Cross-platform rule-based proxy client: import an existing subscription and use rule-based routing to control how connections are handled. iPhone / iPad: $2.99 one-time through the App Store; Mac, Windows, Android, and Linux: free.
iPhone / iPad: $2.99 one-time · Other platforms: free
[Routing]Match in orderConfig / Proxy / DirectiOS / macOS / Windows / Android / Linux
[Capability]
From connection methods to rule matching
Confirm the server details first, then choose a connection method. Rules, subscriptions, and Config address different needs; you do not need to change every option during the first connection.
[Rule]
Match from top to bottom; use the first match
In Home, select Config under Global Routing to match requests against the rules in the active configuration file, in order. Specific domain rules usually go before broader rules, with FINAL at the end as a fallback. PROXY sends requests to the proxy policy, DIRECT connects without a proxy, and REJECT denies the request. To troubleshoot, first confirm which file is active, then check the first rule matched by the target domain. Switching to Proxy or Direct changes the overall routing mode; it does not edit the rules in the file.
On Demand starts a connection when specified conditions are met. It does not select a server protocol or replace domain-based routing. First connect manually from Home and confirm that an existing server works, then review the On Demand conditions and system permissions in Settings. During testing, change only one network condition at a time and check whether the connection behaves as expected. After an automatic connection succeeds, Global Routing and the active Config still determine how requests are routed. If the connection needs to stay off, check the automatic trigger conditions as well as disconnecting.
[Rule]
DOMAIN,example.com,PROXY
FINAL,DIRECT
On DemandSettingsConfig
Global Routing
On Demand
Subscribe
Config
Add Server
[Protocol]
Set Type to match the server
Shadowrocket supports protocols including Shadowsocks, VMess, VLESS, Trojan, HTTP, SOCKS5, WireGuard, and Hysteria2. In Add Server, choose the Type specified by your existing server details, then check the address, port, and authentication fields. Do not guess TLS, SNI, or transport options from their names; get complete parameters from your service provider. The protocol determines how to connect to the server. The Rule example below determines which requests go through the proxy. Configure and check them separately.
Get the subscription link from your service provider. In Add Server, choose Subscribe, enter the complete link, and save. After updating, check that the expected servers appear in the list. A single share link describes one server, while a subscription can maintain a list; do not import a web page address or configuration file address as either of these. If an update fails, first check that the link is complete and authorization is valid, then check whether the current network can reach the subscription address. Subscription updates and Config updates serve different purposes and cannot replace one another.
[Rule]
DOMAIN-KEYWORD,example,PROXY
FINAL,DIRECT
SubscribeAdd ServerConfig
Global Routing
On Demand
Subscribe
Config
Add Server
[Config]
After editing a file, confirm it is active
Config manages configuration files, which commonly contain General, Rule, Host, and URL Rewrite sections. Keep a copy of the original file before editing. After making changes, save the file, confirm that the intended file is active, then test it using Config under Global Routing. The selected server in the server list and a configuration file are separate items; a file can exist without being active. To use iCloud sync, check the account, sync switch, and file status on each device. After syncing, confirm the selected configuration separately on each device.
[General]
dns-server = system
[Rule]
FINAL,DIRECT
GeneralRuleiCloud
Global Routing
On Demand
Subscribe
Config
Add Server
[Global Routing]
Config / Proxy / Direct: what is the difference?
Config handles requests according to the rules in a configuration file, which is useful when routing needs to vary by domain or address. Proxy routes requests through the proxy and is useful for temporarily testing a server connection. Direct connects requests without a proxy and is useful for checking the local network. These interface terms are related to PROXY and DIRECT in rules, but they are not the same settings. Note the original state before switching modes and restore it after testing, so a temporary test is not mistaken for the normal routing behavior.
For a first setup, import one server entry and check that its address, port, and authentication details match before connecting. When the system first requests VPN configuration permission, read the prompt and follow the steps to grant permission. Permission allows the client to establish a connection; it does not confirm that the server works. Check the status, destination access, and diagnostic information to determine whether the connection succeeded.
