Shadowrocket First-Time Setup: 10 Common Questions Answered

1. Does buying the app include a server?

No. Shadowrocket is a closed-source commercial app. The one-time App Store purchase covers the app itself, not a server account or service plan. After installing the app, you’ll still need to add your own server details or subscription. This guide assumes you already have a provider and subscription; it explains how to check and use your configuration, but does not provide, sell, or recommend servers or subscriptions.

The App Store is the only place to get the app. Verify the product name, Shadowrocket, the developer, Shadow Launch Technology Limited, and app ID 932747118. Don’t rely on icon colors in search results alone. Shadowrocket is primarily used on iPhone and iPad; compatibility with other Apple devices, system requirements, and the scope of Universal Purchase are as listed on the App Store page.

2. Why does the first connection ask to add a VPN configuration?

This permission allows the app to establish a VPN connection; it isn’t a second purchase. The first time you turn on the connection from Home, the system may ask to add a VPN configuration. Confirm that the request follows an action you just took in Shadowrocket, then follow the system prompts to allow it and authenticate your device. Permission only allows a connection to be established; it doesn’t confirm that the server details are correct or that all requests will use the proxy.

• After allowing the request: Return to Home, check the switch and connection status, then open a webpage to test the connection.
• If you denied the request: Return to Home and try connecting again, following the system prompts. If it still fails, check the VPN configuration status in system settings.
• If your device is managed: Device policies may restrict adding VPN configurations. Check your organization’s device requirements first; don’t repeatedly delete configurations used for other purposes.

A VPN status shown by the system indicates the tunnel state only; it doesn’t prove that the remote service is available. You’ll still need to check the selected server, Global Routing, and rules separately. If permission hasn’t been granted yet, resolve that first rather than changing DNS, protocols, and rules all at once.

3. How do I fill in Add Server with my existing server details?

First identify what kind of information you have. A server address, port, and authentication details make up a single-server configuration. A URL that returns multiple configurations is usually a subscription. A QR code is just a way to carry information; it may contain either a single configuration or a subscription. Don’t paste a subscription URL into the Address field for a regular server, and don’t guess the protocol from the port number. The steps below cover manually adding a single server.

1. Open Add Server

   On Home, tap “+” in the upper-right corner to open Add Server. Open Type and choose the protocol that matches your existing details.

2. Check the parameters

   Enter Address, Port, and the authentication details required by the protocol. For example, if the port is 443, enter only 443—not the full URL.

3. Save and select

   After saving, return to Home and make sure the entry appears in the list and is selected. Its name is only for identification; renaming it won’t fix an incorrect address or authentication details.

4. Test the connection

   Turn on the connection and grant system permission, then open a webpage to test it. If it fails, first recheck the fields you entered rather than changing several settings at once.

Shadowsocks, VMess, VLESS, Trojan, Hysteria2, WireGuard, Snell, and TUIC use different parameter formats. Some configurations also include TLS, a server name, or transport-related fields; check each one against your original details. Port 443 does not necessarily mean the protocol is Trojan, nor does it mean authentication details can be omitted.

4. What’s the difference between adding a server by QR code and importing with Subscribe?

Scanning a QR code only reads its contents; it doesn’t verify whether the service is working. Use the scanner on Home and grant camera permission when prompted. After scanning, check the imported entry’s type and address before connecting. QR codes may contain passwords, keys, or subscription credentials, so don’t post them in public forums for others to identify.

• Add by QR code: Use this when you have a readable QR code. If it can’t be recognized, first check that it contains a configuration supported by the app, rather than a regular webpage URL.
• Import with Subscribe: Go to Home → “+” → Type → Subscribe, enter your own subscription URL, and save. Then check the update result.
• The list is empty: Check that the URL is complete, the subscription is valid, and its response contains a supported configuration. A URL opening in a browser doesn’t mean its contents can be parsed.

A subscription update refreshes the relevant entries using the content returned by the remote service. Don’t treat manually edited subscription entries as permanent backups. If you need to keep custom changes, distinguish between servers you added independently and those generated by a subscription. Update options under Settings → Subscribe affect how updates work. Whether to update via a proxy depends on whether the subscription URL is reachable; don’t enable it by default.

5. Which Global Routing mode should I choose: Config, Proxy, or Direct?

Choose a mode based on what you’re testing. To check whether a server can proxy requests, you can temporarily use Proxy. For everyday rule-based routing, use Config, after selecting and checking the configuration you need. Direct is for testing a direct connection; it doesn’t show whether the remote proxy works. Scene applies routing based on configured scenarios—it isn’t a general-purpose “speed up” option.

If Proxy can reach a destination but Config can’t, check which rules match and what the final policy is before deleting the server. Conversely, if Direct can reach a website, that only shows your local network can connect to it directly; it doesn’t confirm that the proxy configuration is correct. When you’re done testing, restore the mode you normally use.

