Shadowrocket First Connection: Select a Default Server and Run Connectivity Test

At a glance

This guide is for first-time Shadowrocket users who already have a provider and subscription. Follow the sequence: confirm the servers are imported → select a default server → check Global Routing → connect and grant permission → run Connectivity Test. This verifies your configuration, system connection status, and real-world access. If something fails, change one setting at a time to avoid mixing up server, routing, and network issues.

1. Before connecting: Check the app, network, and server details

Shadowrocket is a paid app for Apple platforms, primarily used on iPhone and iPad, and is available exclusively on the App Store. The developer listed on the product page is Shadow Launch Technology Limited, and the app ID is 932747118. A one-time app purchase does not include a service plan. This guide assumes you already have your own provider and subscription, and covers how to use an existing configuration.

Before your first connection, turn off the connection switch and make sure your current Wi-Fi or cellular network can access commonly used websites. If Wi-Fi requires sign-in through a web page, complete that first. Switching servers repeatedly will not help if the underlying network is offline. Check the App Store page for compatibility, system requirements, and whether purchases are universal.

Server details: At least one usable entry has been imported, with its protocol, address, port, and authentication details taken from your existing configuration.
Subscription status: If you use a subscription, make sure its servers appear on Home—not just that the subscription name has been saved.
Configuration basics: Use Home to select a server and control the connection, Config to manage configuration files, and Settings to adjust app preferences. Importing a subscription does not automatically select or enable a rule configuration.
Protect your information: Subscription URLs, passwords, UUIDs, and keys are sensitive. When troubleshooting, note the error rather than sharing full credentials in public screenshots or support requests.

If you have a subscription but the server list is empty, tap “+” in the upper-right corner of Home to open the add screen. Select Subscribe under Type, enter your own subscription URL, and save it. Then return to Home and update the subscription. https://example.com/sub?token=xxxx is a dummy value shown only to illustrate the format; it will not connect. For import and update instructions, see the subscription manual.

2. First connection from Home: Select and authorize in five steps

Seeing a server in the list only means its details have been imported. You still need to select a default server and turn on the connection switch. The server row’s edit control does not select it, and a latency-test result does not prove that a connection is active.

Select a server

Go to Home, find the server you want to use, and tap the circle to the left of its row. Make sure the selection indicator appears next to the right entry. If you opened the edit screen, return to Home and check the selection indicator there.
Check routing

Go to Home → Global Routing and note the current selection. For an initial check, you can temporarily select Proxy to test the selected server’s proxy route. If you already have a rule configuration, you can use Config, but make sure you know which rule will match the test destination.
Turn on the connection

Return to Home and turn on the connection switch at the top. This starts the system VPN connection; selecting a server with the circle on the left does not do this automatically.
Allow the configuration

When iOS first asks to add a VPN configuration, confirm that the request is from Shadowrocket, tap Allow, and complete any system verification. If you denied permission, return to the app, turn the connection switch on again, and respond to the system prompt.
Run the test

Wait for the connection status to settle, then run Connectivity Test from Home. Note whether it succeeds or fails, and compare the result with a visit to the website you actually need in your browser.

A system VPN indicator or an enabled connection switch mainly confirms that the system connection has started. It does not guarantee that the remote server, DNS, and every destination website are available. Routing traffic through the app and successfully completing a specific request are different outcomes, so continue with the test.

3. Global Routing: Know which route your test uses

The same device and server can reach the same website by different routes depending on the Global Routing mode. A common first-connection mistake is to leave Global Routing on Direct after turning on the switch, then mistake a successful direct connection for a working proxy server. Another is to assume the proxy works when a Config rule sends the test destination to DIRECT.

The four Global Routing modes

Proxy: Prioritizes proxy routing; use it during initial troubleshooting to check the selected server’s proxy route.
Direct: Prioritizes direct routing; it cannot confirm that the default server’s proxy connection works.
Config: Routes connections according to the rules and policies in the active configuration file.
Scene: Applies routing behavior based on configured scene conditions; check the scene settings first.

Note the original mode before switching temporarily for troubleshooting, then restore your usual setting.

Record your first test

Selected server: Note the server label next to the selected circle on Home. Do not record passwords or keys.
Network: Note whether you are on Wi-Fi or cellular, and retest after switching.
Routing mode: Note whether you used Proxy or Config. If you used Config, also note the active configuration.
Test results: Record the Connectivity Test status and the result of the browser test separately.

