For your first connection, confirm in order that a server is selected, the VPN connection is established, and both the test and real-world access work. This guide is for users who have imported their own server or subscription into Shadowrocket. Follow the steps in Home and check separately that a server is listed, the connection switch is on, and requests are actually working.
1. Understand the difference between importing, selecting, and connecting
A server appearing in the Home list only means its connection details are saved in the app. It does not mean it is selected as the active server, and it does not mean the VPN is connected. Check each step in turn to avoid repeatedly refreshing a subscription before selecting a server, or assuming that one successful test means every app can connect.
This guide assumes you already have a service provider and subscription. Buying the client and purchasing network service are separate: the one-time purchase of Shadowrocket does not include a service plan. Your subscription provides server details; the app uses those details to connect and apply the current routing settings.
Use Home to select a server and control the connection. Config is for managing configuration files, and Settings contains app options such as On Demand. For the first connection, stay in Home and run a basic check; there is no need to change rules, DNS, or automatic connection settings at the same time.
2. Select a server in Home and turn on the connection
Tap the server row in the Home list and check whether a selected indicator appears on its left. The detail control at the end of the row usually opens the server’s settings for viewing or editing; it does not select the server. Server names can be customized, so use the selection indicator—not the word “default” in the name—to confirm which server is selected.
-
Check the list
Open Home and confirm that the imported subscription group or server appears. If the list is empty, check the import. A subscription URL is not itself a server configuration you can connect to.
-
Select a server
Expand the existing group, tap the server you want to test, and confirm that the selected indicator appears on its left. Note the server name and use the same one for the remaining tests.
-
Check routing
Go to Home → Global Routing and check the current selection. Use Config if you already have a working rules configuration. To temporarily rule out routing as the cause, compare with Proxy, then restore your original setting after testing.
-
Turn on the connection
Return to Home and turn on the connection switch at the top. The first time you connect, iOS may ask to add a VPN configuration. Confirm that Shadowrocket initiated the request, tap Allow, and complete device authentication if prompted.
-
Confirm the connection
Return to Home and check the connection status. If the switch turns off immediately or the connection cannot be established, address the authorization or connection error first. The switch briefly lighting up is not proof that the connection succeeded.
If you already granted permission, you may not see the prompt again. This is normal. If a device management policy restricts VPN configurations, first confirm whether adding one is allowed. Do not repeatedly delete configurations as a way to troubleshoot.
3. Check that Global Routing does not change what the test tells you
Requests to the same server can take different paths under different Global Routing modes. In particular, a webpage loading in Direct does not prove that the server works; under Config, a webpage may match a DIRECT rule. The modes below refer to Shadowrocket’s routing behavior. The recommended option assumes you have a working rules configuration.
Config
RecommendedRouting follows the rules in the active configuration. Rules can direct traffic to DIRECT, REJECT, or a proxy policy. Requests that do not match an earlier rule are usually handled by FINAL; this does not simply mean “everything else goes direct.”
Best for: Everyday rule-based routing after you have checked the configuration.
Proxy
Requests handled by the app use a proxy routing mode. Use this to see whether a problem persists when rule-based routing is bypassed. It does not replace checking server details or guarantee that a particular network service will work.
Best for: Temporarily comparing with Config to narrow down problems with rules or policy selection.
Direct
Requests use a direct connection. The result mainly reflects your local network’s direct connectivity, so this mode is not suitable for checking whether the selected proxy server works.
Best for: Comparing against your local network to see whether the problem occurs only on the proxy route.
Scene
Applies behavior based on conditions set in advance for each scene. If you have not checked your scene settings yet, use a clearly defined, fixed mode for the first connection test so that changes in your environment do not also change the test conditions.
Best for: Users who have configured scenes and understand their triggers and effects.
If access works in Proxy but fails in Config, return to Config and check the active configuration and matching policies. Focus on where the rules send the request. Do not immediately change the server password: both tests may use exactly the same server authentication details.
4. Run Connectivity Test, then check real-world access
In Home, find and tap Connectivity Test. Wait for it to finish, then check the result beside the server. The test can help assess reachability or response under the current network conditions. What it tells you depends on the test method and target; a result in milliseconds is not the same as the time it takes to load a complete webpage.
