After install, do not rush to find a subscription. The first job is to let iOS / iPadOS allow Shadowrocket to add a VPN configuration. A large share of “the switch flips back” and “nothing will connect” starts with this step being denied or the configuration being deleted.
Allow adding a VPN configuration
- Open Shadowrocket. The Home screen shows the connection switch.
- Flip the switch once. The system asks whether to allow adding a VPN configuration.
- Choose Allow, then confirm with Face ID, Touch ID, or the passcode.
- Open Settings → General → VPN & Device Management, or Settings → General → VPN, and confirm a Shadowrocket-related configuration appears.
The system is asking to authorize a configuration profile, not for your Apple ID password. If you tapped Don’t Allow, the switch often lights up and flips back. Return to the app and flip it again. You usually do not need to delete and reinstall.
Screen Time, company MDM, or parental controls can block adding a VPN. In that case you have to lift the device policy first. The app cannot bypass it.
Three main screens
Entry labels can differ slightly across minor versions. The structure is usually stable:
- Home screen: the master switch, the node in use, and connection status.
- Config: subscriptions, local configuration files, and entries for clipboard, scan, and manual add.
- Settings: proxy mode, DNS, On-Demand, per-app, backup, and other options.
The first time you open Config, the list is often empty. That is normal: no server information has been written yet. An empty configuration can still complete the VPN permission above.
How this relates to the system VPN
iOS usually lets only one VPN actually take effect at a time. If another VPN is already on, opening Shadowrocket can leave both sides unable to connect. While you debug, turn the other VPN off and keep only this one.
On newer iOS, the VPN entry may be in Settings → General → VPN & Device Management, or still in Settings → General → VPN. If you cannot find it, search for VPN in the box at the top of Settings. The list should show a configuration name related to Shadowrocket. When it is not connected, the status is often Not Connected.
It still flips back after you allow it
If you already tapped Allow and it still flips back at once, check in this order: whether the system configuration was deleted; whether another VPN is on at the same time; whether Screen Time restricts VPN. On a company device with MDM, an admin can block adding a VPN. Only a policy change helps. Reinstalling the app will not.
After permission, the configuration list can still be empty. The next step is writing a subscription or node in. See Add a subscription or node.