[Diagnostics]
Check connection status separately from access results
Connectivity Test helps check whether a server is reachable. Results depend on the current network, test method, and destination response, and do not necessarily reflect access to every website. Traffic statistics in Data show transfer activity; an increase alone does not confirm that a particular rule matched. To verify routing, choose a specific destination, check the request path in the connection log, then adjust the relevant rule.
If only some destinations have problems, check whether the target domain includes subdomains, whether an earlier rule takes precedence, and whether the current file is saved and active. If all requests fail, check the local network, server details, and subscription status. Changing one factor at a time makes it easier to compare results; changing the protocol, DNS, and rules together makes the cause harder to identify.
Two access options: iPhone / iPad is a one-time $2.99 purchase on the App Store; Mac, Windows, Android, and Linux versions are free. Desktop and Android installation files are provided at /dl/shadowrocket/ on this site. See the download guide for files by platform.
One-time $2.99 App Store purchase; Mac, Windows, Android, and Linux versions are free. iPhone and iPad share the purchase. Check the App Store page for system requirements. Before purchase, verify the developer, icon, and app ID, then check availability in your account's storefront.
Allow the VPN configuration when prompted by the system before connecting for the first time. After importing an existing subscription, select a server and test a manual connection, then configure Config and On Demand as needed. Purchasing the app does not provide server details.
Free · Apple Silicon / Intel. iPhone / iPad is a one-time $2.99 App Store purchase; Windows, Android, and Linux versions are also free. Check About This Mac for the chip or processor name, then choose the corresponding dmg. Do not guess based on appearance or purchase year.
If the first launch says the developer cannot be verified, confirm that the file came from this site, then check “Open Anyway” under “System Settings → Privacy & Security.” The download guide covers other warnings and steps. You do not need to disable system-wide protection in advance.
Free · 64-bit installer. iPhone / iPad is a one-time $2.99 App Store purchase; Mac, Android, and Linux versions are free. Check the system architecture before downloading. Save the installer before running it to avoid reopening an old file from browser history.
If SmartScreen appears, confirm the source and file name first, then choose “More info → Run anyway” to continue. Follow your administrator's policy on organization-managed devices. After launch, import your existing subscription or server details.
Free · arm64 apk. iPhone / iPad is a one-time $2.99 App Store purchase; Mac, Windows, and Linux versions are free. Open this site's download guide in a browser and save the file using the link on the page. If the download does not work inside WeChat, open the guide in your system browser.
When the system asks about the installation source, allow “Install unknown apps” only for the browser or file manager you are using. You can turn it off again after installation. The first connection also requires handling the system VPN permission prompt; installation permission and connection permission are separate.
Free · deb / rpm / AppImage. iPhone / iPad is a one-time $2.99 App Store purchase; Mac, Windows, and Android versions are free. Choose the format that matches your distribution's package management. A package extension is not a protocol or configuration file format.
AppImage needs executable permission; handle deb and rpm dependencies with the relevant package manager. The download guide lists the steps. Before installing, check your system architecture and file location. Use the actual downloaded file name in commands.
App verification, purchase, and configuration basics
Shadowrocket is a closed-source commercial application. This is the official Shadowrocket site and manual. Check the acquisition method, client purchase, and server requirements separately.
Before getting the app for iPhone / iPad, check that its name is Shadowrocket, compare its icon with the official icon on this page, and verify the developer, Shadow Launch Technology Limited, and app ID 932747118. A similar name is not enough to confirm an app's identity, and a matching search result should not be assumed to be the same app. Check the App Store page for system requirements instead of relying on an old guide's version information.
iPhone / iPad is a one-time $2.99 App Store purchase; Mac, Windows, Android, and Linux versions are free. The store may display prices in local currency; check the purchase confirmation page for the amount charged. Desktop and Android access does not involve this App Store purchase; choose the relevant installation file in this site's download guide.
