A rule-based proxy client for iPhone / iPad. Learn how to verify the official App Store listing, import an existing subscription, and test rule-based routing.
First, distinguish server details, configuration files, and the connection switch: server details determine where to connect, configuration files describe how requests are routed, and the Home switch controls whether the connection is enabled. The six capabilities below are organized by task. Rule snippets illustrate syntax only; they are not ready-to-use connection configurations.
To choose how traffic is handled based on its destination, select Config under Global Routing and check which configuration is active. Rules are evaluated in order, and the policy for the first match is applied: PROXY sends traffic through the selected proxy, DIRECT connects directly, and REJECT blocks the request. Start with specific domain or address conditions, then add broader rules, and put FINAL last. Keep a working copy before making changes, adjust one item at a time, and verify the result with an actual request.
See the tutorial →[Rule]
DOMAIN-SUFFIX,example.com,PROXY
DOMAIN,example.org,DIRECT
DOMAIN,blocked.example.com,REJECT
FINAL,DIRECTOn Demand starts connections when specified conditions are met; review its options in Settings. Enable it only after manual connections are stable. First identify which network situations should trigger automatic connections and confirm that behavior after switching networks. On Demand is separate from the current connection status shown on Home, and it does not verify server availability. If the connection comes back on after you turn it off, check the On Demand conditions first. To investigate battery use, compare usage under similar conditions in the system battery settings.
See the tutorial →[General]
bypass-system = trueThis is a standalone General syntax example, not the On Demand setting. Configure on-demand connections in Settings.
When adding a server, choose the matching protocol under Type in Add Server, such as Shadowsocks, VMess, VLESS, Trojan, Hysteria2, or WireGuard. Each protocol uses different authentication and transport fields; changing only the protocol name while keeping all other parameters may not work. Check Host, Port, and the relevant authentication details. Keep TLS and any additional transport settings consistent as well. The protocol name alone says nothing about connection quality; test connectivity on your current network.
See the tutorial →[Rule]
DOMAIN,example.com,PROXYRules specify how traffic is handled; configure the protocol and authentication parameters separately in the server settings.
These steps assume you already have your own subscription or server details. First identify whether the content is a server subscription, a link for a single server, or a configuration file URL. Each import method accepts different content, so don't judge by how a link looks. Import it using the appropriate entry point, such as Subscribe, then check the list and any groups before selecting a server. After an update, verify your selection again if the entries have changed. Links may contain personal credentials, so don't share them in full when troubleshooting. Successful import does not confirm that the connection works.
See the tutorial →[Rule]
DOMAIN-SUFFIX,example.com,PROXY
FINAL,DIRECTThis is a routing configuration snippet, not a subscription URL, and it contains no server details.
Use Config to manage configuration files. Common sections include General, Rule, Host, and URL Rewrite. A file appearing in the list does not mean it is the active configuration; after editing and saving, check that it is selected and review the Global Routing mode. Save a copy of the existing contents before changing rules, and avoid making many changes at once. If you use iCloud sync, check that syncing has finished on each device. Syncing configurations and restoring an app purchase are separate processes; keep important configurations backed up separately.
See the tutorial →[General]
bypass-system = true
[Rule]
DOMAIN-SUFFIX,example.com,PROXY
FINAL,DIRECTFor your first connection, use Connectivity Test on Home to check the selected server, then see whether actual access behaves as expected. Test results apply only to the test target and network conditions at that time; they do not verify access for every app. Data can help you observe traffic changes, but traffic counts alone do not prove connectivity. If the test succeeds but a particular request fails, check Global Routing, rule matches, and DNS. Before sharing information collected in Settings > Diagnostics, redact subscription URLs and credentials.
See the tutorial →[Rule]
DOMAIN,example.com,DIRECT
FINAL,PROXYUse specific match conditions to understand policy differences; don't overwrite a working configuration with an example.
The App Store is the only place to get Shadowrocket. First verify the product listing, then check whether your device meets the compatibility requirements. Refer to the App Store listing for system requirements. App purchase, importing server details, and authorizing the system VPN configuration are three separate steps. After purchasing, you still need to configure your existing connection details.
After verifying the listing and purchasing Shadowrocket on the App Store, open the app and import your own server details. When you enable a connection for the first time, the system may ask for permission to add a VPN configuration. Confirm that the request was initiated by the app before allowing it. Authorization only permits the system to establish a connection; you still need to select a server and test it.
Use the Apple Account you used to purchase the app to check your purchases, then confirm the status shown in the store. Purchase availability for iPhone and iPad depends on the App Store listing. The layout may differ on larger screens; look for Home, Config, and Settings to find the relevant controls. Owning the app does not automatically add server details or restore all local configurations.
