The Verdict First: Three Gates on iOS
On Android you just install an APK and you're done. iOS doesn't work that way. Apple splits the whole chain into three stages, and each one has its own pitfalls:
- Gate one: App Store region. Clients are only listed in certain regional stores, so if your account region is wrong you can't even find them, let alone download them. Region follows your Apple ID billing address, and changing it comes with prerequisites.
- Gate two: configuration profiles. Native IKEv2 / IPSec setups go through a
.mobileconfigprofile; custom protocols like Shadowsocks, VMess, and Trojan can't use the native channel and need a client with a built-in core running over NetworkExtension. The two paths live in completely different places in Settings. - Gate three: subscription import and keep-alive. iOS sandboxing and background policies follow different logic than desktop, so when subscriptions refresh and who reconnects a dropped tunnel have different answers.
Order matters: clear these three gates first, then talk about protocols, routes, and split tunneling. Do it the other way around and you'll usually stall at gate one.
5 iOS Client Types Compared
These are the 5 ways that still work on iOS in 2026. They aren't five brands but five formats — one service may offer two or three of them at once. Here's how they differ:
| Type | How to get it | Subscription import | Background keep-alive | Best for |
|---|---|---|---|---|
| Native client from an international store | Download from the App Store with an Apple ID from the target region | Paste a subscription link or scan a QR code in the app | Managed by the system NetworkExtension; the tunnel survives the lock screen | People who want zero fuss and long-term use |
| General-purpose proxy client | Also needs an account for that region; import a third-party subscription | Supports ss://, vmess://, vless:// and other link formats | Depends on the core's capabilities and whether on-demand rules are registered | People with their own subscription who want to pick nodes manually |
| TestFlight beta | The provider hands out beta slots; install TestFlight to claim one | Import in the app, same as the release build | Same as the release build, but each build expires after 90 days | People who want early features without switching regions |
| Configuration profile (.mobileconfig) | The provider supplies a file; download it in Safari and install | No subscription needed; the config is baked into the file | System-level VPN, easiest on battery, doesn't depend on an app staying alive | People who only use native protocols and don't want an app |
| Self-signed / enterprise-signed install | Sign the ipa yourself, or distribute it with an enterprise certificate | Depends on the client | Crashes the moment the signature expires; you have to re-sign it | Hands-on users who accept the maintenance overhead |
The last two formats come with real costs, so don't stop at 'it installs.' A profile is a global configuration — verify its source before installing. Free signatures on self-signed apps expire after 7 days, and signatures from a paid developer account last 1 year; on the day they expire the app simply won't open until you re-sign it. For daily use, the first or second format is enough.
A profile can carry more than most people expect: Wi-Fi, VPN, proxy settings, and root certificates all live in one file. Never install a .mobileconfig from an unknown source — a profile with a root certificate lets a man-in-the-middle decrypt your HTTPS traffic, while all you see in Settings is an ordinary-looking entry.
App Store Region Switching in Practice
Switching regions isn't just changing a dropdown. Your App Store region is determined by your Apple ID billing address, and you have to deal with your balance and subscriptions before changing it, or the system will refuse outright. Here's the full process:
- Get an Apple ID for the target region. You can register a new one, or move your existing account — moving requires spending or clearing your account balance and cancelling every active subscription.
- In Settings → your name → Media & Purchases, sign out of your current account, sign in with the target-region account, then open the App Store and search for the client.
- Don't sign out of that account right after downloading. When iOS updates an app it checks the account that originally downloaded it; if that account is signed out, the update will ask for the password again.
- After switching back to your original account, previously downloaded clients still work, but updates stall. There are two fixes: update from Purchased with the original account, or uninstall and re-download with the new account.
Switching regions only affects the store and payments — not your system language, iCloud content, or installed apps. Downloaded clients keep running as usual after a region switch, so there's nothing to agonize over.
What If You Don't Want to Switch Regions?
