Shadowrocket Setup: 10 Common Questions for First-Time Users

1. Where do I install Shadowrocket?

Choose your device on the Get the App page. On iPhone and iPad, get Shadowrocket from the App Store for a one-time $2.99 purchase; check the App Store listing for system requirements. The Mac (Apple silicon and Intel), Windows, Android, and Linux versions are free. Desktop and Android installers are linked from the Get the App page and downloaded from this site. The mobile app's price does not apply to desktop versions.

• iPhone / iPad: On the App Store product page, verify the name Shadowrocket, the developer Shadow Launch Technology Limited, and app ID 932747118.
• Mac: Open About This Mac to check whether your device has Apple silicon or an Intel processor, then choose the matching option on the Get the App page.
• Windows, Android, and Linux: Choose the file that matches your operating system and follow its installation instructions. On Linux, make sure the package format is compatible with your distribution.

Installing the app does not provide access to a proxy service. These instructions assume you already have your own service and subscription. This site does not provide, sell, or recommend nodes or subscriptions. The app reads connection settings and applies routing policies; whether a connection works also depends on the status of your existing service.

2. How do I import a subscription?

A subscription URL provides connection settings; it is not just any web link. Copy the complete URL from the management page of a service you already use, including its query parameters. A partial copy, an inserted line break, or a login-page URL instead of a subscription URL can cause the import to fail.

1. Get the subscription URL

   Copy the subscription link provided by your existing service. Its token is an access credential, so don't share it in screenshots, chat logs, or troubleshooting details.

2. Open the add screen

   Go to Home → tap “+” in the upper-right corner, then select Subscribe under Type. Don't enter a subscription URL in the Address field for an individual server.

3. Paste and save

   Paste the full link into URL, add a note to help identify it, and save. Return to Home and wait for the subscription to finish loading.

4. Check the import

   Make sure Home shows a subscription group and its connection entries, then select one. If the group appears but has no entries, troubleshoot the subscription loading issue before changing Rule.

This example is only for recognizing the URL format: https://example.com/sub?token=xxxx. It does not provide usable settings. To add Shadowsocks, VMess, VLESS, Trojan, Hysteria2, or WireGuard manually, use the protocol settings supplied by your existing service. Don't guess the Type, Port, or authentication fields based on the server name alone.

3. How do I turn on the connection?

Select a connection entry on Home, then turn on the connection switch at the top. The first time you connect on iPhone or iPad, iOS will ask to add a VPN configuration. If you initiated the request, approve it by following the system prompts. This is a system step for routing network traffic locally; it does not mean every website will be reachable.

1. Make sure Home shows a connection entry and that the one you want to test is selected.
2. Turn on the connection switch and approve the VPN configuration request. If you previously declined, try connecting again and follow the system prompts.
3. Wait for the status to show Connected, then test one destination that clearly requires a proxy and one ordinary destination that should connect directly.
4. If the switch turns off immediately, note the error and check the connection settings, whether your service is active, and whether another VPN session is using the connection.

The connection switch, Global Routing, and the selected connection control three different things: whether traffic is routed through the app, how it is routed, and which connection carries it. Changing just one may not change the final result. During troubleshooting, change one thing at a time so you can tell what made a difference.

4. Which routing mode should I choose?

For everyday use, Global Routing → Config is usually the right choice, provided you have enabled a Config that suits your needs. Config does not automatically proxy every address outside mainland China; the actual behavior depends on the rules, their order, and the policies they use. Here's how Shadowrocket's four routing modes differ.

If Proxy works but Config doesn't, focus on Config and Rule. If neither mode works, that alone doesn't prove the rules are at fault. Also check the connection, authentication, DNS, and destination.

5. Do I need to import a Config?

Subscriptions and Config serve different purposes: subscriptions primarily update connection entries, while Config determines rules and related network behavior. Seeing a new connection on Home does not mean the active Config has changed. Open Config to confirm which file is enabled, then check its [Rule] section.

