Shadowrocket Guide
Import a Subscription and Connect for the First Time

STEP 01 / HOME

Add a server / import an existing subscription

Open Shadowrocket and go to Home at the bottom. This screen shows available servers and connection controls. Tap the plus sign in the upper-right corner to open Add Server, then choose a Type that matches the details you have. Both subscriptions and individual servers should appear as selectable entries on Home, but their input fields differ.

For an existing subscription link: choose Subscribe

In Add Server, set Type to Subscribe and paste your complete subscription link into URL. Check that the beginning, end, and query parameters are intact; avoid including chat text, line breaks, or extra spaces. You can enter a label to help identify it; this does not affect the server settings. Save using the on-screen control, return to Home, and wait for the subscription content to load.

A subscription link retrieves and updates a server list. It is not a regular website home page and may not display readable text if opened in a browser. Do not remove parameters just because they look unusual. A link may contain personal access credentials, so do not post it publicly in questions, screenshots, or shared documents. If you need help troubleshooting, describe the error instead.

Back on Home, check whether server entries appear under the subscription group. A subscription name with no servers does not mean the import is complete. First check that the current network can access the subscription, the link is still valid, and its response can be read. A subscription update issue and a connection issue with an individual server are separate stages; do not repeatedly change the routing mode before the list has loaded.

For a single server: fill in the fields for its Type

If you have an address, port, and authentication details, choose the corresponding protocol Type in Add Server and enter each value in its own field. Enter the address and port separately. Authentication may use a password or other fields required by the protocol. For encryption, TLS, transport, and additional parameters, follow the original details. Do not substitute options just because their names look similar, and do not use fields from a different protocol.

If the original details include a QR code, use Scan QR Code to read it. After scanning, check the Type, address, and port rather than connecting as soon as you see an entry name. When entering details manually, watch for digits versus letters, full-width punctuation, and trailing spaces. Save, return to Home, and confirm the server entry is present before continuing.

STEP 02 / GLOBAL ROUTING

Choose a Global Routing mode

Find Global Routing on Home and open it. This setting determines how requests are handled; it is separate from choosing a server in the server list. First understand the difference between Config, Proxy, and Direct, then choose the mode for what you are doing. Changing modes will not fix incorrect server details.

Check the configuration before using Config

To route traffic by rules, open Config at the bottom and confirm which configuration is selected. Importing a subscription does not automatically provide a complete rules file suited to your needs; check the server list and rules configuration separately. If you already have a configuration file, review its source and contents before selecting it. You do not need to import an unfamiliar configuration just to complete your first connection.

Config uses the current configuration to determine whether a request goes to PROXY, uses DIRECT, or follows another rule action. As a result, the same server might reach a page under Proxy but take a different route under Config. That does not necessarily mean the server has failed; check which rule matches the request. For rule keywords and more detailed matching behavior, see the protocol reference and feature guide.

Use Proxy and Direct for a focused comparison

If you are not sure whether the issue is with the server or the rules, temporarily choose Proxy and test with the default server in the next step. To check whether the current network can access a destination directly, temporarily choose Direct. Switch back to the mode you need when testing is complete. Direct does not mean using the selected server at a different speed, and it cannot confirm that the proxy path is working.

After choosing a mode, return to Home and check the current Global Routing value again. Do not change the mode, server, DNS, and configuration file all at once; if the result changes, it will be difficult to tell which setting made the difference. For everyday rule-based routing, use Config if the current configuration's rules match your needs.

STEP 03 / VPN

Choose a default server and turn on the connection

Return to Home, find the server you want to use, and tap the circle to its left to set it as the default. Check that the selection has changed before using the connection switch at the top. Tapping a server name may open its details or another action, so do not assume the default changed just because you tapped its row.

If your subscription contains multiple entries, choose one with complete details that you know is still usable for your first connection. Do not select other entries repeatedly while a system authorization prompt is open. Check the default server and Global Routing together: the server determines the target of the proxy path, while the mode determines when requests use that path. Both matter.

Allow the system to add a VPN configuration

Turn on the connection switch at the top of Home. When connecting for the first time, the system may ask to let Shadowrocket add a VPN configuration. Confirm that the prompt matches your action, choose Allow, and complete any password or other authentication required by your device. This system authorization sets up a network configuration on your device; it is not a request for the server password. Enter server credentials in the corresponding fields in Add Server.

