Your first connection involves three separate steps: selecting a server, starting the VPN, and checking access to your destination. This guide covers Shadowrocket on iPhone and iPad and is for users who already have their own provider configuration or subscription but have not connected yet. Follow the steps in order to distinguish server selection, system authorization, Global Routing, and access to an actual website. An enabled switch alone does not confirm a working connection.
Before connecting: Check your configuration source and network
First, make sure your device can open ordinary websites before starting Shadowrocket. If your Wi-Fi requires a web-based sign-in, complete it first. If the network itself has no internet access, importing a configuration and testing a server may fail. For your first connection, stay on one network rather than switching between Wi-Fi and cellular while changing connection settings.
This guide assumes you already have your own provider and subscription. This site does not provide, sell, or recommend nodes, subscriptions, proxy services, or invitation codes. The app's purchase cost and the cost of a network service are separate; buying the app does not provide a server address, password, or subscription URL.
- Already imported: On Home, make sure you can see individual server entries, not just a subscription name that has not been expanded or updated.
- Not imported yet: Go to Home → tap “+” in the upper-right corner → Type → Subscribe. Enter your subscription URL in URL and save. Confirm that the server list has loaded, then update the subscription if needed.
- Only have a single configuration: Choose the matching Type for your configuration, such as Shadowsocks, VMess, VLESS, Trojan, Hysteria2, or WireGuard. Do not guess the protocol from its name or change the port and authentication fields without a reason.
- Protect sensitive information: Treat subscription URLs, passwords, and Private Keys as credentials. Before sharing a screenshot for support, hide the full URL and any keys.
The subscription URL https://example.com/sub?token=xxxx is a fictional example and will not connect. Use your own complete URL, including query parameters. Leaving off the final token may cause an update to fail or return incomplete content. Importing a subscription adds configurations to the list; it does not start a connection.
On Home: Select the server, then turn on the connection
The selection dot on Home sets the current default server. Opening a server's details to inspect its settings is different from selecting it as the default. After returning to the list, check which entry is selected. Do not rely on the server name alone—you may still be using a previously selected entry.
-
Expand the list
Go to Home and find the imported subscription group or server list. If the group is collapsed, expand it and confirm that it contains a selectable server.
-
Select the server
Tap the selection dot next to the server you want and confirm that it is selected. For your first test, stick with this one server and do not change settings for multiple entries at once.
-
Check routing
Go to Home → Global Routing and check whether the current mode is Proxy, Direct, Config, or Scene. To initially test the selected server, you can temporarily use Proxy. Check Config separately when you are ready to test everyday rule-based routing.
-
Start the connection
Return to Home and turn on the connection switch at the top. When the system first asks to add a VPN configuration, confirm that the prompt is from Shadowrocket, then allow it and complete any required system authentication.
-
Run a test
Return to Shadowrocket and make sure the switch remains on, then run Connectivity Test on Home. Record the result shown in the app, then open a browser and check the destination you need to access.
The selected default server is not always the final exit for every connection. In Config, a rule may specify DIRECT, a policy group, or another policy; a policy group may also select its own member. The selection dot sets the default server—it does not determine where every destination ultimately goes.
System authorization: A running VPN does not confirm website access
When you connect for the first time, the system must allow Shadowrocket to add a VPN configuration. This authorization lets the app create a VPN tunnel on your device; it does not activate an account on a remote server or fix an expired password. If you cancel the authorization prompt, the connection switch may turn off. Return to the app, turn it on again, and complete the system authorization.
The system VPN status indicates that a local tunnel has started; it does not by itself confirm successful server authentication, working DNS resolution, or access to a specific website. The VPN indicator may also appear in different places depending on the device, so do not judge by a single icon. Check the Home switch, Connectivity Test, and actual access together.
Global Routing: Isolate server issues first, then restore your rules
Proxy and Config are easy to confuse during a first connection. Proxy helps temporarily isolate routing rules; Config routes traffic according to the active configuration. The recommendation below applies only to initially testing the selected server—it does not mean you should leave Proxy enabled permanently.
Proxy: Test the server first
RecommendedTraffic that enters the tunnel and is handled by this mode follows the proxy route, making it easier to check whether the selected server can provide access. This does not apply to traffic the system retains or connections outside the tunnel.
Best for: A first connection or temporarily ruling out rule matching.
Config: Route traffic according to your configuration
The active configuration and rules determine the policy. The outcome depends on rule order, destination matching, and policy group selection, so not every request is guaranteed to use the default server.
