Shadowrocket First-Time Setup: VPN Permission and the Four Home Screen Sections

In this guide

This guide is for anyone opening Shadowrocket on an iPhone or iPad for the first time. Learn the difference between system VPN permission, server details, and an active connection, then follow the four sections on the Home screen in order. You’ll learn what to get from your service provider, when to allow a VPN configuration, and why an enabled switch doesn’t guarantee that a website will load.

Before you begin: the app, server, and VPN permission are separate

Shadowrocket is a paid app for Apple platforms, available exclusively on the App Store. This guide covers iPhone and iPad. Check the App Store listing for system requirements and general purchase terms. Buying the app does not include a service plan or automatically add a usable server to Home. This guide assumes you already have a service provider; get subscription details from them.

During setup, the app needs system permission to create a VPN configuration. The prompt may appear the first time you turn on the connection switch, rather than as soon as you open Home. It lets iOS create the configuration Shadowrocket needs to establish a network tunnel. It is not a purchase confirmation and does not provide server settings.

4 sections

Home: connection switch, Global Routing, Connectivity Test, and SERVER

3 main sections

Home manages connections, Config manages configurations, and Settings manages app preferences

932747118

App Store app ID for verifying the product listing

For an initial check, confirm three things separately: the app came from the correct App Store listing, SERVER contains server details, and iOS allows a VPN configuration. Without all three, installing the app alone doesn’t mean it’s ready to connect. See the App Store guide for verification steps.

Allow VPN configuration: follow the system prompt

Allowing a VPN configuration lets iOS manage the VPN connection for the app. When the connection is active, the app handles traffic according to the current routing settings. Where that traffic goes depends on the server, Global Routing, and the active configuration. Granting permission does not mean every request passes through a remote server, nor does it guarantee that the remote service is available.

Verify the source

Make sure you got the app from the App Store and that the developer is Shadow Launch Technology Limited. Before setup, have your server details or subscription from your service provider ready.
Add a server

Go to Home → tap “+” in the top-right corner to add details. To use a subscription, choose Subscribe under Type, enter the subscription URL, and save. Check that the server appears in SERVER.
Start the connection

Return to Home, tap the dot next to the server you want, then turn on the connection switch at the top. If you haven’t granted permission yet, follow the system prompt when it appears.
Grant permission

When the system asks to add a VPN configuration, tap Allow and complete any device authentication required. Do not enter your device passcode in a server password field.
Check the connection

Return to Home and check the connection status, then run Connectivity Test. If it doesn’t succeed, read the current prompt before taking further steps; don’t repeatedly delete the system VPN configuration.

Not Connected: the top switch controls the connection, not the server selection

Not Connected at the top of Home means there’s no active connection. This is a status label; the switch beside it starts or stops a connection. The server selected in SERVER determines which server is in use. Adding a server without selecting it—or selecting one without turning on the switch—doesn’t establish a connection.

After turning on the switch, wait for the status to change before browsing. A VPN status in iOS means the tunnel is active; it doesn’t mean every remote destination is reachable. Server address, port, authentication, DNS, and rules can all affect requests. If you’re connected but a website won’t load, check each layer in turn.

Choose your troubleshooting path by connection status

Still shows Not Connected

Check that SERVER has an entry and the dot beside the intended server is selected.
Confirm system permission was granted and read any connection error message.
Check that the server address, port, and authentication details are complete.

Connected, but access isn’t working

Run Connectivity Test first to distinguish a test failure from an issue with a specific website.
Check the current Global Routing option and confirm which route the request should take.
Make sure the current network has internet access, then check DNS and configuration rules.

First check whether the tunnel is established, then whether requests succeed. Don’t use one status indicator to diagnose both.

During your first manual test, also check whether Settings → On Demand is enabled. On Demand can start a connection when specified conditions are met. If the connection comes back after you turn it off, check those conditions before assuming the switch is faulty. To reduce variables, turn off On Demand while testing manually, then configure it as needed.

Global Routing: understand Config, Proxy, Direct, and Scene

Global Routing determines how the app handles requests sent through the tunnel. It is not a server list and does not provide servers. For first-time setup, it’s especially important to distinguish Config from Proxy: Config applies policies from the active configuration, while Proxy routes relevant requests through a proxy. Selecting an option by name doesn’t guarantee that the rules are correct or a server is available.

