Shadowrocket can manage proxy configurations on an iPhone, but it does not provide a subscription by itself. You need an active subscription URL from your service and an iOS version of Shadowrocket that can read the configuration format supplied by that service. Once imported, the app can retrieve the available server entries, refresh them later, and create the iOS VPN configuration needed to route traffic through a selected server.
This guide walks through the complete process: prepare the subscription URL, add it as a subscription rather than as a single server, refresh the list, connect, and check that traffic is using the intended route. The names and positions of buttons can differ slightly between app versions, so use the function described here if a label is not an exact match. A subscription URL is sensitive account information: anyone who obtains it may be able to retrieve configuration details associated with it.
Before you import the subscription
First, confirm that Shadowrocket is installed and opens normally on your iPhone. App availability can depend on the country or region associated with your Apple Account. If you cannot find or download the app, check the availability information for your current store region and use only a legitimate distribution route. Avoid installing configuration profiles or apps from an unknown source just because a page promises a faster setup.
Next, sign in to the service that issued your subscription and locate the subscription or client-configuration section. Copy the URL intended for a compatible proxy client. A website may offer multiple links for different clients or formats; choose the one described as compatible with Shadowrocket or with the relevant iOS client. A browser may display a long string, an error page, or an unreadable response if you open the URL directly. That appearance alone does not prove the address is invalid: a subscription is intended for a client to parse, not necessarily for a browser to display as a normal web page.
Before copying, check that the complete URL is selected. Some account pages provide a copy button, while others require selecting the text manually. If you copy it by hand, make sure the selection does not omit the beginning or end, include surrounding punctuation, or introduce a line break. Do not edit the URL to make it look shorter. Subscription addresses can contain authorization data, and changing even one character can stop the client from retrieving the configuration.
It is also useful to distinguish a subscription from an individual server. A single-server configuration describes one connection entry. A subscription URL is an address that Shadowrocket uses to fetch and maintain a list of entries. Importing the latter as though it were a server address will not work: the client needs to know that the address is a subscription source.
3
Main stages: import, refresh, connect
1
Private URL to protect
Add the subscription in Shadowrocket
Open Shadowrocket and look for the add control, commonly shown as a plus sign. The app may offer several ways to add a configuration, such as scanning a code, entering a server manually, or adding a subscription. Choose the subscription option. Do not choose a protocol-specific server type unless your provider has explicitly supplied individual server details and you intend to create a single entry manually.
Paste the copied URL into the subscription URL field. If the screen also offers a remarks, name, or label field, enter a short description that helps you recognize the source later, such as the provider name or “Personal subscription.” The label is for your own reference; it does not change the subscription address or the server settings returned by the provider.
Review the address once before saving. Check that it begins and ends as expected, contains no leading or trailing spaces, and has not been replaced by a different link copied from another screen. Then save or confirm the entry. Depending on the app version, saving may immediately start a fetch, or it may return you to a list where you need to tap the new subscription to update it.
When the fetch completes, Shadowrocket should show one or more server entries, assuming the URL is valid and the returned configuration uses formats the app supports. A successful import does not necessarily mean the connection is active. It means the client received configuration data and created entries that it can display. You still need to choose an entry and connect.
If iOS asks whether Shadowrocket may add VPN configurations, review the prompt and allow it if you want to use the app’s VPN routing. iOS may request device authentication, such as the passcode or biometric confirmation. This is a system permission for creating a VPN configuration, not a request to reveal your subscription URL. If you decline, the subscription may still appear in the app, but the client may be unable to establish a system-level connection until you enable the required permission.
Refresh the list and select a server
After importing, update the subscription if Shadowrocket has not already fetched it. Look for an update or refresh action in the subscription entry’s menu, or open the entry and use the refresh control provided by your version. Wait for the operation to finish before judging the result. If the list is empty, check whether the refresh reports an error; repeatedly tapping refresh without reading the result can hide the distinction between a network problem, a rejected URL, and an unsupported response format.
Choose a server entry based on the task you need to perform and the location it represents. A server label is a useful identifier, but it is not a complete description of the route, application compatibility, or current network conditions. If a particular service requires an exit in a specific region, select an entry labeled for that region, then verify the result rather than assuming that the label alone proves the route.
Shadowrocket can also offer routing modes or rule-based behavior. For an initial check, use a mode that makes it clear whether the selected traffic is going through the proxy, and avoid changing several routing rules at once. If you use a rule-based mode, some traffic may intentionally connect directly while other traffic uses the proxy. A browser test can therefore differ from an app that follows a different rule. When troubleshooting, simplify the route temporarily if you understand the consequences, then restore your preferred rules after testing.
Once an entry is selected, tap the connection control. The first connection can trigger another iOS permission prompt or require confirmation that the VPN configuration should be used. Approve the system prompt if you intend to connect. Wait for the app’s status to change and for the iOS VPN indicator to appear; the exact indicator can vary by iOS version and device settings.
