Shadowrocket Setup: 10 Common Questions About Connecting, Global Routing, and Subscriptions

1. Why do I need to add a configuration after buying the app?

Shadowrocket is a closed-source commercial app for Apple platforms, available as a one-time purchase through the App Store. The app reads configurations, establishes connections, and applies rules. Server addresses, ports, authentication details, and service validity come from a service you already have. Buying the app does not include a service plan or automatically create a usable remote configuration.

When you open the app for the first time, get familiar with its three main screens: Home lets you view servers, choose one, and connect; Config manages rule configuration files; Settings controls app behavior. A server list in a subscription does not mean you have selected a suitable Config file.

• Check the app: The developer is Shadow Launch Technology Limited, and the app ID is 932747118.
• Check your existing information: verify server details and rule files separately; they serve different purposes.
• Check device requirements on the App Store page. For availability and purchase details, see the official app verification page.

2. How do I authorize the VPN configuration for the first connection?

When you turn on the connection for the first time, the system may ask whether to allow a VPN configuration to be added. This permission lets the app create a system network tunnel; it is not a purchase confirmation and does not verify that the remote server is reachable. Grant permission only after confirming that the request comes from Shadowrocket.

1. Check the configuration

   Go to Home, confirm that your server details have been imported, and select the server you want to use. If the list is empty, do not use that to judge whether the connection feature is working.

2. Choose a mode

   Open Home → Global Routing and choose Config, Proxy, or Direct as needed. If you choose Config, first confirm that the intended configuration file is enabled on the Config screen.

3. Grant permission

   Return to Home and turn on the connection switch. Approve the VPN configuration request when prompted, then complete any device authentication required.

4. Check the result

   Wait for the connection status to change, then visit a site to test it. If you previously denied permission, try turning the connection on again from Home and check the existing VPN configuration in system settings.

3. Does turning on the connection switch route all websites through a proxy?

No. The connection switch controls whether the app's tunnel is active. Global Routing determines how traffic is handled, and the selected server determines where traffic goes when a proxy is used. Check these three states separately. Even when the system reports that the VPN is connected, rules may route traffic through DIRECT, or the app may be in Direct mode.

When the switch is off, Shadowrocket no longer handles traffic through its tunnel. Your device's network or another system VPN configuration may still affect access. When troubleshooting, note the difference before and after turning the switch off rather than relying on the status bar icon to determine whether the remote service is available.

4. How do I choose Config, Proxy, or Direct in Global Routing?

If you already have a suitable rule file, use Config for everyday traffic. To check whether a problem is caused by routing rules, temporarily switch to Proxy. To establish a direct-connection baseline, use Direct. Restore your previous mode when testing is done so temporary troubleshooting settings are not left in place.

If the interface also shows Scene, treat it as an entry point for applying presets by scenario, not as a new transport protocol. Before enabling it, check the mode and configuration associated with the scene. When troubleshooting, start with one clearly defined mode to reduce variables caused by automatic switching.

5. How do I import my subscription, and what changes when I update it?

On Home, tap “+” in the upper-right corner, set Type to Subscribe, and enter a subscription URL you already have. Save it, return to Home, and update the subscription. Example URL: https://example.com/sub?token=xxxx. This is only a format example and cannot be used to obtain a configuration. A token in a real URL often grants access, so do not share it in public screenshots or support messages.

1. First, check that the URL is complete, including https://, the path, and query parameters. When copying it, make sure no spaces or line breaks are included.
2. After saving, update the subscription from Home. Wait for the operation to finish, then expand the list to check its entries.
3. Select a server that is available after the update. An existing entry may have been renamed or removed, so the previous selection may no longer work.
4. To adjust whether subscription updates use a proxy, check Settings → Subscribe → Update via Proxy and decide whether to enable it based on network access.

A subscription update usually refreshes the server entries; it does not renew the service or refresh every remote resource in Config. A successful update only confirms that the subscription URL returned readable content. Test each server separately to see whether it connects. If an update fails, keep the error message and first check whether the link has expired and whether the current network can reach it. Then decide whether to change the update route.

6. What's the difference between adding a server by QR code and importing a subscription?

A QR code is one way to enter information. Whether it adds a single server or a group of servers that can be updated depends on what the code contains. Use the QR scanner on Home to scan your own configuration code. When prompted for camera access for the first time, follow the system instructions. Review the imported details before saving.