Keep all other conditions unchanged so you can tell whether a particular change helped.

Config processes connections in the order of the rules in the configuration. For example, DOMAIN-SUFFIX,example.com,DIRECT sends connections matching that domain suffix directly; FINAL,PROXY sends connections that match no earlier rule to the PROXY policy. These are examples of rule syntax, not a recommendation to create a configuration for your first connection. Do not assume that PROXY refers to the same server in every configuration.

If your configuration uses policy groups, check the current selection in each group as well. The default server selected on Home does not necessarily override the choices made by every policy group in a configuration file. It is usually easier to identify the issue by first testing the server under simpler conditions, then returning to Config to investigate specific rules.

4. Connectivity Test: What success and failure can tell you

Connectivity Test checks whether a test request can complete. It is not an overall check of every website, protocol, or network condition. A successful test means the request was reachable under those specific test conditions, but an app may access different domains, use different connection methods, or match different rules.

Test succeeds and the webpage loads: You have basic confirmation that the first connection works. If you temporarily used Proxy, restore your usual Config and check whether your commonly used websites are still accessible.
Test and webpage both fail: Check the underlying network first, then verify the default server, routing mode, and server details. Avoid changing everything at once.
Test succeeds but one website fails: Note the website’s domain, error message, and current Global Routing mode. If the failure occurs only with Config, check the rules and policies for that destination before considering changes to the subscription.
Test fails but some websites load: The traffic may be going direct, the browser may be using cached data, or the test destination itself may be unreachable. Confirm the route and destination before trying again. A single page loading does not prove that everything is working.

The latency number in the server list and Connectivity Test are not the same thing. A response to one kind of probe does not fully verify the protocol handshake, TLS, DNS resolution, or request to the destination website. Results from different test methods are not directly comparable. For a first check, focus on whether an actual request completes—not just which entry shows the lowest number.

5. Wi-Fi and cellular: Retest by changing one condition

If the same server fails on Wi-Fi but works on cellular, the issue may be related to the network environment, but that alone does not identify the cause. Keep the server, protocol settings, and routing mode the same when switching networks. Once the new connection is stable, check the status on Home, reconnect if needed, and run Connectivity Test again.

Compare the same server on two networks

Test on Wi-Fi

Turn off the connection and make sure any network sign-in is complete.
Note the current default server and Global Routing mode.
Reconnect, run Connectivity Test, and visit the same website.

Test on cellular

Make sure Shadowrocket is allowed to use cellular data in system settings.
Keep the server and routing settings the same as in the Wi-Fi test.
Repeat the same test and note whether the error changes.

Compare the networks first, then the servers. Changing both at once makes it impossible to tell which change affected the result.

Also check Settings → On Demand. This feature can control automatic connections based on network conditions, so existing conditions may affect the connection after a network change. For a first manual test, note the current settings and temporarily turn off On Demand if needed; restore it after testing. Do not attribute every switch change to a server issue while automatic conditions are controlling the connection.

6. Common first-connection issues and how to troubleshoot them

I tapped a server. Why am I still not connected?

Return to Home and check that the circle on the left is selected, then check the connection switch at the top. Selecting a server and starting the connection are separate steps. If the switch is off, turn it on, respond to the system VPN configuration request, and then run Connectivity Test.

The switch turns off right after I turn it on. What should I check first?

First, check whether you allowed the system request to add a VPN configuration. Then check whether another VPN connection is controlling the device. Next, review the conditions under Settings → On Demand. Note the exact system message rather than deleting all servers. Only address a specific item after confirming that its permission or configuration is at fault.

It says connected, but webpages still won’t load. What should I do?

Run Connectivity Test from Home and note the Global Routing mode. If it is set to Config, record the original setting and temporarily switch to Proxy for comparison. If Proxy works but Config does not, check the rules and policies in the active configuration. If both fail, check the server details and underlying network.

Do I need to select a server again after updating a subscription?

An update may add, remove, or replace entries, so confirm that the server selected by the circle on Home still exists. Do not assume the selection is unchanged based on an old label. After confirming, reconnect and run Connectivity Test. If Config uses policy groups, also check that the selected option in each group is still valid.

After your first successful check, keep a brief record of the network, server label, Global Routing mode, Connectivity Test result, and whether the website loaded. If a problem later occurs only on a particular network or with a particular routing mode, these notes can help narrow it down. You do not need to change DNS, MTU, TLS, and rule files all at once to complete your first connection; investigate them individually when there is a clear clue.