Product notes
Shadowrocket is a rule-based proxy client for iOS / iPadOS.
The app takes outbound traffic through the system VPN interface, then judges each connection DIRECT, PROXY, or REJECT by rules. Nodes, subscriptions, and rules are imported by you; the app does not provide servers, and has no account system.
The diagram below is routing. The switch in the middle is the in-app connect control; tap to toggle. Objects and readings are in the Manual, chapter by chapter.
DIRECT · Direct
Not via a proxy node
A request that hits DIRECT leaves on the system path — for example hostnames you listed as direct, or Apple system services. Latency and availability follow the local network, and do not consume node traffic.
PROXY · Proxy
Forwarded to a configured node
A request that hits PROXY is sent by this app to the currently selected server. Protocol, encryption, and transport are decided by that node’s configuration, not by one global protocol the client picks on its own.
—→—
Overview
How it works
Shadowrocket runs on iPhone and iPad, requiring iOS 13.0 or later. The first time you connect, the system asks to add a VPN configuration. That is iOS’s standard Network Extension authorization, not a third-party login.
After connect, most apps’ outbound TCP / UDP enters the tunnel. The client matches the current configuration’s rules first: DIRECT is sent back on the system path, PROXY is sent to the current node, REJECT is blocked. If nothing hits, FINAL at the end of the rules decides the default policy.
Domain matching usually follows DNS results, the HTTP hostname, or TLS Server Name Indication. IP and GeoIP matching follow the destination address. Rules run top to bottom in file order; the first hit takes effect and later lines are not evaluated.
Configuration, nodes, and rules stay on the device. With iCloud allowed, they can sync across devices under the same Apple ID; developer servers do not host this content.
Priced at $2.99 on the App Store, a one-time purchase. You bring your own proxy servers. Some regional stores do not carry it.
- Record
- A selectable exit in the list, with address, protocol, and credentials.
- Container
- Subscribe: stores only a URL; child records are written on refresh.
- Rules
- An ordered list of “condition → policy.” Conditions can be domain, IP range, GeoIP, process, and more; policy is DIRECT, PROXY, or REJECT.
- Config
- The currently active rule set and related options. Several configurations can exist; while connected, only the selected one is used.
Docs
Read by what’s on screen.
The home page only says what the product is. On-screen objects are written chapter by chapter. Chapter entries are in the top bar; reading order is in the Manual.
- 01Manual · Reading order and how objects divide work
- 02Tunnel · The switch and Config / Proxy / Direct
- 03Objects · Records and containers
- 04Rules · The list, order, FINAL
- 05Data · Four signals
- 06System · iOS VPN limits
- 07Config · Multiple files and iCloud
- 08Rewrite · Not the same as routing
- 09DNS · Two resolvers and IPv6
- 10Store · App Store
- 11Blog · Unpacking what you see on screen
Rule matching
Match a domain top to bottom
DOMAIN-SUFFIXapple.comDIRECTDOMAIN-SUFFIXicloud.comDIRECTDOMAIN-SUFFIXmicrosoft.comDIRECTDOMAIN-SUFFIXoffice.comDIRECTDOMAIN-KEYWORDintranetDIRECTDOMAIN-SUFFIXnetflix.comPROXYDOMAIN-SUFFIXgithub.comPROXYDOMAIN-SUFFIXyoutube.comPROXYDOMAIN-SUFFIXwikipedia.orgPROXYGEOIPCNDIRECTFINAL—PROXY
GEOIP depends on the IP database on the device; this page cannot simulate it. FINAL is the default policy when nothing else matches.
Match result
PROXY
DOMAIN-SUFFIX, github.com
Policy: forwarded via a proxy node.
Rules
Common condition types
Full syntax follows in-app docs and the rule file. Below are the types that show up most in real configurations. Besides DIRECT and PROXY, the policy column can also be REJECT.
- DOMAIN
- Hits when the hostname is an exact match. For example
DOMAIN,example.com,PROXYmatches example.com only, not www.example.com. - DOMAIN-SUFFIX
- Hits when the hostname equals that suffix, or ends in “.suffix.” For example apple.com matches apple.com and www.apple.com.
- DOMAIN-KEYWORD
- Hits when the hostname contains that string. Wider than a suffix, and easier to over-match. Use it for a batch of names a suffix cannot cover.
