This guide is for users who have installed Shadowrocket, have their own provider and subscription, but haven’t completed their first connection. Follow the steps in order—check the configuration, select a server, allow the VPN configuration, run Connectivity Test, and verify actual access—to distinguish between an imported server, an active system tunnel, and a successful request.
1. Before Connecting: Prepare the App and Connection Service
Shadowrocket is a closed-source commercial app for Apple platforms, primarily used on iPhone and iPad. It is available exclusively on the App Store. On the product page, verify that the developer is Shadow Launch Technology Limited and the App ID is 932747118. Refer to the App Store page for system requirements.
A one-time app purchase is not a service plan. The one-time purchase grants access to the client only. Get server addresses, authentication details, and subscription information from your provider. This guide assumes you already have those details; you don’t need to switch subscription providers just to run a test.
- First, make sure your current Wi-Fi or cellular network can access ordinary websites. If the Wi-Fi network requires a sign-in, complete it first.
- Open Home and make sure the list contains available servers. If you see a subscription group name but no server entries when you expand it, check whether the subscription update completed successfully.
- Check the server address, port, and protocol provided by your service provider. Don’t swap the Type for entries such as Shadowsocks, VMess, VLESS, or Trojan just because their names look similar.
- Temporarily stop any other tasks using a system VPN connection to prevent another connection from changing state during the test.
If the Home list is empty, tap “+” in the upper-right corner of Home to open Add Server, then choose the appropriate Type using the details you have. To import a subscription, select Subscribe, enter the link from your provider, and save. Then confirm that the servers appear in the list. Subscription links often contain personal credentials; don’t include them in public screenshots or chat logs.
2. Select a Server on Home, Then Turn On the Connection
A server appearing in the list doesn’t mean it’s selected for the current connection. For your first connection, tap the server you want to use and confirm the selection dot appears beside it. Opening the details to edit parameters and selecting a server for the connection are separate actions. Follow the steps below in order, and don’t switch between multiple servers before checking their settings.
-
Check the Entry
On Home, expand the subscription group and find the server you want to use. Open its details to check the address, port, and Type, then save and return to the list. Don’t enter a subscription URL as an individual server address.
-
Select a Server
Tap the server entry you want to use and confirm that it shows the selection dot. If you’ve just changed a configuration or updated a subscription, check again to make sure you’re testing the intended server.
-
Check Routing
Go to Home → Global Routing and check the current mode. If you have a usable rules file, you can use Config. To rule out routing effects, temporarily select Proxy for a comparison test, and note the original mode.
-
Turn On the Connection
Return to Home and turn on the connection. When the system first asks to add a VPN configuration, confirm that the request was triggered by your current Shadowrocket action, then allow it and complete any device authentication required by the system.
-
Check the Status
Return to Home and make sure the connection doesn’t switch off immediately, then run Connectivity Test. Don’t enable automatic switching or change DNS yet, so you can tie the result to the server you just selected.
3. Understand the Selected Server and Global Routing
The selected server determines the candidate for the default proxy route; Global Routing determines how requests are handled. Check both. In Config mode, rules can send requests to DIRECT, PROXY, or a specified policy. If a rule explicitly selects another server or policy group, the actual route may not use the entry selected on Home.
Home Connection Target
- Where to Find It
- Home → Server List
- Selection Indicator
- The selected server entry shows a selection dot
- Address and Port
- Check each value against your provider’s details. Port 443 is one possibility, not a universal setting.
- Authentication Parameters
- Enter the password, UUID, TLS, and transport parameters for the selected Type
Changing the port doesn’t replace checking the protocol or authentication parameters, and you shouldn’t change every server to port 443.
Global Routing Mode
- Config
- Request routing depends on the rules file currently enabled
- Proxy
- Routes everything through the proxy; useful for temporarily ruling out rule-based routing
- Direct
- Routes everything directly; this can’t confirm whether the proxy route works
- Scene
- Handles traffic according to configured scenarios; check the relevant scenario when troubleshooting for the first time
The mode name describes the routing behavior; server availability still needs to be tested separately.
For example, if a rules file contains DOMAIN-SUFFIX,example.com,DIRECT, requests to matching domain suffixes go direct. A webpage loading successfully in this case doesn’t prove that the proxy server is working. For your first test, identify the route used by the test request instead of just checking whether a webpage displays content.
