The official Shadowrocket manual for iPhone / iPad. Verify the one-time purchase on the App Store, then import your existing information and check your connection with rule-based routing.
Shadowrocket is available exclusively on Apple platforms, and the App Store is the only place to get it. Before purchasing and setting it up, check device compatibility, your current App Store account, and the app’s identity.
Find Shadowrocket on the App Store and verify the developer and app ID before purchasing. On first launch, get familiar with Home, Global Routing, and Add Server. Have your own subscription or server details ready before connecting. Check the App Store listing for system requirements.
View the iPhone guide →If you already purchased Shadowrocket with the same Apple ID, first look for it in your App Store purchase history. Check the App Store listing for universal purchase terms, compatible devices, and system requirements for iPhone and iPad. After restoring the app, check your configuration and connection details separately.
View the iPad guide →A similar app name does not confirm that it is the same app. On the product page, check the official icon, the developer, Shadow Launch Technology Limited, and app ID 932747118 in the link. The App Store button below opens this product page. Opening the page does not complete a purchase; review the price and compatibility shown in your storefront before paying.
If you can’t find the app, first check the account currently used for App Store purchases and its country or region. Don’t infer the storefront from your device language alone. The storefront path in a product link may not match the purchase region of your current account. App availability, purchase eligibility, and payment prompts depend on the App Store page shown to your account.
The VPN configuration permission prompt shown when you connect for the first time is a system confirmation that allows the app to create a network connection configuration. Read and respond to the prompt after confirming that the action was initiated by Shadowrocket. Granting permission only allows the system configuration to be created; it does not confirm that server details, subscription status, or rules are correct. Follow the setup guide to check those separately.
First, distinguish connection details, Global Routing, and configuration files. The server determines the connection destination, the routing mode determines how traffic is handled, and rules determine the policy for each request.
Rule-based routing selects how different requests are handled. Set Global Routing to Config on Home, then check which configuration is active in Config. Rules are usually matched from top to bottom; when a condition matches, its policy applies. Put specific conditions before broader ones, and place FINAL at the end as a fallback. PROXY, DIRECT, and REJECT are policy keywords, not server addresses. Save a copy before editing, change one thing at a time, then check which rule matches the actual request. The example.com snippet below illustrates syntax only; it is not a complete working configuration.
DOMAIN-SUFFIX,example.com,PROXY
IP-CIDR,192.168.0.0/16,DIRECT
FINAL,DIRECTOn Demand triggers connections under specified network conditions; it does not replace server configuration. Find On Demand in Settings, decide which Wi-Fi, cellular, or domain conditions should trigger a connection, then check each condition for overlap. Start with one clear condition. Change networks and observe the connection status; add other conditions only after confirming the result. If the app reconnects after you turn the connection off manually, check On Demand before deleting a configuration. Automatic connection and rule-based routing are separate: the first determines when to connect, while the second determines how requests are handled after connecting.
Settings → On Demand
Wi-Fi / Cellular / Domain
Connection trigger conditions ≠ Rule matching conditionsShadowrocket supports protocols including Shadowsocks, VMess, VLESS, Trojan, Hysteria2, and WireGuard. To use your own existing server details, select the correct Type in Add Server, then enter the Host, Port, and authentication details for that protocol. Fields differ by protocol; TLS, transport, and certificate options should also match the server. Don’t guess by repeatedly changing Type. Check each field against your existing configuration. Saving an entry only confirms that the input was accepted, not that the remote connection works. Verify it with a test and by checking actual access.
Add Server
Type → Host → Port
Trojan / Hysteria2 / WireGuardUse Subscribe to manage subscription entries you already have. Before importing, check that the address is complete and preserve any required parameters. Avoid copying extra spaces, line breaks, or explanatory text. After importing, confirm that the expected server entries appear, then select one and test the connection. Updating a subscription refreshes the remote list; it does not fix an unavailable service, authentication errors, or every local rule issue. Before deleting or replacing entries, identify which came from a subscription and which you added manually. Subscription URLs may contain access credentials, so don’t include the full address in screenshots or public records when troubleshooting.
Add Server → Type → Subscribe
Import existing URL → Update entries → Select a server
Subscription list ≠ Rule configuration fileConfiguration files organize settings such as General, Rule, and Hosts. Keep them distinct from the server list. After importing or editing a file in Config, confirm which configuration is selected and whether Global Routing is set to Config. A file saved in the list is not necessarily being used to process requests. Before changing DNS or rules, keep a recoverable copy and note what you changed and what you expect to happen. If you use iCloud sync, check the system iCloud settings, the relevant in-app options, and the actual contents on the other device separately. Sync is not a complete backup or proof that a connection works.
[General]
bypass-system = true
dns-server = system
[Rule]
FINAL,DIRECTIf a connection fails, first confirm that the device itself has a working internet connection. Then check the selected server, Connectivity Test, and the test method in use. A test result only reflects reachability using that method; it does not establish that all requests will work. Next, check protocol parameters, TLS settings, system time, and Global Routing. If needed, review Diagnostics in Settings. Data traffic statistics can help you monitor usage, but they are not server billing records and cannot prove that rules are correct. Change one variable at a time and record the failure and test conditions so you can compare results.
Connectivity Test
Settings → Diagnostics
Network → Parameters → Global Routing → Actual requestConfig handles requests according to the active configuration’s rules. Proxy routes requests through a proxy, while Direct connects without one. For everyday rule-based routing, first check Config and the configuration file in use. Switching modes temporarily can help narrow down an issue, but compare the results under the same test conditions. One successful visit does not prove that every rule is correct.