Two alternatives: the TestFlight build, or an install method that doesn't rely on the App Store. The first has a 90-day build expiry, the second a signature expiry, and both need periodic maintenance — pick them if you can live with that, not because they're easier. When choosing a service, ask two things up front: which regional stores list its iOS client, and whether it offers a TestFlight channel.
How to Install and Remove a Profile
A profile (.mobileconfig) is Apple's configuration container for businesses and administrators, but individuals can use it too. There's only one way in: open the file link in Safari, and the system shows "This website is trying to download a configuration profile."
- Open the link from your provider in Safari and tap Allow to download.
- Go to Settings → General → VPN & Device Management → Downloaded Profile, tap Install, and confirm with your passcode.
- Once installed, the VPN configuration appears in the VPN section of the same page — just toggle it there, no app required.
Removal and Troubleshooting
- Removal: Go back to Settings → General → VPN & Device Management, open the profile details, and tap Remove Profile. The matching VPN configuration disappears with it, leaving nothing behind.
- Installed but nothing happens: first check whether the server address in the profile is reachable. Native protocols get blocked on some networks, and a NetworkExtension-based client is more reliable in that case.
- Protocol limits: a profile can't run custom protocols like Shadowsocks, VMess, or Trojan. Those need a client with a built-in core that builds the tunnel through NetworkExtension.
What Shortcuts Can Do for You
iOS Shortcuts can toggle the connection by scenario — turn it on when you join a certain Wi-Fi network, turn it off when you open a certain app. The catch is that the client has to expose Shortcuts actions (App Intents); clients that don't simply can't be automated this way. If yours doesn't, fall back to the on-demand rules built into NetworkExtension: always connect, connect on Wi-Fi only, or exclude specific Wi-Fi networks. On-demand rules are triggered by the system whenever the network changes, which makes them more reliable than any third-party automation.
Subscription Import and Background Keep-Alive
A subscription link is the only credential between client and server. It's usually a base64-encoded blob, or plain text made of several protocol prefixes. Common ones look like this:
ss://[email protected]:8388#HongKong-01
vmess://eyJ2IjoiMiIsInBzIjoi5rWm5rWmIiwiYWRkIjoibm9kZS5leGFtcGxlLmNvbSJ9
vless://[email protected]:443?type=ws&security=tls#Japan-02
trojan://[email protected]:443#Singapore-01
hysteria2://[email protected]:8443#US-01
https://sub.example.com/delta-svc/client/subscribe?token=9f3c1a7e5b2d4c8fThere are three ways to import: paste the link, scan a QR code, or let the clipboard be detected automatically. On iOS the easiest is to copy the link and open the client — most clients read the clipboard and pop up an import prompt. Once imported, the node list is grouped by region, and the client core parses the parameters for each protocol.
Keeping Your Subscription Link Safe
A subscription link is effectively your account key — anyone who has it can burn through your data. Don't post it in group chats, don't commit it to a public config repository, and don't share it as a screenshot. If it leaks, reset the subscription URL in your user panel right away and the old link stops working immediately.
What Actually Affects Background Keep-Alive
- The NetworkExtension tunnel is managed by a system process, so locking the screen or switching apps won't drop it right away, and the system reclaiming the app itself doesn't affect an established connection.
- Low Power Mode tightens background refresh, so automatic subscription updates may be delayed. To keep them on schedule, don't block the client in Background App Refresh.
- Subscription updates usually fire when you open the app. That's normal on iOS, not a sign of a badly built client.
- On-Demand is more practical than any keep-alive trick: the system triggers it whenever the network changes, and the app doesn't need to stay in the background.
Once You're Connected, Run This Checklist
- ✅ Exit IP: after connecting, open any IP lookup page in Safari and confirm it shows the node's region, not your local ISP.
- ✅ DNS leaks: use a DNS leak test page to confirm the resolver isn't your local ISP. The client has to route DNS queries through the tunnel too, or you get the classic leak where the IP changes but DNS doesn't.
- ✅ Subscription status: pull to refresh the subscription manually and check that the node count and route labels look right, ruling out an expired subscription.
