The “Add VPN Configurations” prompt in Shadowrocket is a system authorization request. It is not the result of importing a subscription, nor does it mean a route is ready to use. This guide is for first-time connections, users who previously denied permission, and anyone who accidentally deleted the system VPN entry. Identify which configuration is missing, follow the steps to authorize it again, then check system connection status separately from server and rule behavior.
Add VPN Configurations: What Are You Authorizing?
Shadowrocket uses the network extension capabilities provided by iOS on iPhone and iPad to handle traffic. The first time a connection is needed, the app asks iOS to save a VPN configuration, and the system asks for your permission. This entry tells the system which app provides the tunnel and how to start the associated network extension. The app can continue with the connection process after you allow it.
The authorization prompt is part of the system interface. Depending on your system language, the buttons and message may appear in English or another language. The English interface usually includes the text below. The warning that network activity may be filtered or monitored describes what VPN capabilities can do. Confirm that the request comes from Shadowrocket, which you just opened, before deciding whether to allow it.
Prompt: “Shadowrocket” Would Like to Add VPN Configurations
Why it appears: The app is requesting permission to create a system VPN configuration. This is an authorization prompt, not a connection error.
What to do: Confirm the app name and source, select Allow, and complete any authentication requested by the system. If you selected Don’t Allow, return to the app and turn on the connection switch again to request permission again.
The system may ask for your device passcode or another form of authentication; follow the prompt shown on your device. This verifies an authorization action on your device. It is not your service provider password, and you do not need to buy the app again. Do not enter subscription links, server credentials, or your Apple Account password in the device passcode field.
System VPN Entries vs. Config Files
People often refer to a VPN entry in Settings as a “VPN profile,” but troubleshooting requires distinguishing three items: the system VPN configuration, a Config file in Shadowrocket, and a configuration profile that may appear under device management. They are stored in different places and serve different purposes. Don’t delete something just because it has the word “configuration” in its name.
| Item | Where to check | What it does |
|---|---|---|
| System VPN configuration | System Settings → General → VPN & Device Management → VPN | Records the VPN provider app and connection-related settings so the system can start the corresponding network extension. |
| App Config file | Shadowrocket → Config | Stores routing rules and related settings, such as DOMAIN-SUFFIX, IP-CIDR, and FINAL entries in the Rule section. |
| Device configuration profile | System Settings → General → VPN & Device Management | May be installed by an organization to deliver management settings, certificates, or network configurations. Not every device has one. |
System menu locations may vary slightly by OS version and device management status. Search for VPN in Settings, then open the relevant details. The English menu paths here are included to help identify the right item; localized systems show the equivalent names. Before opening details, check the entry name and associated app. Don’t delete configurations required by your work or school.
First, Identify Which Configuration Is Missing
If the Shadowrocket entry is missing from the system VPN list, return to Home and trigger authorization again. Restore a Config file only if that is what’s missing. Reimporting a subscription does not replace system authorization, and you should not delete an entire set of device management settings to restore one VPN entry.
First Connection or Steps After Denying Authorization
First, make sure your internet connection works. Turn off Shadowrocket’s connection switch and open a website you can normally reach in Safari. If regular internet access is also unavailable, troubleshoot Wi-Fi sign-in, cellular data, or the network first. Then follow the steps below to create the VPN configuration. Avoid changing your subscription, rules, and DNS at the same time so you can identify the cause of any issue.
-
Check the App
Make sure you have Shadowrocket. It is available through the App Store, from developer Shadow Launch Technology Limited, with app ID 932747118. For verification, see the purchase guide on this site.
-
Select a Server
Go to Shadowrocket → Home. Check that your existing subscription or server entry is present, then select the server you want to test. If you haven’t imported your subscription yet, use the settings provided by your service provider.
-
Turn On the Connection
Turn on the connection switch at the top of Home. When the system asks to add VPN configurations, check the app name in the request and select Allow. If you denied permission earlier, this will request it again.
-
Complete Authentication
Complete the device authentication requested by the system, then return to Shadowrocket. Wait for the connection status to change. Don’t keep toggling the switch while the system prompt is still open.
-
Check the VPN Entry
Open System Settings → General → VPN & Device Management → VPN and confirm that the Shadowrocket entry is listed. Then return to Home and check the connection status and whether the website is actually reachable.
If no prompt appears when you turn the switch on again, authorization may still be working—the system may already have a saved configuration. Check the VPN list first instead of assuming that no prompt means you need to reinstall the app. If your device is managed by an organization and the system explicitly blocks adding a VPN, ask your device administrator about the policy. Tapping Allow repeatedly won’t override a management restriction.
Deleted VPN Configuration: How to Recreate It
Deleting Shadowrocket’s configuration from the system VPN list removes the entry the system uses to start the tunnel. This is different from deleting a server on Home or a rules file in Config, and it usually does not remove server entries or Config files already stored in the app. Before restoring anything, check that these items are still there. Don’t reset all settings to their defaults.
