Shadowrocket Setup Guide Import a Subscription and Verify Your Connection

01 Add a Server or Import a Subscription

First, identify what you have: a subscription link that retrieves multiple servers, or server details listing a protocol, address, port, and authentication parameters. Each is entered differently in the app. A subscription link may look like a string of text, but don’t paste it into the server address field. Don’t identify the protocol based only on the start of an address; follow the instructions that came with your details.

Import an Existing Subscription with Subscribe

Open Shadowrocket, go to Home, and tap the add button in the upper-right corner to open Add Server. Under Type, select Subscribe, enter your complete subscription link in URL, add a recognizable name for the entry, and save. Check that the link’s beginning, end, and parameters are intact after pasting. Watch for spaces, line breaks, or punctuation added by a messaging app; these characters can change an otherwise valid URL.

After saving, return to Home and wait for the subscription to load. Check that the expected server entries appear. Seeing the subscription name doesn’t necessarily mean its servers loaded successfully; expand the group and confirm it contains selectable entries. If the list is empty, check that the link is still valid, that your current network can reach it, and that the provider gave you a client subscription link rather than an account management page.

Subscription contents can change when the provider updates them. To refresh the entries, update the subscription and check that the selected server is still the one you expect. Don’t add the same subscription repeatedly instead of updating it, or you may end up with duplicate groups with similar names. An update refreshes the content provided by the subscription, so don’t rely on temporary edits to subscription entries as your only way to preserve changes.

Add a Server Manually with Add Server

If you have details for a single server, open Add Server as before, but select the protocol specified in your details under Type instead of Subscribe. Fill in the server address, port, and authentication details for that protocol. Shadowsocks, VMess, VLESS, Trojan, and other protocols require different parameters; an address and port alone are usually not enough. Check each field, including the encryption method, authentication identifiers, transport, and TLS settings.

Don’t combine values from separate fields. For example, the server address usually shouldn’t include a webpage path, and the port should be entered separately. The TLS server name may differ from the connection address, so use the value specified in your details. After saving, return to Home, check that the entry’s name and protocol are correct, then tap it to select it. If you have multiple servers, stick with one while testing so you don’t change the connection target during troubleshooting.

02 Choose a Global Routing Mode

Return to Home and open Global Routing. Config, Proxy, and Direct determine how connections are handled overall; they aren’t server protocols or speed settings. Decide what you want to test, then choose the appropriate mode. To route traffic by website, also confirm that the active configuration in Config contains the relevant rules.

Config: Apply the Rules in the Active Configuration

For everyday rule-based routing, choose Config. The app uses rules in the active configuration to determine how each request is handled. Open Config and confirm that the active configuration is the one you intend to use. If you have multiple configurations with similar names, seeing a file in the list doesn’t mean it’s active. Check the rules to confirm that the target domain’s policy and the fallback rule meet your needs.

For example, the snippet below routes example.com and its subdomains through PROXY, while requests that don’t match use DIRECT. This illustrates rule syntax only; it contains no server details and you don’t need to replace your current configuration to follow this guide. Make sure you understand which requests it would affect before using it.

[Rule]
DOMAIN-SUFFIX,example.com,PROXY
FINAL,DIRECT

Rules are usually evaluated in order, so specific conditions should come before fallback rules. PROXY routes traffic through a proxy, DIRECT connects directly, and REJECT blocks the request. These rule policies operate at a different level from the modes in Global Routing. For more on configuration structure, policy references, and rule order, see Configuration File Reference. This page doesn’t cover advanced rule editing.

Proxy and Direct: Choose What You’re Testing

When you choose Proxy, requests are handled in Proxy mode rather than routed individually by standard rules. This can help you check whether the current proxy connection works. But if a website loads in Proxy mode, that doesn’t prove your original configuration is wrong: the two modes handle requests differently, and different results are a reason to check the rules.

When you choose Direct, requests connect to their destination without using the selected proxy server. A server may be selected in the list, but that doesn’t mean the website is connecting through it. After a temporary comparison, return to your normal setup: if you need rule-based routing, restore Config and recheck the active configuration instead of leaving a test mode selected.

03 Connect and Complete Authorization

Before connecting, return to Home for a quick check: is the right server selected, does Global Routing match your needs, and, if using Config, have you confirmed the active configuration? Once these are set, turn on the connection switch at the top of the screen. If something goes wrong, you’ll be able to tell whether the issue is with importing, your selections, or the connection itself.

When connecting for the first time, iOS may ask to add a VPN configuration. This allows the app to create a system network configuration; it doesn’t mean you need to buy the app again. Confirm that the request came from Shadowrocket, which you just opened, and follow the system prompts to authorize it. If your device asks you to authenticate, do so in the system prompt. Don’t enter device authentication details in any server field.

After authorizing, return to Shadowrocket and check the switch and connection status. If you denied authorization or canceled partway through the system prompt, the connection may not proceed. Try connecting again and follow the prompts. If another VPN connection is already active, check which network configuration is currently in use so you don’t mistake its status for Shadowrocket’s.

Turning on the connection switch only indicates that the system connection has been started or established. It doesn’t prove that the selected server can reach every destination. The system’s VPN status indicator isn’t a substitute for testing website access. Keep the current server and mode unchanged, then verify both with Connectivity Test and by visiting a website.