• Single server configuration: Check Type, address, Port, and authentication fields. If the parameters change later, you will usually need to edit or import the configuration again.
• Subscription URL: Verify its source and full address. Save it as Subscribe to enable updating entries from that URL.
• Scan failed: Check that the QR code is complete and clear, and that it contains a configuration format supported by the app rather than an ordinary webpage.

Scanning the same QR code more than once may create duplicate entries. Do not delete entries based on their display names alone; compare the protocol type, server address, and port first. If the configuration uses Shadowsocks, VMess, VLESS, Trojan, Hysteria2, or WireGuard, keep the original protocol field. Do not change the Type just to make it “look the same.”

7. Why do webpages still fail when the latency test shows a low value?

A latency test measures a specific probe; it is not a webpage load time, available bandwidth, or measure of whether every service will work. Connectivity Test on Home can provide an initial check, but first confirm the test method and target selected under Settings → Connectivity Test. Results from different methods cannot be compared directly, even for the same server.

• A value appears but webpages fail: The basic probe may succeed while the destination's DNS, TLS, routing policy, or remote access still fails.
• The test times out but some webpages work: The test target or probe method may be restricted. Try a known reachable target for comparison.
• Results vary widely: Keep the network, target, and test method the same and run several tests in a row. Do not treat a single fluctuation as a stable result.

When entering a server Port, use the exact value from your existing configuration. For example, 443 is a common port for HTTPS, but that does not mean every server listens on it. Changing every port to 443 will not fix authentication failures or a protocol mismatch.

8. Will the connection drop when I leave the app? What is On Demand?

Returning to the Home Screen is not the same as turning off the connection switch. The system network tunnel may keep working while the app is not in the foreground. Check the system VPN status and actual request results to see whether the connection is still active. Force-quitting the app is not a standard way to disconnect.

Settings → On Demand configures automatic connection behavior. When enabled, the system may initiate a connection based on the conditions you set. If it reconnects after you manually turn it off, check this setting before repeatedly deleting configurations. On Demand cannot fill in missing server details or fix expired authentication.

1. Go to Settings → On Demand and check the main switch and existing conditions.
2. While troubleshooting, turn off On Demand, then use the connection switch on Home to control the connection manually.
3. Once the manual connection is stable, restore the conditions you need one at a time and observe what happens when switching between Wi-Fi and cellular networks.

9. What should I check if Config rules or DNS are causing problems?

First, check which file is selected on the Config screen, then review the rule order. Rules are generally evaluated from top to bottom, so more specific conditions should appear before fallback rules. The example below only shows how to “proxy a specified domain and connect directly to everything else.” It is not a complete server configuration and does not create a service.

[Rule]
DOMAIN-SUFFIX,example.com,PROXY
FINAL,DIRECT

• DOMAIN-SUFFIX matches domain suffixes, such as example.com and its subdomains.
• IP-CIDR matches IP ranges; GEOIP uses IP geolocation data and does not identify a domain's language.
• FINAL handles requests that did not match earlier rules and should appear at the end. DIRECT in this example is not the default for every configuration.

DNS resolves domain names to addresses; rules determine how traffic is handled. They are separate settings. If only domain access is failing, first check that the [General] section and dns-server setting in the active Config match the original configuration requirements. Do not change multiple DNS sources at once. Accessing an HTTPS site directly by IP may cause certificate or SNI issues, so that test alone cannot confirm a DNS problem.

10. Connected, but webpages won't load: what should I check, and in what order?

Choose one test website and one server, change only one setting at a time, and record the result. Check the local network, selected server, Global Routing, rules, and DNS in order. This makes problems easier to isolate than changing everything at once. Record the network type, time, mode, test method, and error message; do not include passwords or subscription tokens.

1. Turn off the connection. Confirm that your Wi-Fi or cellular network works and complete any network sign-in that may be required.
2. Return to Home. Confirm that the selected server is still included in an active subscription, then check its address, Port, protocol, and authentication details.
3. Run Connectivity Test. If it fails, check the server or network first rather than making major rule changes.
4. Temporarily select Proxy and test the same destination. If Proxy works but Config does not, check the rule and policy that match that destination.
5. Check DNS settings and On Demand behavior. If needed, switch networks and test again, then restore your usual mode.

If you need more help, share the steps you took, the error message, and the differences between your Config and Proxy tests, after removing sensitive information. These details can help distinguish input errors, network access problems, routing rules, and DNS issues. Avoid repeatedly importing the same configuration without evidence pointing to it.