Before using Shadowrocket for the first time, prepare your own connection details, choose a routing mode, and allow the system to add a VPN configuration. This guide focuses on iPhone and iPad, explains how Home, Config, and Settings differ, and shows how to distinguish the connection toggle, server selection, and connectivity tests. It’s for users who have installed the app and have their own provider and subscription, but haven’t connected yet.
What should you prepare before opening Shadowrocket?
You’ll need your own server details or subscription, and a device with a working internet connection. Installing the client doesn’t automatically provide a usable server, and VPN configuration permission isn’t a server account. This site does not provide, sell, or recommend nodes or subscriptions. Check your connection details with your own provider.
First, confirm the installation channel and platform. The App Store listing for iPhone / iPad names Shadow Launch Technology Limited as the developer and has app ID 932747118. Check the listing for system requirements. Mac has separate Apple Silicon and Intel versions; find links for every platform on the Download page. The system permission steps below use iPhone / iPad as an example. On other platforms, follow the prompts shown by your system.
- Existing subscription: Check that the link is complete and the account is active. Subscription links often contain personal access credentials.
- Manual setup: Have the protocol, server address, port, and authentication details ready. Additional parameters such as TLS must match the server configuration.
- Existing rules configuration: Confirm the file’s source and purpose. A server subscription and a configuration file for routing rules are not the same thing.
How do you handle the first connection and VPN configuration permission?
For your first connection, select a server, turn on the connection switch on Home, and allow the system to add a VPN configuration when prompted. This permission lets the app create a system network tunnel; it doesn’t validate your subscription or guarantee that the remote server is reachable. If you deny the request, try connecting again and follow the system prompt rather than repeatedly importing the same subscription.
-
Check your internet connection
Keep the Home connection switch off for now. Use a browser to confirm that your current Wi-Fi or cellular network can reach sites that normally work. If the network requires a sign-in page, complete that first.
-
Add your connection details
Go to Home → tap “+” in the top-right corner → Type. If you have a subscription, choose Subscribe, enter your own link, and save it. To add a server manually, choose its actual protocol and enter the corresponding details.
-
Select a server
Return to Home and select the entry you want from the SERVER list. If no servers appear after importing a subscription, check the import or update result first; an empty list doesn’t indicate a permission problem.
-
Check the routing mode
Go to Home → Global Routing. If you have a verified rules configuration, choose Config. For temporary troubleshooting, try Proxy as a comparison, and avoid changing several settings at once.
-
Allow the system configuration
Turn on the connection switch on Home. When the system asks to add a VPN configuration, allow it and complete any required authentication. Return to the app to check the status, then visit the target site to verify the result.
The system may not prompt again on a device that has already been authorized; the existing permission is being reused. If you deleted the VPN configuration in system settings, you may need to authorize it again. On iPhone / iPad, check the configuration under Settings → General → VPN & Device Management. The section names may vary by system version.
What do Not Connected and SERVER control on Home?
Not Connected indicates that the app’s VPN connection isn’t active. The SERVER list is where you manage and select servers. The first is the connection status and switch; the second contains the remote connection details. Seeing an entry in the list doesn’t mean you’re connected, and selecting one doesn’t guarantee it will work.
| Home section | What it does | What to check on first use |
|---|---|---|
| Not Connected | Shows that you’re disconnected; use the adjacent switch to connect. | Check whether the system asks for permission and whether the connection status changes. |
| Global Routing | Controls how traffic is handled after the connection is established. | Check whether Proxy, Direct, Config, or Scene is selected. |
| Connectivity Test | Tests connectivity to a server. | Review the test result; a latency number doesn’t prove that the target site is reachable. |
| SERVER | Lists server entries for you to select and edit. | Check that the selected entry, protocol, and port match your connection details. |
The server entry must use the same protocol as the server; you can’t switch protocols by changing Type at random. Shadowsocks, VMess, VLESS, Trojan, Hysteria2, and WireGuard have different authentication and transport requirements. For example, if your details specify 443, enter that value. But using port 443 alone doesn’t prove that the entry uses TLS or replace any required password, key, or certificate settings.
Handle subscription updates and server selection separately. Updating reloads the list provided by your service provider; selecting a server determines which entry is currently used. If the provider renames or removes an entry, check your selection again. Don’t share your subscription link, an edit screen containing authentication details, or a complete configuration file.
How do you choose among the four Global Routing modes?
Choose based on whether you have usable rules and what you’re troubleshooting. Global Routing determines how traffic is handled; it doesn’t change the protocol or add a server. The recommendations below assume you’ve checked and enabled the correct configuration. Without a rules configuration, selecting Config doesn’t mean traffic will be routed as expected.
Config
Recommended forHandles requests according to the rules and policies in the current configuration. Different requests may match DIRECT, a proxy policy, or REJECT; the rules determine the result.
Use when: You’ve checked the current configuration in Config and want to apply its rules for everyday use.
