Setting up a VPN on iPhone is straightforward once you know which method to use. There are three paths: the VPN provider's app (fastest), a manual IKEv2 or WireGuard config (for self-hosted or corporate VPNs), and a profile from your employer or school. This guide covers all three, plus how to confirm the VPN is actually working.
What changed in 2026
- WireGuard is the default protocol for most consumer VPNs. It is faster and more battery-efficient than OpenVPN, and iOS supports it natively since iOS 17.
- iOS 18 added per-app VPN in Settings — you can now route only specific apps through the tunnel without an MDM profile.
- App Store VPN reviews are stricter. Apple now requires privacy nutrition labels with data retention disclosures — useful for vetting providers.
- Kill switch is now a standard toggle in every major VPN app; it used to be premium-only.
Method 1: VPN provider app (recommended)
This is the right path for commercial VPNs (Mullvad, ProtonVPN, ExpressVPN, NordVPN, and similar).
- Download the provider's official app from the App Store.
- Sign in with your account credentials.
- Tap Connect or choose a server location.
- iOS will prompt you to allow the VPN configuration — tap Allow and authenticate with Face ID or passcode.
- The VPN icon (a small "VPN" badge) appears in the status bar when active.
To enable the kill switch: open the app → Settings → Kill Switch → On. Some apps label it "Block internet if VPN disconnects" or similar.
Method 2: Manual IKEv2 configuration
Use this for self-hosted servers (e.g., Algo, Streisand) or employer VPNs that provide credentials rather than an app.
- Go to Settings → General → VPN & Device Management → VPN → Add VPN Configuration.
- Set Type to IKEv2.
- Fill in Description, Server (hostname or IP), Remote ID (usually the same as server), Local ID (leave blank or use your username).
- Enter your Username and Password (or choose Certificate and import one).
- Tap Done. Toggle the VPN on from Settings → VPN or the status bar shortcut.
| Field |
What to enter |
| Type |
IKEv2 (most common) or WireGuard |
| Server |
Your VPN server hostname or IP |
| Remote ID |
Usually same as server |
| Authentication |
Username/password or certificate |
| Proxy |
None unless specified |
Method 3: WireGuard manual config
- Install the WireGuard app from the App Store (free, open source).
- Tap the + icon → Create from QR code or Create from file.
- Scan the QR code your server admin provides, or import the
.conf file.
- Toggle the tunnel on inside the WireGuard app.
WireGuard is the better choice for self-hosted setups in 2026 — lower latency and battery usage than IKEv2.
How to verify the VPN is working
- Visit ipleak.net or dnsleaktest.com while connected.
- Confirm your IP shows the VPN server's location, not your home IP.
- Run the Extended test on dnsleaktest.com — all DNS servers listed should belong to the VPN, not your ISP.
If your ISP's DNS appears, the kill switch is not configured or there is a DNS leak in the app settings.
How to pick a VPN for iPhone
| Use case |
Recommendation |
| Privacy from ISP |
Mullvad (no-logs, accepts cash/Monero) |
| Speed + streaming |
ExpressVPN or NordVPN (~$4–12/month range) |
| Free with trusted provider |
ProtonVPN free tier (no data cap) |
| Work / corporate |
Use the profile or app your IT team provides |
| Self-hosted |
WireGuard with Algo or similar |
Avoid any free VPN that does not publish an audited no-logs policy. Several major free VPN apps have been caught selling DNS and browsing data.
Common mistakes
Not enabling the kill switch. If the VPN drops mid-session, your real IP leaks. Enable it before relying on the VPN for anything sensitive.
Connecting to the wrong server. Picking a distant server hurts speed. For privacy, a nearby server gives the same protection with far less latency.
Trusting the app's "connected" badge without a leak test. App badges confirm the tunnel is up, not that DNS is protected. Run a leak test once after setup.
Using a VPN to fix buffering on ISP-throttled streams. This works, but a free or cheap VPN may introduce more latency than the throttling it avoids. Use a fast paid provider.
What to skip
- Router-level VPN without understanding the tradeoffs — it covers all devices but adds latency to everything, including local traffic.
- Free VPNs with data caps or vague privacy policies — they are not worth the data privacy risk.
- "VPN boosters" or optimiser apps in the App Store — they are placebo apps that do nothing.
FAQ
Does a VPN slow down my iPhone?
Slightly — WireGuard adds 5–15 % overhead. On a fast connection, this is unnoticeable. IKEv2 is similar; OpenVPN adds more.
Can a VPN bypass iCloud Private Relay?
They address different threats. iCloud Private Relay hides your IP from websites; a VPN also hides your traffic from your ISP. You can use both, but Private Relay is disabled when a VPN is active.
Is it legal to use a VPN?
In most countries, yes. A handful of countries (Russia, China, UAE) restrict VPN use — check local laws if travelling.
Does a VPN protect me on public Wi-Fi?
Yes — it encrypts your traffic between your phone and the VPN server, preventing snooping on the local network.
Where to go next