Shadowrocket
Features and Essential Settings

01 / GLOBAL ROUTING

Global Routing: Config, Proxy, and Direct

What it does: Global Routing determines how requests handled by the client are processed. Config, Proxy, and Direct are the three available modes; they are not three separate servers or connection-quality levels. After choosing a mode, check the connection switch, server selection, and system permissions.

Where to find it and how to set it: Open Global Routing from Home and choose a mode for your needs. Select Config to route traffic by domain or address using an existing rule configuration. To check whether rules are causing an issue, temporarily switch to Proxy or Direct, test the same destination each time, and note the results.

Keep in mind: Proxy does not mean that every system operation necessarily follows the same route; the actual scope depends on the system and traffic-handling settings. Direct does not turn off the connection switch. Restore the original mode when troubleshooting is complete. Otherwise, traffic may be handled differently even if the configuration file is unchanged. If Proxy works but Config does not, check which rule is matched before reimporting server details.

02 / CONFIG

Proxy rules: match conditions and policies

What they do: A rule usually consists of a match type, match value, and policy. DOMAIN matches an exact domain; DOMAIN-SUFFIX matches a domain and its subdomains; DOMAIN-KEYWORD matches a keyword in a domain. IP-CIDR and IP-CIDR6 describe IPv4 and IPv6 ranges, respectively, while GEOIP matches against an IP geolocation database. USER-AGENT depends on request information being available, so it is not a reliable general-purpose condition for all app traffic.

Where to find them and how to set them: Open Config, confirm which configuration is active, then review its rules and policies. Rules are generally evaluated in order, so put specific conditions before broader ones and use FINAL at the end to handle requests that do not match earlier rules. PROXY sends traffic to a proxy policy, DIRECT connects directly, and REJECT blocks the request. If the configuration refers to a named policy, check which object that name points to.

DOMAIN-SUFFIX,example.com,PROXY
DOMAIN-KEYWORD,example,PROXY
GEOIP,CN,DIRECT
FINAL,PROXY

The example above illustrates rule syntax only. example.com is a placeholder domain, not a complete configuration to import. The first rule already covers the specified domain, so it does not depend on the keyword rule below it. FINAL handles requests not matched by earlier rules. To find errors, consider “what is being matched” separately from “where it is sent” rather than looking only at PROXY at the end of a line.

Keep in mind: Rules cannot fix an unavailable server. Change one thing at a time, save, confirm the configuration is still active, and then test the request again. For IP-based rules, account for DNS results, IPv6, and database differences. A single geographic match does not tell you the actual route of every request.

03 / HOME · SUBSCRIBE

Subscriptions and server management

What they do: A server entry stores the protocol and parameters needed for a connection. Subscribe updates the server list from a subscription URL you already have. Subscriptions and Config are separate objects: importing a server list does not switch to a rule configuration or select a default server.

Where to find them and how to set them up: Use the add option on Home. To import an existing subscription, select the Subscribe type, paste the complete URL, add a recognizable label, and save it before updating. To add a server manually, choose the protocol specified in your server details under Add Server, then enter the address, port, and authentication parameters. Scan QR Code is for a valid QR code you already have.

Shadowsocks, VMess, VLESS, Trojan, HTTP, SOCKS5, WireGuard, and Hysteria2 use different parameter formats. The same address does not mean you can change the protocol, and a server domain is not automatically the right value for every TLS field. Use the details you already have. For field descriptions, see the protocol reference.

Keep in mind: Updating a subscription may change server names and list contents. After an update, confirm the default server is still the one you want and has not been removed. Importing the same subscription more than once makes it harder to manage. Before deleting an entry, check whether it was created by a subscription or added manually. Subscription URLs may contain access credentials; hide the full URL and authentication details before sharing screenshots, logs, or configurations.

04 / ON DEMAND

On Demand: connect when conditions are met

What it does: On Demand is the setting for the system’s automatic connection feature. It can trigger a connection when configured conditions are met. It does not assign domains to PROXY or DIRECT; connection triggers and traffic routing after connection are separate settings.

Where to find it and how to set it: Find On Demand in Settings. Review the current conditions before enabling the rules you need. If the interface offers conditions based on network type or a specific network, set them for your actual use case. After saving, test on the relevant network and check that the system has allowed the VPN configuration to be added.

Keep in mind: On Demand may start the connection again after you manually disconnect. This does not necessarily mean the switch is malfunctioning; first check the trigger conditions. If you’re troubleshooting a connection failure, temporarily turn off On Demand and test with a manual connection so the conditions are repeatable. Re-enable it when you’re done. The system controls when a connection is triggered after a network change, so On Demand does not guarantee a continuous connection in every situation.

