If iPhone VPN won’t turn off, disable Connect On Demand, remove VPN profiles, or check work MDM rules first.
You tap the switch, the blue badge flickers off, then the tunnel springs back. When an iPhone keeps re-enabling a VPN, the cause is usually a profile or a setting that auto-starts the connection. This guide gives clear steps that stop the loop and get you back online without guesswork.
Common Causes And Fast Checks
Start here. These quick checks solve most cases where the VPN keeps coming back on. Work through them from top to bottom for a clean win.
| Symptom | Likely Cause | Quick Action |
|---|---|---|
| VPN shows as “Connected” again after a few seconds | Connect On Demand or a kill switch in the VPN app | Open Settings > VPN, tap “i” next to the profile, turn off Connect On Demand |
| VPN toggle is greyed out | Always On VPN from work or school management | Ask the admin to change the policy; you can’t turn it off yourself |
| Two or more VPN apps installed | Competing network extensions | Delete extras; keep one VPN app and one profile |
| VPN comes back after you delete the app | Leftover configuration profile | Settings > General > VPN & Device Management, remove the profile |
| Only Safari traffic looks “proxied” | iCloud Private Relay | iCloud settings > Private Relay, turn it off temporarily and re-test |
iPhone VPN Not Turning Off: Causes And Fixes
The steps below move from the simplest toggle to deeper clean-up. You’ll stop auto-reconnects, remove hidden triggers, and keep the device stable.
1) Turn Off VPN From Two Places
First, use the system switch: Settings > VPN, then turn VPN off. Next, open your VPN app and switch it off there as well. Many apps include a “connect on device start” or “auto-reconnect” toggle. Turn that off too. If the app offers a kill switch, pause it while you test.
2) Disable Connect On Demand
Connect On Demand tells iOS to bring the tunnel back whenever a rule matches. In Settings > VPN, tap the “i” icon next to your active configuration and turn off Connect On Demand. Some apps rename it as Auto-connect or Persistent connection. Same idea, same fix.
3) Remove Old Or Duplicate VPN Configurations
Open Settings > General > VPN & Device Management > VPN. Delete profiles you don’t use. Keeping one clean profile prevents clashes between network extensions that can force the icon back on.
4) Check For A Configuration Profile
Still stuck? Look in Settings > General > VPN & Device Management. If you see a profile under Configuration Profiles, open it and review its payloads. A profile can install a VPN and set rules that re-enable it after you toggle the switch. If it’s your own profile, tap Remove Profile. If it belongs to a workplace, ask the admin before removing it to avoid access loss. Apple’s guide shows how to remove configuration profiles safely.
5) Spot “Always On” From Work Or School
On supervised devices, an MDM policy can set Always On VPN. The system blocks the off switch in that case. You’ll know because the toggle is disabled and the tunnel stays up across Wi-Fi and cellular. Only the administrator can change it. Apple’s platform guide explains how Always On VPN works with supervised devices.
6) Restart And Retest
Hold the Side button and a Volume button, then slide to power off. Wait a few seconds, turn the phone back on, launch no VPN app, and check Settings > VPN. If the icon stays off after a minute of browsing, you’re done.
7) Reset Network Settings (Safe For Data)
Network resets clear saved Wi-Fi networks, VPN settings, and cellular preferences, then rebuild stacks from scratch. Go to Settings > General > Transfer or Reset > Reset > Reset Network Settings. You’ll re-enter Wi-Fi passwords after the reset. This step wipes stray VPN entries that can revive a tunnel.
8) Update iOS And The VPN App
Install the latest iOS release under Settings > General > Software Update. Then update the VPN app from the App Store. Fresh network extensions fix auto-connect bugs and stale launch daemons that can trigger reconnects.
9) Reinstall The VPN App Cleanly
Delete the app, restart the phone, then reinstall. After login, skip any wizard step that enables auto-start, kill switch, or on-demand rules. Add those back only if you need them once you confirm you can turn the tunnel off and on at will.
10) Check For Private Relay Look-alikes
Safari can route traffic via Private Relay, which may feel like a VPN. Turn it off temporarily in iCloud settings and test your sites. If the VPN toggle now behaves, keep Private Relay off only while you fix the main issue. Apple explains the feature on its About iCloud Private Relay page.
When The VPN Toggle Is Locked
If the switch is greyed out, the device likely runs under device management from work or school. Supervision lets admins enforce a tunnel for all traffic. That design protects corporate resources and blocks data leaks. In that setup, only the admin can relax the rule. You can still ask for a per-app VPN, a schedule, or a rule that spares trusted networks.
