Shadowrocket Subscription Import
and Connection Test Guide

Step 01 / Add a server entry you can select

Add a Server or Import an Existing Subscription

Open Shadowrocket and check Home for existing server entries. An empty list means no details have been added yet; it doesn’t mean the app installation failed. Before adding anything, identify what you have: a set of address, port, and authentication fields for manual entry; a single server share link that usually imports one entry; a Subscribe URL for retrieving and updating a group of entries; or a configuration file that may include rules and other settings. These require different import options, even if they’re all links.

Already have a subscription? Use the Subscribe import option

Copy the complete subscription URL from your service provider. Make sure it points to subscription content, not an account login, billing page, or help article. Return to Home and open the add menu. If Subscribe appears in the Add Server type list, select it, enter the subscription URL, and save. Wait for retrieval to finish. If the app detects importable content on your clipboard, check the import type and source before confirming; don’t accept it just because a prompt appears.

After saving, return to Home and check that the subscription group and its server entries appear. If you see a subscription name but no server entries, check the update result before connecting. A refresh may change entry names or available options. After the first successful import, select one entry to test; there’s no need to import the same URL repeatedly. Duplicate imports can create similar groups and make it hard to tell which details a connection is using.

If your existing details specifically refer to a remote configuration or Subscribe management option on the Config page, use the appropriate option for that type: add or retrieve the configuration in Config, review its contents, then select it. Config manages configuration files; importing one doesn’t mean a usable server is selected. Likewise, seeing a subscription entry in Home doesn’t mean the routing configuration has changed. If the options have similar names, first distinguish between updating the server list and selecting a routing configuration.

Already have server details? Enter them in Add Server

In Home, open the add menu and go to Add Server. Select the protocol specified by your service provider, then enter the server address, port, and required authentication fields. Shadowsocks, VMess, VLESS, Trojan, WireGuard, and other protocols require different fields. Enter only values included in your details. Don’t guess passwords, IDs, keys, or transport settings from nearby fields, and don’t use the server’s display name as its connection address.

Watch for leading or trailing spaces, full-width punctuation, and extra line breaks copied with the details. The address field usually takes only the specified hostname or address; don’t add a webpage path. Enter the port exactly as provided. If TLS or other transport settings are required, check each one against the source details instead of enabling everything to see what works. After saving, return to Home, select the new entry, and confirm its name so you don’t choose an older one by mistake.

If you have a QR code, use Scan QR Code to scan it. For a share link, use the app’s clipboard import prompt if available. Either way, you’re done only when the entry has been saved and you can clearly select it—not just when the scan finishes. See the glossary for protocol field definitions, or read subscription import methods for more on the four import options. Once you’ve checked the entry, choose a routing mode.

Step 02 / Choose how to route traffic

Choose a Global Routing mode

In Home, find Global Routing and open the mode selector. This setting determines how traffic is handled overall; it won’t fill in missing server details or fix invalid credentials. The three modes are Config / Proxy / Direct. Before choosing one, decide what you need: everyday rule-based routing, a server connection test, or a check of your existing network.

Everyday routing: choose Config and check the active configuration

To route traffic by destination, choose Config, then open the Config page and confirm that the selected configuration is the one you want to use. A file appearing in the configuration list doesn’t mean it’s active. If you’ve just imported a remote configuration, first make sure retrieval is complete and the file can be read, then select it in the app. If your existing configuration works, there’s no need to replace it with a rule set from an unknown source just to follow this guide.

In rules, DIRECT means connect directly, PROXY means use the corresponding proxy policy, and REJECT means block. Rules are generally matched in order, so once a destination matches an earlier rule, later rules may not be considered. For now, focus on the idea that the configuration determines the route; you don’t need to rewrite any rules. If the active configuration references a missing policy or an unprepared server group, fix the reference rather than just switching the entry in Home.

For comparison: temporarily choose Proxy or Direct

If you’re not sure whether the issue is with the server or the rules, temporarily choose Proxy and test the same destination. If it works in Proxy but not Config, focus next on the configuration and matched policy. Direct lets you check whether your existing network can reach the destination. It doesn’t guarantee that every website will load, and it can’t confirm that a proxy server works.

After each change, return to Home, check the displayed Global Routing mode, and note which mode you tested. When you’re done comparing, restore the intended Config setting so you don’t leave a temporary test mode in place. For rule keywords and policy definitions, see the glossary. Keep one clear mode selected before moving on to the connection steps.

Step 03 / Establish the system connection

Turn on the connection and authorize VPN access

Return to Home and confirm the selected server and Global Routing mode. This is especially important after refreshing a subscription, which may change the previously selected entry. Seeing a familiar name in the list doesn’t confirm that it’s currently selected. Once you’ve checked, turn on the connection switch in Home and wait for the app to report its status. Don’t toggle the switch repeatedly or change the configuration while it’s connecting.

The first time you connect, the system may ask to let Shadowrocket add a VPN configuration. This grants the app permission to create a system network tunnel; it isn’t a request to buy the app again or confirm a subscription import. Check the app name in the prompt and make sure you initiated the request, then follow the system steps to allow it and authenticate with your device passcode or biometrics. If you cancel, the server entry may remain, but the connection won’t be established as expected.

