How to set up a VPN on your iPhone – with an app or by hand

A VPN builds an encrypted tunnel between your iPhone and one of the provider's servers. Everything your iPhone sends travels through this tunnel; only the server forwards it on to the internet. This gives you the two genuine benefits: on the open Wi-Fi of a hotel, airport or café, the network operator sees only encrypted data going to a single server, instead of being able to tell which services you use. And websites see the IP address of the VPN server rather than yours – how to check your own address is shown in (→ How to find your IP address – and what it reveals about you). That is also why a server in a country of your choice lets you access content available there; whether a streaming service allows it, however, is up to the service and changes constantly – providers cannot promise it.

What a VPN does not do: it does not recognise phishing sites and does not stop malware, unless the provider additionally includes a DNS filter such as NordVPN's Threat Protection, Surfshark's CleanWeb or Proton's NetShield – and even those only block known domains. It does not make you anonymous: as soon as you are signed in to Google, Instagram or your email account, the service knows who you are, whatever IP address it sees; cookies recognise you even without a login, see (→ Clear cache and cookies – in every browser, on your computer and your phone). And it shifts the trust: instead of the Wi-Fi operator or your mobile network, it is now the VPN provider that sees which servers you connect to. How the tunnel works technically, what sets WireGuard, OpenVPN and IKEv2 apart and what kill switch and no-logs mean is covered in our explainer (→ What is a VPN? How the virtual private network works).

On top of that, the vast majority of traffic is encrypted via HTTPS anyway – Safari warns you these days if a page is not. So the content of your connections is protected from the Wi-Fi operator even without a VPN; what remains visible is mainly the destination addresses. Whether a VPN is useful to you every day, only when travelling or not at all is weighed up in our guide (→ Do you really need a VPN in 2026? The honest guide).

If you subscribe to iCloud+, you will find «Private Relay» under «Settings» > Apple Account > «iCloud». Apple describes the service like this: it protects your privacy «when you browse the web in Safari». Your requests pass through two separate relays – the first is run by Apple and sees your IP address but not the website, because the DNS request is encrypted; the second is run by a third party, which assigns you a temporary IP address and calls up the website. Apple's aim is that no single party – not even Apple – knows both who you are and which sites you visit.

The difference from a VPN lies in its scope: according to Apple, Private Relay applies to browsing in Safari (and to DNS requests); apps that generate their own traffic are not covered. Your network provider, Apple says, can still see your IP address – only websites cannot. You cannot choose a country; the temporary address stays in your region. And Private Relay is not available in every country; in unsupported regions it switches itself off automatically. Apple also concedes that some websites may require extra steps when signing in while your IP address is hidden, and that speed tests may show lower results.

Apple does not explicitly address combining it with a VPN on the iPhone. For the Mac, Apple describes the alert «Some of your system settings prevent Private Relay from working» and names as a possible cause settings installed by «a third-party app — such as a VPN or internet filtering software»; to use Private Relay, you are told to turn off or uninstall that app. In practice that means: either a VPN or Private Relay, not both. For users who only want to hide their IP address from websites in Safari and already have iCloud+, Private Relay is enough; anyone who wants to protect apps, choose a country or encrypt all traffic on open Wi-Fi needs a VPN.

A kill switch is meant to stop your iPhone from quietly carrying on unprotected after the VPN connection drops. Proton VPN describes the iOS version like this: if the connection drops unexpectedly, the iPhone blocks all internet traffic until Proton VPN is reconnected; if you disconnect deliberately, the standard kill switch does not kick in. Turn it on under «Settings» > «Security options» > «Kill switch». Proton explicitly names two limitations: with the kill switch active you cannot reach devices on your local network, and individual DNS requests from Apple services may bypass the VPN despite the kill switch. An «Advanced kill switch», which only allows internet access through Proton VPN at all and survives a restart, is listed by Proton as a beta for iOS.

Surfshark lists the kill switch in its feature overview for iOS too: it cuts internet access if the VPN drops unexpectedly. ExpressVPN offers the levels «Standard» and «Advanced» under «Profile» > «Internet Kill Switch»; according to ExpressVPN, the advanced level blocks all network traffic when the VPN drops and can interfere with AirDrop and CarPlay. NordVPN's iOS help page does not mention a kill switch but the option «Prevent VPN bypass», which routes all traffic through the tunnel. One reason for the different implementations: according to Apple Platform Deployment, iOS only knows a system-wide, permanently enforced VPN requirement as «Always On VPN» for IKEv2 on managed devices, where all IP traffic is dropped without a tunnel – apps build their kill-switch variants within the limits Apple leaves them.

Auto-connect is the more convenient companion: the VPN connects automatically as soon as you join Wi-Fi or the mobile network. NordVPN offers «Always» or «On Wi-Fi networks» plus a list of trusted networks where the VPN stays off. Surfshark turns on auto-connect under «Settings» > «VPN Settings» and uses the last chosen location on iOS. With Proton VPN, «Always-on VPN» is permanently active on iOS and restores a dropped connection by itself. For everyday use we suggest: auto-connect on Wi-Fi on, home network excluded as trusted, kill switch only if you really cannot accept a single unprotected second – and are prepared to lose printers and AirPlay on your home network in return.

