This guide is for first-time Shadowrocket users on iPhone or iPad who already have configuration details or a subscription from their own provider. Follow the steps in order—identify the screens, import your configuration, choose a routing mode, approve the connection, and test access—to distinguish system VPN permission, SERVER entries, Config files, and connectivity tests. A connected status alone does not guarantee that everything is working.
Know the Three Main Screens
After opening the app for the first time, avoid changing several settings at once. Home is where you select a server, choose Global Routing, and start a connection. Config manages configuration files used for tasks such as traffic routing, while Settings contains app options, including On Demand. Server entries and routing configurations are separate: importing one does not mean the other is ready.
Shadowrocket is a closed-source commercial app for Apple platforms, primarily used on iPhone and iPad. It is available exclusively through the App Store. Before purchasing, check that the developer is Shadow Launch Technology Limited. Refer to the App Store listing for system requirements and device compatibility. The app is a one-time purchase; buying the app does not include a service plan. You’ll still need your own connection details after installation.
Your First Connection and VPN Permission
Not Connected means the app-managed connection is not currently active. It does not mean your purchase failed or that the server is unavailable. The first time you start a connection, iOS may ask you to allow a VPN configuration. This adds the system configuration needed to manage network traffic; it is not a purchase of an additional service.
-
Check for a Server Entry
Open Home and check that your own server entry appears under SERVER. If the list is empty, follow the import steps below before trying again; repeatedly tapping the connection switch won’t add an entry.
-
Confirm Your Selection
On Home, select the intended entry under SERVER, then check the current mode under Global Routing. If you’re using Config, make sure the expected file is selected on the Config screen as well.
-
Start the Connection
Return to Home and tap the switch in the Not Connected row. If the system asks to add a VPN configuration, confirm that the request is for Shadowrocket, tap Allow, and complete any device verification required by the system.
-
Check the Status
Wait for the connection status to change, then open a page you know should be accessible. Note the app’s connection status and the webpage result separately; don’t treat the status indicator as the only measure of success.
If you previously denied permission, you can usually return to Home and try connecting again. If your device is managed by an organization, restricted by system settings, or affected by another VPN configuration, first check VPN management in system settings. Don’t start by deleting all network configurations. Menu labels may vary by system version and device management status.
SERVER: Import and Select an Entry
SERVER is the list of selectable server entries. Each entry stores a protocol and connection details, such as an address, port, and authentication information. Required fields vary by protocol. Shadowsocks, VMess, VLESS, Trojan, Hysteria2, and WireGuard are not interchangeable by changing the Type alone; use the complete set of details from your existing configuration.
- Already have a subscription? Tap “+” in the top-right corner of Home → Type → Subscribe, enter your own subscription URL, and save. Return to Home to update the subscription. Use the URL, name, and authentication details from your existing information.
- Have individual connection details? Tap “+” in the top-right corner of Home → Type, choose the protocol that matches your details, and fill in the corresponding fields. Use the actual port provided; don’t change it to
443just because a website uses HTTPS. - Confirm the import: Check that a server entry appears under SERVER, then select the one you plan to use. Saving a subscription and successfully fetching its entries are two separate results to verify.
- Update later: After updating a subscription from Home, check the selected entry again. Entries may be renamed or removed when the remote list changes. A successful update also doesn’t guarantee that every entry will work on your current network.
Subscription URLs often contain credentials. Don’t include the full URL in public screenshots, group chats, or support requests. If no entries appear after saving, first check the fetch result, confirm the URL is complete, and check your device’s network. There’s no need to immediately change rules in Config.
Server Subscriptions and Rule Files Are Different
Home → SERVER
- View and select a connection target.
- Check the protocol, address, port, and authentication fields.
- Update a subscription to retrieve changes to remote entries.
Config
- Select the configuration file currently in use.
- Check the matching conditions and policies in sections such as Rule.
- A file may contain other settings too. Keep a backup before making changes.
Selecting a server doesn’t mean you’ve selected the right rule file. Importing a rule file doesn’t mean you have a usable server.
Global Routing: Choose a Routing Mode
Global Routing determines how traffic is routed after it is handled by the app. It won’t fix a server password or fill in missing rules. On your first use, make sure you know which mode is selected. In particular, Config does not necessarily mean that only specified websites use a proxy: actual behavior depends on the rules in the selected file and its final fallback policy.
Config
RecommendedRoute requests according to the rules in the current configuration file. Requests matching DIRECT connect directly; those matching a proxy policy use that policy. Requests not matched by earlier rules generally fall through to FINAL.
Best for: Everyday use when you’ve checked the current configuration and want different traffic routed according to its rules.