After authorizing, return to Shadowrocket and check the switch and connection status. A VPN indicator in the system can be helpful, but status bar indicators vary by device, so there’s no need to reconnect repeatedly just to find a particular icon. What matters is whether the app maintains the connection and whether you can access your destination in the next step. A connected status confirms that the tunnel is established; it doesn’t prove that authentication, DNS, the destination service, and routing rules are all working correctly.

If the switch turns off immediately, first check that system authorization is complete. Then check whether another system configuration is managing a network tunnel. Devices managed by a workplace or school may restrict these actions; follow the device management requirements and don’t delete configurations if you’re unsure what they do. If the connection still fails repeatedly after authorization, note the error and troubleshoot in order.

Keep the first test simple: connect manually with the app in the foreground and don’t add On Demand conditions at the same time. On Demand triggers connections based on conditions, which is separate from this manual test. If you’ve already set it up, check whether automatic reconnection is affecting the test—for example, reconnecting after you manually disconnect. Once the connection is stable, test actual access.

Step 04 / Check three outcomes separately

Check that the connection, access, and routing work as expected

Check three things separately: does the connection stay up, can you reach the destination, and does traffic take the route specified by the configuration? These are different outcomes. Don’t stop just because the switch is on, and don’t delete all your settings because of one timed-out test. Keep the same server entry and test destination so you can compare the effects of each change.

Start with Connectivity Test

In Home, find Connectivity Test and run it for the server you plan to use. Wait for the result before continuing. The test method and target affect the result; a response means the probe received a response, not that every website or app will work. A failed test may also be caused by the probe target or network conditions, so check actual access too. Don’t keep switching servers just to get a lower number.

Then test access to a destination you can check repeatedly

Open a browser and visit a familiar destination that you’re allowed to access and can clearly tell has finished loading. Reload the page if possible so you don’t mistake a cached page for a successful connection. Check that the page content or request actually completes, rather than relying on an old title or image. Avoid testing several apps at once; otherwise, it’s hard to tell which request used which server entry.

Then return to Shadowrocket and check for traffic changes in Data related to your test. If the app shows current connection records, you can also compare the destination address and routing policy. Traffic in Data means data was transferred, but background requests also contribute, so an increase alone doesn’t prove the destination used PROXY. Consider the time of access, destination, and policy together.

Finally, check the routing result in Config

When using Config, test one destination that should use DIRECT according to your configuration and another that should use PROXY. Visit each and check the records. Don’t assume a particular domain should always use the same route across every configuration; the active file determines the result. If a destination matches REJECT, blocking may be the intended rule behavior, not a problem with the connection switch.

If access works in Proxy but fails for the same destination in Config, restore Config and note the active configuration name and matched policy. Focus on the rules and policy references. If both modes fail, continue checking the server details and network conditions. When testing is complete, restore the intended Global Routing setting. Data readings are not necessarily the same as your service provider’s usage figures; they may be measured differently.

Step 05 / Change one thing at a time

Troubleshoot based on where the failure occurs

Start troubleshooting at the earliest step that failed instead of re-entering every setting. Note the network you’re using, selected server, Global Routing mode, active configuration name, and any visible error. Change one condition at a time, then repeat the same test. This helps identify what fixed the issue and makes it easier to restore the previous state.

No entries appear after importing a subscription

First check that the URL is complete and returns subscription content rather than a webpage that requires login. Query parameters in the URL may be needed for authentication; leaving any out can cause retrieval to fail, so don’t remove them. Confirm that your existing service is active and that the format is supported, then update it. If your service provider has changed the URL, update the existing subscription entry first. Verify that it works before removing old details, so you don’t delete your only usable copy prematurely.

The entry is there, but the connection switch won’t stay on

Check that VPN authorization is complete, the selected configuration can be read, and no other network tunnel setting is interfering. In Add Server, check the protocol and required fields; don’t just re-enter the password. If a connection fails immediately after importing a configuration, compare it with a configuration you’ve already confirmed works to determine whether the new configuration or the connection itself is the problem.

Connected, but the destination won’t load

First disconnect Shadowrocket and confirm that your existing Wi-Fi or cellular connection can access the internet. Complete any network sign-in page if needed. Reconnect, confirm the selected server entry, and run Connectivity Test. If you already have other usable entries, test one of them with all other conditions unchanged. There’s no need to add details from unknown sources while troubleshooting.

If server authentication fails, check that the address, port, authentication, and transport fields all come from the same set of details. A subscription entry may have been updated while an older manually saved copy remains unchanged. For certificate or domain resolution errors, check the server domain, device time, and DNS settings in the active configuration; don’t hide the cause by disabling security checks at random. For complex fields, consult the glossary, then check the details with your own service provider.

Config fails, or only some destinations fail

Test the same destination in Proxy and Config. If only Config fails, check the active file, rule order, policy references, and DNS. If only specific destinations fail, check whether the destination itself is available, requires sign-in, or is intentionally blocked by the configuration. Don’t assume the entire subscription is invalid, and don’t delete the whole rule set to make one destination work.

If results differ between Wi-Fi and cellular, compare networks you’re allowed to use and check network access permissions and On Demand conditions. The same server may resolve or connect differently across networks; noting the difference is more useful than repeatedly reinstalling the app. After changing networks, check the connection status again and repeat the same access tests.

Once the connection is stable, access works as expected, and Config routes traffic according to its rules, the initial setup is complete. Make changes later only when your details or needs change. For purchase, App Store storefront, and device transfer questions, read the genuine purchase guide. Handle these separately from server connection issues; changing rules won’t resolve them.