Shadowrocket Features and Settings Guide

Global Routing: Choose one of three modes

Global Routing determines how requests are handled overall; it is separate from the connection toggle. Find Global Routing on Home and choose Config, Proxy, or Direct based on what you need. These options describe configuration-based, proxy, and direct handling; use the English labels shown in the app. Existing long-lived connections may not immediately use the new mode. To verify a change, send a new request rather than checking a page that was already open.

Option in the app	What it does	When to use it	What to keep in mind
Config Configuration	Applies rules from the currently selected configuration.	When different destinations need different policies.	Check which configuration is active and the order of its Rule entries.
Proxy Proxy	Handles requests in proxy mode, primarily for checking the selected proxy route.	When you want to set rules aside temporarily and check whether an existing server works.	This does not mean all system traffic follows the same route.
Direct Direct	Handles requests using a direct connection.	When comparing with direct access on your current network.	Selecting Direct does not turn off the system VPN connection.

For everyday rule-based routing, start with Config. If a destination fails, note the current mode, then try Proxy or Direct temporarily for comparison. Restore the original setting afterward. The comparison shows how different routes behave; it does not, on its own, identify whether the server, DNS, or destination service is at fault. Check the logs as well.

Config can be confusing because it names both a menu and a Global Routing mode. The Config menu manages configuration files; the Global Routing option means “use the current configuration.” Opening a file in Config does not necessarily make it active. Check which configuration is selected before enabling it.

Rule: Understand rule types and policies separately

Rule types identify requests; policies determine what happens when a rule matches. In Config, open the configuration you use and check Rule or the corresponding [Rule] section. Rules are processed from top to bottom, and processing stops at the first match. Put specific exceptions before broader rules, and keep FINAL at the end as a fallback.

DOMAIN matches an exact domain, DOMAIN-SUFFIX matches a domain suffix, and DOMAIN-KEYWORD matches a keyword in the domain. IP-CIDR and IP-CIDR6 describe IPv4 and IPv6 address ranges, respectively. GEOIP uses an IP geolocation database when evaluating a request. Domain and IP rules look at different things. A page belonging to one domain does not mean every resource it loads will match the same rule.

[Rule]
DOMAIN-SUFFIX,apple.com,DIRECT
DOMAIN-KEYWORD,adservice,REJECT
DOMAIN-SUFFIX,example.com,PROXY
IP-CIDR,192.168.0.0/16,DIRECT
GEOIP,CN,DIRECT
FINAL,PROXY

The examples above show syntax; they are not a complete configuration. DIRECT means connect directly, REJECT means reject the request, and PROXY sends it to a proxy policy. Check the current selection to see which server that policy uses. Policy keywords are uppercase and are distinct from the Proxy and Direct options in Global Routing.

Before editing, save a copy of the original configuration. Add just one rule with a clearly defined scope, save it, confirm that the configuration is active, and test again. If the rule has no effect, check that Global Routing is set to Config, that no broader rule above it already matches, and that the request uses the domain or address you expect. Do not move FINAL to the top: it would act as a fallback before the other rules have a chance to match. For more on rule order, see Custom Rules and FINAL.

Subscribe and Add Server: Manage details you already have

Subscriptions let you manage server entries in bulk; manual setup lets you enter a specific set of connection details. Both require information you already have. From Home, select Add Server, choose the matching type, and enter the details you have. To import a subscription, select Subscribe from the relevant menu and enter your own subscription URL. You can also use options such as Scan QR Code to import existing details. Check where the content came from and what it is for before importing it.

When entering details manually, check the address, port, authentication details, and protocol requirements individually. Shadowsocks, VMess, VLESS, Trojan, Hysteria2, WireGuard, and other protocols use different parameters; changing only the type while keeping the other fields is not enough. Enter TLS, transport, and related values as specified in your source details. Do not disable validation or change parameters just to clear an error.

A successful import only means the app read the content; it does not guarantee the server can connect. Return to Home, check the group and entries, select the server you want to use, and run Connectivity Test separately. Subscription updates may add, remove, or change entries. Save important notes and independent edits first; do not assume local changes will survive the next refresh.

A subscription URL may contain access credentials. Redact the full URL and authentication fields in screenshots, logs, and support requests. If an update fails, determine whether the URL could not be accessed, the returned content was in the wrong format, or an imported entry cannot connect. The first two issues involve retrieval or parsing; the last calls for checking protocol settings and the connection route. For details, see the user guide.

On Demand: Connect when conditions are met

On Demand triggers a connection based on conditions; it does not choose a routing policy for individual requests. Open the On Demand settings in the app, check which conditions are available, and configure them for your network use. On Demand, Global Routing, and Rule operate at different levels: On Demand controls when to connect, while Global Routing and Rule control how requests are handled after connecting.

Before enabling On Demand, confirm that a manual connection works with your current configuration and server. Then enable one condition that is easy to verify. After saving, switch to the relevant network and check both the system VPN status and the connection status in the app. Then leave that condition and check again. If a condition uses a Wi-Fi network name, verify that it exactly matches the current network rather than a similarly named one.

After On Demand is enabled, manually turning off the connection may be followed by a new connection when a trigger condition is met. So “it reconnected right after I turned it off” does not necessarily indicate a problem. To investigate, temporarily pause On Demand and test manually, then check the related VPN settings in the system. Automatic connection does not guarantee the remote service is available: network changes, authentication failures, or an unreachable server can still prevent connection or access.

To pause automatic connections, return to On Demand and check or disable the relevant conditions instead of repeatedly using the Home toggle. Before enabling automatic connection again, confirm the selected server and active configuration so it does not use a selection left over from testing.

