VPN on iPhone: which method to use and how to set it up

One LeoTun account gives an iPhone five options. The first four install a client on the phone; the fifth installs nothing.

• Cisco (AnyConnect): the client is Cisco’s own Cisco Secure Client, available in the App Store in most regions. You enter an address, a username and a password — no certificate file, no profile to import.
• Hiddify: search “Hiddify” in the App Store, then scan a QR code on this site to import. Fastest on lossy networks, with a split-routing switch built in. Needs a non-China Apple ID.
• Private network (Tailscale): install the official Tailscale app and log in once with your site account; it stays online and recovers by itself when you change Wi‑Fi or move to mobile data. Needs a non-China Apple ID.
• OpenVPN: install the official OpenVPN Connect and import one .ovpn file; the profile already carries your username and password.
• Router: at home, join the Wi‑Fi of a router running our firmware and the phone is on the route with nothing installed.

• First time, or travelling: Cisco. Test it once before you leave and it works when you land — see the travel guide.
• Dormitory, campus or office Wi‑Fi that restricts UDP: Cisco. It runs over TLS like any HTTPS site and is the steadiest on restricted networks.
• Mobile data or old-building broadband with heavy packet loss: Hiddify. Its protocol is built to resist loss.
• A phone, a tablet and a couple of computers, set up once and forgotten: private network. It also lets you reach a home NAS from outside — see the multi-device guide.
• Inside China and wanting Chinese sites to go direct: Hiddify, switched to “auto split” in the client.
• Abroad and watching Chinese video: any of the four clients, with the China region selected.
• Family members who will not manage an app, or many devices: router — see choosing a VPN router.
• Not sure: start with Cisco; the same account switches to any other method later. The full comparison is in which method fits which scenario.

This site already has illustrated tutorials for the install steps; this section points to them.

• Cisco: open the step-by-step section of the AnyConnect guide and choose the iOS tab. The App Store link is in the install area of the Cisco page, and the address for each region is in the region list.
• Hiddify: after installing, go to the Hiddify page and scan the QR code or copy the import link. Importing on iPhone works the same as in the Android screenshots — see importing a Hiddify subscription.
• Private network: on the signed-out screen tap “⋯” at the top right, choose Use custom server, enter the address shown on the private network page, then confirm with your site account. Details are in the private network guide.
• OpenVPN: install OpenVPN Connect from the table on the OpenVPN page, log in and tap a region’s flag to download its .ovpn file, open it in the client and connect.
• Router: to flash your own, start at the router page; a pre-flashed unit is also available there.

The App Store is split into storefronts by the region of your Apple ID. The China storefront does not carry Hiddify or Tailscale, which is also why you may see “This item is not available in your country or region”. Cisco Secure Client and OpenVPN Connect are available in most regions.

The fix is to register a new Apple ID in another region. Payment method can be set to “None”, you only switch accounts inside the App Store, and iCloud and your photos stay as they are. The steps are in the iOS App Store guide.

If your storefront does not list Cisco Secure Client, the open-source OpenConnect client speaks the same protocol and takes the same username and password.

Always decline an Apple ID shared by someone else: the owner of that account can lock your phone remotely. The same goes for configuration profiles and “enterprise-signed” installers of unknown origin.

• On the first connection the system asks for VPN permission. Allow it.
• Moving between Wi‑Fi and mobile data rebuilds the connection, which is normal: the private network recovers on its own, the other methods need one reconnect.
• Run one device-wide method at a time on the same phone. Cisco, the private network and Hiddify compete for network settings when they are on together; a VPN your employer keeps always on counts as one.
• With Hiddify, scan the QR code separately on each device: one profile connected from two devices uses two device slots.
• Keep the date and time on automatic. Encrypted connections need the clock to be within a few minutes, and a Cisco “untrusted certificate” prompt usually means the time is off.
• Client updates arrive through the App Store like any other app.

1. Log in to this site and check the account expiry. Expiry is the most common cause; a new account needs a trial or a payment before it has any time.
2. Check that the phone’s date and time are set automatically.
3. Try another region. If that one connects, only the first server was temporarily unreachable.
4. Change network: if Wi‑Fi fails, try mobile data once, and the other way round. Interference differs between carriers.
5. Read the error. In Cisco, “Login failed” means a wrong password or an expired account; “Untrusted server certificate” usually means the clock is wrong or the current network intercepts TLS, so try another network; “Connection attempt has failed” means the address is unreachable, so change region. In Hiddify, a failure to fetch the subscription means the account expired or the password changed — scan the QR code on this site again.
6. Change method. If the UDP methods (Hiddify, private network, OpenVPN) fail, switch to Cisco over TLS; blocking of the different protocols is independent.
7. Still stuck: bring the method, the region, the exact error text and the time to a support group on the contact page. The longer checklist is in the troubleshooting guide.