Shadowrocket is also available through the same App Store on Mac and Apple TV; check the listing for compatibility details.
See the getting started steps →Get one verifiable connection working before adding routing rules or automatic connection conditions. The steps below preview the full tutorial. If something fails, pause and check the inputs and status at that step; this is more effective than repeatedly toggling every switch.
For a single server, start with Add Server. Check what a QR code contains before using Scan QR Code. For an existing subscription, choose the appropriate import method in the tutorial; manage configuration file URLs in Config. After importing, return to Home, check the SERVER list, and select the entry you want to connect to.
An empty list, missing fields, and authentication errors are different issues. First identify the type of content you imported, then check Host, Port, and authentication fields. Don't post a full subscription URL publicly.
The available modes are Config, Proxy, and Direct. Config routes traffic according to the active configuration's rules; Proxy uses the proxy mode; Direct connects directly. Understand the difference before choosing a mode. Selecting a server does not mean every request will use it.
When using Config, also check which configuration file is active. A DIRECT or REJECT rule may explain why a request didn't go through the proxy; the connection switch alone doesn't tell you how a rule handled it.
Turn on the connection switch on Home and follow the system prompts to authorize the VPN configuration. Then use Connectivity Test to check the selected entry. Test a real destination you need to access as well, and see whether the result matches the current mode and rules.
If the test fails, note whether authorization is incomplete, the test timed out, or only one destination is affected. Leave other settings unchanged and check one thing at a time. Retest after switching networks; don't assume a previous result reflects the current connection.
Shadowrocket is a closed-source commercial app, and this is its official website and manual. Use the App Store product page to verify the product identity, purchase status, and compatibility. This manual explains the steps to follow; a connection test does not replace store information, and purchasing the app does not include a network service.
On the product page, first check the name Shadowrocket, then verify the developer, Shadow Launch Technology Limited, the official icon matching the one in this site's header, and id932747118 in the product URL. Don't identify the app by a similar name in search results alone. Confirm all three details point to the same product before purchasing.
The official icon helps identify the app; it does not indicate connectivity or service quality. For feature details, compatibility, and purchase information, refer to the same App Store product page rather than treating a single app screenshot as the full product description.
Whether the product page shows a purchase button depends on the current storefront and account eligibility. If the page is unavailable or shows an unexpected status, check the App Store account you're signed in to, the storefront, and device compatibility. Each storefront displays prices in its local currency; the amount charged is shown on the store page when you confirm the purchase.
Don't assume the device is faulty just because you can't find the product in search. A price you saw on another device may not be the current purchase price. Refer to the App Store listing for system requirements, purchase availability, and store details.
The US storefront lists the app at around $2.99 as a one-time purchase. Check the App Store listing to confirm whether one purchase covers both iPhone and iPad. If you reinstall the app or switch devices, use the original purchase account to check your purchases first. If a purchase prompt still appears, verify the account and purchase history before trying again.
Restoring the app and restoring configurations are separate tasks. After reinstalling the app, whether local server details and configuration files remain depends on your previous backups and sync settings. App Store manages updates; keep important configurations safe before updating, then check the selected server and active configuration afterward.
Purchasing Shadowrocket does not include a server or subscription. The tutorials assume you already have your own subscription or server details; this site does not provide, sell, or recommend servers or subscriptions. The app reads configuration details, establishes connections, and applies rules. You must verify the availability of the network service separately.
If a connection fails, check the app settings, current network, and existing server status separately. A completed purchase doesn't prove a connection works, and seeing a server in the list doesn't prove authentication succeeded. Import and select a server first, run Connectivity Test, then verify the destination request.
See how to verify the App Store listing → Read the rules and configuration guide →
Once the basic connection works, explore articles by topic: protocol guides explain transport requirements, configuration guides describe file sections, and battery guides help you review automatic connection behavior. After each change, retest under the same conditions so you can compare results.
Learn how Hysteria2 uses QUIC / UDP transport and congestion control, and how it behaves on networks with high packet loss, high latency, or UDP restrictions. Choose a protocol based on tests on your actual network, not its name alone.
Read the article →Learn what General, Rule, Host, and URL Rewrite sections do, including global parameters, request routing, local mappings, and rewrites. Understand section names and match scope before combining the snippets you need in your own configuration.
Read the article →Start with system battery usage, then check On Demand conditions and behavior when switching networks. Track connection time, actual traffic, and usage scenarios separately before deciding when to keep on-demand connections enabled.
Read the article →