If the app does not appear in the App Store, check your account region
The app is not available in the mainland China App Store storefront. Search results depend on the storefront associated with the current Apple ID; the device's system language and location settings are not the same as the store account's region. Check the country or region under “Media & Purchases” in your account settings. Before changing it, review the displayed requirements for balance, subscriptions, and payment methods, then follow the official process. Changing the device language repeatedly will not resolve storefront availability.
If a previous purchase does not appear on a new device, first confirm that the account used for “Media & Purchases” is the same account used for the original purchase, then check your purchased items. Seeing the app icon on another device does not by itself mean that the current account has the same purchase record.
Handle purchases, restores, and file backups separately
iPhone and iPad can share a purchase under the same account. When switching devices or reinstalling, get the app again from App Store purchases. Restoring the app and restoring local configuration are separate steps. Whether your original subscription URL, manually entered servers, and local rules remain available depends on your previous backup and sync settings. Downloading the app again does not automatically restore all data.
Keep a copy of the original file and note which item is active before editing a configuration. With iCloud, check the account, sync conditions, and file status. Do not overwrite a file on another device before syncing finishes. Before sharing diagnostic screenshots or rule snippets, remove personal subscription links, authentication details, and any server information you do not want to disclose.
Client purchase ≠ server plan
The client provides connection, rule processing, and management features. Users arrange their own servers and subscriptions. This site does not provide, sell, or recommend nodes or subscriptions. Get subscription links from your service provider and confirm subscription validity, server access, and authentication parameters with the original provider. Purchasing the client does not generate this information.
The iPhone / iPad client is a one-time $2.99 App Store purchase; Mac, Windows, Android, and Linux versions are free. Whichever access option you use, valid server details are still required. Subscription update failures, server authentication problems, and incorrect local rules need to be checked separately; getting the client again does not resolve them by itself.
App updates and subscription updates are different
Update the iPhone / iPad app through the App Store. Get app update files for Mac, Windows, Android, and Linux from this site's download guide. Keep your configuration before updating; afterward, check the existing files and selected status before testing the connection. Version information on this page is read dynamically from the download manifest. If your browser cannot retrieve it, check the download guide rather than using an article's publication date to estimate the installer version.
Subscribe updates the server list maintained by your service provider. Config updates configuration content, while an app update changes the client itself. These are separate operations. If an update creates duplicate entries or overwrites manual changes, check the subscription group and its maintenance method first. If routing changes after switching Config, check the new file's Rule and FINAL before deleting the original server entry.
Follow a clear checklist when connections fail
Start by checking whether the local network works, then check that the subscription imported successfully, server parameters are complete, the system allows the connection, the current Global Routing mode is correct, and the right Config is selected. Each step has its own result. Recording where the failure occurs is more useful than a general “it doesn't work” report. If only one website has a problem, check that destination's matching rules first.
For step-by-step instructions, read the setup guide. For English interface terms, see the terminology guide. For installation or connection problems, see Frequently Asked Questions. Rule syntax and complete examples are in the rule reference; On Demand and other options are covered in the settings guide. This helps avoid changing unrelated options during a single troubleshooting session.
[Notes]
Installation and routing guides
Start with a specific question: distinguish a single share link from Subscribe, manage Android installation permissions, or test routing for a domain with a minimal rule snippet. Example addresses demonstrate syntax only; they are not working servers.
Start with “send specified domains through PROXY and everything else DIRECT” to understand the order of specific rules and fallback rules. Learn when to use DOMAIN-SUFFIX, how to prevent a broader earlier rule from matching first, and how to check the active file and access results after saving.
Follow the steps for browser downloads, system permission for the installation source, and first-connection permissions. If the file cannot be saved in WeChat, open this site's guide in a browser instead. After installation, check your existing subscription and server details; completing the download does not complete the connection.
A single link describes server parameters; a subscription retrieves and updates a server list. They use different import and maintenance methods. Learn how to check prefixes and encoding, and what to inspect if a link is not recognized, so you can choose the right Add Server option for your information.
