Shadowrocket Beginner’s Guide: 10 FAQs on Setup, Global Routing & Subscriptions

1. What do I need before connecting for the first time?

Installing the app doesn’t provide a server to connect to. Shadowrocket is a closed-source commercial app that uses connection details to establish connections and apply routing rules. To get started, you’ll need a subscription link or individual connection configuration you already have, and should confirm it’s still valid. This guide does not provide, sell, or recommend nodes or subscriptions.

There are two ways to get Shadowrocket: the iPhone / iPad app costs $2.99 as a one-time purchase on the App Store. The developer is Shadow Launch Technology Limited; check the App Store listing for system requirements. The Mac (Apple Silicon / Intel), Windows, Android, and Linux versions are free. See the download page for platform-specific instructions. The app price does not include a service plan.

1. Prepare your configuration

   Check the subscription URL, validity period, and device limits with your existing provider. Treat the token in the URL as a credential; don’t post it in public forums.

2. Add a subscription

   Go to Home → tap “+” in the top-right corner → Type → Subscribe. Enter your subscription URL and save.

3. Choose a connection

   Return to Home and confirm that the subscription has loaded its entries, then select an existing node. If you see the subscription name but no node list, check whether the subscription was fetched successfully.

4. Allow the connection

   Turn on the connection switch on Home. The first time, iPhone / iPad will prompt you to add a VPN configuration. Review the prompt, allow it, and complete any authentication required by the system.

2. The Home switch won’t turn on—or turns off right away. What should I do?

First distinguish between the system not allowing a connection and a connection that’s established but failing to handle requests. In the first case, the switch usually won’t stay on; in the second, the VPN status may still appear. The VPN indicator only shows the system connection state—it doesn’t confirm that the selected remote node is working.

• No entries to select: Go back to Home and check the import. Make sure a complete configuration is selected, not just a subscription name.
• Initial authorization was canceled: Turn the switch on again and respond to the system prompt. If your device is managed by an organization, check whether its management policy restricts VPN configurations. Don’t repeatedly delete system settings.
• Another VPN connection is active: Disconnect other apps using the system VPN connection, then test Shadowrocket by itself.
• The switch stays on: Check node connectivity, Global Routing, and DNS next. Don’t keep treating the issue as an authorization problem.

3. Which Global Routing mode should I use: Config, Proxy, Direct, or Scene?

Global Routing determines how current requests are routed. Use Config for everyday use when you have a valid rule configuration. To check whether a rule is affecting a request, briefly switch to Proxy for comparison. Note the original setting first, then restore it after testing.

4. What’s the difference between Config and Rule, and which one takes effect?

Config is the configuration file and the place to manage it; Rule is a set of matching rules within that configuration. Node settings saved in Home determine where to connect and which protocol to use. Rules in Config determine the path a request takes. Successfully importing a subscription doesn’t necessarily provide a complete routing configuration.

When Global Routing is set to Config, check which file is actually enabled, then edit its rules. Changes to a file that isn’t enabled won’t affect the path of current requests. Rules are generally evaluated in order, so put more specific exceptions before broader rules.

[Rule]
DOMAIN-SUFFIX,example.com,DIRECT
IP-CIDR,192.168.0.0/16,DIRECT,no-resolve
GEOIP,CN,DIRECT
FINAL,PROXY

• DOMAIN-SUFFIX: Matches a domain suffix. example.com here is a syntax example, not a complete rule set to import as-is.
• IP-CIDR: Matches an IP range. In this example, no-resolve means the client won’t perform an additional domain lookup for this IP rule.
• GEOIP: Matches based on an IP geolocation database. A country code doesn’t indicate the language of a website’s content.
• FINAL: Matches requests that haven’t matched an earlier rule. This example routes them to PROXY, so it would be inaccurate to say that everything else connects directly.

5. How do I tell a subscription link from a single share link?

A single share link usually starts with ss://, vmess://, vless://, or trojan:// and describes one connection. A subscription URL is usually an HTTP or HTTPS URL that can return a list of connections and be refreshed later. Don’t assume a URL is a subscription just because it’s long.

