This guide is for users who have installed Shadowrocket and are ready to use their own connection details. First, distinguish system VPN authorization from server settings. Then learn what the Home screen’s connection switch, SERVER list, Global Routing, and Connectivity Test do. Finally, compare manual connections with On Demand to troubleshoot your first connection. By the end, you should be able to tell whether an issue lies with authorization, configuration, connectivity, or routing rules.
First connection: prepare your configuration, then approve VPN access
Shadowrocket is a paid app for Apple platforms, primarily used on iPhone and iPad. It is available exclusively on the App Store. After purchasing the app, you’ll still need your own subscription or server details. This guide does not provide, sell, or recommend servers or subscriptions. Check the App Store listing for system requirements and device compatibility.
The prompt to add a VPN configuration is a system permission request that allows Shadowrocket to create a network tunnel on your device. It is not a remote server login prompt and does not automatically provide a working connection. The prompt may not appear as soon as you open the app; it usually appears the first time you try to connect and the system needs to create a VPN configuration.
-
Check the app
Open Shadowrocket after installing it from the App Store. To verify the purchase listing, visit the official app verification page and confirm that the developer is Shadow Launch Technology Limited and the app ID is
932747118. -
Prepare your details
On Home, tap “+” in the top-right corner to open Add Server, then choose a Type that matches your existing details. If entering them manually, check the server address, port, and authentication fields one by one. To use a subscription you already have, choose Subscribe and enter your own URL. After saving, make sure an entry appears in SERVER.
-
Connect manually
Return to Home, select the entry you want to test, and turn on the switch next to Not Connected. For your first test, connect manually and leave Settings → On Demand off.
-
Allow the configuration
When the system asks to add a VPN configuration, confirm that the request is from Shadowrocket and tap Allow. If prompted for your device passcode or authentication, follow the system instructions. Do not enter your device passcode in a server password field.
-
Check the connection
Return to Home and see whether the connection status has changed, then run Connectivity Test and try accessing your intended destination. If you denied permission, turn the connection switch on again so the app can retry creating the configuration.
Home, Config, Settings: know what each section does
Home is for everyday connections and server selection. Config manages rule configuration files. Settings contains app behavior and testing options. Subscription entries and rule configurations serve different purposes: the former provide server details, while the latter determine how connections match rules and which policies apply. Seeing a server on Home does not mean a rule file is enabled or configured correctly.
Not Connected: connection status and switch
Not Connected means the app’s VPN connection is not currently established; it is not a specific error indicating that a subscription has expired. If the status doesn’t stay connected after you turn on the switch, first check that authorization is complete, then verify the selected server details. Even when the system shows a VPN connection, the remote server may still be unreachable, DNS resolution may fail, or the routing rules may not behave as expected.
SERVER: choose the server entry to use
The SERVER section contains your server list and subscription groups. For your first test, make sure you know which entry is selected. Otherwise, you might change the port on entry A while continuing to connect through entry B. Updating a subscription refreshes the server list; it does not start a connection or switch the rule configuration file on the Config screen.
- The list is empty: Check whether you’ve saved a server entry or whether the subscription was parsed successfully. Repeatedly approving the VPN configuration won’t populate the list.
- Entries are listed, but none connect: Check the address, port, and protocol authentication fields for the selected entry. Don’t rely on its display name alone.
- The list changed after a subscription update: Confirm which entry is selected and check whether its details changed with the update.
Global Routing: what the four options do
Global Routing determines how traffic is routed. When troubleshooting for the first time, check “Is the VPN switch on?” separately from “Where does traffic go?” Turning on the connection switch does not mean every request will pass through the selected proxy server. The options below apply to Shadowrocket itself; choosing Config assumes you already have a rule configuration you’ve checked.
Config
RecommendedRoutes connections according to the rules and policies in the active configuration. A match may resolve to DIRECT, a proxy, or a policy group. Requests that don’t match are handled by fallback rules such as FINAL, so it’s not safe to assume that everything else goes direct.
Use when: You have a working rule configuration and want to route traffic by rule in everyday use.
Proxy
Routes all traffic through a proxy. This can help temporarily narrow down whether rules are affecting the result. It won’t fix an incorrect UUID, password, port, or TLS setting, nor does it prove that every network request will succeed.
Use when: Comparing with Config to find out whether rule selection is causing the issue.
Direct
Routes all traffic directly. Even if the VPN is connected, a successful visit in this mode does not prove that the selected proxy server works.
Use when: Establishing a direct-connection baseline on your current local network.
Scene
Applies routing behavior based on configured scene conditions. It depends on scenes you’ve set up in advance and is not a button for automatically fixing connection problems. If you haven’t configured a scene, start with a manual option you can interpret.
Use when: You’ve configured scenes and want routing behavior to change for specific conditions.
