How to Use Shadowrocket and V2Ray with Proxies

Shadowrocket is an iOS proxy client. It does not encrypt your whole device by default like a standard VPN app does. Instead, it reads a config file and routes your traffic through a proxy server using a protocol such as VMess, VLESS, Shadowsocks, or Trojan.

V2Ray is the protocol family behind most of these configs. A v2ray server runs the V2Ray core software and accepts connections that use these protocols, then forwards your traffic to its final destination. VMess was the original V2Ray protocol and adds its own authentication layer. VLESS is a lighter version that skips some of that overhead and relies on the transport layer for security instead. Trojan disguises your connection as ordinary HTTPS traffic, which makes it harder for network filters to flag.

A standard VPN app usually gives you one tunnel, one server list, and one on/off switch. Shadowrocket gives you routing rules instead. You can send some domains through the proxy, send others direct, and block a third group entirely, all from the same config. This rule-based design is why Shadowrocket appeals to people who want more control than a typical VPN app offers.

Most V2Ray-compatible clients, including Shadowrocket, also support a plain SOCKS5 or HTTP outbound, which means the app can point at any generic proxy server, not just a V2Ray-protocol one. That flexibility is the main technical difference between these apps and a typical consumer VPN. For background on how proxies work and what separates a proxy server from a VPN tunnel, read our other guides before you pick a config format.

This distinction matters most when you compare cost and control. A VPN provider bundles the server, the app, and the exit IP into one subscription, and you rarely see what is happening under the hood. A V2Ray setup separates those pieces: you choose the client (Shadowrocket, HTTP Injector, v2rayNG), the protocol (VMess, VLESS, Trojan), and the server or proxy endpoint independently. That separation is more setup work, but it also means you are not locked into one provider's server list or pricing.

Setting up Shadowrocket on iPhone takes about five minutes once you have a server config ready. Shadowrocket is a paid app, and in some regions you need an App Store account registered to a different country to download it.

1. Install Shadowrocket from the App Store and open it. 2. Add your server using a QR scan, a pasted link, or manual entry, as covered in the section above. 3. Tap the toggle next to the server name to select it as active. 4. Flip the main switch at the top of the screen to "On." iOS will prompt you to allow a VPN configuration -- this is normal, since Shadowrocket uses the local VPN framework to route traffic even though it is acting as a proxy client, not a full VPN. 5. Approve the prompt with Face ID, Touch ID, or your passcode. 6. Open a browser and check your IP address to confirm the connection changed.

Shadowrocket defaults to global mode, where every connection uses the active server. Switch to rule mode from the config screen if you only want specific apps or domains routed through the proxy. Rule mode keeps local network access and other apps working normally while only your chosen traffic goes through the tunnel.

If the connection fails, check that the date and time on your iPhone are set automatically. A clock that is off by more than a few minutes will break the TLS handshake most V2Ray configs rely on.

Battery drain is a common complaint with always-on proxy apps. Shadowrocket itself is lightweight, but leaving the VPN toggle on all day keeps the network extension active in the background. Turn the connection off when you are not using it, or set up per-app rules so only the apps that need the proxy trigger the tunnel.

KnoxProxy sells proxy access. It is not a free VPN or a V2Ray server provider, but Shadowrocket and most V2Ray-compatible clients accept a plain SOCKS5 or HTTP proxy as an outbound alongside VMess and VLESS. That means you can route your V2Ray client's traffic through a KnoxProxy endpoint for the exit IP, while V2Ray still handles the encrypted tunnel to your own server.

If you are new to the difference between these two approaches, read what a proxy server does and how it compares in our proxy vs VPN guide before you commit to one setup.

To add a KnoxProxy endpoint as an outbound in a V2Ray config file, use the socks or http protocol block:

{
  "outbounds": [
    {
      "protocol": "socks",
      "settings": {
        "servers": [
          {
            "address": "gw.knoxproxy.com",
            "port": 7000,
            "users": [
              { "user": "YOUR_USERNAME", "pass": "YOUR_PASSWORD" }
            ]
          }
        ]
      }
    }
  ]
}

KnoxProxy plans are priced per GB: residential at $2.10/GB, ISP at $2.90/IP, mobile at $4.50/GB, and datacenter at $0.60/GB, with coverage across 195+ countries. Pick residential or mobile if the target site checks for consumer IPs, or datacenter if you just need a fast, low-cost exit point for testing. Full plan details and volume tiers are on the pricing page.

One caveat worth stating plainly: a SOCKS5 or HTTP outbound handles IP masking and geographic targeting, but it does not add the extra obfuscation a VMess or Trojan server provides against deep packet inspection. If your network actively blocks proxy traffic by protocol signature, keep the V2Ray tunnel as your outer layer and use the KnoxProxy endpoint for the exit IP behind it, rather than replacing one with the other.