Shadowrocket is a paid iOS app that takes your device's traffic and decides, connection by connection, whether it goes to a proxy server you configured or straight out to the internet. It is a rule engine with a network client attached — not a proxy service, and not free.
Shadowrocket is a third-party utility app for iPhone and iPad, sold on the App Store as a one-time purchase. It is not free, there is no free tier, and no proxy or VPN service is included with it — you supply the servers. This shop has no connection to it and does not publish it; what follows is a neutral description of how it behaves, because a lot of people arrive at proxy sites having been told to “just use Shadowrocket” without ever being told what it does.
Functionally it is two things bolted together. The first is a network client that speaks a list of proxy and tunnel protocols. The second, and the more important one, is a rule engine: a configuration that inspects every outgoing connection and decides whether to send it through one of your servers, let it go out directly, or drop it. Everything people like about the app comes from that second part.
One practical note before anything else: the app has come and gone from various App Store regions over the years, so availability depends on which country your Apple account is registered in. That is outside anybody's control but Apple's.
iOS gives applications no way to capture another app's traffic except through the system VPN extension API. So when Shadowrocket asks permission to “add VPN configurations” and shows a VPN badge in the status bar while running, that is not a VPN connection in the usual sense. It is the mechanism the operating system requires for a local app to receive the device's packets and forward them somewhere.
This matters for two reasons. It explains why the app can route traffic on mobile data as well as Wi-Fi, unlike the proxy fields in Settings → Wi-Fi which are stored per network and only apply to that network. And it explains the main constraint: iOS permits one active VPN configuration at a time, so the app and a real VPN client cannot both be connected.
Shadowrocket's server list accepts a broad set of entry types. Roughly grouped:
The protocol list on any given version is whatever that release supports; treat the app's own “add server” screen as the authority. For proxy customers the only line that matters is the first group, because that is what a proxy subscription gives you.
This is the part iOS itself cannot do well, and the reason proxy users install the app at all. In the server editor, pick type HTTP (or HTTPS if the provider terminates TLS on the proxy port), then fill in four fields: address, port, user and password. Authentication is standard HTTP proxy authentication, so the credentials your provider gave you go in verbatim.
PyProxy's residential gateway is HTTP and HTTPS only — it does not support SOCKS5 — so it goes in as an HTTP server entry:
Type: HTTP Address: gw.pyproxy.com Port: 1111 User: USERNAME-country-us Password: PASSWORD
The username carries the routing options. -country-us selects a United States exit;
appending a session token instead holds a single exit address for about thirty minutes, which is what
you want if a site would object to your address changing mid-session. Confirm the credentials work from
any machine with curl before you blame the phone:
curl -x http://USERNAME-country-us:PASSWORD@gw.pyproxy.com:1111 https://httpbin.org/ip
If that returns a US address, the same four values will work in the app.
Shadowrocket's global routing has a few modes — send everything to the selected server, send
everything direct, or follow the configuration. The third is the interesting one. A configuration is a
text file in the Surge-style .conf format, with a section defining servers and a section
defining rules, evaluated top to bottom until one matches:
[Proxy] PyProxy-US = http, gw.pyproxy.com, 1111, username=USERNAME-country-us, password=PASSWORD [Rule] DOMAIN-SUFFIX,target-site.com,PyProxy-US DOMAIN-SUFFIX,api.target-site.com,PyProxy-US DOMAIN-SUFFIX,apple.com,DIRECT IP-CIDR,192.168.0.0/16,DIRECT GEOIP,US,DIRECT FINAL,DIRECT
The matchers you will use most are DOMAIN for one exact host,
DOMAIN-SUFFIX for a host and everything under it, DOMAIN-KEYWORD for a
substring, IP-CIDR for an address range, and GEOIP for a country. Each rule
ends in an action: the name of one of your servers, DIRECT to bypass everything, or
REJECT to drop the connection. FINAL is the catch-all for anything no earlier
rule matched.
Order is the whole trick. Because evaluation stops at the first match, specific rules go above
general ones, and the two mistakes people make are putting a broad DOMAIN-KEYWORD near the
top so it swallows traffic meant for a later rule, or leaving FINAL pointed at the proxy so
that every unrelated app on the phone burns paid traffic. On a per-gigabyte plan the second one is
expensive; keep FINAL,DIRECT and list only what you actually need proxied.
The app can also load a configuration from a URL and refresh it, which is how shared rule sets get distributed. Read anything you import — a rule file controls where all your traffic goes.
Turn the connection on and load a page that echoes the address the request came from, such as
httpbin.org/ip, in Safari. If it shows the gateway's exit address, the rules are matching;
if it shows your own, either no rule matched that host or routing is set to direct. Test again with a
host you deliberately left on DIRECT to prove both branches behave.
Two limits are worth stating plainly. The app does not make traffic anonymous by itself — your privacy is exactly whatever the server you point it at provides. And it is a client, not a source of addresses: the quality of the exit, which country it looks like it is in, and whether a target trusts it are all properties of the proxy behind it, not of the app.
No. It is a paid App Store app bought once from an Apple account, and it is not published as a free or trial version. It is also a third-party product with no connection to any proxy provider, so buying it does not include any proxy service.
It registers itself as a VPN configuration on iOS so it can capture the device's traffic, then forwards each connection according to a rule set: to one of the servers you configured, or straight out to the internet, or rejected.
Yes. Add a server of type HTTP or HTTPS and fill in the address, port, user and password fields. This is how an authenticated gateway is used on iOS, since the built-in iOS Wi-Fi proxy fields are limited to one Wi-Fi network.
No. PyProxy residential is HTTP and HTTPS only and does not support SOCKS5, so it is added as an HTTP server entry pointing at gw.pyproxy.com on port 1111 with your gateway username and password.
