Shadowrocket FAQ for Beginners: 10 Setup and Usage Questions Answered

1. What do I need after purchasing Shadowrocket?

You’ll need your own connection details. Shadowrocket is a closed-source commercial app sold as a one-time purchase on the App Store. Buying the app does not include a connection service. The purchase gives you the app; server addresses, ports, credentials, and subscription links must come from a provider you already use. These are separate costs.

Shadowrocket is primarily for iPhone and iPad. Check the App Store listing for compatibility, purchase availability, and system requirements on Mac, Apple TV, and Apple Vision. Get the app through the App Store purchase verification page. Confirm the developer is Shadow Launch Technology Limited and the app ID is 932747118. Check the App Store for the current price.

• You have the app but no connection details: First ask a provider you already use whether your service is active. Buying the app does not create a usable server connection.
• You have a subscription link: Add it as Subscribe in Home, then choose a connection entry after importing it.
• You have details for one server: In Home, add the appropriate Type and enter each field. Don’t infer the protocol from the port number.

2. Why does the first connection request permission to add a VPN configuration?

This is the system’s authorization for Shadowrocket to manage network traffic. It is not another purchase. Start by turning on the connection switch in Shadowrocket’s Home. Review the system prompt, allow the configuration to be added, and complete any required authentication. Authorization makes the system configuration available; it does not guarantee server authentication or access to a website.

1. Check your connection details

   In Home, confirm that your own connection entry has been imported. Open it and check its Type, address, and port.

2. Choose a connection

   Return to Home, select the entry you want to use, and turn on the connection switch at the top of the screen.

3. Allow the configuration

   When the system asks for permission to add a VPN configuration, tap Allow and complete any authentication required by your device.

4. Check the result

   Return to Home to check the connection status, then visit a destination you know is available. Verify system authorization separately from actual access.

If you denied permission earlier, start a connection again from Home. If your device is managed by a school or employer, its policies may block VPN configuration changes. Check with the device administrator rather than repeatedly deleting configurations or reinstalling the app.

3. Which Global Routing option should I choose?

To route traffic according to rules, go to Home → Global Routing and select Config. Then open Config and confirm which configuration is enabled. Proxy sends general traffic through the current proxy route; Direct connects without using it. If Direct is selected, an active connection switch does not mean a website is being routed through a proxy.

Scene organizes routing choices by situation. It is neither a protocol nor a more powerful proxy mode. When getting started, first understand the differences between Proxy, Direct, and Config. Verify your connection details and rules before setting up a scene. During troubleshooting, change one option at a time; changing servers, routing, and configuration together makes it hard to identify what affected the result.

4. How do I add and update a subscription?

In Home, tap “+” in the upper-right corner to open the add screen. Set Type to Subscribe, enter your subscription link, and save. Return to Home and pull down to update. A subscription imports connection entries in bulk; it is not a rules configuration file. After importing one, check Global Routing and Config separately.

• Import for the first time: Home → “+” → Type → Subscribe. Paste the complete link, keep its query parameters, and remove any leading or trailing spaces.
• Update manually: Return to Home and pull down to refresh. Check whether the entries in the subscription group loaded successfully.
• The original address has changed: Edit the relevant Subscribe entry, replace the address with the new one from a provider you already use, and update again.
• Protect your credentials: A token in a subscription link may be tied to account access. Hide the full link and any authentication fields in troubleshooting screenshots.

A successful update means the subscription contents were retrieved; it does not mean every server in it can connect. If the entries change after an update, check which connection is selected instead of assuming an old name still refers to the same server. Ask your provider about service expiration, device limits, and connection permissions.

5. Where should I start if a subscription update fails?

First distinguish between a link that can’t be read and one that loads but contains no usable entries. For the first, check your network and subscription URL. For the second, check whether the returned content is in a supported subscription format. Being able to open a regular webpage doesn’t prove that the same network can reach the subscription URL. Seeing an error page doesn’t mean the subscription loaded successfully.

6. What if the connection switch won’t turn on or turns off right away?

First confirm that system authorization is complete, then check that your connection details are complete. A switch that immediately turns off, a connection that remains in progress, and failed access after connecting are different symptoms. Don’t assume they all mean the server timed out. Note which step fails and work through the checks below to avoid losing existing configurations by reinstalling too soon.

