1. Add Server: Add or Import a Server
Open Shadowrocket and go to Home. Check the SERVER list first. If it already contains the server you want to use, there’s no need to add it again; verify its details and select it as the default. If the list is empty or doesn’t contain the connection you need, tap the add button in the upper-right corner to open Add Server. Choose an import method based on the details you have. Don’t enter a subscription link as a server address.
Have a Subscription Link? Choose Subscribe
In Add Server, open Type and choose Subscribe, then paste the subscription link from your service provider into URL. Keep the entire link, including any parameters at the end. When copying, avoid extra text, line breaks, and spaces at either end. Use the remarks field only to identify the subscription with a name you’ll recognize. Check the details and save, then return to Home. Wait for the subscription request to finish and check that server entries appear in the corresponding group.
Saving a subscription entry is not the same as successfully retrieving a server list. If you see the subscription name but no servers to select, check for an update error before turning on the connection. Copy the link again from its original source and confirm the subscription is still valid; creating the same subscription again usually won’t fix an incorrect URL. To refresh it later, use the update action for that subscription and check the list afterward. Don’t assume the update succeeded just because you tapped the button.
Have Details for One Server? Check the Protocol and Fields
If you have details for a single server, choose the exact matching protocol in Type under Add Server, then enter the server address, port, and required authentication details. Shadowsocks, VMess, VLESS, Trojan, Hysteria2, and WireGuard use different fields; don’t just change the protocol name while keeping fields from another protocol. Check the encryption, transport, TLS, server name, and other options against the details you received. Ask your service provider if anything is unclear.
If you have a supported share link or QR code, you can use the import option in the app. Scan QR Code reads QR codes. After importing, open the entry and check that the protocol and server address match your details. Scanning a code is just an input method; it doesn’t confirm that the settings are valid. Don’t guess at missing fields or put authentication details in the remarks or address field.
Return to SERVER: Choose the Default Server
After saving, return to Home and tap the server you want to use in the SERVER list. Confirm that it shows the default selection marker, DOT. Entries with similar remarks may belong to different groups, so check the subscription and protocol as well. The default server determines which connection is used for requests that need a proxy. A server appearing in the list does not mean it is currently selected as the default. For now, leave other settings alone; next, choose how Global Routing should handle requests.
2. Global Routing: Choose a Routing Mode
Tap Global Routing on Home and choose how you want requests handled. The three modes are Config, Proxy, and Direct. They control request handling; they don’t fill in server details or restore an expired subscription. When getting started, test server availability separately from rule behavior to make issues easier to diagnose.
Proxy: Check Server Connectivity First
Proxy handles requests managed by the app using a proxy. It’s useful for temporarily checking whether the default server is reachable when you first connect. After selecting it, return to Home and check the default server marker again. This isn’t an extra speed-boost setting and doesn’t guarantee that all traffic on your device follows the same route; system traffic and app behavior can differ. There’s no need to edit rules yet—first connect and test real-world access.
Config: Handle Requests Using the Current Configuration
Config handles requests according to the rules and policies in the current configuration. Before using this mode, open Config and confirm that the configuration you intend to use is set as current, not merely saved in the list. A configuration file and a server subscription serve different purposes: the former defines behavior such as routing and DNS, while the latter typically maintains a server list. Successfully importing a subscription doesn’t mean the current configuration’s rules suit your needs.
If you already have a working configuration, leave it unchanged until you’ve connected successfully. Rules are matched in order, and an earlier rule may determine where a request goes. Even with a working default server, requests matching DIRECT won’t use the proxy policy. This guide doesn’t cover editing rules. For details on DOMAIN-SUFFIX, IP-CIDR, and FINAL, see the Configuration section. Avoid changing DNS, rules, and server settings all at once during your first connection.
Direct: Check the Direct Connection Path
Direct handles requests without using the selected proxy server. It can help you compare direct access on your current network, but it can’t test whether the server’s proxy connection works. If you choose Direct and see a connection status or a page loads normally, that doesn’t prove the proxy server is available. To test a server for the first time, switch to Proxy or confirm that the relevant request matches a proxy policy in Config.
After choosing a mode, note which one you selected and why. Don’t switch repeatedly between modes during testing; the same page may take a different route each time. Next, turn on the connection. If you change modes later, reconnect and test again rather than relying on earlier results.
3. Home: Turn On the Connection
Return to Home and check these two items in order: the correct default server is selected in SERVER, and Global Routing is set to the mode you just chose. If your subscription includes multiple servers, stick with one for this test; don’t switch servers while connecting. Once confirmed, turn on the connection switch near the top of the screen. When disconnected, the app may show Not Connected. Wait for the status to update during connection and avoid toggling the switch repeatedly, which can make it harder to tell authorization from connection progress.
First-Time Authorization: Allow the VPN Configuration
The first time you connect, iOS may ask to add a VPN configuration. This lets Shadowrocket use the networking capabilities provided by the system; it only concerns system permissions and doesn’t mean the server has connected successfully. Confirm that Shadowrocket initiated the request, tap Allow, and complete authentication as prompted. System permission dialogs may vary by language. The English terms in this guide refer to the app’s interface, not fixed wording for system dialogs.
If you previously denied permission, the connection switch may not stay on. Try connecting again in the app and watch for another system request. Managed devices or system restrictions may prevent a VPN configuration from being added or enabled. Check that your device permits this action; re-importing server details won’t resolve a permissions issue. Once authorized, return to Home and check the switch and connection status instead of judging the result from the system settings screen.
