Official website · Illustrated guide

ShadowrocketSetup and connection guide

Cross-platform rule-based proxy client for connecting with your existing server information. Use Global Routing and routing rules to choose how traffic is handled.

Download Shadowrocket All platforms

Current version 2.2.92 · iPhone / iPad: $2.99 once through the App Store; Mac, Windows, Android and Linux: free

First-time setup: import, choose a mode and test →

  • Config
  • Subscribe
  • On Demand

From interface controls to outcomes

Shadowrocket features and rules

First distinguish servers, modes and configuration files. Then adjust automatic connection and diagnostic options. The notes below are explanatory labels, not app interface text.

Explore features

Routing rules: match first, then process

Rules determine whether a connection uses PROXY, DIRECT or REJECT. In Config, select the configuration file in use and check the order of its Rule entries. Rules are generally matched from top to bottom, so put specific conditions before fallback rules. DOMAIN-SUFFIX matches domain suffixes, GEOIP checks the geographic classification of the destination IP, and FINAL catches connections that did not match earlier rules. After making changes, confirm that the file is enabled and test the same destination again. Rules added to an unselected file do not affect current connections.

Global Routing: understand the three modes

Global Routing is where you choose how traffic is handled globally. Config routes traffic according to the selected configuration file's rules; Proxy sends general traffic through the selected proxy; Direct uses a direct connection. For an initial test, choose one mode clearly so you can identify the cause without changing both servers and rules at once. Use Config for normal rule-based routing. For troubleshooting, briefly switch to Proxy or Direct and compare the same destination. Scene is for scenario-based settings and is not equivalent to the other three options. After changing modes, send a new request instead of checking whether an old page is still displayed.

Route by rules

Check the selected configuration file, rule order and FINAL. Selecting a server does not mean every connection will use it.

On Demand: connect based on network conditions

On Demand controls whether a connection starts automatically when its conditions are met. It can be useful on devices that switch between Wi-Fi and cellular networks. In Settings, open On Demand and check the network conditions and existing settings separately. Start with simple conditions and enable automatic behavior only after confirming that a manual connection works. Automatic connection does not replace routing rules: the former controls when to connect, while the latter controls where traffic goes after connecting. If the connection starts again after you turn the switch off, check On Demand and the system VPN settings. Reinstalling repeatedly usually will not explain why a condition was triggered.

Multiple protocols: fields depend on Type

Shadowrocket supports protocols such as Shadowsocks, VMess, VLESS, Trojan and WireGuard. When adding a server, choose its Type in Add Server, then check Host, Port and authentication fields against your own information. Depending on the protocol, you may also need to configure TLS, the transport method and the server name. Similar protocol names do not mean their parameters are interchangeable. A successful import also does not guarantee every field is correct. If a connection fails, check the protocol and port first, then authentication and transport settings. Do not try to fix it by switching Type at random.

Import subscriptions: maintain existing servers

If you already have your own subscription, use Subscribe to save its link and update the server list. You can also import individual details using a share link, the clipboard or Scan QR Code. A subscription maintains servers in batches; Config manages rules. They are different types of files. Before updating, note your current selection. Afterwards, check changes to groups and item counts, and confirm that authentication details still apply. Repeated imports may create entries with the same name. Before tidying the list, check which subscription an entry belongs to, then remove duplicates without deleting a group that is still in use.

Diagnostic tools: isolate the point of failure

Connectivity Test can help determine whether a server responds. Test Method in Settings affects how to interpret the result. A response does not mean every website is reachable; also check Global Routing, DNS and the rule that actually matched. Data lets you review traffic records, while Diagnostics provides further troubleshooting. Hide server addresses and authentication details before sharing records. If you use iCloud to sync relevant settings, confirm the account and sync scope first, and keep a separate backup. Syncing is not a backup of historical versions and does not replace checking server connectivity.

Choose how to get Shadowrocket by device

Two ways to get it: iPhone / iPad costs $2.99 once through the App Store; Mac, Windows, Android and Linux versions are free. Desktop and Android installers are available from this site's download page under /dl/.

iPhone / iPad

$2.99 once through the App Store; other platforms are free. The same purchase account can restore access on both devices. Before installing, check the developer, icon and app ID on the store product page. System requirements are as listed on the App Store page.

Getting and restoring access

Mac

Free · Apple Silicon / Intel. Check your chip in About This Mac, then choose the matching dmg. If the first launch says the developer cannot be verified, confirm the app came from this site, then check for Open Anyway under Privacy & Security in System Settings.

