How do you use a VPN on an iPhone? First, get an iOS client that works with your subscription service. Import the subscription, allow iOS to add the VPN configuration, choose a route, and connect. Then check your exit IP and confirm that the apps you use are taking the expected route. Don’t rely on the status bar icon alone: it shows that iOS has established a VPN connection, but doesn’t prove that a particular website or app is using your selected route. This guide walks through the first-time setup in order and explains where you might run into trouble.
Before you start, make sure the client works with your subscription
First, know the difference between the two: a client is an app installed on your iPhone that manages the connection; a subscription is the service’s way of providing route configurations. A subscription link is usually imported into a compatible client—it isn’t a web address to paste into iOS Settings. Only set up a connection manually in system settings if the service explicitly provides configuration details for iOS’s built-in VPN support.
Check the iOS client name, supported import methods, and instructions using the download link provided by your service. For VPNQN, start at the client download page. Apps with the same or similar names in the App Store aren’t a substitute for your service’s instructions. Check the developer details before downloading, and don’t hand your subscription to an app from an unverified source. If your device is managed by your school or employer, first check whether its management policy allows you to add a VPN configuration.
| What you have | How to use it | What to check first |
|---|---|---|
| Subscription link | Choose the link import option in a compatible client, then refresh the route list | Whether the client supports the subscription format and the link is still valid |
| QR code | Scan it using the client’s built-in scanner; you may need to save it first and import it from Photos | Whether the QR code contains a full subscription or just one route |
| Individual route details | Enter or import each field according to the client’s supported types | Whether the protocol, address, and other details match the service’s instructions |
| System VPN configuration details | Add them in iOS using the provider’s instructions for native configuration | Whether the setup uses a configuration method that iOS natively supports |
Shadowsocks, VMess, Trojan, VLESS, Hysteria2, and TUIC are names of different connection protocols or solutions, not generic “connection mode” buttons on an iPhone. A client that supports one protocol may not recognize every subscription format. Likewise, being able to import a subscription doesn’t guarantee that every route will work in that client. If the list is empty after import, check the service’s instructions and client compatibility first instead of repeatedly toggling the system VPN switch.
Get an iOS client and find the import option
Once you’ve installed the client recommended by your service, open it and look for an option such as “Add,” “Import,” or “Subscription.” Menu locations and wording vary across clients, but the goal is the same: let the app manage the configuration provided by your service. When you open the app for the first time, it may ask for notification, Photos, or camera access. Which permissions it needs depends on your import method. For example, importing from a link usually doesn’t require camera access, while scanning a QR code may.
- Get the subscription details from your service dashboard and make sure they’re intended for your current client. If the page offers multiple formats, choose the one its instructions recommend for iOS.
- Return to the client, choose “Import from link” or the corresponding option, paste the subscription link, and save it. To import a QR code, scan it from within the client.
- Manually update or refresh the subscription once. Import is complete when you see region or route entries. Seeing only the saved link name doesn’t confirm that the list loaded successfully.
If the refresh fails, first check for extra spaces in the link and make sure your current network can open the service dashboard. Then check whether the client reports an unsupported format, an expired link, or a network request failure—each requires a different fix. Don’t mistake an individual route address for a subscription link. And don’t enter your subscription into a “format converter” site unless you’ve verified its source; the conversion process may expose the full configuration.
Allow the VPN configuration, then choose a route
Once the routes appear, choose one that matches the region of the service you want to access, then tap the client’s connect button. The first time you connect, iOS will usually ask for permission to add a VPN configuration. Check that the request comes from the client you just installed, then approve it as prompted. Your device may ask you to confirm using your usual unlock method. This allows the app to submit a connection configuration to iOS; it doesn’t verify that every app’s traffic is taking the expected route.
Some clients ask you to choose between global routing and rule-based routing before connecting for the first time. Global mode generally routes as much client-managed traffic as possible through the selected route. Rule-based routing decides whether traffic uses the route or your local network based on conditions such as domains, addresses, or apps. Exactly which traffic is routed depends on the client and its rules. For initial troubleshooting, start with the client’s recommended defaults and note the selected route and mode. If an app behaves differently later, check its routing rules.
