Shadowrocket First-Time Setup: VPN Permissions and the Home Screen Guide

Before connecting: distinguish the app, connection details, and configuration files

Shadowrocket is a closed-source commercial app available as a one-time purchase through the App Store. Buying the app does not include a connection service. The steps below assume you already have your own provider and subscription, or valid connection details. This site does not provide, sell, or recommend nodes, subscriptions, or connection services.

When obtaining the app, verify the developer is Shadow Launch Technology Limited and the app ID is 932747118. This guide focuses on iPhone and iPad. Compatibility and system requirements for Mac, Apple TV, and Apple Vision are as listed on the App Store page. The App Store is the only place to get the app. For verification steps, see the App authenticity guide.

Home shows connection status, lets you select a server entry, and provides testing tools. Config is where you manage configuration files; to understand rule-based routing, check which configuration is active. Settings is where you adjust app preferences, such as Settings → On Demand. A server entry on Home and a rules configuration in Config are different things.

VPN permission: allowing a system connection configuration

The system prompt to allow a VPN configuration usually appears when you first try to connect; it does not necessarily appear as soon as you open the app. After you tap Allow, the system may ask you to confirm with your device passcode or another supported authentication method. This gives Shadowrocket permission to create a system VPN configuration for handling network traffic.

Approval only means the system can create the configuration. It does not confirm that your remote connection details are correct or that websites are reachable. How traffic is handled still depends on Global Routing, the selected server, the active rules, and related network settings.

1. Prepare your connection details

   Make sure you already have your own subscription URL or complete connection details. If Home → SERVER is empty, import your details before trying to connect.

2. Import an existing subscription

   Go to Home → tap “+” in the top-right corner → Type → Subscribe. Enter your own subscription URL and save. Wait for the content to load, then check that the expected entries appear under SERVER.

3. Check the selected entry

   On Home → SERVER, select the entry you want to use. Check its name and the source of the connection details; the presence of an entry alone does not mean the configuration is complete.

4. Connect and approve

   Use the connection switch at the top of Home. When the system asks to add a VPN configuration, tap Allow and complete any required authentication.

5. Return and check the status

   Go back to Home and see whether Not Connected changes to Connected. Then run Connectivity Test and try opening a website, recording each result separately.

If you previously denied permission, return to Home and try connecting again, then respond to the system prompt. If your device is managed by a school or organization, device policies may restrict VPN configurations. Check with the administrator rather than repeatedly changing server details.

Home status and SERVER: one controls the connection, the other selects a target

Not Connected means the app tunnel is not connected. After it changes to Connected, check separately whether the destination website is reachable. VPN status and a website’s HTTP response are different checks; one cannot stand in for the other.

SERVER lists server entries you have imported or added manually. The selected entry is the target used when traffic needs to be proxied, but it does not mean all traffic will go through that target. Whether it is used also depends on Global Routing and the configuration rules.

When adding an entry manually, Type must match the protocol in your connection details. Authentication and transport fields for Shadowsocks, VMess, VLESS, Trojan, Hysteria2, and WireGuard are not interchangeable. For example, if your details specify port 443, enter that value as given. However, 443 is not a fixed port for every protocol or service, and the port alone does not identify the protocol.

Global Routing: choose a traffic-handling mode first

Go to Home → Global Routing and check the current selection before interpreting test results. The comparisons below describe differences between Shadowrocket’s own modes. Config assumes you already have a configuration and have checked its contents; not every configuration is ready to use as-is.

In Config mode, rules are generally checked in order. These examples illustrate rule syntax; they are not a complete configuration file. example.com is a sample domain. Place FINAL after the preceding rules to handle requests that do not match any of them.

[Rule]
DOMAIN-SUFFIX,example.com,DIRECT
GEOIP,CN,DIRECT
IP-CIDR,192.168.0.0/16,DIRECT
FINAL,PROXY

• DOMAIN-SUFFIX matches a domain and its subdomains.
• GEOIP matches based on the geographic database result for the destination IP; it does not determine a match based on the webpage’s language.
• IP-CIDR matches the destination IP’s network range. In this example, 192.168.0.0/16 is a private address range.
• FINAL,PROXY sends requests unmatched by earlier rules to PROXY. If the actual configuration uses DIRECT instead, the result will be different.

Connectivity Test: a test result does not guarantee a website is reachable

Home → Connectivity Test runs a connectivity test. Interpret the result in light of the selected test method and target. A latency value alone cannot confirm that DNS resolution, the TLS handshake, the website response, and routing rules are all working correctly.

For example, if the test returns a time in milliseconds but the browser keeps waiting, record it as “test responded, website access failed” rather than concluding that the entire connection is working. Conversely, a timeout in one test does not by itself prove that all websites are unreachable.

1. Note the current Home status, Global Routing selection, and selected SERVER entry.
2. Run Connectivity Test and note whether it responds, times out, or shows an error.
3. In a browser, try a destination you are authorized to access. Check whether the problem affects one website or several.
4. If access fails only in Config mode, save your current settings, temporarily switch to Proxy for comparison, then restore the original mode after testing.
5. If several domains fail, check DNS-related settings in the active Config, your network environment, and your connection details. Do not replace the entire configuration at once.

When sharing troubleshooting details, include the error message, time, and steps taken. Redact tokens in subscription URLs, authentication passwords, and private keys; these fields may give others direct access to your connection details.

Subscription updates and On Demand: check each separately after your first connection

A subscription provides a way to retrieve a set of server entries. Updating it fetches those details again; it does not update the app or refresh the rules file in Config. Import your own original URL. https://example.com/sub?token=xxxx is only a format example and cannot be used to connect.

After the initial import or a later update, check that the SERVER entries look right and that the selected entry still works. An update may change names, details, or available entries. Seeing “Update complete” does not replace running a new connection test.

• Before updating: Make sure your subscription URL is complete, with no missing query parameters or extra spaces.
• After updating: Go to Home → SERVER, confirm the selected entry again, then run Connectivity Test.
• Before enabling automatic connections: Connect successfully by hand first, then go to Settings → On Demand and check the trigger conditions.
• To troubleshoot automatic reconnections: Temporarily turn off On Demand and test manually. Restore it afterward if needed.

On Demand lets the system start a connection under specified conditions. It does not fix a server address, authentication fields, or DNS settings. If the connection comes back after you turn it off manually, first check this setting and any automatic connection behavior from other system VPN configurations. Do not immediately delete an existing subscription.

First-time setup FAQs: choose the next step based on what you see