Shadowrocket Setup: 10 Common Questions Answered

1. What do you need after purchasing Shadowrocket?

Shadowrocket is a closed-source commercial app for Apple platforms, primarily iPhone and iPad, and is available exclusively from the App Store. After purchasing the app, you’ll also need your own server details or Subscribe link that you’re authorized to use. A purchase record confirms the app purchase; it doesn’t mean a server is already configured.

• On the App Store, verify the developer Shadow Launch Technology Limited and app ID 932747118.
• Have your own Subscribe link or the complete server address, port, protocol, and authentication details ready.
• Check the App Store listing for system requirements and purchase availability. Compatibility with Mac, Apple TV, and Apple Vision is also listed on the same store page.

2. Why does the first connection request permission to add a VPN configuration?

When you connect for the first time, the system may ask to allow a VPN configuration to be added. This permission lets Shadowrocket route the relevant traffic through a system network extension. It is not a step for purchasing a service and does not confirm that a remote server is available. Make sure the request was triggered by the Shadowrocket app you just opened, then follow the system prompts to authorize it.

1. Check the server entry

   Go to Home and confirm that you’ve added and selected your own server entry. Installing the app without usable server details is not enough to establish a working proxy connection, even after granting permission.

2. Start the connection

   On Home, turn on the connection switch. If the system prompts you to add a VPN configuration for the first time, verify the request and tap Allow, then complete any required device authentication.

3. Check the status

   Return to Home and see whether Not Connected has changed, then run Connectivity Test. Check the system connection status and remote request test separately.

4. Restore permission

   If you previously denied permission, return to Home and try connecting again. To review the system configuration on iPhone or iPad, go to Settings → General → VPN & Device Management → VPN and check the relevant entry.

Don’t delete every system VPN configuration as soon as a connection fails. First turn off other active VPN connections, confirm that your network is working, and try the current entry again. If the device is managed, check whether its management policy restricts adding VPN configurations.

3. What do the Home switch and Not Connected mean?

The connection switch on Home controls Shadowrocket’s network session. Not Connected means that the session is not currently established; it doesn’t necessarily mean your subscription has expired. Conversely, an active connection only means the local session has started. It doesn’t guarantee that every website, rule, or remote server is working.

• The switch won’t stay on: First check system authorization, configuration validity, and conflicts with other VPN connections.
• The switch is on, but webpages won’t load: Check the selected server, Global Routing, DNS, and the destination website. Don’t rely on the status indicator alone.
• The connection stays active after you leave the app: Returning to the Home Screen doesn’t disconnect it. To stop the connection, return to Home and turn off the switch; also check whether On Demand could trigger it again.

Home is where you manage connection status, select a server, and run tests. Config manages routing configuration files, while Settings contains app preferences. Knowing which section does what helps prevent accidental changes to server details while editing rules.

4. How do you import your own Subscribe link?

A Subscribe link retrieves a set of server entries; it is different from the routing rules file in Config. After importing, confirm that the expected entries appear and select one to test. Saving a link doesn’t automatically complete every setup step.

1. Copy the link

   Copy the complete Subscribe link from your own service details. Check for leading or trailing spaces, line breaks, and missing query parameters. Don’t use the URL of an account management page in place of the subscription link.

2. Select the type

   Go to Home → “+” in the upper-right corner → Type → Subscribe, then enter your own link. Authentication details in the link are sensitive; don’t post them in public forums.

3. Save and verify

   After saving, wait for the content to load and check the names and number of entries shown on Home. If the subscription is saved but no entries appear, check for retrieval errors instead of repeatedly adding duplicate subscriptions.

4. Select and test

   Select one of your own server entries, turn on the connection switch, and run Home → Connectivity Test. Then use a browser to check the website you actually need to access.

When adding a server manually, set Type to match the protocol in your existing service details. Shadowsocks, VMess, VLESS, Trojan, Hysteria2, and WireGuard use different authentication and transport fields. Don’t copy just the address and port and then choose a protocol at random. A port such as 443 doesn’t identify the protocol.

