Shadowrocket First-Time Setup: Allow VPN Configuration and Navigate the Home Screen

At a glance

Before using Shadowrocket for the first time, have your own server or subscription details ready. Then start a connection and allow the VPN configuration when prompted. This guide follows the steps in order and explains the Home screen status switch, SERVER list, Global Routing, and Connectivity Test—so you can tell the difference between system authorization, an active tunnel, and access to a website.

First connection: Add your configuration, then allow VPN access

The VPN authorization prompt may not appear the first time you open the app. It usually appears when you start your first connection and iOS needs to add a VPN configuration. Buying the app, importing a subscription, and allowing VPN access are separate steps: the purchase provides access to the client, the import supplies connection details, and system authorization allows the app to establish the network connection.

Shadowrocket is a closed-source, paid app for Apple platforms, primarily used on iPhone and iPad. It is available exclusively on the App Store and sold as a one-time purchase. Buying the app ≠ buying a service plan. The steps below assume you already have a service provider and subscription. This site does not provide, sell, or recommend servers or subscriptions.

Verify the source

Open the App Store through the authenticity verification page. Check the product name Shadowrocket, developer Shadow Launch Technology Limited, and app ID 932747118. Refer to the App Store listing for system requirements.
Add a subscription

Go to Home → tap “+” in the top-right corner → Add Server. Set Type to Subscribe, enter your existing subscription URL, and save. The example https://example.com/sub?token=xxxx illustrates the format only; it is not a working subscription.
Check the list

Return to Home and wait for the subscription to load; pull down to refresh if needed. Check that actual server entries appear in the SERVER section, then select the one you want to use. If you see a subscription name but no servers, check the update result first.
Start a connection

Tap the connection switch beside Not Connected at the top of Home. When iOS asks to add a VPN configuration, read the system prompt, allow it, and complete any device authentication required.
Test access

Return to Home to check the connection status, then run Connectivity Test and open a website you normally use. Don’t judge access only by the switch position.

Not Connected: Check connection status, not internet speed

Not Connected at the top of Home means no connection is currently established. The adjacent switch starts or stops a connection; it does not purchase a service, update a subscription, or choose routing rules. When troubleshooting for the first time, check that the SERVER section contains a selectable entry and that system authorization is complete. Avoid toggling the switch repeatedly without valid connection details.

Two different situations: Not connected vs. connected but unable to access sites

Always shows Not Connected

Check whether you have allowed the VPN configuration.
Make sure an actual server is selected in the SERVER section.
Check that all connection details are present and look for error messages.
Check that your current Wi-Fi or cellular network can access the internet.

Connected, but websites won’t load

First, check the current Global Routing selection.
Run Connectivity Test and note any failures or timeouts.
Try another working website to see whether the issue is limited to one destination.
Select a different existing server entry and test again without changing other settings.

Connection status tells you whether the tunnel is established. Actual access also depends on server availability, DNS, rules, and the destination website.

For example, the status may change after you turn on the switch while a website still times out. That does not directly mean authorization failed. Check for DNS resolution failures, an unreachable server, a rule routing traffic to the wrong policy, or an issue with the website itself. Change one condition at a time to identify what affects the result.

SERVER: Select an entry, then check its connection details

The SERVER section displays and lets you select servers you have added. A subscription is a way to obtain multiple sets of connection details; it is not a server itself. One subscription may contain several entries, and entries with the same region name may use different addresses, ports, or protocols. Names help you identify entries but do not guarantee they work.

Selection and editing are separate: Tapping an entry selects the connection target. Open its details or edit it to check the connection settings. Don’t change fields just to select an entry.
Address and Port: Enter the values provided with your existing service. Don’t copy a sample port, and don’t enter a subscription URL as the server Address.
Type: Shadowsocks, VMess, VLESS, Trojan, Hysteria2, WireGuard, and other protocols require different fields. Changing Type while keeping mismatched connection details will not work.
Subscriptions and manual entries: Subscription contents may change the next time they are updated. If you need to check connection details, note the issue first; a temporary local edit does not mean the source has been fixed.

For your first test, use one specific entry you already have rather than importing several sets of details and trying them all. If SERVER is empty, resolve the import or update issue first. If entries appear but all fail, check your network, subscription validity, and service details. Subscription URLs may contain access credentials, so hide the full URL in screenshots or when asking for help.

Global Routing: Choose how traffic is handled

Home → Global Routing determines how traffic is handled overall. It is not a server list or a configuration file on the Config page. Understand the differences between Config, Proxy, Direct, and Scene before switching modes. The “Recommended” option below refers to everyday use with a valid rules configuration already in place.

