Import a Shadowrocket Subscription and Make Your First Connection
Follow this sequence: import → choose a route → connect → verify → troubleshoot. First establish a repeatable connection, then adjust rules and automatic connection settings.
Before you begin: Install Shadowrocket from the App Store and have your own subscription link or server details ready. This site does not provide, sell, or recommend servers or subscriptions. The app is a one-time purchase; that does not include a service plan. Buying the app does not provide a connection service.
Haven’t installed it yet? Read the App Store purchase guide and verify the developer, Shadow Launch Technology Limited, and app ID 932747118. Check the App Store page for system requirements.
These steps focus on iPhone and iPad, with interface labels kept in English. Read the import option that matches the information you have; you don’t need to use both methods. Button locations may vary with the layout, so identify controls by name.
Add Server: Add a Server or Import a Subscription
First, identify what you have. A subscription is usually a complete link that can provide multiple server entries. Details for a single server include its protocol, address, port, and authentication settings. These are different types of input: don’t paste a subscription link into the server address field, and don’t open it in a public browser just because it looks like a web address. A subscription link may contain personal access credentials, so protect it like a password.
Have a Subscription Link? Choose Subscribe
Open Home in Shadowrocket, tap the add button in the upper-right corner, then open Add Server. Under Type, choose Subscribe and enter your complete existing subscription link in URL. You can add a descriptive name to distinguish it from other subscriptions. Before submitting, check for spaces or line breaks at either end. Make sure the link hasn’t been truncated by a messaging app and that you haven’t copied any surrounding instructions.
After saving, return to Home and wait for the subscription to load. If you see the subscription name but no selectable server entries, open its actions and update it, then check for an error message. Success means actual servers appear under the subscription—not simply that the Save button worked. Select one server, and don’t repeatedly add the same link before confirming the import.
Updating a subscription requires a network connection that can retrieve its contents. A failed update doesn’t necessarily mean the link has expired; the issue could be your network, DNS resolution, or the response format. Keep the original link and note the error, then check each item under Troubleshooting. Server names in a subscription are for identification only and don’t prove that a server works.
Have Details for a Single Server? Enter Its Protocol Settings
From Home, open Add Server and choose the protocol that matches your details under Type, such as Shadowsocks, VMess, VLESS, or Trojan. Enter the server address, port, and required authentication details. Required fields vary by protocol; a password and UUID aren’t interchangeable. Don’t use details for one protocol in another just because the fields look similar.
If your details specify TLS, Server Name, a transport type, Host, or Path, check and enter those settings too. The server address and the name used for TLS verification may differ, so follow the original details rather than making them match. Distinguish a hostname from a complete URL: if the field asks for a hostname, don’t add a path. Save, return to Home, confirm the entry appears, then select it.
If you have a QR code for your own server, use Scan QR Code from the scanning option on Home. After scanning, check the protocol and key settings; a successful scan doesn’t verify the connection. On iPad, the layout may place the option elsewhere. Look for labels such as Add Server, Type, and Subscribe.
Step complete when: At least one actual server entry appears on Home and is selected. Next, choose how requests should be routed instead of changing multiple Settings at once.
Global Routing: Config, Proxy, and Direct
On Home, tap Global Routing and choose a mode for this connection: Config, Proxy, or Direct. This determines how requests are handled; it won’t fill in missing server settings or fix invalid authentication details. For your first setup, test server connectivity separately from whether the rules behave as expected.
Config: Route Requests According to the Active Configuration
Config uses the active configuration to determine how requests are routed. Open Config, confirm the configuration you want is selected, then return to Home and choose Config under Global Routing. Importing a server subscription and selecting a rules configuration are separate tasks: multiple servers in a subscription don’t mean requests will be routed as you expect. Before using an existing configuration, check its source, purpose, and policy references.
