Shadowrocket proxy setup on iPhone and iPad: add a server, pick a routing mode, check the IP

A Shadowrocket proxy setup takes about two minutes: tap Add Server, set Type to HTTP, enter the host, port, username and password from your ProxyHive order, tap Done, set Global Routing to Proxy, and flip the connection switch. iOS asks once to add a VPN configuration. From then on every app on the iPhone or iPad leaves through your proxy, on Wi-Fi and on cellular.

Steps checked against the App Store listing and published setup guides on 2026-09-30. We found no official English manual from the developer, so where a label may differ between versions we say so and describe the control instead.

#What Shadowrocket is (and is not)

Shadowrocket is a "rule based proxy utility" from Shadow Launch Technology Limited, for iPhone, iPad, Mac and Apple TV. On 2026-09-30 it cost $2.99 on the US App Store. Its listing says it captures HTTP, HTTPS and TCP traffic from any app and works on cellular networks.

It does this by installing a local VPN profile. There is no VPN server involved: the tunnel ends on your phone and Shadowrocket forwards the traffic to the proxy you add. It sells no proxies itself, and its listing says so. Proxy vs VPN explains why the two are different things even when an app uses one to carry the other.

#Before you start

1. Buy an IP (one is enough) and open the order in the dashboard at https://app.proxyhive.io.
2. Copy HOST, PORT, USERNAME and PASSWORD. Each ISP or datacenter IP is its own endpoint, with separate HTTP, HTTPS and SOCKS5 ports listed on the order. Use the HTTP port.
3. Use username and password authentication. An IP allowlist is awkward on a phone: your public IP changes every time you move between Wi-Fi and cellular, and the proxy refuses you until the new one is on the order.

A static ISP proxy suits a phone best: it keeps the same carrier-registered address every day, which is what a single app or account expects.

#Add a server in Shadowrocket

#1. Create the server

1. Open Shadowrocket. On the home screen, tap Add Server (or the + button, depending on the version).
2. Tap Type and choose HTTP, then go back.
3. Fill in the server address (labelled Address or Host depending on the version) with HOST, and Port with the HTTP port.
4. Fill User and Password from the order.
5. Optionally type a name in Remark, such as the IP's city and carrier, so you can tell servers apart later.
6. Tap Done. The server appears in the list on the home screen.

#2. Choose Global Routing

On the home screen, under Global Routing, pick one of:

Choose Proxy for the first test. It removes the rules from the picture.

#3. Connect

1. Tap the server so it is selected (it gets a marker).
2. Turn on the switch at the top of the home screen, next to Not Connected.
3. The first time, iOS asks to add a VPN configuration. Tap Allow and confirm with your passcode or Face ID.

iOS allows one active VPN configuration at a time, so turning Shadowrocket on disconnects any other VPN app.

#Shadowrocket SOCKS5 and authentication

Shadowrocket accepts a username and password for SOCKS5 as well as HTTP. If you prefer SOCKS5, set Type to SOCKS5 and use the SOCKS5 port from the order. Chrome on a desktop cannot do this, which is one reason a phone setup is sometimes easier than a browser one. HTTP vs SOCKS5 proxies covers when the difference matters.

Pick HTTP rather than HTTPS in the Type list for the HTTP port. A type that does not match the port is the most common reason a server never connects.

#Per-app routing on iOS: use Config mode instead

People coming from Android or Proxifier look for a list of apps to tick. It does not exist: iOS does not let a consumer VPN app choose traffic by app (per-app VPN is available only on devices managed through MDM).

What Shadowrocket offers instead is routing by destination. In Config mode, rules match domain, domain suffix, domain keyword, IP range (CIDR) or GeoIP, and send each match to the proxy or direct. To proxy one app, find the domains it talks to and proxy those. Shadowrocket's configuration files use this rule form:

[Rule]
DOMAIN-SUFFIX,example.com,PROXY
FINAL,DIRECT

That sends example.com and its subdomains through the proxy and everything else direct. Open the configuration from the Config tab to edit it, and check the result with the connectivity test below before relying on it.

#Connectivity test and exit-IP check

1. On the home screen, tap Connectivity Test. Each server shows a latency figure if it answered, or a failure. A figure means the server answered; the IP check in the next step confirms traffic goes through it.
2. With the switch on, open Safari and go to https://api.ipify.org?format=json. The ip value should be the address on your order.
3. Turn Wi-Fi off and load the page again on cellular. It should show the same IP.

If you see your own IP, Global Routing is on Direct, a Config rule sent that site direct, or the switch is off.

#Wi-Fi vs cellular

iOS has its own proxy field under Settings, Wi-Fi, the info button next to a network, Configure Proxy. It applies to that one Wi-Fi network only and is ignored on cellular, and apps that open their own connections can bypass it. Our iPhone proxy guide covers that route. Shadowrocket carries all app traffic on both networks, which is why people buy it.

#Several IPs on one phone

Add one server per IP, each with its own Remark, and tap the one you want before connecting. For account work, keep one account on one IP: the pattern behind buying a single static IP. Check the allowed-use policy before automating accounts.

#Troubleshooting

• The switch turns itself off. The VPN configuration was not allowed, or was removed in Settings, General, VPN & Device Management. Reconnect and allow it again.
• Pages do not load, Connectivity Test fails. Wrong host or port, or Type does not match the port.
• Test passes, pages fail. Re-copy the username and password from the order, then check Global Routing and any Config rules.
• The connection drops when the phone is locked. iOS can suspend the tunnel. Reconnect, and check Shadowrocket's own settings for an on-demand option in your version.

Status codes and what each one means are in proxy error codes. ISP IPs start at $3.20/IP on ISP pricing.