Shadowrocket: 10 FAQs for New Users — Subscriptions, Connections, and VPN Permissions

1. Does buying Shadowrocket include a server or connection service?

No. Buying the app does not include a server subscription. Shadowrocket is a closed-source commercial app, and its one-time App Store purchase gets you the client. Server addresses, authentication details, and subscription validity are provided by services you already use. If Home has no server entries when you first open the app, that doesn’t mean your purchase failed, and you don’t need to buy the app again.

Shadowrocket is available only on Apple platforms, primarily for use on iPhone and iPad, and the App Store is the only place to get it. Before buying, verify the developer, Shadow Launch Technology Limited, the official app icon, and the app ID. Check the App Store listing for system requirements, price, and purchase availability.

• Home: Add and select servers, manage subscriptions, choose Global Routing, and control the connection switch.
• Config: Manage rule configuration files. Importing a subscription does not automatically import and select a rule configuration.
• Settings: Adjust app behavior, including Subscribe update options and On Demand.

2. Why does Shadowrocket ask to add a VPN configuration when I connect for the first time?

iOS requires this configuration permission to let the app handle network traffic on your device; it is not an additional charge. The first time you turn on the connection switch in Home, iOS may ask permission to add a VPN configuration. Make sure the prompt follows an action you just took in Shadowrocket, then follow the system instructions. You may need to confirm with your passcode or biometric authentication.

1. Check the configuration

   In Home, make sure at least one server entry is available and selected. If the list is empty, import your subscription as described in the next answer.

2. Turn on the connection

   Use the connection switch at the top of Home and wait for the VPN configuration permission prompt. Don’t tap repeatedly.

3. Grant permission

   Verify the app identity, allow the configuration to be added, and complete any verification steps. Then return to Home to check the connection status.

4. Verify the connection

   Open a website you use regularly and check both the connection status and whether the page loads. Don’t rely on the VPN icon alone.

3. Where do I add my subscription link?

Add subscriptions in Home—not in the Address field of an individual server entry. In Home, tap “+” in the upper-right corner → Type → Subscribe to add a subscription containing multiple server entries. Get the subscription from your service provider and copy the entire link, including any parameters after the question mark.

1. Copy your subscription link and make sure it has no leading or trailing spaces, line breaks, or punctuation copied from a chat message.
2. Go to Home → “+” → Type, then select Subscribe.
3. Paste the complete link into URL, enter a recognizable name, and save.
4. Return to Home and wait for the subscription to load. To fetch it manually, pull down to refresh and check whether server entries appear.
5. Select a server entry, then test the connection and open a webpage to verify it.

The example below shows the structure of a link and cannot be used to connect. Parameters such as token often act as access credentials. Don’t post your real link in public comments, screenshots, or support requests.

https://example.com/sub?token=xxxx

If your provider gave you a single server share link rather than a subscription URL, import it according to its actual type. Shadowsocks, VMess, VLESS, Trojan, Hysteria2, and WireGuard use different configuration fields. Don’t treat every link as Subscribe, and don’t guess port or authentication settings based on the protocol name.

4. How often should I update a subscription, and what if an update fails?

A subscription update fetches the server list currently provided by your service provider. It doesn’t update the app in the App Store or fix a service that has stopped working. If your provider changes the entries, names, addresses, or authentication details may change too. After an update, check that the entry you want to use is still there and selected.

• Update manually: Return to Home and pull down to refresh the subscription. Check the list afterward; don’t rely only on whether the refresh animation has finished.
• Can’t fetch over your regular network: If you already have a working connection, connect first, then go to Settings → Subscribe and check Update via Proxy to fetch the subscription through the available proxy.
• No working connection available: First check that the URL is complete and your current Wi-Fi or cellular network has internet access. Turning on Update via Proxy alone won’t create a working connection.
• Authentication error or empty list: Check the subscription’s validity, whether its token has changed, and the type of link your provider gave you. Avoid repeatedly deleting and re-creating the same entry.

The update result depends on what the server returns. Don’t delete an existing subscription because of a single timeout. Keep the current information, note the error, and try again once on the same network. If you contact your provider, share the error text—but hide the full subscription URL.

5. How do I choose a server and connect when there are many entries?

In Home, select a server entry, then use the connection switch at the top. A server entry is a connection option; the switch starts or stops the current VPN session. Selecting a name alone does not connect. If your rule configuration uses a policy group, the server ultimately used also depends on that group’s selection, so the selected marker in Home doesn’t necessarily show where every request will go.

1. Use Connectivity Test to check how a server entry responds. The result reflects the specific test conditions; it isn’t a measure of sustained download speed.
2. Select an entry that responds, check the current Global Routing mode, then turn on the connection switch.
3. Open a frequently used website to verify requests. After switching entries, test the same site again so you don’t mistake a cached result for a result from the new connection.