Some tests can run even when the VPN is disconnected. A Connectivity Test result and a successfully established VPN connection from the Home switch are two separate states to verify. After testing multiple servers, check the selection indicator again; do not assume the test automatically selects a new default server.
| What you see | What it tells you | Next step |
|---|---|---|
| A response time appears | The test received a response, but that does not mean every request will succeed. | Select the same server, confirm the VPN status, then open the page you actually need to use. |
| The test times out or fails | No expected response was received under the current test conditions. | Keep the settings unchanged, switch networks, and test again. Check the test target and server reachability. |
| Test succeeds, webpage fails | The test route may differ from the route used by real traffic. | Check Global Routing, rule policies, DNS, and server authentication details. |
| Webpage works, but one app fails | The issue may involve a specific domain, protocol, or the app’s own network state. | Check the policy applied to the failed request. Do not treat the result from one app as a verdict on the entire server route. |
Basic verification checklist
- In Home, confirm that the selected indicator is still beside the server you want to use.
- Confirm that the connection is stable, then run Connectivity Test and note the result.
- Open a known-working HTTPS page that should use the proxy route. Check that the page content loads, not just a cached title.
- Test the app you actually plan to use. If you use Config, check the request record to confirm which policy handled the request.
Regular HTTPS websites commonly use TCP port 443, but the proxy server’s port is determined by your existing service configuration. These are separate settings: a website using port 443 does not mean you should change the server port to 443. Protocols such as Hysteria2 use UDP, which must be allowed by the network. A successful webpage test alone does not confirm that the UDP route works.
5. Troubleshoot by symptom; change one thing at a time
Keep the server, routing mode, and test target the same while troubleshooting, and change only one condition at a time. First determine whether the switch will not stay connected or whether the connection is established but requests fail. These symptoms call for different checks.
Troubleshooting steps for each symptom
The connection switch will not stay on
- Confirm that you granted system permission for the VPN configuration.
- Check the connection error in Home and keep the original message.
- Check whether another active VPN connection is interfering with the test.
- Verify the server address, port, and required protocol settings.
Connected, but requests fail
- Confirm that the selected server is the one you intended to use.
- Check Global Routing; if needed, compare Proxy with Config.
- Test DNS resolution, the test target, and the actual webpage separately.
- Test on another network to distinguish a local network issue from a server route issue.
Record the original settings, then change one item. If that does not help, restore it before trying anything else.
If the test times out on Wi-Fi but works on cellular, that only shows the results differ between the two network environments; it does not prove the server is broken. After switching networks, wait for the connection to stabilize, then retry with the same server and test method. Cellular testing uses mobile data, so check your data usage conditions first.
If the problem started after a subscription update, check whether the previously selected server is still listed and whether its address, port, or authentication details changed. Updating a subscription refreshes the details; it does not confirm a successful connection. Do not share your full subscription URL, password, UUID, or other authentication details when reporting an issue. Include only the error type, network environment, and comparisons you have already tried.
6. Set up On Demand after verifying the first connection
Settings → On Demand lets you configure when to connect automatically; it is separate from manually turning on the connection switch in Home. During initial troubleshooting, automatic connections can make it difficult to diagnose behavior such as reconnecting after a manual disconnect. First verify the manual connection, then configure On Demand for your own trigger conditions.
- Keep the server and configuration that you verified as working, and note which Global Routing mode worked.
- Go to Settings → On Demand. Review the current conditions before deciding whether to enable it; enabling On Demand does not fix timeouts.
- After changing the settings, check how the connection behaves on Wi-Fi and when switching to cellular.
- When you need to stop the connection, check both the Home switch and On Demand settings. Do not rely on observing a single manual disconnect.
A successful first connection means more than seeing a VPN indicator: the intended server is selected, the system connection is stable, the test result is understandable, and real requests follow the current policy. If problems occur later, retrace these steps in order; this is more useful than repeatedly importing the entire configuration. For details on rule matching and policy behavior, see the Rule Manual.