How do you use a VPN on iOS? On an iPhone, you usually need to install a compatible client, import the subscription provided by your service, allow it to add a VPN configuration, then select a route and test access. The VPN switch in iOS Settings does not provide routes; turning it on alone won’t complete setup.
Follow these steps the first time you connect. Menu names vary by client, but the process is the same: get a configuration, load routes, grant permissions, and connect. This guide doesn’t assume you’ve already installed a particular app, and the button names in one client may not match those in another.
Before You Begin: Understand Clients, Subscriptions, and iOS Settings
A client is an app that runs on your iPhone. It reads route details, manages connections, and applies traffic-routing rules. A subscription is a configuration entry point provided by the service, usually as a link. The client uses it to retrieve nodes and related settings. A node is a specific connection endpoint you can select.
The iOS VPN configuration allows an app to handle traffic through Apple’s Network Extension framework. Proxy clients may also show the system VPN indicator, but that doesn’t mean they use the same protocol as the IKEv2 configurations commonly used by businesses. Don’t paste a subscription link into the server address field when manually adding a VPN in Settings.
| Item | What it does | Common misconception |
|---|---|---|
| Client app | Import a configuration, select a node, and connect | Assuming installation automatically provides working routes |
| Subscription link | Retrieve and update route details in the client | Treating it as a regular web address or entering it in the system server field |
| Service account | Sign in to the user dashboard to view your plan and subscription link | Using the dashboard password as the node authentication password |
| System VPN configuration | Grant the selected app permission to handle network traffic | Assuming the VPN indicator means every website is working normally |
Find and Choose an iOS VPN Client
For VPNUnit, first sign in and open the client download section in the user dashboard, then check the current iOS instructions. The dashboard manages platform download access. App availability, access, and any additional charges can change, so check the current download section and App Store listing before paying for an app.
Get apps through the official links provided by the service or channels published by the developer. App Store availability may vary by account region. If you can’t find an app, check the official instructions first. Don’t install configuration profiles from unknown sources or sign in to Settings with someone else’s shared Apple Account.
When choosing a client, check its protocol and subscription format support. Shadowsocks, VMess, Trojan, VLESS, Hysteria2, and TUIC are distinct protocols, and client support may change between versions. Supporting a protocol doesn’t necessarily mean a client can parse every subscription format. Use the import method provided for that client in the dashboard.
Import a Subscription: Verify the Source, Then Update Your Routes
Check your plan status and available traffic in the user dashboard before opening the subscription section. Subscription links usually contain credentials that can retrieve your configuration, so treat them as sensitive. Don’t share them in public chats, screenshots, or online parsing tools. If you need help troubleshooting, redact authentication details in the link first.
- Find the import option for your client. If the dashboard offers one-tap import, install the target app first, then use the link and confirm that it opens the correct app.
- If the link doesn’t open the app, import it by pasting. Copy the full subscription link, then look in the client for “Add Subscription,” “Import from URL,” or a similar option. Don’t create a manual node at random.
- Make sure the import was saved. Give the configuration a recognizable name. After saving, update or refresh it and check that the route list and rules appear.
- Check which configuration is selected. If the app lets you save multiple configurations, make sure you’re using the subscription you just imported, not an old configuration or an app demo.
An empty node list after import doesn’t necessarily mean the routes are unavailable. You may have missed a character while copying, the subscription may have expired, the current network may be unable to reach it, or the format may not be supported. Check the import error in the app, then verify the dashboard link. Switching nodes repeatedly won’t fix a subscription parsing error.
Updating a subscription usually syncs routes and configuration. It doesn’t automatically renew your plan or change your current traffic allowance. Check the dashboard for plan and traffic details. If a link is exposed, look for an option to reset the subscription in the dashboard, or contact support for guidance.
Allow the iOS Configuration and Connect for the First Time
Return to the client, select a working configuration and route, then tap the connection switch. The first time you connect, iOS will usually ask whether to allow a VPN configuration. Check the app name in the prompt, confirm it’s the client you just installed, and allow it. Follow the system prompts to authenticate your device.