Best for: Testing everyday routing after confirming the server works.
Direct: Check direct connectivity
Uses a direct route without the selected proxy server. If a website opens while the connection switch is on, that alone does not prove the server is working.
Best for: Comparing with your device's original network and checking whether the destination itself is unavailable.
Scene: Check scene settings
Routing behavior depends on the configured scene conditions. Before using Scene, check its conditions and associated policies. Scene is not a fixed proxy or direct mode.
Best for: Using different policies in different environments with an existing scene configuration.
If access works in Proxy but fails after switching to Config, check which configuration is active under Config. Rules are generally matched from top to bottom, so place rules for specific destinations before the fallback rule. The following illustrates syntax only; it is not a complete configuration and should not replace your file as-is:
[Rule]
DOMAIN-SUFFIX,example.com,PROXY
IP-CIDR,192.168.0.0/16,DIRECT,no-resolve
GEOIP,CN,DIRECT
FINAL,PROXYDOMAIN-SUFFIX matches domain suffixes, IP-CIDR matches IP address ranges, GEOIP matches against an IP geolocation database, and FINAL handles connections that did not match earlier rules. The example 192.168.0.0/16 is a private address range, not a server address. Configure policies according to your own network needs.
Connectivity Test: Record test results separately from destination access
Connectivity Test checks connectivity to its test destination in the current environment. A successful test only means that this particular test met its conditions; it does not guarantee that every domain, app, or policy group works. Latency shown in the list is not the same as website load time or available bandwidth.
Verification plan: Test in the app and in a browser separately
In-app test
- On Home, check the server selection dot and connection switch.
- Run Connectivity Test and record the actual result; do not assume it will succeed.
- Record the current Global Routing mode and network.
Browser test
- Open the specific URL you originally needed to access.
- Distinguish DNS errors, connection timeouts, and errors returned by the website.
- Check the relevant connection records in Data and confirm the destination and policy used.
Conclusion: Mark the first-connection check as complete only after both the in-app test and destination website have been checked. Repeat the checks after changing networks or routing modes.
If the test succeeds but the destination website will not open, keep the server and network unchanged, then compare Proxy and Config. If only Config fails, check the rules and policy group first. If both modes fail, check the destination domain, server settings, and DNS. Do not change DNS, port, protocol, and rules all at once, or you will not know which change affected the result.
- DNS resolution error: Check the DNS settings used by the active configuration and make sure the domain is spelled correctly. A successful direct connection to an IP address does not mean domain resolution is fixed.
- Connection timeout: Confirm that the server address and port match the original configuration, then check whether the current network can reach the service. A timeout alone does not prove the password is wrong.
- The website returns an HTTP error: For example, HTTP 403 means the server returned an access-denied response. This is different from being unable to establish a connection; check the destination website's access requirements.
After your first connection: Keep the configuration stable, then update and retest
Once the connection works, return to the Global Routing mode you plan to use. If you use Config, make sure the expected file is enabled on the Config page, then check the policies actually used for common destinations in Data. Keep a reproducible baseline for testing: the same network, server, routing mode, and destination URL.
- Check your selection after updating a subscription: Server entries may be added, removed, or renamed. After the update, return to Home and confirm the selection dot and intended server. Do not rely only on the subscription update success message.
- Retest after changing networks: After switching from Wi-Fi to cellular, run Connectivity Test again and visit the destination. Record results separately for each network.
- Keep a way to revert configuration changes: Save the original settings before changing rules or DNS. Test only the change you made, and restore the original settings for comparison if it fails.
- Set up automatic connections only if needed: Once manual connections are stable, go to Settings → On Demand and set the conditions you need. Test behavior both when the conditions are met and when they are not.
The selection dot is on, but why won't the website open?
The selection dot only confirms the default server. Check that the connection switch is on, system VPN authorization is complete, Global Routing is set as expected, and review the actual Connectivity Test result. In Config, also check which rule matched; do not assume the server selection failed.
What should I check if the switch turns off immediately?
First check whether you canceled the system authorization to add a VPN configuration. Then review the error shown in the app and the current VPN status. Record the error and address one factor at a time; repeatedly deleting the app is not a substitute for diagnosis.
Does a successful subscription update mean I can connect?
No. A successful update means the subscription content was retrieved and processed, not that every server in it can connect. You still need to select a specific server on Home, start the connection, and verify it with a test and actual access.