Connection Status: Check Before Leaving the Screen
If the connection switch stays on and the app shows a connected status, the system network connection has reached a certain stage—but you still need to test actual requests. A VPN status indicator alone doesn’t confirm that server authentication, DNS resolution, and access to your destination are all working. If the switch immediately turns off or the app shows a connection error, note the error text and protocol, then follow the troubleshooting steps below. Don’t enable On Demand before identifying the error; automatic reconnections can make it harder to diagnose.
After your first successful manual connection, you can consider On Demand in Settings. On-demand conditions determine when a connection starts; they don’t fix an unavailable server. Avoid having multiple VPN configurations handle the connection at the same time. First confirm that Shadowrocket is the active configuration. Keep the default server and mode unchanged, then check Connectivity Test and real-world access.
4. Connectivity Test: Verify the Connection
Tap Connectivity Test on Home and check the result for the current entry. It can help assess connectivity, but it isn’t a complete network quality report. Different test methods may check different destinations or stages, so a result for one test doesn’t mean every page will load. A timeout should also be assessed alongside real requests. First make sure you’re looking at the result for the current default server, not a previous test of another entry.
Compare Test Results with Real-World Access
After testing, open a page you expect to use or make a specific request in an app. Choose a destination where you can tell whether the result is expected, and check that it finishes loading rather than relying on the connection icon. To compare before and after connecting, keep the network, destination, and action the same, and test each time. Change only the client’s connection state. Cached content may continue to appear; refresh and make a new request if needed instead of treating an already loaded page as verification.
If you’re using Proxy and access fails, check the server, DNS, and current network first. With Config, also confirm which rule should match the request. A destination loading doesn’t mean it used the proxy; a rule may specify DIRECT. Likewise, one failed destination doesn’t immediately mean every server is unavailable. The destination itself, authentication status, and the app’s connection behavior can all affect the result.
Data: Check the Request Path
Return to the app and review the available traffic or request records in Data. Use the destination domain, time, and policy details to check whether the request appeared and was handled as expected. Interpret entries such as DIRECT and PROXY in the context of the current mode and configuration; a change in total traffic alone isn’t enough. Some requests may reuse an existing connection or appear under a different domain than expected. If a name is missing, make the request again and check the relevant records.
A successful check should include at least three results: the Home connection status stays stable, the selected server completes the relevant test, and the expected page or app request succeeds. If you need rule-based routing, also confirm that the request uses the expected policy. The network icon, test results, and traffic counters each reflect different things. Don’t treat any one of them as conclusive or replace multiple settings based on a single test.
Once verified, keep this working combination: the current server, Global Routing mode, and configuration. Use it as a baseline for future changes, repeating the same tests after each adjustment. To learn more about routing records and DNS, see Common Settings. If results don’t match expectations, follow the troubleshooting steps next.
5. First Connection Issues: Troubleshoot in Order
First identify where the failure occurs: no server entries, the connection switch won’t stay on, Connectivity Test times out, or only some requests fail after connecting. Each issue has a different place to start. Keep the error text and note the current network, default server, and Global Routing mode. Change one thing at a time and test before moving on. Updating the subscription, switching servers, changing modes, and editing DNS all at once can erase useful clues.
No Servers in the List? Check the Import
If there are no selectable entries in SERVER, return to the subscription and confirm the URL is complete and the latest update succeeded. Subscription links may contain authentication parameters; omitting the end of the link can prevent the server list from loading. Try one update on your current network to distinguish a failed request from a response the app couldn’t recognize. Follow any specific error message. Check the subscription’s validity, access, and response format with your service provider. Repeatedly creating subscriptions with the same name won’t replace these checks.
Can’t Connect? Check the Selection, Permissions, and Protocol Details
If a server entry exists but the connection fails, first confirm it’s selected as the default, then check VPN configuration permissions. Open the server entry and compare each field with the original details: address, port, protocol, authentication, and any required transport or TLS settings. A responsive port doesn’t mean the authentication details are correct, and choosing the right protocol doesn’t ensure its additional fields match. Don’t disable certificate verification or change the server name at random to pass a test; restore the correct settings instead.
Also check that your device’s date and time are accurate. An incorrect system clock can affect certificates and authentication, especially for connections using TLS. Correct the time, reconnect, and test again. If the subscription includes another server known to work, switch only the default server for comparison and leave other settings unchanged. If one server fails and another works, check the failed entry’s details and service status first.
Connected but Can’t Access Content? Isolate Rules and Network Issues
If requests fail with Config, temporarily switch to Proxy and test the same destination using the same server. If Proxy works but Config doesn’t, check rule matching, policy references, and DNS settings in the current configuration. This is a diagnostic step, not a recommendation to use Proxy permanently; it narrows the issue down to the configuration. If both modes fail, check the server details and current network before looking into configuration details. Don’t rush to rewrite the entire ruleset.
If your device allows it, compare Wi-Fi and cellular networks. Change only the network; keep the server, mode, and destination the same. Different results suggest the network environment may be involved, but don’t prove which part is responsible. Some Wi-Fi networks require you to sign in first; without that, subscription updates and server connections may both fail. Confirm that regular pages load directly, then test Shadowrocket again.
Keep What Works Before Changing Advanced Settings
If only one app or destination fails, check its request records first instead of deleting all servers or resetting every setting. If the issue started after a subscription update, confirm that the default server still points to a valid entry. An update can change the list, and an entry with the same name may not have identical settings. If the problem started after a configuration update, compare it with your backup and confirm that Config still points to the configuration that worked.
If you need further help troubleshooting, describe the issue without sharing sensitive information: the failed step, error text, protocol, Global Routing mode, and whether the result differs across networks. Don’t post passwords, keys, or complete subscription links. See Troubleshooting for common causes and fixes, or the maintenance section of the user guide for updates, backups, and ongoing upkeep.