Shadowrocket First Launch Guide: VPN Configuration Permission and Home Screen Overview

1. VPN Configuration Permission: Allow Shadowrocket to Create a System Tunnel

Shadowrocket uses Apple’s built-in VPN capability to handle network requests. The first time you use the app, iOS asks you to approve adding a VPN configuration. This often happens when you first turn on the connection switch on Home, not necessarily as soon as you open the app. If the prompt hasn’t appeared yet, there’s no need to repeatedly quit and relaunch the app.

After you approve, iOS saves a VPN configuration that Shadowrocket can use to create a tunnel. This is separate from the configuration file on the Config screen, which determines routing behavior, and it does not fill in a server address, port, or authentication details. Allowing the configuration only lets the app request a connection; it does not mean the remote service is ready to use.

1. Verify the app

   Make sure you got Shadowrocket from the App Store. The developer is Shadow Launch Technology Limited, and the app ID is 932747118. To verify these details, visit the App Store verification page.

2. Prepare your details

   On Home, check for existing connection entries under SERVER. If the list is empty, add a server or subscription you already have. Approving the VPN prompt does not import server details.

3. Start a connection

   Select the server you want to use, then turn on the connection switch at the top of Home. If iOS asks to add a VPN configuration for the first time, confirm that the request comes from the current app.

4. Grant permission

   Allow the configuration when prompted, then complete any authentication required by your device. Return to Home and check the status. Permission approval and a successful connection to the remote service are separate things to verify.

2. What Home, Config, and Settings Are For

When you first open the app, learn what these three screens do before changing individual options. Home is mainly for connecting and selecting a server. Config is for managing routing configurations. Settings is for app preferences, including On Demand. Similar screen names do not mean their settings are interchangeable.

For example, Home → Global Routing → Config selects the option to route traffic according to a configuration. The Config tab at the bottom is where you view and manage the configuration itself. The first setting determines how traffic is handled; the second provides the rules used to handle it. Check both together.

• To connect or switch servers: start on Home.
• To check which rule matches a domain: review the current Config and its Rule entries.
• To find out why the connection starts automatically after a network change: check the conditions under Settings → On Demand.

3. Not Connected: Connection Status Isn’t Server Status

Home shows Not Connected when Shadowrocket has no active VPN connection. This is normal after installation and does not by itself mean the server is unavailable. The switch starts or stops the tunnel; the selected item in SERVER is the basic server choice for proxy requests.

After turning on the switch, check separately whether iOS granted permission, whether the app connected, and whether you can access the content you need. These are different layers: permission does not mean authentication succeeded, and an active connection does not mean every request uses the proxy. The actual route also depends on Global Routing and the rules.

4. Global Routing: Check How Requests Are Handled

Home → Global Routing lets you choose how traffic is handled. For a first look, understand Config, Proxy, and Direct, and remember that Scene is a scenario-based selection, not another server protocol. “All” below means traffic handled by Shadowrocket; it is not an absolute guarantee about all system traffic on the device.

Change one thing at a time when comparing results. Keep the same server and network, note what happens with Config, then briefly switch to Proxy and visit the same destination. If the results differ, check the routing rules first. Treat this as a troubleshooting clue, not a definitive answer; DNS and restrictions on the destination may also matter. Restore your preferred routing mode when you’re done.

5. SERVER: Server Details and Subscriptions

Use SERVER to view and select servers you already have. An empty list after installing means there are no connection details to select; it does not mean your purchase failed. Shadowrocket is a commercial app sold as a one-time purchase; buying the app does not include a service plan. This site does not provide, sell, or recommend servers, subscriptions, or providers.

The following steps assume you already have your own provider and subscription: on Home, tap “+” in the upper-right corner → Type → Subscribe, enter your own subscription URL, and save. Then check which entries were imported. A subscription supplies server details; it does not replace system VPN permission or ensure that your Config routing rules are ready.

• Check the protocol first: Shadowsocks, VMess, VLESS, Trojan, Hysteria2, and WireGuard require different parameters. Don’t choose a Type based only on a similar name.
• Then check the address: The server address and port must come from your own valid details. Ports are not fixed to the same number across all protocols, so don’t copy an unrelated example.
• Check authentication fields: Enter the password, UUID, key, and other fields required by the protocol you use. If TLS is enabled, check the related names and parameters too.
• Select after updating: After updating the subscription, check the server list and selected entry so you don’t mistake an old entry’s status for the new details.
• Protect your subscription URL: Credentials in the URL may grant access. Don’t post the full link, QR code, or authentication fields in a public support request.

Selecting a server sets the basic outbound choice for proxy requests. With Config selected, rules or policy groups may still route traffic elsewhere. Selecting a server does not mean every request goes through it.

6. Connectivity Test: Use Results as Diagnostic Clues

Home → Connectivity Test checks connectivity. Before reading the results, confirm which test method is being used and its target. A latency or success result applies only to that test’s route and conditions; it does not guarantee that every website, port, or protocol feature will work. If a test fails, also consider the current network, server details, and target status.

1. Keep test conditions consistent: Choose Wi-Fi or cellular, and note the current Global Routing mode and selected server so you don’t change multiple variables at once.
2. Run a connectivity test: Use Connectivity Test on Home and check the result for the same entry. Don’t treat results for other entries in the list as results for the current server.
3. Check real-world access: After granting VPN permission and connecting, try to access the destination you need. If the test succeeds but the destination doesn’t, check the rule that actually matched and the destination itself.
4. Retest after one change: Change only one of the network, server, or routing mode at a time. Keeping the state and error details from a failure makes it easier to find the cause than switching several options in a row.

7. Config and On Demand: Understand These Two Settings First

A common point of confusion is treating “when to connect” and “how to route traffic after connecting” as the same setting. On Demand controls how the system handles the connection when conditions are met. Rule controls which policy applies to requests. On Demand won’t fix an incorrect server password, and Rule doesn’t replace system permission.

For first-time setup, follow this order: verify the app source → prepare server details you already have → choose a Global Routing mode → connect and allow the VPN configuration → verify with Connectivity Test and real-world access. Confirm that a manual connection works consistently before adjusting automatic connection conditions. This makes troubleshooting clearer.

• Still seeing Not Connected? Go back and check the connection switch and system permission.
• Connected, but traffic is taking the wrong route? Check Global Routing and Config.
• Status changes on its own after switching networks? Check Settings → On Demand.