Shadowrocket Beginner FAQ: Purchase, Subscription Setup & First Connection

1. What does a one-time purchase cover? Does it include connection service?

A one-time purchase covers the right to use the Shadowrocket app; it does not buy remote server service. Shadowrocket is a closed-source commercial app, available exclusively on the App Store. Verify the product name, developer Shadow Launch Technology Limited, and app ID 932747118. Check the App Store listing for current pricing, system requirements, and purchase eligibility.

Before you start, check what information you have. A server address, port, and authentication details are usually entered manually; a URL that provides a server list is usually added as a Subscribe item. An App Store purchase receipt is not a subscription URL, and a subscription URL does not belong in the server address field.

2. Which switch on Home controls the connection?

Home is the main place to check connection status, select a server, and set Global Routing. The connection switch at the top starts or stops Shadowrocket’s VPN connection. Selecting a server in the list only chooses a possible exit; it does not start the connection. When you first open the app, check the switch and list as they appear in the app.

1. Open Home

   Go to Home and check whether a usable server is listed. If the list is empty, import a subscription using the steps below instead of repeatedly toggling the connection switch.

2. Select a server

   Select a server from your existing service and confirm the selection indicator appears beside the intended entry. If server names are similar, check the subscription group and address as well.

3. Check routing

   Go to Home → Global Routing and check the current mode. If you have suitable rules, choose Config. If you have not checked the rules, do not assume traffic behavior based on the mode name alone.

4. Start the connection

   Return to Home, turn on the connection switch at the top, and approve any system prompt. Then test a destination that should use the selected server rather than relying only on how the switch looks.

An enabled switch means the system tunnel has started or is starting. It does not confirm that the remote server, DNS, or every destination is reachable. Check the app status, test results, and actual requests together. If the connection drops immediately, check permissions and server details before adding duplicate entries.

3. What’s the difference between Add Server and Subscribe?

Add Server is the entry point for adding connection details; Subscribe is a Type used to import a subscription. They are not mutually exclusive options: you can start from the add screen whether you enter protocol settings manually or paste a subscription URL. The difference is whether you save details for one server or subscription information that retrieves a server list.

The protocol must match the details for your existing service. Shadowsocks, VMess, VLESS, Trojan, Hysteria2, and WireGuard use different authentication and connection fields; changing only the protocol name is not enough. Do not assume the port is 443: even when a service uses TLS, enter the actual listening port from your service details.

4. How do you import and update a subscription?

A subscription is a remote resource that returns server details. Importing saves its URL; updating requests the resource again. Saving successfully is not the same as retrieving a valid server list. Check the app for its current update behavior. For your first import, update manually and verify the results.

1. In Home, tap + in the upper-right corner and set Type to Subscribe.
2. Paste your complete subscription URL into the URL field. Check the beginning, end, and query parameters, and make sure there are no spaces or line breaks.
3. After saving, return to Home and pull down to refresh the subscription. Wait for the request to finish, then expand the group and check its entries.
4. Select an actual server, not just the subscription group name, then run a connection test.

An update can change the server list based on the content returned by the remote resource, but it does not necessarily update the active Config. Server subscriptions and rule configurations serve different purposes: the former tells Shadowrocket where to connect; the latter determines how requests are handled. After updating, check that your selected server is still listed.

5. Should you choose Config or Proxy in Global Routing?

Global Routing sets the overall routing mode. Proxy, Direct, Config, and Scene each work differently. The app’s current default is shown in its interface; for everyday use, choose Config after checking the active configuration. Config does not mean that unmatched requests always go direct: their final destination depends on the rules and FINAL in the configuration.

6. What should you do when the VPN permission prompt appears?

VPN configuration permission allows Apple’s system to let an app create a network tunnel; it is not a prompt to buy a subscription. When you start a connection for the first time, the system may ask to add a VPN configuration and confirm with your device passcode or system authentication. This grants permission on your device but does not verify that the remote server works.

