Official guide · Names and meanings
First distinguish interface options, protocols, match conditions, and policies, then review the configuration. Terms are kept in English, with explanations of their roles in Shadowrocket and what their names alone cannot tell you.
Interface
Page names identify where to perform an action; they do not indicate that a connection has succeeded. When troubleshooting, check the current selection, connection status, and actual request results separately.
Home is where you view server entries and access connection controls. An entry in the list means only that its details have been saved; it does not confirm that the entry is currently usable or that a VPN connection is active. Before connecting for the first time, check the selected entry and Global Routing, then start the connection. Do not confuse a selected list item with an active connection.
Global Routing controls how traffic is handled overall. The interface options are Config, Proxy, and Direct. Config uses the current configuration, while Proxy and Direct apply proxying or direct connections to traffic as a whole. If rules do not seem to work, check this selection first; changing Rule does not replace the overall routing mode.
On Demand triggers VPN connection behavior when configured conditions are met; it does not assign a destination to each domain. It operates at a different level from routing rules and cannot supply missing server authentication details. If a connection starts again after you turn it off manually, check the enabled On Demand conditions and adjust them if needed.
Add Server is where you enter details for an existing server manually. Select the correct protocol first, then enter the address, port, and authentication details. Transport and TLS options must also match the server settings. Saving confirms only that the form was accepted; test the connection afterward. Do not reuse an arbitrary set of parameters with a different protocol.
Connectivity Test checks whether an entry is reachable using the selected test method. Its latency reading reflects response time under specific conditions, not sustained download speed, and does not mean every website or app request will succeed. Compare results using the same test method and network. If a single test times out, also check DNS, authentication, and the destination address.
Data shows traffic statistics. Interpret the figures in light of the selected view, reporting period, and current connection. Upload and download are separate directions, and totals viewed by server may differ from totals viewed by app. If the figures are zero, first check whether the request passed through the connection being monitored; do not use the statistics alone to decide whether a service is working.
DNS resolves domain names to IP addresses, usually before a connection to the destination is established. A successful lookup does not guarantee that the destination service is reachable, and a failed lookup does not mean the server password is wrong. When troubleshooting, distinguish DNS resolution from connection setup and check the DNS settings in the current configuration rather than changing unrelated options at the same time.
Protocols
A protocol defines how a client and server communicate; it does not determine rule matching order. The descriptions below assume you already have your own server details. Check all parameters against the server's actual configuration.
Shadowsocks establishes a proxy connection using an agreed encryption method and password. The method, password, server address, and port in the client must match the server; matching protocol names alone do not guarantee compatibility. If your details include a plugin or other transport parameters, check those fields too. Changing the encryption method will not fix an incorrectly entered address.
VMess uses credentials such as a user ID for authentication. Connection details may also include transport and TLS settings. A correct user ID does not mean the connection details are complete; fields such as the hostname and path may also be required. After importing, check every field against the original details. Protocol, transport, and security are separate settings.
VLESS uses a user ID for authentication, and the connection also depends on transport-layer and security-layer settings. Protocols with similar names are not interchangeable; select the type used by your server. If the connection fails, check the user ID, transport, and security settings separately. Filling in one field does not confirm that the entire entry is correct.
Trojan typically uses TLS and a password for authentication. In addition to the address and port, check that the password, TLS hostname, and certificate match. Certificate errors and authentication failures are different issues. Confirm the correct hostname and certificate settings rather than routinely disabling certificate verification.
Hysteria2 is a QUIC-based proxy protocol that relies on UDP reachability and correctly configured authentication and TLS settings. The protocol name does not guarantee speed; performance depends on the network and should be tested. First confirm that the existing server uses Hysteria2, then check the port, authentication details, hostname, and whether the current network supports UDP.
WireGuard uses public and private keys to establish an encrypted tunnel. Its configuration generally distinguishes local details from peer details. The peer public key, endpoint address, tunnel addresses, and allowed routes each serve a different purpose and are not interchangeable. Treat the private key as sensitive and remove it before sharing troubleshooting details. Even when the tunnel is established, check that routing and DNS behave as expected.
HTTP and SOCKS5 are different proxy protocols. Select the type the server actually supports. The protocol name alone does not mean all traffic is encrypted; understand proxy protection separately from HTTPS to the destination website. If the server requires a username and password, enter both. A correct address and port do not make authentication optional.
Rules & Policies
Rules specify what to match and then what action to take. Order matters: typically, processing stops at the first match. Put specific rules before broader ones and place FINAL last.
Rule refers to the rules section of a configuration. In text configurations, this section is marked [Rule]. Rules are usually checked from top to bottom, and the policy on a matching rule is applied without checking subsequent ordinary rules. Before editing, confirm which Config is in use and keep a copy of the original. Editing a file that is not enabled will not change how current requests are handled.
