This guide is for iPhone and iPad users who have installed Shadowrocket, have their own provider and subscription, but haven’t completed their first connection. Follow the steps to check the server entry, default selection, routing mode, and system permission, then compare Connectivity Test results with an actual webpage. If something goes wrong, check the default server, VPN connection status, and Global Routing first. Change one setting at a time.
1. Confirm You Have Server Details
Shadowrocket is a paid Apple-platform app available exclusively on the App Store. Buying the app does not include a service plan. This guide assumes you already have valid server details or a subscription from your own provider. After purchasing the app, import those details to connect through a proxy. Check the App Store listing for system requirements.
Open Home and check the server list. A subscription group is just a container; it doesn’t mean a connectable server is already available. Expand the group and look for individual entries. If the group is empty, update the subscription before continuing.
- If server entries are already listed: Check the name and protocol type. Keep the address, port, and authentication details provided by your service provider; don’t change them based on guesswork.
- If you only have a subscription link: In Home, tap “+” in the upper-right corner, choose Subscribe under Type, paste your own link, and save. Return to Home and update the subscription.
- If the list is still empty after updating: Check that the link is complete and the subscription is valid, and that your current network can reach the subscription URL. Retrieving a subscription and connecting to a server are separate checks.
- To verify the app’s source, visit the App Store and authenticity page and check the developer, Shadow Launch Technology Limited, the official icon, and app ID 932747118.
2. Choose a Default Server and Connect in Home
The default server is the connection target you select manually. In the Home list, tap the dot to the left of a server entry to select it. Seeing the entry name or opening its edit screen doesn’t select it. Check that the dot shows it’s selected before turning on the connection switch.
-
Select a server
Open Home, expand your subscription group, and tap the dot to the left of a specific server. Make sure the selection indicator is beside the server you want to use, not just the group heading.
-
Check the routing mode
Open Home → Global Routing. For an initial connection check, you can temporarily choose Proxy to reduce variables from rule matching. If you need specific routing rules, use Config.
-
Turn on the connection
Return to Home and turn on the connection switch at the top. The first time, iOS will ask to add a VPN configuration. Confirm the request came from the action you just took, tap Allow, and authenticate as prompted.
-
Check the connection status
Return to Home and check that the switch stays on and no error appears. If it turns off immediately, note the message, then check permissions and whether another VPN app is in use. Don’t keep tapping the switch.
-
Run a test
In Home, tap Connectivity Test and wait for the result. Then open Safari and visit a webpage you need to use to confirm that a real request also succeeds.
System VPN permission establishes a network tunnel; it doesn’t authenticate your server account. Even after allowing a VPN configuration, the server address, port, or password may still be incorrect. A switch that stays on only means you can proceed to testing; it doesn’t prove that a particular website is reachable.
3. Understand Default Server vs. Global Routing
The default server determines which connection target is selected. Global Routing determines how traffic is handled. Check them separately. Even with the correct server selected, a different routing mode can produce different results.
| Mode | How it handles traffic | What to check on your first connection |
|---|---|---|
Proxy | Routes traffic through the proxy | Confirm that the selected server works. This mode can help narrow down issues caused by routing rules. |
Direct | Connects directly | A webpage loading in this mode doesn’t prove that the proxy server works. |
Config | Routes traffic according to the rules in the current configuration | Check which configuration is enabled on the Config screen and which policy matches the target domain. |
Scene | Routes traffic according to the configured scene conditions | Check the scene conditions first. When troubleshooting manually for the first time, don’t change the scene and server at the same time. |
In Config mode, rules are evaluated from top to bottom, and the first matching rule applies. For example, DOMAIN-SUFFIX may route a specified domain to PROXY, while FINAL may send all other traffic to DIRECT. If one website loads but another doesn’t, check the rule outcome before assuming the entire connection is down.
4. What Connectivity Test Can Tell You
Connectivity Test checks whether a test request completes; it doesn’t guarantee that every website or app request will work. Interpret the result alongside your current network, Global Routing mode, and selected server. The test target’s availability also affects the result, so a single failure doesn’t necessarily mean the server is down.
Cross-check the test result against real browsing
Connectivity Test
- First, make sure the connection switch in Home stays on.
- Run one test and note whether it succeeds, times out, or shows another specific message.
- After switching servers, run the test again. Don’t carry over the previous server’s result.
Test in Safari
- Visit a webpage you need to use and reload it.
- Check whether the issue affects one website or several.
- Compare results on the same network and in the same routing mode. Avoid changing multiple conditions at once.
If both the test request and the webpage load, the connection path worked for this check. That doesn’t guarantee access to other websites or future network conditions.
If the test succeeds but a webpage doesn’t load, first check whether the problem is limited to one domain. In Config mode, temporarily switch to Proxy and reload the same page. If the result changes, investigate the rules or policies. If it doesn’t, check the target website, DNS, and server-side restrictions. Restore your original routing mode after comparing.
If the test fails but a webpage loads, check whether the page is cached and reload it. The test target may be unreachable, or the webpage may be routed directly by the current configuration. Check the mode and target; don’t keep changing server authentication details just to get a test result.
5. Check These Three Things if You Can’t Connect
Troubleshoot in this order: selection → tunnel → routing. Change only one setting at a time, then rerun Connectivity Test and revisit the same webpage. Compare what happens before and after each change to identify its effect.
- Check the default server. Return to Home and make sure the dot is beside a valid server entry. If you’ve just updated the subscription, confirm that the selected entry is still the one you expect. Check its address, port, protocol, and authentication details against the information from your provider.
- Check the VPN connection status. Make sure you allowed the system to add a VPN configuration and that the Home switch hasn’t turned off. If the system reports a configuration or connection conflict, stop other apps that are establishing VPN connections before trying again.
- Check Global Routing. Make sure the mode hasn’t been accidentally left on Direct. In Config mode, check the current configuration; in Scene mode, check the trigger conditions. To isolate rule-related issues, temporarily choose Proxy and test the same destination.
After checking all three, compare Wi-Fi and cellular networks. Keep the same server and routing mode when switching networks, and keep an eye on cellular data usage. If it fails on only one network, the network path may be a factor. If it fails on both, continue checking that the server is valid and that its connection details match what your provider supplied.
6. Common First-Connection Questions
Why tap the dot on the left if the server is already imported?
Importing adds the entry to the Home list. Tapping its left-hand dot manually selects it as the default server. Check the selection indicator before turning on the connection switch; opening the edit screen doesn’t select the server.
How do I continue if I didn’t allow the VPN configuration the first time?
Return to Home and turn on the connection switch again, then follow the system’s authorization prompt. If no prompt appears or the system blocks adding a configuration, check device-management restrictions. On managed devices, follow your administrator’s instructions; don’t repeatedly delete configurations.
Why won’t webpages load even though the switch is on?
Run Connectivity Test in Home, then check Global Routing. Temporarily switch to Proxy and retry the same webpage. If it fails only in Config mode, check the rules and policies in Config; you don’t need to rebuild all your server entries first.
Do I need to test again after switching servers?
Yes. Return to Home, confirm the dot has moved to the new entry, check the connection status, and run Connectivity Test again. Results from different servers aren’t interchangeable, and a successful subscription update doesn’t mean every updated entry will work.
After your first connection, keep the working default server and routing mode you need. If a problem comes up later, repeat the three checks in this guide before investigating configuration rules, DNS, and network conditions. A one-time test result doesn’t guarantee ongoing availability.