Shadowrocket First Connection: Select a Server and Run Connectivity Test

At a glance

This guide is for iPhone and iPad users who have installed Shadowrocket and are ready to use a service configuration they already have. Follow the steps in order: prepare a server, select it, check Global Routing, approve the VPN configuration, and test a real request. Learn how to distinguish a server appearing in the list from an active system connection and a reachable webpage, and narrow down the cause if something fails.

1. Home: Prepare a Server and Select It

After opening Shadowrocket, check whether Home already lists a server. Installing the app does not provide a server automatically; get a subscription link from your service provider. Purchasing the app and purchasing a service plan are separate. To connect for the first time, you need an existing, valid service configuration.

To import a subscription, tap “+” in the upper-right corner of Home, set Type to Subscribe, enter your subscription link in URL, and save. Wait for the list to load. Subscription URLs often contain account-identifying parameters, so treat them as sensitive information. Do not post the full URL or screenshots showing credentials publicly. If the list is empty, first check whether the import or update succeeded instead of repeatedly toggling the connection.

Prepare a Subscription

Get the subscription link from your service provider. If a valid server is already listed in Home, skip re-importing and check which server is selected.
Import the List

Home → “+” → Type → Subscribe. Enter the URL and save. Once it loads, check that server entries appear. If you see only a subscription name but no usable entries, troubleshoot the update first.
Select a Server

In Home, tap the dot beside a server name and confirm the selection indicator moves to the intended entry. The info button on the right opens its details for viewing or editing; it does not select that server.
Check the Settings

To review a server, open its details and compare Type, address, port, and authentication information with your provider’s settings. Use the port specified by your provider; do not change it to 443 just because that is a common port.

Shadowsocks, VMess, VLESS, Trojan, Hysteria2, and WireGuard are different protocol types, not speed settings for the same configuration. Do not switch Type to another protocol to try to “speed things up.” If the protocol does not match the server settings, the connection will fail even when the address and port look correct.

2. Global Routing: Check How Requests Are Routed

Open Global Routing in Home and check whether Proxy, Direct, Config, or Scene is selected. The server dot selects the server; Global Routing determines how requests are routed. These settings are not interchangeable. In particular, with Direct selected, turning on the connection does not mean webpages are being accessed through the selected server.

Config

Recommended

Requests follow the rules in the currently enabled configuration. Rules may route traffic to DIRECT, PROXY, or a specific policy, so do not assume that one type of website always connects directly while another always uses a proxy.

Best for: Everyday use with an existing rule configuration you have reviewed and intend to use.

Proxy

Routes traffic through the proxy globally, making it easier to temporarily rule out ordinary routing rules in Config during testing. It does not change the server protocol, authentication details, or service availability.

Best for: Temporarily checking whether the selected server can handle real requests while troubleshooting your first connection.

Direct

Routes traffic directly. If you open a webpage that is already reachable directly, that only confirms it is accessible on your current network; it does not show that the selected server is working.

Best for: Establishing a direct-connection baseline and checking basic network access.

Scene

Routing follows the configured scene. Before testing for the first time, review what the scene does; selecting Scene alone does not tell you which route a request will take.

Best for: Environments where the scene has already been set up and reviewed.

If you are unsure what the existing rules do, temporarily select Proxy for a comparison test, record the result, then restore the original mode. If access works in Proxy but fails in Config, check which file is enabled in Config and which rule matches the request instead of changing the server password. Rules are generally evaluated from top to bottom. DOMAIN-SUFFIX, GEOIP, IP-CIDR, and FINAL serve different purposes; you do not need to replace the entire ruleset to test your first connection.

3. Connection Toggle: Approve the VPN Configuration and Check Status

Return to Home, confirm the server dot is selected, then turn on the connection toggle at the top. The first time you connect, the system may ask permission to add a VPN configuration. Confirm that the request was initiated by Shadowrocket, allow it, and complete device authentication as prompted. This authorizes a system VPN configuration; it does not involve buying the app again or re-entering your service provider’s subscription URL.

Before Connecting

Server: The dot beside the intended server in Home is selected.
Routing: The Global Routing selection matches the purpose of this test.
Permission: Approve the system prompt to add a VPN configuration when it appears for the first time.

Check these three items before deciding whether the connection toggle has stayed on.

After Connecting

Toggle: Return to Home and check that the connection is still on.
System Status: Check the connection status in the system’s VPN settings.
Request Result: Continue with Connectivity Test and a real webpage request.

An active system connection is only one part of the process; you still need to test the intended request.

