When comparing iOS VPNs, check whether you can install the app, import your subscription, and route traffic as intended—not just the app's name. The App Store region determines which apps are listed; the subscription format determines whether a client can read the configuration. The VPN icon only indicates connection status and doesn't prove that traffic to a particular site is using the intended route.
For a first-time iPhone setup, follow this order: confirm the iOS connection method supported by your service, get a compatible client, import the subscription, then verify access. If you already have a client, check its supported formats and protocols first so you don't buy another app just to change routes.
What your App Store region affects
The App Store catalog is tied to the country or region of the Apple Account used for purchases, not your VPN exit location. Switching routes won't change your store region. Changing your device language, region, or browser language won't change the App Store catalog either.
Check the app name and developer in your service dashboard before searching the App Store. If you see “Not available in your country or region,” check your store account region and whether the app is currently listed instead of repeatedly refreshing your subscription. App availability can change, and the clients mentioned here may not be downloadable in every region at all times.
Before changing your Apple Account region, review Apple's requirements for account balance, existing subscriptions, Family Sharing, and payment methods. Don't treat a region change as a temporary switch with no side effects. Use an account you manage so you can update apps and restore purchases later; don't use shared accounts from strangers or hand over your credentials.
How to choose an iOS client
iPhone's built-in VPN settings aren't a universal subscription importer. Proxy configurations for Shadowsocks, VMess, Trojan, VLESS, and other protocols usually require an app that supports them; you can't paste a subscription URL into the system's “Server” field. For Hysteria2, TUIC, and other protocols, check the client version and implementation—“supports proxies” alone doesn't guarantee compatibility.
| Connection method | Best for | Check before importing | Key limitations |
|---|---|---|---|
| Service-specific app | Connecting directly using your service's instructions | Whether an iOS version is available and how accounts are linked | Don't assume it supports subscriptions from other services |
| Shadowrocket | A subscription or configuration explicitly provided by the service | Protocol, subscription type, and source of rules | You can't assume a desktop configuration will work unchanged |
| Stash | Configuring rule-based routing and policy groups | Whether the service provides a compatible configuration file | Fields and extensions vary between cores |
| sing-box-compatible client | The service provides the required format and you're prepared to check the configuration | App version, configuration structure, and protocol support | Configuration updates may require changes to fields |
| Built-in system VPN | An organization or service explicitly provides connection details supported by the system | Connection type, server, and authentication details | Not a general-purpose client for the proxy protocols above |
First, check whether your service dashboard has an import option for the client you're considering. Then check whether its routing rules and DNS settings are complete; compare interface preferences last. A “node” in a client list generally means a connection endpoint and its settings. IEPL, transit, and direct connections describe route paths or transport methods, not iOS protocol plugins you need to install separately.
If you're new to this, start with a client and configuration explicitly supported by your service. For more control over routing, check policy groups, domain rules, and DNS behavior. There is no single “best iOS VPN client” for every service, and repeatedly switching apps won't make an incompatible subscription work.
Configuration profiles vs. VPN settings
An iOS configuration profile is a way to distribute device settings. These files commonly use the .mobileconfig extension and can contain VPN, certificate, network, or device management payloads. A profile isn't the same as a node subscription, and most proxy clients don't require one to run.
When you first enable a regular client, iOS may ask whether you want to allow it to add a VPN configuration. Once approved, the app can use the system network extension to create a tunnel. That's different from manually installing a downloaded profile in Settings. Keep app subscriptions, VPN configurations saved by the system, and profiles installed on the device distinct.
If a guide asks you to download a profile, review the publisher, included payloads, and permissions on the installation screen. A signature can help verify a file's source or integrity, but it doesn't tell you whether the requested settings are appropriate. Certificate trust and device management have separate implications; don't accept unfamiliar settings just to connect to a route.
To check for old configurations, search Settings for “VPN” or “Profiles.” The relevant section is often under “General” > “VPN & Device Management”; exact labels vary by iOS version. Confirm who a profile belongs to before removing it, so you don't delete a work or school configuration. Uninstalling an app doesn't guarantee that all profiles and certificates have been removed.
How to import a subscription after installation
Subscription links often contain account identifiers. A client uses one to retrieve nodes, and some full configurations also include rules and policy groups. It's not an ordinary URL to share publicly or a webpage you need to open in a browser every time you connect.
- Check the app's source. Open the App Store through your service's instructions and verify the developer and app name. Don't trust a similar-looking icon in search results alone.
