Before using Shadowrocket for the first time, have your existing connection details ready. Start a connection from Home and allow Shadowrocket to add a VPN configuration when prompted. This guide covers permission, the connection switch, routing modes, connection testing, and the server list, and explains the difference between system permission being granted, the app being connected, and a website being reachable.
Before connecting for the first time: Check the app and your existing connection details
Shadowrocket is a paid app for Apple platforms, primarily used on iPhone and iPad, and is available exclusively through the App Store. Before purchasing, verify the developer, Shadow Launch Technology Limited, and app ID 932747118. The app is sold as a one-time purchase. Check the App Store listing for system requirements, compatibility with other Apple devices, and Universal Purchase availability.
Buying the app and obtaining a connection service are separate things. This guide assumes you already have your own service provider and subscription or individual server details. This site does not provide, sell, or recommend servers or subscriptions. If the SERVER list on Home is empty, allowing a VPN configuration will not automatically add a server address, port, or authentication details.
Home shows connection status, lets you select a server, and provides access to the current routing mode. Config is for managing configuration files and rules. Settings is for app preferences, such as On Demand. Server details and routing rules are different: the former specify where and how to connect, while the latter determine which policy applies to each request.
- Existing subscription: Have the complete link ready, preserve its query parameters, and don’t treat a truncated address in a screenshot as a complete link.
- Existing individual server details: Check the protocol, address, port, and authentication fields. A familiar server name alone doesn’t confirm that the details are correct.
- Existing configuration file: Check its source and intended rules, especially the final policy. For details, see the import guide.
Allow VPN Configuration: System Permission and First Connection
Opening the app alone may not trigger a VPN permission prompt. The system typically asks to add a VPN configuration when you start your first connection and a system VPN configuration needs to be created. Once allowed, Shadowrocket’s network extension can establish a local traffic-processing channel. This permission does not authenticate a server account or mean that all requests will go to a remote proxy server. Their destination is determined by Global Routing and your configuration rules.
-
Check your connection details
Open Home and confirm that the SERVER list shows the servers you imported. If the list is empty, import your connection details first; system permission does not configure a server.
-
Select a server
On Home → SERVER, select the entry you want to use and check the selection indicator. If names are similar, open the edit screen to verify the address, port, and protocol.
-
Check routing
Open Home → Global Routing. If you have an existing rules configuration and have verified it, select Config. To troubleshoot a server connection, you can temporarily select Proxy, then restore the previous mode when testing is complete.
-
Start the connection
Return to Home and use the switch next to Not Connected. When the system asks to add a VPN configuration, verify that the request is from Shadowrocket, tap Allow, and complete authentication if required by the system.
-
Verify access
Return to Home to check the status, then cross-check with Connectivity Test and an actual website. Keep the same network and server during testing; avoid changing multiple settings at once.
If you denied permission the first time, return to Home and start the connection again to see whether the system prompts you again. To check an existing system configuration, go to General → VPN & Device Management → VPN in iPhone or iPad Settings; labels may vary by system version. Don’t delete configurations unrelated to this setup, especially those that must remain on the device for management purposes.
Allowing a VPN configuration completes only the system-permission step. You still need to verify that the server details are valid, the current network can reach it, the correct rules are selected, and the target service is accessible.
Not Connected: What the Switch Tells You
Not Connected means there is no active client connection. The switch starts or stops traffic processing; it does not import subscriptions or fix incorrect authentication details. After turning it on, check the status text too. The switch position alone does not confirm that the connection is ready.
Even when the system shows VPN as connected, that only means the corresponding local channel is active; it doesn’t prove that a server can handle every request. With Direct selected, the local channel can be active while requests are routed directly. With Config, some requests may match DIRECT while others use a proxy policy.
| What you see | What to check first | What you can’t conclude from this alone |
|---|---|---|
| Not Connected is displayed | The Home connection switch and whether system permission is complete | This alone does not mean the server is unavailable |
| The connection turns off again shortly after you switch it on | Whether the system denied permission or showed a specific error | This alone does not mean the rules are at fault |
| Connected status, but websites won’t load | The current server, Global Routing, DNS, and the request to the destination | This doesn’t mean all traffic is being proxied successfully |
| The connection starts again after you turn it off manually | Settings → On Demand and the system’s automatic VPN connection settings | This behavior alone doesn’t mean the switch is broken |
When troubleshooting, noting exactly when something changes is more useful than repeatedly toggling settings. For example, record whether a system permission prompt appeared, when the connection dropped, and whether switching networks changed anything. Don’t share server authentication details, complete subscription links, or screenshots containing tokens publicly.
Global Routing: What the Four Modes Do
Go to Home → Global Routing. This controls how requests are routed and is separate from whether you have allowed a VPN configuration. On first use, check the current mode before reviewing your configuration. Proxy is not the same as system permission, and Direct does not turn off the Home connection switch.
Config
RecommendedChoose a policy according to the rules in the current configuration. The result depends on the specific rules, their order, and FINAL. Config does not automatically mean some traffic goes direct and the rest through a proxy.
