Shadowrocket FAQ: 10 Setup Questions About Global Routing, Subscription Updates, and Restoring Purchases

1. The connection toggle does nothing. What should I check first?

To connect for the first time, you need an available server entry, a clearly selected default server, and permission from the system to add a VPN configuration. The toggle on Home starts a connection; it does not create a server automatically. If the list is empty, import a subscription you already have. If there are entries, make sure you selected a server rather than just expanding a subscription group.

1. Check the server entry

   Open Home and confirm a server is listed. Its address, port, and authentication details should come from a configuration you already have.

2. Select a server

   Tap the dot to the left of a server to set it as the default. Note its name so you can confirm which server you test later.

3. Turn on the connection

   Turn on the connection toggle on Home. When the system first asks to add a VPN configuration, review the prompt, allow it, and complete any device verification required.

4. Run a test

   Return to Home and run Connectivity Test, then visit the webpage you need to use. Record each result separately.

If system permission was revoked, return to the app and start the connection again. If the toggle turns on briefly and then switches off, first check the system VPN status and any error shown in the app. Avoid repeatedly deleting all configurations; doing so makes it harder to identify where the failure occurs.

2. Which Global Routing mode should I use: Proxy, Direct, Config, or Scene?

Global Routing determines how traffic is routed; it is separate from the server list. For rule-based routing, first confirm the active configuration file in Config, then go to Home → Global Routing and select Config. To check whether a server is reachable, you can temporarily use Proxy for comparison, then restore your original setting.

If only some sites fail in Config but the same sites work in Proxy, check which rules match and which policies are selected before concluding that the server is down. Scene does not mean “automatically find the fastest server.” Don’t use it as a troubleshooting baseline until you’ve checked the scene conditions and associated settings.

3. Why won’t webpages load even though the VPN is connected?

A system VPN status of Connected only means the tunnel is running. It does not confirm that remote authentication succeeded, DNS is resolving correctly, or the destination is reachable. A successful Connectivity Test applies only to its test target and the network conditions at that moment; it does not verify access for every service you use.

• Check your local network first: Turn off the connection temporarily and make sure Wi-Fi or cellular data works on its own. Complete any sign-in required by the Wi-Fi network.
• Check the selected server: Return to Home and confirm the default server is still the one you expect. A subscription refresh may have changed the entries.
• Compare routing modes: Note your current Global Routing setting, then retry the same destination with Proxy. Don’t change DNS and multiple rules at the same time.
• Identify the scope of the failure: If every destination fails, check the endpoint, authentication, and service status. If only one domain fails, check its rules, DNS resolution, and the website’s own status.

For example, “the test returns a result, but one webpage keeps loading” and “every test times out” are different symptoms. The first calls for checking the destination connection; the second means you should first confirm the server is still valid. Logs and screenshots may contain addresses, UUIDs, or subscription credentials. Redact them before sharing troubleshooting materials.

4. Where do I add an existing subscription?

A subscription is an address used to retrieve server entries, not an ordinary webpage URL or proof of purchase for the app. Enter the full subscription link you already have, preserving its path, query parameters, and letter case. When copying it from a messaging app, check for added spaces, line breaks, or punctuation.

1. Open Home, tap “+” in the top-right corner, and select Subscribe under Type.
2. Paste your existing subscription URL into URL, add a note to help identify it, and save.
3. Return to Home, pull down to refresh, wait for the request to finish, and check whether servers appear in the group.
4. Select a server, then follow the first-connection steps to authorize, connect, and test.

Importing a subscription and connecting successfully are two separate checks. Seeing entries means the app retrieved and recognized the content; it does not mean every server is reachable on your current network. This site does not provide, sell, or recommend servers or subscriptions; it only explains how to use configurations you already have.

5. Subscription update failed, timed out, or changed nothing. What should I do?

A subscription update first sends a request to retrieve content, then parses the response. A request timeout, invalid authentication, and an unreadable response each require a different fix. Note the exact error first, then determine whether the issue is the network path or the subscription itself. Don’t use repeated deletion as a substitute for checking the cause.

