Before You Start: Three Things to Check
iOS funnels every third-party VPN into its system-level “VPN Configurations” framework: the client writes a configuration through a system network extension, and the system builds the tunnel. That's why the first connection always triggers a system prompt — it isn't an ad or a redundant step, it's how iOS permissions work. Once that clicks, the rest of the setup goes much more smoothly.
Three things to confirm before you start:
- An iPhone with a working internet connection, running a reasonably recent public iOS release. Very old versions may not install the current client — updating iOS is less hassle than reinstalling the app over and over.
- A working subscription. Signing up needs only a username and password, no email address; once you're logged in, copy the subscription link from the dashboard — that link is the entry point for every step below.
- A stable network. Do the first import over Wi-Fi; switching networks mid-import will make the node list fail to load.
Cost first: monthly plans are ¥9.9 for 60GB, ¥18 for 250GB and ¥28 for 500GB; data packs are ¥158/300GB, ¥358/1000GB and ¥658/3000GB, valid until used up with no expiry. If you only use one iPhone, the 60GB tier is usually enough; add an iPad and a computer and you'll want the next tier up.
Step 1: Get the App and Import Your Subscription
Copy the subscription link
After signing up and logging in, the subscription page in your dashboard shows a link starting with https. Copy the whole thing — don't stop halfway: the parameters at the end are part of the authentication, and one missing character will break the import. Treat that link like account credentials: anyone who has it can burn through your data, so don't post it in public groups or share screenshots of it.
Install the client
Search the brand name in the App Store and download the client. App Store availability depends on the region your account belongs to; if it isn't listed in your current region, sign in to the App Store with an Apple ID from another region, download it, then switch back to your usual account — installed apps don't disappear when you switch.
Import the subscription
- Open the client and find “Add Subscription” or “Import from Link”.
- Paste the link you copied into the field and give the subscription a name you'll recognise, such as “Primary”.
- Once saved, the client pulls the node list automatically. Wait a few seconds — if countries/regions and route names appear, the import worked.
- When nodes change later, just tap “Update” on the subscription; there's no need to reinstall the client.
Some clients also support QR import — the code simply contains the same link, so both methods are equivalent.
Don't forward your subscription link
It's not just an address; it carries your account identifier. If it leaks, the data usage you see in the client may be coming from someone else's device.
Step 2: Allow the VPN Configuration
Pick a route and tap Connect. The first time, iOS always shows a system dialog — usually titled “VPNCQ” Would Like to Add VPN Configurations, with a line underneath naming who provides it. Tap Allow, then confirm with Face ID, Touch ID or your passcode.
Once you've approved it, three things change:
- A VPN badge appears in the status bar — its exact position varies by iOS version, usually top-left or on the right side.
- The VPN entry in Control Center switches to connected and shows the name of the configuration in use.
- Back in the client, a connection timer appears next to the route name and starts counting.
Where is the configuration stored? Settings → General → VPN & Device Management → VPN, where a configuration named VPNCQ will be listed. You can toggle it manually there too, but switching routes and checking your current exit is far clearer in the client.
If you tap Don't Allow by accident, go back to the client and connect again — the prompt usually reappears. If it doesn't, delete the leftover configuration at the path above and connect once more from the client.
One more easy trap: with two or more VPN clients installed on the same iPhone, iOS generally keeps only one personal VPN tunnel active at a time, so switching clients disconnects the previous one. If a connection drops right after it connects, check whether another client has grabbed the configuration in the background.
Step 3: Choose a Route and Routing Mode
After a successful import, the client lists a long set of routes with different countries/regions, cities and route types. Coverage is 120+ countries / 150+ routes — you don't need to test them one by one; sorting them into three groups by purpose is enough.
| Route type | How traffic travels | Best for | Watch out for |
|---|---|---|---|
| IEPL dedicated line | Carrier-grade dedicated line that avoids public international gateways | Video calls, remote desktop and other long-lived connections | Fewer nodes, so popular hours may mean waiting |
| Relay | Connects to a nearby relay node first, then on to the exit node | Everyday browsing and short connections | One extra hop; quality depends on the relay node |
| Direct | The client connects straight to the exit node | Quick lookups, backup | More noticeably affected by international gateway congestion |
How to choose: start with Direct — if it loads reliably, it's the leanest option; if it stalls at peak hours, switch to Relay; for meetings or remote desktop, go straight to IEPL. A region usually has more than one route, so note down the one you use most and skip the list next time.
Choosing a routing mode
Clients usually offer three modes:
- Global proxy: all traffic goes through the tunnel. Simplest to set up, but local sites take the long way round too, which adds latency.
- Rule-based: only the domains and IP ranges in the rule set are proxied, everything else connects directly. This is the everyday choice — local sites are unaffected and overseas sites go through the tunnel automatically.
