Shadowrocket Setup: 10 Beginner FAQs on Adding Servers, Connecting, and Global Routing

1. Why do I need to add a server after buying Shadowrocket?

Your purchase covers the client app, not a remote service. Shadowrocket is a closed-source commercial app sold as a one-time purchase; buying the app does not include a server plan. If the Home list is empty when you first open the app, import your existing configuration or use Add Server to enter the details for a server you already have. Buying the app does not provide service credentials or guarantee that your account is active or ready to connect.

The App Store is the only place to get the app. To verify the listing, check that the developer is Shadow Launch Technology Limited, the app ID is 932747118, and the icon matches the official icon shown on this site. This guide focuses on iPhone and iPad; check the App Store listing for system requirements and device compatibility.

2. What are Home, Config, and Settings for?

Knowing the difference between servers and configuration files helps prevent unnecessary changes. Server entries in Home specify where to connect and how to authenticate. Configuration files in Config determine how requests match rules and which policies they use. Adding a server does not automatically load rules suited to your needs, and changing a configuration file does not change your server credentials.

• Home: View and select existing servers, open Add Server, control the connection switch, and choose the current routing mode from Global Routing.
• Config: Manage and select configuration files. Save a copy before editing rules, then confirm which file is currently active.
• Settings: Review app settings, such as configuring On Demand connection conditions under Settings → On Demand.

When troubleshooting, first identify which layer is involved. For authentication failures, check the server details first. If only certain websites take an unexpected route, then inspect Global Routing and the rules in Config. Avoid changing the server, configuration file, and network all at once; otherwise, it will be hard to tell which change made a difference.

3. What details do I need to add a server manually?

Manual entry is useful when you already have the connection details for a single server. Go to Home → “+” in the upper-right corner → Add Server, check Type, then enter the address, port, and required authentication details. Protocol types are not interchangeable labels: Shadowsocks, VMess, VLESS, Trojan, Hysteria2, and WireGuard use different fields and connection methods. Match the settings to the service you already have.

1. Check the protocol

   Go to Home → “+” → Add Server → Type and select the protocol specified in your existing configuration. Don’t choose a Type based only on the server name.

2. Enter the address

   Enter the hostname or IP address in the server address field and the number provided by your service in the port field. If the details specify port 443, enter 443; that is not a universal port for every connection.

3. Check authentication

   Enter the required password, UUID, key, or other protocol-specific details, and check the TLS, server name, and transport settings required by your configuration. Don’t guess or add values for fields that aren’t needed.

4. Save and select

   After saving, return to Home and select the entry you just added. Test that connection before making bulk changes to other entries so input errors are easier to find.

Common entry mistakes include putting a full URL in the hostname field, adding spaces around the port, missing a character when copying a UUID, or using the TLS server name as the connection address. Compare each field with the original details. Disabling certificate verification should not be treated as a routine fix.

4. How do I import a subscription, and why do entries change after an update?

A subscription is a configuration source provided by a service you already use; it is neither a saved webpage nor proof of an app purchase. It typically lets the client retrieve a group of servers and sync their entries during later updates. If you have details for a single server, add it manually as described above. If you already have a subscription URL, use the Subscribe type instead of entering each server individually.

1. Copy your complete subscription URL, including query parameters. Don’t include explanatory text from a message, line breaks, or punctuation at the end of the sentence.
2. Go to Home → “+” → Add Server, set Type to Subscribe, enter the subscription URL, and save.
3. Return to Home and pull down to refresh. Check that the expected group and entries appear, then select a server to test before connecting.
4. After an update, check the currently selected entry again. If its name, number of entries, or parameters have changed, compare them with the update information from your service.

Subscription updates sync entries based on the content returned by the remote service, so updates may overwrite names or parameters you changed manually. Keep separate notes for custom entries you need to retain, and save any important details before updating. A successful refresh does not mean every server has passed an access test.

5. Why does the app ask to add a VPN configuration the first time I connect?

When you first turn on the connection switch in Home, the system may ask permission to add a VPN configuration. This authorization lets the client handle traffic through the system network extension. It is not another purchase or an account registration with a remote server. Check that the system prompt refers to Shadowrocket, follow the device instructions to authorize it, then return to the app and check the connection status.

• Authorization denied: Return to Home and try connecting again, following the system prompt. Switching servers alone won’t help if authorization hasn’t been granted.
• Connected after authorization: This means the system tunnel is active. You still need to test an actual request to confirm that the remote service and routing are working.
• Managed device: If device policies restrict VPN configurations, check the device management requirements. Don’t repeatedly delete other configurations as a way to troubleshoot.

VPN status and access results are two different things. Even when the VPN icon appears, server authentication, DNS resolution, or the destination website may still fail. Conversely, being able to open a webpage using Direct does not prove that the proxy connection is working.