Choose a Mac version

Windows

Free · 64-bit exe. Check where the file was saved before running it. If SmartScreen blocks it, first confirm the file came from this site's /dl/, then select More info to see the Run anyway option. Full installation and permissions instructions are on the download page.

Windows download details

Android

Free · arm64 apk. If prompted for permission to install from this source, allow it only for the browser or file manager you are using to open the installer. You can revoke this permission afterwards. On the first connection, follow the system prompt to allow a VPN connection.

Android download details

Linux

Free · deb / rpm / AppImage. Choose a format based on your distribution and package manager. Install deb and rpm packages using your local package installation process; AppImage needs execute permission before launch. Do not mix installation commands for different formats.

Choose a Linux package format

See all platforms →

Three steps to your first connection

These steps assume you already have your own subscription or server information. Test one connection first, then add rules, automatic connection and sync settings to keep troubleshooting straightforward.

  1. Add Server / Subscribe

    Use your existing information to choose manual entry, a share link or subscription import. For manual entry, select Type first, then check Host, Port and authentication fields. After importing a subscription, update the list and confirm that at least one server can be selected. If you see only a group heading with no valid entries, do not proceed directly to connection testing.

  2. Global Routing

    Confirm the selected server, then choose Config, Proxy or Direct. With Config, also confirm the configuration file is enabled and its rule targets are valid. Note the current mode and file name so later tests can show whether the server route changed or a rule sent the request through a different path.

  3. Test the connection and access

    Turn on the connection switch and follow the system prompt to add a VPN configuration. Then run Connectivity Test and visit a test destination of your own. A VPN icon in the status bar only confirms that the system connection is established; it does not confirm that the destination is reachable. If it fails, check the server, mode, DNS and rules in that order.

Read the complete guide →

For more detailed steps after importing, read the server management guide. It covers naming multiple subscriptions, updating, sorting, deleting and backing up, keeping routine maintenance separate from first-time setup.

Verify the app and understand the purchase

This is the Shadowrocket official website and guide. Check the app's identity, how to get it and your own server information as three separate steps before configuring it.

Store verification

Developer, icon and app ID

On iPhone / iPad, open the Shadowrocket product page in the App Store. Check that the developer is Shadow Launch Technology Limited, the app ID is 932747118, and the icon matches the official icon in this site's header. A matching name alone is not enough to verify these details, and search result position does not establish an app's identity.

Shadowrocket is a proprietary commercial app. Rule syntax examples and the client app are different things; the rule lines shown in this guide explain settings and are not source files for the client. Get Mac, Windows, Android and Linux installers from this site's download page, and confirm that the address is under this site's /dl/.

Store availability

Check your account region first

App Store search results depend on the storefront region associated with your Apple ID. If the app is unavailable in the mainland China storefront, trying different search terms will not change its availability. Check the current region in your account settings, then review the store information on the download page. Before changing your account region, review the system requirements related to your balance, payment method and existing subscriptions.

For iPhone / iPad, system requirements are as listed on the App Store page. This guide does not state a fixed minimum system version that may change. If the store page says your device is incompatible, use the product information shown on that device rather than drawing conclusions from another device's installation.

Purchase and restore

Separate the app from connectivity

The iPhone / iPad version costs $2.99 once through the App Store; Mac, Windows, Android and Linux versions are free. The actual currency and amount depend on the relevant store page. The same purchase account can restore access on compatible iPhone and iPad devices. When changing devices, check your purchased items first; an account mismatch does not mean you must purchase again.

A one-time app purchase is not a connectivity plan. Getting Shadowrocket does not create a server or subscription. This site does not provide, sell or recommend servers or subscriptions. Import instructions assume you already have your own subscription or server information. Server availability and expired credentials are separate from whether the app has been purchased.

Updates and preserving settings

Back up before reinstalling

App Store manages app updates on iPhone / iPad. Mac, Windows, Android and Linux users can get updated installers from this site's download page. On Mac, continue to select the version that matches your chip; on Linux, use a package format compatible with your distribution. The version field on this page reads from the current manifest and does not use the article publication date as version information.

Before updating, note the server, Global Routing mode and configuration file you use, and back up important information separately. iCloud sync can help retain relevant settings across supported devices, but check sync status, availability and separate backups individually. If a connection fails, keep diagnostic clues before taking action; deleting and reinstalling immediately may remove both your existing rules and evidence of the problem.

Continue reading by issue

Handle installation permissions, connection failures and system package formats separately. Before following the relevant steps, note your device, current mode and the exact prompt so you do not mix solutions for different systems.

Browse all articles →