Before troubleshooting, note the current server, routing mode, and configuration name. If a request works under Proxy but behaves differently under Config, first check the matching rule, its policy target, and DNS-related settings. If the connection itself fails, start with the server details and basic network connection. When you’re done, restore the intended mode so temporary settings don’t affect later use.
Compare Config, Proxy, and Direct →Shadowrocket is a closed-source commercial app. Use its App Store product page to verify the app’s identity, price, compatibility, and purchase terms. Follow the options currently shown in the app for in-app steps.
The official icon, developer name, and app ID should all match. Don’t rely only on the name in search results or the icon’s colors. Open the product page, check the developer, and then verify the numeric ID in the product link.
App Store search results and app availability can vary by the country or region associated with an account. A device set to Chinese does not identify the account’s storefront. A product page opened in a browser may also differ from the storefront used by the account on the device. If the app doesn’t appear or the page says it’s unavailable, read the App Store message, check the current purchase account and its country or region, then consult the relevant section of the authenticity guide.
Don’t assume the app is no longer available just because it doesn’t appear in search, and don’t assume that seeing the page in a browser means you can purchase it on your device. Check separately whether the product page is visible, the purchase button is available, and the device meets the compatibility requirements. If the identity details differ from the three checks on this page, stop the purchase and return to the correct product page to verify it.
The U.S. storefront reference price is $2.99 as a one-time purchase. Other storefronts show local currency; check the App Store page for the actual price and purchase terms. The purchase is tied to the Apple ID used to pay. If you switch devices later, first check that you’re signed in to that account. Don’t treat the reference price as fixed worldwide or infer your current account’s purchase status from what appears on another device.
Check the validity period of an existing subscription, server authentication, and server status separately from the app purchase. The app opening normally does not mean the remote service is still available; a failed connection to a remote entry does not mean you need to buy the app again. First identify whether the issue is with the store purchase, app configuration, or remote connection, then follow the relevant troubleshooting steps to avoid changing unrelated settings.
After switching devices or reinstalling the app, sign in to the original purchase account and look for Shadowrocket in your App Store purchase history. If you see a price instead of the expected redownload option, first check that you’re using the correct account for Media & Purchases. Don’t pay again without checking. Purchase records, regional availability, and device compatibility can all affect what appears; follow the system prompts and App Store records.
Restoring the app and restoring its configuration are separate tasks. After restoring the app, check the server list, selected configuration, Global Routing, and On Demand one by one. If you use iCloud features, confirm that the synced content actually appears. Seeing the app icon does not mean all your previous settings have been restored. For Family Sharing, check the product page and family settings for the applicable terms; don’t assume that restoring with the same account and use by family members are the same thing.
Get and update Shadowrocket through the App Store. Check automatic update options in your system’s App Store settings, and view update history on the app’s product page. This manual does not list specific version numbers or update dates. If labels or navigation differ slightly, follow the options currently shown in the app. First identify the relevant screen, then look for the same action.
Before making important configuration changes, save a copy of the current working configuration and note the selected server and routing mode. After an update or device change, first verify a connection under known conditions, then restore automatic connection and other settings gradually. This makes it easier to tell whether a difference comes from imported details, rule selection, or a change in network conditions—rather than losing the comparison by changing several things at once.
Read the complete guide to getting Shadowrocket from the App Store →
First identify which step you’re stuck on, then open the relevant guide. Expand any answer below to read it.
Purchasing only gets you the client. To connect, you also need your own subscription or server details and must select the correct server, Global Routing mode, and configuration. First check for an available entry on Home, then verify its settings and the system VPN configuration permission. Completing the purchase does not complete the connection setup.
Subscription entries and rule configurations serve different purposes. A subscription typically manages server details, while the configuration in Config determines how rules handle requests. For rule-based routing, confirm that Global Routing is set to Config and check which configuration is selected. A successful subscription update alone does not mean the rules are active.
A test and an actual request may use different destinations and handling conditions. Interpret the result in light of the test method, and also check the rule matching the request, DNS, TLS, and the selected server. Reproduce the issue on the same network and change one setting at a time before comparing results. A successful reachability test does not mean every request will work.
First check whether On Demand is enabled and whether the current Wi-Fi, cellular, or domain conditions still apply. Automatic connection and the manual switch can both affect the current state. Note when the connection is triggered, change one condition, and observe the result. Don’t immediately delete the server or the entire configuration file.
Once you’ve completed the basic setup, continue with the guide that matches your issue. Note what happened and your current settings first, then follow the guide’s troubleshooting sequence. Avoid applying fixes for different problems all at once.
Start with the syntax for DOMAIN-SUFFIX and IP-CIDR conditions, then check rule order and the uses of PROXY, DIRECT, and REJECT. Learn how to troubleshoot requests that don’t follow the expected policy, and where to place FINAL for clarity and easier maintenance.
Read the rules guide →Compare how the three modes handle traffic and learn why rule-based routing requires checking Config. This guide explains how temporarily switching modes can help with troubleshooting and which settings to restore afterward, so you don’t mistake a temporary test state for your everyday setup.
Read the routing guide →First check the basic network and test conditions, then review protocol settings, TLS, and system time. Follow a consistent sequence to distinguish a failed test, a failed connection, and failed access for actual requests—without repeatedly changing multiple settings.
Read the troubleshooting checklist →