Setting up a VPN on an iPhone with Shadowrocket is not difficult, but the process has several separate parts that are easy to confuse. You need a compatible iOS client, a valid subscription URL, at least one usable server profile, and permission from iOS to create a VPN configuration. After that, you still need to verify that the selected route is being used by the intended app. Seeing a VPN icon in the status bar confirms that iOS has created a tunnel, but it does not by itself prove that the subscription was parsed correctly, that the selected server is reachable, or that the target app is following the expected routing rules.

This guide explains the complete Shadowrocket workflow for iPhone users: preparation, app installation, subscription import, server selection, permission approval, connection testing, and basic troubleshooting. The same principles apply to many other compatible clients, although button names and supported protocols can differ between applications. Always obtain the client and subscription information from the official service dashboard or an official distribution channel. Avoid copying configuration URLs from public posts, screenshots, or unknown websites.

iPhone VPN Setup Guide: Import Subscriptions in Shadowrocket

Prepare your iPhone and Shadowrocket

Before opening Shadowrocket, confirm that your iPhone can install the application from the App Store region associated with your Apple account. App availability may vary by region, and an application that appears in search results for one account may not appear for another. Use the exact application name and check the developer information carefully. Do not install a similarly named application simply because it has a matching icon or a large number of downloads.

You should also have the subscription URL ready in a safe place. A subscription URL often contains an account-specific token. Anyone who obtains it may be able to retrieve the same configuration data, so do not publish it in a chat group, paste it into a public issue, or include it in a screenshot. If the service dashboard offers a copy button, use that rather than retyping the address. A single missing character, an extra space, or a line break can cause an import failure.

YJVPN supports Windows, macOS, iOS, Android, and Linux. If you use the official client, the account dashboard may provide a simpler sign-in and configuration workflow. Shadowrocket is more useful when you want to inspect subscription entries, choose a specific server, switch routing modes, or work with compatible formats such as Shadowsocks, VMess, Trojan, Hysteria2, or WireGuard. Support for a protocol depends on both the subscription format and the client version, so an import option alone is not proof that every entry will work.

For a first setup, keep the configuration simple. Do not import several unrelated subscriptions at the same time, and do not run two VPN clients simultaneously. Multiple applications can compete for the iOS VPN profile, modify routing behavior, or make it unclear which client is currently active. If another VPN, DNS filter, security application, or device-management profile is enabled, temporarily note its settings before troubleshooting Shadowrocket.

Install Shadowrocket and import the subscription

After installing Shadowrocket, open it and review the main configuration areas before connecting. Depending on the application version, you may see sections for servers, subscriptions, local files, routing rules, and connection status. The exact interface can change, but the workflow remains similar: add the subscription source, update it, select an imported server, and then start the connection.

Copy the subscription URL

Sign in to the YJVPN account dashboard and open the client or subscription section. Choose the iOS-compatible subscription entry if the dashboard provides several formats. Copy the complete URL. Do not manually remove query parameters, replace the protocol prefix, or shorten the address with a third-party service. Those details may be required for authentication or format detection.

If the dashboard offers a one-tap import link, you can use it when iOS allows the link to open Shadowrocket directly. If it does not open the application, copy the URL and add it from inside Shadowrocket instead. A direct link and a copied URL should lead to the same configuration source, but the internal import method is easier to inspect when something goes wrong.

Add and update the subscription

In Shadowrocket, open the subscription management area and choose the option to add a subscription. Paste the URL into the address field, give it a recognizable local name if the application asks for one, and save it. Then trigger an update. A successful update normally produces a list of servers or profiles and records a recent update time. If the list remains empty, the problem may be the URL, network access to the subscription service, an unsupported format, or an expired account authorization.

When an import fails, start with the least complicated checks. Confirm that the URL begins with the expected secure web address, that no spaces were inserted before or after it, and that the entire token was copied. If you copied the link through a messaging application, try copying it again from the account dashboard. If the service dashboard permits regeneration, create a new subscription URL and revoke the old one when you believe it may have been exposed.

• ✅ Copy the complete subscription URL from the account dashboard
• ✅ Update the subscription before choosing a server
• ✅ Keep only the configuration source you need during the first test
• ❌ Do not publish the URL or share it in screenshots
• ❌ Do not assume an empty server list means the iPhone itself is broken

Importing a subscription does not necessarily select the best route automatically. Imported entries may be grouped by country, city, protocol, or service purpose. Read the names carefully, but do not treat a name such as “fast” or “premium” as a measurable guarantee. A better starting point is to select a route near the destination service or the region you need, then compare behavior under your own network conditions.

Select a server and choose a routing mode

Shadowrocket commonly supports more than one routing approach. A global mode sends supported traffic through the selected proxy route, while a rule-based mode decides whether traffic should use the proxy, connect directly, or be rejected according to matching rules. The names and available options can vary, so read the application’s current labels rather than relying on instructions written for an older release.

Global mode is useful as a short diagnostic step because it reduces the number of possible routing explanations. If a target service works in global mode but not in rule-based mode, the server may be fine and the issue is more likely to be a rule match, DNS decision, or application-specific exception. Rule-based mode is usually more practical for daily use because local services and nearby traffic can remain direct while selected destinations use the proxy route. However, it requires rules that cover the actual domains and processes involved.

