How to Set Up Shadowrocket for the First Time: VPN Permission and Home Screen Guide

At a glance

For your first Shadowrocket setup, have your connection details ready, add and select a server on Home, check Global Routing, then turn on the connection switch and allow the system to add a VPN configuration. This guide is for first-time iPhone and iPad users. It explains the difference between connection status, routing mode, connection tests, and the server list, and ends with troubleshooting steps for connection failures and automatic reconnection.

Before connecting: understand the client, server, and configuration file

Shadowrocket is a closed-source commercial app for Apple platforms, available exclusively on the App Store. Before purchasing, verify the developer, Shadow Launch Technology Limited, and app ID 932747118. Check the App Store listing for current pricing and system requirements. This guide focuses on iPhone and iPad; interface labels may vary depending on what appears on your device.

A one-time app purchase is not a service plan. Buying Shadowrocket does not automatically provide a working server. The steps below assume you already have a service provider and subscription, or the connection details for a server you manage. This site does not provide, sell, or recommend nodes or subscription services. If you don’t have these details yet, you can explore the interface without repeatedly toggling the connection switch.

3 places to start

Home, Config, and Settings: connection, configuration, and app settings

2 types of information

Check server connection details separately from your .conf configuration file

932747118

App Store app ID for verifying the app

A server entry on Home contains details such as the address, port, and authentication. A configuration file in Config can define rules, DNS behavior, and more. Seeing new entries in the SERVER list after importing a subscription does not mean you have the routing rules you need or that they are enabled. Likewise, importing a .conf file alone does not guarantee that the proxy policies it references have a working server.

First-time setup: add an entry, then allow VPN configuration

The system permission prompt usually appears when you first try to connect and need to create a VPN configuration—not necessarily as soon as you open the app. Following these steps helps distinguish missing connection details from missing system permission.

Verify the app

Open Shadowrocket from the App Store and go to Home. First, make sure your existing service is active and have its connection details or subscription URL ready.
Add an entry

To use a subscription, go to Home → “+” in the top-right corner → Type → Subscribe. Enter your subscription URL and save. Subscription URLs are sensitive: don’t share pages or QR codes containing a real token.
Select a server

Return to Home and wait for the subscription to load, then select an entry in the SERVER list. To add a server manually, tap “+”, choose the protocol you actually use, and enter the address, port, and authentication details. Don’t enter a subscription URL as though it were a single server address.
Check routing

Go to Home → Global Routing and check the selected mode. Use Config if you have a suitable configuration. To temporarily check whether rules are affecting a request, you can use Proxy, then restore your original routing mode when you’re done.
Allow VPN configuration

Turn on the connection switch at the top of Home. When the system asks to add a VPN configuration, tap Allow and complete device authentication as prompted. Return to the app, check the connection status, then test a destination you’re authorized to access.

Home screen sections: switches, lists, and tests

Not Connected is a status, not an explanation. It means there’s no active connection; it doesn’t tell you whether the subscription is incorrect, the server is down, or system permission is missing. The switch at the top starts or stops the connection. Global Routing controls how requests are handled. The SERVER list lets you select a connection entry, and Connectivity Test checks connectivity. Treat these as four separate things.

Connection and routing

Not Connected: Shows that you’re not connected. Check the switch and permissions first.
Top switch: Starts or stops the connection; it doesn’t import subscriptions.
Global Routing: Choose a routing mode such as Proxy, Direct, Config, or Scene.

The switch controls whether you’re connected; the routing mode controls how requests are handled once connected.

Entries and tests

SERVER: Shows server entries or subscription groups. Select the entry you want to use.
Connectivity Test: Checks connectivity using the current test settings. Interpret the result in the context of the test destination.
Config: Manage configuration files. If using Config routing, check which configuration is active.

An entry appearing in the list, a test returning a result, and a real request succeeding are separate things to verify.

A latency result only shows that the test received a response at that time using that test method. The test destination, timeout, and network conditions can all affect the result; a lower number doesn’t mean every website will load faster. If the test responds but a particular page won’t open, check the rules for that page, DNS, and the destination itself instead of repeatedly choosing the entry with the lowest latency.

Global Routing: choosing between four modes

For your first setup, decide what you’re trying to verify: whether the server can proxy requests, or whether the rules in your configuration work. Proxy and Config serve different troubleshooting purposes. The recommendation below applies only to everyday use with a suitable configuration already in place and checked; it is not a recommendation for any connection service.

Config

Recommended

Uses the rules in the active configuration to determine how requests are handled. Rules can specify DIRECT, PROXY, or another defined policy. Check settings such as FINAL at the end of the configuration to see how unmatched requests are handled.

Use when: you have a suitable configuration and want to route traffic based on domains, IP addresses, or other conditions.

Proxy

Handles requests intercepted by the app through the proxy, rather than deciding where each request goes according to the regular rules in Config. You still need valid server details; switching to this mode won’t fix authentication or server-side issues.