Data: Read traffic statistics, not speed test results

Data shows traffic usage; cumulative bytes are not a measure of current speed. Open Data and check the current view, which entries it covers, and the statistical range shown in the app. Then review the upload and download readings. Viewing data by server can help identify how a particular entry is being used. If the app offers a per-app view for your device, check how it attributes traffic; an entry name alone does not tell you everything an app has done.

For a useful comparison, note the current reading and its starting point, then perform one specific action—for example, reopen a page—and check Data again. An increase over a short period only shows that traffic was recorded within the selected range. A page may also load images, scripts, and background resources, so its total traffic is not necessarily the size of the file visible on screen.

If the reading stays at zero, first check that the connection is established, that you sent a new request, and that you are viewing the server actually in use. Browser caching, different routing policies, or a change in the statistical range can make the number unexpected. If the reading seems high, check background activity and repeated tests before concluding that the statistics are wrong.

Data is not a service billing record. The app's statistical range may differ from how a remote service measures usage; check each source separately. If the app offers an option to clear or reset statistics, note any information you need before using it. Start comparisons from the new baseline afterward. For more on these readings, see Understanding traffic statistics in Data.

DNS: Check the active configuration before changing DNS settings

DNS translates domain names into addresses; successful resolution and a successful connection are separate checks. When checking DNS, review the relevant items in the active Config and the DNS options shown in Settings. Changing one place does not necessarily affect every request. The actual behavior also depends on the configuration, request route, and related options.

For example, dns-server in a configuration describes DNS server settings. The snippet below shows how to use the system DNS. It is not a recommendation for every network and does not cover everything a complete configuration may require.

[General]
dns-server = system

Before making changes, back up the active configuration and note the original value. Change only one DNS-related item at a time. After saving, send a new request to the same domain and, if needed, reconnect using the method provided by the app so an existing connection or cache does not skew the comparison. Do not change DNS, Global Routing, and the server at once because a slow lookup makes it difficult to tell which change affected the result.

If a domain cannot be resolved, first check DNS reachability on the current network and verify the configuration syntax. If it resolves but remains inaccessible, check the connection to the destination address, TLS, and the rule policy. Cached results and network conditions can affect resolution, so note the conditions during the test rather than treating one result as a lasting conclusion.

Settings: Test methods, shortcuts, and sync

Adjust common Settings options one at a time, based on what you need to do. Menus and options may differ by device and current app view, so identify the setting before changing it. Keep a record of the original value and favor changes you can verify repeatedly. Look up unfamiliar options first; turning on every switch is not a general fix.

Test Method and Connectivity Test

Test Method selects how a connection test is performed; Connectivity Test runs the test. Check Test Method in Settings, then return to Home to test a server you already have. When comparing entries, keep the method, test target, and network conditions the same. Results from different methods are not directly comparable.

A successful test does not mean every website or app will work, and a failed test does not necessarily mean the credentials are wrong. Try a real request to a specific destination and distinguish among domain resolution, connection establishment, and content delivery. Do not keep switching methods to chase a lower number while ignoring whether access actually works.

Today Widget

Today Widget provides shortcuts in the relevant system area. Whether it can be added and which actions it shows depend on the current system and app interface. Check the related settings in the app, then use the system's widget editor to see whether it can be added. The widget is a shortcut, not a separate configuration environment. Before using it, confirm the server, Global Routing mode, and active configuration in the app.

If a shortcut leaves the connection in an unexpected state, open the app and check the actual connection status first, then see whether On Demand triggered another connection. Do not rely on the last text shown in the widget to determine the route a request is currently taking.

iCloud sync

iCloud sync can transfer data supported by the app when the required conditions are met. Check iCloud status and app permissions in system settings, then review the corresponding option in Shadowrocket. The app shows what is included in sync. Turning sync on does not necessarily make servers, configurations, statistics, and connection status identical on every device.

Before using another device, check which content has synced and what is selected; confirm everything before connecting. Keep a recoverable copy before deleting, overwriting, or making bulk changes. Restoring an app purchase from the App Store restores purchase eligibility, not all connection details. Check these separately. For steps when switching devices, see Restoring an App Store purchase.

Diagnostics: Narrow down problems step by step

Diagnostics should help identify where a failure occurs, not prompt a series of changes to every setting. Look for Diagnostics or the diagnostic tools available in the current app view under Settings, then check the results alongside Connectivity Test and connection records. Tool names, record coverage, and available features may vary; refer to the app. Keep the results you need after testing.

Check the underlying network first. Note whether you are using Wi-Fi or cellular and whether the problem only occurs on one network. If basic access fails, troubleshoot the network connection first.
Check what is selected. Review the server on Home, Global Routing, the active Config file, and On Demand status. An enabled connection toggle is only a starting point for troubleshooting.
Keep test conditions consistent. Check Test Method, run Connectivity Test for the same entry on the same network, and note the result. Do not compare readings from different methods.
Check rules and DNS. For one specific destination, review the request details, domain resolution, matching policy, and connection errors. If the problem occurs only in Config mode, check the Rule order.
Restore and retest. Change one setting at a time and repeat the same request. If there is no improvement, restore the original value before testing another setting to avoid stacking temporary changes.

“Timed out,” “authentication failed,” and “name resolution failed” point to different issues. For a timeout, check network reachability, the destination address, and the remote response. For an authentication failure, recheck the credentials you already have and the protocol settings. For a name resolution failure, start with DNS settings. A single error message is rarely enough to identify the cause of the entire connection path.

When preparing a support request, note the device type, current network, Global Routing mode, type of destination, and redacted error text. Do not share server credentials, a full subscription URL, or sensitive configuration fields. If the issue is with the connection process, see Connection troubleshooting FAQs. If you cannot get the app or restore a purchase, see the App Store guide instead of repeatedly changing network settings.