Stop the current attempt

   Return to Home. If the switch still shows that it’s connecting, turn it off and wait for the status to settle. Avoid toggling it rapidly, so you can tell which request is being handled.

2. Send the request again

   Keep the same server selected and turn on the connection switch again. If the system prompt reappears, tap Allow and complete authentication.

3. Check the system entry

   If no prompt appears, go to Settings → General → VPN & Device Management → VPN and check for a Shadowrocket entry. An existing configuration may not trigger another prompt, so the absence of a prompt alone doesn’t indicate a permission problem.

4. Check for system restrictions

   If the entry is missing and can’t be created, reopen the app and, if needed, restart your device before trying again. On a managed device, ask the administrator whether VPN configurations are allowed. Don’t remove management policies yourself.

If you tapped Allow but then canceled device authentication, the configuration may not have been saved. Check the system list before sending another request. Deleting and reinstalling the app can make it harder to restore subscriptions and rules, so it shouldn’t be the first response to tapping Don’t Allow.

Missing or Incorrect Configuration: Rebuild Only the VPN Entry

If Shadowrocket is missing from the system list but your server is still in Home and your rules are still in Config, you can usually recreate the entry by starting a connection in the app. Remove and rebuild the entry only if it’s actually malfunctioning and restarting the connection doesn’t restore it. A website failing to load while connected isn’t enough to show that the entry is damaged.

1. Keep your app settings

   Note the selected server, Global Routing, and Config, and make sure you can retrieve your subscription link from your service provider. You don’t need to post the link, password, or full configuration in a public forum.

2. Turn off automatic connections

   In Shadowrocket, go to Settings → On Demand and pause any enabled automatic connection conditions. Then return to Home and turn off the connection. Otherwise, iOS may reconnect based on those conditions, making it harder to diagnose the issue.

3. Check before deleting

   Go to Settings → General → VPN & Device Management → VPN and open the details for the Shadowrocket entry. Choose Delete VPN only if you’ve confirmed it needs to be rebuilt. If there’s no entry, skip this step.

4. Create the configuration again

   Return to Home, turn on the connection, and accept the system authorization prompt. Check that the entry reappears in the system list, then test an actual connection. Once everything is stable, restore On Demand if you normally use it.

After reinstalling the app, moving to a new device, or restoring a backup, check the system VPN entry rather than assuming that restoring the app icon also restored its network extension configuration. App data and system authorization can be in different states; rely on the system list and an actual connection test.

Authorized but Can’t Connect? Check the Connection and Rules

This applies when a Shadowrocket entry is present in Settings and authorization is complete, but the connection fails or access is abnormal. Deleting the VPN configuration usually won’t fix an expired subscription, an unreachable server, incorrect authentication details, or unexpected rule matching. A connected status only indicates the tunnel state; it doesn’t guarantee every remote request will succeed.

• The switch turns off shortly after you turn it on: Check whether another VPN connection is running, then check your network and selected server parameters. Note the exact error shown by the app; don’t label every failure as “permission denied.”
• Connected, but sites won’t load: Check which server is selected in Home, refresh your existing subscription, and ask your service provider to verify the address, port, authentication details, and service status. VPN authorization won’t fix expired connection parameters.
• Only some domains are affected: Check Global Routing. If you’re using a Config, verify the selected rule file and matching policy. Proxy and Direct can help with a deliberate, temporary comparison; restore your original setting afterward. Scene affects scene selection, so note its current state and avoid changing several variables at once.
• The connection comes back after you turn it off: Check the conditions under Settings → On Demand. Manually turning off the connection is different from disabling automatic triggers. Pause the conditions first, then see whether the connection switch stays off.

Rule syntax is not a system permission switch. For example, DOMAIN-SUFFIX,example.com,DIRECT specifies how to handle a matching domain suffix, while FINAL,PROXY sets the final policy when no earlier rule matches. These rules affect traffic only when used by the relevant configuration and operating mode; they do not trigger or replace the Add VPN Configuration authorization prompt.

Change one thing at a time: first confirm the system configuration exists, then check that the tunnel starts, and finally investigate the server, DNS, and rules. If you need help, report whether the system entry exists, whether the connection switch turns off, the current Global Routing setting, and the exact error. Hide subscription tokens, passwords, and personal information.

FAQ: Authorization, Subscriptions, and Device Management