How to set up a Proxy Chain (Parent Proxy) in Shadowrocket? (China / strict firewall)

A SOCKS5 proxy is not encrypted. Used on its own from mainland China, it crosses the firewall in the clear, and the connection can be cut or blocked. The node you already use to get out of China (your “机场”, or “airport”) is built for that. A proxy chain puts the two end to end:

iPhone → your usual node → FRProxy proxy → website

Your traffic leaves China inside your node's encrypted tunnel, then reaches our proxy. Websites see the proxy's French mobile IP, not your node's.

What you need

• Shadowrocket, on iPhone, iPad or Mac. The app is paid and is not on the Chinese App Store: it is bought with an Apple ID from another region.
• Your usual node, already added to Shadowrocket and working.
• Your FRProxy proxy, active. Everything you need is on its card, in My proxies.

The labels 代理通过, 全局路由 and the ones below are those of the Chinese interface. In another language, they sit in the same place.

Step 1: add the proxy to Shadowrocket

The easiest way is the QR code on the proxy's card:

1. In My proxies, open the card's Shadowrocket tab, then the Shadowrocket (iPhone) tile.
2. In Shadowrocket, tap the top-left button, then scan the QR code. If you are reading this page on the iPhone itself, tap Open in Shadowrocket instead.

If Shadowrocket does not recognise the code, add the node by hand: + at the top right, type SOCKS5, then the host, the SOCKS5 port, and the proxy's username and password, as shown on its card. They are not those of your FRProxy account.

Step 2: route the proxy through your usual node

The setting is called 代理通过. It goes on the FRProxy node, not on your usual node:

1. In the node list, tap the ⓘ to the right of the FRProxy node.
2. Tap 代理通过.
3. Pick your usual node, or the group that contains it.
4. Save.

To undo the chain: ⓘ of the FRProxy node, 代理通过, 取消 at the top right, then save.

Step 3: connect and check

1. On the home screen, select the FRProxy node, not your usual node: it is the one that calls the other.
2. Under 全局路由, choose 代理: all traffic then goes through the chain. In 配置 mode, only the sites your rules send to the proxy go through it.
3. Turn the connection on with the switch at the top of the screen.
4. Open a site that shows your IP address (see Testing your proxy). It must be French and belong to a mobile carrier, not to your node.

Calls, games and WebRTC

Web pages and most apps use TCP, which the chain always carries. UDP, used by calls and some games, needs three things:

• your usual node relays UDP;
• in Shadowrocket, 设置 → UDP → 启用转发 is on;
• your proxy accepts UDP: its card shows UDP ✓ on the SOCKS5 line.

Also turn on 设置 → UDP → 禁用STUN. Without it, a site can get an address other than the proxy's through WebRTC (see WebRTC and DNS leaks).

If it does not work

• The connection fails: check the proxy's username and password (those on its card), and that your usual node works on its own. An expired or suspended proxy also refuses the connection: see Common errors. After a password change, scan the QR code again or edit the node.
• The site sees your node's address: your usual node is selected instead of the FRProxy node, or the chain was set the wrong way round (on your usual node).
• The site sees a Chinese address: the 全局路由 mode sends that site direct. Choose 代理.
• It is slower than your node alone: that is expected, the route goes through your node, then through France.

On Android

Shadowrocket only exists for iPhone, iPad and Mac. The app with that name on Google Play comes from another publisher. The proxy's card also offers a QR code for v2rayNG; the principle stays the same: the FRProxy node behind your usual node, if your app can chain two nodes.

---

See also: Android and iPhone · Testing your proxy · WebRTC and DNS leaks