How to Make Your First Shadowrocket Connection: Select a Default Server, Connect, and Run Connectivity Test

At a Glance

After importing a server into Shadowrocket, select a default server, check Global Routing, connect, and verify that requests go through. This walkthrough uses the iPhone / iPad interface and is for users who already have a service provider and subscription but have not completed their first connection. Follow the steps in order to distinguish between an imported configuration, an established system connection, and a website that is actually reachable.

1. Before Connecting: Check the Server, Configuration, and System Permissions

First, check whether Home shows any server entries. A name in the list only confirms that an entry was imported; it does not confirm that the address, port, authentication details, or service status are correct. This walkthrough starts with an existing server and does not cover how to obtain a connection. These instructions assume you already have your own subscription and cover only client setup.

Home, Config, and Settings serve different purposes: use Home to select a server and control the connection, Config to manage rule configurations, and Settings to adjust app preferences. For your first connection, verify the selected server and connection status before working on advanced routing. This avoids changing multiple variables at once.

3 steps

Connection basics: Select a server → Connect → Verify access

4 checks

Global Routing：Proxy / Direct / Config / Scene

3 places to check

Main sections: Home / Config / Settings

Make sure the device itself has internet access. If regular websites still do not load with Shadowrocket turned off, check Wi-Fi, cellular service, or network sign-in first.
Make sure your existing service is still active. A subscription updating successfully does not mean every server in it can establish a proxy connection.
If you previously set up automatic connections, go to Settings → On Demand and note the current settings. Temporarily disable automatic triggers while testing to prevent the connection from restarting after you disconnect it manually.

2. First Connection: Select the Server, Then Turn On the Switch

In Home, tap the circle to the left of a server to make it the current default. Opening an entry to edit it is not the same as selecting it as the default; viewing server details does not confirm that it has been selected. Return to the list and check that the selection indicator is beside the server you want to use.

Select a server

Open Home, find the server in the existing list, and tap the circle on its left. Confirm that the selection indicator changes, and note the server name so you can match it to the test results later.
Check routing

Go to Home → Global Routing. Select Config if you have a reliable rule configuration. If you have not verified your rules yet, temporarily select Proxy for a comparison test. Do not leave it on Direct and expect requests to go through the selected proxy server.
Connect

Return to Home and turn on the connection switch at the top. The first time you connect, iOS may ask to add a VPN configuration. Allow it as prompted and complete device authentication. If you have not granted permission, do that before troubleshooting rules.
Run a test

Run Connectivity Test in Home and check the result for the selected server. Note whether it returns a response time, times out, or shows a specific error. Do not judge the connection by the color of the switch alone.
Test a website

Open a browser and visit an HTTPS website you normally use, then test the app you actually need. If you temporarily switched to Proxy, restore Config afterward if that is your usual setup, and test access again.

3. Choosing Global Routing: Separate Everyday Use from Troubleshooting

Global Routing determines how requests are routed; it does not fix an incorrect server password or an expired service. During initial troubleshooting, Proxy can reduce variables introduced by rule selection. Once the connection works, switch back to Config to verify your actual routing rules. The options below describe Shadowrocket's routing modes.

Config

Recommended

Select a policy based on the rules in the currently enabled configuration. Requests may use DIRECT, a proxy, or a policy group. It is not simply “direct in mainland China, proxy everywhere else”; the result depends on the configuration and rule order.

Best for: Everyday rule-based routing with a working configuration.

Proxy

Route typical proxy traffic through the selected proxy, making it easier to compare with the results under Config. System restrictions or explicit bypass settings may still affect some traffic, so this does not guarantee that every connection on the device will use the proxy.

Best for: Temporarily checking whether a server can reach a destination and separating connection issues from rule issues.

Direct

Use a direct route without the selected remote proxy server. Even when the switch at the top is on, this does not mean the current request is going through a proxy.

Best for: Checking whether your local network can reach a destination directly.

Scene organizes routing behavior by context. When you have not yet verified a successful first connection, avoid adding scene changes at the same time. Scene and Settings → On Demand are different features: Scene affects routing choices for a given context, while On Demand controls when connections are triggered.

4. Understanding Connectivity Test Results

A result in milliseconds means the test received a response at that time. It does not mean every website is working, and it is not a bandwidth test. Different test methods check different layers: basic connectivity or a port response alone cannot confirm successful proxy authentication, a TLS handshake, and access to the destination.