6. Which Global Routing mode should I choose: Config, Proxy, or Direct?

Global Routing determines how requests are routed. Config uses the currently selected configuration rules; Proxy routes traffic through the proxy path for testing; Direct connects without using a proxy. These are separate from the VPN connection switch: turning the switch on doesn’t mean every request goes through a proxy server.

For everyday use with existing rules, first make sure the right file is selected in Config, then choose Config under Home → Global Routing. To troubleshoot one website, temporarily switch to Proxy and compare the result. If the site works with Proxy but not Config, investigate rule matching and DNS rather than immediately changing server settings. Restore your usual mode when testing is complete.

7. Why do some websites connect directly when the VPN is on?

In Config mode, rules select different policies for different requests, and DIRECT is a valid policy. Common rules include DOMAIN-SUFFIX, GEOIP, IP-CIDR, and FINAL. Rules are matched from top to bottom, so put specific rules before broader ones. FINAL handles requests that didn’t match any earlier rule.

[Rule]
DOMAIN-SUFFIX,example.com,PROXY
IP-CIDR,192.0.2.0/24,DIRECT,no-resolve
GEOIP,CN,DIRECT
FINAL,PROXY

• DOMAIN-SUFFIX,example.com,PROXY: Matches example.com and its subdomains, then routes them through the PROXY policy.
• IP-CIDR,192.0.2.0/24,DIRECT,no-resolve: Shows the syntax for an address range rule using a documentation-only example range. no-resolve means this rule won’t trigger an additional domain lookup for matching.
• GEOIP,CN,DIRECT: Matches CN using the IP geolocation database and applies DIRECT. Results depend on the database and the address returned by DNS.
• FINAL,PROXY: Routes requests that didn’t match earlier rules through PROXY. Don’t put it before specific rules you want to take effect.

This snippet explains the syntax; it is not a complete configuration. Policy names in an existing file must correspond to valid policies. Don’t overwrite a complete configuration maintained by your provider or by you. For field details, see the configuration field reference.

8. Why does the connection come back after I turn it off? Could On Demand be responsible?

It could be. On Demand starts connections when its configured conditions are met. A session may reconnect when your device switches from Wi-Fi to cellular, rejoins a network, or makes a request that matches a condition. This doesn’t mean the connection switch is broken. First make sure manual connections work reliably, then add automatic triggers.

1. Go to Settings → On Demand and check whether it’s enabled, along with the configured network conditions and actions.
2. To temporarily stop automatic connections, turn off On Demand first, then return to Home and turn off the connection switch.
3. Stay on the current network and confirm that manual connections and disconnections work. Then switch between Wi-Fi and cellular once and observe the status.
4. When re-enabling On Demand, change only one set of conditions at a time. Test networks where the connection should start and where it should stop separately.

On Demand doesn’t decide whether a domain uses DIRECT or PROXY; that depends on Global Routing and your rules. If other VPN configurations are still on the device, check in system Settings which one is actually enabled so you don’t confuse their automatic triggers.

9. Connected, but there’s no internet: what should I check first?

First, distinguish between the device establishing a VPN session and a request to a particular destination succeeding. Turn off automatic triggers, then check the basic network, server entry, Global Routing, rules, and DNS—in that order. Don’t change the port, protocol, and rules all at once; otherwise, even if access returns, you won’t know what fixed it.

The port is part of the server configuration. For example, if an entry uses port 443, that number alone doesn’t tell you the protocol is Trojan or confirm that authentication is correct. The protocol, port, TLS settings, and credentials must all match the server. Use the values from the configuration you already have.

10. What should I keep before switching devices or reinstalling?

Keep your connection details and rule configuration before dealing with the app itself. Getting Shadowrocket again from the App Store and restoring your server list are separate tasks; your app purchase record does not replace subscription credentials. Check the App Store listing for system requirements and purchase availability, and confirm compatibility separately on any other device.

• Subscription: Securely save the complete link from your service provider and make sure it is still valid. A screenshot of server names isn’t enough.
• Manual server details: Record the address, port, protocol, authentication details, and any required TLS settings. Store them securely.
• Rule configuration: Check which file is selected in Config, use an available export option to back it up, and make sure the exported file doesn’t contain sensitive information.
• Current settings: Note the selection under Home → Global Routing and the trigger conditions under Settings → On Demand. Don’t enable automatic connections right away when restoring.
• Restore and verify: Import the subscription or server entries, then restore and select the rule configuration. Complete the initial VPN permission, verify access manually, and only then turn on On Demand.

A new device requires its own system authorization. Don’t assume that the “connected” status on your old device means its settings have been transferred. After restoring, test one server entry and one familiar website first, then enable rules and automatic connections one at a time. This helps separate import, authorization, and routing issues.