Shadowrocket Setup Guide
Import a Subscription & Connect

01 · Add Server: Add a server or import a subscription

After opening Shadowrocket, stay on Home and leave the connection switch off for now. Identify which type of information you have: a subscription link usually retrieves and updates a group of servers; a single share link describes one server; manual entry requires complete protocol and connection details. These serve different purposes. Do not use a single-server link as a Subscribe URL or enter a configuration file URL in a server address field.

Have a subscription link? Select Subscribe

On Home, tap the add button in the upper-right corner to open Add Server. Open Type and select Subscribe, then paste your full subscription link into URL. You can enter a recognizable name in Remarks, such as “Everyday setup”; do not put access credentials in the remarks. Check for spaces or line breaks at either end of the link, then tap Done to save. Return to Home and wait for the subscription to load. If no servers appear, use the action menu for that subscription to update it.

After a successful import, Home should show a subscription group and its server entries. Check that a specific server is available to select before continuing. Seeing a subscription name without any servers does not mean the import is complete: the request may still be in progress, the response may be empty, or the content may not be recognized. Check the update result first. Avoid repeatedly creating subscriptions with the same name, which can make it difficult to tell which one you are using.

An update retrieves the content from the remote source again. If you need to keep manual changes, note them before updating and check whether the next update will overwrite them. Subscription links may contain access credentials, so paste them only where the app requires them. When describing an issue to someone else, do not share the full link or a screen showing it.

Have details for one server? Enter them by protocol

If you have a server address, port, and authentication details, start from Add Server, select the specified protocol under Type, and fill in each field. The fields differ between protocols such as Shadowsocks, VMess, VLESS, and Trojan. Enter the password, user ID, encryption method, and transport parameters as provided. Address should be the server's domain name or IP, not a subscription page or a help page opened in a browser.

If the setup uses TLS or a specific transport method, check the related options in the server details as well; entering only an address and port is not enough. If you were given a QR code, use Scan QR Code to read it, then check the detected Type and Address. Whichever method you use, return to Home after saving and select a specific server. For the difference between fields and share links, see the glossary. There is no need to change parameters you do not yet understand during your first connection.

At the end of this step, Home should show a clearly identified server entry that you can select, with a known source for its connection details. This does not yet confirm that the server works. Next, decide how traffic should be handled.

02 · Global Routing: Choose Config, Proxy, or Direct

On Home, tap Global Routing and choose Config, Proxy, or Direct for your current purpose. These modes change how traffic is handled; they do not fill in missing server details or make an unreachable server work. During initial setup, note the selected mode so you can make a meaningful comparison during verification.

Config: Follow the rules in the current configuration

If you already have a rules configuration that you have checked, start with Config. In Config, check which configuration is enabled and confirm it is the one you intend to use. Importing a server and enabling a rules configuration are separate actions: seeing a server on Home does not mean Config has switched to a particular rules file. Rules determine whether requests use policies such as PROXY, DIRECT, or REJECT; actual results also depend on rule order and policy settings.

You do not need to edit the entire ruleset during initial setup. Keep the configuration you know and complete a connection and access test first. If you later need to change how a domain is handled, back up the configuration and make changes one at a time. See the rules terminology guide for keywords such as DOMAIN-SUFFIX, IP-CIDR, and GEOIP. For a systematic check of rule-matching issues, see the troubleshooting guide.

Proxy: Compare the connection through the selected server

To check whether the selected server can handle requests, temporarily switch to Proxy to reduce interference from ordinary routing rules. Keep the server, network, and test page unchanged; change only Global Routing. If the page loads in Proxy but fails in Config, check the configuration rules and policy target first rather than immediately importing the subscription again. Restore the mode you need after testing.

Direct: Check a direct connection over your current network

Direct connects over the current network and cannot confirm that the selected proxy server works. To check whether the basic network connection is available, a clearer method is to turn off the Shadowrocket connection and open a familiar page. Once Wi-Fi or cellular data is working, return to Home and continue. After choosing a routing mode, you can authorize the first connection.

03 · Home: Connect and authorize the system configuration

Return to Home and confirm that the intended server is selected and Global Routing still matches your choice in the previous step. Then turn on the connection switch at the top. The first time you connect, the system may ask to add a VPN configuration; this authorization is required to establish a system network connection. Read the prompt and allow it, complete any passcode or biometric authentication required by the device, then return to Shadowrocket.

After authorization, check whether the connection switch on Home stays on and whether the system displays the corresponding connection status. Do not repeatedly tap the switch while authorization is still in progress. Repeated actions may overlap connection and disconnection requests, making it harder to tell what failed. If the switch turns off immediately, check whether you dismissed the system prompt and whether device management restrictions apply.

