Shadowrocket First Connection: Select a Server and Run Connectivity Test

At a glance

This guide is for first-time Shadowrocket users who already have service provider details. The steps are: confirm the import, select a default server, check Global Routing, allow the system to add a VPN configuration, then run Connectivity Test and verify access in a browser. The connection switch being on, a test returning a result, and a web page loading are three separate checks; verify each one.

1. Before connecting: confirm the server details are imported

Use Home to view and select servers, Config to manage configuration files, and Settings to adjust app preferences. For your first connection, stay on Home and confirm that the list contains server entries. Saving a subscription URL alone does not mean its server details have been retrieved. This guide assumes you already have your own provider and subscription.

If you have not imported any servers, tap “+” in the upper-right corner of Home, choose Subscribe under Type, enter your subscription URL, save it, and then update the subscription. After the update, check that server entries appear beneath it. When adding a server manually, Type must match the protocol in your existing details; do not mix fields from different protocols.

Address is the server address; Port is the server port. Use the exact port in your existing details. Even when using TLS, do not change it to 443 based on assumptions.
Password, UUID, and Private Key serve different purposes. Fill in only the fields required by the current protocol; do not substitute credentials from another protocol.
If the list is empty, first check the subscription update result, confirm the address is complete, and make sure the current network can reach the subscription source. Repeatedly toggling the connection will not add missing server details.
Subscription URLs, passwords, and keys are sensitive. Mask them when recording errors; do not include complete credentials in screenshots or support requests.

2. First connection: select a server and allow the VPN configuration

The selection indicator on Home marks the current default server. Tap a server row and check that the dot on the left moves to the intended entry. Opening the edit screen does not select a server. Rules may explicitly use a different policy or server, so the actual connection can still depend on your configuration. Check Global Routing as well.

Select a server

On Home, tap an imported server row and confirm that a selection dot appears on the left. For the first test, use one server at a time so you can tell which result corresponds to which action.
Check routing

Go to Home → Global Routing and check whether the current mode is Proxy, Direct, Config, or Scene. Use Config if you have a working ruleset. To temporarily isolate the effect of rules, use Proxy for a comparison test.
Turn on the connection

Return to Home and turn on the connection switch at the top. The first time you connect, the system asks for permission to add a VPN configuration. Confirm that the request follows your action, allow it, and complete device authentication as prompted.
Check the status

Return to Shadowrocket and check that the switch stays on. Permission to add a configuration only grants the ability to establish a VPN connection; it does not confirm that the remote server is reachable or that a website has loaded successfully.
Run a test

Run Connectivity Test on Home and wait for a result. Then open a browser and test a page you actually need to access. Note the current server, Global Routing mode, and test result as a baseline for troubleshooting.

If you previously denied system permission, turn the connection on again and follow the prompts. If the device is managed by an organization and system settings explicitly restrict VPN configurations, check with the device administrator. Reimporting the same details will not resolve a system permission issue.

3. Global Routing: understand the four routing modes

Global Routing determines how connections are handled; it is not an indicator of server availability. In Direct mode, a website loading does not prove that the selected proxy server works. The modes below describe routing within Shadowrocket. The recommendation to use Config assumes that you have selected and checked a rules configuration.

Config: route according to your configuration

Recommended

Routing follows the selected Config and its rules. Traffic may use DIRECT, PROXY, or a policy defined in the configuration. The mode name alone does not tell you where traffic for a particular domain will go.

Best for: everyday use with a rules configuration you understand.

Proxy: proxy mode

Route app traffic through the proxy mode. Use this to temporarily check whether the selected server can handle requests. When the test is done, restore the mode you normally use.

Best for: a brief comparison test that isolates rule-related factors.

Direct: direct mode

Handle traffic in direct mode rather than using the selected proxy server for ordinary access. If a page loads in this mode, that only confirms the direct route is working.

Best for: comparing direct access on your current network.

Scene: scene mode

Use the routing behavior associated with your configured scene conditions. During initial troubleshooting, check the scene settings first so you do not mistake behavior changes caused by switching scenes for a server problem.

Best for: setups with scenes already configured and reviewed.

