Shadowrocket Setup: VPN Permissions and the Home Screen

Before first launch: prepare the purchase and connection settings separately

Shadowrocket is a paid client for Apple platforms, available exclusively on the App Store. Before installing, verify the developer, Shadow Launch Technology Limited, the official app icon, and app ID 932747118. This guide focuses on iPhone and iPad; check the App Store listing for system requirements and purchase availability.

Buying the app does not include a service plan. After purchase and installation, an empty SERVER list on Home does not mean the installation failed. You’ll need to add your own connection details or import your existing subscription using Subscribe. The steps below assume you already have your own provider and subscription; they don’t cover choosing a service.

These three screens serve different purposes: Home is for selecting a server, connecting, and testing; Config manages configuration files, including rules; Settings controls app options such as On Demand. Adding a server entry does not mean you’ve loaded a routing configuration that suits your needs. Likewise, selecting a configuration file does not mean its referenced proxy policies have a working connection.

VPN permission: when the prompt appears and how to approve it

When you first enable a connection, iOS may ask you to allow Shadowrocket to add a VPN configuration. This permission lets the app use the system network extension to handle relevant traffic; it does not ask for your provider account credentials. Simply opening the app and browsing Home may not trigger the prompt. It usually appears the first time you actually enable a connection.

1. Get ready to connect

   Go to Home and make sure you have a server entry of your own and that it’s selected. If the list is empty, follow the Subscribe import steps below to add an entry. Don’t use repeated toggling as a substitute for configuring a connection.

2. Turn on the connection

   Turn on the connection switch at the top of Home. If a system prompt to add a VPN configuration appears on first connection, verify that it names Shadowrocket.

3. Approve the request

   Choose Allow in the system prompt, then complete device authentication as required. This is device-level authorization, not a server password or a Subscribe token.

4. Return and verify

   Go back to Home, check the connection status, and run Connectivity Test. Whether iOS has saved the VPN configuration and whether the server is reachable are two separate things to verify.

Once approved, you generally won’t need to add the VPN configuration again each time you connect. If iOS keeps prompting, note the full message, check whether the existing configuration was saved, and review any device management restrictions. System authorization failures and server authentication failures are different issues with different troubleshooting steps.

Not Connected on Home: a status, not a diagnosis

Not Connected means there is no active connection. You may see it when first opening the app, after turning off the switch, or when a connection attempt fails. This status alone can’t tell you whether a service has expired, a password is incorrect, or DNS is having issues.

• Not enabled yet: If the switch is off and the status reads Not Connected, check the selected server and Global Routing before deciding whether to connect.
• Disconnects immediately after enabling: Check system VPN permission, the selected entry’s settings, and any other active VPN configuration. Keep any error message for troubleshooting.
• Connected, but webpages fail: Check the selected server, routing rules, DNS, and the destination site. Don’t assume all network access is working just because the connection status says Connected.
• Reconnects after you turn it off: Go to Settings → On Demand and check whether automatic connection conditions are enabled. Automatic reconnection doesn’t necessarily mean the switch is malfunctioning.

Connection status mainly reflects whether the local network extension is running; it does not replace end-to-end access testing. First check whether ordinary webpages load on the same network, then enable Shadowrocket and test the destinations you actually need. Change one variable at a time—for example, switch only the server or only the routing mode—to make it easier to identify what changed the result.

Global Routing: understand the four modes before choosing one

Home → Global Routing determines how traffic is routed. It is not a protocol selector and won’t fill in server addresses or authentication details. The descriptions below cover Shadowrocket’s routing modes. The guidance for Config assumes you’ve already loaded and reviewed a configuration file.

If a destination works with the same server under Proxy but fails under Config, check rule matching and policy mappings first rather than changing protocol settings immediately. If both modes fail, continue by checking server reachability, authentication details, and DNS. This comparison can narrow down the cause, but it can’t prove that a particular rule is wrong.

SERVER and Subscribe: preparing your server list

The SERVER section on Home displays and lets you select server entries. A name is only a label; the entry’s Type, address, port, and authentication settings determine how it connects. After selecting an entry, you still need to turn on the connection switch at the top. Selected and connected are two different states.

1. On Home, tap “+” in the upper-right corner and choose Subscribe for Type.
2. Paste your existing subscription link into URL, check that it’s complete, and save. The format can look like https://example.com/sub?token=xxxx. This address is only an illustration and is not a working subscription.
3. Return to Home and update the subscription group. A common way is to swipe left on the group and tap Update; the exact option may vary by interface version.
4. When the update finishes, make sure server entries appear. Select one, check Global Routing, and enable the connection.

Updating Subscribe fetches entries from the subscription URL; enabling the VPN routes traffic through the current connection. These are separate actions. If the update fails, check the URL, your current network, and the subscription status provided by your service provider. If the update succeeds but the connection fails, check the selected entry’s connection settings. Re-adding the same subscription repeatedly won’t help identify the problem.

Shadowsocks, VMess, VLESS, Trojan, Hysteria2, and WireGuard are different protocols or connection types. Don’t change Type just because a name looks familiar. The address, port, TLS, transport, and authentication fields should match your existing service configuration. For example, entering 443 as the port alone does not mean TLS must be enabled or prove that the server listens on that port.

Connectivity Test: check what’s being tested before reading the result

Home → Connectivity Test checks connectivity. Before interpreting the result, confirm the test method, destination, and server. Different test methods cover different parts of the connection: a port check is not the same as successful protocol authentication, and successfully reaching a test address through a proxy does not mean every website is accessible.

• A duration is displayed: The specified test returned a result. The value depends on your network and the test destination; it is not a fixed download speed.
• Timeout appears: The test did not finish within the waiting period. Possible factors include your current network, the server address or port, and the test destination’s response. This alone does not prove that your account has expired.
• The test succeeds, but a webpage fails: Check the destination’s rules, DNS, TLS, and the site’s own status. Don’t assume that success with the test address means every website will work.
• Results change when you switch networks: Record results separately for Wi-Fi and cellular, keeping all other settings the same. Then check whether the difference is due to the network environment.

Record five details: network type, selected server, Global Routing mode, test destination, and result or error message. Don’t change DNS, rules, and servers all at once and record only the final result, or you won’t know which change mattered. For further checks, see Troubleshooting and work through connection, DNS resolution, and rules in order.

Config and On Demand: enable each one after the first connection

Verify the basic connection first, then add automation. Rules in Config determine which policy handles each request; Settings → On Demand controls when connections are established automatically. Scene in Global Routing and On Demand serve different purposes: the former concerns scene-based routing, while the latter concerns when to connect automatically. They are not interchangeable.

In the rule example, DOMAIN-SUFFIX matches domain suffixes, GEOIP checks the region associated with the destination IP, IP-CIDR matches IP ranges, and FINAL handles requests not matched by earlier rules. DNS results can affect IP-based rule matching, so selecting Config alone doesn’t confirm that routing is correct. Check the policy matched by a specific destination.

After your first session, use the checklist below to verify the setup. Each item has something specific to check and tells you more than the connection icon at the top of the screen alone.

• iOS has saved Shadowrocket’s VPN configuration, and the Home switch turns the connection on and off as expected.
• SERVER contains entries you imported yourself, and the selected server is the one you intended to use.
• You’ve confirmed the current Global Routing mode. If you’re using Config, you’ve also reviewed the active configuration and proxy policies.
• Connectivity Test returns an interpretable result, and you’ve separately tested the destination webpage you need.
• If On Demand is enabled, automatic connection behavior after switching networks matches your settings.