After a successful connection, the client will usually show that you’re connected, and iOS may display a VPN status indicator. If iOS says another VPN configuration is already in use, check which app owns the active configuration. This helps avoid confusion when multiple clients are involved. You can use system settings to check the VPN status, but switch routes and refresh subscriptions in the client that manages that subscription.
How to verify that the connection is working
The simplest check is to compare your exit IP before and after connecting. Before you connect, open a trusted IP lookup page in your browser and note the reported region and network provider. After connecting, refresh the same page and see whether the exit location matches your selected route. The city shown by an IP lookup may be inaccurate, so focus on whether the public exit IP and general region look right—not whether the city name exactly matches the client.
Next, check the app you actually want to use. Fully close and reopen it, then try accessing the content. Some apps cache connection status or location data. If your browser shows a changed exit location but the target app still behaves as if it’s on your local network, check whether the client has per-app rules, a direct-connection list, or domain-based routing enabled. Account region, content licensing, and cached data can also affect what an app shows. A changed network exit doesn’t guarantee that a service will display different content.
For further troubleshooting, use a DNS test page to see where your DNS requests are being resolved. If the results show a resolver you didn’t expect, check the client’s DNS settings and routing rules. However, a resolver’s location doesn’t have to match your exit IP’s location, so don’t assume there’s a leak based on the location alone. Test Wi-Fi and cellular separately, too. Switching networks may reconnect the VPN, so results from the previous network may no longer apply.
- ✅ The client shows the selected route as connected, and the iOS VPN status matches.
- ✅ Your browser’s public exit IP appears to be in the selected route’s general region.
- ✅ After reopening the target app, its traffic follows the client’s routing rules.
- ✅ After switching networks, check the connection, exit IP, and DNS behavior again.
What to do if the route list is empty, the connection fails, or access is unreliable
First, identify which step is failing. If no routes appear after importing a subscription, return to the import screen, confirm the link or QR code type, refresh manually, and read the error message. If routes are listed but you can’t connect, try another route recommended by the service and check that the route’s protocol is supported by your client. IEPL, relay, and direct connections describe transport paths or access methods, not iOS system switches. The name alone doesn’t prove that a route currently works with your network.
If the client says it’s connected but webpages still won’t load, first open a regular webpage to check whether the device itself has internet access. Then check whether the client has mistakenly added the destination to a direct-connection rule or set DNS to a resolver that’s unavailable on your current network. Compare against the client’s default rules first. Avoid changing the route, DNS, and routing rules all at once, or you won’t know which change helped. If the issue affects just one app, focus on its routing rules and account region rather than reinstalling every configuration.
If it works on Wi-Fi but fails on cellular, disconnect and reconnect, wait for the client to update its status, then check your exit IP again. A change in network conditions can interrupt an existing session, and an app may briefly continue to show “Connected” even though traffic isn’t flowing properly on the new network. If the problem persists, note the route name, the client’s error message, the network type, and what you were doing when the issue occurred. That gives support more to work with than “it doesn’t work.”
Tips for everyday use and switching devices
After the initial setup, you don’t need to import the subscription again every time. To see new or updated routes, refresh the subscription list in the client. To switch regions, select a route from the existing list and check your exit IP again. Refreshing a subscription and switching routes are two different things: the first retrieves configuration updates; the second chooses the route used by your current connection. If you haven’t used the client in a while, check the subscription and connection status when you reopen it.
When you replace your iPhone or reinstall the client, subscriptions and rules saved in the old app may not transfer automatically. Get the current import details from your service dashboard, then follow the new device’s client instructions to add the configuration. Don’t assume the new device is set up just because the old one still shows a VPN icon. iOS clients can differ in their support for protocols, subscription formats, and routing features, so check compatibility before migrating rather than relying on an old screenshot to find each button.
Finally, consider where and how you’re connecting. On public networks, make sure the sites you visit are trustworthy. On workplace or school networks, follow the applicable policies. A VPN changes the route taken by some network traffic; it can’t tell whether a page is genuine or resolve account permission and regional licensing issues for you.