How to Connect to Shadowrocket for the First Time: Select a Default Server and Run Connectivity Test

At a Glance

Your first Shadowrocket connection involves three separate checks: whether a server is selected in Home, whether iOS allows the VPN configuration, and whether your current network can reach a test destination through that server. This guide is for users who have already imported their own server or subscription. Follow the steps in order—select, authorize, test, and verify—so you don’t confuse the DOT indicator, VPN status, and website access.

1. Make Sure a Server Is Available in Home

Importing a server doesn’t connect you automatically. Go to Home, expand your subscription group, and make sure individual server entries are listed. If you see only the group name and no servers, address the subscription update or its contents first; repeatedly toggling the connection switch won’t help. This guide assumes you already have your own service provider and subscription; it does not cover choosing a service.

If you haven’t imported a server yet, tap “+” in the upper-right corner of Home to open the add screen. Select Subscribe under Type, enter your own subscription URL, save it, and then update the subscription. An update can change the server list. During your first connection check, avoid changing the subscription, rules, and multiple server settings at once, or it will be hard to identify the cause of a failure.

Check that an entry is listed: Make sure Home shows server entries rather than an empty list. A server name helps you identify an entry but doesn’t guarantee it will connect.
Verify the settings: Make sure the address, port, and authentication details match the information for your existing service. Port numbers aren’t universal; don’t copy one from another entry.
Check your network: Before connecting, make sure your current Wi-Fi or cellular network has internet access. If the Wi-Fi network requires a sign-in page, complete that authentication first.
Temporarily disable automation: Go to Settings → On Demand and review the automatic connection settings. For initial troubleshooting, turn off On Demand so a manual disconnect isn’t immediately overridden by an automatic connection rule.

2. Select a Default Server, Then Turn On the Connection

In Home, tap the server entry itself, not its edit option. The DOT indicator marks the currently selected default server; it is neither a test result nor confirmation of a successful connection. If you select a different entry, make sure the DOT moves to it before testing.

Select a Server

Home → Expand your group → Tap a specific server. Confirm that the DOT indicator appears beside it and note its name. Use this same entry for the tests that follow.
Check Routing

Home → Global Routing, then check the current option. To isolate the effect of rules during initial troubleshooting, you can temporarily select Proxy. If you’re using a rules configuration you’ve already checked, you can leave Config selected and note that condition.
Turn On the Connection

Return to Home and turn on the connection switch at the top. The first time you connect, iOS may ask to add a VPN configuration. Verify the app, allow the configuration, and complete any device authentication required by the system.
Check the Status

Wait for the status to stabilize and check whether the switch stays on. If it immediately turns off, address missing system authorization or a configuration error first; don’t assume the issue is with a website or rules.
Run a Test

Run Connectivity Test in Home and note whether it succeeds, fails, or times out. Then try the website you need to access. Keep the same server selected during both checks.

The system VPN indicator shows that the device has a VPN connection state; it does not, by itself, confirm that remote authentication, DNS resolution, and access to the destination website are all working. Status bar indicators can vary by device, so check both the in-app status and the system VPN status rather than relying on a label at the top of the screen.

3. How Global Routing Affects Your First Connection Test

Global Routing determines how traffic is handled; the DOT indicator only identifies the default server. One does not replace the other. The recommendations below are for initial troubleshooting: first reduce the number of variables to check the connection path, then restore your usual settings.

Proxy

Recommended

Routes traffic through the proxy, temporarily ruling out the effects of rules in Config. This doesn’t mean every type of system traffic on your device will use the selected server, nor does it guarantee access to a particular website.

Best for: Diagnosing your first manual connection and checking whether the selected server can handle proxy traffic.

Config

Handles traffic according to the rules in the active configuration. Rules may direct traffic to DIRECT, PROXY, or a policy in the configuration, so turning on the connection doesn’t mean a given webpage will use the default server.

Best for: Verifying everyday routing after confirming the configuration file and its rule policies.

Direct

Uses a direct connection and can’t verify whether a remote proxy server is working. If a webpage opens, that only confirms access under the current direct-connection conditions; it doesn’t confirm that server authentication is correct.

Best for: Comparing with a direct connection to see whether the issue occurs only when using a proxy.

Scene in Global Routing applies handling options based on the scene conditions you set. For your first connection, choose a clear manual option to avoid a network change triggering a scene switch and changing the conditions between tests. After temporarily using Proxy for diagnosis, remember to restore Config or another option that suits your needs.

