Shadowrocket First-Time Setup: VPN Permission and Home Screen Guide

VPN Permission: What You’re Allowing

Shadowrocket uses Apple’s Network Extension capabilities to handle traffic. During initial setup, iOS may ask for permission to add a VPN configuration. This prompt may also appear the first time you turn on the connection toggle rather than as soon as you open Home. Tap Allow and complete any authentication requested by the device. The timing and wording of the prompt may vary by device.

This permission allows the app to establish a local VPN connection. It does not import a subscription or create server addresses, ports, or credentials. The system VPN configuration, Shadowrocket rule configuration files, and server details from your provider are three separate things. System permission alone is not enough to reach destinations that require a proxy.

1. Verify the App

   Make sure the app is named Shadowrocket, the App Store developer is Shadow Launch Technology Limited, and the app ID is 932747118. To verify these details again, visit the app guide.

2. Open Home

   Open the app and check whether SERVER already has any entries. An empty list means you haven’t added server details yet; it doesn’t mean system authorization failed.

3. Allow the Configuration

   When the system asks to add a VPN configuration, tap Allow and complete any authentication required by your device. If the prompt hasn’t appeared yet, prepare your server details, then try the Home connection toggle.

4. Check the Status

   Return to Home and check the connection status. Permission granted doesn’t mean the connection is working: you still need to select a server and verify it with Connectivity Test and an actual request.

Home, Config, and Settings: What Each One Does

Home is where you manage the current connection, routing mode, tests, and server selection. Config is for configuration files and their rules. Settings contains app preferences, including On Demand. On your first run, establish a working manual connection in Home before changing other settings. This makes it easier to tell connection issues apart from automatic connection behavior.

The Home connection toggle starts or stops the local connection. Global Routing determines how requests are routed. Connectivity Test provides a way to diagnose connectivity. SERVER lists imported or manually added servers. These sections work together but don’t replace one another: changing the routing mode won’t fix an incorrect password, and selecting a server won’t add missing rules to a configuration file.

• Check the current connection: Return to Home and review the connection toggle and status. The app being open in the foreground doesn’t prove that you’re connected.
• Check your routing rules: Open Config, confirm which configuration file is active, then review its rule order and policies.
• Check automatic connection: Go to Settings → On Demand and confirm whether it’s enabled and what conditions apply.

SERVER List: Import First, Then Choose a Default Server

This guide assumes you already have a provider and subscription of your own. Get your subscription from your provider. Shadowrocket is a closed-source, paid app available as a one-time purchase through the App Store; buying the app does not include a service plan. Purchasing the app and obtaining a working server are separate steps. If SERVER is empty, start by preparing your own connection details.

To import a subscription, tap “+” in the upper-right corner of Home, choose Subscribe under Type, paste your own subscription URL, and save. Return to Home to check that server entries appear, and update the subscription if needed. Subscription URLs often contain credentials, so don’t include the full URL in public screenshots or support requests. To add a server manually, choose the Type that matches the protocol provided by your provider.

Shadowsocks, VMess, VLESS, Trojan, Hysteria2, and WireGuard use different fields and authentication methods. Don’t reuse a set of parameters for another Type just because the names look similar. Use the port provided by your provider; for example, enter 443 only if they specify it—443 is not a universal port for every protocol. Don’t replace the TLS server name with an IP address without checking the required value.

• In SERVER, tap the entry you want to use and check that the default-selection dot moves to it.
• Distinguish selecting an entry from editing it: saving changes in the editor doesn’t necessarily make that server the current default.
• The default server is used by proxy paths that reference the current server. Policy groups in Config may specify a server or selection method of their own.
• If an entry disappears or is renamed after a subscription update, check the default selection, policy references, and connection result again.

Global Routing: How Modes and Rules Work Together

Global Routing changes how traffic is handled; it doesn’t change your provider account or server settings. When troubleshooting for the first time, note the current mode. If Proxy works but Config doesn’t, check which rules match and where the policies point before changing passwords or reinstalling the app.

When learning Config, start with four common rule keywords. DOMAIN-SUFFIX matches domain suffixes; GEOIP matches based on an IP address’s geographic location; IP-CIDR matches address ranges; FINAL sets the policy for requests that haven’t matched an earlier rule. Rules are generally evaluated in order, so put more specific conditions before broader ones.

[Rule]
DOMAIN-SUFFIX,example.com,DIRECT
IP-CIDR,192.168.0.0/16,DIRECT
GEOIP,CN,DIRECT
FINAL,PROXY

Connection Toggle and Connectivity Test: How to Check That It Works

After selecting a server, turn on the connection toggle in Home. If the system asks for permission, grant it first. If the toggle immediately switches off again, check the system prompt and server settings. A toggle that stays on only indicates the connection is in its corresponding state; it doesn’t mean every destination is reachable. Test a destination’s response and make an actual request as well.

Latency tests in SERVER and Connectivity Test aren’t the same thing. Latency reflects the response under the selected test method; it isn’t a bandwidth guarantee. Connectivity Test results can also depend on the test destination, DNS, routing policies, and network conditions. If a test succeeds but a specific page won’t load, check the domain, matching rules, and route for that request.

• Toggle is on, but the test times out: Keep the same server, check your local network, then verify the address, port, authentication, and TLS settings.
• Proxy works, but Config doesn’t: Check the rule order in Config, the FINAL rule, and whether policy references point to a working route.
• Test works, but the destination doesn’t: Note the exact destination and what happens. Check whether the request goes direct or matches the expected policy; don’t assume one test result applies to all requests.
• Wi-Fi works, but cellular doesn’t: Retest with the same server and routing mode. Avoid changing the network and server at the same time, so you can isolate the cause.

Settings → On Demand: Configure It After Manual Connection Works

On Demand triggers connection behavior based on conditions you set. It determines when to connect; it doesn’t determine whether a server is available. Before using it for the first time, make sure manual connection, Connectivity Test, and an actual request all produce results you can interpret. Then review the conditions in Settings → On Demand.

If the connection comes back shortly after you turn it off, check whether On Demand is enabled and whether the current network meets its conditions. Assuming the toggle is broken could lead you to mistake normal on-demand behavior for a fault. After changing the conditions, try again on the same network and note the app’s status.

1. In Home, confirm the current server and Global Routing mode, then verify the connection manually.
2. Open Settings → On Demand and check whether it’s enabled and which network conditions are configured.
3. Adjust the conditions as needed. When troubleshooting for the first time, don’t also change the rules file or server settings.
4. Return to Home and observe the connection on the network you expect to use. Confirm that the behavior matches your settings.