Shadowrocket setup, and the iOS quirks that drop you
Buying and installing Shadowrocket, importing subscriptions and single nodes, and the four iOS-specific settings — On Demand, Private Relay, Low Power Mode, stale VPN profiles — that disconnect you for no apparent reason.
Shadowrocket is the most widely used proxy client on iOS. This covers the setup and, more usefully, the iOS-specific problems you will not meet on any other platform.
Step 1: buying and installing
The app is not in every App Store region, so you may need an Apple ID registered elsewhere.
Price: about $2.99, one-time. Not a subscription.
Step 2: import a subscription
- Open Shadowrocket
- Top right +
- Type: Subscribe
- Paste the subscription URL
- Give it a name
- Done
The node list should fill. If it stays empty: No nodes after importing.
Faster route
Open the subscription link in Safari. If the provider supports it, iOS offers "Open in Shadowrocket" and imports automatically.
That is what a provider's "one-click import" button uses.
Step 3: import single nodes
For an ss://, vmess:// or trojan:// link:
Fastest: copy the link, switch to Shadowrocket, and it offers to import from the clipboard.
Manual: + → choose the protocol → fill in the fields.
In bulk: one link per line, select all, copy — Shadowrocket will take the batch.
Step 4: connect
- Tap a node so it shows a checkmark
- Return to the main screen, flip the toggle at the top
- First time, iOS asks to add a VPN configuration — allow it and enter your passcode
Verify: open any IP lookup page in Safari and confirm the region matches your node.
Step 5: set the global routing mode
Bottom Settings → Global Routing:
| Option | Behaviour | When |
|---|---|---|
| Config | Uses your rules | Day to day |
| Proxy | Everything proxied | Debugging only |
| Direct | Nothing proxied | Effectively off |
Choose Config. It applies the rules from your subscription or the defaults — local traffic direct, foreign traffic proxied.
The iOS quirks
This section is why the article exists. None of these happen on Android or desktop.
Connect On Demand disconnects you
Symptom: it shows connected, then suddenly nothing loads. Or it drops after the screen has been locked a while.
Cause: Connect On Demand lets iOS disconnect the tunnel whenever it decides you do not need it.
Fix: Settings → turn Connect On Demand off. Or restrict it to specific Wi-Fi networks.
Low Power Mode kills the background process
Symptom: stable while charging, unstable on battery.
Cause: Low Power Mode tightens background limits.
Fix: turn it off while you need the proxy.
iCloud Private Relay fights the proxy
Symptom: some sites work, others do not; Safari behaves differently from other apps.
Cause: Private Relay routes part of Safari's traffic through Apple's relays, which collides with your proxy.
Fix: Settings → [your name] → iCloud → Private Relay off.
Leftover VPN profiles
Symptom: strange behaviour after reinstalling, or several profiles competing.
Fix: Settings → General → VPN & Device Management → delete everything you are not using, then re-add.
Settings worth changing
Subscription refresh interval
On the subscription row in the node list.
- Paid: 24 hours
- Free: 4–6 hours
Pin a node for AI tools
Shadowrocket can route specific domains to a specific node.
Config → Rules → add:
Type: DOMAIN-SUFFIX
Value: openai.com
Policy: a fixed node (not an automatic or load-balancing group)Repeat for chatgpt.com, claude.ai, anthropic.com.
Why it matters: a changing exit IP makes AI services treat the session as compromised. See Using ChatGPT over a free VPN.
Save your data allowance
On a metered plan, route iCloud Photos backup and system updates direct.
I skipped this in my first month and photo backup quietly consumed tens of gigabytes through the proxy.
Leave the advanced features alone
Shadowrocket includes MITM, scripting and rewrite modules. If you do not need them, do not enable them — they cost battery and add failure modes.
MITM in particular requires installing a root certificate. Do not go near it unless you know exactly why you are doing so.
If you would rather not pay
The official sing-box iOS client is free, capable, and supports a wider protocol range including Hysteria2 and TUIC.
The trade is a more technical interface. See sing-box setup.
My own view: three dollars for a tool you will use for years, with documentation everywhere, is worth it — especially at the start, when "easy to search for" has real value.
Read next
- sing-box setup
- Public subscription links that still update
- No nodes after importing a subscription
- Connected but nothing loads
Questions people keep asking
How much does Shadowrocket cost?
Around $2.99 on the US App Store, a one-time purchase rather than a subscription. It is not available in every region's store, so you may need an Apple ID registered elsewhere to buy and download it.
Can my family use the same purchase?
Yes. Family Sharing covers purchased apps, or you can sign into the App Store with the same Apple ID on another device without touching its iCloud account. Remember which ID bought it, because updates require that ID.
Why does it keep disconnecting?
On iOS, three culprits account for most cases: Connect On Demand disconnecting when the system thinks you do not need it, Low Power Mode throttling background activity, and iCloud Private Relay conflicting with the proxy. All three are covered below.
Shadowrocket, Stash or sing-box?
Shadowrocket has the deepest documentation, so problems are easy to search — best for beginners. Stash handles Clash configs more faithfully if you are migrating from desktop. sing-box is free and supports the widest protocol range but has a more technical interface.