Best for: Using a verified rules configuration to route requests according to their conditions.
Proxy
Routes requests handled by the client through the proxy globally, rather than using regular routing rules to select DIRECT or REJECT. Valid server details are still required, and access to remote services is not guaranteed.
Best for: Temporarily troubleshooting a proxy connection while reducing variables from rule-based routing.
Direct
Routes requests handled by the client directly. This changes where requests go; it does not revoke system VPN permission or turn off the Home connection switch.
Best for: Comparing direct access with proxy access to see whether the proxy path is causing an issue.
Scene
Routes traffic according to preset scene conditions. Check the specific Scene settings first; this mode does not automatically find a working server without configuration.
Best for: Adjusting routing to suit different environments after setting up and understanding Scene.
Here’s an example of rule syntax: the snippet below routes requests for the example domain suffix through PROXY and all other requests through DIRECT. This demonstrates only the rules section; it is not a complete configuration and includes no server details:
DOMAIN-SUFFIX,example.com,PROXY
FINAL,DIRECTRules are generally evaluated from top to bottom. The first matching rule determines the policy for a request, and FINAL handles requests that didn’t match earlier rules. DOMAIN-SUFFIX matches a domain suffix, GEOIP matches an IP geolocation, and IP-CIDR matches an address range. You don’t need to add several types of rules at once when getting started. First check that the current Config matches your expectations, then add conditions one at a time. For more verification steps, see Rules & Routing basics.
Connectivity Test and SERVER: Testing, Selecting, and Updating
Home → Connectivity Test helps diagnose connection performance; the SERVER list displays and lets you select existing servers. These serve different purposes: a test helps assess a connection under current conditions, while the selection indicator shows which entry is in use. Updating a subscription retrieves details from your existing subscription; it is not a connection test.
- Check the test method first. TCP-based tests mainly indicate whether a connection can be established. Tests that make HTTP requests are also affected by the destination address, TLS, and the response process. For meaningful comparisons, use the same method and network.
- Latency isn’t speed. The result in milliseconds measures how long that test took, not download throughput. A low result from a single test doesn’t guarantee a stable connection over time.
- A failed test doesn’t identify the cause. A timeout or failure may be related to the server address, port, network restrictions, authentication, DNS, or the test destination. You can’t determine the cause from one result alone.
- Check which server is selected. After testing several entries, check which server is actually selected in SERVER. Testing a server does not select it automatically.
- Check again after an update. Updating your existing subscription may change its entries. Confirm that the current selection is still what you expect, then check the authentication details and any policy references in your configuration.
When entering server details manually, there is no universal default port for all protocols. If your details specify port 443, enter 443; don’t change the port just because the protocol uses TLS. Shadowsocks, VMess, VLESS, Trojan, Hysteria2, and WireGuard use different authentication fields. Changing only Type while keeping fields from another protocol can cause errors.
Test by changing one variable at a time: keep the network unchanged, test the current server, then try loading an actual website. Next, switch only to another entry you already have and test again. To compare Wi-Fi with cellular, keep the server and routing mode unchanged. These are testing steps, not predictions of specific results or guarantees.
A successful Connectivity Test is one piece of diagnostic evidence, not proof that every website is accessible. Verify an actual destination website too, and check whether its requests use the intended policy.
On Demand and Config: Don’t Confuse Automatic Connections with Rule-Based Routing
After verifying your first connection, you can consider automatic connections. Settings → On Demand manages connection behavior triggered by conditions; rules in Config determine the policy applied when processing requests. The first answers “when does the connection start?” and the second “where does this request go?” They are not interchangeable.
Manual connection checks
- Connection switch
- The switch next to Not Connected on Home
- Routing mode
- Home → Global Routing → Config
- Rules configuration
- Config → The configuration file currently in use
- Test location
- Home → Connectivity Test
Verify a manual connection and access to your target first; then adjust automatic connection conditions.
On Demand check
- App section
- Settings → On Demand
- Primary function
- Triggers connection behavior based on configured network conditions
- What to look for
- The connection restarts when network conditions change after you turned it off manually
- What it doesn’t control
- It does not replace request rules such as DOMAIN-SUFFIX or FINAL
To stop automatic reconnections completely, check both the app conditions and system VPN settings.
If the first connection fails, don’t change On Demand, DNS, protocol fields, and Global Routing all at once. Even if access starts working, you won’t know which setting made the difference. First turn off any automatic triggers you don’t need and keep a repeatable set of manual test conditions. Then check the relevant layer based on the error message.
- SERVER list is empty: Return to the import steps and check that your existing connection details were saved completely.
- System permission isn’t complete: Return to Home, start a connection, and approve the system prompt and complete authentication.
- Connected, but the destination fails: Check Global Routing, the selected server, and the actual request result.
- Connection restarts after you disconnect: Check Settings → On Demand, then review the system’s automatic VPN connection settings.
A successful first-time setup means more than turning on the switch. You should be able to identify the selected server and routing mode, then verify the expected result by visiting your target. Keep this sequence in mind to follow the same checks after subscription updates or network changes.