Use Config to manage rules files, Home to select a server and control the connection, and Settings to adjust app settings. Don’t change all three areas to troubleshoot your first connection. Keep the server and routing mode fixed, get a reproducible result, and then adjust one setting at a time.
4. Run Connectivity Test and Check Actual Access
Open Home → Connectivity Test, run the test, and note the result. It checks whether a connection to the test target can be completed; it isn’t a bandwidth test and doesn’t guarantee access to every website, protocol, or app. Check the test target and settings too—a successful result doesn’t establish that the entire connection supports every use case.
- If you get a response: Note the server, Global Routing mode, and network in use. Then open a webpage you need to check and confirm that the page content loads, not just a cached title.
- If the test times out or fails: First confirm that your regular network works, then check the server address, port, authentication details, and provider account status. Toggling the connection switch repeatedly won’t fix an incorrect password.
- If the test succeeds but a webpage doesn’t load: Check the routing rules for that domain and its DNS resolution. A reachable test target doesn’t mean the webpage uses the same route or DNS path.
- If the result changes when you switch networks: Keep the server and other settings unchanged. Compare Wi-Fi with cellular to see whether the issue is related to the network you’re using.
You can record the result like this: “Same server, Proxy, Connectivity Test timed out on Wi-Fi; got a response on cellular.” This is an example of a record format, not a predetermined test result. The comparison is useful only if all other conditions stay the same. A response time from one test can’t be directly converted into a download speed.
Compare Networks: Test the Same Server on Wi-Fi and Cellular
On Wi-Fi
- Complete any network sign-in first, then confirm that ordinary webpages load.
- Keep the same server and Global Routing mode.
- Run Connectivity Test and record whether it succeeds, times out, or returns a specific error.
On Cellular
- Make sure Shadowrocket is allowed to use cellular data.
- Turn off Wi-Fi and check whether the connection needs to be re-established.
- Repeat the same test, then visit the same webpage. Keep an eye on data usage.
Change only the network connection for each test. If you also switch servers, change DNS, and edit rules, you won’t know which change caused the result.
5. Common First-Connection Problems and What to Check
Start with the easiest states to verify: whether a server appears in the list, whether the selection dot is showing, whether the connection switch stays on, and whether the test returns a result. Identify the step where the failure occurs before changing the related settings. This usually preserves more useful clues than rebuilding the entire configuration.
The server is imported. Why can’t I connect?
Return to Home, expand the group, and tap a specific server to confirm the selection dot. Then check the address, port, and Type in its details. A successful subscription update only means the configuration was retrieved; it doesn’t mean every server in it is currently available. If your provider has changed authentication parameters, update the subscription before selecting the server again.
I didn’t allow the VPN configuration. What should I do?
Return to Home and turn on the connection again. Watch for another system authorization prompt and confirm it as required by your device. If the device is managed and system policy prevents adding a VPN, check the management policy or contact your administrator. Reimporting the same subscription won’t resolve an authorization issue.
The switch is on, but Connectivity Test keeps timing out. What should I check?
First check your network connection and provider account, then verify the current server settings. You can temporarily use Global Routing → Proxy for a comparison test to separate routing-rule effects from connection failures; restore the original mode afterward. If the test fails only on one network, record the difference using the two-network steps above.
It reconnects after I turn it off manually. Is the switch broken?
Go to Settings → On Demand and check whether on-demand connection and its conditions are enabled. For a manual test, disable On Demand temporarily, then return to Home, turn off the connection, and observe its status. Once the manual connection is stable, configure on-demand connection for your network conditions.
6. Final Checks After Connecting
After the first successful test, restore any temporary settings. If you switched to Proxy for troubleshooting but normally use rule-based routing, return to Home → Global Routing → Config, then confirm that the intended rules file is enabled on the Config page. Visit the target webpage again to make sure rule-based routing works as expected.
- Keep a brief record of the server name, network, routing mode, Connectivity Test result, and actual access result.
- Confirm where your subscription came from and how it updates. Get subscriptions from your provider, then check the selected server and any parameter changes after an update.
- Check Settings → On Demand and enable it if needed. Don’t rely on automatic reconnection as a fix until manual connections are stable.
- Before sharing troubleshooting details, hide the full subscription URL, password, UUID, and other authentication information. Include only the issue and the setting names needed to diagnose it.
These checks complete the verification chain: configuration present, server selected, tunnel active, test response received, and actual request successful. If access fails later while the switch is on, check these five steps one by one instead of relying only on the system’s VPN status to judge whether the remote connection is working.