Shadowrocket / Official Manual / Defined terms
Identify the English interface term first, then determine whether it controls a connection, rule, or config. The five categories below cover common terms; each card can be linked directly using its URL anchor.
01 / Interface
A connection issue can involve different settings. Check which page you’re on and the current status before changing anything, so you don’t confuse test results, routing mode, and the VPN switch.
Home is the main place to view your server list, current selection, and connection switch. After importing, check that the expected entry appears in the list, then confirm which entry is selected. An entry in the list means its details have been saved; it does not confirm successful authentication or access to the destination service.
Add Server lets you enter existing server details, and Type determines which fields are required. Choose the protocol based on the server information, then check the address, port, authentication details, and any additional options such as TLS. Don’t use passwords, user IDs, or transport settings from one protocol as if they applied to another.
Global Routing controls the overall routing mode: Config, Proxy, and Direct. Config evaluates rules in the currently enabled config, Proxy uses a proxy route, and Direct connects directly. When troubleshooting rules that don’t seem to work, check this setting first. In a mode other than Config, connections won’t necessarily behave as the config rules suggest.
On Demand connects the VPN when specified conditions are met; it does not guarantee that a server is available. After configuring it, check the status separately when switching Wi-Fi, using cellular data, locking the screen, and reconnecting. If the connection starts again after you turn it off manually, check these conditions before treating it as an unexpected reconnection.
Connectivity Test checks whether an entry is reachable under specific test conditions. The reported latency depends on the test target, method, and current network; it is not a direct measure of real-world download speed. If the test succeeds but an app cannot connect, also check DNS, rule matches, and the destination service.
DNS resolves domain names to IP addresses, a step that takes place before many connections are established. Domain rules and IP rules match different things, so the result and timing of resolution can affect subsequent matches. If a domain fails to load but its IP address works, note the resolution error rather than repeatedly switching servers.
URL Rewrite processes request URLs according to matching conditions; routing rules that determine where a connection goes operate at a different level. Whether a rewrite applies depends on the request format and relevant config conditions. First check whether the request matches the expression. Changing a URL is not the same as choosing PROXY or DIRECT.
Data shows traffic recorded by the client and related statistics, making it useful for tracking usage over time. Before interpreting the numbers, check the reporting scope, counting period, and whether the data has been reset. The client’s counting method may differ from your service provider’s, so these figures don’t reveal your remaining allowance or billing status.
02 / Protocols
Type must match the server. A protocol name describes only part of the communication method; actual speed and battery use also depend on network quality, transport, connection duration, and server settings.
Shadowsocks uses a specified encryption method and password for proxy communication. Check the server address, port, encryption method, and password together; confirming the password alone is not enough. Compatibility requirements can vary by method, so enter each field based on the server details you have.
VMess authenticates using parameters such as a user ID and can use different transport methods. Protocol type, transport, and TLS are separate settings, so check each one after importing. If authentication or a handshake fails, also confirm that the device clock is accurate before troubleshooting transport parameters.
VLESS separates user authentication from the specific transport protection method, so the name alone doesn’t tell you whether traffic is encrypted in transit. The user ID, transport settings, and security options required by the server must work together. VLESS and VMess are different protocols; changing Type alone does not mean the other fields will still apply.
Trojan typically uses TLS and password authentication. Along with the address and password, check the name used for certificate verification and any other parameters required by the server. A failed handshake does not necessarily mean the password is wrong; disabling certificate verification at random is not a substitute for troubleshooting.
An HTTP proxy forwards requests at the application layer and can also use CONNECT to tunnel to a destination. Check separately whether the proxy requires a username and password and whether traffic between the client and proxy server is protected. A destination using HTTPS does not mean every part of the proxy connection uses the same type of protection.
SOCKS5 negotiates the destination address and port; the protocol itself does not encrypt traffic. The client and server must both support the authentication method and UDP forwarding. If some apps work but real-time communication fails, check whether TCP and UDP are both available.
WireGuard is a UDP-based tunneling protocol that uses public-key identities, with a config structure unlike that of password-based proxies. Check the keys, peer address, tunnel addresses, and routing scope together. A private key is sensitive information: hide it when troubleshooting and never include the full config in a public screenshot.
Hysteria2 is based on QUIC; connection performance depends on UDP availability, packet loss, and congestion. Check authentication, TLS, and server-required settings such as bandwidth limits, but don’t treat a bandwidth field as a measured speed. The protocol itself does not guarantee speed; assess it using real tasks under comparable network conditions.
03 / Rule keywords
Rules specify what to match, then how to handle it. They’re evaluated from top to bottom, and the first match determines the action. More specific rules generally belong before rules with broader coverage.
