VLESS Reality on macOS: client setup with Shadowrocket or FoxRay

VLESS Reality on macOS has two reasonable paths, and the right one depends on what Mac you have. If you're on Apple Silicon (M1 or later), Shadowrocket is the obvious choice — the same iOS app you probably already use on your phone, sets up an OS-level tunnel, one-time purchase on the Mac App Store. If you're on an Intel Mac or you want a free native option, FoxRay is the clean alternative: full Reality support, free, also in the App Store.

This post covers both. Companion to the Windows v2rayN guide — same subscription URL works across all three.

Path 1: Shadowrocket on Apple Silicon

Shadowrocket is an iOS app, but Apple Silicon Macs can run iOS apps directly from the Mac App Store under the "iPhone & iPad Apps on Mac" listing. It's not a Catalyst port — it's the same binary as the iPhone build, running in an iPad-style window on macOS.

Hardware requirement: M1 or later. Intel Macs cannot install it — skip to FoxRay below.

Install

1. Open the Mac App Store and sign in.
2. Click your profile (bottom-left) → iPhone & iPad Apps.
3. Search Shadowrocket. One-time purchase, a few dollars.
4. Install. The app lands in /Applications like any native app.

If you already own Shadowrocket on the same Apple ID for iOS, the App Store recognizes it and the Mac install is free.

Add your subscription

The flow is identical to iOS:

1. Launch Shadowrocket. The first launch will prompt for VPN configuration access — approve it (System Settings → VPN → Shadowrocket should appear).
2. Bottom tab bar: Subscribe.
3. Tap + (top-right).
4. URL: paste your subscription URL. Typically looks like https://your-endpoint.example/<random-token>/sub.
5. Optionally set Remarks to whatever label you want.
6. Done.
7. Pull down on the Subscribe screen to fetch — the nodes appear under the subscription group.

Subscriptions auto-refresh every 24 hours by default. You can change the interval in the subscription's detail screen.

Connect

1. Bottom tab bar: Home (or Global).
2. Tap the node you want to use — the row highlights as active.
3. Top of the screen: toggle Connect on.
4. The first connection writes a "Shadowrocket VPN" profile to System Settings → VPN. A tunnel icon appears in the menu bar.

Shadowrocket on macOS uses a Personal VPN configuration (NEVPNManager), so by default all traffic routes through the tunnel — not just HTTP, not just browsers. This is closer to a traditional VPN than a per-app proxy.

If you want some traffic to bypass (LAN, specific domains, work apps), Shadowrocket's Rule tab supports the same Rule-Set / Direct / Reject syntax as on iOS — and Mac rules can be copy-pasted from your iOS config.

Path 2: FoxRay on any Mac

If you're on an Intel Mac, or you'd rather not pay, FoxRay is a free native macOS app from the Mac App Store. It embeds Xray-core directly and stays current on Reality.

Install

1. Open the Mac App Store.
2. Search FoxRay — fox head icon on a dark background.
3. Get → Install. Free.
4. Launch from /Applications or Launchpad.

FoxRay lives in the menu bar by default. There's a preference to also show it in the Dock if you'd rather.

Add your subscription

1. Click the menu bar icon → Manage Servers.
2. Click the + dropdown (top-left of the window) → Subscription.
3. Paste your subscription URL.
4. Save.
5. Right-click the subscription entry → Update. The nodes populate the server list.

Connect

FoxRay runs a local SOCKS5 server on 127.0.0.1:1086 and an HTTP proxy on 127.0.0.1:8118 by default. It does not set up a system VPN profile.

To route Mac traffic through it:

1. In Manage Servers, double-click a node to set it active.
2. Menu bar icon → Set As System Proxy → toggle on.

That writes HTTP/HTTPS/SOCKS values into your active network interface (visible at System Settings → Network → Wi-Fi → Details → Proxies). Apps that honor system proxy settings route through FoxRay; apps that don't (some games, some VOIP clients with hardcoded transports) bypass it.

If you need full-stack routing including those holdouts, check the current FoxRay docs — newer builds have added TUN-style routing options that go beyond the system proxy mechanism.

Verify the egress

Once a node is active and traffic is being proxied:

1. Open Safari (it respects system proxy reliably — good for testing) and visit ifconfig.me or whoami.akamai.net.
2. The IP should match your endpoint's outbound path — direct VPS IP, residential proxy IP, etc. — and not your real ISP IP.
3. Run a DNS leak test. The resolvers shown should be your endpoint's configured upstream DNS, not your ISP's.

If you see your real ISP IP, the tunnel isn't intercepting. Common causes:

• Shadowrocket: the Connect toggle is off, or macOS denied the VPN configuration profile. Re-enable under System Settings → VPN → Shadowrocket.
• FoxRay: "Set As System Proxy" isn't toggled, or the app you tested with ignores system proxy. Retry in Safari to rule that out.

If the egress IP is your VPS's public IP and you expected a residential exit, the issue is server-side — Xray on your endpoint isn't routing through its upstream proxy. The client can't tell you that.

Shadowrocket vs FoxRay

	Shadowrocket	FoxRay
Apple Silicon	✓	✓
Intel Mac	—	✓
Cost	one-time purchase	free
Default routing	system-wide VPN (NEVPN)	local proxy + system proxy toggle
Rule routing	iOS-style Rule tab, mature	URL Routing rules, less ergonomic
Best if	already use Shadowrocket on iOS	want free + native macOS

The deciding question is usually whether you already have an iOS Shadowrocket rule set you want to mirror. If yes, Shadowrocket on Mac is worth the few dollars to keep your behavior consistent. If no, FoxRay is plenty.

Daily use

• Switch nodes: tap a node in Shadowrocket, double-click in FoxRay.
• Pause without quitting: toggle Connect off (Shadowrocket) or "Set As System Proxy" off (FoxRay). The app keeps running.
• Refresh subscription: pull down on Shadowrocket's Subscribe tab; right-click → Update on FoxRay's subscription entry. Auto-refresh handles the rest.
• Quit fully: Shadowrocket → Cmd+Q. FoxRay → menu bar icon → Quit.

iOS, Windows, and macOS now share the same subscription URL model: set the endpoint once, reuse the URL everywhere, and switch clients per device based on what feels best on that platform.