Shadowrocket First-Time Setup: VPN Permission and Home Screen Guide

1. Before setup: distinguish the app from connection details

Installing Shadowrocket does not create server addresses, credentials, or working connections. The app reads configurations, establishes connections, and applies rules; server addresses, ports, and passwords come from a service you already use. If the SERVER list on Home is empty, import a configuration first instead of repeatedly tapping the connection switch.

The steps in this guide apply to iPhone and iPad. Shadowrocket for iPhone and iPad costs a one-time $2.99 on the App Store. The developer is Shadow Launch Technology Limited; check the App Store listing for system requirements. The Mac (Apple silicon and Intel), Windows, Android, and Linux versions are free. For your device’s download, visit the download page for all platforms. The layouts on other platforms differ, so don’t assume the steps here apply unchanged.

There are also two different meanings of “configuration.” The VPN configuration added at the system prompt is a system record that allows the app to create a network tunnel. A configuration file in Config contains runtime settings such as rules and DNS. Allowing the former does not prepare the latter or add a working entry to SERVER.

2. First connection: import, select, and grant VPN permission

It’s not necessarily a problem if the VPN permission prompt doesn’t appear as soon as you open the app. The system usually asks to add a VPN configuration when the app tries to create one, often the first time you turn on the connection. Complete the steps below first so you’re not troubleshooting permissions without server details.

1. Check your network

   Keep the connection off and open a page you can normally access in Safari. If that page won’t load either, check Wi-Fi sign-in, cellular data, or your router connection first.

2. Import a configuration

   If you already have a subscription, go to Home → “+” in the top-right → Type → Subscribe, enter your subscription URL, and save. If you only have the details for a single server, choose its specified protocol and enter the address, port, and authentication fields as provided.

3. Select an entry

   Return to Home and check that the SERVER list contains an entry. Select the server you want to use. If a subscription group appears but contains no entries, check the subscription update result; a group name is not a connectable server.

4. Check routing

   Go to Home → Global Routing. Choose Config if you have a complete rules configuration. If you haven’t set up rules and need to troubleshoot a proxy connection, you can temporarily choose Proxy. Don’t use Direct to verify that a proxy connection works.

5. Allow permission

   Turn on the connection switch at the top of Home. When the system asks whether to allow a VPN configuration, verify the app source, allow it, and complete any device authentication the system requires. Then return to Home, check the connection status, and test access to the services you need.

3. Home screen sections: switches, server list, and tests

Home is where you manage day-to-day connections, but each section answers a different question. Not Connected means no connection is currently established; it doesn’t tell you whether a subscription is valid or a server password is correct. Once the connection status changes, test an actual request to confirm that the websites or services you need are reachable.

SERVER entry names usually come from manual entry or subscription data. Renaming an entry only changes how you identify it; it doesn’t change the server address. When troubleshooting, check the actual address and port in the edit screen rather than relying on the name.

Connectivity Test results depend on the test method, target, and current network. A latency result means the target responded under those test conditions; it doesn’t guarantee stable large-file downloads. A timeout doesn’t necessarily mean all protocol traffic is failing. Consider test results alongside real-world access and connection logs, and don’t choose an entry based only on the lowest latency.

4. Global Routing: Config, Proxy, Direct, and Scene

Global Routing determines how requests handled by Shadowrocket are routed. It’s neither system connection permission nor a protocol type. The same Trojan or Hysteria2 entry can handle different requests under different routing modes; changing modes won’t fix the entry’s address or password.

When troubleshooting, keep the server and network fixed and change just one variable at a time. For example, if a destination works in Proxy but fails in Config, check its matching rule and policy next instead of immediately reinstalling the app. If both modes fail, check the server details, basic network connection, and server status.

5. Config and Settings: rules don’t connect automatically

Config manages configuration files; Settings manages app preferences. Settings → On Demand controls system behavior for connecting on demand. It determines when a connection starts, not which route a domain takes. For a first-time setup, verify a manual connection before configuring automatic connections to keep troubleshooting simpler.

The following is a minimal rules example, not a complete configuration with server, authentication, and DNS settings. It sends example.com and its subdomains to PROXY, routes the specified private IP ranges and addresses identified as CN by GEOIP to DIRECT, and sends all remaining requests to FINAL.

[Rule]
DOMAIN-SUFFIX,example.com,PROXY
IP-CIDR,192.168.0.0/16,DIRECT,no-resolve
GEOIP,CN,DIRECT
FINAL,PROXY

• DOMAIN-SUFFIX matches a domain suffix and its subdomains; it doesn’t check whether the page content contains that text.
• IP-CIDR matches an IP range. In this example, no-resolve means the rule won’t trigger an additional DNS lookup.
• GEOIP makes a decision based on the destination IP and the geographic data in use; it doesn’t use the domain suffix.
• FINAL handles requests that haven’t matched an earlier rule, so put it at the end of the rule list. In this example, unmatched traffic goes to PROXY, not DIRECT.

6. Manual server details and subscriptions: two ways to get set up

The details you already have may be a set of server parameters or a subscription URL. Either way, you need to end up with a selectable server entry, but each requires a different approach to maintenance. Subscription URLs often contain access credentials, so hide the full URL and authentication details in screenshots, support requests, and copied logs.

Don’t substitute protocols just because their names seem similar. Shadowsocks, VMess, VLESS, Trojan, Hysteria2, and WireGuard have different authentication and transport structures. For example, if your details specify port 443, enter 443—but that port alone doesn’t prove the protocol is Trojan or that it uses TCP. Hysteria2 is based on QUIC and uses UDP. If the network restricts UDP, check the network conditions instead of switching to a TCP port with the same number.

7. Troubleshooting Not Connected and connected-but-can’t-browse issues

Troubleshoot one layer at a time, starting with system status and moving into app settings. Not Connected, a test timeout, and a page that won’t open are different symptoms; don’t attribute all of them to VPN permission. The sequence below preserves useful comparisons and helps avoid deleting configurations that may still work.

1. Turn off the connection and check your basic network. If Safari can’t open a page you can normally access, sign in to the Wi-Fi network or check cellular data first. Don’t start by changing rules.
2. Check that system permission was granted. If you dismissed the first system prompt, try turning the connection on again. If the system says the configuration is restricted, check device management requirements. Don’t rely on the VPN indicator in the status bar as the only sign of success.
3. Check which SERVER entry is selected. Make sure the list isn’t empty and that the selected entry is the one you intend to test. A successful import doesn’t mean the correct entry was selected automatically.
4. Keep the server entry fixed and check routing. If Config fails, compare the result in Proxy. If a regular page loads in Direct, that only confirms the direct route works for that destination; it doesn’t prove the proxy is working.
5. Then check the protocol and server details. A mismatch in the address, port, authentication, SNI, or transport can leave the tunnel connected while requests still fail.
6. Check automatic connections last. If the connection starts again after you turn it off manually, go to Settings → On Demand and check the conditions. Also check the status of other VPN configurations on the device to avoid conflicts.

You’ve set things up correctly when you can identify the selected server, the Global Routing mode, and the active Config file—and confirm that real requests follow the expected route. A changed connection status or a latency result alone isn’t enough to verify the setup.