- ✅ Protocol support: the client core has to support the protocols in your subscription. sing-box-based clients cover VLESS, Hysteria2, and TUIC well; older clients may only handle Shadowsocks and VMess.
- ❌ Don't install a profile from an unknown source, even if it's 'just' a VPN configuration.
- ❌ Don't forward your subscription link like a share link. The account itself has no device limit — just sign in on multiple devices with the same account and keep the link private.
How Split Tunneling Rules Differ on iOS
On desktop you can split by process; on iOS you can't — per-app routing requires MDM management, which ordinary users don't have. What iOS clients can do is rule-based routing by domain and IP range: connect directly to mainland China domains and proxy the rest, or the reverse, sending only specific domains through the proxy. Rule files usually come from the provider; just pick Rule mode in the client and it takes effect. The upside is that local sites don't take a detour and only cross-border traffic goes through the tunnel — a difference you feel more than switching nodes.
Choosing by Scenario
Here's everything above condensed into a scenario table — find your row:
| Use case | Recommended type | Why |
|---|---|---|
| Commuting video and everyday browsing | Native client from an international store + On-Demand | Survives the lock screen, reconnects automatically on network changes, no manual tapping |
| Cross-border work and video meetings | Native client + IEPL dedicated-line nodes | Dedicated lines skip the public internet, so peak-hour jitter is lower and calls stay steadier |
| You already have your own subscription | General-purpose proxy client | Full protocol coverage and rules you can edit yourself |
| Trying things out without switching regions | TestFlight build | No store region switch needed; mind the 90-day build expiry |
One more word on routes, because on iOS this layer makes the biggest practical difference: direct nodes connect the client straight to an overseas server over the public internet — cheap, but prone to peak-hour congestion and carrier QoS; relay nodes land on a relay inside mainland China before heading abroad, shortening the public segment for middling stability; IEPL dedicated lines run on carrier international private lines that skip the public internet entirely, giving the steadiest latency and packet loss at a higher price. For jitter-sensitive work like video calls, it's worth paying for a dedicated line.
Bottom line: if you just want stable service, go with the native client from an international store — import the subscription, turn on On-Demand, and you're set for the long haul. If you want to tinker with rules yourself, look at a general-purpose proxy client instead.
What it costs: three monthly tiers at ¥9.9 / 60GB, ¥18 / 250GB, and ¥28 / 500GB; data packs at ¥158 / 300GB, ¥358 / 1000GB, and ¥658 / 3000GB that never expire. 60GB is enough for light use; if you watch a lot of HD video, start at 250GB. There's a 14-day no-questions-asked refund, so try it before you commit.
FAQ: Quick Answers
Do I have to pay extra for the client on iPhone?
The client itself is a free download from the App Store; the cost is in the service plan. VPNDM's iOS client shares one account with Windows, macOS, Android, and Linux — no device limit, and no switching back and forth between devices.
What information do I need to sign up?
A username and password are enough — no email address required. That's especially convenient on iOS, where you don't have to hop between browser and client to grab a verification email.
No email address is needed to get started, so there's no 'verification email went to spam' problem either. On the security side, traffic runs through quantum-encrypted tunnels, and browsing activity isn't logged.
Can I use a profile and a client at the same time?
You can, but there's no point. Both build tunnels, and running them together means they fight over routes — speeds fluctuate or some apps can't connect. If you use the client, delete the profile; if you use the profile, don't turn the client on.
It won't connect — what should I check first?
- Check whether the node latency in the client shows a timeout, and try a different node first.
- Turn off Wi-Fi and try again on cellular to see whether the current network is blocking the protocol's port.
- Check that the system time is accurate — TLS handshakes are sensitive to clock drift.
- Re-import the subscription once to rule out an expired or reset subscription URL.
If the system reclaims the app, will the connection drop?
The tunnel is managed by the system, so the app being reclaimed doesn't affect an established connection. What actually interrupts it is a network change or the tighter policies of Low Power Mode — and On-Demand reconnects automatically in both cases.