Shadowrocket FAQ: 10 Common Questions About Getting Started

1. Can I connect as soon as I buy the app?

Buying Shadowrocket gives you a license to use the client, not a connection service. It is a closed-source commercial app for Apple platforms, primarily used on iPhone and iPad, and is available exclusively on the App Store. The store listing also includes compatibility information for Mac, Apple TV, and Apple Vision. Check the App Store listing for system requirements and Universal Purchase availability.

The one-time purchase of the client is separate from any fees charged by your own service provider. Before setup, have your subscription URL or the complete server address, port, and authentication details ready. A server name, a latency figure in a screenshot, or a password alone isn’t enough to create a working connection. This guide covers using connection details you already have; it does not cover obtaining a connection service.

2. What are Home, Config, and Settings for?

First, distinguish the server list from configuration files. Entries in Home describe where to connect and which protocol to use. Files in Config describe how requests match rules and which policies handle them. Importing a server doesn’t mean you’ve selected a suitable rules file, and saving a configuration file doesn’t mean the server’s authentication details are complete.

Home

View and select servers, add connection entries, toggle the connection, and choose the current routing mode with Global Routing. Connectivity Test checks the server connection.

Config

Manage and select configuration files. To inspect [General], [Rule], or routing policies, open the file currently in use here.

Settings

Change app settings. For example, go to Settings → On Demand to review connection triggers, or Settings → Subscribe to check subscription update options.

For an initial check, confirm the selected server and Global Routing in Home, then check the active file in Config, and finally review Settings for automatic connection or update options. This order helps avoid editing an inactive configuration and mistakenly concluding that its rules aren’t working.

3. How do I import my subscription URL?

To add a server subscription, tap “+” in the top-right corner of Home, open Add Server, and select Subscribe under Type. This adds a server list subscription; it’s separate from the rules configuration managed in Config. Before importing, make sure you have the complete subscription URL—not an account sign-in page or a webpage that requires browser interaction.

1. Open Add Server

   Go to Home and tap “+” in the top-right corner to open Add Server. Select Subscribe under Type; don’t leave another protocol type selected.

2. Paste the complete URL

   Enter your subscription URL in URL. Check that the beginning, query parameters, and ending are intact, and remove any spaces or line breaks added when copying.

3. Save and update

   Save the entry, then return to Home and pull down to refresh the subscription. Wait for the list to finish updating, then check that server entries appear—not just the subscription name.

4. Select a server

   Select an existing server and run Connectivity Test. Confirm your selection before turning on the connection so the test and actual connection use the same entry.

Subscription URLs often contain account tokens and should be treated like passwords. The example below is for formatting only and cannot be used to connect. When sharing diagnostic details, redact tokens, passwords, and other authentication fields.

https://example.com/sub?token=xxxx

4. How do I fill in Add Server with server details?

Go to Home → “+” → Add Server, select a Type, and enter the details provided by your service provider. Shadowsocks, VMess, VLESS, Trojan, Hysteria2, and WireGuard use different authentication and transport fields. Changing only Type while leaving all other fields unchanged won’t work. If your subscription already contains the complete details, check the imported entries first instead of entering everything manually.

• Address and port: Enter the server’s domain name or IP in Address and the actual port in Port. If the details give you server.example.com and port 443, don’t include https:// or :443 in Address. Port 443 alone doesn’t prove that the service uses TLS.
• Authentication: For Shadowsocks, check the encryption method and password. For VMess and VLESS, verify identity fields such as the UUID. For Trojan and Hysteria2, check the relevant authentication details. Don’t use a subscription token as the server password.
• Transport: If the details include TLS, SNI, a WebSocket path, or similar settings, enter each one exactly as provided. The server address and SNI may differ; don’t change them just to make them match.
• WireGuard: Enter the keys, interface addresses, and peer details from the actual configuration. You can’t convert a standard proxy’s address and password directly into a WireGuard configuration.

Save the entry and test it first. If other entries in the same subscription connect but the manually added one doesn’t, check each manually entered field before changing the entire rules file. The available fields vary by Type; follow the current interface.

5. Which Global Routing mode should I choose?

Choose a routing mode in Home → Global Routing. It determines how the current connection uses servers and rules; it isn’t a protocol type or the server’s location. For a first-time setup, verify that your configuration works, then use Config for everyday routing. If you haven’t set up rules yet, first identify which mode you’re using for the test.

