VPN Won't Turn Off on Your iPhone? Control Center, On-Demand and Profiles, Explained
TL;DR: If your VPN won’t stay off, Connect On Demand is probably asking iOS to reconnect it. Disconnect inside the VPN app first. If that fails, open Settings > General > VPN & Device Management, switch off Connect On Demand, or delete the configuration. Employer-managed profiles may require an administrator.
Why your VPN keeps turning itself back on
The switch is not necessarily broken. In iOS 26/27, an app-created VPN configuration can support Connect On Demand. When a VPN app enables it, iOS applies rules that can re-establish the tunnel when their conditions match. Turning the VPN off with a system toggle does not necessarily disable those rules, so the tunnel can return almost immediately.
That distinction is the whole puzzle: the visible switch controls the current connection, while Connect On Demand can control what happens next. If its rule still applies, iOS reconnects. The behavior is intentional, even though the interface may make it feel as if your choice was ignored.
This kind of reconnection is usually a feature. It can keep the tunnel active when network conditions change. The confusing part is not that iOS follows the rule, but that the system does not clearly explain why the VPN came back. For background on what the tunnel is doing, see what a VPN is.
One iPhone owner put the frustration this way in a public post on X in August 2026 (quoted anonymously): “why give us an option to turn off Always-On VPN if you won’t let us. like so i can disable my vpn from control center without it aggressively reactivating.” A terminology note: “Always-On VPN” here is the poster’s informal wording for an app’s always-on/on-demand behavior — Apple’s actual Always On VPN is a separate, supervised, management-deployed IKEv2 feature that consumer VPN apps do not use.
”When I disconnect from Control Center it immediately reconnects”
That exact complaint circulates on X — another anonymized August 2026 post reads: “when i disconnect from control center it immediately reconnects.”
In plain language, Control Center or the VPN switch in Settings ends the connection that exists at that moment. An enabled Connect On Demand rule can then ask iOS to create a new connection. The first action worked, but the second action followed so quickly that it looked as though the switch did nothing. This description applies to iOS 26/27-era behavior.
Repeatedly tapping the switch does not address the rule that requests the reconnection. Start with the VPN app: an app may disable its on-demand rules when you use the in-app disconnect control, but iOS does not require it to — the behavior is app-specific. If the reconnection persists, inspect the configuration itself.
If you use Palyfox VPN and the connection keeps coming back after you disconnect in the app, email support@palyfox.com with your iOS version and app version so we can check your configuration.
How to actually turn the VPN off (3 ways that work)
Use these methods in order. The first is the least disruptive. The third removes the configuration, so reserve it for a VPN you no longer want on the phone or one that keeps reconnecting after the gentler steps. The Settings names below reflect the iOS 26/27 era.
1. Disconnect inside the VPN app
Open the app that created the VPN connection and use its own disconnect control. Apps that enable Connect On Demand may turn that behavior off as part of an in-app disconnect, which lets the connection remain off instead of immediately being rebuilt by iOS — but iOS leaves this to each app, so there is no guarantee.
Some apps may enable on-demand again the next time they launch. If the VPN reconnects even after you disconnected inside that same app, the app is being aggressive about restoring its configuration. You can then disable Connect On Demand at the configuration level or delete the configuration.
2. Turn off Connect On Demand
In iOS 26/27-era Settings, follow this path:
- Open Settings.
- Tap General.
- Open VPN & Device Management.
- Tap VPN.
- Find the relevant VPN configuration and tap the ⓘ beside it.
- Turn off Connect On Demand, if that control is shown.
This changes the behavior that was requesting a new tunnel instead of merely ending the current connection. If Connect On Demand is not displayed, move to the app’s controls or the removal option below.
3. Delete the VPN configuration — or remove a profile (not the same thing)
These are two different actions with different consequences:
- A VPN configuration created by an app appears under Settings > General > VPN & Device Management in the VPN list. Deleting it removes that app’s connection settings and on-demand rules; the app can create a fresh configuration the next time you set it up. This is the low-risk removal.
- A configuration profile (installed from a file or a management enrollment, listed separately on the same screen) is broader. Apple’s profile-removal guidance warns that removing a profile also removes the settings — and potentially accounts, apps, and data — associated with it. Read what the profile contains before removing it.
Advice circulating from phone-repair accounts on X in mid-2026 summarized the app-configuration path as: “go to Settings > General > VPN & Device Management > Choose the VPN profile is kept reconnecting > Delete.” That works for an app-created VPN configuration; for a full configuration profile, check the contents first per Apple’s warning above.
Stuck VPN or DNS profile: when Wi-Fi problems aren’t Wi-Fi problems
If a VPN or DNS configuration remains behind after its app was removed, that leftover configuration can produce symptoms such as Wi-Fi failing to connect or some apps failing to load, even when the Wi-Fi network itself is not the cause — Apple’s own connectivity guidance points at VPN and security software as a thing to check when connections misbehave. In iOS 26/27-era Settings, the place to look is Settings > General > VPN & Device Management.
Review the listed configurations and look for one associated with an app or service you removed. If you recognize an obsolete VPN or DNS configuration, open it and delete it. Do not remove a profile merely because its name is unfamiliar; first determine whether an employer, school, or another service you still use installed it.
The useful diagnostic clue is scope. If only one Wi-Fi network fails, the network may deserve investigation. If connection trouble began around removing a VPN or DNS app and follows the phone across networks, checking for a leftover configuration is a sensible next step. That is diagnostic guidance, not proof that the configuration is the cause.
My VPN profile won’t delete?
A profile installed by an employer or a mobile device management system may not offer a user-removal option. That restriction can be intentional — Apple’s deployment documentation states that users can’t modify settings specified in a managed configuration profile. If the iPhone or profile is organization-managed, contact the employer or device administrator and ask whether the VPN is required and whether they can remove it.
Do not treat a missing delete button as evidence that the phone is malfunctioning, and do not try to bypass management controls. The administrator can explain the policy and make an authorized change if appropriate. If this is a personally owned phone that you did not expect to be managed, ask the organization that installed the profile for help identifying it.
Wait — should you even turn it off?
Connect On Demand exists to restore the VPN when its matching rules fire, including after relevant network changes. That can be useful protection. If you only need the VPN off briefly, disconnecting inside the app is usually a better first move than deleting its configuration and leaving it unavailable.
In iOS 26/27-era consumer VPN behavior, there is no per-app split tunneling control that lets an ordinary consumer VPN exclude just one selected app (Apple reserves per-app VPN for managed, MDM-deployed apps). If one app does not work through the VPN, temporarily turning the VPN off is one workaround; switching servers in the VPN app sometimes resolves it too.
If you are deciding whether a VPN is useful for your situation at all, start with what a VPN does rather than assuming it must always be on. If you want the protocol context, read what WireGuard is. Neither question changes the immediate fix: use the app’s disconnect control or change the on-demand rule.
Two related iPhone behaviors are worth separating from this one. What changed for VPNs in iOS 27 covers the OS-version context, while the iPhone VPN kill switch test addresses what happens to traffic during interruptions. A VPN that deliberately reconnects through Connect On Demand is a different issue from either an OS change or a kill-switch test.
What should you do now?
Start in the VPN app and disconnect there. If the tunnel returns, open Settings > General > VPN & Device Management, turn off Connect On Demand if it appears, or delete an obsolete app-created configuration. Check the same screen for leftover VPN or DNS configurations when Wi-Fi or individual apps stop working after an app was removed. Employer-managed profiles belong with the administrator, not a workaround.