Config

Recommended

Handles traffic according to the rules and policies in the currently enabled configuration. Rule order and the final fallback determine the outcome; it does not mean that all sites in a particular category always connect directly. Check which configuration is enabled in Config, then review the policies it references.

Best for: Routing traffic by destination with an existing rules configuration you understand and can verify.

Proxy

Routes traffic through a proxy rather than choosing between direct and proxy connections using the usual Config rules. You can use it temporarily to compare the effect of rules, but it will not fix an unavailable server or guarantee access to every destination.

Best for: Temporarily checking whether routing rules are causing an issue while using the same server.

Direct

Routes traffic directly. Even if the app’s connection switch is on, this does not mean traffic is going through the selected proxy server. Check this setting carefully when troubleshooting.

Best for: Temporarily checking direct access over your device’s existing network.

Scene

Uses settings for specific scenarios to determine how traffic is handled. The result depends on the scenario conditions you have configured. Scene is not a fixed server or a universal fix; for your first connection, use settings you can explain clearly.

Best for: Handling traffic according to scenario conditions you understand and have configured.

Rule keywords are not interface switches. For example, DOMAIN-SUFFIX matches domain suffixes, IP-CIDR matches IP ranges, GEOIP uses IP geolocation, and FINAL provides a fallback when no earlier rule matches. When reading rules, check both the match conditions and the final policy. A keyword alone does not tell you which server traffic will use.

Connectivity Test: Understand what test results can tell you

Home → Connectivity Test checks the connection. Its results reflect specific test conditions; they are not file download speeds or a guarantee of video playback. Results depend on the test destination and method, as well as your network at the time. To compare servers you already have, use the same network and test method, and test them close together in time.

Note whether you’re on Wi-Fi or cellular, along with the Global Routing selection, so you don’t compare results from different conditions.
Run Connectivity Test from Home and distinguish between a returned value, a timeout, and an error. A timeout does not mean zero latency.
Open the website you need and check whether it resolves, loads, and remains accessible. If the test succeeds but the site fails, check your rules, DNS, and the destination service.
Switch to one other server you already have and repeat the same test. If access returns only after changing networks, investigate the original network conditions before rebuilding all your settings.

For example, “the test returns a value, but the website keeps loading” means the test destination and the actual website produced different results. They may match different rules or encounter different server-side restrictions. Likewise, one timed-out test does not prove that no websites are accessible. Consider repeated tests alongside actual browsing.

932747118

App ID on the App Store product page, for verifying the client’s source.

4 items

Global Routing: Config, Proxy, Direct, and Scene are not interchangeable.

First-time setup FAQ: Authorization, disconnecting, and automatic connections

Complete one manual connection before setting up automation. Home is where you check and start connections, Config manages configuration content, and Settings contains app preferences. Settings → On Demand controls automatic connections on demand; it is not where you update subscriptions. When troubleshooting for the first time, avoid changing this and Global Routing at the same time, or it will be hard to tell what caused a change in connection behavior.

I opened the app for the first time, but there was no VPN prompt. Is something wrong with the installation?

Not necessarily. First, import your own connection details on Home and select a server, then turn on the connection switch at the top. iOS displays the relevant system prompt when a VPN configuration needs to be added. Simply viewing the Home screen does not start a connection.

I tapped Don’t Allow. Do I need to buy the app again?

You don’t need to buy it again because you canceled authorization. Return to Home, start a connection again, and follow the system prompt. If your device is managed by an organization that restricts VPN configurations, check its device management policy instead of repeatedly deleting the app.

Where should I look if it disconnects and then connects again?

Go to Settings → On Demand and check whether on-demand connections and related conditions are enabled. To observe a manual connection, you can first turn off on-demand connections, then return to Home, stop the connection, and check whether the behavior changes.

Do I need to allow VPN access again after switching to an iPad?

Complete authorization on the current device by following the system prompt. Authorization on another device does not mean this device is authorized. First check the configuration already on this device, then start a connection manually. Refer to the App Store listing for system requirements and general purchase availability.

Use the same checklist after your first setup: make sure SERVER has a valid entry, Global Routing is set as expected, iOS has allowed the VPN configuration, the connection status is normal, and the website loads. When something goes wrong, checking these in order makes it easier to pinpoint the cause than changing several settings at once. For more steps, see Getting Started. For tips on organizing connection details, see Server Management.