If you have not approved the configuration, turn on the Home toggle again and see whether the system prompt reappears. Do not start by deleting all system network settings. If the toggle turns itself off shortly after you enable it, note the message shown, check whether permission was granted and the current configuration is valid, then address the specific issue.

Where the VPN indicator appears depends on the device and system interface, so do not rely on the status bar icon alone. A more reliable sequence is to check the in-app toggle, the system connection status, and finally a real request. If the three results do not agree, treat that discrepancy as a troubleshooting clue.

4. Connectivity Test: Compare Test Results with Real Access

Find Connectivity Test in Home, run it, and note the result or error message. The test reflects the method and target used at that moment; it does not verify every website, app, or connection type. A latency figure in the list is no substitute for a complete request that requires authentication, encrypted transport, and a response.

Record the conditions first: Note whether you are on Wi-Fi or cellular, the selected server, and the Global Routing mode so you can tell whether multiple tests used the same conditions.
Then run the test: Run Connectivity Test and note whether it succeeds, times out, or shows another message. One failure does not mean the entire subscription is unusable.
Make a fresh request: Open a webpage you actually need and refresh it. Check that new content loads rather than relying on a cached page.
Cross-check the result: To confirm which policy handled a request, check the corresponding destination and policy in the app’s connection logs. A webpage opening successfully alone does not prove that it went through a proxy.

If the test succeeds but a particular webpage does not load, try another site you regularly use as a comparison, then check DNS, rules, and connection logs for the failing destination. Do not change DNS, protocol, port, and rules all at once; even if things start working, you will not know what fixed the issue. This guide does not provide measured latency figures; actual results depend on what your device reports at the time.

5. Wi-Fi and Cellular: Change One Condition at a Time

If the same server works on one network but fails on another, keep the server and Global Routing unchanged and switch only the network. This helps determine whether the issue is more likely to be with the local network or the server configuration. While manually checking the first connection, also review Settings → On Demand so existing automatic connection conditions do not affect your observations.

Compare Wi-Fi and Cellular Connections

Wi-Fi

First check whether the network requires a web-based sign-in, and complete it before connecting.
Keep the selected server and Global Routing unchanged.
Run Connectivity Test and refresh the same webpage.

Cellular

Confirm that Shadowrocket is allowed to use cellular data on your device.
After switching networks, check the Home toggle and system connection status again.
Repeat the same test and note how the results differ from Wi-Fi.

First verify the connection manually. Then configure Settings → On Demand if needed and test each relevant network condition.

If the connection turns back on automatically after you switch it off manually, do not assume the toggle is faulty. Check the automatic connection settings in Settings → On Demand and the on-demand connection status for this VPN configuration in the system settings. Note the original values before making changes, then restore any settings you still need after testing. Do not permanently change all connection behavior to troubleshoot a single network.

6. Common First-Connection Problems: Narrow Down the Cause

Why can’t I connect when the list has so many servers?

Return to Home and confirm the dot beside the intended server is selected; opening its details is not enough. Then check that the service for that entry is still valid and that its protocol and authentication details match your provider’s information. A server appearing in the list only means the data was imported; it does not mean every entry can connect right now.

Why won’t a webpage load even though the toggle is on?

Run Connectivity Test first, then check Home → Global Routing. If Direct is selected, the current request is not a proxy connection test. If you are using Config, temporarily switch to Proxy for a comparison, then restore the original mode. If it fails only in Config, first check the active configuration and relevant rules in Config.

Is it normal not to see a prompt to add a VPN configuration?

If you already approved the configuration, the system may not prompt you again on later connections. First check the Home toggle and system VPN status. If you still cannot connect, check whether device management restrictions prevent changes to VPN settings. Follow the requirements for managed devices; do not repeatedly delete configurations to bypass restrictions.

The subscription imported successfully, but an update failed. Do I need to buy the app again?

Subscription updates and app purchases are separate. First confirm that the current network can reach the subscription URL, then ask your service provider to verify the URL, its validity period, and your account status. If an update fails, keep the existing configuration and error message. Buying the app again will not fix a subscription error.

Can I turn on automatic connection with On Demand after a successful test?

First confirm that the intended webpage is reachable in the required routing mode, then set automatic connection conditions in Settings → On Demand. Check whether the connection behaves as expected on both Wi-Fi and cellular. A successful manual test does not mean every automatic connection condition is configured correctly.

After verifying your first connection, keep a simple record of the server, Global Routing mode, network type, Connectivity Test result, and webpage behavior. When connection problems occur later, compare them with these conditions and change one thing at a time. For help checking specific settings, read the settings handbook. Before sharing troubleshooting details, hide subscription URLs, passwords, keys, and other authentication information.