Rule · Rule syntax
Example snippet, not a complete configuration
[Rule]
DOMAIN-SUFFIX,example.com,PROXYIP-CIDR,192.168.0.0/16,DIRECTFINAL,PROXYCheck the match conditions first, then confirm the action.
Genuine App Store app · iPhone / iPad
Shadowrocket Setup and User Guide
An official guide for iPhone and iPad, covering subscription imports and rule-based routing. Shadowrocket is a one-time purchase from the App Store; the purchase does not include proxy service.
- Shadowsocks
- VLESS
- WireGuard
- Config
Global Routing
Interface terms · Not app screenshots
Config✓
Proxy
Direct
Scene
The mode determines how requests enter the routing flow.
Configuration and connection
Abstract device illustration · Not an app interface
Protocols and parameters
Enter details from your existing server information
ShadowsocksVMess
VLESSTrojan
Hysteria2WireGuard
A protocol name alone does not provide usable connection credentials.
Verify the App Store listing
Check the same product page
- Developer
- Shadow Launch Technology Limited
- App ID
- 932747118
- Purchase type
- One-time purchase See the App Store listing
Before getting the app, verify its icon, developer, and ID.
Rule-based routing and configuration features
First identify whether your existing information is for a server, a subscription, or a configuration file, then choose the corresponding entry point. The sections below explain each feature using the interface terms and outline what to check and in what order.
Rule matching and actions
Rules pair request conditions with actions. DOMAIN-SUFFIX matches domain suffixes, IP-CIDR matches address ranges, and FINAL handles requests that did not match earlier rules. Before testing, check the active file in Config, then set Global Routing to Config. Rule order matters: specific domain conditions should come before fallback rules. This example shows syntax only; you must configure your own server for PROXY. After making changes, check the actual connection records rather than relying on whether a webpage opens to determine how traffic was routed.
[Rule]
DOMAIN-SUFFIX,example.com,PROXY
IP-CIDR,192.168.0.0/16,DIRECT
FINAL,PROXYOn Demand connections
On Demand manages connection behavior according to the network conditions you set; it does not check whether a server is available. First connect manually and verify access, then check the On Demand conditions and enabled status in Settings. Test on your usual Wi-Fi and cellular networks, including when switching between them, so automatic activation is not mistaken for a connection problem. If you disconnect manually and connect again, check whether the On Demand conditions are still met. To troubleshoot, note the current settings, then temporarily disable automatic activation so you can repeat the same tests.
A guide to navigating settings
Settings
On Demand
Global Routing modes
Global Routing determines how requests are handled. Config applies the rules in the active configuration; Proxy sends applicable requests through the selected proxy; Direct connects without routing through the selected proxy server. To troubleshoot, first verify the server, test its connection with Proxy, then switch back to Config to check the rules. Direct does not select a different server or fix invalid credentials. Routing modes and the connection toggle are separate: seeing Config does not mean a connection has been established.
ConfigApply the current rules
ProxyUse the selected proxy
DirectConnect directly to the destination
Subscribe Manage existing subscriptions
Subscribe imports server details from a subscription you already have and keeps them together for management. Before adding one, make sure the link is complete and its contents are compatible with Shadowrocket. After importing, check the name, protocol type, and required fields, then select a server to connect. Updating a subscription refreshes server details; it does not necessarily update all routing rules in Config. Subscription links often contain access credentials, so keep them out of screenshots, chat logs, and public logs. If an update fails, check the network, link validity, and returned content. Avoid creating duplicate entries, and remember that renaming an item locally does not change the subscription contents.
Protocol types to check after importing
ShadowsocksVMessVLESSTrojanHysteria2WireGuard
Config configuration files
Config manages configuration files. Read the rules, DNS settings, and other handling options in the context of the active file. Successfully importing a server does not mean you have a complete routing configuration. Before applying a file, verify its source and contents; keep a recoverable copy before editing. For iCloud sync, also check the system account on each device, sync permissions, and the actual file status. Syncing does not copy purchase records or connection sessions. Change one type of setting at a time and test again after applying it. If something goes wrong, restore the backup first and compare the changes; this makes the cause easier to identify than changing several settings at once.
