How to Set Up a VPN on an iPhone (iOS): The Complete Step-by-Step Guide

Setting up a VPN on an iPhone takes about two minutes: install a provider's app from the App Store, sign in, and tap Connect — iOS creates the VPN configuration for you automatically. You can also add one manually under Settings > General > VPN & Device Management, but the app route is faster and unlocks features like on-demand connection and per-network rules.

The two ways iOS handles a VPN

Before you tap anything, it helps to understand that iPhones support VPNs in two distinct ways, and the choice shapes how much control you get. Almost everyone should use the first method — a provider's app — but knowing why the second exists prevents a lot of confusion when a settings menu asks you to enter a server address and shared secret.

Method 1: the provider app (recommended)

When you download a VPN app, it registers a VPN configuration with iOS on your behalf. You never touch server addresses or encryption keys — the app handles all of it and simply asks iOS for permission to add a VPN profile the first time you connect. This is how the overwhelming majority of iPhone users should set things up, and it's what most top VPN services are built around.

Method 2: the built-in iOS VPN settings (manual)

iOS also ships with a native VPN client that speaks IKEv2, IPsec, and L2TP. You configure it by hand under Settings, typing in a server, remote ID, username and password (or certificate). This is aimed at people connecting to a corporate network or a self-hosted server — not at consumers using a commercial provider, whose modern WireGuard-style protocols the built-in client can't run anyway.

A quick note on what a VPN can and can't do on iPhone

It's worth setting expectations before you rely on one. A VPN encrypts your traffic and masks your IP address, which genuinely helps on public Wi-Fi and when you want your iPhone to appear elsewhere. It does not make you anonymous, block every tracker, or stop you from logging into an account that already knows who you are — so treat it as one layer of your privacy setup, not the whole thing.

Apple's own iCloud Private Relay, if you use it, overlaps with a VPN for Safari browsing but isn't a substitute — it only covers Safari, doesn't touch other apps, and won't let you pick a country. When you turn a full VPN on, it's normal for Private Relay to pause; the two aren't designed to route the same traffic at once, and running both can cause connection conflicts.

Installing and connecting from the App Store

For nearly everyone, this is the whole job. Pick a provider, install its app, sign in, and approve one permission prompt. iOS quietly writes the VPN configuration into your device profile so it shows up in Settings afterward, but you'll rarely need to look there again. Here's the full sequence.

1. 1Open the App Store and search for your provider's name, then tap Get to install its official app. Check the developer name matches the company to avoid copycats.
2. 2Launch the app and sign in with the account you created on the provider's website (or start a subscription in-app).
3. 3Tap the main Connect button. The first time, iOS shows a dialog reading "[App] Would Like to Add VPN Configurations." Tap Allow and authenticate with Face ID, Touch ID, or your passcode.
4. 4The VPN status turns on — you'll see a small VPN badge in the status bar at the top of the screen. You're now routing traffic through the encrypted tunnel.
5. 5To choose a country, open the app's server list and pick a location before connecting. To disconnect, tap the same button again.

That VPN badge in the status bar is your at-a-glance confirmation. If you ever want proof the tunnel is actually protecting you rather than leaking your real location, run a quick DNS leak test and a WebRTC leak test after connecting — both are common ways an apparently-connected VPN still exposes your identity.

Setting up a VPN manually in iOS settings

If you're connecting to a work network, a home server, or a provider that hands you manual IKEv2 credentials, you can skip the app entirely. Gather the connection details first — server address, remote ID, and either a username/password or a certificate file — because iOS won't let you save an incomplete profile. Then follow these steps.

1. 1Open Settings > General > VPN & Device Management > VPN (on older iOS versions it's Settings > General > VPN).
2. 2Tap Add VPN Configuration.
3. 3Choose the Type — IKEv2 is the modern default; IPsec and L2TP are legacy options you'd only pick if told to.
4. 4Fill in Description (any label), Server, and Remote ID exactly as provided.
5. 5Enter your authentication: either a Username and Password, or select a certificate you've already installed via a configuration profile.
6. 6Tap Done, then flip the Status toggle to connect.

One caveat worth stating plainly: the built-in client cannot run WireGuard or a provider's proprietary protocol. If your service is WireGuard-based (many now are, for speed), the manual route simply won't work and you must use its app. This is one reason we generally steer readers toward the app method in our main VPN buyer's guide.

Which VPN protocol should you pick on an iPhone

If your provider's app lets you choose a protocol — most do, buried in settings — the decision matters more on a phone than on a laptop, because iPhones constantly hop between Wi-Fi and cellular and go in and out of sleep. The right choice keeps the tunnel stable and spares your battery; the wrong one causes exactly the drops covered later in this guide.

• WireGuard (often under a provider's own brand name) is the modern default. It's lean, reconnects quickly, and is gentle on the battery because it wakes the CPU less than older protocols — a real advantage on a device you carry all day.
• IKEv2 is the strongest native fallback. It was practically built for mobile: thanks to a feature called MOBIKE, it re-establishes the tunnel almost instantly when your iPhone switches from Wi-Fi to cellular, which is why it's the protocol the built-in iOS client leans on.
• IPsec and L2TP are the legacy options. They still work and are occasionally required by a corporate or self-hosted server, but for consumer use they're slower and offer no advantage over the two above.

The practical rule: leave the app on WireGuard, and only switch to IKEv2 if a particular network keeps blocking or throttling the connection. If both fail on the same network, the network — not your VPN — is usually filtering VPN traffic, and a protocol with obfuscation or a different port may be the only way through. You can gauge how much a protocol costs you in speed with our VPN speed tests.

