Best for Shadowrocket
Residential proxies
from $0.27/GB
Streaming and social apps rarely flag residential IPs. A sticky session holds one IP for up to 24 hours.
Browsers & operating systems
Shadowrocket Proxy How to Add a Server on iPhone and iPad
Shadowrocket works on
- iOS
- iPadOS
- macOS
- tvOS
- visionOS
Key facts
What it covers
All apps on the device, on Wi-Fi and cellular. The proxy in iOS Wi-Fi settings covers one Wi-Fi network, supports HTTP only, and some apps skip it.
One VPN at a time
Shadowrocket installs as a VPN profile, and iOS allows one active VPN. If you switch on another VPN app, Shadowrocket disconnects.
Price and availability
$2.99 once (US App Store), no servers included.
HTTP vs HTTPS vs SOCKS5 vs Shadowsocks in Shadowrocket
Choose the type your provider set the port up for. Shadowsocks is only worth the effort on networks that filter plain proxies. Shadowrocket also takes VMess, VLESS, Trojan, Hysteria, TUIC and WireGuard servers. Geonode proxies use SOCKS5 or HTTP.
| Name | Works In | Auth | Blocking Resistance | Best For | Where To Get |
|---|---|---|---|---|---|
| SOCKS5 | Add Server > Type > Socks5 | User and Password, or none | Low to medium. The handshake is not encrypted, so a filtering network can detect and block it | Apps that connect outside the browser, messengers for example | Geonode residential or ISP proxies; Geonode free list |
| HTTP | Add Server > Type > HTTP | User and Password, or none | Low. The request to the proxy, login included, is sent in plain text | Web and app traffic when your provider only gives an HTTP port | Geonode residential, ISP or datacenter proxies; Geonode free list |
| HTTPS | Add Server > Type > HTTPS | User and Password, or none | Medium. The connection to the proxy uses TLS, so the local network can't read your login | Public Wi-Fi, if your provider has a TLS proxy port | Providers with a TLS proxy endpoint only |
| Shadowsocks | Add Server > Type > Shadowsocks | Password and encryption method | High. Traffic is encrypted from the first byte, though some censors still find servers by active probing | Countries and networks that block SOCKS5 and HTTP | Your own server on a VPS. Geonode doesn't sell it |
Which proxy type to use with Shadowrocket
Shadowrocket will connect through any IP. Whether that IP gets blocked is up to the sites and apps you open.
Good for one account
ISP proxies
from $1.25/IP
The IP never changes, so an account you log into on the phone always sees the same address.
Browsing only
Datacenter proxies
from $0.14/GB
Fast and cheap for everyday browsing. Streaming services and many apps block datacenter ranges, though.
Testing only
Free public proxies
Free
Shared by many people and short-lived, and whoever runs the proxy can see which sites you visit. Good enough to test your Shadowrocket setup before you pay, not for logins.
How to set up a proxy in Shadowrocket
Install Shadowrocket from the App Store and have the host, port, proxy type, username and password ready. On Geonode, open the Proxies section of the dashboard and copy them in hostname:port:username:password format. The host is proxy.geonode.io, and the port depends on whether you picked HTTP or SOCKS5. These proxy credentials are not your Geonode account login. To pin a country, add it to the username as shown in the country targeting docs.
Open Shadowrocket and tap Add Server (the + in the top-right corner once you have servers).
Tap Type and pick Socks5, HTTP or HTTPS, whichever matches your proxy port.
Put the host in Address and the port number in Port.
Type your proxy username in User and the password in Password.
Add a name in Remarks if you like, then tap Save.
On the Home screen, set Global Routing to Proxy.
Tap the Not Connected switch.
The first time, iOS asks to add a VPN configuration. Tap Allow and enter your passcode.
Check detailed instructions on our blog:
Read the blog postHow to check that the proxy works
Tap Connectivity Test on the Home screen. If a latency in milliseconds appears next to the server, Shadowrocket reached it.
Open Geonode's What is my IP page in Safari. It should show the proxy's IP and country, not yours.
Turn off Wi-Fi and reload the page. If the proxy IP still shows, mobile data goes through the proxy too.
How to turn the proxy off
Tap the switch at the top of the Home screen so it says Not Connected. To keep Shadowrocket running without the proxy, set Global Routing to Direct instead.
To remove the VPN profile, go to iOS Settings > General > VPN & Device Management > VPN and delete the Shadowrocket configuration.
Common Shadowrocket proxy problems and fixes
Connected, but the IP does not change
- Global Routing is set to Config and a rule sends that site Direct, or another server is selected
- Set Global Routing to Proxy and tap the server you want to select it. Reload the IP check page.
CauseFixConnectivity Test times out
- Wrong port, a Type that doesn't fit the port (HTTPS on a plain HTTP port is the usual one), or a free proxy that has died
- Compare the port and Type with your provider's details, and run the proxy through the Geonode proxy checker. For a free proxy, just pick another one from the list.
CauseFixPages load with an authentication error (407)
- User or Password is wrong, or left empty on a proxy that requires a login
- Type the username and password again exactly as issued. A trailing space is enough to break it. On Geonode, use the proxy credentials from the dashboard (not your account login) and the documented username format for country targeting.
CauseFixWebsites work, but calls and games fail
- These apps use UDP, and the proxy doesn't forward it
- Use SOCKS5 with a Geonode residential proxy on proxy.geonode.io port 12000 and add -requireUdp-true to the end of the username. HTTP proxies and most free proxies carry only TCP. In that case, set Global Routing to Config and add a Direct rule for the call or game service's domains or IP ranges.
CauseFix
More for Shadowrocket users
Shadowrocket proxy FAQ
No. Shadowrocket is a proxy client. It uses the iOS VPN interface to catch traffic from every app, but it has no servers. You add a proxy or Shadowsocks server, either from a provider or from your own VPS.
In Config mode, the rules in the active configuration file decide where traffic goes: some domains or IP ranges use the proxy, the rest connect directly. Proxy mode sends all traffic through the server. Direct sends none. Scene picks a routing mode per Wi-Fi network or for cellular.
Yes. Tap the scan icon at the top of the Home screen and point the camera at the provider's QR code. A server link such as socks5://, ss:// or vmess:// can be pasted instead of filling in the fields by hand. For a subscription, tap +, set Type to Subscribe, paste the URL and save, then pull down on the server list to fetch the latest servers.
GEOIP is built in. A line like GEOIP,US,DIRECT sends traffic for US IP addresses direct. Geosite lists from v2ray are usually loaded as RULE-SET files converted to Shadowrocket's format, for example RULE-SET,<list URL>,PROXY. Both only work with Global Routing set to Config.
Any HTTP or SOCKS5 proxy can be a Shadowrocket server, including those on Geonode's free proxy list. They go offline often, so use them for testing.
Yes. The App Store listing mentions multi-level forward proxy support, which lets traffic pass through more than one server on its way to the site. Each extra hop adds latency.
No. Shadowrocket is only on the Apple App Store, for iPhone, iPad, Mac, Apple TV and Apple Vision Pro. Android apps with a similar name are made by other developers.
