How to Set Up Shadowrocket for the First Time: VPN Permission and Home Screen Guide

In this guide

This guide is for anyone opening Shadowrocket on an iPhone or iPad for the first time. First, understand the difference between iOS VPN permission and your connection details. Then learn about the connection switch, routing modes, test tools, and server list on Home. By the end, you should know which server is selected, how traffic is routed, and whether test results are enough to confirm that a website is reachable.

Before you start: prepare your purchase and connection details separately

Shadowrocket is a paid app available on the App Store as a one-time purchase, developed by Shadow Launch Technology Limited. This guide focuses on iPhone and iPad; check the App Store page for system requirements. If you haven't purchased the app yet, visit the purchase verification page to check the app name, official icon, and app ID 932747118.

Buying the app does not include a service plan. After purchase, Home may not contain any usable SERVER entries. The steps below assume you already have your own provider, server details, or subscription. VPN permission only allows Shadowrocket to create a connection on your device; it does not supply server addresses, credentials, or subscription details.

App: Make sure Shadowrocket is open, not just its App Store listing.
Connection details: Have your own subscription URL or complete server parameters ready. Don't post your subscription URL publicly.
Network: Before connecting Shadowrocket, open a website you can normally access to check that your Wi-Fi or cellular connection is working.

Add a VPN configuration: grant system permission when prompted

The VPN configuration prompt usually appears the first time you try to connect, not necessarily as soon as you open Home. iOS asks for confirmation because Shadowrocket needs to create a VPN configuration that handles your device's network traffic. After granting permission, select a usable server before testing access.

Check your network

Make sure your Wi-Fi or cellular connection is working. Return to Shadowrocket → Home and check whether SERVER already has entries. Don't keep trying to connect if the list is empty.
Import your details

To use your own subscription, go to Home → “+” in the top-right corner → Type → Subscribe, enter your subscription URL, and save. Wait for the content to load, then check for individual servers under SERVER.
Select a server

Go to Home → SERVER and tap an individual server. Check that its row shows the selection indicator. A subscription group heading is not a selected server, and adding an entry does not start a connection.
Allow the configuration

Turn on the connection switch at the top of Home. When iOS asks to add a VPN configuration, confirm the request is from Shadowrocket, allow it, and complete any verification prompts. If you've already granted permission, the prompt may not appear again.
Test access

Return to Home and make sure the status is no longer Not Connected. Then open a website you expect to be able to access. This initial check is complete only when both the connection status and website access match your expectations.

At the top of Home: What Not Connected means

The switch at the top of Home controls the connection. Not Connected means there is no active connection; it doesn't mean the app hasn't been purchased, and it doesn't tell you whether a subscription has expired. Having SERVER entries, choosing a Global Routing mode, and turning on the switch are three separate checks.

If the status changes briefly after you turn on the switch, then returns to Not Connected, first check the selected server and whether permission is in place. If the status stays connected but websites won't load, check the routing mode, server availability, and DNS. There's no need to purchase the app again or reimport the same details. Note the status when the problem occurs; changing several settings at once makes troubleshooting harder.

Check Home status

Not Connected: Not connected? Check the switch and system permission first.
Selected SERVER entry: Confirm the name of the specific server in use.
Global Routing: Confirm how traffic is handled; the connection switch alone isn't enough.
Website access: Test access separately after connecting; the status label can't confirm it.

Record status, server, mode, and actual access separately.

Check automatic connections

Setting: Settings → On Demand
Purpose: Triggers connection behavior based on configured conditions.
First test: Check whether it's enabled so automatic behavior doesn't affect your manual test.
Reconnect: If it reconnects after you disconnect manually, check this setting and iOS VPN settings first.

Confirm that a manual connection works before setting up On Demand.

Global Routing: Check the mode before interpreting access results

Go to Home → Global Routing to see which mode is selected. This controls how traffic is handled; it doesn't configure a server password or UUID. Before you start, understand what each mode does. For example, don't treat access in Direct mode as a server test, or assume Proxy will fix every problem.

Config

Routes connections according to the rules in the active configuration. Rules may direct traffic to DIRECT, PROXY, REJECT, or a policy defined in the configuration; unmatched traffic does not necessarily go direct. Before using this mode, check that the file selected in Config meets your needs.

Best for: everyday browsing when you've checked the configuration and want its rules to handle traffic.

Proxy

Routes traffic through a proxy, which can help you compare results with Config while troubleshooting. You still need a usable server; this mode won't fix an incorrect address, port, or authentication detail.

Best for: temporarily checking whether the current routing rules are causing a problem.