- IP-CIDR
- Matches a destination IPv4 range, for example
IP-CIDR,172.16.0.0/12,DIRECT. IPv6 uses IP-CIDR6. - GEOIP
- Matches the destination IP’s class in a geo database. The second field is an ISO country code, for example
GEOIP,CN,DIRECTorGEOIP,US,DIRECT. Accuracy follows the database version on the device. - FINAL
- Should sit at the end of the file. Used when no earlier condition hit. With no FINAL, unmatched traffic follows the current configuration; do not rely on an implicit default.
Rules can be handwritten, or imported from a list someone else maintains. Before importing third-party rules, read their license and update method, and confirm FINAL and GEOIP match what you want: for example one country code as DIRECT and the rest as PROXY is a common pairing, not the only correct one.
“Update on open” and “Background update” in settings apply only to subscribed nodes or rules. Background update needs Settings → General → Background App Refresh to allow Shadowrocket. On a failed update the list stays at the last successful result; it is not cleared automatically.
Protocols
Supported protocols
Which protocol you use is decided by the node provider. The client can keep nodes of several protocols in one app; while connected, only the selected one is used. Transport (WebSocket, gRPC, QUIC, and so on) is part of the node configuration and must match the server.
-
Shadowsocks
A lightweight proxy protocol. Main parameters are address, port, cipher, and password. There are many existing nodes; when isolating, check those fields against the server first.
-
Trojan
A proxy carried over TLS. What the client sees is a TLS handshake; certificate and SNI must follow the server, or the handshake fails.
-
VLESS
A lightweight protocol in the V2Ray family. Credentials are not wrapped in a heavy crypto shell, so transport overhead is usually lower than VMess. UUID and flow options must match the server.
-
VMess
V2Ray’s encrypted transport, usable with TCP, WebSocket, gRPC, and more. Historical fields such as alterId are usually 0 on new nodes; do not paste an old configuration onto a new server.
-
HTTP / SOCKS5
A standard proxy interface. Common on LAN gateways, for debugging, or as an entry that only offers this protocol. It generally does not carry complex camouflage; authentication follows the server.
-
Others
Later versions may also include WireGuard, Snell, and others. Whether you can use them depends on the current App Store build and whether the node provides the matching parameters. Confirm the type exists in the “+” list before you add it.
Features
Includes
- ✓Rule-based routing (direct / proxy / reject)
- ✓Subscribe URL, QR code, and adding rows by hand
- ✓Several protocol nodes together; the current row is used while connected
- ✓Latency tests and traffic stats (Data)
- ✓URL rewrite; optional HTTPS decryption (installs a profile)
- ✓Configuration stays on the device; optional iCloud sync to your own devices
Scope
Does not include
- ×Does not provide or sell proxy nodes
- ×No in-app account; configuration is not uploaded to developer servers
- ×No in-app subscription; node service fees are paid separately
- ×Does not choose, build, or maintain nodes for you
- ×Not a system firewall, and cannot patch other apps’ binaries
- ×No official Android / Windows / macOS client
Limits
System and usage boundaries
Shadowrocket is built on iOS’s VPN framework, so it inherits that framework’s limits. Some system processes and some apps detect “VPN is connected” or use their own path; the client cannot force every piece of software into the tunnel.
Low Power Mode, the system reclaiming background, turning off Background App Refresh, or turning off VPN on-demand related options can drop the tunnel. Airplane Mode, Wi-Fi / cellular handoff, and Captive Portal also cause short interruptions; reconnect or wait for automatic recovery.
HTTPS decryption (MITM) installs a user-trusted profile so you can inspect or rewrite HTTPS content. That lowers the certificate trust model on the device. Turn it on only when you clearly need it, and remove the profile when you are done. Ordinary routing, browsing, and APIs do not depend on it.
IPv6, fake-ip, and real-IP routing can disagree. If you only configured IPv4 CIDR and the target uses IPv6, the rule may fall to FINAL. To handle both address families, add IP-CIDR6 in the rules, or turn off the IP version you do not need in settings.
The app cannot override a carrier or a site’s access policy, and cannot make a dead node work. Connection quality is jointly decided by the local network, the node path, and the far-end service. This page does not provide nodes, and does not review any third-party subscription.
Specs
Product specs
- Also known as
- 小火箭
- Platform
- iOS 13.0 or later · iPadOS
- Price
- USD 2.99 · App Store one-time purchase · no IAP
- Availability
- App Store · not listed in some regions (including mainland China)
- Interface
- iOS Network Extension (system VPN)
- Config
- Stored on the device; optional iCloud sync across your own devices
- Developer
- Shadow Launch Technology Limited
Get the app on the Store page. Whether Family Sharing is available follows the App Store product page at that moment.