Shadowrocket First Connection: Select a Server, Connect, and Run Connectivity Test

At a Glance

This guide is for users who have installed Shadowrocket and have their own provider and subscription, but haven't connected yet. Follow these steps: import and select a server → check Global Routing → turn on the connection → run Connectivity Test → verify access. You'll learn to distinguish an imported server list, an active system VPN, and successful access to a website, then use the results to decide what to check next.

1. Import a Subscription and Select a Server in Home

A successful subscription import means Shadowrocket has retrieved and read the server details. It doesn't mean a connection has been established, or that every server in the list is usable. First, check that servers appear in Home, then select one explicitly. Seeing a list doesn't mean you're connected.

Import a Subscription

Go to Home → tap “+” in the top-right corner → Type → Subscribe. Enter your existing subscription URL and save it. Subscription URLs may contain credentials, so copy the full address from your provider account and never paste it into public comments or screenshots.
Check the Server List

Return to Home and confirm that servers appear under the subscription group. To refresh, pull down on the Home screen. If the list is still empty, check that the subscription is valid and returns server details. There's no need to keep toggling the connection switch.
Select a Server

Tap the dot to the left of the server you want to use to set it as the current default. Opening a server's edit screen to review its settings is separate from selecting it. Back in Home, confirm the selection indicator appears next to the intended server.
Check the Server Settings

For a server you added manually, check its Type, address, port, and authentication details. The port must match your server configuration. A common port such as 443 doesn't confirm that the protocol or authentication method is correct. For subscription servers, try refreshing the subscription rather than guessing at changes to the settings.

Use Home to select a server and manage the connection, Config to manage rule configurations, and Settings to adjust the app. For your first connection, establish a verifiable baseline in Home without changing DNS, rules, or auto-connect conditions at the same time. Change one variable at a time so you can identify what caused a difference.

2. Check Global Routing: Testing vs. Everyday Use

Global Routing determines how connections handled by Shadowrocket are routed. Selecting a server doesn't mean every request will use it. For initial troubleshooting, temporarily choose Proxy to reduce variables introduced by routing rules. After verification, choose Config if it suits your setup. The options below describe routing modes within Shadowrocket.

Proxy

Recommended

For an initial check, temporarily route traffic handled by Shadowrocket through the proxy policy to test the selected server's connection. This recommendation is for troubleshooting only; Proxy isn't necessarily the right choice for everyday use.

Use for: Verifying the first connection and ruling out routing rules as a factor.

Config

Routing follows the rules in the active configuration. Rules may specify DIRECT, REJECT, or a proxy policy, so check which rule matches to determine whether a request uses the selected server.

Use for: After confirming the connection works, when you're ready to use your rules as usual.

Direct

Uses a direct connection. A website loading in this mode doesn't prove the proxy server is working; your local network may already be able to reach it.

Use for: Comparing access over your local network.

Scene

Routing follows your configured scenes. If you aren't familiar with the scene conditions, don't rely on them during initial troubleshooting; changes in network conditions could also change the routing mode.

Use for: Users with clearly defined scene settings who can verify which conditions are active.

With Config, rules are generally matched in order. For example, DOMAIN-SUFFIX,example.com,DIRECT sends connections matching that domain suffix directly, while FINAL,PROXY sets the proxy policy for connections that didn't match an earlier rule. Don't assume a request uses the proxy just because that's the last rule; an earlier match may already determine the result.

3. Turn On the Connection and Approve the System Prompt

Return to Home and turn on the connection switch at the top. The first time, the system will ask to add a VPN configuration. Confirm the request was initiated by the Shadowrocket app you just opened, then follow the system prompts to allow it and complete any required authentication. This permission lets the app create a network tunnel; it doesn't authenticate your subscription or restore an unavailable server.

First Connection Checklist

Where to Go: Home → connection switch at the top
System Prompt: Allow the VPN configuration and complete system verification.
Check Back in Home: Make sure the switch in Home stays on instead of immediately turning off.
Test the Connection: Run Connectivity Test, then try accessing a website.

An active system VPN only confirms the tunnel status; it doesn't prove the remote server connection is working.

Check Auto-Connect

Where to Go: Settings → On Demand
What to Check: Whether any connection conditions are triggered on the current network.
Troubleshooting Step: Note the current settings, temporarily turn off On Demand, then connect manually.
When to Restore It: After manual connection and access tests both succeed.

On Demand controls when to connect; it doesn't fix server addresses, authentication details, or routing rules.