In Config mode, rules are generally evaluated from top to bottom. For example, DOMAIN-SUFFIX,example.com,DIRECT routes matching domain suffixes through DIRECT. A FINAL,DIRECT rule at the end sends connections that didn’t match earlier rules directly. Here, example.com is only an example to explain the syntax, not a complete configuration to import. When troubleshooting, also check whether rules such as GEOIP or IP-CIDR match before the rule you’re testing.
Connectivity Test: compare test results with real-world access
Connectivity Test checks reachability, but interpret the result in the context of the test target and method. A latency value beside an entry, a successful test, and a webpage that opens once each describe a result under specific conditions. They are not interchangeable and don’t individually prove that every entry in a subscription works.
For your first test, keep the network, server entry, and target fixed, and change only one setting at a time. If you change Wi-Fi, the server, and Global Routing all at once, you won’t know which change restored access.
| What you see | Check first | Next step |
|---|---|---|
| The switch turns on, then immediately returns to disconnected | VPN authorization, system restrictions, and whether the configuration was created | Confirm that you approved the system prompt, then return to Home and try again. |
| Latency appears in the list, but the target website won’t load | Test method, Global Routing, DNS, and reachability of the target | Note the test target, then compare Proxy and Config on the same network. |
| Proxy works, but Config fails | The active rule file, matching policy, and policy group selection | On Config, confirm which file is active and check the rules for your target, including FINAL. |
| The connection only fails after switching networks | Network sign-in requirements, network restrictions, and address reachability | First confirm that the network itself has internet access, then repeat the test with the same server entry. |
When entering server details manually, use the port specified in your existing details. For example, if the original information explicitly says 443, check that the app also uses 443. Don’t change an arbitrary port to 443 just because TLS is enabled. Likewise, a VMess UUID, VLESS flow, and Trojan password and TLS settings each serve a different purpose. Don’t apply fields from one protocol to another.
On Demand: connect manually first, then configure automatic triggers
Settings → On Demand controls when a VPN connection starts automatically. It’s a different setting from Global Routing: On Demand determines when to connect, while Global Routing determines how traffic is routed during the connection. Verify a manual connection first to avoid automatic triggers obscuring what happens when you operate the switch.
Recommended order: test manually first, then enable automatic triggers
First, test manually
- Turn off automatic triggers in Settings → On Demand.
- Go to Home and select a server whose details you’ve checked.
- Connect manually, then complete system authorization and test access.
- Note which Global Routing options work and what network you’re using.
Set up automatic connections
- Once manual connections are stable, go to Settings → On Demand.
- Check your existing trigger conditions, then enable the behavior you need.
- Test what happens when you switch networks and when you disconnect manually.
- If the connection unexpectedly starts again, turn off automatic triggers before testing further.
Confirm that the server and routing work before checking whether automatic triggers behave as expected. Don’t use On Demand as a substitute for troubleshooting connection problems.
If the connection starts again just after you turn it off, first check whether On Demand is still active. If your device also uses organization-managed network policies, check those restrictions too. Don’t remove every system VPN configuration just to stop one automatic reconnection. Identify which setting triggered it, then address that setting.
Common questions when getting started
I tapped Don’t Allow. Do I have to reinstall the app?
Return to Home and turn on the connection switch again, then approve the system prompt when it appears. If no prompt appears or the configuration still can’t be created, check existing configurations and management restrictions under Settings → General → VPN & Device Management. Reinstalling the app is not a standard first step.
Why is SERVER still empty after I approved the VPN configuration?
VPN permission doesn’t provide server details. On Home, tap “+” in the top-right corner to add your existing details, or import your own subscription. Make sure the entry is saved or the subscription returns entries that can be parsed, then select a server and connect.
It says connected. Why doesn’t my traffic seem to use the proxy?
On Home, open Global Routing and make sure it isn’t set to Direct. If you’re using Config, check whether the target matches a DIRECT rule or another direct-routing policy. You can temporarily switch to Proxy and test the same target for comparison, then restore your intended mode.
Where should I look if it reconnects after I turn it off?
Go to Settings → On Demand and turn off automatic triggers, then return to Home, disconnect, and observe what happens. If it no longer reconnects, the trigger conditions are responsible, not a faulty connection switch. Check each condition before enabling them again.
Can I send my subscription URL and screenshots when asking for help?
First, hide subscription tokens, UUIDs, passwords, private keys, and authentication details in QR codes. You can share the protocol type, port, Global Routing option, whether authorization succeeded, what happened during the test, and the network type. Sharing the original subscription URL may expose access credentials.
You haven’t finished first-time setup just because a VPN icon appears. Confirm that system authorization is complete, the intended server entry is selected, the routing mode is clear, and access to your target behaves as expected. When you later change rules, update a subscription, or enable On Demand, check each layer separately to pinpoint what changed.