Sections in a configuration file
[General]
[Rule]
DOMAIN-SUFFIX,example.com,PROXY
FINAL,DIRECT
[Host]Data statistics and checks
Data shows traffic changes recorded by the client. Use it alongside the server, routing mode, and connection records to investigate where requests went. Before testing, note the current statistics, visit one clearly identified destination, and see whether upload or download totals change. These figures are not a proxy service billing statement, nor can they alone prove that a domain matched the expected rule. If a page fails to load, also check Connectivity Test, DNS, and the active Config. Before sharing troubleshooting details, remove server addresses, subscription credentials, and records that may reveal personal browsing activity; include only the relevant error information.
Suggested reading order; no simulated statistics shown
Data
Connectivity Test
Diagnostics
Interface fields and available options depend on the current app. For a first-time walkthrough of importing and testing, follow the Quick Start. For details on DNS, On Demand, Log, and Proxy settings, see Settings: A Detailed Guide.
Getting the app and first launch
Shadowrocket is available only on Apple platforms, and the App Store is the only place to get it. Verify the product page first, then check device compatibility and your purchase history.
iPhone
Check compatibility and price on the App Store before purchasing; system requirements are as listed on the App Store page. Once installed, have your own subscription or server details ready, then follow the guide to import them. When you first enable a connection, the system may ask to add a VPN configuration. Grant permission only after confirming that the prompt was triggered by your current action.
See how to get Shadowrocket on iPhone →iPad
Use the same Apple ID to check your purchase history. Whether a purchase covers both iPhone and iPad depends on the App Store listing. A larger screen may change how lists and details are arranged, but you still need to verify the selected server, active Config, and Global Routing separately. A purchase record does not replace these configuration checks.
See how to get Shadowrocket on iPad →Shadowrocket is also available from the same App Store on Mac and Apple TV; check the listing for compatibility.
If the product page is temporarily unavailable, check the region of your current store account and any messages on the page. Don’t choose an app based only on its name in search results. If you’ve bought Shadowrocket before and are switching devices, check your purchased items first. If a price appears again, verify which account you used to buy it instead of paying again straight away.
Verify the app and what the purchase covers
Shadowrocket is proprietary commercial software. This guide is based on the App Store product information and the terms used in the app. The purchase, configuration, and proxy service are separate and should be understood independently.
Check the developer, icon, and app ID
App Store search results may include apps with the same or similar names, so don’t rely on the “Shadowrocket” name alone. Open the product page and check that the developer is Shadow Launch Technology Limited, the icon matches the official icon used on this site, and the product URL contains id932747118. All three should match the same product page before you check the price and compatibility.
App ID 932747118 identifies the product in its URL; it is not a purchase credential or subscription number. If you find a similarly named app from a different developer, return to the single App Store product page linked in this site’s getting-started information and verify it again. The icon is one check, not a substitute for verifying the developer and ID.
Read the app verification steps →What the one-time purchase covers
The US storefront lists a one-time price of $2.99; prices appear in local currency in other storefronts, and the amount shown on the purchase confirmation screen is final. The payment buys a license to use the client, not server connection credentials. Payment, app installation, and successful network access are three separate steps. Check each one rather than assuming that completing one means the others are done.
The client purchase is not a proxy service plan. This site does not provide, sell, or recommend proxy servers or subscriptions. To connect, use your own subscription or server details and verify they are valid. The app’s price and the status of any service associated with those details are managed separately; buying the app does not provide a server you can connect to.
See pricing and purchase details →Store availability and account region
Whether you can purchase the app depends on your current App Store storefront, account status, and the information shown by the store. The link on this page points to the same product, but check availability, currency, and purchase conditions on the page opened on your device. The storefront region in a link does not mean your device account has switched regions. Don’t assume your final price based on what someone else sees.