After authorization, return to Shadowrocket and check that the switch stays on and no connection error appears. If you previously denied authorization, try connecting again and follow the system prompt. If needed, check the existing configuration in the VPN section of system settings. Do not delete other network configurations on the device in bulk while troubleshooting, especially those managed by an organization or device administrator.

A VPN status shown by the system only indicates that the VPN configuration on your device is active. It does not by itself prove that the remote server is available or that every request goes through the proxy. Likewise, a switch that stays on and a browser that can access pages correctly are two separate things to verify. Keep the current server and mode for now, and move on to the connection test.

STEP 04 / CONNECTIVITY TEST

Check connectivity and real-world access

Keep the connection switch on and run Connectivity Test on Home. Review the result for the current server. Allow time for the test to finish and the result to stabilize; do not switch networks or default servers repeatedly while it is running. If the list tests multiple servers, distinguish the current default from other entries. A successful test on a different entry does not mean the current connection works.

Connectivity Test checks connectivity under specific test conditions. It does not provide a complete assessment of every app, domain, or transport method. If the result is abnormal, consider it alongside real-world access; if it is normal, still check how the current Global Routing mode behaves. Do not choose a server based on one number alone or treat a test result as actual download speed.

Make a real request in a browser

Switch to a browser and visit a page you know is available to confirm it loads. Then test another destination that matters to you; do not judge the connection based only on a cached page. Note the current network, default server, and Global Routing mode. You do not need to test with many apps at once; make the result reproducible before expanding the test.

If a page works under Proxy but fails under Config, first check the current configuration's matching rules and DNS behavior rather than deleting all servers. If an ordinary page also fails under Direct, first check whether Wi-Fi or cellular service itself is working. Record the original state before switching networks, then repeat the same test to avoid confusing a network change with a server change.

Distinguish three completion checks

1. Device connection established: The switch at the top stays on and system authorization is complete.
2. Server reachable: The current default server's test and actual proxy requests produce consistent, explainable results.
3. Rules behave as expected: Under Config, requests that should use the proxy or connect directly follow the configuration's rules.

Confirm the first two before moving on to the third; this narrows down troubleshooting. One failed test does not automatically point to the protocol type. The actual network, authentication details, server status, and configuration rules can all affect the result. Once you can reproduce the issue reliably, follow the checks in the next section.

STEP 05 / CHECKLIST

Check the stage where the issue occurs; do not reinstall repeatedly

When a connection fails, first identify the step where it happened, then change the relevant setting. Reinstalling makes you repeat the import and authorization steps; it does not automatically fix an expired subscription, incorrect authentication, or rule-matching issue. Change one condition at a time, run the same test, and note what changed. This makes it easier to narrow down the cause.

Empty list: return to the import step

If Home shows no servers, first check whether you saved the details in Add Server. If the subscription entry exists but its group is empty, check that the URL is complete, that the subscription can still be accessed, and what error the app shows. Do not repeatedly add the same link and create duplicate groups; keep one identifiable group and check the update result. For subscription access or response issues, contact the provider of information for a service you already use and do not share the full link publicly.

Switch will not stay on: check authorization and device status

If the switch turns off immediately, first confirm that you allowed the system to add the VPN configuration. Check whether another VPN configuration is already active on the device. If the device is managed or system settings impose restrictions, follow the device management requirements. If the app shows a specific message, record its exact wording; this is more useful than simply saying it will not connect. Do not delete system network items without understanding the impact.

Switch is on but requests fail: check server details

Confirm that the selected circle on the left belongs to the server you intend to use, then recheck its Type, address, port, and authentication fields. If the server requires TLS or other transport settings, compare each one with the original details. If your subscription has another entry you know to be valid, you can test it by changing only the default server. If all entries fail, check the current network and subscription status rather than changing every server's settings at once.

Only some destinations fail: check the mode and configuration

First check whether Global Routing is set to Direct by mistake, then confirm which configuration is selected in Config. Temporarily switch to Proxy and repeat the same request to help distinguish a proxy-path issue from rule matching. Restore the mode you need after testing. If only domain access is abnormal while other tests differ, check DNS next; do not replace multiple DNS settings at the start. For more on routing and connection issues, see FAQs and troubleshooting.

When reporting an issue to your information provider, describe the device system, selected protocol, stage of failure, error message, and result after switching networks. Keep passwords, complete subscription links, and other authentication details private. After the first connection is stable, organize server labels, confirm Config, and set up On Demand in sequence. Verify each new setting so the configuration process remains traceable.