Shadowrocket First Connection Guide: Select a Server, Connect, and Run Connectivity Test

At a glance

This guide is for users who already have a subscription from their own provider and are ready to connect for the first time on an iPhone or iPad. The steps are: confirm servers appear on Home, select a default server, check Global Routing, turn on the connection switch and approve the system prompt, then check Connectivity Test and try the site you need to access. A server appearing in the list, a connected VPN, and a reachable website are three different states—check each separately.

1. Before connecting: App, subscription, and server checklist

Your first Shadowrocket connection starts on Home, not Config. Use Home to view and select servers and operate the connection switch; use Config to manage rule configurations; use Settings to adjust app preferences. Server details in a subscription and rule configurations in Config serve different purposes. Importing one does not mean the other is set up for your needs.

This guide assumes you already have a provider and subscription. Get the subscription link from your provider and follow their instructions to confirm it is valid. Shadowrocket is a paid client; buying the app does not include network service. App Store is the only place to get the app. Check the App Store listing for system requirements and purchase availability.

Check your network: Before connecting, open a page in your browser that normally works without a proxy. If your basic connection is unavailable, first resolve Wi-Fi sign-in, cellular data, or router connectivity.
Check the server list: Go to Home and see whether server entries appear under your subscription. If you see only the subscription name and no selectable entries, check the subscription update status first.
Check your service status: Review the expiration date, usage, and restrictions on your provider’s account page. Don’t infer service status from a server name alone.
Protect your credentials: A subscription link may contain an access token. Before sharing screenshots or diagnostic details, obscure the full link, password, and account information.

2. Select a server and approve the VPN configuration

After importing servers, you still need to explicitly select a default server on Home. Tapping a server entry and opening its edit screen are different actions: the first selects a connection target; the second lets you review its address, port, and protocol settings. For the first test, keep the parameters supplied by your provider. Don’t change the protocol, port, and encryption settings all at once.

Check the subscription

View the server list on Home. If you haven’t imported servers yet, tap “+” in the top-right corner, set Type to Subscribe on the Add screen, enter the subscription link from your provider, and save. Return to Home and confirm that server entries are available. This guide continues from the point where entries are already listed.
Select a server

On Home, tap the server you want to use and check that a dot appears to its left. If you opened the edit screen, return to the list and confirm the selection there. A test value shown next to an entry is not an indication that it’s selected.
Check routing

Go to Home → Global Routing and check the current option. If you already have a rule configuration, you can use Config; to temporarily rule out rule-related issues, switch to Proxy for a comparison test. Note the original setting and restore it when you’re done.
Turn on the switch

Return to Home and turn on the connection switch at the top. The first time iOS prompts you to add a VPN configuration, verify which app initiated the request, then allow it and complete device authentication as prompted. If authorization isn’t complete, don’t assume the server is the problem.
Run the test

Wait for the connection status to settle, then tap Connectivity Test on Home and note the result. Next, use a browser to open the page you actually need. Check both the test result and the page; don’t rely only on whether the top switch stays on.

3. Global Routing: Check the current mode before interpreting test results

Global Routing determines how traffic is routed. The same server and test target can take different paths in different modes, so note this setting when troubleshooting. You don’t need to try every mode for your first connection. First decide whether you’re checking that the server works or that your rules behave as expected.

Config

Recommended

Connections are handled according to the rules and policies in the active configuration. Requests matching DIRECT go directly; requests matching a proxy policy are handled by that policy. This does not mean every request uses the server you just selected.

Use when: You have a specific rule configuration and want to check everyday routing behavior.

Proxy

Routes connections that would normally be handled by the app through the proxy path. This can help temporarily reduce variables introduced by rule-based routing. It’s a troubleshooting mode, not proof that the server settings are correct, and it doesn’t replace checking actual site access.

Use when: You want to check whether rules in Config are sending traffic directly.

Direct

Uses a direct connection. If a test target is reachable in this mode, that doesn’t prove the selected server works. Switch to the proxy mode you need to verify and test again.

Use when: You want to compare with your basic network connection and distinguish direct-connection issues from proxy-path issues.

Scene

Routing behavior depends on the configured scene conditions. If you’re troubleshooting manually for the first time and don’t know the current scene settings, review them first or temporarily use the clearly defined Config or Proxy modes to test one variable at a time.

Use when: Your workflow already depends on configured scene conditions that you understand.

In Config mode, rules are generally evaluated from top to bottom. For example, DOMAIN-SUFFIX matches domain suffixes, IP-CIDR matches IP ranges, GEOIP checks the IP geolocation database, and FINAL acts as a fallback. If a proxy policy points to a policy group, also check which option is selected in that group. The dot on the left of a server on Home confirms the default server selection; it doesn’t guarantee every rule uses that server.

