For your first Shadowrocket setup, get the app, import an existing subscription from your service provider, choose a node, check Global Routing, then connect. This guide uses Home, Config, and Settings on iPhone and iPad to answer 10 common questions. On other platforms, check the corresponding settings rather than assuming the mobile controls are in the same place. By the end, you’ll be able to distinguish app access, subscription management, rule-based routing, and connection authorization—and use what you observe to troubleshoot problems.
1. Can I connect as soon as the app is installed, and what does the app fee cover?
No. Installing the app alone doesn’t mean you can connect. Shadowrocket is a closed-source commercial app that reads connection settings, creates a local network tunnel, and applies rules. A remote connection also requires valid service details that you already have. Buying the app does not include a network service plan. Get subscriptions from your service provider; this site does not provide, sell, or recommend nodes or subscriptions.
There are two ways to get Shadowrocket: the iPhone / iPad app costs a one-time $2.99 on the App Store; check the App Store listing for system requirements. The Mac (Apple Silicon and Intel), Windows, Android, and Linux versions are free, with installers available from this site. Find links for every platform on the Get the app page. Before installing on iPhone / iPad, verify the developer, Shadow Launch Technology Limited, and app ID 932747118.
2. Where is the connection switch, and what should I do first?
On iPhone / iPad, the main connection switch is at the top of Home. Selecting an item in the node list only chooses the connection target; it doesn’t start a connection. Check the switch and the system’s connection status to confirm that the tunnel is on. If the list is empty, import a subscription first rather than repeatedly toggling the switch.
-
Import a subscription
Go to Home → tap “+” in the upper-right corner → Type → Subscribe. Enter a subscription URL from your service provider, check it, and save.
-
Choose a node
Return to Home, expand the subscription group, and select an imported node. Its name identifies the entry; it doesn’t indicate connection quality or current availability.
-
Check routing
Go to Home → Global Routing. Choose Config if you already have a trusted, enabled ruleset. If you haven’t verified your rules yet, use Proxy temporarily to test the node connection.
-
Connect
Return to Home, turn on the connection switch at the top, and approve the system prompt. Then open a website to verify access rather than relying only on a node-test result.
If the system shows a connection but websites won’t load, note the selected node, Global Routing option, and failing domain before proceeding with the troubleshooting steps below. This helps distinguish a remote connection failure from unexpected local rule selection—and avoids changing several settings at once without a clear comparison.
3. What does the first VPN authorization prompt mean?
VPN authorization lets Shadowrocket create a network tunnel configuration in the system to receive traffic from your device and process it according to your current settings. It isn’t a prompt to buy a subscription, and it doesn’t mean every request has reached a remote server. You still need valid connection details and routing settings.
- You just turned on the connection: Check that the prompt is for Shadowrocket, then follow the system steps to allow the configuration. You may need to enter your device passcode or authenticate.
- You previously tapped Deny: Return to Shadowrocket’s Home screen, turn on the connection again, and check whether the system displays the authorization prompt again.
- Your device is managed by an organization: If system policy prevents adding a VPN configuration, ask your device administrator about permissions. Don’t repeatedly delete other system configurations.
- You’re using another network tunnel: Stop any other active VPN connection, then test Shadowrocket on its own to avoid mistaking one tunnel replacing another for a connection failure.
4. Which of the four Global Routing options should I choose?
For everyday use, choose Config if it contains enabled rules that meet your needs. Global Routing determines how traffic is handled; it’s separate from the node selected on Home. Config doesn’t mean “route everything through the proxy”—rules with DIRECT still connect directly.
Config
RecommendedMatches destinations against the rules in the current configuration, then applies the matching policy: PROXY, DIRECT, or REJECT. Unmatched traffic goes to the fallback rule.
Use it when: You have a ruleset and want to handle traffic differently based on its destination.
Proxy
Sends traffic that this mode can handle through the proxy path. Use it to temporarily rule out rule selection as the cause; it won’t fix incorrect node settings or an unavailable remote service.
Use it when: You want to test a node briefly and compare results with Config.
Direct
Uses a direct connection without the selected remote proxy. If a destination works with Direct, that doesn’t mean the proxy node has recovered.
Use it when: You want to check whether the same destination is reachable over your local network.
Scene
Uses the configured scene conditions and their associated policies. Scenes must be set up in advance; selecting this option won’t create rules suited to your current network.
Use it when: You’ve configured different behavior for different network environments.
5. How do I import a subscription, and why didn’t anything change after updating it?
A subscription is a set of connection entries returned by a server, not an ordinary web address. To import one, go to Home → “+” → Type → Subscribe. Enter the full URL, save it, then return to Home and check the group. To update it, pull down on the subscription list on Home and check whether the group successfully retrieved its contents.
- Can’t retrieve it: Check whether a messaging app truncated the URL, whether it has extra spaces at either end, and whether your current network can reach the subscription server.
- Retrieved but can’t parse it: Make sure you copied a subscription URL for Shadowrocket, not your service provider’s login or order page.
- Update succeeded, but the names are unchanged: The server may not have changed the entries. An update doesn’t necessarily add nodes or change their displayed names.
- Old nodes still don’t work: Refreshing the subscription list and restoring a node are separate tasks. Check your service status, authentication details, and subscription term.
Keep the original group while troubleshooting. Don’t repeatedly import the same URL instead of updating it, or you may create duplicates. Subscription URLs often contain access credentials. When contacting your service provider, share the error text and when it occurred; don’t show the full URL, QR code, or authentication details in public screenshots.
6. Why won’t a website load even though the node test shows a result?
A test result applies only to the test method and target used; it doesn’t prove that every website, protocol, or port is available. Start with one failing domain and reproduce the issue on both Wi-Fi and cellular, changing only one variable at a time. The steps below are troubleshooting paths, not a claim that any particular service has been tested.
