Config: applies the policies defined in the active configuration.
This document shows rule syntax, not the app interface.
Connection settings & Routing Rules
Choose a topic based on the issue you’re troubleshooting. These are web manual illustrations, not app screenshots; refer to the app for actual settings.
Rule · Choose policies by condition
Select Config, then check rule order
Routing rules let you apply different connection policies to different destinations. Select Config under Global Routing to have the client match requests against the active configuration, rather than sending all traffic through the same route. Before editing, check the domain and IP conditions and policy names, then review the rule order. More specific conditions generally go first, with FINAL at the end as the fallback. The example on the right illustrates syntax only; it is not a replacement for your complete configuration. To verify routing, check which rule matches an actual request—don’t rely on the connection switch alone.
DOMAIN-SUFFIX,example.com,PROXYMatches a domain suffix and uses the PROXY policy
›
GEOIP,CN,DIRECTMatches a geographic IP condition and uses the DIRECT policy
›
FINAL,PROXYApplies when none of the preceding rules match
›
example.com is a domain used for illustration.
On Demand · Network conditions
Test manually before setting up On Demand
On Demand can trigger connections based on network conditions. Configure it only after confirming that your setup works. Find On Demand in Settings and review the conditions for Wi-Fi and cellular networks one by one. Avoid changing automatic connection behavior while you’re still diagnosing a problem. On Demand doesn’t mean every app continuously transfers data, and it doesn’t guarantee lower battery use. If connections keep restarting when you switch networks, temporarily disable the relevant conditions and retest the same destination manually. Then check battery usage and connection records to investigate further.
On DemandCheck network conditions and expected behavior
›
Retest manuallySeparate automatic connection conditions from configuration issues
›
Protocol · Matching parameters
The Type must match the server settings
Shadowrocket supports multiple protocols, but choose a protocol based on the server details—not its name or perceived speed. In Add Server, set Type to match the information for your existing server, then enter the address, port, and required authentication fields. Shadowsocks Method, Trojan password and TLS, and WireGuard keys and address settings all differ and can’t be substituted for one another. Even the same protocol name doesn’t guarantee matching transport parameters. If a connection fails, compare each field with the original details instead of repeatedly switching types. The technical reference explains these differences field by field.
Refer to the app and your existing server details for the available types and fields.
Subscribe · Import existing details
Tell subscription URLs apart from individual server details
Subscribe imports and updates subscription content you already have. Before you begin, make sure you have a subscription URL—not a regular webpage URL or a single server share link. After importing, check that the resulting entries match the original details. If an update fails, check that the URL is complete, accessible, and still valid; don’t repeatedly delete all your configurations. Subscription URLs may contain access credentials, so redact sensitive information before sharing screenshots or troubleshooting records. This site explains how to import existing subscriptions; it does not provide, sell, or recommend nodes or subscriptions.
https://example.com/sub?token=xxxxIllustrative only; this example won’t connect and contains no real credentials
›
Verify after importCheck that entries and types match your existing details
›
Config · Configuration files
Check server details and routing rules separately
Config manages rules and related settings used when handling connections; it is not the same as the server list in a subscription. First check which configuration is active, then confirm that Config is selected under Global Routing. Editing a file without enabling it may not change how traffic is routed. Keep a recoverable copy before making changes, and change one type of condition at a time, noting why. To organize details across devices, review the app’s iCloud sync options and scope. Don’t treat syncing as a completed backup or assume every device has identical local state.
ConfigUses rules in the active configuration to choose a policy
›
ProxyUse proxy mode for comparison
›
DirectUse direct mode for comparison
›
SceneReview related scene settings separately
›
Diagnostics · Troubleshoot step by step
Interpret test results in context
Connectivity Test, Diagnostics, and Data provide different kinds of information. Use test results to narrow down a problem; one response doesn’t prove that every website is accessible, and Data traffic records don’t indicate the remaining allowance on a server-side account. Start by confirming that your local network works, then check server parameters, the current mode, and matched rules. Finally, test the actual destination. Recording the test method and network conditions is more useful than repeating tests. Before sharing diagnostic information, remove subscription URLs, passwords, and other connection credentials.
Connectivity TestInterpret results in light of the Test Method
›
DataReview traffic recorded by the client
›
DiagnosticsGather troubleshooting clues and remove sensitive details first
›
iPhone & iPadAvailability
The App Store is the only place to get Shadowrocket. Check the App Store listing for system requirements, device compatibility, and whether the purchase is universal.
iPhone
Follow the guide to purchase, open the app for the first time, and verify a connection. Confirm on the product page that your device is supported, then purchase using your own Apple ID. When you first connect, iOS may ask to add a VPN configuration. Read the prompt, confirm it comes from the Shadowrocket app you just opened, and follow the system instructions to authorize it.
Purchasing the app doesn’t provide connection details. You’ll need your own subscription or server information, and should confirm it’s complete. If you don’t have it yet, you can still read about modes and terminology without entering arbitrary addresses or passwords.
Use the wider screen to review configurations, check rules, and organize details you already have. If you’ve purchased the app, first check which account you used in the App Store, then look at its purchase status under your purchased items. Check the App Store listing for universal purchase availability and compatibility.
The iPad layout may differ from the iPhone layout. Use interface labels such as Home, Config, and Settings to find controls instead of relying on screenshot coordinates. System connection authorization must still be confirmed on the current device; check configuration sync separately.
Get started in three steps with an existing configuration
Start with a manual connection before setting up automatic connections or complex rules. Each step should leave you with a result you can check.
Add Server / Subscribe
Import an existing server or subscription
Choose an import method based on the details you already have. For a single server, check Type and each field in Add Server. For a subscription, use your own complete subscription URL. After importing, check that the name, server address, port, and protocol match the original details. Seeing an entry in the list doesn’t mean its parameters are correct. Check the source and completeness of QR codes and shared details, too.
