Rule-based routing
Send traffic to proxy or Direct by domain, IP, or policy group. You can subscribe to rule sets and update them.
iOS / iPadOS · Network-policy client
Shadowrocket
Applies proxy and Direct by rules, imports subscriptions or a single server, and runs through the system VPN interface. This site provides the App Store download entry and how-to notes.
Download
Get it only from the Apple App Store. Full notes are on the download page.
Install from the App Store
- Open the App Store and search for Shadowrocket.
- Confirm the app name, icon, and developer, then buy.
- Launch it from the Home Screen after install.
- Other devices on the same Apple ID can install from Purchased.
Region and account
- If the current store cannot find it, that is usually a storefront limit, not a removal.
- Buy with an Apple ID from a region that lists the app, or open the product link on this page.
- Sign out of the current App Store account before you switch. After purchase, that account can install again.
- If nodes or rule subscriptions come from a third party, those fees are billed separately from the App Store price.
Sources to avoid
- Unsigned IPA files, third-party stores, and packages shared on cloud drives.
- Files labeled “free,” “cracked,” or “Shadowrocket for Android.”
- Copies that require an enterprise certificate or a configuration profile before they open.
This site does not provide any install file. Non–App Store sources cannot be verified and do not receive official updates.
| Devices | Follow the App Store product page. Usually iPhone and iPad. |
|---|---|
| System | iOS / iPadOS with Network Extension. The minimum version is on the App Store product page. |
| Permission | On first launch you must allow a VPN configuration, or the connection switch does nothing. |
| Configuration | The subscription URL, QR code, or server parameters come from your provider. This site does not provide nodes. |
Features
A short list of client capabilities. Full notes are on the features page.
Subscription import
Supports a subscription URL, clipboard, QR code, and Safari handoff. After import you can update by hand or on a schedule.
Multiple server protocols
You can add the proxy protocols your provider supplies. Display names are only labels. They are not used to connect.
System VPN interface
Uses the iOS Network Extension. No jailbreak. A VPN icon in the status bar means connected.
Latency and connectivity
You can latency-test nodes to compare them in the list. Results depend on the network at that moment and are not a standalone availability verdict.
DNS and local mapping
You can set a DNS server and local domain mappings. When a few sites fail, separate a DNS problem from a rule problem first.
On Demand
Connect or disconnect automatically by Wi-Fi / cellular and similar conditions. Use it to flip the switch less often. Confirm it in both the system and the app.
Configuration backup
You can export a configuration or back it up with iCloud / the Files app. After you change devices, restore the configuration first, then grant VPN.
How to use it
This is a summary. Full steps and screenshots are in the illustrated tutorial.
Steps
- Install Shadowrocket from the App Store and open the app.
- When the system asks to add a VPN configuration, choose Allow and finish Face ID / passcode confirmation.
- Open Settings → General → VPN & Device Management and confirm the Shadowrocket configuration is there.
- If other VPN apps are installed, confirm the system VPN points to Shadowrocket before you connect.
- Return to the app. An empty node list is normal. Import a configuration next.
If permission is denied
- Screen Time may block VPN. Check content and privacy restrictions in Settings → Screen Time.
- A school or company profile may forbid adding a VPN. An administrator has to change that. Reinstalling the app will not help.
- Deleting the app does not always remove the VPN configuration. Remove it from the system VPN list, then install again.
Three import methods
- Subscription URL: copy the URL, open Shadowrocket, and choose Add from Clipboard in Config (or the + on Home). Some links open in Safari and hand off to the app.
- QR code: choose Scan on the Config page and point at a printed or on-screen code.
- Single server: choose Add Server and fill in protocol, address, port, password or UUID, and the rest. Values must match the provider.
- Tap Update after import. Success means nodes appear in the home list.
- Several subscriptions can coexist. If an update fails, check that subscription URL. Do not delete every configuration.
After import
- Check whether the subscription name and node count match the provider’s notes.
- See whether a rule set was imported with it. If you have nodes but no rules, Home can still start on Rule, or follow the provider.
- You can change display names. That does not change server parameters.
- This site does not provide subscriptions or nodes. Without a configuration, the app cannot create a proxy connection.
First connection
- Select a node on Home. You do not need a speed test first. Use one the provider marks as usable.