If you tapped “Don't Allow” by mistake, return to Home and try connecting again, then follow the system prompts. If the switch turns off immediately, check for an incomplete permission request or an error message, then see whether another VPN configuration is currently active in the system. Don't start by deleting all system network settings; that broadens the troubleshooting scope and may remove network information you need.

4. Run Connectivity Test, Then Check Real-World Access

Run Connectivity Test in Home to check the current server. Results depend on the test method, destination, and network. A valid response can indicate that the connection is reachable, but a single latency reading doesn't prove that every website, protocol, or routing rule will work.

Keep test conditions consistent. Note the selected server, Global Routing mode, and network type. Don't switch servers or Wi-Fi during a test; otherwise, you can't compare the results directly.
Wait for the test to finish. Distinguish a valid response from a timeout or error. Don't treat a test that's still in progress as a failure, or rely on an older result in the list to judge the connection you just made.
Revisit the site. Open a new browser tab and visit the website you need to use. Confirm that fresh content loads; seeing a previously cached page doesn't prove a new request succeeded.
Compare routing modes. If the site works in Proxy but fails in Config, first check the active configuration and matching rules. If it fails in both modes, check the server settings, network reachability, and DNS results.
Keep a working baseline. Record the server and network conditions that pass the test. Use them for comparison when changing rules or auto-connect settings. Avoid screenshots that show passwords or subscription tokens.

A common scenario: Connectivity Test responds, but a particular website won't load. That's not necessarily a contradiction: the test and website may use different destinations, and DNS resolution, website availability, or routing rules may differ. Conversely, a test may time out while some sites still load. Check the test method and destination before concluding that the entire connection has failed.

5. Compare Wi-Fi and Cellular Networks One Variable at a Time

The same server may behave differently on different networks. A Wi-Fi captive portal, local network restrictions, or cellular signal conditions can affect your first test. Keep the server and routing mode unchanged, switch only the network, then repeat Connectivity Test and the same access check.

Comparison Plan: Keep the Server Fixed and Switch Networks

On Wi-Fi

Complete any required captive portal sign-in first.
With the connection off, confirm that your local network can access everyday websites.
Open Shadowrocket and note whether Connectivity Test responds.
If it fails only on this network, keep the result for checking the network conditions.

On Cellular

On a device with cellular capability, turn off Wi-Fi.
Confirm that Shadowrocket is allowed to use cellular data.
Reconnect using the same server and Global Routing mode.
Repeat the same test. Don't change DNS or protocol settings at the same time.

If it fails on only one network, check that network's conditions first. If it fails on both, check that the server is valid and verify its address, port, and authentication details.

An iPad without cellular capability can be tested on another Wi-Fi network you're authorized to use. If the connection reconnects or disconnects automatically after switching networks, go to Settings → On Demand and check the conditions. Don't confuse auto-connect behavior with Global Routing: the former controls when a connection is established; the latter controls how traffic is routed once connected.

6. First-Connection FAQs and Next Steps

There are lots of servers. Does tapping a name select one?

Check the selection indicator to the left of the server in Home. Tapping a name or details button may open the edit screen; it doesn't necessarily change the default server. Return to the list, confirm the indicator, then turn on the connection. Don't infer the current selection from the list order.

The switch is on, so why can't I access anything?

First, run Home → Connectivity Test, then check that Global Routing is set as intended. If it's set to Config, temporarily switch to Proxy for comparison. If only Config fails, open Config and check the active file and rules. If both fail, check the server details and network conditions.

The subscription update failed. Should I reinstall the app?

First, make sure the subscription URL is complete and still valid, and check that your current network can reach it. If an existing server still works, connect first, then pull down to refresh in Home. Updating a subscription retrieves the server list; connecting to a server establishes the data connection. Troubleshoot them separately rather than reinstalling the app as a first step.

Why does it reconnect after I turn it off?

Go to Settings → On Demand and check the auto-connect conditions. Note the current settings, temporarily turn off On Demand, then compare manual connection and disconnection. If the behavior is still unexpected, check which VPN configuration is active in the system and confirm you're changing the one for Shadowrocket.

After verification succeeds, switch to the Config you use every day and restore settings such as On Demand gradually. After restoring each setting, revisit the same page. If the issue returns after a particular change, keep the working baseline and investigate that setting; this makes the cause easier to pinpoint than reimporting every configuration.

When contacting your provider, include the test time, network type, selected server name, Global Routing mode, and any error message. Hide authentication passwords, the full subscription URL, and its tokens. Buying the app and obtaining server access are separate; purchasing Shadowrocket doesn't automatically provide a usable server.