Use when: you want to temporarily check the selected server and narrow down the effect of routing rules.

Direct

Handles requests through a direct connection. A page opening in this mode does not prove that a proxy server is working. Selecting Direct in Global Routing is also different from turning off the connection switch at the top.

Use when: you want to compare whether the same destination is accessible directly on your current network.

Scene

Routes traffic according to settings for specific scenarios. The actual behavior depends on the configured scenario conditions and their corresponding actions. Before checking those settings, don’t assume from the name alone which route will be selected.

Use when: you’ve set up scenarios and can verify their trigger conditions and routing behavior.

This minimal example is for understanding Config rules. It contains no server details and is not a complete configuration required for your first connection. DOMAIN-SUFFIX matches domain suffixes, rules are checked in order, and FINAL handles requests that haven’t matched an earlier rule.

[Rule]
DOMAIN-SUFFIX,example.com,PROXY
FINAL,DIRECT

In this example, example.com and its subdomains use PROXY; other requests that don’t match a rule use DIRECT. So “connected, but a request goes direct” may be exactly what the configuration specifies. When using GEOIP or IP-CIDR, also consider whether the destination IP is available and whether domain resolution affects matching. You don’t need to add these rule types just to get started.

SERVER and subscriptions: check adding, updating, and selecting separately

A subscription is a way to retrieve multiple connection entries; it is not a connection status. The sample URL https://example.com/sub?token=xxxx illustrates URL structure only. The token is clearly fake and does not provide a working service. Enter the real URL for a service you already have, preserving its existing query parameters.

Check the contents after adding: Return to Home and see whether entries appear under the subscription group. If you see only the group name and no server entries, first check that the URL is complete, the service is active, and the current network can retrieve the subscription.
Check again after updating: Refresh the subscription by pulling down on Home, then check whether the entries actually changed and whether your previously selected entry is still there. Updating a subscription does not automatically switch you to a new server.
Confirm your selection before connecting: Tap the SERVER entry you want to use, then turn on the connection switch. Don’t assume an entry is selected just because of its position in the list or because you tested it recently.
Check these fields when adding a server manually: Type must match your service. For example, a Trojan password and the encryption method and password for Shadowsocks are different protocol fields; changing the name alone won’t make them interchangeable. Use the actual port provided by your service provider.

If importing succeeds but the connection fails, troubleshoot subscription updates and connection tests separately: first confirm that entries can be retrieved, then check whether the selected entry connects. Check configuration file updates separately in Config; a successful subscription refresh does not mean the rules file has also been updated.

Settings → On Demand: connect manually first, then set up automatic connections

On Demand triggers VPN connection behavior according to configured conditions. It is not a latency tester or a way to fix server details. For your first setup, establish a repeatable manual connection before going to Settings → On Demand to check its conditions and actions. Otherwise, automatic triggers can make connection issues harder to diagnose.

Two-step check: manual connection and On Demand

First manual connection

Select a server entry on Home.
Keep Global Routing fixed so you’re not changing multiple variables at once.
After connecting, access the same destination, then disconnect manually for comparison.

Automatic connections

Go to Settings → On Demand and check the existing conditions.
Check the connection action for each network condition, such as Wi-Fi.
After switching networks, check whether the expected action is triggered; don’t rely on the switch’s appearance alone.

First confirm that a manual connection works, then test automatic triggers. Global Routing controls how traffic is routed; On Demand controls when a connection is triggered by its conditions.

If the connection comes back after you disconnect manually, first check On Demand and the on-demand connection status in the system VPN configuration for any automatic triggers. Don’t delete all entries right away. To turn off automatic connections, check both the app settings and the actual status of the VPN configuration in the system, then repeat the same network-switching steps to verify the change.

After connecting: troubleshoot by symptom

A change in connection status is only the first step; next, check whether requests are handled as expected. These are troubleshooting steps, not results from tests conducted by this site, and the same behavior is not guaranteed on every network. Change one setting at a time and note its original value so you can restore it.

The switch won’t stay on: Check whether the system has allowed a VPN configuration, whether a server is selected, and whether the app shows an error. Not seeing a permission prompt isn’t necessarily a problem; a configuration may already have been created.
The subscription list is empty: Check the URL, subscription validity, and any update errors first. Changing Global Routing can’t create a server entry when the list has none.
Connected, but the destination won’t open: Check the current Global Routing mode, the active configuration in Config, and whether the destination matches the expected policy. Compare the same destination in Proxy and Direct, then restore the original settings after testing.
The test responds, but the page won’t load: Confirm that the test destination and the webpage are different checks, then examine DNS resolution, access restrictions on the destination, and the actual connection to the selected entry.
Behavior changes after switching Wi-Fi: First check whether the new network can access the destination, then review Scene and On Demand conditions. Don’t conflate a routing change with an automatic connection change.