If you temporarily switch to proxy-based updates, note that setting so you can recognize the dependency if the server stops working and the subscription can no longer refresh. Don’t refresh repeatedly in quick succession. Check the result of one request before deciding what to do next.

Why does it reconnect after I turn it off? Is On Demand enabled?

On Demand triggers connection behavior based on network conditions. If it connects automatically after switching Wi-Fi networks or reconnects after you disconnect manually, check Settings → On Demand before deleting the system VPN configuration. Routing rules decide where traffic goes; On Demand decides when to connect. They operate at different levels.

If the issue stops when On Demand is off, adjust the automatic connection conditions rather than changing server authentication details. If it still reconnects, check for other system-managed settings and note the current state for further troubleshooting.

7. Can Config rule order affect which sites use a proxy?

Yes. Config routes connections according to the active configuration file’s rules, which are generally evaluated from top to bottom. An earlier match can affect whether later rules are considered. DOMAIN-SUFFIX matches domain suffixes, IP-CIDR matches IP ranges, GEOIP uses an IP geolocation database, and FINAL is the fallback when no earlier rule matches.

[Rule]
DOMAIN-SUFFIX,example.com,PROXY
IP-CIDR,192.168.0.0/16,DIRECT,no-resolve
GEOIP,CN,DIRECT
FINAL,PROXY

This example sends example.com and its subdomains to PROXY, routes the specified private IP range through DIRECT, then checks GEOIP, with FINAL as the fallback. It demonstrates rule syntax only; don’t replace your entire existing configuration with it. Also confirm that the policy names in your configuration are valid and that DNS and other settings still suit their original purpose.

• no-resolve means this IP rule won’t actively resolve a domain name when checking for a match; it can still match an IP range when the destination IP is already known.
• GEOIP checks the location associated with an IP address. It does not check a webpage’s language or where the website operator is based.
• Putting a broad match first may prevent more specific rules below it from matching.
• Before troubleshooting, back up the current configuration in Config. Then adjust one rule at a time, connect, and check where the target traffic actually goes.

Why does authentication fail when the server address and port are correct?

The address and port only identify the service endpoint. Type determines which protocol is used to communicate with it, and the authentication fields and transport settings must also match the existing server configuration. For example, port 443 does not automatically mean you should choose Trojan, nor does it tell you whether to enable TLS.

Recheck the original parameters instead of guessing the protocol or turning off certificate verification. TLS errors can also be caused by the device’s clock, certificate validity, or server name; ignoring verification is not a routine fix. If the settings came from a subscription, first make sure the update succeeded. That helps avoid repeatedly editing generated entries only to have them overwritten on refresh.

9. How do I restore my purchase and configuration on a new iPhone or iPad?

Your App Store purchase record and your Shadowrocket server configuration are separate types of data. Restoring the app with the Apple ID used to buy it does not transfer your servers, subscriptions, or rule files automatically. Before switching devices, check your purchase record and configuration backups separately, then verify the connection on the new device.

If the store still shows a price, first check the signed-in account, storefront region, and purchase record. Don’t rush to buy it again. If a server on your old device is no longer working, restoring the same configuration to a new device won’t make the service available again.

10. What else do I need after purchasing the app?

Shadowrocket is a closed-source commercial app distributed through the App Store on Apple platforms as a one-time purchase. Buying the app does not include a connection plan. The purchase gives you the right to use the app; it does not automatically provide a server, subscription, or service time. This guide assumes you already have your own service provider and subscription.

• Verify the app: The name is Shadowrocket, the developer is Shadow Launch Technology Limited, and the app ID is 932747118.
• Check device compatibility: The primary devices are iPhone and iPad. For Mac, Apple TV, and Apple Vision compatibility and system requirements, refer to the App Store listing.
• Check your configuration: Have your own subscription or server details ready, confirm the service is active, then choose Global Routing and a rules file.
• Record test results: Note the default server, routing mode, Connectivity Test results, and any destinations that fail. Use the same conditions when you test again.

Beginners can follow a consistent checklist: verify the local network, check the selected server, grant system permission, run a test, then review rules and automatic connection settings. This separates “the app didn’t start,” “the server is unreachable,” “traffic is routed incorrectly,” and “the subscription won’t update,” reducing interference from unrelated settings.