Select one server and connect before changing several settings. If the first route does not work, stop the connection, choose another compatible entry, and test again. Changing the protocol, DNS behavior, routing mode, and server at the same time makes the result difficult to interpret. Shadowsocks, VMess, Trojan, Hysteria2, and WireGuard do not have identical transport behavior, and a client may expose different options for each protocol. Use the parameters delivered by the subscription rather than inventing values from another profile.

Some users expect an IEPL, BGP, or CN2 label to determine the result on every network. In practice, route quality depends on the complete path between the iPhone, access network, transit providers, destination region, and target service. A labeled route can still be unsuitable for a particular destination, while another route may perform better for that destination. Use route labels as selection hints, not as a substitute for local verification.

Approve the iOS VPN permission

The first time Shadowrocket starts a VPN connection, iOS normally displays a system permission prompt asking whether the application may add a VPN configuration. This prompt is controlled by iOS, not by the subscription provider. Read the application name shown in the prompt and approve it only if you intentionally started the connection from Shadowrocket. You may need to authenticate with the device passcode, Face ID, or Touch ID.

After approval, iOS stores a VPN configuration that Shadowrocket can activate. You can review related entries in the iPhone Settings application under the VPN or device-management area, although the exact path may differ by iOS version and installed profiles. If the permission prompt was dismissed, return to Shadowrocket and start the connection again. If iOS reports that a VPN configuration already exists, check whether an old profile or another client is active before creating additional entries.

When connected, the iPhone may display a VPN indicator in the status area or inside the Settings application. This indicates that a system tunnel is active, but it does not validate the subscription’s server choice or the target application’s route. Some applications also maintain their own connection state, cache DNS results, or use endpoints that are not covered by the rules you expected. A complete check therefore needs both system-level and application-level observation.

Verify that the connection works

Start verification with the Shadowrocket status screen. Confirm that the selected server is the one you intended to use, that the connection state remains active, and that the application does not immediately return to a disconnected state. If logs are available, look for a successful handshake or connection message rather than focusing only on the presence of a green indicator. Repeated reconnect messages can indicate an unstable route, invalid credentials, an incompatible protocol, or a blocked transport path.

Next, open a browser and check an IP or region information service that you trust. The visible exit region should correspond to the selected route when the traffic is expected to use the proxy. Do not rely on one page alone: cached content, browser privacy features, DNS behavior, or a split-routing rule can produce results that do not represent every application.

Then test the actual application or website you wanted to use. Close and reopen it if it cached a previous DNS result or connection. For streaming, check sign-in, catalog access, and playback separately. For developer tools, test the browser, the IDE extension, and the command-line process independently. For messaging or background applications, remember that iOS may pause network activity when the application is not in the foreground. A working browser route does not automatically prove that every background process is using the same route.

• ✅ Confirm the selected server and active connection state
• ✅ Check the exit address and region with a trusted test page
• ✅ Reopen the target application after changing routes
• ✅ Compare global and rule-based behavior when diagnosing routing
• ❌ Do not use the VPN icon alone as proof of successful access

DNS deserves special attention. A connection can appear active while domain resolution still fails, returns an unsuitable address, or follows a direct path that conflicts with the selected route. If a domain fails but a known IP address responds, investigate DNS and rule matching. If all destinations fail, investigate the server, credentials, protocol compatibility, and iOS permission before changing DNS. Avoid applying several unrelated DNS profiles at once, because that can hide the original cause.

Troubleshoot common Shadowrocket issues

If Shadowrocket cannot update the subscription, first test the account dashboard in Safari. If the dashboard itself cannot load, the problem may be the current network rather than the subscription URL. If the dashboard works but the update fails, recopy the URL and check whether the account status or subscription permission has changed. A regenerated URL may be necessary when the old token was revoked or exposed.

If the subscription updates but a server cannot connect, try another imported entry without changing the entire configuration. Check whether the selected entry uses a protocol supported by the installed Shadowrocket version. For manual profiles, compare the server address, port, identifier, password, transport, and security parameters with the original information. Do not combine fields from different nodes. A profile can look complete while still containing one parameter from an incompatible protocol.

If the VPN connects but the target service remains unavailable, inspect the routing mode and rules. In rule-based mode, the target may be classified as direct traffic, or a required domain may be missing from the matching set. Temporarily switching to global mode can help distinguish a routing problem from a server problem. After the test, return to a suitable daily mode and adjust rules carefully rather than leaving every connection global without considering local traffic.

If the connection stops after the iPhone sleeps or changes from Wi-Fi to mobile data, reconnect Shadowrocket and repeat the verification. iOS manages background activity and network transitions for power and privacy reasons. Do not interpret every reconnect as a subscription failure. Instead, note whether the issue appears only after sleep, only on one access network, or only with one server. This pattern is more useful than repeatedly reinstalling the application.

Finally, avoid stacking fixes. Reinstalling the app, importing a new subscription, changing DNS, enabling a second VPN, and switching protocols in one attempt removes the evidence needed to identify the cause. Make one change, reconnect, and repeat the same verification sequence. If the problem persists, record the client version, iOS version, selected protocol, server name, routing mode, and the exact error message before contacting support. Never send the full subscription URL in a support request unless the provider explicitly offers a secure channel and asks for it.

For a simpler setup, iPhone users can also review the official client workflow and obtain platform-specific configuration from the account dashboard. Shadowrocket is valuable when you need more visibility into nodes, protocols, DNS, and routing rules, but that flexibility makes disciplined testing more important. Start with the official subscription source, use one client at a time, select one route, approve the iOS prompt, and verify the real destination instead of relying on a single status icon.