Shadowrocket First-Time Setup: VPN Permissions and the Home Screen Explained

At a glance

Before using Shadowrocket for the first time, make sure you have a server configuration, allow iOS to add a VPN configuration, and verify the connection. This guide walks new Home screen users through permissions, screen sections, routing modes, and connection checks. By the end, you’ll be able to tell whether no server is selected, permission to connect hasn’t been granted, or the connection is up but access still needs testing.

Before you start: buying the app and configuring a connection are separate

Shadowrocket is a closed-source, paid app for Apple platforms, primarily used on iPhone and iPad. App Store is the only place to get it. On the product page, check that the app is named Shadowrocket and the developer is Shadow Launch Technology Limited. Refer to the App Store page for system requirements.

Buying the app does not include a server plan. It won’t automatically create a server you can connect to. The SERVER list on the Home screen must be populated with your existing server or subscription configuration. This guide assumes you already have your own service configuration and covers how to import, select, and check it in the app.

932747118

App Store app ID, for verifying the product page

Three entry points

How Home, Config, and Settings differ in this guide

If SERVER is empty, prepare a configuration first; there’s no need to keep tapping the connection switch. Use the subscription URL, server address, port, credentials, and transport settings provided by your service. A website URL or arbitrary port cannot replace the server details.

Add VPN Configuration: What the system permission allows

“Add VPN Configuration” is a system permission request, not a prompt to import a subscription. Shadowrocket uses the system’s network extension to establish connections. When you connect for the first time and iOS hasn’t saved the required configuration, the app asks to add one. The prompt may not appear as soon as you open the app; if it doesn’t show up right away, that doesn’t mean anything is wrong.

Prepare a configuration

On Home, check that SERVER contains a recognizable server. To use an existing subscription, tap “+” in the upper-right corner of Home to open Add Server, set Type to Subscribe, enter the full subscription URL, and save. Once it loads, check the list.
Select a server

Return to Home and tap the selection circle to the left of your chosen server under SERVER. Opening a server’s details and selecting it as the current server are separate actions. Make sure the selection indicator is next to the intended entry.
Turn on the connection

Tap the connection switch at the top of Home. If iOS asks to add a VPN configuration, confirm that the request is from Shadowrocket, tap Allow, and authenticate as prompted by the system.
Return and verify

Go back to Home and check the connection status. Then run Connectivity Test and visit a webpage you actually need. Granting system permission only allows the configuration to be created; it doesn’t confirm that server authentication or access to the destination is working.

Home screen: Status, routing, testing, and servers

Home is where you manage everyday connections. The status at the top shows whether a connection is active. Global Routing determines how routing is handled, Connectivity Test starts a test, and SERVER lists the available server entries. These sections work together, but no single result replaces the others.

What each Home screen section does
Section	What it does	What to check the first time
`Not Connected` and the connection switch	Shows that you’re disconnected and lets you start or stop a connection.	Whether the switch stays on, or returns to the disconnected state after connecting.
`Global Routing`	Choose a routing mode such as Config, Proxy, Direct, or Scene.	Whether the selected mode fits what you’re testing.
`Connectivity Test`	Runs a connectivity test to check how the server or test target responds.	Whether a test actually ran, and whether the result is empty or timed out.
`SERVER`	Lists added servers and provides access to selection and details.	Whether the list has entries and the intended server is selected.

If you see Not Connected, check in this order: whether the list has entries, whether a server is selected, and whether permission is granted. If the switch turns on briefly and then off, note any message that appears and troubleshoot from there. A server name in the list alone doesn’t confirm that its credentials or transport settings are correct.

Global Routing: Four routing modes

Global Routing is not a server list, and it won’t fill in missing service details. When troubleshooting for the first time, identify which mode you’re testing and change only one variable at a time. The recommendations below assume you have a valid configuration file; no single configuration works for every network.

Config

Recommended

Uses the rules in the active configuration to determine routing. Rules may direct traffic through a proxy, connect directly, or use another defined policy. Config does not mean that every connection uses the currently selected server.

Use when: You’ve verified the configuration and are ready to use its rules for everyday connections.

Proxy

Routes connections handled by the app through a proxy. This can reduce rule-based routing as a variable during a quick test. You still need a working server configuration; selecting Proxy won’t fix an incorrect address, port, or credentials.

