Shadowrocket Setup Guide

After opening Shadowrocket, stay on Home. The SERVER group below lists your servers; tap Add Server to open the add screen. Choose the method that matches your information: use Subscribe for a link that retrieves a server list, or enter the details manually if you have the protocol, address, port, and authentication information. These are different types of information—don’t enter a subscription URL as the server Host.

Have a subscription link? Choose Subscribe

In Add Server, tap Type and choose Subscribe from the list, then enter the full subscription link in the URL field. Check that the beginning, end, and query parameters are intact, and don’t include explanatory text, spaces, or line breaks. Add a note to identify the subscription if you like, then save and return to Home. Shadowrocket will try to retrieve the subscription. When successful, the imported servers should appear in the relevant group—not just a note name.

If no servers appear after saving, check for an update error, then try updating the subscription. When the subscription changes, update it to retrieve the latest content; toggling the connection off and on does not update a subscription. Avoid repeatedly adding the same link, which can create duplicate groups and make it hard to tell which details are in use.

Have server details? Enter each field according to Type

To add a server manually, first select the Type specified by your provider, then enter Host, Port, and the authentication and transport fields required by that protocol. Password and Method shown in the screenshot are not shared by every protocol: use the fields specified for Trojan, or check Method and the password for Shadowsocks. Similar field names don’t mean the values are interchangeable. If you’re unsure about a parameter, confirm it with your provider rather than guessing from the field name.

Host is usually the domain name or address in your server details; don’t add a web page path. Enter the actual server port in Port. For TLS, server names, and other transport options, match the server details. Don’t lower verification requirements just to make a test pass. If you have a QR code, use Scan QR Code to scan it, then review each field. Import from Cloud JSON is only for existing data in the corresponding format; it doesn’t replace a standard subscription import.

After saving, return to the SERVER group and tap the server you want to use to select it. Don’t connect just yet: adding a server means its details are entered. Next, choose how requests should be routed with Global Routing.

Return to Home and tap Global Routing to see the available modes. This guide covers three basic options: Config, Proxy, and Direct. They determine how requests are routed; they don’t fill in server details or fix an expired subscription. After changing modes, return to Home to confirm the selected option before testing the connection.

Config: Apply rules from a configuration file

Choose Config for rule-based routing, but first make sure you have a suitable configuration and have selected it. Tap Config at the bottom to open the configuration page and confirm which file is active. To review its contents, open the file’s editor and check sections such as General, Rule, and Hosts. The screenshot shows the configuration editor, not the mode list on Home; these screens serve different purposes.

Rules in Rule are evaluated in order. Once an earlier rule matches, a later fallback rule usually won’t determine how that request is routed. This example illustrates the order: apple.com and its subdomains use DIRECT; unmatched requests go to PROXY. It isn’t a complete configuration or a recommendation for everyone. Save a copy before making changes, and confirm that your configuration uses these policies.

[Rule]
DOMAIN-SUFFIX,apple.com,DIRECT
FINAL,PROXY

Use Add Rule in the editor to add a rule. For your first setup, avoid adding a large number of rules at once; you don’t need to change HTTPS Decryption just to connect. First check whether an earlier DOMAIN, DOMAIN-SUFFIX, or other rule matches the target domain, then check the final policy. See the complete rules and configuration reference for syntax, policy groups, and rule priority.

Proxy and Direct: Route requests explicitly or compare paths

Proxy routes requests handled by the app through the proxy path, which can help reduce the effect of rules during troubleshooting. The selected server must still be working. Direct connects to the destination directly; it can’t tell you whether a proxy server is working. If a site opens after you switch to Direct, that only confirms the destination is reachable over a direct connection—it doesn’t verify your proxy setup.

To establish a baseline, temporarily choose Proxy and test your existing server, then switch back to Config to check rule-based routing. If you already have a suitable configuration, you can use Config directly. After each comparison, restore your usual mode so you don’t mistake a test setting for your everyday setup. If a field or policy name is unfamiliar, check the glossary; you don’t need to explore every advanced option yet.