If the device has other tools that take over network connections, pause them and test Shadowrocket by itself to reduce configuration conflicts. A managed work or school device may restrict changes to VPN configurations. Follow the device management requirements rather than repeatedly deleting settings to try to bypass those restrictions.

During the first test, keep On Demand off so that automatic connection conditions do not interfere with manual actions. Once manual connection and access verification both work, you can consider enabling On Demand for specific network conditions. It controls when to start a connection; it does not fix subscription content, server parameters, or rule errors.

A switch that stays on only indicates that the connection process has reached the corresponding state. It does not mean every destination is accessible. Continue with the checks below, comparing the server test, browser access, and routing results.

04 · Connectivity Test: Verify the connection and access

On Home, use Connectivity Test to check whether an existing server is reachable, then select one and test access. The result can help show whether a particular request received a response, but a latency figure is not a download speed and does not guarantee that every app or page will work. Do not consider setup complete based only on a low number.

Repeat the test on the same network and page

Keep the current Wi-Fi or cellular connection unchanged. Open a browser and visit a familiar page whose loading result you can assess. First check whether the main content appears, then check whether images and other resources load. If only some content fails, note exactly what is affected; this calls for a different investigation than a page that will not open at all. An old page may display cached content, so reload it rather than relying on a tab that was already open.

Then return to the app and check the connection log for the request destination and its policy. In Config, check whether the request uses PROXY or DIRECT as expected, whether it is REJECT-ed, and whether the policy points to a currently available server. A system connection indicator or one successful browser page alone cannot prove that all rules are correct.

Change one condition at a time and compare

If Connectivity Test gets a response but the page fails, keep the server unchanged, temporarily switch Global Routing from Config to Proxy, and repeat the same test. If the result changes with the mode, check the rules and current Config first. If both modes fail, check the server details, network conditions, and DNS. Change only one item at a time to connect the change with the result.

After verification, restore the mode you plan to use and test once more. Make a brief note of the network type, selected server, Global Routing mode, failing page, and error shown. Do not record or share authentication details. This is more useful for locating the issue than “the switch is on but it does not work,” and helps you determine whether a later change actually solved it.

05 · Common issues: Start with where the failure occurs

When something goes wrong, turn off the connection and check that the device itself can access the network. Then check import, authorization, server connection, and rule handling in order. Do not delete every server, replace Config, and change DNS all at once; even if service returns temporarily, you will not know which change made the difference. This section covers the most common issues during initial setup. For more details, see the Shadowrocket troubleshooting guide.

No servers appear after saving a Subscribe entry

Return to the subscription entry and check that the URL is complete and does not include copied instructions, spaces, or line breaks. Make sure it is a subscription URL, not an account page or a single-server share link. Once the basic network is working, update it again and check the specific error. If the URL has expired, access credentials have changed, or the response is unexpected, check with your own service provider. Do not guess at changes to characters in the URL.

The switch will not turn on or turns off immediately

First confirm that you allowed the initial system authorization and completed device authentication. Then check whether another network tool is in use and whether device management policies apply. Note any message shown by the app. If you recently changed system network settings, return to a state you can account for before testing again. Removing the system connection configuration will trigger authorization again; do so only after identifying a reason, not as the first step for every issue.

Connectivity Test times out

Retry the current server once, then compare it with another server from your own list. If only one server keeps failing, check its address, port, authentication, and protocol parameters first. If several servers fail, compare Wi-Fi and cellular data, then check the basic network. Keep other conditions unchanged when switching networks. Do not disable TLS verification instead of checking parameters, and do not assume a timeout means the app was installed incorrectly.

Proxy works, but some pages fail in Config

Return to Config and confirm which file is enabled. Check the matching rule and policy for the failing destination. Back up the configuration before changing rules, then save the change and reload the same page. If a policy requires a server selection, make sure it does not still point to an unavailable entry. Rules handle destinations according to the configuration; checking the actual match is the way to distinguish an incorrect route from an unavailable server.

Connected, but domain name resolution fails

First confirm that the device date and time are correct, then check whether the failure occurs during domain name resolution. Note the current DNS settings and change only one item at a time; do not change the resolution method and rules file together. Opening a site directly by IP may not be a valid comparison because HTTPS also requires the domain name to match the certificate. If the error continues, use the specific error message to find the DNS section of the troubleshooting guide instead of repeatedly entering addresses from unknown sources.

The same controls are not in the same place on iPad

On iPad, different orientations and window widths may use a split-view layout, so the relative positions of Home, Config, and other entries can change. Use the interface labels to find the right controls. Find the page with the same name, then follow the corresponding steps. Check browser access, system authorization, and network settings again on the current iPad; success on another device does not confirm that this one is configured.