5. Can updating a Subscribe link overwrite manual changes?

Updating a Subscribe link retrieves the remote entries again, so names, addresses, and entry counts may change. Don’t rely on a subscription-managed entry as the only copy of information you’ve edited manually; some local changes may not survive the next update. Note the currently selected entry before updating, then verify the selection and connection afterward.

• On Home, pull down on the subscription list to refresh. Check whether the update completes and whether an error appears.
• If the request times out, first check whether your current network can reach the subscription URL. Then consider whether an existing working connection is needed to retrieve it.
• To update through a proxy, check Settings → Subscribe → Update via Proxy. This requires a connection that is already established and working.
• An authentication error is different from a timeout. For an authentication error, check that your link is complete and authorized. For a timeout, also check the network and whether the address is reachable.

6. Which of the four Global Routing modes should you use?

Home → Global Routing determines the routing mode in use. It’s separate from the server selection: choosing a server sets the available exit, while the routing mode determines which requests use the proxy. The guidance below assumes you have a valid Config and may not apply to unknown configurations.

For troubleshooting, note the results in Config, temporarily switch to Proxy and test the same destination, then return to Config. A comparison is meaningful only when the network, server, and destination are the same. Don’t update the subscription, switch servers, and change DNS at the same time.

7. Which Config rule keywords should you know?

In Config mode, first confirm which file is active in Config, then check the rule order and policies. Rules are generally evaluated in order, so a broad condition near the top may take effect before a more specific one below. Downloading or saving a configuration file doesn’t mean the current connection is using it.

[Rule]
DOMAIN-SUFFIX,example.com,DIRECT
IP-CIDR,192.0.2.0/24,DIRECT,no-resolve
GEOIP,CN,DIRECT
FINAL,PROXY

• DOMAIN-SUFFIX: Matches a domain suffix, such as example.com and its subdomains in this example.
• IP-CIDR: Matches an IP address range. The example 192.0.2.0/24 is a documentation-only address range; no-resolve means this IP rule won’t trigger a DNS lookup.
• GEOIP: Matches based on an IP geolocation database. CN is the match parameter in this example and can’t replace checks for every domain.
• FINAL: The policy used when no preceding rule matches. In this example, remaining requests are sent to PROXY.

This example explains syntax only; it isn’t a complete recommendation for everyday configuration. Back up an existing file before editing. If you use a policy name that doesn’t exist or place FINAL too early, the result may not be what you expect. Protocols define how to connect to a server; rules determine where requests go. They aren’t interchangeable.

8. Why can’t I open a webpage even when Connectivity Test succeeds?

Home → Connectivity Test checks the result of a request to its test destination under current conditions; it doesn’t guarantee access to every destination on the internet. If the test succeeds but a website doesn’t load, the domain may match a different policy, DNS resolution may be failing, the destination service may be down, or the site may restrict the exit IP address. Test latency is not the same as download bandwidth.

Why does the connection come back after I turn it off? Where do I check On Demand?

On Demand can trigger a connection under specified conditions; it doesn’t extend a subscription or make a server faster. If the connection returns after you turn it off manually, check the enabled state and conditions under Settings → On Demand instead of repeatedly toggling the Home switch.

1. Go to Settings → On Demand and note whether it’s enabled and which network conditions are configured.
2. If you want to control the connection manually, temporarily disable On Demand, then return to Home and turn off the connection.
3. Switch between Wi-Fi and cellular once and see whether the connection triggers again. If the device is managed by an organization, also check its system management requirements.
4. Once the behavior is as expected, restore the conditions you need one at a time. Test the corresponding network after restoring each condition.

On Demand and Global Routing → Scene handle different things: when to establish a connection and which scene-based routing to use. They aren’t the same switch. For a first-time setup, connect manually and verify Config before adding automation conditions. This reduces the number of variables when troubleshooting.

10. How do you restore a purchase after getting a new iPhone or iPad?

On the new device, sign in to the App Store with the account used for the original purchase. Open the account’s purchase history or apps list, find Shadowrocket, and download it again. Apple may change the names of account pages between system versions. If you can’t find the app, first verify the purchase account and record; don’t rely on a search result for an app with the same name.

After the app is back on your device, go through the full process again: select an entry → verify Global Routing → turn on the connection → test the destination. For more troubleshooting, read Troubleshooting; to start from scratch, follow Quick Start.