6. Where is the connection switch, and how do I authorize it?

The connection switch is in Home. The first time you turn it on, the system asks for permission to add a VPN configuration. Follow the prompt and authenticate on your device. This permission lets the app create a system network tunnel; it isn’t a purchase confirmation and won’t fill in missing server details.

1. In Home, select the server you want to use. Make sure you selected a server, not just the subscription group name.
2. Open Global Routing and confirm the mode for this session. If you choose Config, also confirm the active file in Config.
3. Return to Home, turn on the connection, allow the system to add the VPN configuration, and authenticate.
4. Check the connection status, then visit a destination to test it. When you’re done, return to Home and turn off the connection.

A system status of VPN Connected only confirms that a tunnel has been established; it doesn’t prove that every destination is reachable. Server authentication, the remote exit, DNS, and routing policies can still affect requests. If the connection turns off immediately, check system authorization and the server details first. If it stays connected but pages won’t load, follow the steps in question 10.

7. What is On Demand, and why does the connection turn back on?

On Demand triggers a connection based on network conditions. Find it under Settings → On Demand. It serves a different purpose from Global Routing: On Demand determines when to connect, while Global Routing determines the routing mode after connecting. Before troubleshooting, check whether On Demand is enabled and review its configured network conditions and actions.

If the connection comes back after you disconnect manually, first check whether On Demand triggered it again. Don’t immediately delete servers or configurations. Switching from Wi-Fi to cellular or rejoining a network may cause configured conditions to be evaluated again. After restoring On Demand, switch networks to test it—don’t rely on the toggle in Settings alone.

8. Where are configuration files, and in what order do rules apply?

Manage and select a configuration file in Config, then choose Config in Home → Global Routing. Rules in the [Rule] section are generally checked from top to bottom, and the first matching rule determines the policy. Put specific domain rules before broader ones, and use FINAL as the fallback when no earlier rule matches.

[Rule]
DOMAIN-SUFFIX,example.com,DIRECT
IP-CIDR,192.168.0.0/16,DIRECT,no-resolve
GEOIP,CN,DIRECT
FINAL,PROXY

• DOMAIN-SUFFIX matches a domain suffix. The example covers example.com and its subdomains, not arbitrary text in a webpage URL.
• IP-CIDR matches a destination IP range. In the example, no-resolve means not to actively resolve a domain for this IP rule; it doesn’t disable DNS for the whole app.
• GEOIP matches based on the geographic database result for the destination IP. You can’t determine a match from the domain text alone.
• FINAL handles requests that didn’t match an earlier rule. The example uses PROXY as a fallback, but an actual file can use another valid policy.

This is a rule snippet, not a complete configuration with all connection details. Make sure PROXY or another policy can select a server correctly in your environment. Putting FINAL first prevents later rules from working as intended. Editing a file won’t affect current requests unless that file is selected.

9. Are subscription updates and configuration updates the same thing?

No. Updating a server subscription mainly retrieves the server list and connection details. Updating a remote configuration may change rules, policies, and other settings. A successful subscription refresh in Home doesn’t mean the rules in Config have been updated. Likewise, updating a rules file won’t fix an incorrect server password.

Server subscription updates

Return to Home and pull down to refresh. Check whether servers were added, removed, or had their details changed. After updating, confirm which entry is selected—especially if the previous entry has disappeared.

Configuration file updates

In Config, check the remote configuration and its update status. After updating, review the actual contents and the file currently in use; don’t rely on the file name alone.

Change the update route

If the subscription URL is unreachable over a direct connection but an existing server works, go to Settings → Subscribe, check Update via Proxy, and try updating again.

Update via Proxy requires a working proxy connection; it won’t make an invalid subscription URL valid again. If your existing servers can’t connect either, repeatedly enabling this option won’t help. When an update fails, first distinguish a timeout from failed authentication or a response that isn’t in subscription format. Then verify the full URL instead of assuming every failure is a network issue.

10. Why can’t I access a site even when Connectivity Test returns a result?

Connectivity Test in Home checks some aspects of the server connection, but it doesn’t verify every website, protocol, or rule. If the test reports latency but a destination fails, keep the same server and check the routing mode, the destination’s rule, and DNS separately. Don’t change the server, configuration, and network all at once, or you won’t be able to compare results.

Change one condition per test and record the network, server, Global Routing mode, destination, and failure. For example, if the same server times out on Wi-Fi but connects over cellular, check for restrictions on the Wi-Fi network first. If both networks connect but the same domain fails under Config, check the rules first. For more help, see Troubleshooting or the Configuration Guide. Redact authentication details before sharing diagnostic information.