To set up a VPN on iPhone, install a compatible client, import the subscription from your account, allow the system to add a VPN configuration, then choose a route and test access. The VPN switch in Settings is only a connection control; it does not provide routes by itself. Before you start, understand how the client, subscription, and system configuration work together.
Before you start: clients, subscriptions, and accounts
The client reads configuration, applies routing rules, and connects to the network. A subscription link retrieves route settings, while the system VPN configuration lets the client handle the relevant network traffic. These serve different purposes and cannot replace one another. Installing a client without adding routes—or simply turning on the switch in Settings—does not complete setup.
OEMVPN does not require an email address; sign in with a username and password. Get your subscription after signing in to the dashboard. Access to the iOS client download requires an active plan. Check the client download requirements separately from App Store availability, and don’t assume that download instructions on a website mean the app is already installed.
| Item or access point | Purpose | Notes |
|---|---|---|
| Username and password | Sign in to the service dashboard and manage your plan and subscription | Separate from your App Store account, and may differ from your node authentication details |
| Subscription link | Lets the client retrieve routes and related settings | Contains access credentials; keep it private |
| Node address | Identifies the connection endpoint for a specific route | An address by itself is usually not enough to configure the connection |
| System VPN configuration | Authorizes the client to establish a system-level network connection | Approve configuration requests only from clients you have verified |
Getting a client: check its source and compatibility
Check the iOS installation instructions at the client download page in the dashboard, then follow the steps provided. If you can’t find the app in the App Store, check its name and publisher, your account’s country or region, and the system requirements. Don’t look for alternative installers in search ads or files sent by strangers, and never use someone else’s shared account credentials.
Similar client names don’t mean they support the same configurations. Shadowsocks, VMess, Trojan, and VLESS are different proxy protocols; Hysteria2 and TUIC have their own transport and implementation requirements. Supporting a protocol does not guarantee support for every transport combination or subscription format. These names are included to explain compatibility and do not mean OEMVPN offers every one of them.
Follow the client and import method currently recommended in the dashboard. iOS and desktop operating systems differ in their menus, network handling, and background behavior, so Windows system proxy instructions won’t necessarily apply. Manually entering an address on the VPN page in Settings is not a general way to import these proxy subscriptions.
Import a subscription: check each step
Once the client is ready, make sure your iPhone has a working internet connection. Updating a subscription requires access to the subscription server; if the local network requires authentication, the client may not be able to retrieve its configuration. Depending on the client, the relevant menu may be called “Subscriptions,” “Configuration,” or “Profiles.” The steps below describe what to do, not specific button names.
- Sign in to the dashboard. Open subscription management, check your plan status, and find the import option or subscription link for your client.
- Use the matching import method. If the dashboard offers one-tap import, check which app will open. To import manually, paste the complete link into the subscription section of the client.
- Save and update. Wait for the client to retrieve the configuration, then check that a list of routes appears—not just an empty subscription name.
- Select a configuration and route. Some clients require you to activate a profile first, then choose a node in a policy group. Saving successfully does not mean that configuration is currently in use.
- Check for update errors. If you see a format error, authentication failure, or empty list, return to the dashboard and get the correct format. Don’t change link parameters at random.
A subscription link may contain a token that identifies your account. When copying it, make sure you include the final characters. Don’t mistake a webpage URL or plan page URL for a subscription link. If a client expects a configuration file but you paste a single node’s share link, it may not be able to read it.
Treat your subscription link like a password. Don’t post it in public chats or submit it to unfamiliar online conversion sites. If you need help from support, hide the full link, token, and account details first.
System approval: add a configuration, then connect
The first time you connect, the client will usually ask to add a VPN configuration. Make sure the request comes from the app you just installed, then approve it as prompted and complete device verification. This authorizes a network configuration; it does not give a webpage unrestricted access to your device, and it does not guarantee that the connection will work.
If you denied the request, return to the client and try connecting again, then follow the prompts to approve it. You can also search for “VPN” in Settings and check existing configurations; menu locations vary by iOS version. Don’t delete a configuration managed by your workplace just because the connection failed. If the device is managed, ask your administrator first.
