The VPN entry in iPhone Settings is where iOS keeps every VPN configuration installed on the device, whether it came from an app, a work profile or a manual setup. When the toggle is on, all of the phone's internet traffic is being sent through an encrypted tunnel to a server chosen by that configuration. When it is off, the phone connects directly. If you did not install a VPN and the toggle is there anyway, an app you use has added one, and that is worth knowing about.

Where to find it

Settings → General → VPN & Device Management shows every VPN configuration on the phone and, below it, any management profiles. Settings → VPN (near the top of the main Settings list, next to Wi-Fi) appears once at least one configuration exists and is the quick way to switch it on and off. The status bar shows a small "VPN" badge while a tunnel is active.

What the toggle actually does

iOS routes traffic through a VPN using a system component that apps cannot bypass. When a configuration is active:

  • Every app's traffic, including background sync, goes through the tunnel.
  • DNS queries go through it too, if the configuration says so; most VPN apps do this.
  • Websites and services see the VPN server's address instead of your carrier's or Wi-Fi's.
  • Your carrier or the Wi-Fi network sees one encrypted connection to one server.

What it does not do: hide you from the apps you are logged into, block trackers on its own, or make a slow connection faster. The overhead is small but real, explained in does a VPN slow down your internet.

Why the VPN turns on by itself

This is the most common question, and there are four ordinary explanations.

  1. On-demand rules. Many VPN apps let you say "connect automatically on Wi-Fi" or "on any untrusted network". iOS then switches the tunnel on when the condition is met. Check the app's settings for on-demand or auto-connect.
  2. Connect on demand for specific apps or domains. A work profile can be configured so that opening a corporate app starts the VPN. The profile is listed under Device Management.
  3. Content filters and ad blockers. Some ad-blocking and parental-control apps use the VPN slot to filter traffic locally, without sending it to a server. They show as a VPN configuration and the toggle behaves the same way. This is not a privacy VPN, even though it looks like one.
  4. A leftover configuration from an app you deleted. The app is gone, the configuration is not, and it may still try to activate.

If none of these applies and a configuration you do not recognize keeps activating, remove it (below) and review which apps have permission to install configurations.

Real VPN or a filter? How to tell

Open the configuration and look at the server field. A privacy VPN lists a server address or hostname belonging to the provider. A local filter often shows a loopback address such as 127.0.0.1, or a description mentioning filtering, blocking or parental control. Another check: connect and open What Is My IP. A real VPN changes the address and country; a local filter does not.

Removing an old configuration

Settings → General → VPN & Device Management → tap the configuration → Delete VPN. If the entry is greyed out, it belongs to a management profile: remove the profile in the same screen, which removes its VPN. Configurations installed by an app usually disappear when the app is deleted, but not always; this screen is where to check.

Setting up a VPN on iPhone

  • With an app. Install from the App Store, sign in, tap connect; iOS asks once to add a VPN configuration. This is the normal path and gives you the app's features: kill switch, protocol choice, on-demand rules.
  • With a subscription link. Some services provide a link you paste into a client such as Streisand, V2Box or Hiddify; the client installs the configuration and manages servers.
  • Manually. Settings → VPN → Add VPN Configuration supports IKEv2, IPsec and L2TP with server, credentials and certificate typed by hand. This works without any app but offers none of the app's features.

Things worth switching on

  • On-demand for untrusted Wi-Fi, so the tunnel is up before you open anything on café or hotel networks; the reasons are in is public Wi-Fi safe.
  • Kill switch in the app, if it has one, so a dropped tunnel does not silently fall back to the open connection.
  • Private Relay awareness. iCloud Private Relay, a separate Apple feature for Safari, is not a VPN and does not cover other apps; it can be left on or off independently.

Quick checks after connecting

  1. The VPN badge is in the status bar.
  2. What Is My IP shows the server's address and country.
  3. The WebRTC leak test does not reveal your real address in Safari.
  4. Switching from Wi-Fi to mobile data keeps the badge on, or the app reconnects within a few seconds.

404 VPN's iPhone app installs its configuration on first connect, uses VLESS or WireGuard depending on the network, supports on-demand connection for untrusted Wi-Fi, and blocks traffic during reconnects with a kill switch. Details on the features page; get started here.