- Return to Shadowrocket → Home and turn off the connection switch. If the displayed status hasn’t updated, leave the current screen, reopen the app, and check again.
- Check whether your existing subscriptions and servers are still listed on Home. Open Config and confirm that the expected configuration file is still there. Don’t change server settings or rules at this stage.
- Return to Home and turn on the connection switch again. If the system asks to add VPN configurations, select Allow and complete device authentication.
- Go to System Settings → General → VPN & Device Management → VPN and confirm that the entry has reappeared. Then return to the app and test access.
If the entry does not reappear, turn off the connection, reopen the app, and try again. Check whether the system shows a management restriction or whether the authorization prompt was canceled. If the problem persists, restart the device and check again. Record whether the VPN entry is listed, whether an authorization prompt appeared, and the switch status after tapping Allow. These details are more useful for troubleshooting than simply saying “it won’t connect.”
VPN Connected but Still Can’t Access a Website?
A VPN Connected status means the tunnel is connected; it doesn’t guarantee that every upstream server handling a request is available. Shadowrocket processes traffic according to the current Global Routing mode and configuration, which involves the server connection, DNS resolution, and rule matching. The sequence below shows how these steps fit together. A given request may not use a proxy outbound route.
In Home → Global Routing, Proxy routes traffic through a proxy, Direct connects directly, Config uses the current configuration, and Scene applies the selected scene. Don’t assume that turning on the switch sends every request through a proxy. When using Config, put specific conditions in Rule before the relevant fallback rule; FINAL is usually placed last. System authorization does not change these rules for you.
- All websites fail: Turn off the connection switch and test your regular internet connection. Then check that the selected server’s address, port, and authentication settings match the information you already have.
- Some domains fail: Check the current Global Routing selection and review the relevant DOMAIN-SUFFIX rules and the FINAL policy in Config. Reauthorizing repeatedly won’t fix a routing issue.
- Domain access issues: Check the DNS settings in the current configuration and review the resolution results. Change DNS only if you’ve found an issue with name resolution; avoid changing multiple settings at once.
- Connection drops shortly after connecting: Note when it disconnects and record the original text from the app log. Check whether the network changed or another VPN connection started before deleting the system configuration.
Server protocols and ports are connection settings in the app, not device authorization settings. For example, if your existing Trojan configuration specifies port 443, check its address, port, and TLS settings one by one. The same port number does not guarantee that the server is reachable. Don’t switch ports or protocols without a specific error or other evidence.
On Demand and Common Authorization Questions
On Demand can trigger a VPN connection under specified conditions, but it does not replace the initial system authorization or provide server credentials. If the VPN reconnects after you turn it off or starts automatically when you change networks, check both Shadowrocket’s Settings → On Demand and Connect On Demand in the system VPN details, if that option is available. First make connection behavior predictable, then see whether the issue still occurs.
I Tapped Don’t Allow. Do I Have to Reinstall?
Not yet. Return to Home, turn the connection switch off and on, and respond to the system authorization prompt again. If no prompt appears, check the system VPN list for an existing Shadowrocket entry. If it’s there, continue troubleshooting the connection instead of repeatedly deleting the app.
If I Delete the VPN Entry, Do I Have to Buy My Subscription Again?
The system VPN entry and a service provider subscription are separate things. Check for your existing entries on Home, then turn on the connection to recreate the system entry. A one-time client purchase is not a service plan; system authorization does not change your subscription with your own service provider.
Why Does It Reconnect After I Turn the Switch Off? Wasn’t the Configuration Deleted?
First check the trigger conditions in Shadowrocket → Settings → On Demand, then check Connect On Demand in the corresponding system VPN details. For troubleshooting, you can temporarily turn off automatic connection, disconnect manually, and observe what happens. Set the conditions again as needed when you’re ready to resume normal use.
The System Is Asking for a Password. Is That My Service Provider Password?
System authentication when adding VPN configurations is usually for authorization on your device. Enter your device passcode or complete authentication as requested. Don’t enter a subscription token. Keep credentials from your service provider in the corresponding server settings; the two fields are not interchangeable.
Will I See the Authorization Prompt Every Time I Connect?
Once the system has saved a valid VPN configuration, you usually won’t need to add it again each time. If the prompt appears frequently, check whether the system entry is repeatedly being deleted or whether a management policy is involved. Record the prompt text and the steps that trigger it. Updating an existing subscription alone does not mean you need to authorize again.
After troubleshooting, verify three things: the system VPN list contains the relevant entry, the connection status on Home matches what you expect, and the target website behaves as expected for the selected routing policy. These checks cover configuration storage, tunnel status, and request handling. If any one fails, continue troubleshooting that specific layer.