Use when: Briefly testing a proxy connection to distinguish server issues from rule issues.

Direct

Routes connections directly. If a regular webpage opens, that only shows it’s accessible over your current direct connection; it doesn’t confirm that the selected server is working.

Use when: Comparing against your current network’s direct connection.

Scene

Selects routing behavior based on configured scene conditions. Check the conditions and the actions they trigger; Scene is neither another server nor a fixed proxy mode.

Use when: You understand the scene configuration and need behavior to change based on network conditions.

If a destination works under Proxy but fails under Config, check the active configuration and matching rules rather than immediately recreating the VPN configuration. Config rules are evaluated in order; an earlier match may prevent a connection from reaching later rules.

SERVER: Select an entry or view its details

Names in the SERVER list help identify entries; they don’t prove that a server is usable. Whether added manually or loaded from a subscription, each entry needs the protocol and settings that match the server. For your first connection, verify one clearly identified entry before setting up more groups or automatic selection.

Check the current selection: Look for the selection circle to the left of the server. Opening its details or browsing an entry doesn’t make it the current selection.
Check the basic settings: The address and port must match. Use the port from your service details; don’t automatically switch to 443 just because the protocol uses TLS.
Check the protocol fields: A VMess or VLESS UUID is not interchangeable with a Trojan password. TLS, the transport, and any related hostnames must also match the server.
Know what a subscription update does: Updating a subscription reloads server configurations; it doesn’t reconnect the VPN. After an update, check the list and current selection again.

If the list is empty, first check whether the subscription URL is complete, returns valid configurations, and points to an active service. Subscription URLs may contain authentication tokens; when troubleshooting, share only the error type, never the full URL in a public forum. Changing Global Routing repeatedly won’t fix an empty list; they address different issues.

Connectivity Test: Compare test results with real-world access

Connectivity Test reports how a target responds under the test conditions; it doesn’t tell you whether every app or website is accessible. Results depend on the test method and target, and a single response time isn’t a download speed. For your first checks, compare results on the same network, server, and routing mode.

Verification plan: Record connectivity results and real-world requests separately

Connectivity Test

After tapping to start a test, confirm that it’s running. Don’t treat the lack of a result yet as a failure.
Record whether a value appears, whether the test times out, and which test method you used.
Run the test again after switching between Wi-Fi and cellular, and keep the results separate.

Test access to a real webpage

Make sure the Home connection switch is still on.
Open a page you actually need to access rather than relying only on the VPN status.
If only one destination fails, check its DNS resolution, routing rules, and service status.

In short: A test response, a connection that stays on, and successful access to the intended destination must all be considered together to verify your first connection.

If there’s no result, wait for the test to finish and confirm that the list contains a server to test. If it times out, check your current network and server details. If the test succeeds but a webpage won’t load, investigate DNS, rule matching, TLS settings, and the destination site separately. A single timeout doesn’t mean system permission has been lost.

Config and Settings: Adjust these after your first connection

Home is for selecting and managing connections, Config is for configuration files, and Settings is for app preferences. A server subscription and a configuration file are different: the former mainly provides server entries, while the latter can include general settings, rules, and policies. When Global Routing is set to Config, check which configuration file is active.

Config: Check the order of rules and the policy names in the active configuration. DOMAIN-SUFFIX matches domain suffixes, IP-CIDR matches IP ranges, GEOIP matches IP geolocation, and FINAL handles traffic that doesn’t match any of the preceding rules.
Settings → On Demand: Sets conditions for automatically starting a connection. Verify a manual connection first, then configure automatic triggers so unresolved connection issues don’t get mixed up with automatic connection behavior.
Change settings one at a time: Keep a copy of the original configuration that you can restore. First confirm the server works, then adjust routing or DNS so you can tell which change affected the result.

When reviewing rules in Config, check both the match conditions and the final policy field. For example, the snippet below sends a sample domain suffix to PROXY and everything else to DIRECT. It demonstrates the syntax only; it isn’t a complete configuration and can’t replace your existing service details.

[Rule]
DOMAIN-SUFFIX,example.com,PROXY
FINAL,DIRECT

You’re ready to move on when you can explain which server is selected, which routing mode is in use, and what the test results mean—not when every setting is turned on. If a manual connection isn’t stable yet, leave the current On Demand settings unchanged. Set up automatic triggers later, after checking the conditions and expected behavior.