Shadowrocket: 10 FAQs for Beginners — Connection Issues, Routing Modes & Latency Tests

1. Can I connect as soon as I buy the app?

Buying the app alone is not enough to connect. Shadowrocket is a one-time purchase, while the app and your own connection service are separate. To get started, import your existing connection details and select an available entry under SERVER on Home. An empty list has no server configuration to route traffic through.

The App Store is the only place to get Shadowrocket. Before purchasing, verify the developer, Shadow Launch Technology Limited, the app ID, 932747118, and the official icon. This guide focuses on iPhone and iPad; compatibility and system requirements for Mac, Apple TV, and Apple Vision are as listed on the App Store page.

1. Verify the App Store listing

   Start with this site's App Store guide, then verify Shadowrocket using the developer name and app ID.

2. Import your details

   Home → “+” in the top-right corner → Type → Subscribe, then enter your existing subscription URL. For a single connection, choose the Type that matches your details.

3. Select an entry

   Return to Home and select the entry you want to use under SERVER. Check the address, port, and authentication details before turning on the connection.

4. Allow the VPN configuration

   The first time you connect, follow the system prompt to add a VPN configuration and complete any verification required by your device.

A one-time app purchase is not a connection plan. This site does not provide, sell, or recommend servers or subscriptions; the steps below cover only connection details you already have.

2. The Home toggle does nothing. What should I check first?

First determine whether the toggle turns itself off immediately or stays on while websites remain unavailable. If it turns off, check VPN configuration permission and the current connection state. If it stays on, continue by checking the server and routing. A VPN Connected status means a VPN session was established on the device; it does not confirm successful authentication with the remote server or guarantee access to every website.

• First connection was canceled: Return to Home and try connecting again. Watch for a system prompt to add a VPN configuration. Grant permission only to the Shadowrocket connection you are using.
• No server selected: Check whether SERVER contains an imported entry and which one is selected. Do not rely on the presence of a name in the list alone.
• Another VPN session is active: Turn off other active VPN connections, then start Shadowrocket on its own so you can tell whether switching connections is causing the issue.
• Automatic connection may be interfering: Check Settings → On Demand. While troubleshooting, turn off automatic triggers and use the Home toggle to start a manual connection.

Do not start by deleting the app. Keep your configuration and note the exact system message. If the device is managed, also check whether its management policy restricts VPN connections.

3. Which Global Routing mode should I choose?

Home → Global Routing determines how requests are routed. For everyday rule-based routing, choose Config, provided a suitable configuration file is selected on the Config page. Config does not automatically mean “proxy specific sites and connect directly to everything else”; the result depends on the file’s rules, policies, and FINAL rule.

4. VPN says connected, but websites will not load. What should I do?

Troubleshoot in this order: local network → server → routing → target request, changing one thing at a time. Changing servers, DNS, and rules all at once makes it harder to identify the cause. First confirm that your Wi-Fi or cellular connection can open ordinary websites. If the Wi-Fi network requires sign-in, complete its authentication first.

1. On Home, check the selected entry under SERVER and run Connectivity Test. If it times out, first verify the server address, port, and protocol settings rather than changing rules.
2. Check Global Routing. If it is set to Direct, determine whether the request you are testing needs a proxy, then select Proxy for a temporary comparison.
3. If the problem occurs only in Config, confirm the selected configuration file on the Config page. Then check whether the destination domain matches DIRECT, REJECT, or an incorrect proxy policy.
4. If only some domains fail, check the configuration's DNS settings, DNS results, and relevant rules. A failure on one website does not mean the entire connection is down.

For example, if the same destination fails under Direct but works under Proxy, that shows only that the two paths behave differently; it does not prove that all rules are correct. If both modes fail, do not assume the app is at fault. Also check remote authentication, network restrictions, and the destination site's status.

5. Is a lower Connectivity Test latency always better?

Lower latency usually means a shorter response time under the current test conditions, but it does not mean faster downloads. Results from Home → Connectivity Test depend on the test method, network path, and current load. Numbers measured under different conditions are not directly comparable as a performance ranking.

• Lower reading: This only means the response was quicker for this test. Also open the website you plan to use and check its loading and sustained transfer.
• Timeout or failure: The network may be unreachable, or the test target or method may not be suitable. Consider the actual request and connection details as well.
• Large fluctuations: Keep the network and test method consistent and check several times. Do not choose a connection for long-term use based on a single result.

Use the port specified in your existing connection details. Even if it is 443, do not omit the protocol, password, TLS, or any other required field just because 443 is commonly used for HTTPS.

6. How do I import a subscription, and what if it will not update?

A subscription is a way to update connection details, not a connection itself. Go to Home → “+” → Type → Subscribe and enter an existing URL. After saving, check whether entries appear under SERVER. The example https://example.com/sub?token=xxxx shows only the URL format; it is not a working subscription. Tokens in real links are sensitive and should not appear in public screenshots or support requests.

