Shadowrocket First Launch Setup: VPN Configuration Permission and Home Screen Guide

At a glance

Before using Shadowrocket for the first time, have your own connection details ready, approve the system VPN configuration request, then check the connection status, routing mode, and selected server on Home. This guide for new iPhone and iPad users explains the difference between permission and connection, what each Home section does, and what to check if the first test fails. You don’t need to change advanced rules first.

Before opening Shadowrocket: Understand the app, connection details, and configuration files

Shadowrocket is a closed-source commercial app for Apple platforms, sold as a one-time purchase through the App Store. The developer is listed as Shadow Launch Technology Limited, and the app ID is 932747118. Check the App Store listing for system requirements and compatibility. To verify where to buy it, see the genuine app and verification guide.

Buying the app does not include a connection service. These steps assume you already have your own service and subscription, or complete server details. Allowing a VPN configuration only lets the app create a system network tunnel. It does not provide a usable server or fill in missing account details.

932747118

App Store app ID for product verification

3 main sections

Home / Config / Settings: Connections, configurations, and settings

4 routing modes

Global Routing：Proxy / Direct / Config / Scene

Server entry: Includes the protocol, address, port, and authentication details. Use it to choose a connection target on Home.
Subscription: Retrieves and refreshes your existing server list. Updating a subscription does not update the app in the App Store.
Configuration file: Managed in Config. It may include rules, DNS, and policy settings, so it is not the same as a single server entry.

VPN Configuration Permission: Approve It When You First Connect

You may see a system permission prompt during setup. If it doesn’t appear when you open the app, it will usually appear the first time you try to connect and need to create a VPN configuration. The system displays the prompt, and its button labels depend on your device language. Confirm the request was triggered by opening Shadowrocket, allow the configuration to be added, and complete device authentication when prompted.

Have your details ready

Make sure you already have a server entry, or import your own subscription using the steps below. An empty list does not by itself indicate a permission problem.
Start a connection

On Home, select the server you want to use, then tap the connection switch at the top. If iOS needs to add a VPN configuration, it will show a permission prompt.
Verify the request

Make sure you are enabling Shadowrocket. Read the system prompt, allow the configuration to be added, and confirm with your device passcode or another authentication method offered by the system.
Return and check

Go back to Home and check the connection status. Permission alone does not establish a connection; dismissing the prompt does not mean the network is ready to use.

To check whether the system saved the configuration, open Settings → General → VPN & Device Management → VPN on your iPhone or iPad. The exact labels vary by system version. Don’t delete unfamiliar management profiles just to retry. If you remove Shadowrocket’s VPN configuration, you may need to authorize it again the next time you connect.

At the Top of Home: Not Connected and the Connection Switch

Not Connected means Shadowrocket has not established a VPN connection. It does not indicate whether a subscription has expired or whether server details are correct. You may see this status on first launch, after disconnecting, or when a connection cannot be established.

The switch at the top of Home starts or stops the connection. The SERVER section controls which server entry is selected. Global Routing controls how intercepted connections are routed. Each has a different role, so note them separately when troubleshooting rather than saying only that “the switch won’t turn on.”

Home: Connection and Target

Status: Not Connected means there is no active connection
Switch: Start or stop the VPN connection
SERVER: View and select an existing server entry
Connectivity Test: Check server reachability using the selected test method

A connection being established and a website being accessible are separate things to verify.

Config / Settings: Configurations and Behavior

Config: Manage and select the configuration file in use
Global Routing: Choose a routing mode on Home
On Demand: Check the on-demand connection settings under Settings → On Demand
First connection check: Connect manually first, then configure automatic connection behavior

Confirm that a manual connection works before setting up automation. This makes it easier to identify where a problem is coming from.

After connecting, visit a real destination you need to access. The system VPN status confirms the tunnel state, but not that every destination follows the same policy or that remote authentication, DNS, and the destination service are all working.

Global Routing: Check Whether Rules Apply

Go to Home → Global Routing and check the selected mode. For a first connection test, distinguish between routing according to your configuration and temporarily forcing a route. If you have a trusted, appropriate configuration, you can use Config. If you haven’t checked its contents, don’t assume a setting is correct just because it looks like a common choice.

Config

Recommended

Routes connections according to the current configuration’s rules and policies. Rules may direct traffic to DIRECT, REJECT, or a proxy policy. Connections that don’t match a rule follow the configuration’s fallback rule; they are not necessarily sent directly.

Best for: Everyday rule-based routing with an existing, verified configuration.

Proxy

Routes connections intercepted by the app through the proxy mode. This can help reduce the effect of ordinary routing rules during troubleshooting. It does not mean the app can intercept every type of network activity on the device.

Best for: Checking the effect of ordinary routing rules when a server is already selected.

