How to Use Shadowrocket for the First Time: VPN Permission and Home Screen Tour

At a glance

To use Shadowrocket for the first time, make sure you have connection details, import and select a server, check Global Routing, then turn on the connection switch and allow the VPN configuration when prompted by iOS. This guide is for first-time iPhone and iPad users. It distinguishes system permission from server selection, routing, and connectivity testing, so you know that allowing a configuration does not mean the connection is ready to use.

Before connecting: understand the app, connection details, and VPN permission

Shadowrocket is a paid client for Apple platforms, available exclusively from the App Store, and developed by Shadow Launch Technology Limited. Check the App Store listing for purchase details, device compatibility, and system requirements. If you have not installed it yet, first check the product information on the genuine app verification page. The steps below assume the app is installed and that you already have your own provider and subscription or manual connection details.

Buying the app does not include a service plan. After purchasing the app, you may not see a connectable server in Home. VPN permission is separate: it lets the app create a system VPN configuration to handle your device’s network traffic. It does not generate a server address, password, or subscription details for you.

Home: Check connection status, select a SERVER entry, adjust Global Routing, and run Connectivity Test.
Config: Manage configuration files for features such as rule-based routing. Server subscriptions and rule configuration files serve different purposes; do not treat them as interchangeable based on their filenames.
Settings: Adjust app behavior, such as checking on-demand connection settings under Settings → On Demand.

Approving the VPN configuration: from importing details to turning on the switch

The system’s “Add VPN Configurations” prompt usually appears when you first try to connect and the device does not already have the corresponding VPN configuration. It may not appear as soon as you open the app. This is a system-level confirmation, not a purchase prompt, and it does not mean the remote server has passed a test. Follow these steps to check connection details separately from permissions.

Prepare your details

Make sure you have a subscription URL or complete server connection details. When entering them manually, use the original protocol, address, port, and authentication information. Do not guess the port or enter a web admin page address as the server address.
Import a subscription

In Home, tap “+” in the upper-right corner, set Type to Subscribe, enter your own subscription URL, and save. Keep all query parameters in the URL; do not add spaces or explanatory text before or after it. Return to Home and check whether the subscription group contains server entries.
Select a server

Under Home → SERVER, tap the server you want to use and check that it is marked as selected. If you see a group heading but no individual servers, first check whether the subscription was read successfully, then continue.
Check routing

Open Home → Global Routing and confirm the current mode. If you have a rule configuration ready, check Config and verify which file is actually enabled. To briefly isolate the effect of rules, you can select Proxy, then restore your original setting after the test.
Allow the configuration

Turn on the connection switch at the top of Home. When the system asks whether to allow the VPN configuration, confirm that the request comes from Shadowrocket, tap Allow, and authenticate as required by your device. Return to the app and check whether the status changes.

If you tapped Don’t Allow by mistake, return to Shadowrocket and try turning on the connection switch again, then respond to the system prompt when it reappears. If you still cannot proceed, go to Settings → General → VPN & Device Management → VPN on your iPhone or iPad to check the configuration and status. Menu names may differ depending on your system language. Managed devices may also have organizational restrictions; check the device policy first, and do not repeatedly delete configurations you do not recognize.

At the top of Home: what Not Connected and Global Routing control

Not Connected means no connection for the app is currently established. The switch at the top turns the connection on or off, while Global Routing determines how traffic is routed. They are separate settings. Even after a connection is established, the status text alone cannot confirm that every website or protocol works; you still need to test actual access.

Choose Proxy, Direct, Config, or Scene in Global Routing based on what you need to do. The “Recommended” option below assumes you already have a valid, tested rule configuration. When getting started, do not change the server, routing mode, and rules all at once to clear an error; otherwise, you will not know which change made a difference.

Config

Recommended

Routes requests according to the rules in the currently enabled configuration. The outcome depends on rule order, matching policies, and FINAL; it does not automatically mean “some traffic goes direct and the rest is proxied.”

Use when: You have a valid rule configuration and need to route traffic based on destination.

Proxy

Routes traffic through the proxy without using destination-based rules in Config. This can help isolate rule-related issues during a brief test, but it cannot fix an incorrect address, authentication details, or a problem with the remote service.

Use when: You want to check whether rules are causing an issue while keeping the same server selected.

Direct

Uses a direct connection. A connected app status does not mean requests are going through a remote proxy server; check this setting too when determining where requests are routed.

Use when: You want to compare with direct access on your current network.

