Connection controls and modes
The connection toggle controls whether a connection is established; Global Routing determines how traffic is handled. They operate at different levels, so check them separately when troubleshooting.
Home
Home screen and connection status
Home is the main screen for viewing server entries, choosing a connection, and operating the connection toggle. A listed server entry only means its details have been saved; it does not confirm that the server is available. After connecting, check the result with an actual request.
Global Routing
Overall traffic handling
Global Routing has three modes: Config, Proxy, and Direct. Config routes traffic according to the active configuration, Proxy sends traffic through a proxy, and Direct connects without a proxy. These modes are also affected by system network conditions and app settings.
On Demand
Connect automatically under specified conditions
On Demand asks the system to establish a VPN connection automatically when specified conditions are met. Whether it connects depends on the selected conditions and system state. It does not choose PROXY or DIRECT for individual domains. If the VPN reconnects after you disconnect it manually, check this setting before deleting the configuration.
Add Server
Add server details
Add Server is the entry point for creating a server entry. The fields vary by protocol. Check the address, port, authentication, and transport settings against the server details you already have. Missing protocol-specific fields can result in a saved entry that fails to connect.
Config
Screen name and routing mode
Config can refer to the screen for managing configuration files or to the Config mode in Global Routing. Use the surrounding context to tell which one is meant. Saving a file on the configuration screen does not make it active for routing; after editing rules, check which configuration is in use.
Connectivity Test
Connectivity tests and what they measure
Connectivity Test checks a connection using a specified test method. Different methods may cover different parts of the connection. A successful test does not prove that every site is reachable, and the reported time is not a download speed. To investigate discrepancies, check DNS, rule matches, and actual requests.
Authentication, transport, and encryption
A protocol name determines which fields are required; it does not indicate speed. First make sure the server and client settings match, then check whether the network supports the selected transport.
Shadowsocks
Address, password, and encryption method
Shadowsocks establishes a proxy connection using details such as the server address, port, encryption method, and password. The encryption method must match the server. Check that all fields are present even after importing a share link. A correct password will not help if the encryption method is wrong.
VMess
Identity and transport settings
VMess uses identity information such as a UUID and may be configured with different transport methods and TLS settings. The UUID is only one part of the configuration: enter the address, port, transport path, and server name as required by the server. An incorrect device time can also affect authentication.
VLESS
Check authentication and transport security separately
VLESS does not provide content encryption by itself and is typically used with an appropriate transport security mechanism. After entering the UUID, check the transport type, security settings, and any additional parameters. Do not copy similarly named fields from another protocol into a VLESS entry.
Trojan
Password authentication and TLS
Trojan typically uses TLS and password authentication to establish a connection. The server name and certificate validation are important troubleshooting checks. If the address is reachable but the handshake fails, check the password, SNI, and certificate configuration first. Disabling certificate validation is not a routine fix.
Hysteria2
QUIC-based transport
Hysteria2 is based on QUIC, so connection performance depends in part on UDP availability on the network. Authentication, TLS, and optional settings must match the server. If the same entry behaves differently across networks, check UDP availability before repeatedly changing the password.
WireGuard
Keys and tunnel routing
WireGuard creates an encrypted tunnel using a key pair. Its configuration includes the local address, peer public key, endpoint, and allowed IP ranges. A successful handshake only confirms that part of the connection is established; routing or DNS may still affect access. Treat the private key as sensitive and keep it out of public screenshots.
HTTP / SOCKS5
General-purpose proxy types
HTTP and SOCKS5 are different proxy protocols. Check the address, port, and whether account authentication is required for each. The protocol name alone does not guarantee an encrypted connection, and support for traffic such as UDP varies. Choose the type actually provided by your server.
Matching conditions and routing policies
Rules are usually evaluated in the order shown in the configuration. The keyword on the left defines the match condition; the policy at the end defines what happens to matching traffic. Put specific rules before broader rules that could override them.
DOMAIN
Match an exact domain
DOMAIN matches an exact domain, such as api.example.com, and does not automatically include other subdomains. Enter a domain, not a full webpage URL, path, or query string. Use it to set a policy for a specific host.
DOMAIN-SUFFIX
Match a domain and its subdomains
DOMAIN-SUFFIX matches a domain and its subdomains, such as example.com and api.example.com. It matches domain hierarchy, not arbitrary strings. To handle a specific subdomain differently, add a more specific DOMAIN rule first.
