Shadowrocket First-Time Setup: VPN Permission and the Home Screen Explained

At a glance

The key to setting up Shadowrocket for the first time is to have your existing connection configuration ready, then allow iOS to add a VPN configuration when you connect. This guide explains the Home screen’s connection switch, routing modes, test options, and server list. It’s for iPhone and iPad users who have installed the app but haven’t connected yet. Follow the steps to check permissions, the selected server, and routing results—don’t rely on the switch’s color alone.

1. Understand the App, Service Configuration, and VPN Permission

Shadowrocket is a closed-source, paid app for Apple platforms, available exclusively on the App Store. The developer is Shadow Launch Technology Limited, and the app ID is 932747118. Before purchasing, visit the App Store verification page to check the product details. Refer to the App Store listing for system requirements, device compatibility, and general purchase availability.

Buying the app does not include a connection service. The steps below assume you already have a service provider and subscription; they cover using an existing configuration only. Installing the app, importing servers, and allowing a VPN configuration are separate actions: installation provides the app interface, importing provides connection details, and system permission lets the app create a network tunnel to handle traffic.

Two types of configuration to check during setup

In-app connection configuration

From a subscription or connection details you already have.
Includes the server address, port, protocol, and authentication details.
After importing, check the SERVER section on Home.

System VPN configuration

iOS prompts you to add it when the app requests a connection.
You must explicitly allow it and complete any system verification steps.
Permission does not create a server or fill in missing authentication details.

Check the app’s identity and the source of your connection details first, then allow the connection. Granting permission does not verify that the remote service works.

2. First Connection: When to Allow a VPN Configuration

“Allow it the first time you open the app” is a common shorthand. More precisely, iOS usually prompts you when you first try to connect and a VPN configuration hasn’t been added yet. The prompt may not appear as soon as you open the app. If Home is still empty, import your configuration first; there’s no need to keep tapping the switch to trigger the prompt.

Import a configuration

Tap “+” in the upper-right corner of Home, select Subscribe under Type, enter a subscription URL you already have, and save. For example: https://example.com/sub?token=xxxx. This is a fictitious URL and won’t connect. Keep your actual URL and token private.
Check the list

Return to Home, wait for the import to finish, and check the SERVER list. If no servers appear, first check whether the subscription was retrieved successfully. To refresh it, use the update action for that subscription. Don’t mistake an empty list for a system permission problem.
Select a server

Tap an existing server and make sure the selection indicator is next to the intended entry. A subscription group name is not the same as an individual server entry. The connection uses the currently selected server or the target selected by the active policy.
Connect

Tap the switch on the Not Connected row at the top of Home. When iOS asks to add a VPN configuration, confirm that the prompt was triggered by this action, tap Allow, and complete any passcode or authentication steps requested by iOS.
Test access

Return to Home to check the connection status, then try to reach a destination that needs testing. Note whether the connection drops immediately, keeps waiting, or stays connected while the destination remains unavailable. Each points to a different troubleshooting path.

3. What Each Home Screen Section Does

Home is for connection controls, Config manages rule configurations, and Settings manages app preferences. Keep these roles separate when getting started: changing servers on Home doesn’t automatically edit the rules in Config, and changing auto-connect conditions in Settings doesn’t change how each domain is routed.

3 sections

Home / Config / Settings: connections, configurations, and preferences

4 modes

Global Routing：Config / Proxy / Direct / Scene

Connection status and traffic routing

Not Connected: Means the app is not currently connected. Use the switch beside it to connect or disconnect.
Global Routing: Choose a routing mode to decide whether traffic follows the configuration rules or another routing method.
Config: Bottom navigation tab for selecting and editing configuration files. It relates to the routing mode with the same name, but it’s a different control.

Connection status tells you whether the tunnel is running; routing mode tells you how traffic is handled.

Test option and server list

Connectivity Test: Checks server reachability or latency using the selected test method. Results depend on the test destination and network conditions.
SERVER: Shows imported or manually added servers for review, selection, and management.
Subscribe: The subscription type used to retrieve configuration entries from an address you already have.

A test result is not a connection switch, and an entry in the list doesn’t mean authentication succeeded.

Seeing Not Connected at first doesn’t mean installation failed; it usually means you haven’t connected yet. Conversely, a Connected status only confirms that the local tunnel is running. It doesn’t prove that the selected server, DNS, rules, or destination website are all working correctly.

4. Choosing a Global Routing Mode for the First Time

When troubleshooting for the first time, distinguish between choosing the wrong routing mode and using incorrect server details. If you already have a trusted, suitable rule configuration, start in Config. If you haven’t checked the configuration yet, open the Config tab at the bottom and confirm which file is active. Selecting Config doesn’t mean the app will automatically create suitable rules for every website.

