Setting up a VPN on your iPhone is about more than seeing a connection icon. Make sure the app has imported your subscription, the server connects, and your apps follow the expected routing rules. This guide walks through the setup in order. Import everything on a stable network, then test access. If something goes wrong, retracing the steps is more effective than repeatedly reinstalling the app.
Before you begin: understand the difference between a VPN app and a subscription
The app runs the connection on your iPhone; the subscription provides servers and related configuration. Installing an app doesn't give you access to a server, and copying a subscription doesn't connect your iPhone to a VPN. The app and subscription must be compatible before you can proceed.
Sign in to the VPNBaby dashboard to check which app downloads and subscription instructions are available for your account. The iOS download option depends on your plan status in the dashboard. This guide doesn't provide an installer or assume that a particular app is always available to download. Follow the dashboard instructions and the app's official guidance when getting the app.
VPN apps don't all support the same protocols or configuration formats. Even if two apps both offer an “Import subscription” option, they may not be able to read the same content. For example, Shadowsocks, Trojan, and VLESS are different protocol names and can't be converted into one another just by changing a file extension. Check the app's documentation to confirm compatibility. This guide doesn't infer which protocols VPNBaby currently uses.
| Item | Purpose | Common misconception |
|---|---|---|
| VPN app | Reads configurations, lets you select a server, and establishes a connection | Assuming the app is ready to use as soon as it's installed |
| Subscription link | Provides or updates servers, configuration, and related details | Mistaking a website URL or account page URL for a subscription link |
| Server | Provides the server endpoint used to connect | Assuming a server's name guarantees that a platform will be accessible |
| iOS VPN configuration | Allows the app to create a system-level network tunnel | Assuming authorization means a particular website will be accessible |
Import your subscription: check that servers appear before connecting
Find the subscription option for your app in the dashboard. If one-tap import is available, tapping it will usually open the app. If nothing happens, check that the app is installed, then try copying the link manually. Button labels vary by app and may say “Subscription,” “Configuration,” or “Import from URL.”
- Copy the subscription link for your app from the dashboard. Don't copy the account page URL from your browser's address bar.
- Switch to the app and find the option to add a subscription or remote configuration. Paste the full link. Use a name that's easy to recognize.
- Save the link, then update the subscription or download the configuration. Wait for the app to confirm it's done; don't stop at a status that only says the address was saved.
- Open the server list or proxy policy page and check that servers are available to select. If the list is empty, fix the import issue first.
One-tap import doesn't always activate a configuration automatically. Some apps let you save multiple configurations, so you'll need to set the newly imported one as active. If the server names still look old, check which configuration is active, then check the subscription update result. This helps avoid switching back and forth in the wrong configuration.
If the download fails, first make sure your current network can reach the subscription URL. Then check that the link is complete and your account is in good standing. If the app reports a format error, check whether the app supports the subscription format. Don't keep deleting and reinstalling the app before identifying the problem; doing so may also erase local rules.
Allow VPN configuration access; this doesn't install a certificate
The first time you connect, iOS will usually ask for permission to add a VPN configuration. Make sure the request comes from the app you just opened, then follow the system prompts to authorize it and verify your device. Without this step, the app may save the subscription but won't be able to create a system tunnel.
After authorizing, return to the app and check the connection status. To view the system record, search for VPN in Settings or go to General > VPN & Device Management. Menu labels may differ by iOS version and device management status.
Allowing a VPN configuration is not the same as installing a profile or trusting a root certificate. Importing a regular subscription shouldn't require you to trust a root certificate. If a guide also asks you to install a certificate or change certificate trust settings, first make sure you understand why and where it came from. If you're unsure, stop rather than approving every prompt.
Choose a server and a routing mode
Once servers appear, choose one in your target region and start with the rules recommended by the app. Don't change the server, DNS, and routing rules all at once; if access starts working, you won't know which change made the difference.
Rules mode or global mode?
Rules mode uses conditions such as domains and addresses to decide whether connections go through the proxy or connect directly, making it suitable for everyday use. Global mode generally routes connections handled by the app through the active proxy policy. It can help briefly test whether rules are affecting a website. The exact coverage depends on the app and configuration; it doesn't mean every type of traffic on your device necessarily takes the same route.