Proxy
Sends requests within its scope through the selected proxy. Use it to compare results and check whether rules-based routing is causing an access issue. It doesn’t mean every kind of system traffic on the device will necessarily use that proxy.
Use when: You want to test the selected server briefly or compare its results with Config.
Direct
Handles requests using a direct connection, without forwarding them through the selected remote proxy. Even if the app’s connection switch is on, that doesn’t mean sites are using a proxy.
Use when: You’re checking your basic internet connection or comparing direct access results.
Scene
Applies routing according to the configured scene conditions. Check the scene conditions and corresponding settings first; available options are shown in the app.
Use when: You’ve set up different handling for specific network environments.
In Config mode, check both that the right configuration is selected and that the rules are in the right order. DOMAIN-SUFFIX matches domain suffixes, GEOIP matches IP geolocation, IP-CIDR matches IP ranges, and FINAL assigns a policy to requests that don’t match earlier conditions. The first matching rule affects the result, so a server can pass its test while a particular domain still fails because of a rule.
Does a Connectivity Test result mean you can browse normally?
No. A test result reflects only the test method used and the network conditions at that moment. A TCP connection test and a real proxy request check different things. A latency value is neither a download speed nor proof that DNS, TLS, and access to the target site are all working. Treat it as a troubleshooting clue, then verify with an actual request.
How to troubleshoot: test the server, then try a real request
Test the server
- Go to Home → Connectivity Test, run a test, and note which test method is used.
- Check whether the selected entry returns a result or times out; don’t assume there’s a universal acceptable latency threshold.
- If several entries fail at once, check your current network and subscription details first.
Try accessing a site
- Turn on the connection and check the current selection under Global Routing.
- Visit a site you need to use and determine whether all sites fail or just one domain.
- Compare results on Wi-Fi and cellular, keeping the server and routing settings unchanged.
Takeaway: Change one condition at a time to distinguish issues with your local network, server settings, routing rules, or the target site.
Don’t delete all your configurations as soon as a test fails. If your basic internet connection is down, any server test may fail. If only one entry fails, first check its address, port, and whether the service is active. When reporting an issue to your provider, include the error message, network conditions, and whether you can reproduce it. That’s more useful than simply saying “it won’t connect.”
What do Home, Config, Settings, and On Demand each do?
Home handles everyday connections and server selection, Config manages configuration files and rules, and Settings controls app preferences. For your first use, complete a manual connection before setting up automatic connection conditions. Avoid changing rules, switching servers, and enabling automatic connections at the same time, or it’ll be hard to tell what caused a change.
- Home: Check the server, Global Routing, and connection status, and run Connectivity Test.
- Config: Check which configuration file is in use, review rule order, and verify policy references. Server subscriptions and rules configurations serve different purposes, so confirm the type of file before importing it.
- Settings → On Demand: Triggers a VPN connection when configured conditions are met. It controls when to connect; it doesn’t replace server authentication or restore an inactive server.
On Demand isn’t a fix for a failed first connection. First, test manually with automatic triggers turned off. Once the connection and browsing both work, go to Settings → On Demand and review the conditions you need. If the connection starts again after you disconnect manually, check the trigger settings here instead of repeatedly deleting the system VPN configuration.
How do you troubleshoot common first-time setup problems?
Start by grouping issues by symptom, then make only the necessary changes. The steps below cover system permissions, imported connection details, routing mode, and automatic connections separately, rather than blaming every problem on the same switch.
I tapped Don’t Allow. Can I grant permission again?
Yes. Try connecting again by turning on the switch on Home, then follow the system prompt to allow the VPN configuration. If the expected prompt doesn’t appear, check existing configurations and device restrictions under Settings → General → VPN & Device Management. On a managed device, ask your administrator to confirm the permissions.
I saved my subscription, so why is SERVER still empty?
First, check that the saved entry on Home uses the Subscribe type, then make sure your subscription link is complete and your account is active. Once you’ve confirmed that the network can reach the service, pull down on Home to refresh the subscription and check the update result. Don’t use your provider’s website login URL as the subscription link.
The switch is on, so why can’t I open any websites?
First check whether Home → Global Routing is set to Direct, then run Connectivity Test. If Proxy works but Config doesn’t, go to Config and check the current file and the rules for the target domain. If both modes fail, continue checking the server settings, your basic network connection, and the target site.
Why does Shadowrocket reconnect after I turn the switch off?
Go to Settings → On Demand and check whether automatic trigger conditions are enabled. Temporarily turn off the relevant conditions, then disconnect manually and see what happens. Also check for other system VPN auto-connect settings; turning off the Home switch alone may leave a trigger in place.
You’ve completed the initial setup when you can connect repeatedly and access the resources you need as expected—not when a button changes color or a single test returns a number. Keep a verified configuration and change one setting at a time. If something goes wrong, restore the verified settings first, then troubleshoot each item.