Connect On Demand and always-on: never forget to turn it on

The biggest weakness of any VPN is human memory — a tunnel you forgot to switch on protects nothing. iOS solves this with Connect On Demand, a rule-based feature that fires the VPN automatically under conditions you set, such as joining any Wi-Fi network you don't trust. It's the closest thing consumers get to always-on protection.

To reach it, open Settings > General > VPN & Device Management > VPN, tap the blue info (i) icon next to your configuration, and toggle Connect On Demand. Most provider apps expose the same capability under their own labels, and turning it on there is easier than hand-writing rules. Common triggers include:

• Auto-connect on untrusted Wi-Fi — the single most useful rule for anyone who uses coffee-shop, airport, or hotel networks.
• Auto-connect on cellular data, so mobile browsing is covered too.
• A trusted-network exception that lets the VPN stand down on your home Wi-Fi, where you may not want it.
• Auto-connect when specific apps launch, on providers that expose per-app triggers.

True always-on VPN — the kind that blocks all traffic until the tunnel is up and cannot be switched off by the user — is a separate, stricter mode. On iPhones it requires the device to be supervised through Mobile Device Management, so it's really an enterprise and school feature rather than a toggle in a consumer app. For personal use, a well-configured On Demand rule plus a kill switch (offered inside most provider apps) gets you close to the same guarantee.

Per-app and split-tunneling options on iOS

A frequent question is whether you can route only some apps through the VPN — say, a streaming app abroad while your banking app stays on your real connection. The honest answer is that iOS is stricter here than Android, and what's possible depends heavily on whether you go through an app or a management profile.

• Consumer provider apps on a standard iPhone generally offer all-or-nothing tunneling: everything goes through the VPN, or nothing does. Some now add limited app-based rules, but support is uneven — check the specific app.
• Per-app VPN as a formal iOS feature exists, but it's designed for managed devices: an MDM profile assigns individual apps to a VPN tunnel. That's how companies route only their work apps.
• If you need to exempt one app, the practical workaround is toggling the VPN off briefly, or using a provider that offers its own split-tunnel implementation for iOS.

Using an iPhone VPN while traveling or streaming

One of the most popular reasons people set up a VPN on their phone is to keep their normal apps working while abroad. Streaming services and some banking and news apps check your location, and a VPN lets your iPhone appear to be back home. This is a legitimate section of the how-to, not the whole story — it's one use among privacy, public-Wi-Fi safety, and more.

If that's your goal, connect to a server in your home country before opening the app, and pick a provider with reliable mobile performance — a slow tunnel makes video buffer. Our guides to the best VPNs for streaming and specific services like Netflix, HBO Max, and BBC iPlayer cover which servers actually work. You can also check whether a specific show is available in your region before you travel, and sports fans heading abroad should read our sports streaming coverage.

Troubleshooting: disconnects and the "no internet" problem

Two issues dominate iPhone VPN support tickets: a tunnel that keeps dropping, and a connection that says it's active but shows no internet at all. Both are usually fixable in minutes, and they share a short list of causes — a stale profile, iOS power-saving throttling background processes, or a protocol that your current network dislikes. Work through the fixes in order.

When the VPN keeps disconnecting

1. 1Turn off Low Power Mode (Settings > Battery). It throttles the background activity a VPN needs to hold the tunnel open — a leading cause of random drops.
2. 2Allow the VPN app unrestricted Background App Refresh and mobile data in its settings.
3. 3Switch protocol inside the app — try WireGuard, then IKEv2 — since some networks throttle or block specific ones.
4. 4Test on both Wi-Fi and cellular to isolate whether one network is the problem rather than the VPN.
5. 5Update iOS and the app; connection-stability bugs are common and frequently patched.

When it connects but there's no internet

1. 1Disconnect and reconnect to a different server — the one you're on may be overloaded or down.
2. 2Delete the VPN configuration under Settings > General > VPN & Device Management, restart the iPhone, then reinstall it (or re-add it from the app). Corrupt profiles are the classic cause of a "connected but dead" tunnel.
3. 3Reset network settings via Settings > General > Transfer or Reset iPhone > Reset > Reset Network Settings. This clears Wi-Fi passwords, so have them handy.
4. 4Temporarily disable any DNS or content-blocking features in the app, which can silently break name resolution.
5. 5If nothing works, the underlying internet connection — not the VPN — may be the real culprit; confirm you have data with the VPN off.

If drops persist even after all of this, the provider itself may simply be slow or unstable on mobile. It's worth comparing raw performance — our VPN speed tests and the live VPN price index help you judge whether you're paying for a service that underdelivers on iPhone. Privacy-focused readers should also review our VPN privacy guide before committing.

Beyond the iPhone: covering your other devices

Once your iPhone is set up, the natural next step is extending the same account to everything else you own. A single subscription usually covers multiple devices, and some setups protect gadgets that can't run a VPN app at all. A few directions worth exploring depending on your household.

• Install the VPN at the router level so every device on your network — including ones with no app support — is covered automatically; see our best VPN routers guide.
• For the living room, an Android TV VPN app handles streaming on the big screen.
• If cost is the concern, weigh the trade-offs first in our free VPN breakdown before assuming free is good enough for iPhone.

Whichever way you go, the iPhone setup you just completed is the template: install, allow one permission, and let Connect On Demand keep it running. From there it's about picking a provider fast and stable enough that you forget the VPN is even there — which is exactly how a well-chosen one should feel.