4. Connectivity Test: Separate connection status from access results

Connectivity Test checks connectivity to a test target under the current conditions. A successful test shows that the path used for that test worked; it doesn’t guarantee access to every website, protocol, or app. A timeout doesn’t automatically mean the password is wrong. Your basic network, server egress, DNS, target availability, and current routing can all affect the result.

Before connecting: note

Location: Home → Server list
Selection: A dot appears to the left of the target server
Routing mode: Home → Global Routing; note the current option
Basic network: Note whether you’re using Wi-Fi or cellular data

Change only one condition per test round so you can tell which adjustment made a difference.

After connecting: note

Switch status: Whether the switch at the top of Home stays on
System status: Whether the VPN appears connected in system settings
Test entry point: Home → Connectivity Test
Actual access: Open the page you need in a browser and check whether it loads

Record the result accurately—success, timeout, or the exact error text. Don’t substitute example values for actual results.

Test succeeds and the page opens: The connection and access path worked this time. If you temporarily used Proxy, restore your everyday Config setting and test again.
Test succeeds but a specific page fails: Check the rules for that domain, DNS, and the target service status. Don’t immediately redo all server settings.
Test fails but the switch stays on: Connection status alone doesn’t prove end-to-end reachability. Continue checking the selected server and network environment.
The switch turns off immediately: First confirm that system authorization is complete, then check the error shown in the app. Repeatedly tapping the switch won’t fix missing parameters.

5. Compare Wi-Fi and cellular connections using the same steps

The same server may behave differently on Wi-Fi and cellular data. For a comparison, keep the server, Global Routing mode, and test target the same, and change only the access network. If you also change servers, rules, and networks, even an improved result won’t tell you where the original problem was.

Comparison plan: Keep settings fixed and change only the access network

On Wi-Fi

Complete any required web sign-in and confirm that the basic connection works.
Select a server on Home and note the Global Routing setting.
Turn on the switch, run Connectivity Test, then open the target page.
Note the results and disconnect before starting the next comparison.

On cellular data

On a device that supports cellular data, switch to cellular and confirm that data access works.
Keep the same server and Global Routing setting. Don’t change the protocol parameters.
Reconnect and repeat the same test and page check.
Compare the results and keep an eye on cellular data usage.

If only one network fails, first check for differences in the access environment. If both fail, check the server and service status next.

If the connection comes back on after you turn it off, check Settings → On Demand and see whether On Demand is enabled in the device’s VPN settings. On Demand can affect connections according to its configured conditions. For your first manual troubleshooting session, note its current state, temporarily disable relevant automatic connection conditions, and restore them afterward if needed. Don’t mistake an automatic reconnection for a faulty top switch.

6. Common first-connection questions and what to check

There are lots of servers in the list. Which one should I select?

On Home, select one entry you want to test and confirm it with the dot on the left. Region or purpose labels in a name are just for identification; they don’t guarantee current availability. If it fails, try another existing entry while keeping other conditions unchanged, and note the difference.

I allowed the VPN configuration. Why can’t I open anything?

Authorization only allows the device to create a VPN configuration. Return to Home and check the selected server and Global Routing, then run Connectivity Test. If you’re using Config, check whether a rule routes the target to DIRECT or another policy. If needed, switch to Proxy temporarily for comparison, then restore the original setting.

The subscription update failed. Can I still use existing servers?

A failed update doesn’t tell you whether existing servers can connect. Entries already saved on Home can be tested individually, but they may have expired or been changed by your provider. Check your basic network first, then verify the original subscription link and service status. Don’t delete all existing entries just to fix an update failure.

Should I change every port to 443?

No. The server address, port, Type, and authentication parameters must match the server configuration. 443 is just a port number; it doesn’t tell you which protocol a connection uses. Shadowsocks, VMess, VLESS, Trojan, Hysteria2, and WireGuard use different configuration fields. Keep the settings supplied with your subscription and ask your provider about anything unclear.

After a successful test, will I need to authorize the VPN again next time?

Subsequent connections usually use the saved system VPN configuration, so you don’t need to repeat the initial setup each time. If the configuration is deleted, the system asks you to authorize again, or device management policies change, follow the prompts on your device. When reconnecting, still check the selected server, especially after updating a subscription or switching Config.

7. Finish testing: Keep a reproducible connection record

A first connection is complete when you know which server is selected, which Global Routing mode is active, and what Connectivity Test and actual browsing each show—not merely when the switch turns on. This gives you a consistent way to find out what changed after switching networks or updating your subscription.

Note the access network, the server’s displayed name, and Global Routing. There’s no need to record or share passwords.
Confirm that the system VPN is connected, run Connectivity Test, and keep the exact error text or test result.
Open the page you need and verify the actual service path, which may differ from the test target.
Restore any temporary changes to routing and On Demand, then verify your usual setup again.
If you need help, share the steps you took and where the failure occurred. Remove subscription tokens and account credentials before sharing.