Read the compatibility section before installing; system requirements are as listed on the App Store page. If your device reports that the app is incompatible, check its OS version against the store listing. If the product page is unavailable, distinguish storefront availability from a network loading issue. Check the product page and the information shown for your account to confirm purchase eligibility, Family Sharing availability, and access on other devices.
See the App Store access guide →Restore purchases and keep your configurations
When switching or reinstalling, use the Apple ID from your purchase to check your App Store purchases, then open the Shadowrocket product page. Being able to download the app again does not mean the old device’s servers, rule files, and connection state will all reappear. Purchase records and configuration data are separate, so check each before migrating to avoid finding missing settings after installation.
If you use iCloud sync, check the items awaiting sync on the old device, then verify the system account, sync permissions, and actual file status on the new one. Keep a copy of configurations before important changes, and protect your subscription links. App updates are managed through the App Store. After an update, check the selected configuration, Global Routing, and connection toggle before testing your usual destinations.
See how to restore purchases →Identify these three types of information before configuring
Server details specify the protocol, address, port, and authentication fields needed for a connection. Subscribe reads and manages a server collection from an existing link. Config organizes rules and related handling settings. You may have all three, but they serve different purposes. Identify what you have before opening the corresponding screen. A rules file is not server credentials, and updating a subscription does not mean its rules have been applied.
Troubleshoot connections from the smallest scope: check that your details are valid, confirm the selected server, verify Global Routing, then check Config, DNS, and the actual request records. Change one condition at a time and note its previous state. A successful Connectivity Test does not mean every destination is reachable; a single failed destination does not prove the protocol itself is at fault. Record reproducible symptoms in order to avoid noise from repeated changes.
example.com in a rule example illustrates syntax only; it does not represent a real proxy service. When adding VLESS, Trojan, WireGuard, or Hysteria2, match each field to your existing server details. Don’t infer authentication information from the protocol name alone. To understand a parameter, read its explanation and check the original details. Ask the provider of those details about any uncertain values rather than hiding errors by disabling verification.
Frequently asked questions
Import succeeded. Why can’t I connect?
A successful import means the details were read; it does not mean the server is currently reachable. First check the selected server, connection toggle, and system VPN permission, then check Global Routing. After switching networks, retry the same destination and note where the error occurs. Follow the FAQ connection troubleshooting guide step by step; avoid changing rules and server parameters at the same time.
Which mode should I use for rule-based routing?
Select Config under Global Routing and confirm that the intended configuration file is active. Proxy and Direct handle traffic through a proxy or directly; neither automatically replaces the rules in your configuration. Check rule order and connection records to confirm whether the rules are working. See the Quick Start for instructions.
Does updating a subscription also change the rules?
Server subscriptions and Config are managed separately. A subscription update primarily checks the server collection; check the active configuration file to review its rules. If the way a destination connects changes after an update, first check whether the selected server changed, then verify the configuration status. Don’t assume the rules were overwritten. See the Settings guide for the relevant screens and options.
Parameters and practical tips
Understand configuration results through protocol fields, network conditions, and traffic statistics. The articles below assume you already have server details and do not recommend proxy services.
Hysteria2 in Shadowrocket: How QUIC works, why it can be fast, and which networks suit it
Learn how QUIC and UDP behave on high-loss, high-latency connections, and how network restrictions can affect connectivity. Once you understand when it may be suitable, check your existing server settings rather than assuming its speed from the protocol name.
Read the guide →Add a Trojan server in Shadowrocket: How to enter Password, SNI, and Allow Insecure
Learn how TLS transport relates to Address, Port, Password, and SNI. Understand the difference between the connection address and the certificate verification name, and the risks of Allow Insecure, so you can enter your original server details accurately.
Read the guide →How to read Shadowrocket traffic statistics: Understanding Data by server and app
Learn how upload and download totals are measured and how to read the different views. Compare the destination, selected server, and changes in the statistics to see how they can help with troubleshooting—and why they cannot replace rule-match records.
Read the guide →