DOMAIN matches an exact domain name. For example, DOMAIN,example.com,DIRECT applies only to that domain. It does not automatically include all subdomains; add separate conditions for subdomains or use an appropriate suffix rule. The domain field should not contain a full webpage URL with a path, since that does not match the rule type.
DOMAIN-SUFFIX matches domain names by suffix and typically covers both the specified domain and its subdomains. The example DOMAIN-SUFFIX,example.com,PROXY shows this scope; it does not search for the same text anywhere in an arbitrary URL. To apply a different policy to a particular subdomain, put a more specific DOMAIN rule before this one.
DOMAIN-KEYWORD checks whether a domain name contains a specified keyword. It usually matches more broadly than an exact domain or suffix rule. A short keyword may appear in unrelated domain names, so it is not a good substitute for a known, exact domain. If a rule affects unexpected requests, check the keyword's scope and its position in Rule, then narrow the condition if needed.
IP-CIDR and IP-CIDR6 match destination addresses against IPv4 and IPv6 ranges, respectively. The prefix length after the slash determines the range. For example, IP-CIDR,192.168.0.0/16,DIRECT specifies an IPv4 range. These rules match addresses, not domain-name text. Whether DNS resolution is needed first depends on the rule parameters and current DNS behavior.
GEOIP matches destination addresses based on their location in an IP geolocation database, for example, GEOIP,CN,DIRECT. It does not analyze page content, domain suffixes, or the user's location. Database results may also differ from the actual location of a service. To apply a fixed policy to a known domain, use a more specific domain rule before GEOIP.
FINAL is the fallback rule used when none of the preceding rules match, so place it last in the Rule section. For example, FINAL,PROXY sends remaining requests to the PROXY policy. FINAL does not override the results of earlier rules or guarantee that the proxy connection will work. If it appears too early, subsequent rules cannot match as intended.
PROXY, DIRECT, and REJECT are policy names in rules: use a proxy policy, connect directly, or reject a request. These uppercase keywords operate at a different level from the Proxy and Direct options in Global Routing. PROXY does not include specific server credentials, and DIRECT does not turn off the entire VPN. Interpret the actual behavior in context of the current mode and configuration.
Subscribe & Config
Subscriptions mainly manage connection entries; configurations mainly describe how traffic is handled. Importing, saving, selecting, and enabling are separate actions, so check the result of each.
Subscribe imports or refreshes server entries using a subscription URL you already have. The entries depend on the response from that URL. An update may add, change, or remove entries, so check whether the currently selected entry is still present afterward. Importing a subscription is not the same as importing a complete routing configuration. A link may contain access credentials, so do not share the full URL when troubleshooting.
SERVER refers to a server entry containing a connection destination and its parameters, typically including protocol, address, port, authentication, and transport settings. The display name is just a label for identification; it does not confirm the server's actual location or reachability. Check the individual fields in the details you already have, and distinguish manually created entries from subscription-managed ones to avoid mistaking a refresh for an unexpected change.
Config is both the name of the interface for saving and selecting configurations and an option in Global Routing for handling traffic according to a configuration. A configuration file may contain sections such as General and Rule, each describing a different aspect of behavior. Saving a file does not mean it is selected, and the selected file should be considered alongside Global Routing. When troubleshooting, first confirm which configuration is actually active.
URL Rewrite rewrites request URLs and other content using match expressions; it differs from routing rules, which determine where a connection goes. Whether it can process a request depends on the match scope and whether the request meets the relevant conditions. The presence of a rule alone does not prove it ran. Before making changes, understand the expression and replacement target. Encrypted requests may require separate checks of the relevant processing conditions.
App Store
Check app purchases, device compatibility, and connection details separately. Shadowrocket is a closed-source commercial app; an App Store purchase does not include server configuration details.
The App Store is the only place to purchase and install Shadowrocket, primarily for iPhone and iPad. Compatibility with Mac, Apple TV, and Apple Vision is also listed on the same product page. System requirements and purchase availability should always be checked on the App Store page. The getting the app guide on this site brings together the steps to verify your purchase.
To verify the official app, check the official icon, developer name Shadow Launch Technology Limited, and app ID 932747118. Confirm the app ID in the product page URL as id932747118; do not rely on a similar name in search results. The official icon should match the one in this site's header. Verify all three details together.
Purchased is where you find your app purchase history and redownload the app. Use the Apple ID used to make the purchase. Redownloading the app and restoring its configuration are separate tasks; restore server entries and configuration details from your own backup or existing information. If you cannot find the purchase, first check the account used and the App Store status. For recovery steps, see restore a purchased app.
A one-time purchase refers to the app itself. The US App Store price is $2.99; check the App Store page for the current price, as prices are shown in local currency in other storefronts. A one-time client purchase is not a service plan, and purchasing the app does not generate server details. Before connecting, import a subscription or server details you already have. Purchase availability is determined by the App Store listing.