If you denied permission earlier, return to the app and try connecting again. If needed, look for “VPN” or “VPN & Device Management” in Settings to check whether the app’s configuration is already there. Menu locations vary by iOS version, so you don’t need to change unrelated settings just to find an exact menu label.
For the first test, use just one client and pause other VPN or filtering apps that may take over network traffic. This reduces conflicts between configurations. Work- or school-managed devices may have restrictions; check with your device administrator rather than trying to remove your organization’s management configuration.
When choosing a route, prioritize stability and the intended use rather than chasing the lowest latency in the list. IEPL, transit, and direct connections describe how a route is set up, not its protocol, and none of these labels guarantees access to a particular platform. Check the node region, exit IP address, and target platform requirements separately.
Choosing Between Rule-Based and Global Modes
For everyday use, start with the rules mode recommended by the service or client. It uses criteria such as domains and addresses to decide whether traffic connects directly or goes through a proxy, making it useful when accessing both local and international services. Whether the rules work depends on their contents, matching order, and whether the current configuration loaded correctly.
Global mode usually sends traffic handled by the client through the selected proxy. It can help you check whether a problem is caused by routing rules, but it doesn’t mean every communication on your device takes the same path. System behavior, app implementation, and exclusions can still affect the result, so it’s no guarantee that every app will work.
If a website works in global mode but not in rules mode, check which rule matches its domain, whether the rule group has a working node selected, and whether the rule set is up to date. Don’t assume a node is faulty just because a rule isn’t working. When you’re done testing, switch back to the mode that suits your everyday use.
Check that it works — don’t rely on the VPN indicator alone
The VPN indicator in iOS only shows that a related network configuration is enabled. To check what’s actually happening, look at the client status, the target website, and the exit information together. Keep the network and node unchanged during testing. If you change Wi-Fi and routes at the same time, it’s hard to tell which change fixed the issue.
- ✅ Check that the client is connected and that its logs aren’t showing repeated authentication failures, parsing errors, or connection timeouts.
- ✅ Open the international websites you actually use and check that the pages and key features work, rather than just checking whether the home page loads.
- ✅ Check the exit information on a reputable IP lookup site and confirm it matches the expected route. In rules mode, different sites may use different exits.
- ✅ Visit familiar local websites to check that traffic rules aren’t disrupting services that worked before.
- ✅ Test again after switching to another network to see whether the issue only occurs on a particular network.
A DNS check shows which resolvers handle domain lookups. Seeing a local resolver on a test page alone isn’t enough to conclude that all traffic is leaking. Routing rules, encrypted DNS, and the client’s DNS policy can all affect the result. Check the rules and logs for the target domain to see whether its queries took an unexpected path.
If the app provides DNS settings, start with the configuration recommended by the service. Don’t change system DNS, client DNS, and rule sets all at once. If you need to troubleshoot, change one setting at a time and record the results. A browser test page only shows what it can observe during that test; it can’t prove that every app on the device uses the same route.
Common issues: troubleshoot by stage
Routes are listed, but the client won’t connect
First check that your basic connection works with the client turned off. Then check your plan status in the dashboard, the selected node, and the client version. Logs can help distinguish authentication failures from network timeouts. Trying another compatible node can be useful for comparison, but if every node reports the same configuration error, check client compatibility first.
Connected, but some apps can’t access the internet
Using the same node, first try opening the affected website in a browser. Then temporarily compare rules mode with global mode. If the site works in a browser but not in the app, the cause may be app caching, account region, restrictions on the target service, or different routing rules for the app’s domains. Changing your exit IP won’t change the terms that apply to your account; check the target service’s guidance.
The connection drops after locking the screen or switching networks
Switching between cellular data and Wi-Fi changes the connection conditions, and whether the app reconnects automatically depends on how the client is built. Check the app’s auto-connect or on-demand connection settings, and read the relevant instructions. Keeping the screen on isn’t a fix. If the problem recurs, note the network type, what you were doing, and any error logs before contacting support.
What to include when contacting support
Note your iOS and client versions, the name of your current configuration, your network type, whether the issue occurred during import or connection, and logs with sensitive information hidden. Find contact options on the Support page. Don’t expose subscription links, node credentials, or account passwords in support ticket screenshots.