Proxy
Route generally intercepted requests through the selected proxy path. This can help narrow down rule-related issues temporarily. System traffic, exclusions, and other configuration may affect which requests are actually covered.
Best for: Briefly checking whether the selected server can access a particular destination.
Direct
Connect generally intercepted requests directly, without using the selected proxy server for forwarding. This is a routing choice; it does not turn off the connection switch on Home.
Best for: Comparing results with direct access over your current network.
Scene
Use a preconfigured scene and its associated policies. The result depends on the scene’s settings, so this is not an automatic routing solution that works without configuration.
Best for: Users who have already configured and checked their scenes.
For example, DOMAIN-SUFFIX,example.com,PROXY in the current file sends that domain and its subdomains through PROXY. If the final rule is FINAL,DIRECT, requests that don’t match earlier rules connect directly. These examples illustrate matching behavior; don’t replace your existing configuration with them without considering the full file. GEOIP matches based on the destination IP’s geographic location, while IP-CIDR matches an address range. Neither is a field for entering a server address.
Connectivity Test: What Does Latency Tell You?
Home → Connectivity Test checks whether an entry can connect. Interpret the result in light of the test method: a successful TCP handshake and a webpage request completed through a proxy are different levels of verification. A latency reading in milliseconds does not prove that a destination domain resolves, that authentication is correct, or that every resource on a webpage will load.
What Test Results Can and Can’t Tell You
- Where to find it
- Home → Connectivity Test
- Latency shown
- The test received a response under the current conditions. Interpret it in light of the selected test method.
- Timed out
- Check your current network, server address, and port, then review settings related to the test method.
- Webpage fails
- Continue by checking DNS, authentication details, routing rules, and the destination website’s status.
When comparing entries, use the same network and test method. Don’t rank numbers measured under different conditions.
What Automatic Connection Can and Can’t Do
- Where to find it
- Settings → On Demand
- What it does
- Triggers the system VPN’s on-demand connection behavior based on the conditions you’ve configured.
- First-time setup
- Start with a manual connection. Once you’ve confirmed it works, configure automatic triggers.
- Reconnects automatically
- If the connection comes back after you turn it off, check your On Demand conditions and system VPN settings.
On Demand controls when to connect; Global Routing controls how requests are routed after connecting. They serve different purposes and can’t replace one another.
For a repeatable check, stay on the same Wi-Fi network, select one SERVER entry, run a test, and then open the same webpage. Next, change only one Global Routing setting, repeat the request, and note what changed. Don’t update the subscription, switch servers, change DNS, and replace Config all at once; if the issue clears, you won’t know which change made the difference.
Troubleshoot Your First Connection by Symptom
Start troubleshooting with the step closest to what you’re seeing. First check whether a connection was established, then whether the selected target works, and finally review routing rules and DNS resolution. The table below uses no made-up speed test results and can be used to record what you actually observe on your device.
| What you see | Check first | Next step |
|---|---|---|
| Status stays Not Connected | Whether system VPN permission was granted | Try connecting again and check for a system prompt or an app error. |
| SERVER list is empty | Whether the subscription entries were actually fetched | Check the subscription URL, update result, and network status. |
| Latency is shown, but the webpage fails | Test method, authentication details, and DNS | Keep the same entry selected and verify with an actual webpage request. |
| Proxy works, but Config doesn’t | The active Config file and the policy being matched | Check the rule for the destination domain and FINAL. Keep a copy of the original file before editing. |
| Connection resumes after being turned off | Settings → On Demand | Check the trigger conditions, then review the system VPN’s on-demand settings. |
| Only a few websites fail | The destination website, DNS results, and relevant rules | Change one variable at a time for the same domain; don’t reset everything first. |
When reporting an issue, include the order of steps, current network type, Global Routing selection, test method, and exact error text. Hide the full subscription URL, password, and other authentication details. For further help, see the connection troubleshooting guide. Look up rule keywords in the glossary.
Checklist After Initial Setup
The goal of initial setup is a connection path you can explain and verify again—not turning on every switch. Once a manual connection works, consider On Demand, scenes, and more detailed routing changes. Record the current working settings before each change so you can restore them if needed.
- The Home connection status is as expected, and system VPN permission has been granted.
- The intended SERVER entry is selected, and its connection details have a known source.
- You’ve checked the Global Routing mode; if using Config, you know which file is selected.
- You’ve checked both Connectivity Test and actual webpage access without treating them as the same result.
- If you need manual control, you’ve confirmed that On Demand won’t trigger a connection under its existing conditions.
Once these checks are complete, use Home for everyday tasks: check the connection status first, then the routing mode, and review SERVER or test results if needed. Use Config and Settings for specific configuration changes. Avoid changing several things at once to fix a single access issue.