Shadowrocket Tutorial: Five Steps to Your First Connection

When you open Shadowrocket it lands on the Home page. The lower half of the page is the SERVER group, listing every server you have added; on a fresh install it is empty, and there are two ways to fill it: add one server by hand, or import several at once with a subscription link.

Adding a server by hand: tap Add Server in the SERVER group (or the + in the top-right corner) to open the Add Server page, then fill in the fields with the details you already have. Type selects the protocol — common ones are Shadowsocks, VMess, VLESS, Trojan, Hysteria2, and WireGuard; Host takes the server address, Port the port number, and Password and Method the values from your provider, while the remaining fields can stay at their defaults. When everything looks right, tap Done in the top-right corner to save, and the entry appears back in the SERVER list on the Home page. Once added, entries in the list can be edited or deleted at any time — just make sure the details come from your own provider before you change anything.

Importing a subscription: on the Home page choose Subscribe (the entry is also under the + in the top-right corner) and paste the subscription link from your provider into the address field, in the form https://example.com/sub?token=xxxx. After you save it, the app fetches the configuration and builds the server list automatically. The advantage of a subscription is that when your provider updates its servers, one refresh in the app keeps you in sync — no editing each server by hand. Providers sometimes hand out a QR code or a configuration file instead; those map to Scan QR Code and Import from Cloud JSON at the bottom of the Add Server page, so pick whichever matches what you received.

Two things that often go wrong: first, Type must match the details you have — pick the wrong protocol or encryption method and the connection will always fail; second, subscription links and passwords are access credentials, so don't post them publicly and keep them safe when you switch devices.

Once an entry shows up in the list, don't connect yet — first confirm the Global Routing mode, then turn on the switch.

Back on the Home page, there is a Global Routing row below the switch showing the current mode on the right, which defaults to Config. Tap the row to open the selection page. The three modes are: Config, which evaluates the rules in your Config file one by one and sends matching traffic to PROXY, DIRECT, or REJECT; Proxy, which sends all traffic through the currently selected server; and Direct, which sends nothing through the server, effectively taking the app out of the path for the moment.

None of the three modes is better than the others — they differ only in the order in which decisions are made. Keeping Config for everyday use is the least work: domains that don't need a proxy go DIRECT without a detour, domains that do need one follow the rules to PROXY, and domains you specify are blocked outright with REJECT. Switch to Proxy or Direct only when you want to route everything through the proxy temporarily, or when you want to rule out the rules themselves in a comparison test.

The rules themselves live in Config. Open Config and you'll see a configuration file split into General, Rule, Hosts, URL Rewrite, and HTTPS Decryption sections; the Rule section is where routing rules live. Tap Add Rule to add one, writing the keywords in English — for example, DOMAIN-SUFFIX,example.com,PROXY sends traffic for example.com and its subdomains through the proxy. Rules are matched from top to bottom, and the ones higher up win.

Rule keywords and syntax have plenty of detail, and this page only covers as much as you need; for how a particular rule should be written, or why a domain went direct, look under the Routing & troubleshooting category on the FAQ page. Once the mode is confirmed, go back to the Home page and turn on the switch.

Back on the Home page, the switch at the very top shows Not Connected by default. Tap it and the app starts connecting to the currently selected server; your current network has to be working for this, otherwise the connection stalls during setup.

On the first connection, iOS shows a system prompt asking whether to allow a VPN configuration. That dialog comes from the system, not from any setting inside the app; once you confirm it (with your passcode, or Face ID / Touch ID), the app has permission to establish a tunnel. If you accidentally tapped Don't Allow before, go to Settings → General → VPN & Device Management and allow the entry again.

After you allow it, the switch changes from Not Connected to Connected, and the status area at the top starts showing how long this connection has lasted along with upload and download counters. These two are the direct evidence of whether the connection is really up: if the switch says Connected but the numbers don't move for a long time, the connection usually isn't actually running, and you should look at the server details and your current network rather than repeatedly editing rules.

To disconnect, tap the switch again; the status returns to Not Connected and the VPN badge disappears from the system status bar. A VPN entry also appears in system settings, recording the app's tunnel configuration; for day-to-day connecting and disconnecting, the switch inside the app is enough — there's no need to toggle things in system settings.

Once the connection is up, the next step is to confirm it works as expected.

Verification has three layers; work through them from inside the app out to the browser, and if all three look right you can use it with confidence.

The first layer is Connectivity Test inside the app. There is a Connectivity Test row on the Home page; tapping it runs the tests in sequence and reports the result. A normal result means the client-to-server leg is working. You can change how the test runs under Test Method on the Settings page — if one method keeps failing on your network, try another one first.

The second layer is a real browser test. Open Safari and visit a few sites you use every day to see whether they load; if they don't, don't rush to change the server configuration — work through the troubleshooting order in the next step.

The third layer is the traffic counters. Back on the Home page, check whether the upload and download numbers in the status area change as you browse; if they move, traffic really is going through the client.

One thing worth spelling out: passing these checks only means the link between the client and the server is fine — it does not mean every website goes through the proxy. Whether a given domain goes to PROXY or DIRECT is decided by the rules in your Config, and that is normal routing behavior, not a fault.

Connection failures usually come down to a few places; working through them from the outside in, as below, is faster than repeatedly changing your configuration. The options on the Settings page are useful here too: Test Method decides how Connectivity Test runs, On Demand controls on-demand connecting, Diagnostics shows diagnostic information, and the Proxy, TCP, and UDP items affect how traffic is forwarded.

For cases the five items above don't cover, look under the Routing & troubleshooting category on the FAQ page; if the problem is about purchasing, restoring on a new device, or store regions, see the complete App Store guide.