Official Manual · Quick Reference
Find terms by where they appear. First distinguish the connection toggle, routing mode, and rule policy; then check subscription, protocol, and DNS settings.
This page assumes you already have your own subscription or server details. Shadowrocket is a paid Apple-platform app available exclusively on the App Store. A one-time app purchase ≠ a service plan. Purchasing the app does not provide server details.
Connections & Routing
Whether a connection is established and which route it takes are two separate questions. The Global Routing selection is not the same as the connection toggle at the top of the screen.
Home is the main place to view your server list, select a server, and control the connection. A successful import only means the details were added to the list; it does not mean a connection has been established. Select a server and turn on the connection toggle. On the first connection, the system may ask permission to add a VPN configuration. After granting permission, run a connectivity test.
Global Routing sets the overall routing mode: Config, Proxy, or Direct. Config routes traffic according to the active configuration, Proxy uses a proxy route, and Direct uses a direct route. If rules do not seem to work, first select Config, then check the active configuration and rule order.
Config has different meanings depending on where it appears. As a page name, it opens configuration management; as a Global Routing option, it routes traffic according to the active configuration. Saving a file and setting it as the active configuration are separate actions. After making changes, confirm which file is in use instead of checking only whether it appears in the list.
Proxy is the proxy mode in Global Routing and generally routes connections handled by the app through a proxy. It is not the same setting as PROXY at the end of a rule: the former controls the overall routing mode, while the latter is the policy applied when a rule matches. To check how rules are working, switch back to Config.
Direct is the direct mode in Global Routing and routes connections handled by the app directly. Selecting Direct does not turn off the system VPN configuration or delete any servers. After testing, restore the previous routing mode so you do not mistake overall direct routing for a rule that is not working.
On Demand triggers connection behavior based on conditions such as the network or domain, determining when to connect. It operates separately from routing rules, which determine where traffic goes after a connection is established. If the app reconnects after you disconnect manually, check whether the On Demand conditions are still met, then test the trigger scope one condition at a time.
Connection Settings
A protocol determines how the client and server communicate. Choose the type specified by your existing server details. The name alone does not indicate speed, and changing the protocol label is no substitute for checking the settings.
Shadowsocks is an encrypted proxy protocol. Common settings include the server address, port, encryption method, and password. The encryption method in the client must match the server; do not choose an option just because its name looks similar. If a connection fails after import, first check that all settings are complete, then check server reachability and the current network.
VMess is a proxy protocol where the identity credentials and transport settings together determine whether a connection can be established. Whether fields such as UUID, transport, path, Host, and TLS are required depends on the actual server configuration. Checking only the address and port is not enough; also verify the device time and make sure the imported details include all transport settings.
VLESS is a proxy protocol that typically requires compatible transport and security-layer settings. Using the same protocol does not mean two sets of server settings are interchangeable. Check the identity credentials, transport, and security options together. Do not reuse field values from another protocol, and make sure the import format matches the actual data.
Trojan typically establishes connections over TLS, so the authentication details, server name, and certificate settings need to match. The connection address may differ from the name used for TLS verification; use the existing server settings as your reference. If a certificate error occurs, check the name, device time, and server certificate status first. Do not make skipping verification a routine fix.
Hysteria2 is a QUIC-based proxy protocol that depends on UDP availability, authentication details, and security-layer settings. A successful test on one network does not guarantee the same route will work on another. Check UDP support on the network separately from the server settings, and set bandwidth options according to actual conditions.
WireGuard creates a tunnel using public and private keys. Common settings include the local address, peer public key, Endpoint, and Allowed IPs. It is not configured by entering only a server address and password; missing address or routing settings can also prevent access. Protect the private key when backing up data or sharing diagnostic screenshots.
Matching Conditions & Policies
Rules are generally checked from top to bottom, and the policy for the first match is applied. Put the matching condition before the policy; more specific rules should usually come before broader ones.
DOMAIN matches an exact domain, for example DOMAIN,example.com,DIRECT. This rule does not automatically match subdomains such as www.example.com. To change routing for one exact domain, use an exact match and place it before any broader rule that might match first.
DOMAIN-SUFFIX matches a domain and its subdomains, for example DOMAIN-SUFFIX,example.com,PROXY. It can match both example.com and www.example.com, but does not match an arbitrary string anywhere in a domain. To route the same domain and its subdomains consistently, make sure more specific exceptions come first.