6. How should I choose Config, Proxy, or Direct in Global Routing?

Choose Config for everyday rule-based routing. Use Proxy to temporarily check the selected proxy route, or Direct to compare with a direct connection on your current network. These are the three modes beginners use most often, but they are not the only Global Routing options. The interface also includes Scene for switching modes based on configured scenarios.

Proxy should not be taken as an absolute guarantee that all background traffic on the device will use the proxy. Existing connections, system network behavior, and the scope of tunnel handling can all affect what you observe. For a fair comparison, close and reopen the page you’re testing. If needed, restart the app to avoid mistaking a result from an old connection for the effect of a new setting.

7. Why are rules routing traffic incorrectly even when Config is selected?

First, confirm that the correct file is selected in Config, then check the order of rules in the [Rule] section. Rules are matched from top to bottom, and the policy for the first match is applied. A broad rule near the top can prevent more specific rules below it from matching. FINAL catches requests that did not match earlier rules and should be placed at the end.

[Rule]
DOMAIN-SUFFIX,example.com,PROXY
IP-CIDR,192.0.2.0/24,DIRECT,no-resolve
GEOIP,CN,DIRECT
FINAL,PROXY

This code illustrates the syntax; it is not a complete file to use in place of your own configuration. example.com is an example domain, and 192.0.2.0/24 is a documentation-only IP range. The first line sends the domain and its subdomains to PROXY. The second matches the example IP range; no-resolve means not to actively resolve a domain for that IP rule.

• GEOIP,CN,DIRECT matches the destination IP against its location in a geolocation database. Results may vary with database updates.
• PROXY, DIRECT, and REJECT mean proxy, direct connection, and reject, respectively. When adding a rule, also confirm that the referenced policy exists in the current configuration.
• If the logs show that a request matched an earlier rule, adjust that rule’s scope or order instead of adding more rules of the same kind at the end.

8. The connection switch is on. How can I check that it actually works?

Test one layer at a time: local network, selected server, actual request, and matched rule. A latency test returning a number only tells you how that particular test performed. It does not replace testing a webpage, video, or other real-world task, and it does not prove that every destination is reachable. Record results alongside the network, test method, and destination.

1. Check your local connection: Make sure Wi-Fi or cellular data is working, and complete any network sign-in page that requires confirmation in a browser.
2. Check the selected server: Confirm the selected entry in Home, then run Connectivity Test. Distinguish between a response, a timeout, and an authentication error.
3. Send a new request: After connecting, open a page you need to access. Seeing cached content alone does not prove that a new request went through the network.
4. Check the route: If you’re using Config, inspect the request record or logs for the destination, matched rule, and policy to make sure the result is as expected.

For example, if the same destination works in Direct but fails in Proxy, first check the proxy settings and whether the remote service is reachable. If it works in Proxy but not Config, check the rules, selected policy, and DNS settings. This is a way to compare conditions, not a diagnosis made in advance, and there’s no need to keep refreshing the subscription.

9. The connection turns back on after I switch it off. Is On Demand causing this?

It could be related to On Demand, so first check Settings → On Demand. This feature connects or disconnects on demand under specified network conditions; it does not replace Global Routing. If the conditions are met, an automatic trigger may change a connection you turned off manually. When troubleshooting repeated disconnections and reconnections, consider automatic triggers separately from server issues.

1. Go to Settings → On Demand and note whether it is enabled and what conditions are configured, especially Wi-Fi names, cellular network conditions, and domain-related conditions.
2. For manual troubleshooting, temporarily turn off On Demand, then return to Home and disconnect.
3. Switch the network you’re testing and see whether the connection turns back on by itself. Also check the On Demand status for the corresponding configuration in system VPN settings.
4. After testing, restore the original conditions as needed. Test the configured Wi-Fi and cellular scenarios separately; don’t test just one type of network.

When setting a Wi-Fi condition, use the exact network name; a similar name does not count as the same condition. If you’ve configured a domain trigger, distinguish between a request triggering the connection and routing rules choosing the route after the connection is established. The On Demand condition controls the former; the current routing mode and configuration control the latter.

10. Subscription timeouts, webpages that won’t load, or slow performance despite low latency: what should I check first?

Start by recording a reproducible symptom, then change one variable at a time. These three issues call for different checks: how the subscription is fetched, how traffic is routed, and actual throughput. Don’t treat them all as problems to fix by deleting and reinstalling the app. Record the network type, selected entry, Global Routing mode, destination that failed, and error text, but redact personal credentials.

After troubleshooting, keep only the smallest change that explains the issue: if you corrected a parameter, there’s no need to rewrite the rules at the same time; if you fixed a rule, there’s no need to delete the entire subscription. Restore any temporary Global Routing and On Demand changes, then test a destination you use every day. That completes the initial setup.