1. Return to Home and confirm that you’ve selected a valid connection entry. Open its edit screen and check the Type and all required authentication details.
2. Start the connection again and check whether the system prompts you to authorize the VPN configuration. If device management policies block it, check the applicable requirements first.
3. Go to System Settings → General → VPN & Device Management. Check the VPN configuration status and make sure another VPN connection isn’t competing for the system connection.
4. In Shadowrocket, go to Settings → On Demand and review the automatic connection settings. Pause automatic triggers while troubleshooting, then test manually.
5. Keep the exact error message and note which step triggered it. If the failure occurs after the connection is established, check the network, server details, and service status.

If the switch stays on but webpages won’t load, follow the access troubleshooting steps in the next question. Don’t repeatedly delete the system VPN configuration. An incorrect system clock can also affect TLS verification; check it under System Settings → General → Date & Time.

7. Why won’t webpages load when Shadowrocket says it’s connected?

A connected status and access to a particular website are separate checks. In Home, run Connectivity Test for the selected entry, then check Global Routing. If the test fails, check server connectivity and connection details. If the test returns a result but only certain domains fail, check the rules, DNS, and the destination service. Test results aren’t the same as real-world download speeds.

If all entries fail on the same Wi-Fi network but work after switching to cellular, check the current network first. If only one entry fails, check its details and service status. This comparison helps narrow down the issue; it doesn’t identify the cause on its own.

8. How do I route only specific websites through a proxy?

In Config, open the configuration you’re using and add rules under [Rule]. Save it, make sure it’s enabled, then select Config in Home → Global Routing. The example below shows the structure for sending a specific domain through PROXY and everything else through DIRECT. Replace the example domain with the one you want to match.

[Rule]
DOMAIN-SUFFIX,example.com,PROXY
FINAL,DIRECT

• DOMAIN-SUFFIX matches a domain and its subdomains. To match one exact hostname, use DOMAIN.
• GEOIP,CN,DIRECT matches according to the geographic database entry for the destination IP address, not the webpage’s language.
• IP-CIDR,192.168.0.0/16,DIRECT matches a destination IPv4 address range. It is not a domain rule.
• FINAL handles traffic that hasn’t matched any earlier rule. Put it at the end of the rules, after more specific rules.

Test a domain that should use the proxy and one that should connect directly. Then compare the matched rule and policy in the connection log. If a change has no effect, first check that the configuration is enabled, then check which domain the destination actually uses. A website may load resources from multiple domains, so matching only its homepage domain may not cover every request.

9. Why does On Demand turn the connection back on automatically?

On Demand starts the system VPN connection when its configured conditions are met. If the connection comes back after you turn it off manually, check the rules in Settings → On Demand before assuming the switch is malfunctioning. On Demand controls when a connection starts, not whether a domain uses DIRECT or PROXY; that is controlled by Global Routing and the active configuration.

If the connection behaves differently than expected after switching networks, check both On Demand in the app and the corresponding VPN configuration in system settings. Don’t use Direct in Global Routing as a substitute for turning off automatic connections; they control different things.

10. How do I restore my purchase and configuration on a new iPhone or iPad?

Restore the app purchase separately from its in-app configuration. On the new device, sign in to the App Store with the Apple Account used for the original purchase. Find Shadowrocket in your purchased apps, or open its product page to check whether the option to redownload is available. Check the App Store listing for availability, compatibility, and system requirements; installation on an old device doesn’t guarantee compatibility with every device.

1. Restore the app: Open your App Store account page and find Shadowrocket in your purchased apps. If the price is still shown, check that you’re signed in with the purchasing account and verify the purchase record before proceeding.
2. Restore connection details: Reimport connection details you saved yourself. If you previously used sync or a configuration backup, confirm that the relevant data is available before restoring it to the new device.
3. Check your settings: In Home, review the selected connection, Global Routing, and the active file in Config. Don’t assume restoring the purchase also restores all routing settings.
4. Authorize the new device: When connecting for the first time, authorize the system VPN configuration, then test subscription updates and access to your destination.

Limits on the number of devices connected at once are part of your service provider’s terms; they aren’t determined by your app purchase. If the old device connects but the new one doesn’t, check the connection details and whether your service allows another device. Retrieve subscription details from an account with a provider you already use, and don’t share authentication information in public troubleshooting posts.