In Config, rules are matched from top to bottom. DOMAIN-SUFFIX matches domain suffixes, IP-CIDR matches address ranges, GEOIP matches IP geolocation, and FINAL provides a fallback. You do not need to rewrite rules for your first connection. First confirm which configuration is selected, then check which policy matches the request.

4. Connectivity Test: read the result, not just the switch

Connectivity Test checks connectivity; it is not a full speed test and does not verify every domain or protocol. A reported duration means the test request received a result. A timeout means that check did not finish within the allowed time. Do not assume a timeout means the password is wrong, or use a single duration to estimate everyday browsing speed.

Two checks: the test request and actual access

Check in Home

Keep the selected server fixed, leave the connection switch on, and run Connectivity Test.
Record the reported duration, timeout, or other error text—not just “success” or “failure.”
For repeat tests, keep the network and routing mode the same to reduce variables.

Check in a browser

Reload the page you need to use and confirm that its content and required resources finish loading.
If only one site has a problem, note its domain and the specific error, then check where its rules route it.
If you switch between Wi-Fi and cellular, record the results separately. Do not combine data from the two networks.

Bottom line: check both the test result and actual access. If they do not match, first look for differences in the test target, DNS resolution, rules, and current network.

For example, “the switch stays on, Connectivity Test times out, and the browser cannot load the target page” is different from “the test returns a duration, but one target domain fails.” In the first case, check the network, server parameters, and service status. In the second, start with that domain’s resolution and routing. These are examples of how to classify results, not test findings for any particular service.

5. Connections can change: check On Demand and your test baseline

If the connection turns back on after you switch it off manually, On Demand settings may be involved. Go to Settings → On Demand to review the current settings, then check the corresponding VPN configuration’s On Demand status in the system settings. On Demand triggers connections based on configured conditions; it does not fix an incorrect Address, Port, or authentication field.

Manual test baseline

Server selection: Home → tap the target server and confirm the dot on the left
Routing: Home → Global Routing
Test: Home → Connectivity Test
Record: Network type, routing mode, selected server, and result

Change one condition per round to compare results before and after.

Check automatic connections

In the app: Settings → On Demand
Check: Enabled On Demand conditions and their corresponding actions
In system settings: On Demand status for the corresponding VPN configuration
Troubleshooting method: Record the original settings, temporarily disable automatic triggers, then test manually

Once you have identified the cause, restore the settings to suit your needs. Do not leave a temporary troubleshooting setup as your long-term configuration.

Before and after switching networks, also check the status of other VPN connections to avoid interference between connection attempts. To check whether the current server works, keep the network, server, and Global Routing mode fixed, then run a complete test. This makes it easier to find the cause than changing several settings at once.

6. Common questions about the first connection

The server is imported. Why do I still need to select it?

Importing adds server details to the list; selecting one sets the default server. On Home, check that the dot on the left is next to the intended entry. If rules in Config explicitly specify another policy, also check where that policy points.

The switch is on, but the page keeps loading. What should I do?

First run Home → Connectivity Test, then check Home → Global Routing. If the test times out, check Address, Port, and authentication fields. If the test returns a result but the target page fails, check the domain’s rules and resolution. Do not reset the entire configuration right away.

Proxy works but Config does not. Is the server broken?

This difference points first to routing configuration; it does not by itself prove that the server is faulty. In Config, confirm which configuration file is selected, then check whether an earlier rule matches the target domain and which policy FINAL uses. Save the original configuration before making changes.

I denied permission to add a VPN configuration. Do I need to import everything again?

Return to Home, turn on the connection again, and respond to the system permission prompt. Server details and system VPN permission are separate. Reimport only if the details are actually missing or incorrect; otherwise, you may end up with duplicate entries that are hard to tell apart.

Wi-Fi works, but cellular does not. What should I check next?

Keep the same server and Global Routing mode, then run Connectivity Test on each network and note how the errors differ. Check whether Settings → On Demand has different network triggers, and confirm that cellular data can access the internet normally.

A successful first connection is not just seeing a VPN status. You should be able to identify the selected server, the routing mode, the Connectivity Test result, and whether the target page works as expected. Keep these four details as a baseline for comparison when you update a subscription or adjust Config.