Shadowrocket First-Time Setup: VPN Permission and Home Screen Guide

What should you prepare before opening the app?

First verify the app, then prepare your own connection details. Shadowrocket is a paid Apple-platform app available exclusively on the App Store. On the product page, verify the developer, Shadow Launch Technology Limited, the official icon, and app ID 932747118. This guide focuses on iPhone and iPad; check the App Store listing for system requirements and purchase compatibility.

Buying the app does not automatically add a usable server entry. A one-time app purchase is not a service plan. If the SERVER list on Home is empty, import details you already have instead of repeatedly toggling the connection switch. This site does not provide, sell, or recommend nodes or subscriptions.

Make sure the device itself can access the internet before importing details or connecting. You can leave Shadowrocket closed and open a site you normally access directly in your browser. If that fails, check your Wi-Fi or cellular connection first so you don’t mistake a basic network issue for an app setting problem.

When should I allow VPN configuration?

After confirming that you initiated the connection, allow the system to add a VPN configuration. This prompt usually appears the first time you start a connection that needs a system VPN configuration, but it may not appear as soon as you open the app. Its timing depends in part on whether a configuration already exists on your device. Granting permission lets Shadowrocket use the system VPN network interface; it does not confirm that server authentication has succeeded.

1. Verify the app

   Open Shadowrocket from the App Store and go to Home. Make sure you’re using the app whose developer and app ID you verified.

2. Import your details

   Tap “+” in the top-right corner of Home to open Add Server. If you already have a subscription, choose Subscribe under Type, enter your subscription URL, and save. Once the content has been retrieved, check the SERVER list.

3. Select an entry

   On Home → SERVER, select the server you want to use, then check Home → Global Routing. When connecting for the first time, avoid changing several settings at once.

4. Allow the configuration

   Turn on the connection switch at the top of Home. When the system asks to add a VPN configuration, tap Allow, then follow the device prompts to authenticate with your passcode or biometric verification.

5. Check access

   Return to Home to check the connection status, then use your browser to open a page you need. Check separately whether the connection stays active, the test succeeds, and the page loads—don’t judge by the switch alone.

VPN configuration approval does not require your Apple Account password as a server password. Verify your device through the system prompt; enter server authentication details from your own service in Add Server. These credentials are not interchangeable.

What do the Home switch, SERVER list, and other sections do?

Home is where you select a server and start a connection; Config contains the current configuration; Settings contains app preferences. Understanding these as separate sections can help you avoid changing an entire configuration when troubleshooting a connection. The two cards below map each screen location to its function.

If Not Connected disappears or the connection switch stays on, that only indicates a change in connection status—it doesn’t prove the remote service is working. Some protocols reveal authentication, transport, or resolution issues only when an actual request is sent, so verify access in a browser too.

SERVER is not a public directory of ready-to-use resources. Its entries come from details you added manually, shared details, or a subscription you already have. Tapping an entry selects the connection target; editing it changes its connection parameters. When troubleshooting, note the selected entry first so you don’t test one entry and connect to another.

Which Global Routing mode should I choose first?

If you have a trusted configuration and understand what it does, Config is a practical choice for everyday use. If you haven’t checked the configuration, don’t assume a “recommended” option works without review. Go to Home → Global Routing, choose a mode, then return to Home and confirm the displayed value. The comparison below covers Shadowrocket’s own modes only.

The actual effect of Config depends on rule order and the selected policy. Rules are generally evaluated from top to bottom; the matching rule’s policy is applied, and FINAL handles requests that match no earlier rule. For example, this syntax-only snippet sends example.com and its subdomains through PROXY and handles all other requests with DIRECT. It is not a complete file you can use to replace an existing configuration.

[Rule]
DOMAIN-SUFFIX,example.com,PROXY
FINAL,DIRECT

On Demand is not one of the four routing modes above. Settings → On Demand controls when a connection starts; Global Routing controls how requests are handled while connected. When troubleshooting for the first time, keep connections manual until access works, then add automatic triggers.

Connectivity Test shows latency. Does that mean I can access the internet?

A successful test only shows that the path covered by that test responded; it doesn’t guarantee that every website is accessible. After tapping Connectivity Test on Home, interpret the result according to the test method. A TCP connection test and an HTTP request test check different layers. A single latency value can’t confirm that protocol authentication, DNS resolution, and access to the destination site are all working.

• Test timed out: First confirm that the device has a working internet connection, then check the server address and port for the entry you tested. The port should match your own service details; don’t change every port to 443 just because HTTPS commonly uses it.
• Test returns a result, but webpages won’t open: Make sure the selected SERVER entry is the one you tested. Then check Global Routing and the policy applied to that domain in Config.
• Some webpages work: Note the specific domains that fail and what happens. Distinguish a page timeout, a DNS resolution failure, and an error returned by the website instead of treating them all as connection failures.
• It fails only after switching networks: Test separately on Wi-Fi and cellular, and check whether the system allows the app to use cellular data. If On Demand is enabled, also check its trigger conditions.

Latency is not the same as transfer speed, and it is not enough on its own to choose a server. For a useful comparison, keep the device, network, and test method the same. If any of these conditions change, don’t treat the two results as a direct comparison of server performance.

What if SERVER is empty or I still can’t connect after importing?

If the list is empty, troubleshoot importing your details first—not VPN permission. For a subscription you already have, go to “+” in the top-right corner of Home → Add Server → Type → Subscribe. Enter your own subscription URL, save it, and retrieve its contents. Updating a subscription refreshes its entries; it is not an app purchase or an update to the routing rules in Config.

1. Check the type of details. A subscription URL and a single shared server entry are different kinds of content and use different import options. Before pasting, check for extra spaces, line breaks, or explanatory text that isn’t part of the URL.
2. Check the retrieval result. After saving a subscription, see whether server entries appear. If retrieval fails, check that the URL is valid, your current network is working, and your existing service account is active before trying again.
3. Check that all parameters are present. When adding a server manually, Type must match the details you already have. Shadowsocks, VMess, VLESS, Trojan, and other types use different authentication and transport fields; don’t guess the protocol based on the port alone.
4. Check which entry is selected. After updating a subscription, confirm the current selection under SERVER before starting the connection. An entry can be present without being selected, and its presence doesn’t mean the service is still working.

Subscription URLs may contain access credentials, and server details may include passwords or other authentication information. When describing an issue to someone else, share only the symptoms, protocol type, and non-sensitive settings path. Hide the full subscription URL and authentication fields before sharing screenshots or copied text.

What should I check after the first connection?

Consider setup complete when you can explain the current settings and repeat a successful visit—not simply when the connection switch is on. Follow the checks below; you can use the same method after changing networks or updating a subscription.

• Permission: You started the connection from Home, completed the system VPN configuration prompt, and aren’t blocked by device management policies.
• Target: SERVER contains an entry, the selected entry is clear, and its connection details come from a service you already have.
• Mode: You can identify the current mode under Home → Global Routing as Config, Proxy, Direct, or Scene. If you use Config, you know which file is active.
• Results: You’ve checked Connectivity Test and browser access separately, and noted at least one page that works and any specific error that needs further investigation.
• Auto-connect: Once manual use is stable, check the conditions under Settings → On Demand. If the connection stops and then starts again automatically, check this section before considering removing the app.

To pause, return to Home and turn off the connection, then check whether an On Demand condition starts it again. You don’t need to remove the system VPN configuration just to disconnect. Keeping settings you’ve already verified makes it easier to resume using the same steps next time.