- Direct: keeps the configuration but proxies nothing — handy when you want to switch it off temporarily.
Rule-based routing lives or dies by its rule set. When a site won't open, first check whether its domain is matched by a rule — excluded domains go over the local network, which looks exactly like the VPN is on but nothing changed. Add the domain to the proxy list if needed, save, and reconnect for it to take effect.
DNS has to go through the tunnel too
DNS leaks are the easiest link to overlook. If the tunnel only carries web traffic while DNS queries still go to your local ISP, the domains you visit stay visible on the local resolution path, and answers can be pointed at the wrong address. There are two fixes: turn on “Proxy DNS” or “DNS over tunnel” in the client, or set the DNS server manually to a resolver inside the tunnel. Either way, confirm it with the checks in the next section.
Step 4: Verify It's Working
Connected doesn't mean working. Run through the checks below and only start using it normally once they all pass.
- ✅ The status bar or Control Center shows the VPN as connected, and the client displays the current route name and connection time.
- ✅ An IP lookup site shows an exit region matching the node you picked — choose a Japan node and it should show Japan.
- ✅ A DNS leak test shows the resolver on the tunnel side, not your local ISP.
- ✅ International sites that normally won't load now open, without the endless spinning.
- ❌ The exit IP is still local: the tunnel isn't carrying your traffic. Check whether you're in Direct mode, or whether a routing rule excludes the destination.
- ❌ DNS still shows your local ISP: turn on proxy DNS, or set the in-tunnel DNS manually and reconnect.
- ❌ It connects but pages spin: try a different route type — Direct to Relay or IEPL — and if that fails, a different protocol.
If both the exit IP and DNS checks pass, your traffic is almost certainly going through the tunnel in full. If pages are merely slow, that's route quality — switch routes; there's no need to reinstall the client.
Steps 3 and 4 are where most mistakes happen: a wrong route only makes things slow, but a wrong routing rule or DNS setting means “connected” with no tunnel at all — it looks like the VPN is broken when flipping two switches is all it takes.
Troubleshooting order when it won't connect
Most connection failures aren't account problems but link or configuration problems. Work from the outside in — usually the first three steps find it.
- Check the status. If the client sits on “Connecting” forever, the protocol is probably being interfered with; if it throws an error immediately, suspect an expired subscription or a dead link first.
- Change route. Try a different route type in the same region — one dedicated line, one relay, one direct — to see whether it's a single route or everything.
- Update the subscription. The node list is cached; leave it too long and you'll connect to nodes that are already offline.
- Check the system time. Settings → General → Date & Time, turn on Set Automatically. A large clock skew breaks the TLS handshake, and certificate-checking protocols like Trojan and VLESS are especially sensitive.
- Check whether UDP is restricted. Hysteria2 and TUIC run over QUIC and use UDP; some networks throttle UDP ports, which shows up as “connects but no speed”. Switch to a TCP-based protocol and try again.
- Change network. Switch between Wi-Fi and mobile data once to rule out a local network problem.
- Open a ticket. Include the model, iOS version, client version, the route you selected and the exact error text — it makes diagnosis much faster. A full refund can be requested within 30 days of your first payment.
You don't configure protocols yourself
VMess, VLESS and Trojan use TLS over TCP for better compatibility; Shadowsocks is lightweight but has a more distinctive traffic pattern; Hysteria2 and TUIC are built on QUIC, steadier on poor networks but more sensitive to UDP restrictions. The protocol comes from the client and the subscription — you only switch it in the client, never fill in parameters by hand.
Common beginner questions
Do I need to set it up again on a new iPhone?
Yes. VPN configurations live in the local system and don't migrate with your account. On the new device, install the client, import the same subscription and approve the configuration once; on the old device, remember to delete the configuration under Settings → General → VPN & Device Management.
How many devices can one subscription cover?
As many as you like. The same subscription can be imported on your own iPhone, iPad and computer, all online at once; but the link itself is a credential, so keep it to yourself.
Do I need to re-import the subscription every month?
No. The subscription link stays valid long-term, and the plan's data allowance resets monthly from your activation date; after renewing, just tap “Update” in the client once.
Does leaving it on drain the battery?
A persistent tunnel adds some power draw, but most of the consumption comes from actual traffic. If you won't use it for a while, disconnect in the client — no need to delete the configuration; one tap brings it back.
Connected but pages won't open?
Check three things in order: whether a routing rule excludes that domain, whether DNS goes through the tunnel, and whether the current route works. The first two are fixed in the client; for the third, switch routes to test.
The whole four-stage process in one line: get the subscription link → import it into the client → allow the system configuration → verify the exit IP and DNS. The first two are one-time jobs; the last two are worth a second look whenever you change device or network.