Shadowrocket Setup Guide

01 · Add Server / Subscribe

Open Shadowrocket and go to Home. First, identify what information you have: a complete URL that retrieves multiple server entries is a subscription; a separately provided address, port, password, or other authentication fields are server details. These are entered differently. Do not enter a subscription URL as a server address or paste your provider’s account page URL into the subscription field.

Have a subscription URL? Select Subscribe

In Home, tap the plus button in the upper-right corner to open Add Server. Open Type and select Subscribe. On the form, paste the full subscription URL from your service provider into URL. If there is a remarks field, you can enter a name to help identify it; this only changes how the entry appears in the list, not the URL itself. Check the details, tap Done in the upper-right corner, and wait for the subscription to finish fetching.

After pasting, check the beginning and end of the URL, especially any parameters after the question mark. Some URLs contain credentials. Missing part of the URL or including a line break or space can cause the fetch to fail. Copy the URL using the option provided with your subscription details; do not construct one from a webpage address. If prompted to allow pasting, confirm that you are entering your own details into Shadowrocket before continuing.

When the save is complete, return to Home and check whether server entries appear under the subscription group. Seeing a group name without any entries does not mean the import is complete. Check whether the fetch returned an error and whether the subscription contains recognizable server entries. If you already have the same subscription, update the existing entry instead of repeatedly creating groups with the same name. An update may change the list, so confirm which server is selected afterward.

Have details for one server? Enter them by protocol

Tap the plus button to open Add Server, select the protocol specified in your details under Type, and enter the server address, port, and authentication fields. Required fields vary by protocol; for example, a password, UUID, encryption method, TLS, and Server Name are not interchangeable. Use the original details rather than guessing from the protocol name. Do not disable TLS or change certificate options at random to clear an error.

If you have a server QR code for importing, use Scan QR Code and check that the detected protocol and address match the original details before saving. Treat QR codes as confidential, just like the original URL. Whichever method you use, after saving, tap the server entry you intend to use in Home and confirm it is selected before continuing.

You’re ready to continue when a selectable server appears in Home and you have selected one. Its presence in the list does not guarantee that it can connect; you’ll choose a routing mode and test access next. For the differences between Subscribe, protocols, and configuration files, see the Glossary.

02 · Global Routing

The server provides the destination details for a connection; Global Routing determines the policy for requests handled by the app. Return to Home, tap Global Routing, and check the selected mode. When setting up for the first time, don’t focus only on the server name: even with a working server selected, Direct mode or configuration rules may send a particular request outside that server.

Config: Use the active configuration

With Config selected, the app matches requests against rules in the active configuration file, then applies DIRECT, PROXY, or another defined policy. This is useful for everyday rule-based routing, but you need to know which configuration is active. Open Config and check the active item; importing a file into the list does not necessarily make it the current configuration.

You don’t need to edit rules before your first connection. If you’re unsure where the configuration came from, what its policies mean, or how its rules work, leave it unchanged and use the next mode to test the basic connection. Don’t append rules you found online to an unknown location: rule order matters, and the policies referenced by a configuration must match. See the Glossary for DOMAIN-SUFFIX, GEOIP, and FINAL.

Proxy: Test the proxy route first

With Proxy selected, connections handled by the app use the proxy policy. For an initial connection, you can use this mode temporarily to reduce the effect of custom routing rules on your test. It does not guarantee that a server is available or mean that a single test represents all traffic from every app. After selecting it, return to Home, confirm the same server is still selected, and authorize the connection.

Direct: Does not verify that a server works

With Direct selected, requests use a direct connection. This mode can help you deliberately check direct access, but it does not prove that a proxy server is working. If you’re testing a newly imported server, don’t leave Direct selected. To compare with your basic network connection, turn off the connection switch and test directly; this makes it easier to identify which layer is causing the issue.

For this step, choose one mode that matches your goal. Use Proxy to test a server first. Once the test succeeds and you’ve confirmed the active configuration, switch to Config if needed. Don’t change the server, edit the configuration, and switch modes all at once; if the test fails, it will be harder to tell what caused the problem.

03 · Connect from Home and authorize in iOS

Return to Home and check two things: the intended server is selected in the server list, and Global Routing shows the mode you just chose. Then turn on the connection switch at the top of the screen. The first time you connect, iOS may ask whether Shadowrocket can add a VPN configuration. This authorization lets the app handle connections using the system’s network features; it is separate from importing a subscription.

In the system prompt, confirm that Shadowrocket is the app making the request, read the notice, and tap Allow. Complete authentication with your device passcode, Face ID, or Touch ID as prompted. Enter your device passcode only in the system authentication screen, never in a subscription URL or server password field. If you did not authorize the request, return to the app and try connecting again. Selecting a server in the list does not grant system authorization.

After authorization, return to Home and check whether the connection switch stays on. If it switches off immediately or shows an error, resolve that issue first instead of assuming a browser access problem is caused by the server. You can check the VPN section in system Settings to see whether the configuration is present, and check for device management restrictions or another active VPN connection. If your device is managed, follow the applicable management requirements.

A VPN indicator in iOS or an app switch that stays on only shows that the connection mechanism has started; it does not prove that a particular page is using the intended policy. Status bar indicators may also vary by device. Use the real-world access test in the next step to confirm the setup instead of relying on an icon alone.

During initial setup, leave the current On Demand settings as they are; you don’t need to enable automatic connection at the same time. This makes the connection easier to observe when you turn the switch off. Once manual connection and disconnection behave as expected, review the On Demand triggers separately. On Demand controls when a connection starts; it does not replace server details, routing modes, or configuration rules.

04 · Connectivity Test and real-world access

After connecting, return to Home and run Connectivity Test on the server. The test method and target may depend on app settings, so treat the result as applying to those test conditions, not as a measure of every website. A response is a reason to continue testing. If the test times out, consider the result alongside actual access, your network, and server status; don’t delete all your configuration based on one test.

Next, open a browser and visit a page you normally use and know how it should connect. Reload it, then check whether its main content loads. An old page, cached text, or a tab that was already open is not enough to confirm that the current connection works. There’s no need to verify access on a page that asks for an account or your subscription details.

Return to Shadowrocket and check traffic changes in Data. Traffic counts can help indicate whether the app is handling traffic, but they cannot prove by themselves that a particular page used the selected server. Background apps may also generate connections, and Config may send some requests directly. If the app provides connection logs, compare the destination domain with the matched policy instead of relying only on an increase in total traffic.

If access works as expected in Proxy but only some pages behave differently after switching to Config, check the active configuration and its matching rules first. The basic server connection may already be working, so there’s no need to repeat the subscription import from scratch. If access fails in both modes, check your basic network, selected server, and authentication details one layer at a time.

Finally, turn off the connection switch and confirm that the app’s status changes, then reconnect if needed. If you plan to use Config, test the same page again after switching; don’t rely on results from Proxy. You’re done when the connection status, selected mode, and actual access results agree—not just because a test result is low.