Other VPNs, network filters, or security apps may compete for control of the network. To troubleshoot, first stop other connections that actively handle network traffic, then test the current client. A VPN indicator only shows that the system’s connection status has changed; it doesn’t prove that a particular website is reachable.
Routing rules and DNS checks
Rule-based routing uses domains, addresses, or other rules to choose between a direct connection and a proxy, which works well for everyday mixed use. Global proxy mode generally sends more traffic through the selected proxy policy, but behavior still depends on the client, system restrictions, and configuration exceptions. “Global” does not mean every bit of traffic on the device must use the same exit route.
If you’re new to this, start with the default rules provided with your dashboard configuration, then adjust them to address a specific issue. Avoid changing routing, DNS, and nodes all at once, or it will be hard to tell what fixed the problem. If a rule sends the site you want to access directly, temporarily test it with a proxy policy. Once confirmed, fix the rule rather than relying on global mode to mask the configuration issue.
DNS translates domain names into addresses. A DNS leak generally means that DNS requests aren’t taking the expected route and are instead going to the local network or another DNS resolver. Client DNS settings, encrypted DNS in the browser, system profiles, and routing rules can all affect the result. A connected VPN does not guarantee that DNS requests are following the expected path.
Use a trusted DNS test to see which resolvers are handling your requests, then compare the results with your configuration. A difference between the resolver’s location and your exit location does not, by itself, prove a leak; public DNS services may use distributed servers. Don’t install an unfamiliar root certificate or disable website certificate checks just to clear a warning on a test page.
Connection check: test access, not just the icon
After connecting for the first time, open a familiar website to confirm that basic internet access works, then try the site you actually need. Comparing your exit IP before and after connecting can help confirm whether it changed. In rule-based mode, a test site may be routed directly, so interpret the result in light of which rule applies to that site.
- ✅ The client has loaded a valid configuration, the route list is visible, and a route is selected.
- ✅ The system has approved the VPN configuration, and the client is not showing persistent authentication or configuration errors.
- ✅ The site you need opens, and key actions such as signing in and loading content work.
- ✅ Check the connection again after switching between Wi-Fi and cellular data to make sure the network change hasn’t interrupted it.
- ❌ Don’t treat a successful route latency test as proof that every app will work, or rely on the status bar icon alone.
A website may load while a particular app doesn’t, due to app cache, account region, platform access policies, or an issue with the service itself. Switching routes is a troubleshooting step, not a guarantee that platform eligibility restrictions will change. Keep other conditions consistent while testing, and note whether the failure is with the website, sign-in, or content playback.
Common issues: troubleshoot from the local network outward
Subscription update fails or no nodes appear
Disconnect first and check that the local network has internet access; public Wi-Fi may require you to complete a web-based sign-in. Then check the subscription format, make sure the link is complete, confirm your account status, and try updating manually. If the update fails on only one network, test another network instead of reinstalling every app right away.
Shows connected, but no websites will load
Disconnect and check whether regular websites load. If they still don’t, troubleshoot the local network first. If they work again, check the selected route, DNS, routing rules, and other VPN configurations. Change one thing at a time and keep the original configuration so you can revert if needed.
Works at first, then stops after switching networks
Switching between Wi-Fi and cellular data changes the network path, and the client may need to reconnect. Try disconnecting and reconnecting to see if that helps. If it keeps happening, give support your client version, system version, network type, and a redacted error message. Don’t send the full configuration file.
In short: Setting up a VPN on iPhone is about matching the client, subscription format, system authorization, and routing configuration—not just finding a VPN switch. First, use the default configuration to establish a connection you can verify, then adjust one setting at a time. Troubleshooting outward from the local network makes the cause easier to find than repeatedly reinstalling the app.
For everyday use, update the client and subscription through trusted channels, and keep your account credentials secure. OEMVPN follows a no-logs policy, but privacy policies are no substitute for securing your device. For help finding the right place to start, see the getting started guide. If you’re still having connection issues, contact us with redacted diagnostic details.