- Turn the connection switch on. A VPN icon in the status bar means the system tunnel is up.
- Verify with a site or app you normally use. If it opens, you are done.
- To change nodes, tap another one, or disconnect and connect again.
- Turning VPN off in Control Center is a disconnect. To use it again, turn the switch on in the app.
After you connect
- VPN icon present, in-app switch on, but a page fails: check the mode and DNS first, then change the node.
- The icon appears and vanishes at once: the system usually rejected the configuration, or another VPN took over. Return to the install section.
- Fails only on cellular or only on Wi-Fi: check On Demand and whether that network blocks VPN.
- The widget and the in-app switch control the same connection. Do not flip both.
Home modes
- Rule: proxy or Direct by domain or IP. Use this for daily work.
- Proxy / Global: most requests go through the current node. Use it to compare a failure. Do not leave it as the long-term default.
- Direct: skip the node. Use it to see whether the fault is the node or the local network.
- Scene: some versions switch policy by scene. Follow the labels in the UI.
Rules and policy groups
- Rule sets can be subscribed on their own. Updating rules does not automatically change the node you selected.
- A policy group collects several nodes and picks an exit by latency or by hand.
- After you edit rules, confirm the home mode is still what you expect, then judge speed.
- Whether “global is faster” or “rules are faster” depends on the destination and the node. There is no fixed winner.
Check order
- The switch drops immediately: check whether the VPN configuration is still there, and whether another app is using it.
- Every node fails: update the subscription; if it still fails, change the node. Avoid retrying the same timeout in a loop.
- Only some sites fail: switch to Global briefly to compare. If Global works, check rules and DNS.
- Certificate or TLS errors: check the system date and time first.
- Subscription update failed: see whether the URL expired, and whether the current network can reach the update host.
- High battery use or heat: check whether Global was left on, or whether rules send a large share of traffic into the proxy.
What not to do at the same time
- Changing the node, the mode, DNS, and reinstalling at the same time. Change one thing at a time.
- Reinstalling over and over before VPN permission is confirmed.
- Treating one high latency-test spike as a permanently dead node.
- Overlaying a “fix package” from outside the App Store.
Common settings
Names follow the installed version. Full notes are on the settings page.
| Configuration updates | Subscriptions can update by hand or on an interval. If the node list looks wrong, update first, then change other items. |
|---|---|
| Latency test | Compares a node’s round-trip time. The probe address and the network at that moment affect the number. It does not replace a real page load. |
| DNS | You can set a remote or local DNS. If only some domains fail, suspect DNS or rules before a mistyped server address. |
| IPv6 | If IPv6 is broken on the current network, disable or bypass it as the provider describes, to avoid handshake failures. |
| UDP | Some protocols, games, and calls need UDP. If the provider does not offer UDP, those apps may fail. That is a configuration limit. |
| On Demand | Can turn on or off by network type. If rules conflict, trust the system VPN state. |
| HTTPS Decryption | An advanced debug feature. It needs a local certificate. Use it only for traffic you explicitly need to inspect. Keep it off for daily use. |
| Backup and restore | Export the configuration before you upgrade the system or change devices. After restore, you must allow the VPN configuration again. |
Do I need a jailbreak?
No. Shadowrocket runs on non-jailbroken iOS / iPadOS through the system VPN interface.
Do I pay monthly after I buy the app?
The app is a one-time purchase. Fees for third-party nodes or subscriptions are charged by that provider and are separate from the App Store price.
Is there an Android version?
No. Do not install packages labeled “Shadowrocket for Android.” Android needs a client for that platform.
What if I cannot find the app?
Open the App Store link on this page first. If it is still unavailable, that storefront does not list it. Buy with an Apple ID from a region that does.
The switch is on, but I have no internet?
Confirm the status bar shows a VPN icon. If it does, change the node or compare modes. If it does not, return to the VPN permission check.
Can I run two VPNs at once?
iOS usually allows only one VPN configuration at a time. When another VPN app connects, Shadowrocket is disconnected.
Does the configuration remain after I delete the app?
The system VPN configuration may remain. Remove it in Settings → General → VPN & Device Management. Subscription content follows the next import.
Does this site provide nodes?
No. The download entry points to the App Store. Features follow the version installed on the device.