Shadowrocket
Import and Connect

Add Server / Subscribe: Add and Import

After opening Shadowrocket, stay on Home and leave the connection toggle off for now. Choose one way to add details: use Subscribe if you have a subscription link, or enter the server address, port, and authentication details manually in Add Server. Both methods add servers to Home for you to select. You do not need to complete both to connect for the first time.

Existing subscription link: Save the URL in Subscribe

On Home, tap the plus sign in the upper-right corner to open Add Server. Open the Type options and choose Subscribe. On the entry screen, paste your complete subscription link into the URL field. If you want to add a remark, use a name that will be easy to recognize. Before saving, check that the beginning, end, and query parameters have not been truncated by a messaging app or copy operation. Do not include explanatory text, spaces, or line breaks with the link.

After saving, return to Home and wait for the subscription content to load. The import has retrieved selectable content only when a subscription group and its server entries appear. If there is a group name but no servers, do not turn on the connection toggle yet. First check whether the network can reach the subscription address, then confirm that the link is still valid. A subscription URL may contain personal access credentials; do not include the full address in public screenshots or troubleshooting records.

A subscription provides server details in bulk; it is not a complete routing configuration. After a successful import, confirm Global Routing in the next step. A later subscription update may change the list, so note the selected entry when testing for the first time and check that it is still present after updating. This helps distinguish a list change from a connection toggle problem.

Existing server details: Fill in Add Server for the specified protocol

If you have details for a single server rather than a subscription, open Add Server using the plus sign on Home. In Type, select the protocol specified by your provider, such as Shadowsocks, VMess, VLESS, or Trojan. Then enter the address, port, and authentication details required by that protocol. Fields such as password, identifier, encryption method, and transport options are not interchangeable. Do not guess based on instructions for a different protocol.

Enter the provided hostname or IP address in the address field; do not add a webpage path. Use the port specified for that service. Check TLS, SNI, and transport parameters against your existing details exactly, as leaving a field blank can produce a different result from entering a value. If details are missing, confirm them with your service provider first. Do not combine parameters from different sources into one entry.

After saving and returning to Home, check that the entry name and protocol are as expected. Do not make several server parameter changes at once. Seeing an entry in the list only confirms that its details were saved; it does not prove the server is reachable. Next, open Global Routing, choose a route for this connection, and test connectivity. For more on import formats, see the FAQ.

Global Routing: Choose a routing mode

Once the server appears on Home, find and open Global Routing. This setting controls how requests are handled; it does not correct server addresses or authentication details. For a first connection, understand the three modes: Config, Proxy, and Direct. Each is useful for a different kind of check. Select one, return to Home, and then connect. Avoid switching back and forth before testing.

Config: Route traffic using the active configuration rules

Choose Config for rule-based routing during everyday use. Then open the Config page and check which configuration is selected. Make sure it is the file you intend to use, not just one that appears in the file list. A configuration can assign different policies to different requests, so opening a webpage successfully under Config does not, by itself, confirm that the default server was used.

If you do not have a routing configuration yet, there is no need to copy in a large set of rules just to run the first test. Start with Proxy to check the server and connection process, then return to Config to learn about routing. Importing and selecting a configuration, and checking rule order, are separate topics. Read the troubleshooting guide for more detail; this page does not require a complex configuration in advance.

Proxy: Verify the proxy path first

When checking whether an existing server works for the first time, you can choose Proxy to reduce the effect of rule-based routing on the result. Here, “Proxy” refers to the Global Routing mode; it is not where you add a server. You still need to select an existing server on Home and turn on the toggle. Proxy cannot repair an unavailable server, and it does not mean every type of traffic on the device will necessarily be handled in exactly the same way.

Direct: Compare against the local network

Use Direct to check access without a proxy server. If a familiar webpage loads under Direct but not Proxy, focus on the server and proxy path. If both fail, first check the device’s Wi-Fi or cellular connection and the webpage’s service status. Internet access under Direct does not mean the proxy server is working. When the test is done, switch back to the mode you intended to use.

After choosing a mode, note which one is active. For each check that follows, record both the selected server and the current Global Routing mode so the results can be compared. Remembering only that the toggle is on often makes it difficult to tell a server problem from a routing problem.

Home: Select a server and turn on the toggle

Return to Home and select the entry you just checked in the server list. Tap the circular selection area to the left of the server and confirm that the selection indicator is on the intended entry. Opening the edit screen does not switch the default server. If a subscription contains several entries with similar names, select just one for the first test. Changing servers at each step makes it difficult to identify which change affected the result.

After confirming the server and Global Routing mode, turn on the connection toggle at the top of Home. The first time you connect, the system may ask to add a VPN configuration. Follow the prompt and approve it using the verification method required by your device. This permission establishes the system network connection; it does not confirm that a subscription was imported successfully. If you cancel, the toggle may not stay on when you return to the app. Start the connection again and complete the system prompt.