- Get the right format. Sign in to your service dashboard and choose the subscription option for your client. Don't force a configuration made for a different core into the app or hand it to an unfamiliar online converter.
- Import and update. Use the client's link import, clipboard import, or dashboard handoff feature. Confirm the expected nodes appear in the configuration. If it's empty, check that the link is complete and in the right format.
- Check routing and permissions. Follow your service's instructions to choose a routing mode and exit, then connect. When iOS prompts you to add a VPN configuration, verify the app name before allowing it.
- Verify traffic. Check your exit location and test the destination app for loading and functionality. Keep the current working configuration before trying different rules or routes.
If importing fails, first determine whether the subscription couldn't be downloaded or downloaded but couldn't be parsed. The former may be caused by a network issue, an expired link, or account status; the latter often points to an incompatible format, protocol, or configuration field. Support usually needs only the client name, version, and a redacted error—not your full subscription link.
How to check routing and DNS
Rule-based routing uses domains, destination addresses, or other conditions to decide whether traffic goes through a proxy or connects directly. Global mode usually sends all connections within the client's scope through the selected policy. It doesn't mean every system connection is always proxied, and it can't remove a destination app's regional restrictions.
For your first connection, start with the rules provided by your service. Avoid changing DNS, removing policy groups, and switching modes all at once. If an international site won't load, you can compare another mode or route temporarily, but change only one setting at a time. Fix the rule once you identify the issue instead of leaving global mode on to mask a configuration problem.
A DNS leak occurs when domain lookups that you expect to take a particular route are sent another way. Check the client's DNS settings, query logs, and test results together; a changed exit IP alone doesn't tell you how DNS is handled. Conversely, a test showing a resolver in another region doesn't prove there's a leak without considering the configuration, since public DNS services may use distributed networks.
- ✅ Use the IP lookup page to check your browser's current exit IP, then test the destination app separately. Don't assume browser results apply to every app.
- ✅ Check the client's connection logs to confirm the destination domain matched the intended rule and policy group.
- ✅ Check where DNS queries are routed. If encrypted system DNS or another network extension is enabled, check its effects too.
- ❌ Don't treat the system VPN icon, a webpage loading, or a single DNS test as complete verification.
Streaming and collaboration apps may also use account region, location permissions, or session history to determine your location. If switching routes doesn't help, check the app's message first instead of assuming it's a speed issue. For general issues, see the full troubleshooting guide.
Connect and switch routes with Shortcuts
“Connect to VPN” and “switch nodes” are different capabilities. Depending on your iOS version, Shortcuts may offer a VPN connection action, but you'll need to check whether it can select the configuration you want on your device. It generally can't change the exit policy inside a third-party client.
To connect from your Home Screen, create a Shortcut, search for VPN actions, select the configuration you want, and explicitly set it to connect or disconnect. A fixed “Connect” action is more predictable than “Toggle”: run the latter again and it may disconnect an active connection. Test the Shortcut manually before adding it to your Home Screen.
To switch to a specific exit, such as Japan or the United States, check the client's documentation or available Shortcut actions for options to select a node, set a policy group, or run a configuration. If the client provides one, set the policy before connecting. If it doesn't, a system action can't add that capability.
Some apps support URL schemes. Use only formats documented by the developer; don't copy links from other clients or share commands that contain subscription credentials. Automations triggered by opening an app or a network change may depend on the lock screen, permissions, and system execution conditions. Test them individually; they aren't guaranteed to run silently every time.
Troubleshooting: connected but can't access sites
Temporarily disconnect other proxies or VPN clients, confirm your basic connection works, and then start only the configuration you need. Avoid having on-demand connection settings from multiple apps compete with each other, and don't start by resetting all network settings.
If all nodes fail, check whether the subscription is up to date, the account is active, and the client supports the current protocol. If only one node fails, compare another endpoint in the same region or try a different network. If you're connected but one app fails, check its routing rule, app session, and service restrictions first.
Problems that appear only after switching between Wi-Fi and cellular may involve network paths, UDP reachability, or how the client reconnects. A protocol's name doesn't guarantee it will work better on every network. Use compatibility options provided by your service and don't change transport settings you don't understand.
Setup is complete when the client source is clear, the subscription updates, system permissions are understood, and routing and exit behavior match expectations. Shortcuts can reduce repetitive steps, but they can't replace a correct configuration or fix route and account issues.