Step-By-Step Fix Flow
Use this flow to keep things tidy. Move to the next step only if the VPN turns itself back on again.
Toggle And App Settings
- Settings > VPN: turn the switch off.
- Open the VPN app: turn off Auto-connect and any kill switch.
- Force-quit the VPN app; don’t launch it during tests.
Profiles And Management
- Settings > General > VPN & Device Management: remove old VPN profiles.
- Under Configuration Profiles: remove personal profiles that add VPN payloads.
- If enrolled by work or school: ask the admin to review Always On settings in MDM.
Clean-Up And Updates
- Restart the phone.
- Reset Network Settings.
- Update iOS and the VPN app.
- Reinstall the VPN app without auto-start options.
What Each Fix Changes
Not sure which step to try next? This table maps each action to its impact so you can pick the leanest move for your case.
| Action | What It Changes | Trade-Off |
|---|---|---|
| Turn off Connect On Demand | Stops rule-based auto-reconnects | Tunnel won’t auto-protect on risky networks |
| Delete extra VPN profiles | Removes clashes between extensions | You’ll need to re-add a profile later if required |
| Remove a configuration profile | Uninstalls managed VPN payloads and rules | May break work access until you re-enroll |
| Reset Network Settings | Clears Wi-Fi, APN, VPN, and DNS caches | Re-enter Wi-Fi passwords and custom DNS |
| Ask admin to lift Always On | Re-enables your VPN off switch | Security team may decline the request |
| Reinstall the VPN app | Flushes hidden toggles and corrupted states | Requires login and setup from scratch |
Prevent The VPN From Reconnecting
Once you tame the auto-reconnect, set up the device so the tunnel only runs when you want it.
- Keep only one VPN app installed. Running two apps spawns extension fights.
- Use app allow-lists instead of a kill switch when possible.
- Skip “connect at device start” prompts during setup unless you need them.
- Use Wi-Fi known networks at home, so you don’t rely on auto-protection there.
- For work access, ask for per-app VPN so the switch stays free for the rest.
Why iOS Brings A VPN Back
iOS can watch for rules defined in the profile, the app, or device management. When a rule matches a domain or a network type, the system spins up the tunnel again. The Always On setting in management goes further by sending all IP traffic through a single tunnel at all times. Apple’s deployment guides call out these controls for admins.
Extra Checks That Pay Off
Test with cellular off, then with Wi-Fi off, so you can see which path retriggers the tunnel. Try a guest network that has no captive portal. Remove content filters or DNS blocker profiles while you test. If you use Dual SIM, switch lines to see if a carrier profile triggers odd behavior. Keep screen recordings of every step; timestamps help an admin or a vendor spot the trigger fast.
When It’s A Third-Party App Setting
Many VPN apps ship with reconnect features that sound helpful but can fight your intent to keep the tunnel off. Launch the app and scan settings for Auto-connect, Connect On Launch, Launch At Login, Packet Loss Protection, or a kill switch that “blocks all traffic.” Set those to off, then confirm the iOS switch stays off for a few minutes of browsing. If the app adds a per-site split tunnel, clear those rules and try again.
When It’s A Profile You Didn’t Add
Some mobile security tools and filtering services add a profile that includes a VPN payload. If you don’t recognize the issuer, take a screenshot and check with the device owner or the admin. Removing an unknown profile can cut network access you rely on. If the profile is yours, removing it is a quick way to stop hidden on-demand rules from reviving the tunnel.
Privacy And Function Trade-Offs
Turning off on-demand rules gives you direct control, though it also means the phone won’t auto-protect on coffee-shop Wi-Fi. If you want a middle ground, ask for per-app VPN for your work tools only, then leave the global switch free. Another handy option is to add a Home SSID to a trusted list inside the app so the tunnel stays down on your own network.
Safe Troubleshooting Tips
Screen-record your steps so you can show the admin or the VPN vendor what happens. Test on both Wi-Fi and cellular. Try a spare network with no captive portal. If the phone is enrolled, verify that you’re allowed to remove profiles before you tap any Remove button.
When To Escalate
If the switch stays locked or springs back after a clean reset and a fresh install, you’re likely on a supervised device or facing a carrier or DNS profile that pins the tunnel. Send the timestamped screen-recording, your iOS build, and the VPN app version to your admin or the vendor. That speeds up a policy change or a bug fix.
Wrap-Up Fix Checklist
Turn it off in Settings and in the app, kill auto-connect, remove stray profiles, check for Always On, restart, reset network settings, update, then reinstall. With those steps, an iPhone that keeps turning the VPN back on becomes predictable again.