Guide
How to set up a VPN on iPhone and iPad
The app from the App Store, the configuration prompt and where it lands, the on-demand setting that makes the tunnel survive a restart, and the one honest thing to know about a kill switch on an iPhone. Written against iOS 27.
Before you start
This guide does not pick one for you
Every step below is the same whichever provider you use, which is why none is named here. Choosing is a separate job and it is done on the register, where the choice is made against a published score rather than against a store listing.
Install the app from the App Store, from the listing the provider’s own site links to. The store is full of VPN apps with the right word in the name and no company behind them; the link from the account you pay for goes to the one you paid for.
Install the app
- Sign in on the provider’s website first and follow its link to the App Store. If you bought the subscription through the store itself, the same rule holds: open the listing from the provider’s site, not from a search.
- Open the app, sign in, and accept the configuration prompt. iOS asks once whether the app may add a VPN configuration and asks for your passcode or Face ID. That is the system installing the tunnel profile; it lands in Settings › General › VPN & Device Management, and an app without one cannot connect.
- Name the device something that is not you. Most apps ask for a device name at this point; it is stored by the provider.
- Do not connect yet. The setting that makes the tunnel survive a restart is off by default in most apps, and connecting before you set it is how the tunnel quietly disappears the first time the phone reboots overnight.
The settings worth checking
App menus differ, the settings do not. Every one has an entry in the glossary if the name is unfamiliar.
Connect On Demand
The single setting that matters most on iOS. Without it the app connects when you tap and the tunnel lives as long as iOS lets the app live, which in the background is not long. With it, iOS itself owns the tunnel: it is brought up when the phone has a network, restored after a restart, and reconnected after sleep, whether or not the app is running.
In the app it is called On Demand, auto-connect or always-on; in Settings › General › VPN & Device Management, the profile’s page shows the same switch as Connect On Demand. Turn it on in the app rather than in Settings, so that the app’s own rules — which networks, which exceptions — are the ones iOS applies.
The kill switch, and what it is on an iPhone
iOS has no system-level switch of the kind Android has. What the app calls a kill switch is the app asking iOS to drop traffic while the tunnel is down, and it holds only as long as the configuration is active. Between a reboot and the app’s first connection, and when a profile is turned off by hand, there is no switch at all. Turn it on; it covers the common case, a tunnel that drops while you are using the phone. Just do not count it as more than that. What the switch is for is on its own page.
DNS inside the tunnel
Name lookups can leave the phone outside the tunnel even when everything else is inside it, which tells the network which sites you visited and hides only what you did there. Look in the app for DNS leak protection, use provider DNS or a custom DNS field, and set it to the provider’s own resolver rather than a third party’s: a second party who sees only the lookups is one more party. How a leak happens is on the DNS leaks page.
iOS has its own encrypted-DNS profiles, installed by some DNS apps. One of those and the VPN’s DNS setting can fight; keep the provider’s and remove the other.
iCloud Private Relay
Private Relay sends Safari’s traffic through Apple’s relays. With a VPN on, the two stack, and the result is slower pages and the occasional site that loads through neither. Turn Private Relay off in Settings › your name › iCloud while you use the VPN. The tunnel already does what Private Relay did for Safari, for every app.
The protocol
Leave it on the modern default — the protocol page lists which are current and which are legacy. If the app offers an older option to fix a connection problem, that is a trade to make knowingly and then undo: the register marks the weakest protocol a provider still offers, and selecting it by hand is choosing that mark for yourself.
Confirm it is actually working
Connect, then check rather than assume. Three checks, in this order, all of them free and none of them needing another app:
- Your address changed. Open any “what is my IP” page in Safari and confirm the country matches the exit you chose. Repeat once on Wi-Fi and once on mobile data.
- Lookups are inside the tunnel. Run a DNS leak test and read the resolvers it reports. Anything belonging to your carrier or your home internet provider means the DNS setting above did not take.
- The tunnel comes back on its own. Restart the phone and unlock it without opening the app. The VPN badge should return to the status bar by itself within a few seconds of the network. If it does not, Connect On Demand is off.
The kill switch is harder to test on iOS than elsewhere, because iOS does not let you kill the tunnel from underneath the app the way a desktop does; the kill-switch guide has the one method that works. The longer battery of tests is its own guide.
What those checks prove
+Your traffic is leaving through the exit server, in the country you selected
+Neither the carrier nor the Wi-Fi you are on can read which sites you reach
+iOS brings the tunnel back after a restart without you or the app doing anything
What they do not
−They say nothing about what the provider keeps — that is a documents question, answered on the retention pages
−They do not make you anonymous: the accounts signed in on the phone are still signed in, see what a VPN does not protect you from
−A passing test today is not a promise about the next app update or the next iOS update
Which networks, and which not
Most apps let On Demand follow a list: connect on every network, connect on mobile data and unknown Wi-Fi, or stay off on named networks you trust. The last option is the one to be careful with. A home network is trusted because you run it, not because it is private; the internet provider behind it still sees every lookup you make outside the tunnel. The defensible exception is a network where the VPN breaks something you need — a printer, a cast to the television — and in that case the trusted-network rule is a workaround for one device, not a judgement about safety. What a public network can see without the tunnel is on the public Wi-Fi page.
Whatever the list says, keep connect on mobile data on. The carrier is the one network you cannot choose.
When it does not work
The VPN turns itself off when I lock the phone
iOS suspends apps in the background, and a tunnel the app has to keep alive by itself dies with it. Connect On Demand is the fix: once it is on, iOS owns the tunnel and brings it back the moment the phone wakes, without the app being running.
If On Demand is on and the tunnel still vanishes after sleep, Low Power Mode or a very old device is the usual reason. The first is a setting; the second is not.
Safari is slow or some sites will not load while connected
Check iCloud Private Relay in Settings > your name > iCloud. Private Relay routes Safari through Apple's relays, and a VPN routes everything through the provider; the two stacked on top of each other add latency and sometimes break one of the hops.
Turn Private Relay off while the VPN is on. You lose nothing: the tunnel already hides Safari's traffic from the network, which is what Private Relay was for.
The app says connected but a site shows my real location
A site's idea of where you are is not only your address. Location Services, a logged-in account and a language setting all say where you are, and the VPN changes none of them. Check the address itself on a “what is my IP” page; if it shows the exit country, the tunnel is fine.
If it shows your own country while the app says connected, the configuration profile was not installed. Settings > General > VPN & Device Management should list it; if it is missing, reinstall the app and accept the prompt.
The connection drops every few minutes on one Wi-Fi
Hotel and captive-portal networks interrupt long-lived connections, and some block the port a protocol uses. Switching protocol in the app is the first test, since the modern one uses a different transport and often survives what the older one does not.
If no protocol holds on that network and every one holds elsewhere, the network is blocking VPN traffic. That is a fact about the network, and this guide stops there.
Same steps, other machines
The rest of the platforms
Every platform has a guide of its own rather than a tab on this one. The steps diverge as soon as the installer opens, and a page that answers three platforms at once answers none of them properly.