Shadowrocket Supported Protocols: Shadowsocks, VMess, VLESS, Trojan & Hysteria2

1. Protocols, transports, and Global Routing

A protocol defines how the client and remote server authenticate, encapsulate, and transmit data. The transport determines which channel carries that data, such as TCP, UDP, WebSocket, or QUIC. TLS provides encryption and identity verification for the relevant connection layer. These settings are not interchangeable: two VLESS profiles may require different parameters because of their transport, TLS settings, or server requirements.

Home is where you manage and select connection profiles; Config is for managing configuration files; Settings is for adjusting app preferences. Global Routing in Home determines how requests are routed. It does not turn a Shadowsocks profile into a Trojan profile. Config routes traffic according to its rules; the result depends on which rule matches and its target policy, not on a fixed assumption that an entire category of sites will always connect directly.

2. Shadowsocks: Check Method and Password

Shadowsocks uses a pre-shared credential and encrypts and authenticates proxy data with the selected Method. Common AEAD Methods include aes-128-gcm, aes-256-gcm, and chacha20-ietf-poly1305. Each Method has its own key requirements and protocol details; similar names do not mean they are compatible. For specific extensions, confirm that both the client and server support them.

• In Home, tap “+” in the top-right corner to open Add Server, then set Type to Shadowsocks.
• Enter the remote host and listening port in Address and Port. Do not enter a subscription URL here.
• Method and Password must match the supplied parameters exactly. Do not use your account login password as the connection password.
• If the original parameters include additional obfuscation or plugin settings, keep those settings. A standard TLS toggle is not a substitute.

Saving successfully only means the profile was accepted; it does not confirm that authentication works. If the address is reachable but requests still fail, compare Method, Password, and any additional settings with the original parameters first, then check features such as UDP forwarding. Avoid changing several options at once, or it will be harder to identify the cause.

3. VMess and VLESS: Similar UUIDs Don't Make Them Interchangeable

Both VMess and VLESS may use a UUID as the user identifier, but their authentication and data-handling mechanisms differ. VMess has its own authentication and encryption mechanisms. VLESS does not encrypt payloads by itself; it must be paired with TLS or another security mechanism required by the server. Changing Type from VMess to VLESS does not convert one protocol into the other.

After selecting the matching Type in Add Server, enter Address, Port, and UUID, then check the transport and TLS options. For WebSocket, also verify Host and Path: /ws and / are different paths, so do not simplify them. For other security extensions, refer to the complete original configuration; copying only the address and UUID is not enough.

4. Trojan and HTTP/SOCKS5: Authentication vs. Encryption

Trojan typically uses TLS to protect traffic and Password for authentication. In Add Server, check Type, Address, Port, Password, and the TLS settings. The connection address and certificate identity may be different strings: Address can be an IP, while Server Name must match the server requirements and certificate identity. Do not change Server Name to the IP just because Address contains an IP.

HTTP and SOCKS5 are general-purpose proxy protocols. An HTTP proxy can use CONNECT to establish a tunnel, but CONNECT alone does not encrypt the connection between the client and proxy server. SOCKS5 username-and-password authentication does not provide transport encryption either. HTTPS on the destination website and TLS protection on the connection to the proxy endpoint are separate layers.

• Trojan: Check Password, TLS, and Server Name. If you see a certificate error, first verify the domain, device time, and certificate chain.
• HTTP: Check the address, port, and whether Username and Password are required. If the remote server requires an encrypted proxy connection, match its TLS settings as well.
• SOCKS5: Check the authentication method. For UDP forwarding, both the server and client must support it.
• For all protocols: Do not use web-console login credentials for proxy authentication unless your service provider explicitly confirms they are the same.

5. WireGuard and Hysteria2: Check UDP Availability

WireGuard is a UDP-based encrypted tunnel protocol that uses public and private keys to establish a peer connection. It does not use a VMess UUID or the Trojan Password format. When entering settings manually, check the existing configuration for the local Private Key, tunnel address, remote Public Key, Endpoint, and any required routing parameters. Keep the Pre-shared Key if one is provided. Private keys are sensitive and should not appear in public screenshots.

Hysteria2 is based on QUIC, relies on UDP, and uses TLS to protect the connection. After selecting Hysteria2 in Add Server, check the address, port, authentication details, and security settings such as Server Name. Include any obfuscation parameters from the original configuration. A network that allows TCP 443 may still block UDP 443.

A protocol name alone cannot predict real-world speed. Latency, packet loss, bandwidth limits, server load, and the current network's UDP policies can all affect results. If a Hysteria2 profile works on cellular but times out on Wi-Fi on the same device, network routing or UDP restrictions are worth checking—but that symptom alone does not identify the cause.

6. Add Server: Manual Setup and Subscribe Import

Add individual profiles when you need to check parameters; use Subscribe for bulk import and future updates. A subscription URL is used to fetch profiles—it is not the remote proxy's Address. https://example.com/sub?token=xxxx below is only a format example and cannot be used to connect. Get your actual subscription from your service provider.

1. Open the add screen

   Go to Home and tap “+” in the top-right corner to open Add Server. For manual setup, first select the protocol that matches the original parameters in Type.

2. Enter connection details

   Fill in Address, Port, and the relevant authentication fields for the protocol. Then check TLS, Server Name, transport, and Path. Do not replace server-specific requirements with common defaults.

3. Import a subscription

   If you already have a subscription, go to Add Server → Type and select Subscribe. Enter the complete subscription URL in URL, save, and wait for the profiles to load. Do not enter it in a protocol's Address field.

4. Check and test

   Return to Home and check the number of imported profiles and each profile's Type. Select one and connect, then test a specific destination. Distinguish latency results from whether the actual request succeeds.

5. Keep the update source

   To sync changes from your service provider, update the subscription in Home. After updating, check that the profiles are still present. Do not rely on local edits to subscription-generated profiles as a way to preserve changes long term.

7. Protocol Settings Are Correct, but Check Global Routing

If a connection test succeeds but a particular site does not load, first confirm that its request is actually using the selected profile. Config under Global Routing applies the rules in the configuration. For example, if an earlier DOMAIN-SUFFIX rule matches, a later FINAL rule will not handle that request. IP-CIDR matches IP ranges; GEOIP matches based on the destination IP's region. Neither is a protocol selector.

Scene organizes related settings by scenario; it is not a protocol. Settings → On Demand manages automatic connection conditions and does not change a profile's Type. For troubleshooting, keep test conditions consistent, check Global Routing and the active configuration, then separately check for On Demand behavior.

8. Common Protocol Setup Questions