Shadowrocket Subscription Import and Connection Guide

Step 01 / Build Your Server List

Add Server: Add a Server or Import a Subscription

Open Shadowrocket and go to Home. The list may be empty the first time you use the app. That means connection details haven't been imported yet; it does not mean installation failed. First, identify what you have: a subscription URL that can update a list of servers, a share link for one server, or configuration details including an address, port, and authentication information. Each requires a different import method. Don't enter a subscription URL as a server address.

Have a Subscription URL? Use Subscribe

On Home, tap the add button in the upper-right corner to open Add Server. Go to Type and select Subscribe. On the entry screen, paste the full subscription URL into URL, enter a recognizable name in Remarks, and save. Check for spaces, line breaks, or extra text before and after pasting. Keep any query parameters in the URL; don't copy only the domain.

After saving, return to Home and wait for the subscription to load. Check that a subscription group and its server entries appear. If you see a subscription name but no selectable servers, check the load result instead of adding the same URL again. Subscription URLs often contain access credentials, so treat them like passwords. When describing a problem, don't share the full URL or a QR code that contains credentials.

Have Details for One Server? Enter or Import Them

If you have server details, select the protocol in Add Server that matches the original instructions, then enter the server address, port, and authentication fields. Don't guess the protocol from its name or replace the domain with a resolved IP address; some connections rely on the original domain and related TLS settings. Compare transport, path, and other optional fields with the details from your provider. Don't fill in fields they haven't specified.

If you have a QR code, use Scan QR Code and grant camera access when prompted. For a share link, follow the clipboard import prompt if one appears. If it doesn't, make sure you copied the complete share content, not the webpage title. After scanning or pasting, check the entry type and address. Successful import only means the app recognized the details; it doesn't confirm that the server is working.

Finally, tap the server you want to use on Home and confirm it is selected. Choose one server to complete the connection test; there's no need to reorder the entire list yet. For subscription updates, duplicate entries, and backups, see the Subscription and Server Management Manual. Next, continue to Global Routing.

Done when: Home shows at least one selectable server, and you have selected one.

Step 02 / Choose How Traffic Is Routed

Global Routing: Choose Config, Proxy, or Direct

The server determines which connection endpoint to use; Global Routing determines which connections use it. Open Global Routing on Home and identify the three modes: Config, Proxy, and Direct. Seeing a server in the list—or even an active connection switch—doesn't mean every request is going through that server. The selected routing mode also determines where traffic goes.

Config: Apply Rules from the Active Configuration

Config handles requests according to the rules in the active configuration. Traffic matching DIRECT connects directly; traffic matching PROXY uses the corresponding proxy policy. Before using it, open Config, confirm which configuration is active, and understand its basic purpose. Importing a subscription does not necessarily import a complete rule configuration. A subscription group appearing on Home does not mean Config has changed.

If you already have a trusted configuration that suits your needs, use Config for everyday connections. Don't replace the entire configuration just to complete the first connection. A configuration may also include DNS and policy groups, so changing it can introduce more variables when troubleshooting. You don't need to learn every rule now. Note the current configuration name so you can restore it later.

Proxy and Direct: Modes for Comparison

Proxy routes traffic handled by the app through a proxy path. It can help you check whether the selected server allows actual access, but it doesn't mean every type of device communication uses that path. Direct sends handled traffic straight to its destination and can serve as a baseline network comparison. It is not a more stable proxy mode and does not forward these requests through the selected server.

If you're unsure whether rules are affecting your first test, note the current selection, temporarily choose Proxy and try accessing a page, then restore Config and repeat the same test. If the results differ, check the configuration and policies before deleting a server. Whichever mode you choose, return to Home afterward and continue to the connection switch.

Done when: You can explain which mode is selected and what it does, and you know which mode to restore after a temporary test.

Step 03 / Establish the System Connection

Home: Turn On the Connection and Approve the First VPN Prompt

Return to Home and check the selected server and Global Routing again. Make sure you haven't selected a different server while browsing the list, then turn on the connection switch at the top. When connecting for the first time, iOS may ask Shadowrocket to add a VPN configuration. This system authorization lets the app handle relevant network traffic; it is not a request to buy the app again or proof that a subscription is active.

Check that Shadowrocket is the app requesting authorization. Review the prompt, allow the VPN configuration to be added, and complete any authentication required by your device. If you cancel or deny the request, the app may not be able to connect. Return to Home and try again, following the system prompts. If your device is managed by an organization or has restrictions, permissions may be controlled by its management policy. Check those restrictions first rather than repeatedly resetting the configuration.

After authorization, return to the app and check that the switch and connection status remain on. A VPN indicator in the status bar or Control Center can help confirm that the system connection is established, though its location varies by device. A connected VPN does not mean the remote server, DNS, and target website are all working; test actual access next.

During your first test, don't enable or adjust On Demand. Automatic connection conditions may trigger another connection after you disconnect manually, making it hard to compare results. If you've already set up automatic connection conditions, note them and temporarily stop automatic triggers until you understand how they work. Disconnect any other VPN connection in use on the device to avoid competing connection states.