DOMAIN-KEYWORD
Match a string in the domain
DOMAIN-KEYWORD matches when the domain contains the specified string, which may cover more domains than a suffix rule. A short keyword can match unrelated domains, so use it only when needed and check the request logs after adding it.
IP-CIDR / IP-CIDR6
Match an IP address range
IP-CIDR is for IPv4 ranges; IP-CIDR6 is for IPv6 ranges. The prefix length after the slash defines the range. These keywords match destination IP addresses, not domain text. Whether the destination has been resolved and the relevant rule parameters can affect matching.
GEOIP
Match by IP geolocation data
GEOIP checks the destination against records in an IP geolocation database. It does not use webpage language or domain suffixes. Database records may differ from a server's actual deployment location, and domains using a CDN may resolve to different addresses. Treat the result as an approximate database classification, not proof of a fixed physical location.
FINAL
Fallback for unmatched requests
FINAL handles requests that did not match any earlier rules and is usually placed at the end of the rule list. It does not recheck all rules; it assigns a route to the remaining requests. The wrong fallback can make domains without specific rules connect differently than expected.
PROXY / DIRECT / REJECT
Actions at the end of a rule
PROXY sends traffic to a proxy policy, DIRECT connects without a proxy, and REJECT denies the request. These are rule actions, not protocol names. Also distinguish the uppercase PROXY and DIRECT actions from the Proxy and Direct modes in the Global Routing interface.
[Rule]
DOMAIN,api.example.com,PROXY
DOMAIN-SUFFIX,example.com,DIRECT
FINAL,PROXYConnection details, rules, and purchase records
Subscriptions update connection details, configuration files organize processing logic, and App Store purchase records confirm app entitlements. Each serves a different purpose; they are not interchangeable.
A source of updatable server details
A subscription uses a remote URL to fetch and update a set of server details. Get subscriptions from your service provider. It differs from a single server share link and does not necessarily include routing rules. Subscription URLs may contain access credentials, so do not paste or share them publicly.
SERVER
Server entry
A server entry is a set of connection details, usually including the protocol, address, port, and authentication information. It is also commonly called a node. The entry name is just a label for identification; it does not confirm the server's location or availability. Check the actual settings and connection results when troubleshooting.
.conf
Section-based configuration files
Configuration files organize settings into text sections. [General] controls global behavior, [Rule] defines routing order, and [Host] can be used for local mappings. Importing a file does not mean it includes a usable server. Keep a copy before editing, and make sure you are changing the active file.
URL Rewrite
Processing request URLs
URL Rewrite applies specified actions to request URLs based on matching conditions. It is separate from rules that choose a proxy or direct connection. For encrypted requests, what can be accessed depends on TLS and related settings; a rewrite expression cannot be assumed to handle every request.
iCloud
Syncing app data
iCloud Sync keeps app-supported data in sync across eligible devices. Check the in-app options for the exact scope. Syncing, backing up, and restoring purchases are separate processes. Before switching devices, check your configuration backups, sync status, and the purchase account used with the App Store.
App Store purchase records
Purchased items are app records associated with the Apple ID used to make the purchase. They can help you find Shadowrocket when switching or reinstalling a device. They do not include the renewal status of a service provider subscription. Check the App Store listing for compatibility, system requirements, and whether a purchase applies universally.
Resolution, handshakes, and test times
Domain resolution, establishing a connection, and transferring data are separate stages. Identify where the failure occurs before changing the relevant setting, and avoid changing several variables at once.
DNS
Resolving a domain to an address
DNS resolves domain names to IP addresses for subsequent connections. A DNS failure can prevent a webpage from loading even when a connection test succeeds. Conversely, resolving an IP address does not guarantee that the server is reachable; check routing, the port, and the handshake as well.
dns-server
Resolver settings in a configuration
dns-server is a [General] setting for specifying DNS resolvers. system uses the resolver settings provided by the system. Before changing it, confirm that the active configuration is in effect and consider the network path used by DNS requests. Changing the resolver does not necessarily fix every access issue.
TLS / SNI
Transport security and server names
TLS protects data in transit. SNI tells the server which hostname is being requested during the handshake; the two are not interchangeable. The connection address may differ from the name used for certificate validation, so follow the server requirements. If a certificate error occurs, check the name and device time first.
What test results can tell you
Latency is the time taken by a specific test step. A timeout means the test did not complete within the allotted time; it does not confirm that the server has failed. Test method, DNS, and network path all affect the result. Low latency does not guarantee high throughput, so assess speed issues using actual data transfers as well.