This guide is for users who have already imported servers on an iPhone or iPad. Follow this order: check the server entry, select a default server, review Global Routing, turn on the connection, and run Connectivity Test. Then verify access by opening a page you actually use. Keep these three states separate: a server is selected, the system VPN is connected, and the destination is reachable. A latency figure alone does not confirm a working connection.
Before Connecting: Check SERVER and Your Configuration Source
In Shadowrocket, Home is the main screen for your first connection. SERVER lists server entries, Config manages configuration files, and Settings manages client preferences. Seeing a server in the list only means an entry was imported; it does not confirm that its credentials are valid or that your current network can reach it.
This guide assumes you already have your own service provider and subscription. Get the subscription from your provider. Buying the client does not include a service plan: your App Store purchase covers the right to use Shadowrocket. You must separately verify the server address, port, authentication details, and service status needed to connect.
- On your current Wi-Fi or cellular network, open a page you can normally access to check that your basic connection works. If the Wi-Fi network requires a sign-in, complete that first.
- Go to Home → SERVER and make sure there is at least one complete server entry, not just a subscription group with no content yet.
- If the subscription is empty, first check whether its update failed. Repeatedly toggling the connection does not replace updating the subscription.
- Keep your existing working configuration. For an initial check, avoid changing the server, DNS, rules, and On Demand all at once.
First Connection: Select the DOT and Turn On the Connection
The default server is the one currently selected manually. In Home → SERVER, tap the server entry you want and confirm that the DOT appears beside it. Opening an entry's details or edit screen lets you review its parameters; it does not select it as the default. Check the DOT again after switching to make sure the previous entry is no longer selected.
-
Select a Server
Go to Home → SERVER and tap an imported server entry. Confirm that the DOT is beside it and note its name; use only this server for the current test.
-
Check the Routing Mode
Go to Home → Global Routing and review the current selection. If you have a trusted, working configuration, use Config. To test the selected server's proxy connectivity on its own, you can temporarily choose Proxy, then switch back to your usual mode after testing.
-
Turn On the Connection
Return to Home and turn on the connection switch at the top. If iOS asks to add a VPN configuration, confirm that the request is from Shadowrocket, allow it, and complete device authentication as prompted.
-
Run the Test
Wait for the connection status to settle, then tap Home → Connectivity Test. Note whether it succeeds or fails, how long it takes, and which network you're using. Don't switch servers while the test is still running.
-
Verify Access
Open and refresh a page you actually need to use. Make sure it loads, then check other services you use regularly. Keep the server and routing mode combination that reproduces the result.
A connected system VPN means the local VPN tunnel is established; it does not guarantee that the remote server is reachable. If the switch turns off immediately, first address system authorization or the connection error shown by the client. If it stays on but pages won't load, continue with the connectivity checks below.
Global Routing: Routing Modes and the Default Server
The default server controls your manual proxy selection; Global Routing determines how requests are routed. They are separate settings. With Config selected, rules may send requests DIRECT or use a policy or policy group, so not every request necessarily goes through the entry marked with the DOT. Don't assume a page's route based only on the default server's name.
Config
RecommendedRoutes requests according to the rules and policies in the current configuration. First confirm that the enabled file in Config is the one you expect; rules can send different requests through different outbound routes.
Best for: Everyday rule-based routing with a working configuration.
Proxy
Routes requests handled by the client through the proxy, which can help reduce the effect of rule-based routing while testing. It cannot fix incorrect server parameters or an expired service.
Best for: Checking the selected server for the first time and isolating rule-related issues.
Direct
Sends requests handled by the client directly. A page loading in this mode does not prove that the selected proxy server works.
Best for: Comparing against direct access on your current network.
Scene
Applies routing according to configured scene conditions. Check the scene conditions and their associated settings before use; this mode is not an automatic connection repair.
Best for: Users who have already configured network scenes.