Config

Recommended

Routes traffic according to the rules in the active configuration. Rules can send different traffic to PROXY, DIRECT, or another defined policy. Traffic that doesn’t match a rule is generally handled by FINAL; the exact behavior depends on the file.

Best for: everyday rule-based routing with a suitable configuration already in place.

Proxy

Routes all traffic handled by the app through the proxy path, making it easier to compare with the results under Config. It can’t fix an incorrect password, an invalid server address, or a remote service outage.

Best for: checking whether a specific destination is taking the wrong route because of a rule.

Direct

Connects traffic handled by the app directly, without using the selected proxy server. This is a direct routing mode, not the same as turning off the connection switch on Home.

Best for: comparing direct access on your current network to distinguish local network issues from proxy path issues.

Scene

Switches routing behavior according to configured scene conditions. Check the scene settings and current conditions first; Scene is not simply another name for Config.

Best for: switching behavior based on environment after setting up and verifying scene conditions.

For example, if the active configuration contains the rules below, example.com and its subdomains match PROXY, while traffic that doesn’t match earlier rules goes to DIRECT. This illustrates rule syntax; it isn’t a complete configuration to paste for your first connection. Before using it, make sure PROXY points to an available target in your configuration.

[Rule]
DOMAIN-SUFFIX,example.com,PROXY
FINAL,DIRECT

Rules are checked in order, and the first match determines how traffic is handled. If a destination is unavailable under Config but works after switching to Proxy, check which rule matches the destination and which policy it uses before removing the subscription. Restore the previous routing mode after testing so a temporary setting isn’t left in place.

5. Connectivity Test: Latency Isn’t Proof of Access

After tapping Connectivity Test on Home, treat the result as an outcome from a specific test method on your current network. Some tests focus on whether the server’s port is reachable; others check access to a test destination through the proxy. They test different parts of the connection. The numbers may also change if you change the test type, destination, or timeout.

What you observe	What it may indicate	What to check next
Latency is shown, but websites won’t load	The test completed, but that doesn’t confirm every part of a request to the destination is working	Check authentication, routing rules, DNS, and access to the destination itself
Shows timeout	This test didn’t finish within the allowed time	Try another network and check the address, port, and test destination
Connection drops immediately	The tunnel startup or connection process didn’t stay active	First check system permission and any error messages in the app
Only one website is unavailable	This alone doesn’t mean the entire server has failed	Compare Proxy and Config, then check the destination’s rule and the server’s response

For example, if the connection details you already have specify port 443, check that the imported entry still uses 443. Don’t change it to 80 just because a test timed out. The port is only one connection detail; the protocol, authentication method, and TLS options must also match the existing service configuration. This port is an example of what to check, not a value that applies to every server.

Keep the server, network, and destination the same to get a repeatable result.
Change one setting at a time and record the connection status and access results before and after.
When comparing Wi-Fi with cellular data, keep the server and routing mode unchanged.
When reporting an issue, include the error message but hide subscription tokens, passwords, and personal connection details.

6. SERVER List and Subscription Updates: Check What’s Selected

The SERVER list contains connection resources, not purchase records. An imported subscription may include multiple entries. Names are labels for identification; they don’t replace checking the protocol and connection details. Expand the relevant group, confirm which server is selected, and then run a test. After switching servers, test again instead of relying on results from the previous entry.

Refreshing a subscription retrieves entries from the remote source; it doesn’t update the app. If the remote content changes, server names, entry counts, and connection details may change too. After refreshing, confirm that the selected entry is still the intended one. You usually don’t need to add the system VPN configuration again after each subscription update.

List is empty: Check whether you’ve only saved the subscription URL without successfully retrieving its contents, and make sure the URL is complete.
Update failed: Determine whether the URL couldn’t be reached, authentication has expired, or the content couldn’t be parsed. Read the error message before taking action.
Entries have changed: Check which server is selected and test it again if needed. Don’t assume that an old name still refers to the same connection details.
Rules haven’t changed: A server subscription update doesn’t necessarily update rule configurations. Check the file on the Config page separately.

7. Set Up On Demand After Your First Successful Connection

If you haven’t verified a manual connection yet, leave your auto-connect conditions unchanged. After you’ve completed a manual connection successfully and can repeat it, go to Settings → On Demand to review the on-demand settings. On Demand controls when to connect or disconnect automatically; Global Routing controls how traffic is handled after connecting. They serve different purposes.

Connect manually on Home and verify that the selected server and current routing configuration work.
Go to Settings → On Demand, review the existing conditions one by one, and adjust them to suit your needs.
Switch to the relevant Wi-Fi or cellular network and check the actual connection status to see whether the condition is met.
If the app reconnects automatically after you disconnect manually, review the On Demand conditions and the system VPN’s on-demand connection status.