Direct

Routes traffic directly rather than using the selected server as the usual proxy exit. If a website loads in this mode, that only confirms it's reachable over your current direct connection.

Best for: comparing direct and proxy access to check your underlying network.

Scene

Selects routes based on configured scene conditions. If you haven't set up scenes, this isn't a good starting point for troubleshooting your first connection. Check your scene settings before interpreting what happens after switching modes.

Best for: users who understand their scene conditions and the behavior associated with each one.

If you select Config, go to Config and check which configuration file is active. Rules are usually matched in order: DOMAIN-SUFFIX matches domain suffixes, IP-CIDR matches address ranges, GEOIP checks an IP address's geographic region, and FINAL handles connections that didn't match earlier rules. You don't need to edit rules right away, but remember that the final policy can affect the result.

[Rule]
DOMAIN-SUFFIX,example.com,DIRECT
IP-CIDR,192.0.2.0/24,DIRECT,no-resolve
GEOIP,CN,DIRECT
FINAL,PROXY

This is a syntax example for reference, not a complete configuration to import. The first rule sends example.com and its subdomains to DIRECT; the last sends connections not matched earlier to PROXY. The 192.0.2.0/24 range is reserved for documentation examples, not a server address.

Connectivity Test: A result doesn't guarantee websites will load

Use Home → Connectivity Test to run a connectivity test. A result means the test received a response for its current target and method; it doesn't mean every website, protocol, or domain will work. To troubleshoot, consider the test target, routing mode, and actual browsing results together.

Keep conditions consistent: Use the same network, selected SERVER entry, and Global Routing mode for each test.
Record the results: Note whether a value was returned, whether there was a timeout, and which results differed. Don't just write “green” or “looks fine.”
Check a website too: Open a site you need to access. If it loads, check whether its images and subsequent requests work as well.
Change one thing at a time: For example, switch to another server you already have and repeat the same test. Don't change DNS, the mode, and the server all at once, or you won't know which change made a difference.

SERVER list: Adding, selecting, and updating are different actions

SERVER lists available servers and related groups. Tapping an entry selects it; it doesn't connect automatically. Editing an entry changes its parameters; it doesn't update the entire subscription. If you see multiple entries, check which one is selected before deciding which server the test used.

When adding a server manually via Home → “+”, choose a Type that matches your connection details. The fields differ for Shadowsocks, VMess, VLESS, Trojan, Hysteria2, and WireGuard. Use the port provided by your service provider; a port of 443 alone doesn't tell you which protocol, TLS, or transport to use. Changing only the port after choosing the wrong Type usually won't fix mismatched settings.

Import a subscription: Select Subscribe under Type and enter your own URL. A subscription provides server details; it doesn't prove that a connection has been established.
Update a subscription: Pull down on Home to refresh, then check the update result and any changes to the entries. If the update fails, keep your existing details and first check whether the link can be accessed on your current network.
Protect your privacy: When reporting an issue, share only the Type, what happened, and the steps you took. Redact subscription URLs, passwords, UUIDs, private keys, and other credentials.
Check the parameters: Compare each field against the original details. Don't guess the address, port, or TLS settings based on the server name.

Common first-use questions: Check the screen you're on

I just opened the app, but there's no VPN permission prompt. Did I install it incorrectly?

Not necessarily. First, import your own connection details in Home and select a server, then try connecting. The permission prompt usually appears when you first attempt to connect. If you already allowed the configuration, it may not appear again.

SERVER is empty. What do I do after purchasing the app?

The app purchase and connection details are separate. To use your own subscription, go to Home → “+” → Type → Subscribe, enter the URL, and save. Check that individual servers appear in the list, then select one.

The switch is on. Why won't websites load?

Note the actual connection status on Home, then check the selected SERVER entry and Global Routing mode. Run Connectivity Test, but test a website separately too. If results differ between Config and Proxy, check the rules in Config. A latency value alone doesn't mean a site is reachable.

It reconnects right after I disconnect. Where should I look?

Go to Settings → On Demand and check the automatic connection conditions, then review iOS VPN settings. Separate automatic connections from manual testing: first confirm what happens with the manual switch, then restore the conditions you need.

Should I check Home, Config, or Settings first?

Start in Home: select a server and check the connection status and mode. If you're using Config mode, go to Config and confirm which rules file is active. For behaviors such as On Demand, check Settings. Troubleshoot the relevant layer; you don't need to change every setting the first time you open the app.

The first connection is complete when a SERVER entry is selected, VPN permission is granted, Global Routing is set as expected, and the website you need loads. Before making changes later, record the current status and change one setting at a time. That way, you can compare results and return to the previous setup if needed.