Common rule policies include DIRECT, PROXY, and REJECT. With Config selected, some requests may connect directly as a result of the rules; that doesn’t mean the connection has failed. If you’re unsure why a domain uses a particular policy, check the request during verification and review the rule order. For a detailed explanation of rule matching, see the beginner-to-advanced guide. This page focuses on completing a basic connection test.
Proxy: Test the Selected Server Route
To check whether a server you already have is working, temporarily choose Proxy to reduce the effect of rule routing on the test. Requests handled by the app will use the proxy route, but this doesn’t mean every activity on the device follows exactly the same path. Test a specific destination and check the actual result. Once the server is verified, switch back to Config and review your everyday rules.
Direct: Compare Against Your Baseline Network
Direct connects the relevant requests to their destination without using the selected proxy server. It can help check whether your baseline network works, but it doesn’t verify the server. If a page opens with Direct selected, that only confirms this direct request succeeded. To test the selected server, switch back to Proxy or a Config with an explicit proxy rule, then repeat the access test.
After choosing a mode, note the current mode and server name. If a test fails, change one condition at a time so you can identify whether the problem is with the server or the rules. Don’t switch servers, change DNS, and replace the configuration in the same test.
Home: Turn On the Connection and Approve the VPN Configuration
Return to Home and confirm the selected server and Global Routing mode, then turn on the connection switch at the top. The first time you connect, the system may ask to let Shadowrocket add a VPN configuration. This allows the app to create a system network configuration; it’s separate from whether your subscription is valid. Confirm that the prompt followed your action, then approve it and complete any device authentication requested.
After approving the prompt, return to Shadowrocket and check the switch and connection status. If you canceled earlier, the connection usually can’t proceed; turn the switch on again and follow the prompt. If the prompt doesn’t appear again, check the VPN-related settings in your device’s Settings. Menu paths vary by system version, so use the options shown on your device. Don’t repeatedly delete configurations just to find a specific path.
Once connected, the VPN indicator in the system can help you check status, but it only shows that the network configuration is running. It doesn’t confirm server authentication, DNS, or access to a particular page. The app can show a connected state even when a request to a destination fails, so complete the next step as well. Don’t rapidly toggle the switch just because the status takes a while to change; wait for the result before retrying.
Other active VPN connections or network configurations managed by your workplace or school may affect this connection. Check which connection is active and follow your device management requirements. Don’t remove managed configurations if you’re unsure what they’re for. For your first test, avoid setting up On Demand; automatic connection conditions could reconnect after a manual disconnect and make the result harder to interpret.
Step complete when: You’ve handled the system authorization and Shadowrocket shows the connection as active. Next, verify access with a real request; the switch position alone isn’t a test result.
Connectivity Test and Real-World Access Checks
First, use Connectivity Test on Home for an initial check of your selected server. The result shows reachability under that specific test; it doesn’t replace a full page access test. A response time doesn’t mean every domain, protocol, or destination is reachable. A timeout also needs to be considered alongside the test method and actual use; don’t delete every server based on a single result.
Next, open a browser and visit a page you’re authorized to access that displays recognizable content. Keep the same server and routing mode, refresh the page, and open another link on it to make sure you aren’t seeing cached content. If only one destination fails, test another known destination for comparison. First determine whether all access is failing or just one site; each points to different troubleshooting steps.
Check the Request in Data
Return to Shadowrocket and check the available traffic and request records in Data. Find the request using the time of your visit and the destination domain, then review the policy, error, or connection details shown. If you’re using Config, check whether the request used PROXY or DIRECT as expected, or was REJECT. An increase in total traffic alone doesn’t prove the page loaded; background apps may also generate requests.
If the records don’t provide enough detail, don’t guess which rule matched. First test the server route using Proxy, then switch back to Config and retest the same destination. If Proxy works but Config doesn’t behave as expected, check the active configuration, rule order, and policy references before re-entering all the server details. If both modes fail, check the server settings, baseline network, and DNS resolution.
