Before using Shadowrocket, prepare your own connection configuration, then check VPN authorization, your selected SERVER, and Global Routing. Allowing a VPN configuration lets the app create a system network tunnel; it does not mean the connection is ready to use. This guide focuses on first-time setup on iPhone and iPad, explains each Home section, and walks through connecting, testing, and disconnecting.
First-time setup: distinguish the app, configuration, and system authorization
Shadowrocket is a paid client for Apple platforms, available exclusively on the App Store. The developer is Shadow Launch Technology Limited, and the app ID is 932747118. The app is sold as a one-time purchase; prices vary by App Store storefront. Buying the app and obtaining a connection service are separate matters. This guide assumes you already have your own service provider and configuration. This site does not provide nodes or subscriptions.
If no servers are available on Home the first time you open the app, that does not mean installation failed. The app needs a server address, protocol, and the corresponding authentication details. System VPN authorization is a separate requirement: it lets the app use the system’s tunneling capability, but does not fill in server addresses or authentication details for you.
Home handles connection status, server selection, and common tests. Config manages configuration files and their rules. Settings contains app preferences such as On Demand. Identify these three sections before changing options to avoid confusing a server switch with a routing-rule change. Compatibility with Mac, Apple TV, and Apple Vision, as well as system requirements for all devices, is listed on the App Store page. The system settings paths in this guide use iPhone and iPad as examples.
VPN permission: what happens when you allow it
During first-time setup, the app needs permission to add a VPN configuration. The prompt usually appears when you first try to connect, rather than immediately when you open Home. The system asks you to confirm and may require device authentication to complete authorization. Check that the prompt was triggered by the Shadowrocket app you just opened, then follow the system instructions.
Once allowed, the system saves a configuration for establishing a VPN connection. This system configuration is different from the rule configuration files on the Config screen: the former records system network permission and connection details, while the latter determines how the app handles requests. Authorization does not mean all requests are routed through the selected server, nor does it confirm that server authentication succeeded.
-
Prepare a configuration
Go to Home and check that your own server entry is available. To add one manually, tap “+” in the upper-right corner to open Add Server, then choose a Type and fill in the fields using your existing details.
-
Select a server
Return to Home → SERVER and select the entry you want to use. Confirm your selection before operating the connection switch at the top of Home.
-
Confirm system authorization
The first time you turn on the connection, if the system asks to add a VPN configuration, verify the prompt’s source, allow it, and complete any required device authentication.
-
Check the connection status
Return to Home and check whether the status has changed. If it still says Not Connected, first confirm authorization is complete, then check the selected entry’s address, port, and authentication details.
Home screen sections: switches, servers, and tests
Not Connected at the top of Home indicates the current connection status; it is not a server name. Turning on the connection switch asks the app to establish a tunnel. Turning it off asks the app to end the connection. The selected entry under SERVER provides the connection parameters. These serve different purposes and cannot replace one another.
Connection and routing
- Not Connected
- Indicates that no connection is currently established.
- Connection switch
- Starts or stops the app’s VPN connection.
- Global Routing
- Choose Proxy, Direct, Config, or Scene as the routing method.
The switch controls connection status; Global Routing controls how requests are handled.
Server entries and tests
- SERVER
- Lists available server entries and shows the current selection.
- Connectivity Test
- Checks connectivity for an entry using the current test settings.
- Add Server
- Tap “+” in the upper-right corner of Home, then add an entry by Type.
Test results can help troubleshoot, but do not replace checking actual requests.
When adding an entry manually, its Type must match your existing configuration. Shadowsocks, VMess, VLESS, Trojan, Hysteria2, and WireGuard use different fields. Changing the Type while keeping authentication details from another protocol will not work. Check the address, port, password, key, TLS, and transport settings against the original configuration. Do not guess default values based on the protocol name.
If you already have a subscription, tap “+” in the upper-right corner of Home to open the add screen, select Subscribe as the Type, then enter your own subscription URL and save it. Updating a subscription refreshes the server entries; it does not grant system VPN permission again. After updating, confirm which entry is selected. Subscription URLs may contain sensitive tokens, so do not share the full URL publicly when troubleshooting.
Global Routing: choosing a mode for your first connection
Go to Home → Global Routing and decide whether to use rules or temporarily isolate the connection for troubleshooting. The recommendation below assumes you have obtained and verified a valid configuration file. If Config does not yet have ready-to-use rules, selecting Config will not configure them automatically.