6. How do I update a subscription, and what should I check if it fails?

Updating a subscription fetches the remote configuration list again. It doesn’t update the app, and may not update the rule file in the current Config. After updating a subscription on Home, check the node list and result message. A successful refresh doesn’t mean every node can connect.

1. Return to Home and update the subscription you need. If you pull down to refresh, check which subscriptions the current screen actually updates and review the result message.
2. If the request times out, first check whether your current network can reach the subscription URL. An expired URL, a revoked token, and a network timeout are different problems.
3. Only if you already have a working proxy and the subscription needs to be fetched through it, go to Settings → Subscribe, check Update via Proxy, and try again.
4. After a successful update, confirm the selected node again. The server may remove old entries or rename them, so don’t rely on the entry’s previous position.

7. Why won’t a website load even though the latency is low?

A latency test reflects a specific test method, destination, and network at that moment. It doesn’t measure download speed or prove that every website is reachable. For example, 80 ms is only a result from that test; it can’t be converted directly into a file download rate or replace an actual page request.

• Keep variables constant: Use the same node and webpage, note the current Global Routing mode, and compare modes without changing the node and configuration at the same time.
• Check which rule matched: Use available request records or logs to verify the destination domain, matched rule, and final policy. Make sure the request wasn’t sent down the wrong path.
• Check for DNS failures: If you see a domain resolution error, check DNS settings and whether DNS requests can get through. Don’t start by changing every rule to PROXY.
• Check whether it’s one site or all sites: If only one site fails, check the site and your authentication status. If all sites fail, check the node, network, and routing.

Recording the URL, exact error, network type, mode, and whether the issue is reproducible is more useful than noting a latency figure alone. See the connection troubleshooting guide for the full checklist.

8. What does Settings → On Demand do, and why does the connection come back after I turn it off?

On Demand asks the system to establish a connection when specified conditions are met; it controls when connections are triggered. Global Routing determines how traffic is routed after a connection is established. They address different things. On Demand doesn’t mean all requests use a proxy or change the server’s validity period.

1. Go to Settings → On Demand. First check whether it’s enabled, then review the existing trigger conditions.
2. If the connection comes back after you disconnect manually, pause On Demand first, then turn off the Home switch and see whether it reconnects.
3. If the issue occurs only on a particular Wi-Fi network or after switching networks, note the network conditions and compare them with each existing trigger setting.
4. Once a manual connection is stable, re-enable automatic triggers. Change one setting at a time and test Wi-Fi and cellular separately.

Don’t try to fix a single disconnection by changing On Demand, Scene, and Config all at once. Test automatic connection triggers separately from request routing to identify which setting changed the behavior.

9. Do I need to change protocols like Shadowsocks, VMess, VLESS, or Trojan myself?

The protocol must match your existing server configuration. Don’t change the client’s Type just to try to make it faster. Shadowsocks, VMess, VLESS, Trojan, Hysteria2, and WireGuard have different authentication fields and transport requirements. The same address and port don’t make them interchangeable.

• Shadowsocks: Check the encryption method and password. Don’t enter another protocol’s UUID and expect it to work the same way.
• VMess / VLESS: Check the authentication parameters for the protocol, along with the transport, path, and TLS settings specified by your configuration source.
• Trojan: Check the password and TLS fields. The connection address and the name used for certificate validation may differ; use the values in your original configuration.
• Hysteria2: Requires the relevant UDP path to be reachable. Being able to load TCP-based websites doesn’t prove that the underlying path for this connection is available.
• WireGuard: Requires configuration such as keys, a peer, and addresses; a server name alone isn’t enough.

10. What should I know when switching devices, connecting to a LAN, or asking for help?

Keep reproducible troubleshooting notes before handling a migration or local access issue. Configuration sync, server-side device limits, and access permissions on the current network are separate things. Importing the same subscription on another device doesn’t automatically mean the server allows another simultaneous connection.

For initial troubleshooting, check in this order: valid configuration → system authorization → reachable node → matched route → DNS and destination request. Change one variable at a time and confirm the result before moving on.