If the switch turns off immediately, note the system prompt and any error shown in the app, then go to Troubleshooting to check authorization and configuration. Don't toggle the switch repeatedly. If it stays on, keep the current state and continue to testing. To end the connection, turn off the switch on Home and check the system connection status. If it reconnects automatically, review your On Demand conditions.

Done when: System authorization is complete and the connection stays on. Next, test actual requests—not just the switch.

Step 04 / Verify with Real Requests

Connectivity Test: Check Latency and Page Access Separately

First, confirm that your Wi-Fi or cellular connection is working. If you still need to sign in to a captive portal or your network is otherwise offline, complete sign-in and restore connectivity before testing Shadowrocket. Otherwise, subscription loading, latency tests, and webpages may all fail together, making a server configuration issue seem more likely than it is.

On Home, run Connectivity Test for the imported server and wait for the test to finish. The result can provide an initial check of reachability and response time, but different test methods don't all check the same things. A latency result doesn't prove that authentication, DNS, rules, or access to your target website are working. If there is no result, consider the test method and network conditions rather than deleting the entry based on one attempt.

Next, open Safari and visit an HTTPS page you can access and normally use. Wait for it to load, then open another page on the same site so a cached page isn't mistaken for a successful connection. If you need the connection for a particular app, open that app and test the relevant task too. Browser access only confirms that the browser request worked; it doesn't replace testing in the app itself.

When using Config, a page opening doesn't prove that it went through a proxy; its domain may match DIRECT. To check the route, look in the app's request records or logs for the target domain and see whether the request follows the active configuration's policy. Check only the information you need on your own device. Logs may include visited domains, so don't publish them in full.

For a useful comparison, change only one condition at a time. For example, keep the network, server, and test page the same, temporarily switch from Config to Proxy, reload the same page, and then restore the original mode. If Proxy works but Config doesn't, focus on rules, policy selection, and DNS. If both fail, continue checking the server and network.

After testing, keep one confirmed working server and the current configuration as your baseline. You can repeat the same page test after changing servers, updating a subscription, or editing rules. Don't choose a server based only on the lowest latency; stable access and successful completion of the intended task are what matter.

Done when: The test page loads, the intended task works, and traffic follows the expected route for the current Global Routing mode.

Step 05 / Narrow Down the Problem by Stage

Shadowrocket Won't Connect? Find the Step That Failed

When something fails, first note which step didn't meet its completion criteria, then check the items below in order. A failed import, a switch that won't stay on, and a webpage that won't load are different problems with different fixes. Keep the current configuration and original connection details. Change one thing at a time and repeat the same test so you can tell whether the change helped.

No Servers in the Subscription, or They Still Don't Work After an Update

Check the subscription details and confirm the URL is complete, including trailing parameters, letter case, and any spaces introduced while pasting. Make sure your current network can reach the subscription URL, then try updating the existing subscription instead of creating multiple groups. If the response is an account sign-in page, an information page, or other unrecognized content, the app can't generate the server list as expected.

Ask your provider about subscription access, validity, and server availability. When reporting an issue, include the error text, the step where it occurred, and only the necessary redacted details. Don't post a full subscription URL on a public webpage or in a chat screenshot. For more on updates and organization, see how to update a subscription.

The Entry Is There, but the Test Fails or the Connection Drops

First, check which server is selected, then verify the protocol, address, port, and authentication details. For manually entered entries, pay particular attention to TLS and transport fields. Connection settings must match; a correct address and port alone may not be enough. If your provider has changed the details, update them using the latest valid information rather than just renaming the entry.

If system authorization hasn't been completed or the switch turns off immediately, follow the permission prompt shown on your device. If the connection stays on but requests fail, test another server you already have while keeping the same network and test page. Switching several servers while changing DNS and rules at the same time makes the results hard to compare.

Latency Looks Normal, but Webpages Won't Load

First, check whether Direct is selected when you expected another routing mode. Then compare Config and Proxy as described above. If only Config fails, check the active configuration and relevant rules. If neither mode works, continue checking server capabilities, the underlying network, and DNS. Testing another page that normally works can help distinguish a problem with one website from a broader access issue.

DNS resolves domain names to addresses, and a successful latency test doesn't prove that every domain resolves. Save your configuration first and check whether you've changed settings such as dns-server. Don't enter an unfamiliar address at random. Restore a previously tested working setting where possible, then repeat the request. For a detailed sequence of checks, see how to troubleshoot DNS when latency is normal but webpages won't load.

Restore Your Everyday Settings After Troubleshooting

Once the same page works consistently on the same network and server, restore your usual Global Routing mode and make sure a temporary test hasn't left Proxy or Direct selected. If you need On Demand, configure its trigger conditions separately and test them. Next, see the Subscription and Server Management Manual for help organizing groups, updates, and backups. You don't need to change every advanced option during your first connection.

Done when: You can identify the failure stage, what you checked, and the results of retesting—not just that the switch is on.