Direct

Routes connections intercepted by the app directly, without using a remote proxy as the ordinary connection’s exit. Even if the connection switch is on, that does not mean traffic is going through the selected server.

Best for: Comparing direct access on your current network.

Scene

Uses configured scenes to determine routing. Check the relevant scene settings before using this mode. Scene does not automatically infer what you need to access without configuration.

Best for: Users who understand and have configured scenes.

For example, the following explains rule syntax; it is not a complete configuration to paste in during first launch. DOMAIN-SUFFIX matches domain suffixes, GEOIP matches by the IP address’s geographic location, IP-CIDR matches IP ranges, and FINAL handles connections that don’t match earlier rules. You can determine the result only after understanding the current configuration and policy names.

[Rule]
DOMAIN-SUFFIX,example.com,DIRECT
IP-CIDR,192.0.2.0/24,DIRECT
GEOIP,CN,DIRECT
FINAL,PROXY

Rules are checked from top to bottom, and the first match determines the policy. In this example, PROXY must refer to an actual, usable proxy policy. Don’t treat example domains, documentation IP ranges, or policy names as a complete setup for your network.

SERVER Section: Importing, Updating, and Selecting Are Separate Steps

The SERVER section shows existing server entries or subscription groups. If the list is empty, import your own details first. If it contains entries, check which one is actually selected. Seeing a name in the list does not mean that entry is selected or currently reachable.

Two ways to add connection details you already have

You have a subscription link

Tap “+” in the upper-right corner of Home → Type → Subscribe.
Enter your own subscription URL and save it.
Wait for the subscription to load, then check the server group it creates.
To refresh it, update the subscription entry. When it finishes, check which item is selected.

You have individual server details

Tap “+” in the upper-right corner of Home → Type, then choose the protocol specified in your connection details.
Enter the address, port, and corresponding authentication fields one by one.
For TLS, SNI, or transport paths, use the values from your original connection details.
Save the entry, return to the SERVER section, select it, and run a test.

Updating a subscription refreshes the source list; manual entry changes a local server record. Neither replaces system VPN permission.

Shadowsocks, VMess, VLESS, Trojan, Hysteria2, and WireGuard use different fields. Don’t enter a password from one protocol in another protocol’s identity field just because both have an address and port. For example, if your connection details specify port 443, enter that value as given. The port number alone does not confirm the protocol or verify that the TLS settings are correct.

Connectivity Test: Separate Test Results from Real-World Access

Use Home → Connectivity Test to choose and run a connection test. Each test method checks something different: a TCP test focuses on whether a connection can be made to the target port, while other methods may also test access to a destination through the proxy. When recording results, note the test method too; don’t compare only the millisecond figure.

Milliseconds displayed: The test received a response using the current method. This is not your actual download speed and does not mean every website is accessible.
Timeout displayed: The test did not receive the required response within the allotted time. Check your local network, server address, and port, then verify the protocol and authentication details.
Test succeeds, but a webpage won’t load: Check Global Routing, the active configuration, DNS, and the destination itself. A successful test alone does not rule out a configuration problem.
Some entries fail: First compare their details and source status. Don’t immediately delete and recreate the device’s entire VPN configuration.

For your first test, change only one variable at a time on the same network. Keep the server and configuration unchanged while testing and trying a real destination. Switch routing modes or servers only when you need a comparison. Changing the network, server, and configuration all at once makes it difficult to tell what affected the result. Test times also vary with network load, so don’t treat a single result as a lasting conclusion.

First-Connection Checklist: Connect Manually Before Checking On Demand

On Demand and Global Routing do different things: On Demand determines when to establish a connection automatically, while Global Routing determines how to handle traffic after the connection is established. Test a manual connection first, then check the relevant settings under Settings → On Demand. If the connection comes back soon after you disconnect, check the on-demand behavior before assuming the switch is broken.

System permission: You allowed Shadowrocket to add a VPN configuration, and no system prompt is waiting for confirmation.
Server selection: The expected entry is selected in the SERVER section, and its protocol, address, port, and authentication details match your original connection information.
Routing mode: You know whether Global Routing is set to Config, Proxy, Direct, or Scene. If you use Config, you’ve also checked the active configuration.
Test results: You ran Connectivity Test and recorded the test method and whether it responded or timed out.
Real-world access: After connecting, you tested an actual destination and confirmed the result goes beyond a change in the status text.
Automatic behavior: After confirming that manual connection works, check Settings → On Demand to avoid interference between automatic connections and manual operation.

If you still can’t connect, note which step failed, what the system prompt said, the current routing mode, and the test results. If permission failed, start with system permissions. If the list is empty, start by importing your details. If a test times out, check the network and server details. If only some destinations fail, then check rules and DNS. Troubleshooting one layer at a time makes it easier to find the cause than resetting everything at once.