How to set up a VPN on iPhone

On iOS an app cannot quietly become your network. Tunnelling is handled by a system framework, and the first time an app wants to use it the operating system shows a sheet titled along the lines of "WrapVPN Would Like to Add VPN Configurations", then asks for your passcode, Face ID or Touch ID to confirm. Allowing it writes one configuration entry owned by that app. Nothing else on the phone gains access to your traffic, and no certificate or configuration profile needs to be downloaded by hand the way older corporate setups required.

You see the prompt once per install, not once per connection. After that, tapping connect brings the tunnel up with no system sheet at all. If you ever see the prompt a second time without having reinstalled anything, the configuration was removed in Settings in the meantime, which is worth knowing because it is also how you reset a setup that has gone strange.

Once approved, the entry sits in Settings > General > VPN & Device Management > VPN. That screen lists every VPN configuration on the phone, shows which one is selected, and has its own status toggle. The toggle is a convenience, not a second product: flipping it on there brings up the same tunnel the app would, and flipping it off tears it down whether or not the app is open.

While a tunnel is up, iOS puts a small VPN badge in the status bar. On models with a notch or Dynamic Island it may only be visible when you pull down Control Centre or the notification shade, which catches people out: the badge not being on screen does not mean you are disconnected. The app's own connection state and the toggle in Settings are the two places that always agree.

A tunnel costs very little by itself, because the radio your iPhone uses for the connection is already on and already sending the same packets. What does cost battery is a connection that keeps dropping and re-establishing, which is why the thing to look at when a phone gets warm is reconnection behaviour rather than the tunnel as such.

Low Power Mode is the usual culprit. It throttles background activity, which can mean the tunnel is slower to come back after the phone has been asleep in your pocket, or after a switch between Wi-Fi and cellular on the way out of the house. Nothing is broken; the first request after you wake the phone simply has to wait for the handshake to finish. If instant reconnection matters more than the last few percent of battery, turn Low Power Mode off while you need it and the pause disappears.

The first is a sign-in page that was never accepted. Hotel, cafe, airport and campus networks hold new devices behind a captive portal, and until you have completed it the network forwards nothing except that page. A VPN cannot negotiate through it, because there is nowhere for the handshake to go. The symptom is distinctive: the Wi-Fi symbol looks perfectly normal, the app sits on connecting, and nothing loads. The fix is to disconnect, open any ordinary website so the portal appears, accept it, confirm a normal page loads, then connect again.

The second is a stale configuration left by a previous install. iOS keeps VPN configurations even when the app that created them is deleted, so a phone can carry an orphaned entry for an app that no longer exists, sometimes with an on-demand rule still set to bring it up automatically. Two configurations each trying to own the route is a reliable way to get a connection that fails for no visible reason. Open Settings > General > VPN & Device Management > VPN, read the list, and delete anything you do not currently use.

Deleting the app is not the same as removing the VPN. Because the configuration is a system object rather than part of the app bundle, dragging the icon away can leave the entry behind in Settings. Most people never notice, until a VPN badge appears in the status bar on a phone with no VPN app installed on it, which is exactly the orphaned entry described above doing what it was last told to do.

Removing it is one extra step and worth doing in this order: disconnect in the app, go to Settings > General > VPN & Device Management > VPN, tap the information icon next to the entry and choose to delete the configuration, then delete the app. Do that and the phone is genuinely back to how it was. Deleting the configuration does not delete your account, so reinstalling later means signing in and approving the prompt again, nothing more.

One account covers your other Apple hardware, and the Mac half of that surprises people: there is no separate Mac app to go looking for. WrapVPN ships as an iPad build, which Apple Silicon Macs can install from the same App Store listing as the iPhone app, so searching the Mac App Store for a distinct Mac version is a dead end. Install that same listing, sign in with the same credentials, and there is nothing to buy again. The exception worth knowing is Intel Macs, which cannot run iPad builds at all. Each device then asks for its own configuration approval, because that permission is granted per device, so expect the prompt once more on each. Android comes from Google Play, and the Windows build is in review.

This is also the point where the cost model matters more than the setup, because what you are billed for is the account rather than the device. Access is $0.99 a day, $1.99 a week or $3.99 a month, with no annual subscription or long-term commitment; the monthly plan is the one that opens with a 7-day free trial. Setting up the iPad and the Mac as well therefore costs nothing extra. There is a free tier too — 3 hours a week, 1 hour per session, 2 devices — which is enough to confirm the install works on a phone before you decide anything.