Shadowrocket for iPad: First Launch, VPN Permissions, and the Home Screen Guide

Before connecting for the first time: installation and VPN permission are separate steps

Shadowrocket is a closed-source commercial app for Apple platforms, primarily iPhone and iPad, and is available only through the App Store. Before purchasing, verify the app name, app ID 932747118, and developer Shadow Launch Technology Limited. The app is sold as a one-time purchase. Prices vary by region; check the App Store listing for system requirements.

Buying the app does not buy a service plan. Purchasing Shadowrocket does not automatically populate the SERVER list. You’ll need to import your own existing subscription or enter server details you already have. This site does not provide, sell, or recommend nodes or subscription services. If Home has no usable entries, import your data first rather than repeatedly toggling the connection switch.

The VPN permission prompt may not appear the first time you open the app. It usually appears when you first try to connect and Shadowrocket needs to add a VPN configuration to the system. The prompt authorizes the app to add that configuration; it is not a subscription sign-in or purchase confirmation. After you allow it, iPadOS may ask for your device passcode or another form of authentication. Follow the prompts shown on your iPad.

From an existing subscription to your first connection: follow these five steps

First, make sure your iPad’s Wi-Fi or cellular connection can reach the websites you normally use. If public Wi-Fi requires a sign-in page, complete that step first. Import only a subscription URL whose source you trust. Never post a full URL containing a token in public comments, screenshots, or group chats.

1. Prepare your subscription

   Have your own subscription URL ready. This sample URL shows the format: https://example.com/sub?token=xxxx. It is only a text example and cannot be used to connect. Do not enter an ordinary website homepage as a subscription URL.

2. Add the subscription

   Go to Home → tap “+” in the upper-right corner → Type → Subscribe. Enter your subscription URL, add a recognizable note, and save. Check that SERVER entries appear under the subscription. To fetch the contents again, pull down on Home to refresh the subscription.

3. Select an entry

   Choose a server from your existing subscription in the Home SERVER list and verify that it is selected. For initial troubleshooting, stick with the same server. Changing entries and multiple settings at once makes it harder to tell what affected the result.

4. Allow the configuration

   Turn on the connection switch at the top of Home. When the system asks to add a VPN configuration, confirm the request is from Shadowrocket, tap Allow, and complete any requested authentication. If you previously declined, return to Home and try connecting again.

5. Test access

   Wait for the connection status on Home to change, then run Connectivity Test and visit a website you know is available in your browser. Note the connection status, test result, and what happens in the browser separately. A VPN icon in the system status area alone does not confirm that the remote service is working.

Home: connection status, routing modes, and the SERVER list

Home is where you connect and check the current status. If the top of the screen shows Not Connected, a connection has not been established; this does not by itself mean your subscription has expired. SERVER entries only indicate that server data is stored locally. You still need to select an entry, connect, and test actual access.

Region or purpose labels in SERVER entry names usually come from the subscription; they do not verify a server’s location or ability to provide access. When editing an entry, check that its protocol, address, port, and authentication details match the information you already have. For example, if the supplied details specify port 443, don’t change it to 80 just because a test failed. The port must match the server’s actual listening configuration.

Config and Settings: keep these three types of settings separate

Home is for selecting a server and connecting; Config manages configuration files; Settings controls app behavior. A collection of servers in a subscription is not the same as a rules file in Config. Importing servers does not provide routing rules suited to your network, and switching configuration files does not update your subscription URL.

• Home → Global Routing: Check the current mode first. Direct, Proxy, and Config use different routes, so note the mode before comparing test results.
• Config: Check which configuration file is enabled and where its rules point. In Config mode, every policy name referenced by a rule must exist in the current configuration.
• Settings → On Demand: Check whether connection triggers are enabled. For initial manual troubleshooting, you can temporarily turn them off to prevent automatic connections from interfering when network conditions change.

In a rules file, DOMAIN-SUFFIX matches domain suffixes, GEOIP matches against IP geolocation database results, IP-CIDR matches IP ranges, and FINAL catches traffic that did not match an earlier rule. This example is for syntax only; it is not a recommendation to replace your existing configuration. The range 192.0.2.0/24 is reserved for documentation examples.

[Rule]
DOMAIN-SUFFIX,example.com,DIRECT
IP-CIDR,192.0.2.0/24,DIRECT,no-resolve
GEOIP,CN,DIRECT
FINAL,PROXY

Rules are generally evaluated from top to bottom, so more specific conditions should come first. The example’s PROXY target must correspond to an available proxy. If your configuration uses a different policy name, verify the target before applying the rule. When getting started, confirm basic connectivity first, then add rules one at a time. This is easier to troubleshoot than changing the routing mode and an entire configuration at once.

Connectivity Test: check direct and proxy paths separately

Connectivity Test provides clues about connectivity; it is not a comprehensive check of every website, protocol, or app. Latency values in the list are not download speeds. Results depend on the test method, destination, and current network. If a test times out, note the server, routing mode, and network conditions instead of keeping only a screenshot of the red result.

For example, if the same server can reach a website in Proxy mode but fails in Config, the issue may be a rule match, policy selection, or related DNS setting. Don’t assume the server is down. If both modes fail while the direct connection works, check the server details and service availability. This illustrates a troubleshooting approach; it is not a test result for any particular network.

Common first-use questions: troubleshoot by symptom

After your first connection, keep a troubleshooting record

After a successful first connection, note the server label, routing mode, configuration file name, and network conditions used for testing. This can help you reproduce the setup if a problem occurs later. Do not include subscription tokens, passwords, or full authentication URLs. Refreshing a subscription can change the server list, so verify the selected entry again after each refresh rather than relying on an old label.

• Home: Check the connection status, selected SERVER, and Global Routing mode.
• Config: Check the enabled file and the target policies referenced by its rules.
• Settings → On Demand: Confirm that automatic connection behavior matches your expectations.
• Test: Keep both the Connectivity Test result and what you observed in the browser.