4. How to Interpret Connectivity Test Results

Connectivity Test is a connection-checking tool, not proof that every website or app is accessible. A latency test in the server list is also different from an access test after connecting: a latency reading alone doesn’t confirm that authentication, transport, TLS, and the destination request are all working. One timeout doesn’t prove the service is permanently unavailable either.

Before the Test

Default server: The specific entry marked with a DOT in Home
Routing mode: Home → Global Routing → Current option
Network: The Wi-Fi or cellular network currently in use
Connection status: Whether the switch stays on and the system VPN status is established

Record these four details before testing so results from a different network aren’t confused with the original conditions.

After the Test

Test location: Home → Connectivity Test
Test result: Record whether the screen shows success, failure, or a timeout
Destination check: Open the same website you need to access in a browser
Retest conditions: Change only one thing at a time: the server or the network

There’s no universal latency threshold. Results depend on the test destination, network distance, and connection conditions.

If Connectivity Test succeeds but a particular webpage won’t open, keep the current server selected and check whether the issue affects only that domain. Then check DNS and the matching rules in Config. DOMAIN-SUFFIX matches domain suffixes, IP-CIDR matches IP address ranges, GEOIP matches based on an IP address’s geographic location, and FINAL handles traffic that doesn’t match an earlier rule. Don’t assume a request uses the proxy just because you see a PROXY rule.

If all access fails, check the server settings and network conditions first rather than rewriting the entire ruleset. For TLS connections, also verify that the system date and time are correct, along with fields such as the server name required by your service. Don’t disable security checks instead of correcting the settings.

5. Retest on Wi-Fi and Cellular with One Variable at a Time

The same server may behave differently on two networks. For a useful comparison, keep the server, Global Routing option, and destination website unchanged; change only the network. Wait for the connection to stabilize after switching, then reconnect and test again. Cellular availability depends on your device and plan, and testing uses mobile data.

Retest Plan: Change Only the Network

On Wi-Fi

Complete any required sign-in page authentication first.
Select the same server and note the Global Routing option.
After connecting, run Connectivity Test and visit the same website.
Note whether it fails immediately, times out after waiting, or works normally.

On Cellular

On a device that supports cellular, turn off Wi-Fi and confirm that cellular data is available.
Keep the same server and routing option; don’t update the subscription at the same time.
Reconnect, then repeat the same test and website check.
Compare the results with Wi-Fi; don’t use a single speed test to predict long-term performance.

If only one network fails, troubleshoot that network environment first. If both fail, focus on the server settings and service status.

6. First-Connection FAQs and Next Steps

I tapped a server. Why am I still not connected?

Tapping a server changes the default server in Home; it doesn’t connect you. First check the DOT indicator, then turn on the connection switch at the top and authorize the system VPN configuration. Selecting a server and establishing a connection are separate steps.

The switch turns off right after I turn it on. What should I check?

First check whether you missed a system authorization prompt or received a specific error, then check the VPN status in your device’s system settings. If the device is managed and adding VPN configurations is restricted, follow the applicable management requirements. Repeatedly deleting the configuration won’t remove a management restriction.

The VPN status is on, but websites won’t load. Am I connected?

VPN status alone isn’t enough to tell. Go to Home → Global Routing and confirm the expected option, run Connectivity Test, then open the destination website. If Proxy works temporarily but Config doesn’t, check the rules and policies in the active configuration first.

Why does it reconnect after I’ve manually turned it off?

Check Settings → On Demand first, then review the on-demand connection status for the VPN configuration in your system settings. Disable automatic triggers while troubleshooting and test the switch manually. Before turning automatic connections back on, make sure you know what should happen on each network.

Do I need to select a server again after updating the subscription?

An update may change server entries or their names. Go to Home and check that the original server is still there and that the DOT indicator is beside the intended entry, then reconnect and test. Don’t rely on the entry’s previous position in the list.

Your first connection is verified when the selected entry is clear, the connection status is stable, Connectivity Test returns a result you can check, and the destination website works as expected. After restoring your everyday Config and On Demand settings, revisit the destination to confirm that the changes haven’t introduced unexpected routing or automatic connections. Keep the results and conditions for future troubleshooting. Before sharing them, hide your subscription URL, authentication details, and any other sensitive information.