Shadowrocket proxy setup (iOS and iPadOS)

Published: 19 July 2026 · 6 min read

What you need before you start

Everything in this tutorial uses the same four values. Grab them from your Roam dashboard and keep the tab open — you will re-type them once in the app and once more if you verify from a terminal.

Field	Value
Server	gw.roamproxy.com
Port	41080
Username	generated in the dashboard
Password	generated in the dashboard

Step 1 — Install Shadowrocket

Shadowrocket is a paid App Store app and it is not listed in every storefront. If you cannot find it by searching, you are on a storefront where it is unavailable — you will need an Apple ID registered to a region that carries it (the US store is the usual choice). It runs on iPhone, iPad, and Apple silicon Macs.

Step 2 — Add the Roam server

1. Open Shadowrocket and tap + in the top right.
2. Set Type to Socks5.
3. Fill in the rest from the table below.
4. Tap Done in the top right.

Field	Enter
Type	Socks5
Address	gw.roamproxy.com
Port	41080
User	your username
Password	your password
Remark	anything, e.g. Roam

Why SOCKS5 and not HTTP

This is the single most common misconfiguration we see. The HTTP type only proxies HTTP and HTTPS traffic — DNS lookups and every other protocol leak out over the local network instead. The symptom is confusing: an IP-check site reports your new exit IP, so the proxy looks like it is working, while most other sites hang or time out. SOCKS5 carries the whole connection, DNS included, and removes that entire class of failure. Pick Socks5 even if HTTP appears to connect.

Step 3 — Select the server and turn it on

1. Go back to the home screen and tap the server you just added so it becomes the selected entry. Adding a server does not select it.
2. Set Global Routing at the top of the home screen to Proxy. This sends all traffic through Roam, which is what you want while you are still confirming the setup works.
3. Flip the switch in the top left. The first time, iOS asks permission to add a VPN configuration — tap Allow and confirm with Face ID or Touch ID.

Once the setup is verified you can switch Global Routing back to Config and let your rule set decide what goes through the proxy. Do that after verification, not before — the default rule sets route a share of traffic direct, which makes a genuine misconfiguration look intermittent.

Step 4 — Chaining behind an upstream hop

Skip this step if Step 3 already works. You need it when your network cannot reach our gateway directly. Shadowrocket can send its outbound connection through a second proxy first, so the path becomes: your device → your upstream hop → Roam gateway → destination site. The destination still sees the Roam exit IP.

1. Add your own upstream node in Shadowrocket first — whatever egress you already use. Confirm it works on its own before chaining anything to it.
2. Open the edit screen for the Roam entry. The entry point moved between app versions, so use whichever of these works for you: swipe left on the row, long-press the row, or tap the i / > icon on its right.
3. Find Chain Proxy and select your upstream node.
4. Save, re-select the Roam entry on the home screen, and turn the switch back on.

If the chain fails, test the two hops separately: turn on the upstream node alone and confirm you have working internet, then add Roam back. A chain that fails at hop one looks identical to a chain that fails at hop two.

Step 5 — Verify (properly)

Open https://ip.sb in your browser and confirm it shows a Roam exit IP in the region you expect.

Checking ip.sb alone is not enough. An IP-check page is a single small HTTPS request; it succeeds under conditions where real browsing does not. Open two or three sites you normally use as well. If ip.sb reports the new IP but everything else times out, your configuration is wrong — almost always the HTTP-vs-SOCKS5 issue from Step 2 — and you should go straight to connected but not working.

Optional: verify the credentials from a terminal

If you have a Mac nearby, testing outside the app tells you whether a problem is with your credentials or with Shadowrocket's configuration. Note the form: -x takes the proxy address and -U passes the credentials separately.

curl -v -x socks5h://gw.roamproxy.com:41080 -U 'username:password' https://ip.sb

If curl returns a Roam IP but the phone does not, the credentials are fine and the problem is in the app. If curl fails too, re-copy the username and password from the dashboard. For a full desktop walkthrough, see macOS proxy setup.

Plans and what a session costs

Rotating residential traffic is billed at $2/GB with no monthly minimum, so a phone used for testing costs cents rather than a subscription. If you need one address that stays the same across sessions — anything with a login that reacts badly to a changing IP — a static residential IP is $4/IP/month. New accounts get 300MB free, which is more than enough to complete this tutorial and confirm the exit IP behaves the way your target site expects.

FAQ

Nothing happens when I flip the switch.

Two causes account for almost all of these. Either you added the server but never tapped it to select it — adding and selecting are separate actions in Shadowrocket — or the iOS VPN configuration prompt was dismissed or denied at some point. For the second case, go to Settings → General → VPN & Device Management, delete the Shadowrocket configuration, then return to the app and turn the switch on again so the prompt reappears.

It connects, but only some sites load.

Set Global Routing on the home screen from Config to Proxy. The default rule sets deliberately route a portion of traffic direct rather than through the proxy, so anything matching those rules keeps using your normal connection. While you are verifying a new setup you want everything on the proxy; switch back to rule-based routing once you know it works.

My dashboard shows traffic being used, but pages will not load.

Billed traffic means authentication succeeded and the tunnel is established — so your credentials and the gateway are fine. The failure is in what is being carried: either the connection type or DNS. Change the server type to Socks5 as described in Step 2, since the HTTP type leaves DNS lookups outside the tunnel. If SOCKS5 is already set and pages still fail, see connected but not working.

Do I need the Chain Proxy step, and can I use the HTTP type instead of SOCKS5?

Chain Proxy is only needed when your network cannot reach gw.roamproxy.com:41080 directly — try Step 3 on its own first and add the chain only if it fails. The HTTP type is a different matter: use SOCKS5 regardless. HTTP proxies only HTTP/HTTPS traffic and leaks DNS to your local network, which produces a proxy that shows a new IP on a check page while most real browsing breaks.

Roam is the exit-IP layer for this setup: rotating residential at $2/GB, static residential at $4/IP/month, no monthly minimum. Create an account and start with 300MB free — enough to finish this tutorial and confirm the exit IP behaves the way your target site expects.