You don’t need to adjust automatic connection settings such as On Demand during initial setup. First, use the manual switch to establish a repeatable process and confirm that the connection, rules, and website access work as expected. Then consider whether you need automatic connections. If the connection turns on again after you switch it off, check whether automatic connection settings are enabled rather than repeatedly deleting server entries. See On Demand Settings for more information.

04 Verify the Server and Website Access

Verify in two steps: first check whether the selected server responds to a test, then check whether requests to your target are handled as expected. A single test result or a webpage loading on its own isn’t enough to confirm that the whole setup is working. The test can’t confirm every destination is accessible, and a website may load because it’s already reachable directly.

Run Connectivity Test First

In Home, run Connectivity Test and check the result for the selected server. The result can help you assess server reachability, but different test methods measure different things. A lower number doesn’t necessarily mean every website will load faster. If the test times out, note the selected server and test method, then continue to the troubleshooting section. Don’t immediately change the protocol, rules, and DNS all at once.

If your subscription includes multiple entries, test the current one and check website access before switching servers. After switching, check the connection status and repeat the tests; don’t assume the previous results still apply. Keep your network conditions stable during testing. Avoid changing networks and servers at the same time, or it’ll be harder to compare results.

Visit Your Target and Check the Rules and Policy

Keep Shadowrocket connected and open a browser to visit the website you want to use. Check whether it loads, then try another action, such as opening a second page on the site. A previously loaded page may be cached and won’t necessarily reflect how a new request connects. You don’t need to use the example domain in this guide as a test site; it’s only there to explain rule syntax.

Return to the app and review the target request in the available access records or connection details. Check the domain, matched rule, and resulting policy. When using Config, compare the result with your active rules: did a request expected to use a proxy match PROXY, and did one expected to connect directly match DIRECT? If you see REJECT, first find the rule that blocked the request rather than assuming the server is down.

You can also run a controlled comparison: keep the target website and server fixed, temporarily switch Global Routing from Config to Proxy, visit the site again, then restore the original mode. If the results differ, check the active configuration and rule matching first. If both attempts fail, check the server details, your network connection, and the target website’s status. Change only one variable at a time to get useful results.

05 Troubleshoot One Symptom at a Time

Keep your current settings and note which step failed before troubleshooting. A subscription that won’t load, a server test timeout, a failed connection authorization, and a website that won’t open are different issues. Don’t try to fix all of them by reimporting, and don’t change several settings at once. After each check, repeat the original test to see whether the symptom has changed.

Subscription Won’t Load or the List Is Empty

First, check the device’s internet connection. If needed, temporarily disconnect and confirm that ordinary network access works. Then check that the subscription URL is complete, has no spaces, and is still valid. If some server entries are already present, don’t delete the whole group; first check whether the update simply failed to complete. Change the address only if your details have changed, using the latest information from your provider.

A subscription link may contain personal access credentials. If you ask someone for help, share the error message and steps you took rather than the full link or a screenshot containing it. If you need your provider to check the subscription status, contact them through their existing support channel. This guide doesn’t provide replacement subscriptions or recommend changing providers as a troubleshooting step.

Connectivity Test Times Out or the Server Won’t Connect

Keep your current network unchanged and check the server address and port, then verify the protocol, authentication fields, transport settings, and TLS parameters. Similar-looking fields aren’t interchangeable; don’t disable authentication settings just to make the test pass. If the issue occurs only on one network, repeat the same test on another network you can use to help distinguish network conditions from incorrect details.

Also check that the date and time on your iPhone or iPad are accurate. A significant system time error can affect certificate validation or time-dependent authentication. If the server details changed after a subscription update, confirm the selected entry before testing again. Repeatedly tapping the test won’t fix incorrect settings. If you can’t verify the details, keep the error information and check with your provider.

Connected, but the Website Still Won’t Load

Return to Global Routing and make sure you haven’t selected Direct by mistake. If Proxy works but Config doesn’t, open Config and check the active configuration, rules for the target domain, and rule order. A request may match an earlier rule than expected or fall through to FINAL. Seeing a rule in the file doesn’t prove it was matched.

If only some websites fail, use the access records to check the target domain and DNS results, and confirm the target service is working. Don’t assume that all connections have failed just because one website won’t load. If you’ve changed the configuration, first restore the most recent state that you verified worked, then reapply changes one at a time. For more on connection and DNS issues, see Troubleshooting Shadowrocket Connection Issues.

Review the Steps and Save a Repeatable Process

After making a fix, repeat these steps: select a server → confirm Global Routing → connect → run Connectivity Test → visit the target website. Once it works, remember the subscription group, server name, and configuration name; you don’t need to record sensitive links. Use the same verification steps after updating a subscription or changing rules so you can identify where any change occurred.

That covers the essentials of first-time setup: your connection details, selected mode, and access results should all line up. To edit DOMAIN, DOMAIN-SUFFIX, GEOIP, or FINAL, continue to the rules guide. For unresolved issues, look up the specific symptom in the troubleshooting guide; you don’t need to adjust every advanced setting during initial setup.