WireGuard on iPhone & iPad: Complete iOS Setup (2026)

WireGuard is the cleanest VPN protocol to run on an iPhone or iPad - fast, light on battery, and a single toggle once it's set up. This guide walks through WireGuard on iOS end to end in 2026: installing the app, importing your server config, enabling On-Demand (always-on), and fixing handshake and MTU issues. It works with any WireGuard server - PiVPN, NetBird, or a manual setup. (For Android, see our WireGuard on Android guide.)

What you need before you start

• An iPhone or iPad on iOS/iPadOS 15 or later (the WireGuard app supports older versions too, but On-Demand is most reliable on recent releases).
• A running WireGuard server with a reachable public endpoint - a home Raspberry Pi with a port forwarded, or a small VPS. WireGuard on iOS is only the client; it does nothing on its own.
• The client config that server generates for this device: either a QR code on screen, or a .conf file you can move to the iPhone. Each device should get its own config (its own key pair) - never share one config across phones, as duplicate keys break the handshake.

Step 1 - Install the app

Install the official WireGuard app from the App Store, published by WireGuard Development Team. Avoid third-party clones - a VPN client sees all your traffic, so the publisher matters.

Step 2 - Import your server config

Tap + and choose:

• Create from QR code - scan the QR your server generates (pivpn -qr, NetBird, or qrencode). Fastest and least error-prone.
• Create from file or archive - import a .conf from the Files app or AirDrop.
• Create from scratch - paste keys and the [Peer] endpoint manually.

WireGuard is the client; it needs a server. A Contabo VPS at €5.50/month runs a personal WireGuard server comfortably.

Step 3 - Connect and verify

Toggle the tunnel on and allow the VPN configuration when iOS prompts. Check the latest handshake updates (not "never") and that your public IP changes. For the protocol background, see WireGuard vs OpenVPN.

Step 4 - On-Demand (always-on)

Edit the tunnel → enable On-Demand → activate on Wi-Fi and/or cellular. iOS keeps the tunnel up and reconnects automatically - the practical iOS equivalent of an always-on VPN. A true system-wide kill switch on iOS needs a configuration profile (MDM) for managed devices; for most users, On-Demand is enough.

Allowed IPs: full-tunnel vs split-tunnel

The single most important field in a WireGuard tunnel on iOS is AllowedIPs in the [Peer] section - it decides which traffic goes through the VPN:

• 0.0.0.0/0, ::/0 - full tunnel. Every packet (IPv4 and IPv6) routes through your server. This is what you want for privacy on public Wi-Fi or to take your home IP abroad.
• A specific range, e.g. 10.0.0.0/24 - split tunnel. Only traffic to that subnet uses the VPN; everything else goes out your normal connection. This is ideal when you only want to reach devices on your home or office LAN without slowing down everything else.

If you chose a full tunnel but still want to keep talking to printers and local devices, toggle "Exclude private IPs" when editing the tunnel - iOS rewrites AllowedIPs to send the internet through the VPN while leaving 192.168.x.x/10.x.x.x local. Forgetting this is the usual reason AirPlay or a local NAS "disappears" once the VPN is on.

Run multiple servers and switch between them

The WireGuard app holds as many tunnels as you like - one for home, one for a VPS abroad, one for a work network. Only one is active at a time. Give each a clear name and you can switch in two taps from the app or the iOS Settings → VPN menu. If you use On-Demand on more than one tunnel, enable it on just the one you want as default, or iOS may flip between them unpredictably.

Troubleshooting

• No handshake ("never"): wrong endpoint IP/port, server UDP port not open, or mismatched public key. Verify the server is reachable.
• Connects but no internet: lower the MTU (e.g. 1280) in the interface config - fixes many cellular MTU issues.
• DNS leaks: set the tunnel's DNS to your server or a trusted resolver and test.
• On-Demand keeps the VPN off: check it isn't disabled for your current Wi-Fi in the SSID list, and that "Disconnect on demand" isn't toggled - that switch tells iOS to drop the tunnel, the opposite of always-on.
• Tunnel won't import from QR: make sure the screen brightness is up and the whole code is in frame; a partially cropped QR fails silently. Fall back to importing the .conf from the Files app.
• Works on Wi-Fi but not on cellular (or vice-versa): this is almost always the MTU or an IPv6 mismatch - set 1280 and ensure the server hands out a working DNS resolver.

For reusable client/server templates, see WireGuard config templates.

The bottom line

WireGuard on iOS is a five-minute setup: install the official app, import your server config by QR, allow the VPN config, and enable On-Demand for always-on. Keep the MTU trick handy for flaky cellular networks. You just need a WireGuard server to point it at - a Contabo VPS or a home Raspberry Pi does the job.

Editorial guide based on the documented behaviour of the official WireGuard iOS client and iOS On-Demand VPN. Security depends on your server configuration and key hygiene. Commercial links carry the rel="sponsored nofollow" attribute; an affiliate commission may apply at no extra cost to you.