Every VPN costs processing power for encryption and a detour via the provider's server – both show up in battery drain and response time. How much depends above all on the protocol. NordVPN recommends NordLynx, its WireGuard variant, as the fastest protocol, citing among other things the lean code: around 4,000 lines for WireGuard against around 400,000 for OpenVPN. Surfshark offers WireGuard and OpenVPN (UDP and TCP) on iOS; Proton VPN lets you choose the protocol under «Settings». IKEv2, which iOS has built in for manual connections, is considered robust when switching between Wi-Fi and mobile data thanks to MOBIKE – Apple lists this feature in its protocol overview.

We have not run our own measurements. In TechRadar's tests on a 10 Gbit line, NordVPN reached 1,427 Mbit/s with NordLynx and 633 Mbit/s with OpenVPN; Surfshark averaged 2,005 Mbit/s with WireGuard and 625 Mbit/s with OpenVPN (both tests dated 6 October 2026). The figures come from desktop measurements and, for an iPhone on a mobile network, tell you mainly one thing: WireGuard-based protocols are two to three times faster than OpenVPN in these tests, and the providers' servers are not the bottleneck in practice. Details and context are in (→ NordVPN review 2026: is the market leader still worth it?) and (→ Surfshark review 2026: cheap, but is it good?).

As for the battery: a permanently active VPN with auto-connect keeps a connection open that is renegotiated at every network change – this costs more than a connection you switch on only on unfamiliar Wi-Fi. None of the providers gives reliable percentages, so we do not either. On a mobile network, a VPN works just as it does on Wi-Fi; when roaming abroad, the encrypted data counts towards your allowance as normal, and the same goes for a travel eSIM (→ What is an eSIM? How the digital SIM card works). If a hotel or office Wi-Fi blocks VPN connections, NordVPN says its NordWhisper protocol helps, while Surfshark offers its «NoBorders» mode for this.

If the app will not connect, Surfshark and NordVPN both recommend the same first steps: choose a different server or country instead of the quick connect, then change the protocol – in Surfshark under «Settings» > «VPN Settings» > «Protocol» (WireGuard, OpenVPN UDP, OpenVPN TCP), in NordVPN under «Settings» > «Protocol», where the help page says to try every available protocol. NordVPN additionally recommends temporarily turning off «Post-quantum encryption», disabling Meshnet and using an obfuscated server on restrictive networks. Both providers: update or reinstall the app, remove other VPN apps, restart the iPhone and check whether the problem also occurs on a different network or another device.

No internet despite «connected»: often the server or protocol does not suit the network environment – switching protocol helps most often. Surfshark points out that its service does not support IPv6 and that IPv6 cannot be turned off on the iPhone; the only remedy there is to disable IPv6 on the router. If the «VPN» badge stays in the status bar even though the app is disconnected, a second configuration or a leftover profile is usually behind it: check under «Settings» > «General» > «VPN & Device Management» which configurations and profiles are installed, and delete what you do not need. For network problems, Apple advises searching Settings for «VPN» and «profile» and removing the entries concerned.

As the last resort, NordVPN and Apple name resetting the network settings («Settings» > «General» > «Transfer or Reset iPhone» > «Reset» > «Reset Network Settings») followed by a restart; afterwards, Wi-Fi passwords and VPN settings are gone. NordVPN also offers «Reset VPN profile» in the app, which renews only its own configuration. If nothing helps, the providers want to see the app's connection logs – NordVPN describes how to collect them on the iPhone – and offer support by chat or email. And: keep iOS up to date; Apple names outdated or third-party networking software as a common cause of connection problems, extending even to iMessage and iCloud backups.

All the apps shown here run on current iPhones; NordVPN, Surfshark and Proton VPN require iOS 17 or later (NordVPN refers to its list of supported versions), ExpressVPN iOS 15. Technically they differ less on the iPhone than on the desktop, because iOS sets the framework. The differences lie in the device limit, the price, extras such as ad filters and dark web monitoring, and whether there is a usable free plan. This assessment is a review of the pricing and help pages, not a hands-on test of our own.

Prices (US dollars, excluding taxes, for the long term; the regular price applies afterwards): NordVPN costs $3.49 per month for Basic, $3.99 for Complete and $6.99 for Prime on the 2-year plan plus 3 months, for 10 devices, with a 30-day money-back guarantee – these are the Black Friday prices, which NordVPN says run from 21 October to 9 December 2026 (nordvpn.com, checked 22 October 2026; Basic already cost $3.49 before the sale, Complete and Prime $4.49 and $7.49). Surfshark charges $2.49 per month over 2 years for Starter as well as One and $3.99 for One+, with no device limit, also with 30 days' money back (surfshark.com, checked 21 October 2026). Proton VPN Plus costs $3.49 per month over 24 months, $3.99 over 12 months or $9.99 monthly, for 10 devices; the free plan is limited to one device (checked 12 October 2026). ExpressVPN Basic is $2.99 per month over 2 years plus 4 months with 30 days' money back (checked 12 October 2026).

This leads to a simple rule of thumb: if you only occasionally want a VPN on unfamiliar Wi-Fi and can live with not choosing the server country, Proton VPN Free serves you well – no data limit, based in Geneva, no adverts. If you want to protect several devices for the whole family, Surfshark is the cheapest; our assessment is in (→ Surfshark review 2026: cheap, but is it good?). NordVPN is dearer but brings the Dark Web Monitor and Threat Protection and scores very well in expert tests, though it draws criticism for renewal prices and billing – details in (→ NordVPN review 2026: is the market leader still worth it?). The full overview with all providers is at (→ VPN).