If a field is unclear, refer to the original details rather than using values from an online example. Pay particular attention to authentication, TLS, and transport options: an incorrect combination may save successfully but still fail to connect. Example domains are for explaining formats only; they aren’t real servers.
Global Routing
Choose a routing mode for your needs
Config routes traffic according to configuration rules, Proxy uses proxy mode, and Direct uses direct connection mode. To handle different websites differently, select Config and confirm the intended configuration is active. For troubleshooting, compare with another mode if needed, but note your changes and restore the intended settings after testing. Mode and server selection are separate checks; one doesn’t replace the other.
You don’t need to write a large set of rules when starting out. First understand the fallback policy in your existing configuration, then add only the conditions you need. If a website behaves unexpectedly, check the matched rule and domain condition rather than assuming the entire server is unavailable. Review Scene behavior separately once you’re familiar with the basic modes.
Home / Connectivity Test
Connect and verify access
After confirming the selected server and mode, turn on the connection and follow the system prompt to authorize the VPN configuration. Use Connectivity Test to gather clues, then visit a specific destination and check whether its behavior matches the active rules. A connected status confirms only the connection state; it doesn’t by itself prove that authentication, DNS, rules, and access to the destination are all working.
If something goes wrong, check the local network, server parameters, mode and rules, then the destination—in that order. Change one condition at a time and keep the previous settings. If the issue occurs only on a particular Wi-Fi or cellular network, note the conditions before comparing. This makes differences easier to find and helps distinguish automatic connection issues from protocol problems.
Shadowrocket is a closed-source commercial app. Verify the product before purchasing, then manage the app and your own connection details separately.
Verification · Developer
Check the full developer name
On the App Store product page, find the developer or seller information and confirm it says Shadow Launch Technology Limited. Don’t decide based only on the app name, search ranking, or similar descriptions. A matching or similar name alone doesn’t prove the product’s identity; check the icon and app ID as well.
Verify the actual product page, not just the search result summary. If the page doesn’t match the three details listed in this manual, return to the verification guide and confirm you’re on the right listing before purchasing. Check the price and compatibility on that same product page to avoid mixing up details from another app.
Verification · Icon & ID
Check the icon and product URL together
App ID 932747118
The official icon is a blue-purple outlined design on a white background, matching the icon shown here. The product page URL should include id932747118. The app name, developer, icon, and ID should all identify the same product. Checking only the icon color or one word in the name isn’t enough.
After arriving at the App Store from this site’s availability guide, review the information currently displayed there. Storefronts, interface languages, and prices may differ. Checking the product ID and developer helps confirm it’s the same Shadowrocket, not a similar listing.
What the purchase covers
App purchase ≠ connection plan
The one-time purchase gives you a license to use the Shadowrocket app. The US storefront price is about $2.99; prices appear in local currency on other storefronts. Check the App Store listing for the current price. The app purchase, your existing subscription, server validity, and connection conditions are managed separately. A record of purchasing the app doesn’t mean a connection service is ready to use.
This site does not provide, sell, or recommend nodes or subscriptions. Import instructions assume you already have your own subscription or server information. Before purchasing, make sure you have the details you need. If the list is empty after purchase, follow the guide to import your own existing configuration, then check its settings and connection status.
Account & recovery
Keep purchase records and configuration details separate
When using Shadowrocket on iPhone and iPad, first check the App Store account and purchase history. Check the App Store listing to see whether the purchase is universal. After changing devices or redownloading the app, restore the app first, then check whether your existing configurations are still there. Restoring purchase eligibility does not restore all local rules, subscription URLs, or custom settings.
App availability in the store depends on the storefront associated with your account. If you can’t find the app, see a different currency, or see a purchase button again, check your current account and the product page. Don’t rely on your device’s region or interface language alone. Before changing your account’s storefront, read the App Store notices and applicable requirements.
Frequently asked questions for first-time users
First distinguish the purchase, connection, and routing layers; then decide what to check next.
Why do I need to select Global Routing after adding a server?
A server entry provides connection parameters; Global Routing determines how requests are handled. Even with correct server details, the current mode or configuration may apply a different policy to a destination. First understand Config, Proxy, and Direct, then check which rule matches the destination. Don’t confuse routing choices with authentication parameters.
Are Subscribe and Config the same kind of information?
No. Subscribe is generally used to import and update existing server entries; Config covers routing rules and related settings. Before importing a URL or file, identify what it contains and choose the corresponding option. Don’t use a regular webpage URL as a subscription, or assume that importing servers automatically enables the rules you need.
Can Data show how much traffic remains on my subscription?
Data shows information recorded by the client. Interpret its scope and measurement according to the app’s documentation; it shouldn’t replace the usage records for a service you already have. To investigate traffic use, consider the connection times, actual usage, and rules together. Don’t infer the status of a server-side account from a single cumulative figure.
What should I verify after turning on the connection?
Check that you can reach the actual destination and that requests follow the expected policy. First check your local network, then the server parameters and Global Routing, and finally compare test results with request records. If only one website is affected, start with its rules and domain matching conditions rather than changing everything at once.
Start with the details for your existing server and distinguish the roles of the address, password, SNI, and TLS. Match each field when entering the settings. If authentication or handshake fails, check the relevant fields instead of repeatedly switching protocols.
A test timeout and an actual connection failure are different issues. Check the test method, address and port, authentication details, system time, and TLS settings in order. This helps avoid misdiagnosis caused by changing several conditions at once.
Assuming Config is selected under Global Routing, this guide explains domain conditions, rule order, and how FINAL,DIRECT works. Adapt the example to your destinations and verify that the intended rule matches.