If a site won't load in rules mode but works after a temporary switch to global mode, check which rule matched, the selected policy group, and DNS first. Don't assume the server is at fault. After testing, switch back to your usual mode and adjust the rules using the app's documentation. Some apps keep existing connections open, so reopen the target app after changing modes to see the effect.
Don't apply Android per-app VPN guides directly to iPhone
On a standard iPhone, proxy apps don't necessarily offer the same per-app selection features as Android. Per-app VPN on iOS generally involves managed apps and device management configurations. For everyday use, focus on domain rules, policy groups, and features actually available in your app. Don't search for a setting on iPhone just because it appears in another platform's guide.
Don't choose a server based only on its name or a latency test. A latency test measures a specific probe; it doesn't tell you how fast downloads will be over time or whether a platform will accept that exit IP. Access to streaming services and region-specific content may also depend on your account region, content rights, and payment requirements.
How to verify that your connection is working
Verify your connection from the system status through to the app you're using. A VPN indicator means the system reports a related connection status; by itself, it doesn't prove that a particular request used your selected server. In rules mode, a direct site's exit IP may remain unchanged, and that can be expected.
- ✅ The app shows a connected status, the newly imported configuration is active, and the policy group is set to the expected server.
- ✅ Open the website or app you need the proxy for and try an actual task, such as loading a page, signing in, or playing content. Don't just check whether the homepage appears.
- ✅ If the app provides connection logs, check which rule matched the target domain and which policy it used. Make sure it didn't connect directly by mistake.
- ✅ Use a trusted IP lookup page as an additional check, and confirm that the lookup request itself goes through the proxy. A direct connection result doesn't mean the entire configuration has failed.
- ✅ Test your usual destinations on both Wi-Fi and cellular data. After switching networks, wait for the connection to recover before sending a new request.
What to check in DNS
DNS translates domain names into addresses. Even after the tunnel connects, a website may still fail to load if DNS queries time out or the rules use unsuitable results. Start with the DNS settings recommended by the app. Configuration snippets from unknown sources can disrupt how DNS and routing rules work together.
A DNS leak test can help show which resolvers handle queries, but interpret the results in the context of your configuration. The region shown for a resolver doesn't have to match your proxy exit region. Encrypted DNS in your browser, system settings, and the app's handling can also affect the results. Don't conclude there's a problem just because the regions differ; check the target request's rules and DNS path as well.
How to tell: A normal system connection, a successful test in the target app, and the expected policy being used for the request are stronger evidence that the VPN is working. IP lookup and DNS tests are supporting tools, not a substitute for testing real use.
Common issues: trace the problem to the point where it occurs
Subscription imports, but the connection fails
First check your plan status and available data, then update the subscription and try another available server. If only one server fails, note its name and the error message. If all servers fail, check the app version, protocol support, and current network conditions. Disconnect other proxies while testing to avoid interference.
Shows connected, but websites won't load
First check whether all websites fail or only one specific destination. If nothing loads, check the server connection and DNS. If only one destination fails, check the matching rule and the platform's status. Temporarily switching to global mode can help identify the cause, but leaving global proxy enabled isn't a universal fix.
Can't reconnect after locking the screen or switching networks
Reopen the app and check whether the connection has recovered, then send a new request from the target app. Whether on-demand connections or automatic reconnection work depends on the app and system settings; Android background-keepalive methods don't necessarily apply. If you use another VPN, filtering tool, or network extension, temporarily disable them one at a time to compare results, then restore any settings you need.
Updating the subscription invalidates the previous selection
A subscription update may change server or policy names. If an item you selected manually no longer exists, select a new one. Check the update result first, then make sure the active policy still points to a working server. Don't treat names in an old screenshot as permanent options.
If you still can't find the cause, see the troubleshooting guide or submit a support ticket in the dashboard with the app name, iOS version, steps that led to the issue, and a screenshot of the error with credentials hidden. Don't send your password or full subscription link. Explaining exactly where the process fails is more helpful than simply saying it doesn't work.