1. Copy the full URL and check for extra spaces, line breaks, or missing query parameters. Do not use a management page address as the subscription URL.
2. After importing, pull down on Home to refresh and check whether the subscription entries update. Then confirm which server is selected.
3. If an update times out, check your current network first. If the subscription URL requires a proxy, check Update via Proxy under Settings → Subscribe and retry with a connection you have already verified works.
4. If you see an authentication error or an unreadable response, ask your own service provider to verify that the link is valid and returns the correct format. Switching Global Routing modes repeatedly will not fix an expired token.

A subscription update may change server names, addresses, or the list of entries. Do not assume the previously selected entry is still available after refreshing; select and test an entry again. Updating a subscription and switching Config files are different operations: the former updates connection details, while the latter changes how requests are routed.

7. How do I route only specific websites through a proxy?

On the Config page, select and edit your own configuration, add a rule for the destination domain, then verify it under Home → Global Routing → Config. The following rule entries are examples for the [Rule] section; do not use them to overwrite your configuration file.

DOMAIN-SUFFIX,example.com,PROXY
FINAL,DIRECT

DOMAIN-SUFFIX matches a domain and its subdomains; FINAL handles requests that did not match any preceding rule. Here, PROXY must refer to an available proxy policy, while DIRECT means a direct connection. Rules are generally matched in order, so an overly broad rule near the top can prevent a later rule from taking effect.

• GEOIP matches the region associated with the destination IP address, not the language displayed on a website.
• IP-CIDR matches a specified IP range; it does not match domain suffixes.
• REJECT rejects requests. Before using it, make sure it will not block sign-in or other required resources.
• A website may load images, APIs, and sign-in resources from multiple domains. Adding only its main domain may not cover the entire flow.

If a rule still has no effect, first confirm which Config file is selected, then make sure Global Routing is not set to Proxy or Direct. Verify the scope of existing rules before adding more.

8. Does a newer protocol mean faster speeds? Can I mix parameters?

You cannot determine speed from a protocol name alone, and parameters cannot be mixed across protocols. Shadowsocks, VMess, VLESS, Trojan, Hysteria2, and WireGuard use different fields and connection methods. Under Home → “+” → Type, choose the protocol specified in your connection details; do not guess from the server name.

• Shadowsocks: Check the encryption method and password. Do not substitute authentication fields from another protocol.
• VMess / VLESS: Check the UUID, transport, and any required TLS settings. Similar protocol names do not mean all fields are the same.
• Trojan: Check the password and TLS details. If you encounter a certificate or name issue, verify the original settings instead of simply relaxing validation.
• Hysteria2: Uses QUIC-based transport, so consider whether UDP is reachable on your current network.
• WireGuard: Check the keys, endpoint, addresses, and allowed routes. It is not a server entry that requires only a password.

Actual performance also depends on server load, packet loss, the network path, and the destination service. Beginners should import their existing connection details as provided and change transport settings only when they know which options the server supports. For field details, see the technical reference.

9. Why does On Demand connect automatically?

Settings → On Demand triggers a VPN connection when configured conditions are met. It operates at a different level from Global Routing: On Demand determines when to connect, while Global Routing determines how requests are routed during the connection. An automatic connection does not automatically select the right Config file.

1. Go to Settings → On Demand and check the main toggle and configured network conditions to confirm whether automatic connections are expected.
2. When troubleshooting the manual connection toggle, turn off On Demand first, then return to Home and connect manually so automatic triggers do not affect your observations.
3. After switching between Wi-Fi and cellular, check the connection status and Global Routing on each network. If you use Scene, also check which scene matches that network.
4. Before re-enabling automatic connections, verify that both a manual connection and actual website requests work. Then restore the conditions you need one at a time.

If the connection turns back on after you switch it off manually, check the automatic trigger conditions first instead of repeatedly turning it off. Connection timing, scene selection, and rule-based routing need to be checked separately; none of these settings replaces the others.

10. How do I restore my purchase on a new device?

On the new device, sign in to the App Store with the Apple account used for the original purchase. Open the account's Purchased section or app list, find Shadowrocket, and download it again. Purchase history and local configuration are separate: reinstalling the app does not restore subscriptions, rules, or server settings from the old device.

• First confirm that the App Store account matches the original purchase. Do not rely on accounts signed in to other services on the device.
• Check device compatibility, system requirements, and Universal Purchase availability on the App Store page.
• Reimport your existing connection details, confirm the configuration file in Config, and approve the system prompt the first time you connect.

The verification steps after restoring are the same: confirm your connection details, confirm the VPN session, then check routing with an actual request. For more, see how to restore purchases and the connection test guide.