• Make sure the prompt was triggered by Shadowrocket after you turned on the connection, then follow the system instructions to allow the configuration.
• If you previously denied permission, return to Home, turn on the connection again, and check whether the system prompt reappears.
• If another VPN connection is active on the device, stop it before testing Shadowrocket to avoid interference.
• If your device is managed by an organization or has system restrictions, check the VPN and device management settings. Do not remove a management configuration unless you understand its purpose.

If you still cannot access anything after granting permission, continue troubleshooting the server, Global Routing, and Config. Repeatedly revoking permission usually will not fix an incorrect address, expired subscription, or mismatched TLS settings, and it adds more variables to check.

7. What are Home, Config, and Settings for?

These sections handle connection controls, configuration files, and app settings. Use Home to select a server and control the connection, Config to choose and edit rule configurations, and Settings to adjust app behavior such as On Demand. When troubleshooting, identify which layer is involved before opening the relevant section.

DOMAIN-SUFFIX,example.com,PROXY
IP-CIDR,192.168.0.0/16,DIRECT,no-resolve
GEOIP,CN,DIRECT
FINAL,PROXY

These rule lines illustrate evaluation order; they are not a complete configuration file. Rules are checked from top to bottom, and a matching request follows the associated policy. FINAL sets the policy for requests that do not match any preceding rule and belongs at the end. example.com is used only to illustrate the syntax; it does not predict how other domains will behave.

• DOMAIN-SUFFIX matches a domain and its subdomains, not any URL that happens to contain the same string.
• IP-CIDR matches an IP range; no-resolve means the rule will not trigger a domain lookup.
• GEOIP matches based on the destination IP’s geolocation; a domain suffix alone does not determine the result.
• PROXY, DIRECT, and REJECT mean proxy, direct, and reject policies, respectively. Check the active configuration to see which rule applies.

8. Why can’t I access anything even though the switch is on?

Troubleshoot in this order: local network → server reachability → protocol settings → routing and DNS. A latency test reports only the result for that test method; a latency value does not prove that protocol authentication or real-world access is working. Change one setting at a time so you can tell what changed the result.

When recording the issue, specify whether the subscription update failed, the server test timed out, or only a particular destination will not open. These involve different request paths. If you contact your existing provider, include the network you were using, the test steps, and a redacted error message; this is more useful than saying only that it does not work.

9. Should you enable On Demand right away?

On Demand triggers connection behavior based on conditions; it does not make a server more reliable. Find it under Settings → On Demand. The current default is shown in the app. For your first setup, verify a manual connection before adding conditions based on Wi-Fi, cellular networks, or domains.

1. Note your current On Demand settings first. While troubleshooting, avoid automatic triggers that could interfere with manual connection tests.
2. Connect manually from Home and confirm that the selected server and Global Routing meet your needs.
3. Go to Settings → On Demand. Set one condition at a time, using the options available in the current interface.
4. Switch to the relevant network or make a request to the destination, then check whether the connection starts as expected. Turn it off manually and see whether it reconnects while the condition remains true.

On Demand and Scene control different things: On Demand determines when to establish a connection, while Scene controls routing behavior for configured scenarios. If the connection turns back on right after you switch it off, check the automatic connection conditions first rather than assuming the Home switch is unresponsive.

10. How do you set up Shadowrocket on iPhone and iPad?

Check app purchase eligibility separately from connection setup on each device. Shadowrocket is primarily used on iPhone and iPad; check the App Store listing for compatibility and system requirements on Mac, Apple TV, and Apple Vision. To redownload under the same account, check your App Store purchase history. Do not assume that every configuration is ready just because the app is installed on another device.

Your initial setup is complete when the subscription updates, the selected server is clear, the routing mode matches the configuration, system permission is granted, and the requests you expect to work succeed. Before changing anything later, note its current value. Checking the steps above in order is more likely to reveal the cause than changing servers, rules, and DNS all at once. For the full setup sequence, see the guides on this site. For explanations of individual options, see the Settings Reference.