WireGuard on iPhone & iPad: Complete iOS Setup (2026)

WireGuard is the cleanest VPN protocol to run on an iPhone or iPad — fast, light on battery, and a single toggle once it's set up. This guide walks through WireGuard on iOS end to end in 2026: installing the app, importing your server config, enabling On-Demand (always-on), and fixing handshake and MTU issues. It works with any WireGuard server — PiVPN, NetBird, or a manual setup. (For Android, see our WireGuard on Android guide.)

Step 1 — Install the app

Install the official WireGuard app from the App Store. Avoid third-party clones.

Step 2 — Import your server config

Tap + and choose:

• Create from QR code — scan the QR your server generates (pivpn -qr, NetBird, or qrencode). Fastest and least error-prone.
• Create from file or archive — import a .conf from the Files app or AirDrop.
• Create from scratch — paste keys and the [Peer] endpoint manually.

WireGuard is the client; it needs a server. A Contabo VPS at €4.99/month runs a personal WireGuard server comfortably.

Step 3 — Connect and verify

Toggle the tunnel on and allow the VPN configuration when iOS prompts. Check the latest handshake updates (not "never") and that your public IP changes. For the protocol background, see WireGuard vs OpenVPN.

Step 4 — On-Demand (always-on)

Edit the tunnel → enable On-Demand → activate on Wi-Fi and/or cellular. iOS keeps the tunnel up and reconnects automatically — the practical iOS equivalent of an always-on VPN. A true system-wide kill switch on iOS needs a configuration profile (MDM) for managed devices; for most users, On-Demand is enough.

Troubleshooting

• No handshake ("never"): wrong endpoint IP/port, server UDP port not open, or mismatched public key. Verify the server is reachable.
• Connects but no internet: lower the MTU (e.g. 1280) in the interface config — fixes many cellular MTU issues.
• DNS leaks: set the tunnel's DNS to your server or a trusted resolver and test.

For reusable client/server templates, see WireGuard config templates.

The bottom line

WireGuard on iOS is a five-minute setup: install the official app, import your server config by QR, allow the VPN config, and enable On-Demand for always-on. Keep the MTU trick handy for flaky cellular networks. You just need a WireGuard server to point it at — a Contabo VPS or a home Raspberry Pi does the job.

Editorial guide based on the documented behaviour of the official WireGuard iOS client and iOS On-Demand VPN. Security depends on your server configuration and key hygiene. Commercial links carry the rel="sponsored nofollow" attribute; an affiliate commission may apply at no extra cost to you.