After granting permission, return to Shadowrocket and check that the toggle and connection status remain active. The VPN status in the system status bar or Control Center can provide additional information, but it only indicates the system connection state. It does not prove that the selected server can load webpages. Keep the current settings and run Connectivity Test next; do not skip verification just because a VPN indicator appears.

If the toggle switches back off immediately, first check that system permission was granted and whether another VPN connection is already active on the device. Devices managed by a school or organization may also have network configuration restrictions; follow the device management requirements rather than repeatedly deleting managed configurations. If you need to change server details, turn off the connection first, save the changes, then reconnect. This keeps the before-and-after states separate.

The iPad’s larger display may show some pages in a split view. The operation order is the same: select a server on Home, choose a mode in Global Routing, and connect with the top toggle. Do not add the same server again just because the list remains visible on the left. Confirm the entry used for this connection, then check actual traffic.

Connectivity Test: Verify the connection

After connecting, find Connectivity Test on Home, run it, and check the result for the current server. Wait for the test to return a result; a blank screen or an in-progress state immediately after tapping is not necessarily a failure. If the test times out, keep the server and mode unchanged and test once more. Troubleshoot if timeouts continue; do not draw conclusions from a momentary status.

Connectivity Test checks connectivity to its test target. A successful result means that this test received a response; it does not mean every website, protocol, or continuous transfer is working normally. The displayed time is not the same as actual download speed. When getting started, there is no need to compare the numbers repeatedly. A stable check of one path is more useful than looking at a single test result.

Use a browser to check real requests

Leave Shadowrocket connected, switch to a browser, and open a familiar webpage that you know is available. Open a new page and refresh it where possible rather than relying on content that was already loaded; a cached page may still display after the network changes. Then try another, different webpage to determine whether the issue affects one site or all new requests.

If you are using Config, also check that the request is routed as expected. Use the app’s request records to check the target domain and handling policy. Different rules may send two webpages along different paths, so success on one does not verify the other. If you are not familiar with the records yet, test the same webpage with Proxy first, then switch back to Config to compare and narrow the issue down to the rules.

Keep the minimum details needed to reproduce the test

A useful test record answers four questions: which server was selected, which Global Routing mode was active, what Connectivity Test returned, and whether the webpage loaded. You can note the entry name and result locally, but do not record a complete subscription link, password, or authentication details. If you troubleshoot later, use the same webpage for comparison so changes to the test target do not affect the result.

If the test succeeds and the webpage behaves as expected, the first-connection process is complete. If you later switch to Config for everyday routing, repeat the same check after switching. One successful test is not a guarantee that no further checks will be needed. Retest in the same order if the network environment, subscription content, or configuration changes.

Common issues: Check one thing at a time

When something goes wrong, revisit the earliest step that did not complete instead of resetting every setting. An empty list points to an import issue; a toggle that will not stay on points to a connection setup issue; a test timeout points to reachability. If the test responds but a webpage fails, check the mode, DNS, and target service separately. Follow this order and return to the same test target after each change.

No servers after import: Check the input and subscription response

Open the saved subscription entry in Add Server and check that Type is set to Subscribe, the URL is complete, and the symbols between parameters have been preserved. If you entered the address of an information page instead of a subscription URL, saving it will not produce a valid server list. The device needs a working basic network connection to retrieve a subscription. First confirm that an ordinary webpage loads, then try updating the subscription.

If the link has expired, access permissions have changed, or the response is unexpected, ask your service provider to check the status of your existing link. Do not paste the complete URL into a public page while troubleshooting, and avoid creating multiple identical groups. Keeping one confirmed entry and checking its update result usually makes it easier to locate the issue.

Connectivity Test keeps timing out: Check the server details

For a manually added entry, check the address, port, and authentication fields first, then check transport settings for the selected protocol. Compare each field with the original details instead of relying on the entry name; entries with the same name may use different ports. For a subscription entry, update it once, then compare the result with another server from your own list. If only one server keeps failing, check that entry’s service status first.

Also consider the current network environment. If the result changes when switching from Wi-Fi to cellular, the network path may be involved. To make a useful comparison, keep the server, mode, and test target the same. Without a clear reason, do not change the protocol, server, and DNS at the same time; the result will be difficult to interpret.

The test responds but webpages fail: Check the mode and DNS

First, return to Home and check Global Routing to rule out being left in Direct by mistake. If Proxy works but Config does not, open Config to confirm the active file, then check which rule matches the request and what policy it uses. Do not start by changing the server password. If only one webpage fails, confirm that the site itself is working before concluding that the whole connection is unavailable.

Check DNS after you have a comparison result. Save the current configuration first, then check the DNS settings under Config and confirm that the resolution path is as expected. Do not replace all settings with addresses copied from an unknown source, and do not change the system network and app configuration at the same time. For more on domain resolution, rule order, and network switching, see DNS troubleshooting.

If these steps do not restore the connection, look for the relevant symptom in the FAQ or read the troubleshooting guide for a systematic process. When describing the issue, include only the necessary details: device type, the step where the failure occurred, the Global Routing option, and the error text with sensitive information removed. Keep a copy of the original configuration to make further checks and recovery easier.