Troubleshooting: separate local network issues from proxy-path issues
Fails on only one network
- Keep the same node, domain, and Global Routing option.
- Switch between Wi-Fi and cellular, and check whether the failure follows the network.
- On public Wi-Fi, complete any web-based sign-in first. The node test may fail until you do.
- Tell your service provider which network you’re using and what error you see. Don’t change protocol settings you don’t recognize.
Fails on both networks
- Temporarily compare Proxy and Config to see whether the issue is due to a difference in rule routing.
- Try another node in your existing subscription and see whether the problem follows that node.
- If domain resolution fails, check DNS settings. If the connection times out, check the remote address and port.
- For authentication errors, check your credentials and subscription status before repeatedly switching local networks.
If only Config fails, check the rules first. If the same node also fails with Proxy, check the connection settings and network reachability.
7. What’s the difference between Config and Subscribe, and how do I read rules?
Subscribe is mainly for retrieving node entries; configurations in Config organize rules and related settings. Refreshing a subscription doesn’t update the rules currently in use, and downloading a configuration doesn’t mean it’s enabled. Before choosing Global Routing → Config, open Config to confirm which configuration is selected, then check the rule order and policy names.
Rules that match destinations
- DOMAIN-SUFFIX
- example.com,PROXY
- IP-CIDR
- 192.168.0.0/16,DIRECT,no-resolve
- FINAL
- PROXY
A complete rule uses a comma between the rule keyword and its parameters. See the code example below for the order.
What to check when reading rules
- GEOIP
- CN,DIRECT
- Match order
- Specific rules first; FINAL last
- Policy meanings
- PROXY: use the proxy; DIRECT: connect directly; REJECT: deny
GEOIP matches using IP geolocation data; it doesn’t classify traffic by website language or domain suffix.
[Rule]
DOMAIN-SUFFIX,example.com,PROXY
IP-CIDR,192.168.0.0/16,DIRECT,no-resolve
GEOIP,CN,DIRECT
FINAL,PROXYThis example illustrates the syntax; it isn’t a complete configuration. DOMAIN-SUFFIX matches the specified domain and its subdomains. IP-CIDR matches an address range; no-resolve means not to perform an additional DNS lookup just to match that rule. FINAL handles traffic that hasn’t matched an earlier rule. Existing configurations may use custom policy groups, so check the group names before replacing an entire ruleset.
8. Do I need to choose a protocol like Shadowsocks or VMess myself?
Nodes imported correctly from a subscription usually already include their protocol type and connection settings, so beginners should leave them unchanged. Shadowsocks, VMess, VLESS, Trojan, Hysteria2, and WireGuard are different protocols or tunneling approaches—not speed settings you can freely switch for the same node. Your local settings must match the solution used by the server.
| Setting category | What to check | Common mistake |
|---|---|---|
| Address / Port | Server address and listening port | Changing every node’s port to 443 |
| Authentication details | The password, identifier, or key required by the protocol | Treating credentials in the subscription URL as the node password |
| TLS settings | The domain and certificate verification requirements set by the server | Turning off verification as soon as a certificate error appears |
| Transport settings | The transport method and additional fields that match the server | Assuming all transport settings from the protocol name alone |
For example, 443 is a common HTTPS port, but setting a node’s port to 443 doesn’t prove that its protocol is HTTPS or that the remote server uses TLS. If fields are missing after parsing or authentication fails, get the correct settings from your service provider and check them against what your platform supports. Don’t guess based on other nodes.
9. Should I turn on On Demand, and why does the connection come back after I turn it off?
Get manual connections working reliably before setting up automatic connections. On iPhone / iPad, go to Settings → On Demand to trigger connection behavior based on configured network conditions. On Demand and Global Routing do different things: the former controls when to connect; the latter controls how traffic is handled after connecting.
- Go to Settings → On Demand and check whether automatic connection is enabled and which network conditions trigger it.
- To troubleshoot automatic reconnection, pause On Demand first, then return to Home and turn off the connection switch. Check whether it still reconnects.
- If something else still starts the connection, check the system’s VPN configuration, automation tasks, and device management policies. Don’t assume the node is at fault.
- Before restoring automatic connections, test your usual Wi-Fi and cellular networks separately. Avoid conditions that keep triggering a connection on your current network when it can’t connect successfully.
10. What should I keep before switching devices, updating a subscription, or asking for help?
Nodes, subscriptions, rule configurations, and system VPN authorization are separate types of data. On a new device, verify local authorization again; a working connection on your old device doesn’t mean the new one is fully configured. Even if you copy the same subscription, check your existing service terms to confirm whether simultaneous connections are allowed.
- Keep a copy of your configuration: Before editing Config, save the original file or a copy. Note the currently enabled file and Global Routing option so you can roll back if needed.
- Keep a record of your subscription source: Store the subscription URL from your service provider securely. Don’t save full credentials in public documents.
- Record the scope of the problem: Note the device platform, whether you’re on Wi-Fi or cellular, one failing domain, when it happened, and whether the results differ between Proxy and Config.
- Share redacted details: Keep the error text, but hide URL query parameters, passwords, keys, and QR codes. Don’t upload a complete configuration that contains credentials.
- Restore settings in order: On a new device, import the subscription, choose a node, connect manually, enable the rules configuration, and restore On Demand last. Verify each step as you go.
If you can check only one thing, start by confirming that the selected node is available, Global Routing is set as expected, and the intended Config is actually enabled. These correspond to the connection target, routing mode, and rules. Recording all three usually helps pinpoint the problem more than repeatedly deleting subscriptions.