Config
RecommendedHandles requests according to the currently enabled configuration file. Whether a request matches DIRECT, a proxy policy, or another action depends on your actual rules and policy settings—not a fixed geographic split.
Use when: You have a configuration you can verify and want requests handled according to its rules.
Proxy
Routes requests handled by the app through the proxy, which can temporarily remove rule-based routing as a variable. It does not fix incorrect server parameters or guarantee that all system traffic passes through the proxy.
Use when: Checking the server connection or comparing results with actual access under Config.
Direct
Handles requests taken over by the app using a direct connection. Selecting Direct is not the same as turning off the Home connection switch; check the system VPN status separately.
Use when: Comparing direct-access results while keeping the app connected.
Scene
Uses configured scene conditions to select the corresponding handling method. Before using this for the first time, check the scene conditions and linked settings. It does not automatically detect or fix connection problems.
Use when: You have configured scenes and understand what triggers each one.
In Config, DOMAIN-SUFFIX matches domain suffixes, IP-CIDR matches address ranges, GEOIP matches against an IP geolocation database, and FINAL provides a fallback. Rule order and policy targets both affect the result. For an initial connectivity check, keep the server and routing mode fixed. Avoid changing rules, DNS, and protocol settings at the same time, or it will be hard to tell what changed the result.
Connectivity Test: how to interpret the results
Connectivity Test checks server entries using the current test method; it does not measure download speed. Different test methods check different parts of the connection. For example, a TCP test mainly checks connectivity to the endpoint and cannot, by itself, confirm that protocol authentication or web access is working. Before comparing test results, keep the test method, local network, and selected entry the same.
- A response time appears, but web pages still fail: The tested step received a response. This does not confirm that DNS, TLS, rule matching, and access to the destination site are all working. Check the routing mode and protocol settings used for the actual request.
- The test times out: First confirm that your local network is working, then check the server address, port, and current test method. One timeout alone cannot identify which end of the connection is at fault.
- Results change after switching networks: Keep the same entry and test method, then compare Wi-Fi with cellular. A change suggests local network conditions may be a factor, but check subsequent connection records before drawing a conclusion.
- Low latency, but transfers are still slow: Latency and sustained throughput are different metrics. One latency figure cannot summarize large file transfers, video buffering, or the time it takes a web page to load for the first time.
For a test you can reproduce, note the network type, server entry, Global Routing option, test method, and what you observed. For example, “TCP test responds on the same Wi-Fi, but the target page fails under Proxy” is more useful for troubleshooting than “the switch doesn’t work.” You can record what happened without including passwords, keys, or the full subscription URL.
On Demand: what to check if the connection comes back after disconnecting
On Demand triggers connections based on conditions and is found under Settings → On Demand. It works differently from the manual connection switch on Home: On Demand uses automatic trigger conditions, while the switch starts or ends a connection at your request. For first-time setup, complete a manual connect-and-disconnect check before configuring On Demand for your needs.
- Turn off the connection switch on Home and check whether the status returns to Not Connected.
- If the app reconnects afterward, go to Settings → On Demand and check whether it is enabled and whether its current conditions trigger a connection.
- To rule out automatic triggers, turn off On Demand first, then return to Home and repeat the manual connect-and-disconnect steps.
- Also check the current app connection under the system’s VPN settings. Do not rely only on the status bar indicator to tell which configuration is in use.
Checklist after first-time setup
First-time setup is complete when you can explain which server is selected, which routing mode is in use, what system permissions are granted, and what the test results mean—not just when the switch is on. If a step fails, check the corresponding part instead of deleting all your configurations and starting over.
- App source: Shadowrocket was obtained from the App Store, and the developer and app ID have been verified.
- Connection details: SERVER contains a valid entry of your own, and its protocol Type matches the original configuration.
- System authorization: Permission to add the VPN configuration has been granted, and the system entry corresponds to the current app.
- Routing mode: You know whether Global Routing is set to Proxy, Direct, Config, or Scene. If using Config, you know which configuration file is enabled.
- Test limitations: You can distinguish a Connectivity Test response from successful access, and you do not mistake latency for download speed.
- Automatic connections: You know whether Settings → On Demand is enabled, and the behavior after manually disconnecting matches the conditions you configured.
When changing DNS, rules, or protocol settings later, change only one category at a time and keep the original value so you can revert. This helps narrow down the issue instead of changing servers, updating subscriptions, and rewriting rules all at once with nothing to compare.