05 / DATA

Data: view traffic statistics

What it does: Data shows traffic statistics recorded by the client to help you review activity during a connection. It reflects only the client’s own measurement scope, not a complete record of all device traffic, and does not replace usage records from a service you already use.

Where to find it and how to use it: Open Data and identify the displayed time period, direction, and grouping before comparing changes. For example, open just one destination you want to test, note whether the figures increase, and consider the current Global Routing mode. If the interface offers a statistics reset, check whether you need to keep the existing records before using it.

Keep in mind: An increase in traffic shows data activity, but does not by itself prove that the destination loaded successfully or that every request followed the expected policy. Background requests, retries, and connection overhead may also be counted. Don’t compare totals across devices or directly with a provider’s records without first checking each one’s time period, units, and measurement method.

06 / SETTINGS

Settings: what to know about common options

Settings may vary by platform and system permissions. Use the feature names below to find the relevant options; menu levels are not fixed paths. Before changing anything, note its original value. If an option is available both in the current configuration and globally, check whether the active configuration overrides it rather than repeatedly changing the same setting in multiple places.

DNS: check the name resolution path

Purpose and location: DNS translates domain names into IP addresses. Check DNS-related items in Settings and in the active configuration. How to set it: First check whether the current configuration specifies a resolution method. Adjust it to match your existing configuration details, save, and retry the request. Keep in mind: Successful DNS resolution does not mean the proxy connection works, and changing DNS will not fix incorrect authentication details. If an IP address works but its domain does not, DNS is one of the first things to check. Not every connection issue is a DNS problem.

Test Method: keep tests consistent

Purpose and location: Test Method in Settings determines how the relevant connection test is performed. How to set it: Choose an available method in the current interface, then return to Home and run Connectivity Test. When comparing servers, keep the test method and network conditions the same. Keep in mind: Different test methods cover different stages of a connection, so their results are not directly comparable. A successful test does not prove that every website, protocol, or long-duration transfer will work normally.

Today Widget: check the quick-access widget

Purpose and location: Today Widget is a setting related to system widget display. Check the available options in Settings. How to set it: Configure the displayed items using the options provided by the app and system, then check the relevant system widget area to see if it can be added. Keep in mind: Widget availability, refresh timing, and available actions depend on the system version. If it does not appear, check the system’s widget settings rather than rebuilding your server configuration. If the widget’s status is unclear, verify it in Home in the app.

iCloud: check sync scope and conflicts

Purpose and location: iCloud-related options manage syncing or restoring data supported by the app. Find them in Settings. How to set it: Confirm you’re signed in to the intended system account, that the app is allowed to use iCloud, and that the displayed sync scope is correct before syncing or restoring. Keep in mind: Don’t assume that connection status, statistics, or configurations across all platforms will automatically stay in sync. Keep a working configuration before restoring. If there’s a conflict, identify which content is local and which is in the cloud to avoid overwriting newer changes with older data.

Diagnostics: gather troubleshooting details

Purpose and location: Find Diagnostics in Settings and use the app’s diagnostic or log options to look for clues. How to use it: Start with a reproducible issue, collect records for that test as prompted, then turn off detailed logging when you no longer need it. Keep in mind: Logs may contain destination domains, server addresses, and other sensitive information. Remove authentication parameters, subscription credentials, and unrelated details before sharing them. Don’t share your entire configuration as an ordinary screenshot.

07 / CONNECTIVITY TEST

How to verify changes

Test one issue at a time to distinguish between a server that isn’t selected, a failed server connection, an unexpected rule match, and an issue with the destination itself. Don’t change DNS, protocol parameters, Global Routing, and rules all at once. Even if things start working again, you won’t know which change made the difference.

1. Check Home. Confirm your existing server details are complete, a default server is selected, the connection switch is in the expected state, and system permissions are still enabled.
2. Run Connectivity Test. Keep Test Method unchanged and note your current network and the result. If the test fails, first check the address, port, authentication details, and subscription update status.
3. Compare Global Routing modes. Temporarily use Proxy and Direct to reach the same destination, then restore Config. If the difference appears only in Config, review the active configuration and its rule policies.
4. Check settings based on the symptoms. Check DNS for domain resolution issues, On Demand for unexpected automatic reconnections, and Data for questions about traffic statistics. If needed, use Diagnostics to collect relevant records.
5. Restore your usual setup. Restore the temporary test mode, turn off detailed logging you no longer need, and keep a note of effective changes and original values to avoid repeating the same troubleshooting next time.

To check how to get the app, use the specified App Store product page for iPhone / iPad. Refer to the App Store listing for system requirements. Mac, Windows, Android, and Linux installers are available from this site’s download guide. For more issues and troubleshooting guidance, see the FAQ. There’s no need to reset all settings after a single failed test.