[Rule]
DOMAIN-SUFFIX,example.com,PROXY
IP-CIDR,192.168.0.0/16,DIRECT,no-resolve
GEOIP,CN,DIRECT
FINAL,PROXY

This example illustrates the syntax; it is not a complete configuration you can use as-is. DOMAIN-SUFFIX matches domain suffixes, IP-CIDR matches IP ranges, GEOIP matches based on IP geolocation data, and FINAL handles requests that don't match earlier rules. In this example, no-resolve prevents the IP rule from triggering a DNS lookup.

• Rules are evaluated from top to bottom. More specific exceptions should generally come before broader rules.
• First make sure the policy associated with PROXY works, then check whether the rule is incorrect.
• Don't place FINAL before rules you still want evaluated; later rules may never get a chance to match.

6. How do I refresh a subscription?

Return to Home and pull down to refresh the subscription. Check that the refresh finishes and whether the connection list changes. Refreshing reloads the existing subscription; it does not extend your service or reactivate an account disabled by the provider. Before refreshing, note the name of your current connection so you can tell if the list changes and reselect it if needed.

7. Why can't I browse after connecting?

“VPN Connected” only means the local session is established. A successful latency test also doesn't confirm that the full route to a particular website is working. Test the same destination with the same connection and note whether the issue is a timeout, DNS failure, or authentication error. Avoid changing the network, connection, and configuration all at once.

1. Run Connectivity Test on Home and check that the selected connection returns a result. If it fails, compare it with another entry you already have.
2. Check that Global Routing isn't set to Direct by mistake. Temporarily switch to Proxy to test the same destination, then restore the original mode.
3. If Proxy works but Config doesn't, check the active Config, the matching rule, and its policy references.
4. If a domain can't be reached, check your DNS settings and records. Don't casually replace the domain with its IP address for an HTTPS test; certificate and hostname differences can skew the results.
5. If Wi-Fi fails but cellular works, keep the same connection for comparison and check for restrictions or a captive portal on the current network.

8. How do I connect automatically?

First connect manually and confirm that access works, then configure Settings → On Demand. On Demand starts a connection when your configured network conditions are met; it does not select a remote service that is guaranteed to work or replace subscription updates. Automatic connection and Global Routing are separate settings: the former determines when to connect, while the latter determines how traffic is routed after connecting.

• Open Settings → On Demand and review the existing conditions. Check whether connection behavior is configured for the current Wi-Fi or another network.
• Start with one clear scenario, such as the network where you want automatic connection, then switch networks to verify the behavior.
• If the app reconnects after you turn it off manually, review the On Demand conditions. Don't repeatedly delete the system VPN configuration.
• To pause automatic connections completely, first disable the relevant On Demand conditions, then turn off the connection switch on Home.

To verify the setup, check the connection status after switching networks rather than relying on the switch in Settings. Device sleep, network reauthentication, and system scheduling can all affect when On Demand runs. If a manual connection fails, fix that basic connection issue first.

9. How do I use Shadowrocket on multiple devices?

Check app purchase eligibility, configuration, and service connection limits separately. Shadowrocket is a one-time $2.99 purchase on iPhone and iPad; the Mac, Windows, Android, and Linux versions are free. Installing the app on multiple devices does not mean your existing subscription allows the same number of simultaneous connections.

If one device loses its connection as soon as another connects, first check your existing service's simultaneous connection limit rather than assuming the app installation failed. When migrating a configuration, also check that its rule references, network conditions, and file dependencies still suit the new device.

10. What should I save before switching devices?

Save what you need to restore the same connection behavior—not just a screenshot of Home. The subscription URL, individual connection credentials, active Config, and On Demand conditions each serve a different purpose. If you miss one, the new device may show all the same entries but route traffic differently.

• Note where to get the subscription from your existing service, and store the complete URL securely.
• Use the available export or share option in Config to save the configuration you're using, then check that its external rule resources are still accessible.
• Note the current Global Routing mode and any network conditions you've added under Settings → On Demand.
• On the new device, import the subscription, select a connection, approve the system prompt, and enable Config. Restore automatic connection conditions last.
• When asking for help, include your operating system, the exact error message, the steps that caused it, and comparison results. Hide subscription tokens, passwords, and other credentials.

The quickest troubleshooting sequence is: check entries on Home → connect manually → test a destination → check routing in Config → verify automatic connection with On Demand. Confirm each step before moving on to separate app access, service, rules, and system authorization issues.