Syntax example for reference—not a complete config to copy as-is
DOMAIN,api.example.com,PROXY
DOMAIN-SUFFIX,example.com,DIRECT
IP-CIDR,192.168.0.0/16,DIRECT
FINAL,PROXYHere, api.example.com matches the first line, so the second line does not determine its policy. The example domain is for illustrating match scope only.
DOMAIN matches an exact domain, for example DOMAIN,example.com,PROXY. This rule does not automatically include subdomains such as www.example.com. If a service uses multiple domains, use actual connection records to determine which ones to add.
DOMAIN-SUFFIX matches by domain suffix, covering the specified root domain and its subdomains. For example, example.com matches the domain itself and api.example.com, but not any domain that merely contains the same text. If a subdomain needs a different policy, put its more specific rule first.
DOMAIN-KEYWORD checks whether a domain contains a specified string, usually covering more than DOMAIN. That string may also appear in unintended domains, so weigh convenience against the risk of false matches. After making a change, check actual matches instead of testing just one destination.
IP-CIDR describes an IPv4 address range in CIDR notation, for example 192.168.0.0/16. The prefix length after the slash determines the network range; it does not represent a single address. Whether a domain request is evaluated against this rule also depends on the resolved address and relevant rule options.
IP-CIDR6 matches IPv6 address ranges, separately from the IPv4 ranges covered by IP-CIDR. If a destination provides both address types, IPv4-only rules may not cover every connection. If the same domain takes different routes, check which address type the connection actually uses.
GEOIP matches based on classifications in an IP geolocation database; it evaluates the address, not the website’s language. The database may lag behind changes and does not directly indicate where a service operator is based. For precise handling, add more specific domain or address rules based on the actual destination.
FINAL is the fallback rule used when none of the preceding rules match, and it is usually placed at the end. FINAL,PROXY sends unmatched connections to PROXY; it does not reprocess connections already matched by earlier rules. Because the fallback can affect many connections, identify which ones will reach it before making changes.
04 / Policies
Rule keywords answer “what to match”; policies answer “how to handle it.” Distinguish Proxy / Direct in Global Routing from PROXY / DIRECT in rule text.
PROXY sends matching connections through a proxy route; the actual exit also depends on the current selection and policy references in the config. A PROXY match does not confirm that the server is reachable. If the policy matches but a request still fails, check authentication, transport, and access to the destination.
DIRECT connects to the destination without using the selected proxy server. It affects only connections matched by this policy and does not turn off the VPN as a whole. Direct connections still depend on the current network and DNS working properly, so not every failure is caused by a rule.
REJECT blocks matching connections and is best used with clearly scoped match conditions. A broad domain keyword rule may block requests that a feature needs to work. If something suddenly stops working, check whether it matches REJECT before changing the rule’s scope.
Policy groups organize handling options that rules can reference; their behavior depends on the group type and its members. Groups used to organize servers in the Home list are not necessarily policy groups used for routing in a config. When a rule references a group name, confirm that the name and target exist; don’t mistake an organizational label for an exit policy.
05 / Subscription & configuration
Server entries, subscription sources, routing configs, and App Store purchase records serve different purposes. Check each separately when restoring or updating; success with one does not mean the others have been fully restored.
Subscribe imports and updates server entries from a subscription, which you get from your service provider. An update may change the number, names, or settings of entries, but it does not automatically replace the active Config. Subscription links often contain access credentials, so hide the full link before sharing logs or screenshots.
A server entry stores connection details such as the address, port, protocol, and authentication; its list name is just a label. Different names don’t necessarily mean different servers, and matching names don’t mean all settings are identical. When checking duplicates or connection differences, compare the actual fields.
Config is both the entry point for config files and the Global Routing mode that handles connections according to a config. A file can include rules, DNS, and other settings. Importing a file and selecting it as the active config are separate actions. Keep a backup before making changes, then check both the current file and Global Routing to determine whether a rule test is meaningful.
iCloud Sync transfers supported app data between devices; check the in-app options to see what is covered. Before moving to a new device, check the account and sync status, and keep a separate backup of any configs you need. Syncing does not guarantee that everything has been restored. On the new device, verify server entries, Config, and the current selection individually.
Purchased is where to find App Store purchase records and redownload apps; check using the original purchase account. Restoring an app purchase is separate from restoring in-app configuration, so check your data after reinstalling. Purchase eligibility, device compatibility, and system requirements are as listed on the App Store page.
Next / Continue by topic
Use the glossary to identify concepts, then follow the relevant guide for setup. If something goes wrong, troubleshoot step by step using connection status and match results.