This is the from-scratch iOS VPN walkthrough: install the client, import the subscription, allow the system configuration, verify it works — four steps in total. Each step spells out which screen you are on and what to check first when it stalls.
iOS is different because the VPN client is not the one in charge: configurations are managed by the system, and connection state, authorization and background termination all belong to iOS. That is why one system prompt shows up in the flow — miss it and every later step looks right while no traffic actually flows.
Before You Start: Subscription Link and Client
Three things: an iOS device that can change system settings, a working subscription link, and an iOS client. The bar is low — if Settings shows General → VPN & Device Management, the system has everything it needs.
What a subscription link looks like
A subscription is a tokenized URL generated by the dashboard. The format looks roughly like this (the token here is fake; never share a real link):
https://example.com/sub?token=xxxxIt is not the same thing as a username and password: the account signs you into the dashboard, the subscription link lets the client pull the route list. The token segment is the credential itself — anyone who has it can pull the list, so think twice before screenshotting or pasting it into a group chat.
Tip: once a subscription link is out, it is hard to take back. Blur the token segment before sharing a screenshot, or simply copy a fresh link and keep it on this device only.
Step 1: Get the Client
Get the client from the download entry in the dashboard: sign in, open the download page, choose iOS and install it the way the page describes. iOS clients fall into roughly two groups:
- Clients distributed with the subscription: the subscription syncs automatically after sign-in and the route list is pushed by the dashboard — a good fit if you would rather not enter parameters by hand.
- General-purpose network clients: you paste the subscription link yourself and can edit protocol parameters, routing rules and DNS — a good fit if you need per-domain routing or troubleshooting.
Both kinds of client consume the same subscription link; the only difference is who fills in the parameters. Do not tap Connect yet — import the subscription first.
Step 2: Import the Subscription Link
The order is fixed: copy the link → create a new subscription in the client → paste → save → update. Skip one and the node list stays empty.
- Copy the full subscription link from the dashboard, and make sure you do not drop the query parameters at the end.
- Open the client, find the Subscriptions (or Profiles) entry and create a new one.
- Paste the link into the address field; the remark is free-form, e.g. "Primary routes".
- After saving, tap Update once and wait for the client to pull the route list.
| Import method | Best for | Watch out for |
|---|---|---|
| Paste from clipboard | The most common choice when working directly on an iPhone | Long links are easy to truncate by one character — check the start and the end after pasting |
| Scan a QR code | The link is on your computer and you scan it into the client with the camera | The QR code still holds that same link, and you still need to tap Update afterwards |
| Enter parameters manually | You only have single-route parameters and no subscription | Protocol, address, port and key are filled in one by one — handy for one-off troubleshooting |
When the update finishes, the client should show a list of routes grouped by region. An empty list usually means one of three things: the link was truncated, the link has expired, or the current network cannot reach the subscription address. Try another network first, then go back and check the link.
Tip: a subscription pulls a list — it is not a one-time setup. When routes change on the dashboard side, tap Update in the client and compare again.
Step 3: Allow the System Configuration
The first time you tap Connect, iOS shows a system dialog saying that the client would like to add VPN configurations. You must allow it and confirm with Face ID, Touch ID or your passcode. Tap Don't Allow and the client looks perfectly normal while the system forwards no traffic at all.
Once confirmed, a VPN badge appears in the status bar, and Settings → General → VPN & Device Management gains an entry showing Connected.
What if you tapped Don't Allow
Go back to the client and tap Connect again — the prompt reappears. If it does not, delete the leftover configuration for that client in system settings and reconnect. When switching clients, clear the old configuration first so several configurations do not fight over the connection.
Step 4: Verify It Works
Connected is not the same as working. On iOS there are two separate things to confirm: whether the exit region actually changed, and whether DNS followed.
Check the exit region
Open any IP location lookup page in a browser and see whether the region shown matches the route you picked. If you chose Tokyo and it still shows your local region, traffic is not going through the route — go back a step and check the system configuration authorization.
Check for DNS leaks
A DNS leak means traffic goes through the route while domain resolution is still handled by your local ISP. The result is an overseas exit with local resolver answers, and some sites will fail to load or keep asking you to verify. To check, open a DNS leak test page and see whether the resolver's location matches the exit.
If they do not match, set DNS to "resolved through the proxy" in the client, or enable encrypted DNS, then refresh the test page. One more thing that is easy to miss on iOS: if the system's Private Relay is on, it fights the client's DNS policy — turn it off while troubleshooting.
How to set routing rules
Routing decides which traffic goes through the route and which goes direct. There are three common modes:
- Global: everything goes through the route — the fastest way to troubleshoot, but local services take the long way round too.
- Rules: decisions based on domain, IP range and region lists; everyday sites go direct and the rest go through the route. This is the recommended daily mode.
- Direct: nothing goes through the route — useful for telling whether the problem is the route or the site.
In rules mode, if a site that should go through the route fails, or one that should go direct will not connect, check the client's connection log to see which rule that domain matched, then decide whether to whitelist it or reorder the rules. The log is far more useful than toggling the connection on and off.
Choosing a protocol
Each route in the client is labelled with its protocol. Shadowsocks, VMess, VLESS and Trojan are mostly TCP-based and have the widest compatibility; Hysteria2 and TUIC run over QUIC/UDP and complete the handshake faster on poor networks, but some networks restrict UDP — if you cannot connect, switch back to a TCP-based protocol and compare. Protocols are delivered by the subscription, so you normally do not need to change them by hand.
Pass criteria: the exit region matches the route you picked, the DNS resolver sits in that same region, and the target site opens three times in a row without dropping. All three, and the setup is genuinely working on iOS. A single successful load does not count, and the latency numbers in the client are only a reference.
What to check when a step fails
Sorting common failures by step is faster than reinstalling at random. Work through the checklist below item by item.
- ✅ The client shows a route list, and it is not last time's cache — entries changed after you tapped Update.
- ✅ A VPN configuration for that client exists in system settings, and its status is Connected rather than Not Connected.
- ✅ The VPN badge appears in the status bar and disappears when you close the client, which shows the client really owns the connection.
- ❌ Empty list: try another network to re-pull the subscription, then check whether the link was truncated when copied.
- ❌ You tapped Don't Allow on the prompt: delete the leftover configuration and reconnect, or switch to another client to trigger authorization again.
- ❌ Connected but sites will not load: switch to Global mode and compare, then check the DNS test page for leaks.
- ❌ Only some sites misbehave: check which routing rule matched instead of switching routes over and over.
Three platform differences on iOS
- Configurations belong to the system: desktop clients maintain their own virtual adapter, while iOS must go through the system VPN framework — so every new client triggers the authorization prompt again.
- Stricter background policy: iOS actively reclaims background processes, so after a long connection, reopening the client may report that it needs to reconnect. Low Power Mode makes this more frequent.
- Subscription updates happen when you open the client: nothing is pulled in the background, so after changing routes or settings, remember to tap Update in the list.
After Setup: Usage and Plans
One account covers unlimited devices — iPhone, iPad and computer can share the same subscription. On usage, monthly plans reset each month on the day you started: ¥9.9 for 60GB, ¥18 for 250GB, ¥28 for 500GB. If you only look things up occasionally or need it for a few days on a trip, a data pack fits better: from ¥158 for 300GB, valid until used up, with no expiry date.
Within 14 days of your first payment you can request a full refund, no questions asked. Payment supports Alipay, WeChat and USDT, and signing up needs only a username and password — no email address. Put together, the cost of trying it is lower than you would expect: get the four steps working first, then decide whether to stay long-term.