DOMAIN-KEYWORD matches a string contained in a domain name. It usually covers more than DOMAIN or DOMAIN-SUFFIX, and may also match domains you did not intend to include. After adding this rule, check the actual requested domains and match results. When a requirement can be expressed with a specific domain, prefer the more precise condition.
GEOIP matches a rule based on the target IP address's geographic database entry, for example GEOIP,CN,DIRECT. The database entry does not indicate the server's real-time physical location, and a website's language alone cannot determine whether the rule will match. DNS results and database records both affect the outcome, so check the actual connection details.
IP-CIDR matches destination IPv4 addresses using CIDR notation, for example IP-CIDR,192.0.2.0/24,DIRECT. The prefix length after the slash determines the address range; it is not a port number. Use IP-CIDR6 for IPv6 ranges. Before adding a rule, check the address family and make sure the range does not include more targets than intended.
FINAL specifies the policy to apply when none of the preceding rules match, for example FINAL,PROXY. It is usually placed at the end of the rule list and does not identify any particular domain. If a connection reaches FINAL, first check whether the preceding conditions cover the actual destination before adding another rule.
PROXY, DIRECT, and REJECT are policy names applied when a rule matches; they mean proxy, direct, and reject. To determine which server PROXY uses, also check the current selection and policy relationships in the configuration. These are uppercase rule keywords and should not be confused with the Proxy and Direct options in Global Routing.
Importing & Managing Settings
Server lists, routing configurations, and app purchases each serve a different purpose. This site does not provide, sell, or recommend servers or subscriptions. The steps below apply only to information you already have.
Subscribe imports and updates an existing server list. A subscription URL may contain credentials. A subscription is not proof of purchase for the app and may not include complete routing rules. Enter the full URL without extra spaces. When sharing diagnostic information, redact any authentication details in the URL.
A server is a set of server-side settings required for the client to connect, typically including the protocol, address, port, and authentication details. It may also be called a node in Chinese-language documentation. The name in the list is only a label and does not confirm that the server is working. After selecting one, check the connection status, routing mode, and actual request results.
Add Server is the entry point for manually entering server details. First select the protocol that matches your existing settings. Required fields vary by protocol; entering only an address and port does not guarantee the details are complete. Check each authentication and transport setting before saving. Manual entry works best when all parameters are known; if details are missing, check the original record first.
A configuration file organizes routing rules and related network settings, determining how connections are handled. A subscription typically provides a server list, determining which servers are available to connect to. The two are not interchangeable. Before editing, confirm which file is active and save a backup. Afterward, test the target request to verify which rule matches.
Updating a subscription reloads its existing URL and refreshes the server list; it does not update Shadowrocket itself. Server names, settings, or the number of servers may change, and local edits may be affected. If an update fails, first check that the URL is complete, the network is working, and the response is valid. Do not immediately delete entries that still work.
Back up server and configuration data before editing, deleting, or moving it so you can restore it later. Restoring an app purchased from the App Store and restoring its in-app data are separate processes. Backups may contain subscription credentials, passwords, or keys. Store them securely and confirm that they include the settings currently in use.
DNS & Diagnostics
Check domain resolution, server connectivity, and whether the target request completes as separate steps. A single latency test cannot confirm that everything is working.
DNS resolves domain names to IP addresses and is often one of the first steps in a network request. Check the DNS resolution path separately from the path used by subsequent application traffic; changing routing rules may not affect all DNS behavior. If a domain cannot be reached, first check whether it resolves, then test connectivity to the returned address.
DNS over HTTPS, commonly called DoH, sends DNS queries over HTTPS. It protects queries between the device and the DNS service; it does not mean all application traffic uses the same route. Configure a complete, reachable service address. If something fails, determine whether the DNS service or the destination website is unreachable.
Latency is the time measured by a particular test under the network conditions at that moment. It does not directly indicate download speed, throughput, or connection stability. Results from different test methods should not be compared directly, and timeouts need to be considered in light of the test target. Use rankings only as a guide; judge a server by whether real requests complete reliably.
Connectivity Test checks reachability under the current test conditions. Interpret the result alongside the selected server, Global Routing mode, DNS settings, and test target; it does not prove that every app will work. After connecting for the first time, run the test, then try the destination you actually need. If it fails, check each layer separately rather than changing several settings at once.
URL Rewrite rewrites request URLs according to matching conditions. It differs from routing rules that decide whether a connection uses a proxy or a direct route. Whether it can affect a request depends on the protocol, which parts of the request are visible, and the relevant settings; adding a rule does not make it apply to all traffic. Check the match scope before making changes to avoid affecting unrelated requests.