Scene

Routes traffic using configured scenes. Check both the scene conditions and the corresponding actions. Do not assume this works just like Config without first reviewing the scene settings.

Use when: You have configured scenes and can verify the result for the current conditions.

SERVER and Connectivity Test: select an entry, then check access

The SERVER list contains servers added manually or read from an existing subscription. A subscription is used to retrieve and update entries; it does not mean a usable entry is currently selected. A server name appearing in the list also does not guarantee that its address, authentication, or remote status is correct. Confirm the selected entry first, then run Home → Connectivity Test and review the result reported by the app.

What you see	What it tells you	What to check next
No server entries under SERVER	There are no servers to select, or the subscription was not read successfully	Check that the Subscribe URL is complete and review any update messages
The test shows a latency value	The test received a response using the current test method	Turn on the connection and verify access with a website you need to use
The test times out	The expected response was not received before the test timed out	Check your local network, server details, and test method; do not immediately assume the subscription is invalid
Connected, but a website is not loading	The connection status does not match whether that destination is reachable	Check Global Routing, rule routing, and DNS, then try the same destination again

A latency test is not a bandwidth test and does not guarantee access to every website. For a meaningful comparison, keep the destination, network, and server the same, and change only one setting. If you switch between Wi-Fi and cellular, note the result first, then repeat the same test. This helps distinguish network differences from configuration changes.

Note the currently selected entry before updating a subscription. After the update, check whether the entries changed and whether the selection is still what you expect.
Do not treat the name shown in the list as a protocol setting. The protocol, port, and authentication details in the server editor determine how the connection works.
After a successful test, verify access to an actual destination. If a test fails, read the error message before deciding whether to check your details or network.

Config and On Demand: understand the difference before getting started

Rule-based routing in Config and on-demand connections under Settings → On Demand are two separate layers. The first determines where a request goes; the second determines when a connection is attempted. If you have not yet verified a manual connection, avoid adding automatic triggers for now to keep troubleshooting straightforward.

Rule keywords

DOMAIN-SUFFIX: Matches domain suffixes, such as example.com.
GEOIP: Matches IP addresses by geographic region, such as CN.
IP-CIDR: Matches IPv4 address ranges, such as 192.168.0.0/16.
FINAL: Sets the final policy for requests that do not match earlier rules.

Rules are usually checked in order. When reviewing a match, also confirm that the policy it references exists.

On-demand connection

Where to find it: Settings → On Demand。
What it does: Triggers connection behavior based on configured conditions.
When to check: After testing a manual connection and verifying actual access.
What to look for: If the connection starts again after you turn it off, check whether on-demand rules are still enabled.

On-demand connection does not replace valid server details or guarantee a connection on every network.

If Global Routing is set to Config and one website is having trouble, first confirm which configuration file is actually enabled, then check the relevant domain rules and FINAL. Do not clear all your rules because of one failed visit. Keep the original file before making changes, adjust one thing at a time, and test the same destination again.

Common first-time setup questions: check the relevant setting

Why can’t I open a website after allowing the VPN configuration?

Permission only allows the system to create the configuration. Return to Home and check the connection status, selected SERVER entry, and Global Routing, then run Connectivity Test. If the test gets a response but the website still does not load, keep the same server selected and compare the result with Proxy against the original Config setting to narrow down a rule or destination issue.

I just opened the app, but there’s no VPN configuration prompt. Is that normal?

First check whether you have tried turning on the connection. The system prompt may not appear as soon as you open the app, and it may not appear again if the device already has the configuration. Go to Settings → General → VPN & Device Management → VPN to check, then return to Home. You do not need to reinstall the app repeatedly while waiting for a prompt.

I saved a subscription, but SERVER is still empty. What should I do?

Return to the subscription editor and check that Type is set to Subscribe and the URL is complete. Update it again and review the message. The address should come from your existing details; do not use a provider’s homepage instead. If you see an authentication or format error, check the original subscription details. Do not treat an empty list as a VPN permission issue.

The connection turns itself back on after I switch it off. Where should I check?

First, go to Settings → On Demand and check whether on-demand connection and its conditions are enabled. Then check the corresponding status in the system VPN settings. After making changes, return to Home, turn off the connection, and observe what happens. On managed devices, also check the management policy; the switch turning back on by itself does not prove the app is malfunctioning.

You have completed the initial setup when you have selected a server, understand the current Global Routing mode, see the expected connection status, and have verified access to a real destination—not just when you have seen the permission prompt. When troubleshooting later, check in this order: local network → connection details → system permission → routing → destination access. This is usually more effective than changing several settings at once.