Shadowrocket Setup: 10 Common Questions for New Users

1. Can I connect as soon as I buy the app?

A purchase alone does not determine whether you can connect. Shadowrocket is a closed-source commercial app sold as a one-time purchase; buying the app does not include a service plan. The App Store handles the app purchase and installation. Connection details such as the server address, port, and authentication credentials come from a service you already have. After installation, you still need a usable server entry in Home.

The App Store is the only way to get Shadowrocket. Check that the developer is Shadow Launch Technology Limited and the app ID is 932747118. Refer to the App Store listing for system requirements and compatibility. The three counts below describe app usage, not a promise that any service will be available.

2. Where do I add an existing subscription link?

A subscription retrieves server details from a service you already use; it is not the same as a rule config file. Make sure you have a subscription URL that can be imported into the app, not a service provider’s website login address. Links containing a token usually include access credentials, so treat them like passwords and keep them out of public screenshots.

1. Open Add Server

   Go to Home, tap “+” in the top-right corner, and open Add Server.

2. Choose a type

   Under Type, select Subscribe, then enter your existing subscription URL. The example https://example.com/sub?token=xxxx is fictitious and cannot be used to connect.

3. Save the details

   Check that the URL has no extra spaces, line breaks, or punctuation. Add a recognizable note, then save.

4. Check the list

   Return to Home and check that server entries appear under the subscription. If they have not loaded, update the subscription, then select an entry to test.

If saving adds the subscription name but no servers, don’t add the same URL again. Check for an update error, then verify that the link is still valid and returns subscription data. Being able to sign in to a website does not mean the subscription request succeeded.

3. How do I update a subscription, and what should I check if it fails?

Updating a subscription reloads the server list. It does not renew your service or update rule files in Config. Pull down to refresh on Home, then check the subscription status and whether its entries changed; the refresh animation alone does not confirm success. Before updating a subscription you have edited manually, save any changes you need, since remote data may overwrite local edits.

4. Why does the app ask to add a VPN configuration the first time?

When you first enable a connection, the system may ask permission to add a VPN configuration. This system authorization lets Shadowrocket handle network traffic on your device; it is not part of importing a subscription. Continue only if the request comes from Shadowrocket, then follow the system prompts to complete verification.

1. On Home, select an imported server and make sure its details are complete.
2. Turn on the connection switch at the top of Home and read the system prompt to add a VPN configuration.
3. Grant permission, complete any system verification, then return to Home to check the connection status.
4. If you previously denied permission, turn the connection on again to see if the prompt reappears. You can also search for VPN in system settings and check whether the configuration is listed.

A system status of VPN Connected only confirms that the tunnel is connected; it does not verify server authentication, DNS, or access to a specific website. If the connection is established but pages won’t load, run Connectivity Test and check routing rather than repeatedly deleting the system configuration.

5. Which Global Routing option should I choose?

For everyday use with your existing rules, choose Config. To check whether a problem is related to rules, briefly switch to Proxy or Direct and compare. Config here is an option under Global Routing; the Config tab at the bottom is where you manage config files. Check both.

Scene does not mean “automatically choose the fastest server.” If you haven’t configured any scenes, don’t select it just because it sounds like an automation option. When troubleshooting is complete, restore your preferred routing option and note what changed between tests.

6. How do I switch configs, and why aren’t my rules working?

Open Config at the bottom, select the config file you want, choose Use Config from the action menu, then return to Home and set Global Routing to Config. Downloading, editing, or opening a file does not make it the active config. Keep a copy of the original file before editing so you have a known-good version to restore during troubleshooting.

The following is a rule-text example, not an app screen or a complete config. GEOIP matches based on the geographic database entry for the destination IP; check whether the resolved destination IP belongs to the region specified in the rule. PROXY, DIRECT, and REJECT mean proxy, direct connection, and reject, respectively. Don’t enter their explanations in place of rule policies.

[Rule]
DOMAIN-SUFFIX,example.com,PROXY
IP-CIDR,192.0.2.0/24,DIRECT,no-resolve
GEOIP,CN,DIRECT
FINAL,PROXY

7. Why does the connection switch turn off by itself, or turn back on after I switch it off?

First, distinguish a dropped connection from an automatic reconnection. For a dropped connection, check for network changes, server status, and interference from other VPN configurations. If it reconnects automatically, start by checking Settings → On Demand. On Demand triggers connection behavior under specified conditions; it cannot fix server authentication details or guarantee uninterrupted requests when the network changes.

• Reconnects after you disconnect manually: Check whether Settings → On Demand has a condition that matches your current network. Temporarily turn it off and check again.
• Drops when switching from Wi-Fi to cellular: Note when the switch occurred and confirm cellular data works. Reconnect, then repeat the same access test.
• Drops when another VPN starts: Check which VPN configuration is active in system settings. During troubleshooting, keep only the connection you’re testing.
• Drops only on one server: Keep the network and config unchanged, test another server entry you already have, and compare the results.

Closing the app window and turning off the VPN are not the same action. To stop the connection, use the switch on Home and check your On Demand conditions. If the system status and app display don’t match, check the current status in system VPN settings.

8. Why does Connectivity Test show latency when websites still won’t load?

A latency result reflects the response to that particular test; it does not prove that every request to a destination website will succeed. Run Connectivity Test on Home, then visit a specific destination. Record whether the test timed out, whether the connection was established, and whether the page showed a DNS or authentication error.

1. Check the server’s Type, Address, Port, and authentication fields against the details from your existing service. Use the actual port; don’t change it to 443 just because TLS is enabled.
2. Check the fields required by the protocol: the encryption method and password for Shadowsocks; the UUID for VMess or VLESS; the password for Trojan; and any required TLS, SNI, and transport settings.
3. For Hysteria2 or WireGuard, check the relevant authentication or key and address settings. Don’t copy fields from another protocol.
4. Check that your device’s date and time zone are correct. To sync the clock, go to System Settings → General → Date & Time and check that automatic time is enabled.
5. Temporarily compare Proxy and Config using the same destination. If only Config fails, check the rules, policies, and DNS settings in the active config.

Repeat the same test after each step. Don’t change servers and ports, disable TLS, and switch configs all at once; even if access returns, you won’t know which change fixed the problem.

9. How do I restore Shadowrocket on an iPhone, iPad, or new device?

Restore the app purchase first, then restore your connection details. These are separate steps: use the original Apple Account used for the purchase to get the app again from your App Store purchase history. Whether your servers, subscriptions, and configs can be restored depends on whether you saved the details or made a suitable backup. Reinstalling the app does not mean all your settings have been restored.

If you rely on iCloud or a system backup, first confirm that the relevant sync has completed on the old device. After migration, verify each item instead of assuming everything will appear automatically. Whether two devices can use the same service at the same time depends on the connection limits of the service you already have, not on how many times you purchased the app.

10. What information should I record to make troubleshooting easier?

A useful report should make it possible to reproduce the same issue. Include the network, protocol, Global Routing option, active config, and whether the error occurred during subscription update, connection setup, or actual access. “Connectivity Test times out, but the subscription updates successfully” is more useful than “It won’t connect.”

• Keep test conditions consistent: For example, “Home Wi-Fi, Global Routing set to Config; switching to Proxy restores access to the same destination.” This narrows the investigation to rules or related settings.
• Record the exact message: Keep English error text such as timeout and note when it occurred. Don’t label every error as a “network issue.”
• Remove sensitive details: Never include subscription URL tokens, passwords, UUIDs, private keys, or QR codes in public support requests.
• Keep a rollback point: Back up the config before editing and change one thing per test. Restore any temporary routing or automatic connection changes when you’re done.