Any iOS VPN recommendation runs into the same question first: the region of your App Store account. The same client can show up differently under a mainland China, US or Japan account, and once you find it, there are two very different ways to get a subscription onto an iPhone. Below we sort out the clients available under each account state, compare configuration profiles with Shortcuts, and walk through a three-step connection check.
App Store search results are determined by the region your Apple ID belongs to, not by the system language or the network you are currently connected through. Switching the system language to English, or connecting from a network in another region, will not make apps appear in a mainland China account that were never there. To compare mainland China, the US and Japan, start by separating two independent things: the account region and the network you connect through.
Since the mainland China App Store tightened its review of VPN and proxy apps, those clients are essentially no longer searchable there; the US and Japan stores still list the main ones. Switching your account region has its own conditions: you have to clear the account balance, cancel any active subscriptions, and provide a payment method valid in that region. In practice, most people keep a separate Apple ID for another region and sign in with it only to download and update clients.
There is one more iOS-specific constraint: a client has to request Personal VPN permission through the system's NetworkExtension framework, and installation is locked to the App Store — the desktop habit of downloading an installer directly does not apply here. The built-in Settings → General → VPN & Device Management only accepts native protocols such as IKEv2 and IPSec; protocols like Shadowsocks and VMess have to be handled by a third-party client.
How to tell them apart: if Settings shows only the built-in VPN entry and no client name, traffic is running over a native protocol. If a Personal VPN entry named after the client appears, the client is handling the traffic.
The table below lays out the practical differences between the three account regions. Availability shifts as review policy changes, so the search results in your own account's region are the final word.
| App Store account region | Proxy clients | Common import path | Things to watch |
|---|---|---|---|
| Mainland China | The mainstream clients are largely unavailable | Configuration profile (native protocols only) | The account region has to be switched as a whole; you cannot change just the store region |
| United States | Shadowrocket, Quantumult X, Stash, Loon, sing-box and others are available | Subscription link + Shortcuts | Paid apps are priced in US dollars and charged to your account balance or saved payment method |
| Japan | Most comparable clients are available | Subscription link + Shortcuts | Priced in Japanese yen; the amount charged is whatever appears on your statement |
The client itself is only a container: it parses the nodes in your subscription into individual routes and sets up a local proxy on the system. What actually decides whether you can connect is the subscription content, not the client's name. So the order should be: confirm which protocols the subscription provides, then pick a client that supports them.
Free and paid clients differ in three main ways: protocol coverage, how editable the routing rules are, and whether traffic can be routed per app. If you only connect through one or two routes, a free client is enough; if you need fine-grained routing, or switch between many nodes, a paid client's rule editor saves a lot of work. This comparison sticks to the import flow, protocol support and connection checks, and lists no speed figures — the same node varies too much across carriers and times of day for a single speed test to be worth comparing.
There are two ways to get a subscription onto an iPhone, and they do not solve the same problem: a configuration profile hands the configuration to the system, while a Shortcut hands the subscription to the client.
A configuration profile is a .mobileconfig file. After downloading it you install it manually under Settings → General → VPN & Device Management, and iOS warns that the source is unverified. The upside is that the configuration takes effect at the system level, so you can toggle it straight from the lock screen or Settings. The trade-off is that it only carries native protocols such as IKEv2 and IPSec — Shadowsocks, VMess and Trojan cannot ride on it. And once the server configuration changes, the profile has to be downloaded and installed again; it cannot be refreshed in one tap the way a subscription can.
A Shortcut (or the client's own URL scheme) does something different: it passes the subscription link to an already-installed client, which then fetches the node list. The client has to be installed on the device first. The advantage is that updating the subscription is just a matter of running the Shortcut again, or pulling to refresh inside the client. The usual approach is to Base64- or URL-encode the subscription link and append it to the scheme.
# Subscription import paths at a glance (exact schemes vary by client — check its docs)
In the client: paste the subscription link → save → update subscription
Shortcuts: client scheme + Base64-encoded subscription link
Configuration profile: .mobileconfig → Settings → General → VPN & Device Management → InstallThe table below compares the three paths.
| Import path | Protocols supported | How subscriptions update | Best for |
|---|---|---|---|
| Configuration profile (.mobileconfig) | Native to iOS: IKEv2 / IPSec | Re-download and reinstall when the config changes | Native protocols only; you prefer toggling in Settings |
| Shortcuts / URL scheme | Built into the client: Shadowsocks / VMess / VLESS / Trojan / Hysteria2 / TUIC | Run it again to pull the latest nodes | Client already installed; nodes rotate regularly |
| Manual paste in the client | Same as above | Pull to refresh in the client | A single device, with no extra Shortcut to maintain |
A subscription link is as good as an account credential. Writing it into a Shortcut and sharing that Shortcut is the same as lending out your routes; screenshots, clipboard history and chat logs are all common leak paths. When you update a subscription, use the paste field inside the client rather than a public short link.
The same subscription link does not expose the same protocols in every client. Below are the protocol families you will meet on iOS, and the problems that come up in practice.
Differences between iOS clients cluster around the newer QUIC-based protocols. Shadowrocket, Stash, Loon and sing-box have fairly complete coverage; which protocols Quantumult X supports depends on the version, so check the subscription page in the client to see whether each protocol was recognised before importing. If a node shows as unsupported, it usually is not a broken node — the client simply has not implemented that protocol yet.
Route type also shapes the experience, though it has nothing to do with the client. A direct route connects straight to an overseas server over the public international gateway, which congests easily at peak hours. A relay route connects first to a domestic entry point, which then carries the traffic out over an optimised path. IEPL is a point-to-point international Ethernet private line that does not traverse the public international gateway, giving steadier latency and packet loss at a higher cost. The route type shown on the subscription page sets the floor for how that route performs at peak hours.
Connected but pages will not load — that is the most common failure mode. The three steps below will usually pin down which link in the chain is at fault.
Once the client is settled, what remains is checking the service side. Look at three things in order: the protocols your client supports, the regions and routes the subscription covers, and the cost of getting it wrong.
The regions covered determine whether you can get an exit IP in the country you need; the number of routes determines whether you have a fallback at peak hours; the refund window determines the cost of trying it out; and the device count determines whether one subscription can cover mobile and desktop at the same time. Signing up takes only a username and password — no email address, and no need to set up a separate mailbox for it.
Conclusion: on iOS the first hurdle is your account region, and the second is the import path. A mainland China Apple ID will not get you a proxy client, so keep a separate US or Japan Apple ID on hand. For importing a subscription, prefer pasting inside the client or using a Shortcut; a configuration profile only pays off if you know you will stick to native protocols. Pick a client that supports the protocols in your subscription — there is no need to chase the one with the longest feature list.