After selecting a server and setting Global Routing, return to Home. Before turning on the connection, check that SERVER has the server you want to test selected, Global Routing is set to Config or Proxy as planned, and the current configuration file is selected if you’re using Config. This helps avoid testing an old server entry after updating a subscription or mistaking a Direct connection for proxy traffic.

Tap the connection switch at the top of Home. The first time you connect, the system may ask you to allow adding a VPN configuration. This authorization lets the app handle the relevant network requests. Read the prompt, confirm it was triggered by your current action, then continue and complete any device verification the system requires. If you cancel, the connection may not be established. Try connecting again and approve the request instead of repeatedly changing the server password.

After approving the request, return to Shadowrocket and check whether Not Connected is still displayed at the top and whether the switch stays on. The system VPN status and the app’s connection status can help confirm that the network configuration is enabled, but a switch that’s on doesn’t guarantee that a website will load. Server authentication, the destination, DNS, and the active rules can still affect the result. Verify access separately in the next step.

If the switch turns off again immediately, first check whether system authorization is complete and note any message in the app. Then check whether another active VPN configuration is affecting the connection. Resolve authorization and connection status issues before changing Global Routing, the server protocol, or DNS; otherwise, it’s hard to tell which change affected the result. Don’t rapidly toggle the switch before confirming its status, or you may confuse status changes with actual access.

On iPad, the app may show a wider list or a split-view layout, but the checks are the same: Home, server selection, Global Routing, and the connection switch. VPN status indicators may vary across system interfaces; rely on the app status and verify with an actual request. To stop temporarily, return to Home and turn off the connection. If it reconnects automatically later, check On Demand in step five.

When something goes wrong, first identify where the process stopped: the subscription wasn’t imported, the connection switch won’t stay on, the server test failed, or only some destinations are inaccessible. Each stage calls for different checks. Settings includes Test Method, On Demand, and Diagnostics, but you don’t need to change every option. Note what happened, then make the smallest necessary change.

No server entries after import, or subscription update failed

Return to the subscription settings and check the full URL for a management page address, missing query parameters, or extra characters. Confirm that your current network can reach the address and that your subscription is still valid. A URL that displays content in a browser may still return a format that can’t be imported this way. If it shows a login page, error message, or no content, ask your provider to confirm the URL and format. Keep any old details that still work; don’t clear all servers before confirming the new subscription is valid.

Server appears, but the connection or test fails

For a manually added server, check Type, Host, Port, and authentication fields first. Pay particular attention to spaces around the password, whether Method is correct, and whether the transport and TLS settings match. For a subscription entry, update it first, then compare with another server from your existing details that’s known to work. If all entries fail on the same network, check for a local network restriction or temporary issue. If only one fails, first verify that server’s status and parameters.

Test Method in Settings affects how Connectivity Test checks connectivity. Some services don’t respond to certain probes, so interpret a timeout alongside actual access. A test result isn’t a complete measure of speed. Don’t change TCP, UDP, and other options at the same time just to clear a test message; adjust protocol or transport details to match the actual server configuration.

Connected, but some requests don’t take the expected route

First check whether Global Routing is still set to Proxy or Direct for testing, then confirm which file is selected in Config. Follow step four to find the destination’s request record and see whether an earlier rule matched it. For name resolution issues, first check whether the problem recurs on the same network and with the same destination, then review the relevant settings in General. After changing a rule, make a new request; existing connections may not immediately reflect the new policy.

If the connection turns back on after you manually switch it off, check the conditions in On Demand to see whether Wi-Fi, Cellular, or another condition is reconnecting it. You can temporarily disable the relevant condition for comparison, then restore it afterward. For further diagnosis, open Diagnostics and collect only the information needed for the issue. Before sharing it, check for subscription credentials, server authentication details, and personal access records.

Keep a brief record of your network, server, Global Routing mode, affected destination, each individual change, and its result. This lets you resume troubleshooting from a known state instead of repeating the same tests. See FAQs and troubleshooting for more common issues, or read the complete configuration reference to understand rules in detail. After following this guide, you should be able to tell whether details weren’t imported, the connection wasn’t established, or requests took an unexpected route.