Shadowrocket needs system VPN authorization to connect. This guide is for anyone facing a first-time permission prompt, an accidental denial, a missing VPN entry in Settings, or repeated authorization requests. First, distinguish the system VPN configuration from a Config file; then check the system entry and reauthorize if needed. If you’re connected but can’t access a site, check your existing service settings, DNS, and rules instead of repeatedly deleting the configuration.
System VPN Configuration vs. Config Files
The first time you turn on the connection switch in Home, iOS may ask whether Shadowrocket can add a VPN configuration. This system prompt lets the app save VPN connection settings and establish a tunnel through the system network extension. It is not a purchase confirmation or a subscription update prompt. Granting permission allows the system to establish the connection; it does not verify that the remote service settings are valid.
“VPN profile” is often used to refer to two different things: the system VPN configuration created by an app, and a configuration profile installed through device management. Shadowrocket needs the former to connect normally. Although both may appear near each other in Settings, a device-management profile is not a fix for connection issues.
| Item | Where to check | What it does |
|---|---|---|
| System VPN configuration | VPN list in system Settings | Stores connection settings, authorization status, and related On Demand information. |
| Config file | Shadowrocket → Config | Stores app-side settings such as rules and DNS; it cannot replace system authorization. |
| Device management profile | Settings → General → VPN & Device Management | May be installed by an organization to manage a device or apply settings. It should not be removed as part of routine connection troubleshooting. |
Removing the system VPN entry does not delete files in Config or cancel an existing service. Conversely, replacing a Config file usually won’t fix a “VPN configuration not allowed” issue. Before troubleshooting, identify which layer you changed so you don’t confuse routing rules with system permissions.
First-Time Prompt: Allow Access, Then Check the Connection
These steps focus on iPhone and iPad. Prompt and menu wording varies by system language; paths are shown with English menu names. Check the App Store page for system requirements. Before you begin, make sure Shadowrocket is from the App Store and that you have a valid service configuration of your own. This site does not provide nodes or subscriptions.
-
Verify the App
On the App Store product page, check the app name Shadowrocket, developer Shadow Launch Technology Limited, and app ID 932747118. For step-by-step verification, see the Genuine App Verification page.
-
Turn on the Connection
Return to Shadowrocket → Home, select the intended entry from your existing configuration, and turn on the connection switch. Note whether the system authorization prompt appears or the app proceeds directly to connecting.
-
Grant Permission
When the system asks to add a VPN configuration, tap Allow and complete any authentication requested by your device. Never enter your device passcode in a service address, subscription URL, or chat window.
-
Check the Status
Return to Home to check the connection result, then open the VPN list in system Settings and confirm that a Shadowrocket entry is present. The presence of an entry and an active tunnel are two separate checks.
If you tapped Don’t Allow the first time, the app may not be able to save or start the connection. Return to Home, make sure the connection switch is off, then try turning it on again and see whether the system requests permission. If it still fails, check the system VPN entry and device restrictions rather than assuming your subscription has expired.
System Settings: Find the VPN Entry
On many iPhone and iPad versions, the full path is Settings → General → VPN & Device Management → VPN. Some versions also show a VPN shortcut near the top of Settings. If you can’t find it, search for VPN in Settings; menu layout may vary by device.
- Check the name first: Find the entry associated with Shadowrocket. Don’t assume an entry belongs to the app just because it says “VPN.”
- Then check the status: Disconnected means the VPN is not currently connected; it doesn’t mean the configuration is damaged. Connected means the tunnel is established, but not that every destination is reachable.
- Check the details: Tap the information button next to the entry. If Connect On Demand is available, note its current status and compare it with the app’s On Demand settings.
- Check for management restrictions: If Settings says the device is managed, or the entry can’t be deleted or changed, check with your device administrator. Don’t try to remove a profile installed by your organization.
If Shadowrocket is missing from the system VPN list, first-time authorization may not have been completed, or the configuration may have been deleted. An empty list alone does not mean the app is damaged. Try initiating the add-configuration flow again from the app before reinstalling, to preserve your current settings and troubleshooting context.
Decision: Separate a Missing Entry from a Connection Failure
If Shadowrocket is missing from the system list, restore authorization first. If the entry is present and shows Connected, leave the system configuration in place and investigate the specific request that failed. Don’t use the same “delete and recreate” steps for both problems.
If the Entry Was Deleted or Stopped Working: Reauthorize in Order
If the system VPN entry was removed manually, Shadowrocket may need to save the configuration again and request permission when you next connect. You don’t need to obtain another profile or change your subscription URL. If the entry is still there but may be invalid, try disconnecting and reconnecting once before rebuilding it.
-
Record Your Current Settings
Note the selected service, Config file, and Global Routing option. Keep sensitive passwords and full subscription URLs somewhere secure; don’t share them in public support requests.