6. What are Home, Config, and Settings for?

Home is mainly for choosing a server, checking connection status, and setting Global Routing. Config is for managing configuration files and rules. Settings contains app options such as Subscribe and On Demand. The server determines where to connect; configuration rules determine how requests are routed. These are separate layers. Seeing servers after importing a subscription doesn’t mean the rules file is enabled as expected.

• DOMAIN-SUFFIX,example.com,DIRECT: Matches a domain suffix and uses DIRECT when there’s a match.
• IP-CIDR,192.168.0.0/16,DIRECT: Matches the specified IPv4 range. Whether domain resolution is involved depends on the rule options and context.
• GEOIP,CN,DIRECT: Matches based on IP geolocation data; results depend on the data source.
• FINAL,PROXY: Uses PROXY if none of the preceding rules match.

These examples explain the syntax only; they aren’t a complete configuration you can use as-is. Rules are generally checked from top to bottom, so put specific exceptions before broader rules and make sure each policy name exists. If a destination is blocked by REJECT, importing the server again won’t change that rule. For more on rule keywords, see the protocol guide and glossary.

7. The connection switch is on, but why won’t webpages load?

Turning on the switch only means the client has entered a connected state. Problems may still involve the local network, server authentication, remote reachability, DNS, or rule selection. Compare results using the same destination, then narrow down the cause step by step. Don’t change the server, mode, DNS, and rules all at once, or you won’t know which change fixed the issue.

1. Check the local network first: Disconnect Shadowrocket and try a webpage that normally works over your current Wi-Fi or cellular connection. Sign in to the network if required.
2. Then check the server: Verify which entry is actually selected on Home, and compare its address, port, authentication, and TLS-related fields with your existing details.
3. Compare routing modes: Temporarily switch to Proxy and test the same destination. If only Config fails, check the rules and the policies for REJECT and FINAL.
4. Check DNS last: If the symptoms point to name resolution, review the DNS settings in the current Config. Note the original values and change only one setting at a time.

A latency test returning a result doesn’t guarantee that webpages will load, and a timeout doesn’t automatically mean the password is wrong. Test methods, network restrictions, and server responses can all affect the result. When contacting the provider for your existing service, describe the network type, destination, and error. Don’t include your full subscription URL or authentication details.

8. Why does the switch change after I leave the app or lock the screen?

Returning to the Home Screen doesn’t necessarily disconnect the VPN. Check the actual status shown by the system and in Home. If the status changes after switching networks, locking the screen, or reopening the app, note the conditions and check Settings → On Demand. Automatic connection conditions, other VPN configurations, and network changes can all affect what you see. A single disconnection doesn’t prove the server has stopped working.

• While testing manually: Check whether On Demand is enabled. If you need to test manual connections only, temporarily turn it off and note the original setting.
• If the status changes after switching networks: Check whether it happens consistently after switching between Wi-Fi and cellular, then review the relevant automatic connection conditions.
• If it reconnects after you turn it off: Check whether On Demand or a system-level automatic connection setting is still active. Don’t mistake automatic reconnection for an unresponsive switch.
• If you switch between VPNs: Keep the configuration you’re testing clear, and avoid starting another VPN that could change the current state.

On Demand automatically handles connections based on conditions; it doesn’t guarantee that a server is available. Confirm that manual connections are stable before setting up automatic behavior. This makes it easier to tell an unexpected trigger from a failed remote connection.

9. Why did the selected server change after a subscription update?

Subscription content is returned by the service you already use, and entry names, counts, and parameters may change during an update. After updating, check which server is currently selected on Home. Don’t assume an entry is the same server just because it’s in the same position. If the list gets shorter, first check the subscription status and response, then decide whether to update manually. Repeatedly deleting and re-adding entries won’t fix an empty response from the remote service.

1. Before updating, note the selected server’s name and protocol. Don’t record or share passwords, keys, or subscription tokens.
2. Make sure your current network can reach the subscription URL before updating. Check for timeout or resolution errors.
3. After the update, confirm the entry is present, select the server you need again, and test the same webpage.
4. If the subscription URL is reachable only through a proxy, check Settings → Subscribe → Update via Proxy and confirm that you already have a working proxy.

If none of your servers work, enabling Update via Proxy may still not retrieve the subscription, because the update itself needs a working route. It’s not a general-purpose fix. Credentials in a subscription URL grant access to that subscription. When sharing a screenshot, cover the entire URL—not just the display name.

10. After setup, how do I verify and keep a working configuration?

After successfully testing a connection, note the combination of settings you can reproduce: selected server, Global Routing mode, current Config, and On Demand status. Test on each network where you plan to use it; not every destination needs to take the same route. In Config mode, the matching rule determines whether traffic goes direct, through a proxy, or is rejected. These three common follow-up questions can help you finish checking your setup.

You’re done with the initial setup when you can explain why a request takes its current route—not just when the switch is on. If a problem comes up later, return to the last combination of settings that worked, then check what has changed one item at a time. For a step-by-step review, continue with the usage guide.