Config

Recommended

Matches requests against rules in the active configuration and applies each rule’s policy. Rules can specify DIRECT, a proxy policy, or REJECT. Requests that don’t match earlier rules are usually handled by FINAL, which is not necessarily a direct connection.

Use when: you have a trusted, suitable configuration and want everyday requests handled by its rules.

Proxy

Routes requests handled by the app through a proxy. This can help isolate the effect of configuration rules, but it still depends on an available server and won’t fix an incorrect address, password, or server-side issue.

Use when: briefly checking the proxy route to distinguish server issues from configuration rule issues.

Direct

Connects relevant requests directly to their destinations without a remote proxy server. It doesn’t automatically pick the fastest server and should not be mistaken for an active remote proxy connection.

Use when: checking direct connectivity or temporarily connecting directly for a specific reason.

Scene

Applies routing based on configured scene conditions. Before using it, check the scene conditions and their associated settings. Don’t treat Scene as a fixed equivalent of Proxy or Config before understanding what triggers it.

Use when: you’ve configured scenes and want routing to change with your environment.

For example, DOMAIN-SUFFIX,example.com,DIRECT routes requests matching that domain suffix using DIRECT. GEOIP matches by IP geolocation, IP-CIDR matches by address range, and FINAL is the catch-all rule. You don’t need to write rules when first exploring Home, but remember that Config behavior comes from the configuration content, not just the selected server. For configuration details, see the full manual.

Connectivity Test: what a test result can—and can’t—tell you

Connectivity Test checks the connection on demand. A successful result means the test worked for that network, destination, and route at that time; it doesn’t mean every website, protocol, or time period will work. A failed test alone doesn’t prove the app lacks system permission. Check the switch status and error details as well.

Before testing: Make sure the device is online, the intended SERVER entry is selected, and the connection is stable. Note the current Global Routing option.
During the test: Go to Home → Connectivity Test and check whether it returns normally, keeps waiting, or times out. If you can choose a test method, use the same one when comparing results.
After testing: Open the page you actually need. If only one destination fails, check its DNS, rules, and service status first.
After a change: Run the test again after switching Wi-Fi, cellular data, or servers. Don’t treat an old result as a verdict on the current network.

Interpret the latency shown beside a SERVER entry according to the test method used. Some tests only check connectivity to the server and don’t replace a full webpage request. When troubleshooting, change one thing at a time. For example, keep the server the same and briefly check behavior with Proxy; then restore the original setting before deciding whether Config needs adjustment. This makes results easier to compare.

SERVER: importing, selecting, and updating are separate actions

The SERVER list stores server entries. Tapping the dot beside an entry selects it for use; opening its details lets you view or edit its settings. These are different actions. The server’s display name is only a label: a familiar-looking name doesn’t guarantee that the address, port, protocol, or authentication details are correct.

A subscription is one way to retrieve server details in bulk. Go to Home → tap “+” in the top-right corner → Type → Subscribe, enter the subscription URL from your service provider, and save. Once the content loads, check the list. Updates retrieve whatever the provider returns at that time; they don’t renew a subscription or restore expired account access. The fields required for Shadowsocks, VMess, VLESS, Trojan, Hysteria2, and WireGuard differ, so match each one to the details provided by your service provider.

Why is the server list still empty after I allow the VPN configuration?

System permission creates a VPN configuration; it doesn’t add servers. Return to Home → tap “+” in the top-right corner to add existing server details manually, or choose Subscribe under Type to import a subscription from your service provider. After saving, check whether the content loaded successfully.

I have several servers. How do I know which one is active?

Check which dot is selected in SERVER, not just the name at the top. Select a server before turning on the switch. After changing servers, run Connectivity Test again so you don’t mistake an earlier result for the current one.

My subscription is saved, but no entries appear. Should I change VPN permissions first?

First check that the subscription URL is complete, has no extra spaces, and is reachable over the device’s current network. Retrieving a subscription and granting VPN permission are separate troubleshooting paths. If you’re unsure about the URL or account status, check with your service provider instead of repeatedly deleting the system configuration.

The connection turns back on after I switch it off. What should I check?

Go to Settings → On Demand and check whether connection conditions are enabled. Turn it off temporarily and test a manual connection. If the device has other VPN configurations or organization-managed policies, check each one separately rather than changing several settings at once.

You’re done with the initial setup when SERVER contains the correct details and the intended entry is selected, system permission is granted, Home shows the expected connection status, and Connectivity Test and actual browsing behave as expected. Add rules or automatic connection conditions gradually afterward to make initial troubleshooting easier.