How to set up a VPN on iPhone and iPad

Setting up a VPN on an iPhone takes about a minute, and then there are three settings that decide whether it is actually useful. The install is the easy part; the difference between a VPN you remember to turn on and one that is simply always there is entirely in the second half.

Install and connect

1. Install the provider's app from the App Store.
2. Open it and sign in, or skip where the provider allows anonymous use.
3. Tap connect. iOS shows a system prompt asking to add VPN configurations, authenticated with Face ID, Touch ID or your passcode.
4. Approve it. This happens once per app.
5. Pick a server.

The VPN badge appears in the status bar when a tunnel is up. It is drawn by the system, not by the app, so it is trustworthy in a way an in-app indicator is not.

Why the built-in client is not enough

Settings, General, VPN & Device Management lets you add a VPN by hand, and it supports IKEv2, IPsec and L2TP. Those are the protocols iOS itself implements. WireGuard and OpenVPN are third-party protocols delivered through the Network Extension framework, which means an app has to be installed for them to exist at all.

If a provider gives you a .mobileconfig profile rather than an app, it is an IKEv2 configuration. That works, and it is a reasonable fallback, but it gives up the server picker and the reconnection logic an app provides.

On-demand rules, the setting worth finding

iOS supports rules that bring the tunnel up automatically based on the network. The framework calls them on-demand rules, and a well-built client exposes them as a switch labelled something like "connect on untrusted networks".

Set it to connect on any Wi-Fi except your home and office SSIDs, and to connect on mobile data if you want the tunnel always up. From then on the phone joins a café network and is already tunnelled before you have unlocked it.

This is the single setting that changes a VPN from a thing you use to a thing that protects you.

What iOS does not have

• No kill switch of its own. Apps implement one by refusing to pass traffic when the tunnel is down, and by using an on-demand rule that keeps trying, but there is no system switch equivalent to Android's "block connections without VPN". A brief window on wake or on network change is unavoidable.
• No per-app tunnelling on personal devices. Per-app VPN exists on iOS but is a managed-device feature, configured by an MDM server. On a personal phone, the tunnel is all-or-nothing.
• No sideloading. If a provider has no App Store presence in your region, there is no second route.

iCloud Private Relay conflicts

If Private Relay is on, Safari's traffic is already going through Apple's two-hop relay. A VPN takes precedence — Private Relay switches itself off while a VPN is active — but the state in Settings can be confusing, showing Private Relay as enabled and inactive at the same time. That is expected, not a fault.

DNS on iOS

iOS follows the tunnel's resolver while connected, which is the correct behaviour. Two things override it: a DNS profile installed by another app, under Settings, General, VPN & Device Management, and iCloud Private Relay in the case above.

Run the DNS leak test if you want to confirm rather than assume. Safari is the right browser to test in, because Chrome and Firefox on iOS may use their own encrypted DNS.

Battery

A VPN on iOS costs battery, and the honest range is a few percent a day for a modern chip with an efficient protocol. WireGuard costs less than OpenVPN because it wakes the radio less and does less work per packet. What costs noticeably more is a client that reconnects repeatedly on a marginal signal, so a tunnel that seems to halve your battery life is usually a reconnection loop rather than encryption overhead.

Confirm it works

Open what is my IP in Safari. The address and country should match the server you picked. Do this from mobile data as well as Wi-Fi if you have set on-demand rules, because a rule that names Wi-Fi networks does nothing on a cellular connection and the status bar badge looks identical either way.