How to use Shadowrocket with Trump Proxies on iPhone

Shadowrocket is the strongest mainstream iPhone client for a proxy you already own. It accepts raw host, port, username and password details, creates an iOS Network Extension tunnel, and can route the whole phone through one SOCKS5 node. It does not include proxy servers: the app is the client and your Trump Proxies line is the connection.

Install the genuine Shadowrocket by Shadow Launch Technology Limited. There are similarly named apps in some stores, but this guide follows the paid iPhone/iPad utility with bundle ID id932747118. Its App Store description identifies it as a rule-based client for HTTP, HTTPS, TCP and DNS traffic.

Have these four values ready

• Address — the proxy hostname from your customer portal, without https:// or socks5://.
• Port — the exact numeric port attached to that line.
• User — the proxy username, preserving capitalization.
• Password — the proxy password, not your Apple ID or Trump Proxies portal password.

The ideal Shadowrocket settings

Add the SOCKS5 node

1. 01Open Shadowrocket and tap Add Server or the + button.
2. 02Tap Type and select Socks5. Do not choose Shadowsocks: despite the similar name, it is a different encrypted protocol and a standard SOCKS5 username/password will not work in it.
3. 03Paste the portal hostname into Address and enter the supplied numeric Port.
4. 04Paste the proxy User and Password.
5. 05Leave Plugin at none, TCP Fast Open off, Padding off and Proxy Pass empty.
6. 06Switch UDP Relay off. If the switch is already grey, leave it that way.
7. 07Add a specific Remarks label and tap Save.
8. 08Back on Home, tap the node so its selection indicator is active.

Set routing and UDP to fail closed

A correct node can still leak if Shadowrocket's global rules send some traffic direct. On the Home screen, set Global Routing to Proxy for the first clean setup. Config obeys a ruleset and is useful later, but any DIRECT rule becomes an intentional path around the mobile line.

1. 01Open Settings → UDP and leave Enable Forwarding off.
2. 02Turn Disable STUN on. STUN is the WebRTC mechanism commonly used to discover a public address over UDP.
3. 03If your version shows an unsupported-UDP behaviour or fallback, choose REJECT, never DIRECT. An unsupported packet should fail, not leave through your real IP.
4. 04Keep the node-level UDP Relay off as well. The global and node switches control different parts of the path; both should agree.

The maintained Shadowrocket manual documents Proxy as the all-traffic global route, exposes the separate global and node UDP forwarding switches, and supports rejecting UDP when a policy cannot carry it. That is the right shape for a standard Trump Proxies TCP line: carry TCP, block unsupported UDP and let QUIC-capable apps fall back to HTTP/2 over TCP.

Keep DNS on the proxy path

With Global Routing: Proxy, proxy-class domains are resolved through the selected proxy. For the first setup, leave DNS overrides at their defaults and do not add your home router, mobile carrier or a direct-only resolver. If you already maintain a custom Shadowrocket config, use its DNS-over-PROXY form so the resolver request itself follows the selected node.

Connect and grant iOS permission

1. 01Return to Home, confirm the intended node is selected and Global Routing says Proxy.
2. 02Switch the main connection toggle on.
3. 03The first time, iOS asks whether Shadowrocket may add VPN configurations. Tap Allow, then approve with Face ID, Touch ID or the device passcode.
4. 04Wait for the iOS VPN indicator and Shadowrocket's connected state. That proves the local tunnel started, not that the remote node is correct—run the checks below.

iOS allows one active personal VPN/Network Extension tunnel. Temporarily disable iCloud Private Relay for the Safari test, and disconnect commercial VPN clients or any other app using the VPN slot. Competing routes can replace Shadowrocket or make the result impossible to interpret.

Run a real connection test

1. 01Before connecting, open api.ipify.org in Safari and note the current IP.
2. 02Connect Shadowrocket, open a new Private tab and load the same URL. The public IP should change.
3. 03Confirm the country matches the purchased line. The exact mobile IP may change after a rotation; the expected country and carrier path are what matter.
4. 04Run Shadowrocket's connectivity test if you like, but treat it as a preliminary check. A green latency number does not prove the intended app is following the route.
5. 05Open the actual approved platform and complete a normal page load. On a destination-restricted plan, unrelated sites may be rejected by design.
6. 06Run a WebRTC/DNS leak test. Your normal public IP should not appear, and a failed STUN test is expected with UDP/STUN blocked.

Global Proxy or Config mode?

Start with Proxy. Only move to Config or Scene after you can explain every direct rule and have tested both Wi-Fi and cellular. For account work, simplicity is a security feature: one phone, one selected node, one clear route.

Troubleshooting by symptom

Rotate between sessions, not inside one

Use your portal rotation control only after closing the target app or ending the account session. Wait for the line to return, reconnect Shadowrocket if necessary, verify the new public IP, then begin the next session. The Shadowrocket node remains unchanged: rotation happens behind the same host and port.