To compare with a direct connection, briefly switch to Direct or disconnect, test the same destination, then restore your previous selection. This changes the network path, so only use a destination that’s appropriate for direct access, and confirm that doing so is suitable for your needs. Record the destination, mode, and result rather than writing only “network not working.”
After your first verification, test again on Wi-Fi and cellular to help identify issues specific to one network. Skip the cellular test if your device doesn’t have cellular service. Before everyday use, restore your preferred Config or other mode. If a subscription update changes server names or entries, check your selected server and policy references again.
Subscription Problems, Connection Failures, and Pages That Won’t Load
Keep your current settings and error messages, then work through the checks below in order. After each check, change only the relevant setting and retest with the same destination. Reinstalling immediately changes your server selection, configuration, and authorization state, making the original cause harder to identify. It shouldn’t be your first step.
Subscription Saved, but No Server Entries Appear
Open the subscription editor from the corresponding entry in Add Server. Confirm that Type is Subscribe and URL contains your complete existing link. Check whether you copied a page title, missed parameters at the end of the link, or included spaces or line breaks. Then check that your network is working and update the subscription once more, noting any error. If the response is a login page or instructions rather than content the app can read, ask the provider of your existing service to confirm the link’s purpose and format.
Don’t post your complete subscription link in a public forum or remove parameters just to experiment. Some parameters identify your personal subscription, and changing them may prevent the link from returning the right content even if it still opens. If your existing service details say the link has changed, update the existing subscription entry to avoid accidentally selecting an old one later.
Server Appears, but You Can’t Access Destinations
First confirm that the intended server is selected, then check its protocol, port, authentication details, and TLS settings. Don’t disable certificate verification to hide a name or certificate problem. Check that Server Name, server address, and device time are correct. Next, test the same destination using Proxy: if it still fails, focus on server reachability and settings; if Proxy works but Config doesn’t, check the configuration and rules.
Connection Switch Won’t Stay On, or System Authorization Is Incomplete
Check the current connection status in the system’s VPN settings. Confirm that authorization to add the configuration is complete, and check whether another connection is switching on or off. If the device is managed, check its management restrictions first. If it reconnects automatically after you disconnect, check whether On Demand conditions are set; that’s different from a malfunctioning switch. Note the existing conditions before changing them so you don’t unintentionally alter automatic connections you rely on.
Connectivity Test Responds, but Pages Won’t Load
Compare access to different destinations, then check Data for a record matching the failed destination. Possible causes include DNS resolution, rule selection, the server’s connection to the destination, or the destination’s own response. Don’t assume it’s a DNS issue without evidence. If you’ve confirmed a resolution problem, first check the DNS settings in the active configuration. Avoid changing multiple DNS addresses at once so you can compare results.
If the problem occurs only on one Wi-Fi network, check whether it requires its normal network sign-in. If switching to another available network fixes the issue, investigate the original network. If only one app fails, compare by opening an available page from the same service in a browser. This can help distinguish an app session issue from a destination or client connection problem. Don’t change all your rules right away.
Keep a Concise Troubleshooting Record Before Making More Changes
Record the device type, current network, Global Routing mode, the selected server’s custom name, the failed destination, and the error. Before sharing diagnostic records, remove complete subscription links, passwords, UUIDs, personal addresses, and other authentication details. Hiding the server name alone doesn’t remove credentials. After making changes, repeat the sequence—select a server → connect → visit the destination → check the records—to confirm the result is reproducible.
You’re done with the basics when: You’ve imported your existing details, can explain your current Global Routing choice, completed connection authorization, and verified access with a real request. Next, read the complete beginner-to-advanced guide to learn about Config rules, On Demand, Data, and routine maintenance. See feature overview for available capabilities.
Use the App Store for app updates. Updating the app, updating a subscription, and changing a rules configuration are separate actions. Complete and verify them individually to make changes easier to troubleshoot.