Connect and check the route
Use this short sequence after the subscription has been added. It separates a configuration-import issue from a connection issue and makes it easier to identify where to troubleshoot.
- Refresh: Update the subscription and confirm that server entries are visible. If the list is empty or an error appears, resolve the import or update problem before attempting to connect.
- Select: Choose one server entry whose displayed region is appropriate for your task. Avoid switching locations while the first connection attempt is still in progress.
- Connect: Start the connection and approve any iOS VPN permission request. Check both the app’s state and the system VPN indicator.
- Verify: Open a browser-based IP-check service you trust and compare the reported public exit location with the selected route. Then test the specific app or website you actually need.
One successful browser check is useful, but it is not a universal proof that every application uses the same path. Some apps cache connections, use their own network behavior, or are affected by routing rules. If the IP check shows the expected exit but a particular app still behaves differently, close and reopen that app, check its network permissions, and review the routing mode before changing the subscription.
For readers comparing client options or looking for general service information, the Free VPN for China overview is available from the site homepage. Keep the current troubleshooting focused on the iPhone setup: the subscription source, the selected server, the iOS VPN permission, and the traffic path each play a separate role.
- ✅ The subscription entry is saved and a refresh completes without an error
- ✅ A server entry is selected before starting the connection
- ✅ iOS shows that the VPN configuration is active
- ✅ The reported exit location is consistent with the selected route
- ❌ Treating a visible server list as proof that traffic is already routed
- ❌ Assuming every app follows the same rule or uses the same network path
Fix import and connection errors
The subscription will not save: Confirm that you selected the subscription function rather than a manual server type. Copy the URL again from the official account page, paste it without extra spaces, and try saving once more. If the input field is truncated visually, scroll within it or use the app’s copy-and-paste controls to confirm that the full address was entered. Do not remove query parameters or other characters that look unfamiliar; they may be required for authorization.
Refresh fails or returns no entries: Check whether the iPhone has a working internet connection before Shadowrocket is connected. If the URL was copied some time ago, obtain a fresh copy from the provider’s account page. Confirm that the selected link is intended for Shadowrocket and that the subscription has not been disabled or replaced. If the provider offers client-specific links, importing a format intended for another application may produce an unsupported response even when the URL itself can be opened.
The entries appear, but connection fails: First check that iOS permission was granted and that no other VPN app is currently trying to manage the system connection. If another client is active, disconnect it before testing Shadowrocket; simultaneous VPN configurations can conflict or make the result difficult to interpret. Then retry with a different available entry, check that the iPhone’s date and time are set automatically, and review any connection error shown by the client. Do not alter advanced protocol parameters in a subscription-managed entry unless you know the provider expects a manual override.
The VPN indicator appears, but a site or app does not work: Confirm the exit route with an IP check, then test the target service again. If a browser works but another app does not, inspect the routing mode and the rules that apply to that app. Also check whether iCloud Private Relay or another network privacy feature is active, since overlapping network tools can make route checks confusing. For a clean comparison, test one feature at a time and restore the settings you normally use afterward.
iOS keeps showing a permission prompt: Read the prompt and verify that it is the expected system request to add or use a VPN configuration. If you previously declined it, return to Shadowrocket and initiate a connection again so iOS can present the permission flow. Avoid approving unrelated configuration profiles or certificate prompts merely because they appear during setup; those are different from the normal VPN permission request.
Keep the subscription current
A subscription may be updated when the provider changes its available entries or configuration details. To refresh it later, open the subscription section in Shadowrocket and use the update action for the saved source. Refreshing is different from creating a new subscription: if the existing entry is correct, update it rather than repeatedly adding copies. Duplicate entries make it harder to tell which source is current and which server list you selected.
If an update stops working after a period of normal use, start with the least disruptive checks. Confirm that the iPhone is online, try the refresh again, and verify that the saved address still matches the current one in your account. If you recently copied a replacement URL, edit or replace the old subscription using the app’s available controls instead of keeping several similarly named entries. The exact menu path can change between Shadowrocket versions, so confirm the entry name before removing anything.
Keep app updates and iOS updates in mind when diagnosing a newly appearing problem. A client update may change labels or compatibility behavior, while a system update may require you to approve the VPN configuration again. After an update, confirm that the subscription still refreshes, the selected entry can connect, and the traffic check still matches the intended route. If only one server fails, compare another entry before concluding that the whole subscription is unusable.
When asking a provider or app support team for help, describe the stage that fails: saving the URL, refreshing the subscription, creating the VPN configuration, connecting, or reaching a particular service. Include the visible error text and your iOS and app version when requested. Do not include the full subscription URL in a public screenshot or message; redact it first, because it may grant access to your configuration.