Grey nodes in Shadowrocket: tap Update. If that errors, fix the URL, network, or UA. If Update succeeds but handshakes fail, check plan expiry, protocol, and whether this SSID drops UDP. Reinstall and MITM are the wrong first moves.
A subscription is an HTTPS URL. Chat apps, mail wrapping, and SSL inspection can return a login HTML page instead of a node list.
Two branches
| Update | Means | Do |
|---|---|---|
| Error / empty | No profile fetched | Paste, network, spare URL, UA |
| OK, all timeout | List present, tunnel not | Quota, protocol, cellular, global rules |
Traffic and expiry live in the provider console, not in Shadowrocket settings. 3.2.1 may surface UA hints—follow the provider, see the news post. DNS: DoH. Rules: groups. Import: import. Download, FAQ, guides.
Field questions tied to this guide
- Update fails immediately. Spaces, unexpanded short links, or this network blocking the sub host. Try cellular, a spare URL, and the provider’s UA note.
- Update succeeds, still grey. Plan expired, provider retired the hosts, or the path is filtered. Try one node in global mode on another network.
- Reinstall daily? No. Reinstalls do not refill quota. Check the provider console.
- User-Agent? Some sub servers gate on UA. Change it only as the provider documents—not a random 'universal' string.
Change one control, then retest
While working through “Shadowrocket subscription update fails or every node is grey”, write the download-page version, mode, protocol, and node name on the first line of a note. After each toggle, run one check only: 1.1.1.1/help or the exact page that failed. Changing Kill Switch, split rules, and nodes together makes the next failure un-debuggable. Get Shadowrocket packages only from the download page; permissions and device limits live in the FAQ and guides.
On office or hotel networks, finish captive portals and clear leftover PAC entries before you decide this article’s failure mode applies. A cellular A/B exposes router DNS and parental filters quickly. Avoid hammering login on a second device during the test so session kickouts are not mistaken for radio drops.
Pin the combination that works—SSID, node, protocol—and reuse it on that network instead of starting from Auto every time. Keeping slug rocket-sub-update-fail as your note title makes the write-up searchable later.
When to stop and change layers
After five identical failures, stop. Recheck the documented build, confirm a single tunnel client, ensure Kill Switch was not blocking a portal, and verify the browser is not Direct in a split list. Stopping is how you escape the wrong layer.
When you ask for help, include time, SSID, mode, protocol, node names, and steps already tried. After recovery, verify egress in a clean browser so cache does not fake success, then write the split list or favorites back into your notes before the next reinstall.
Extra pass for “Shadowrocket subscription update fails or every node is grey”: retest three minutes on a second network and confirm the download page build. If only one app fails, inspect split membership; if everything fails, inspect permissions and DNS first. One change at a time remains the fastest habit when debugging Shadowrocket.
Extra pass for “Shadowrocket subscription update fails or every node is grey”: retest three minutes on a second network and confirm the download page build. If only one app fails, inspect split membership; if everything fails, inspect permissions and DNS first. One change at a time remains the fastest habit when debugging Shadowrocket.
Extra pass for “Shadowrocket subscription update fails or every node is grey”: retest three minutes on a second network and confirm the download page build. If only one app fails, inspect split membership; if everything fails, inspect permissions and DNS first. One change at a time remains the fastest habit when debugging Shadowrocket.
Extra pass for “Shadowrocket subscription update fails or every node is grey”: retest three minutes on a second network and confirm the download page build. If only one app fails, inspect split membership; if everything fails, inspect permissions and DNS first. One change at a time remains the fastest habit when debugging Shadowrocket.
Extra pass for “Shadowrocket subscription update fails or every node is grey”: retest three minutes on a second network and confirm the download page build. If only one app fails, inspect split membership; if everything fails, inspect permissions and DNS first. One change at a time remains the fastest habit when debugging Shadowrocket.