If a test succeeds in Proxy but a destination fails in Config, first check the enabled file in Config and the rule that matches the request instead of immediately reimporting the subscription. In particular, check how DOMAIN-SUFFIX, GEOIP, and IP-CIDR match the destination, as well as the final policy in FINAL. These rules determine the outbound route; they do not verify whether your account is valid.
Connectivity Test: What the Results Tell You
Home → Connectivity Test checks connectivity to its test target. A successful result is useful evidence, but it only covers that target under the network and routing conditions at the time of the test. It is not a speed test and does not guarantee that every website, video, or app will work. A latency reading in milliseconds does not mean you have sufficient bandwidth.
| Where to Check | What It Confirms | What Still Needs Verification |
|---|---|---|
| Home connection switch stays on | The local VPN connection has not dropped immediately | Whether remote authentication succeeds and actual requests complete |
| A latency result appears for a SERVER entry | The latency check received a response | A complete proxy handshake and access to the service |
| Connectivity Test succeeds | The test request completed under the current conditions | DNS, rules, and access restrictions for the actual destination |
| The actual page refreshes successfully | That destination was accessible at that time | Whether other destinations work and the connection remains stable |
Don't confuse the latency check in SERVER with Connectivity Test on Home. The former can help screen candidate servers; the latter needs to be interpreted alongside the current connection and routing state. When recording results, note the default server, Global Routing mode, whether you're on Wi-Fi or cellular, and whether the page actually loaded. This is more useful for troubleshooting than a latency figure on its own.
When Results Differ: Check These Two Scenarios
If the connection fails, keep the test conditions unchanged at first. Change one factor at a time and repeat the same test after each change. The guidance below explains how to interpret results; it is not a performance claim for any particular service. Results can vary with the network, service status, and destination.
Troubleshoot Test Failures Separately from Access Failures
Connectivity Test Fails
- Make sure the switch stays on and the DOT is still beside the expected server.
- Make sure you're not mistaking a direct connection in Direct for a proxy result.
- Check the server address, port, and authentication details, and verify the service status.
- Switch only between Wi-Fi and cellular, then run the same test again.
Test Succeeds, Page Fails
- Refresh the destination page to rule out a misleading result from a cached page.
- Temporarily compare Proxy with Config to check whether the issue is rule-related.
- Check DNS resolution for the destination domain and look for request errors in the client log.
- Test another commonly used destination to distinguish an issue with one service from a broader problem.
Change only one of these at a time: server, network, or routing mode. Keep the original settings and restore your usual configuration once you identify the cause.
If the system VPN is connected but all proxy traffic fails, focus on the remote server parameters and service status. For connections that use TLS, the device's clock can also matter. On your iPhone or iPad, check Settings → General → Date & Time to make sure the time is correct. Don't turn off certificate verification to bypass an error.
After Connecting: Save Your Everyday Settings and Retest
After your first successful connection, restore the Global Routing mode you plan to use and reopen the actual page. Success in a temporary Proxy test only confirms that this set of proxy test conditions worked; after switching back to Config, you still need to verify rule-based routing. Establish a stable manual connection before setting up automatic triggers—it makes troubleshooting easier.
- Check the active configuration: In Config, confirm which file is enabled instead of relying on its name to infer its contents. Retest your usual destinations after updating the configuration.
- Set up automatic connections afterward: Go to Settings → On Demand and review the relevant conditions. On Demand triggers connections based on conditions; it cannot fix an unavailable server.
- Keep a record for comparison: Note the working server name, routing mode, and network type. If a problem occurs, repeat the same checks in the same order instead of changing several settings at random.
- Check the final connection state: If you're only testing temporarily, turn off the connection when you're done if needed. If it reconnects after you turn it off, check the On Demand conditions rather than repeatedly toggling the switch.
Shadowrocket is available only through the App Store and is primarily used on iPhone and iPad. Compatibility with Mac, Apple TV, and Apple Vision, system requirements, and purchase availability are as shown on the App Store page. Before reinstalling or moving to another device, check your purchase history and keep any configuration backups and connection details provided by your service provider.