What you see	What you can conclude	What to do next
A response time appears, and the website loads	The test and access to this destination both succeeded at the time of testing.	Restore your everyday Config and test the apps you use regularly.
A response time appears, but the website will not load	The test target or test layer responded, but the actual request may still fail.	Compare Proxy with Config, then check DNS and the destination's rules.
The test times out	The test did not complete within the wait period; the cause is not yet clear.	Check the selected server, try a different network, or test another existing server entry.
The switch turns off immediately	The connection is not staying active. First check the local connection setup.	Check system permissions, any alerts in the app, and possible conflicts with another VPN connection.

Keep the destination website the same during comparisons, and change only one variable at a time. For example, keep the same server and switch from Config to Proxy. If only Proxy works, review the policies in Config. If you change the server, network, DNS, and routing mode all at once, you will not know which change fixed the problem.

5. Where to Start When a Connection Fails: Check Server Details and Rules Separately

Check the server first, then routing and DNS. When editing an existing entry, compare each field with your own configuration details instead of guessing from the protocol name. Shadowsocks, VMess, VLESS, Trojan, Hysteria2, and WireGuard use different authentication and transport fields. Do not copy fields from one protocol to another.

Server checks

Type: The protocol must match the requirements of your existing service.
Address / Port: Check the address and port character by character. Port 443 does not imply a particular protocol.
Authentication details: Check the Password, UUID, or key required by the protocol. Do not mix up fields.
TLS / SNI: Use the value specified in your existing configuration. A display name cannot substitute for the name required by the server.

Keep the original entry or make a backup first. Do not disable certificate verification just to clear an error.

Rule checks

DOMAIN-SUFFIX: example.com,PROXY: Matches the domain and its subdomains.
GEOIP: CN,DIRECT: Routes directly based on IP geolocation.
IP-CIDR: 192.168.0.0/16,DIRECT: Example of a local private network range.
FINAL: PROXY: Use this policy when none of the preceding rules match.

These are examples, not a complete configuration. PROXY must correspond to a policy available in the current configuration.

If Proxy works but Config does not, open Config and check the file that is actually enabled. Do not edit a different, inactive configuration. Rules are generally matched from top to bottom; an overly broad rule placed too early can override more specific rules below it. FINAL is for fallback handling, not a substitute for checking the preceding rules.

Only domain access is affected: Note the failing domain and check DNS settings and resolution results. Save the original configuration first, then change one setting at a time for comparison. Do not replace all DNS settings at once.
The same server works on a different network: First consider connectivity, restrictions, or sign-in requirements on the current network. Do not rush to delete all your configuration.
All existing servers fail: Check the device's network, system time, service status, and imported server details. An incorrect system time can also interfere with TLS certificate verification.
Your selection changed after updating a subscription: Return to Home and check the circle on the left. After entries are added, removed, or renamed, do not rely on their previous positions to identify the selected server.

6. First-Connection FAQs

I imported a server. Why do I still need to tap the circle on the left?

Importing creates a server entry; the circle on the left selects the default server. Select the server in Home, then check Global Routing. If the rules in Config specify another policy group, that group can still affect how requests are routed.

The switch is on. Why does it look like the proxy is not working?

Go to Home → Global Routing and make sure it is not set to Direct. With Config, a website may be routed directly by a rule. That is not necessarily a failure. Temporarily switch to Proxy to test the same destination, then restore your original setting for comparison.

Why does the connection turn back on after I switch it off?

Go to Settings → On Demand and check the automatic connection conditions. Temporarily disable automatic triggers while testing, and check whether on-demand connection is enabled in the system VPN settings. Note the existing conditions and restore them after manual testing.

The server works, but the subscription update fails. What should I do?

A subscription update request and a connection to a proxy server follow different paths. First check that your existing subscription URL is still valid, then try updating again when the connection is working. Do not post a URL containing authentication details publicly, and do not delete a working server just because an update failed.

7. Keep a Reproducible Record After Verification

After your first successful connection, record the settings and results—not just “connected.” A known-good setup makes it easier to identify whether a later problem is caused by the network, a subscription update, server selection, or rule configuration. Do not include passwords, full subscription URLs, or private keys.

Current network: Wi-Fi or cellular, and whether network sign-in is complete.
Current server: Record an identifiable name, not authentication credentials.
Current routing: Note whether Global Routing uses Config or a temporary Proxy setting. If using Config, record the enabled file.
Test results: Record the Connectivity Test result type and whether your usual HTTPS websites and apps work.
Automatic connections: Check whether Settings → On Demand is back to the expected settings.

This walkthrough uses the iPhone / iPad interface for the first connection. To get the app, iPhone / iPad users can download Shadowrocket from the App Store for a one-time payment of $2.99. The developer is Shadow Launch Technology Limited; check the App Store listing for system requirements. The Mac (Apple silicon and Intel), Windows, Android, and Linux versions are free. Getting the app and obtaining a connection service are separate: purchasing the app does not include a connection plan.