-
Pause On Demand
Go to Shadowrocket → Settings → On Demand, note the current settings, then temporarily turn On Demand off. If Connect On Demand is still enabled in the system VPN details, check and temporarily turn that off too to prevent automatic reconnection while troubleshooting.
-
Disconnect
Turn off the connection switch in Home, then confirm the VPN is disconnected in the system VPN list. If another VPN app is connecting, disconnect it normally before testing Shadowrocket.
-
Remove the Invalid Entry
Only if the entry is still present and a normal reconnect didn’t help, open Shadowrocket’s details in the system VPN list and tap Delete VPN. Skip this step if the entry is already gone. If the device is managed, contact the administrator first.
-
Authorize Again
Reopen Shadowrocket and turn on the connection in Home. Allow the system to add a VPN configuration and complete any requested authentication. Then check that the corresponding entry appears in the system list.
-
Restore the Settings You Need
Connect manually and test a known destination first. Once it works, restore Settings → On Demand if needed. Change one setting at a time and check whether the issue returns.
Errors and Symptoms: Identify the Layer Where the Problem Occurs
When troubleshooting, keep the full error and note where it appeared. A system prompt, an in-app connection message, and a diagnostic log come from different sources; don’t mistake a network timeout for a permission denial. The system error below is shown only to help identify log output. Your device may display different wording, so don’t ignore your actual error code just to match the example.
Error: The operation couldn’t be completed. (NEVPNErrorDomain error 1.)
Cause: NEVPNErrorDomain error code 1 corresponds to configurationInvalid. It means the VPN configuration submitted to the system is invalid; it does not, by itself, mean the remote service password is wrong.
Fix: Disconnect first and check the Shadowrocket entry in system Settings. If the device isn’t managed, recreate the corresponding system configuration as described above, then note whether the same error code appears again.
| What you see | Check first | Next step |
|---|---|---|
| No system entry after turning on the connection | Was system authorization denied or canceled? | Return to Home and try again while watching for the system prompt. If it doesn’t appear, check device restrictions. |
| The system asks to add the configuration every time you connect | Was the configuration actually saved, or removed by a management policy? | Check the system list as soon as you grant permission, and note when the entry disappears. |
| The VPN reconnects immediately after disconnecting | On Demand and Connect On Demand | Pause On Demand and test again to rule out automatic activation. |
| The entry is present, but connection always fails | Other VPN status, connection logs, and existing service settings | Keep only one connection under test at a time, then investigate the specific error. |
| Connected, but websites won’t load | Service reachability, DNS, rules, and routing options | Troubleshoot the request itself; don’t repeatedly reauthorize. |
Connected: Authorization Doesn’t Guarantee Successful Requests
When the system shows Connected, the tunnel has been established to that point, but requests still depend on the selected service in Home, Global Routing, and the contents of Config. Proxy, Direct, Config, and Scene in Global Routing are different routing options, not levels of authorization. In particular, with Config selected, requests are handled according to its rules. A single website failing to load does not mean system permission has stopped working.
- Check the active configuration: In Config, confirm which file is in use. DOMAIN-SUFFIX matches domain suffixes, IP-CIDR matches address ranges, GEOIP matches IP geolocation, and FINAL handles requests that don’t match any preceding rule.
- Check the remote settings: For example, if your existing Trojan service specifies port 443, its address, port, password, and SNI should match the details from your service provider. Port 443 is a common example, not a requirement for system VPN authorization.
- Check DNS and network access: Note whether one domain or all requests fail, then test Wi-Fi and cellular separately. If switching networks resolves the issue, that only links the problem to the network environment; check the logs to identify the cause.
- Keep test conditions consistent: Use the same destination, existing service, and Config file, changing only one item at a time. Don’t update a subscription, change routing options, and rebuild the system VPN all at once, or it will be hard to tell what helped.
For a more detailed, layer-by-layer checklist, see the Connection Troubleshooting Guide. When reporting an issue, include when it happened, whether the system entry is present, the connection status, the full error code, and which network reproduces it. Hide service passwords, subscription tokens, and other identifying details; there’s no need to share your full configuration.
After Recovery: Verify the Connection and the App
Recovery is successful when all three are true: the Shadowrocket entry remains in the system VPN list, Home can connect and disconnect manually, and requests to the intended destinations work. If On Demand is enabled, also test automatic connections under the relevant conditions. If the VPN reconnects after you turn it off, that doesn’t necessarily mean authorization or the profile is damaged; check your On Demand settings first.
- After reopening the app, check that the selected service and Config are still the ones you expect.
- Test the connection on the network you actually use; don’t rely on the VPN icon alone.
- Investigate saved authorization and device management restrictions further only if the system entry disappears again or the same system error returns.
Shadowrocket is a closed-source commercial app available exclusively on the App Store, sold as a one-time purchase, and primarily intended for iPhone and iPad. Compatibility with other Apple devices, purchase availability, and system requirements are as listed on the App Store page. The app purchase does not include a service plan; check the term and settings of your existing service separately.