Official Manual · Reference
Understand the concepts before changing settings. English names retain the original interface and rule wording. Each entry explains what it does—and what it cannot tell you.
Interface & switches
The same English term may appear as a page name, a mode, or a rule keyword. Check where it appears before deciding whether it affects the request in question.
Home lets you view saved servers and subscriptions, choose a connection, and control the connection switch. An entry in the list only means its details are saved; it does not confirm authentication or an established tunnel. When troubleshooting, check the current selection and connection status first. Do not mistake an imported entry for a working connection.
Global Routing controls how traffic is handled overall. Its three modes are Config, Proxy, and Direct. Config follows the current configuration rules, Proxy uses the proxy route, and Direct uses the direct route. Before investigating why a rule did not take effect, confirm whether Config is selected.
Config can refer to the configuration management page in the interface, or to the Global Routing mode that handles traffic according to configuration rules. Opening the Config page to view a file does not mean that file is selected or that Global Routing is set to Config. Check the current file and current mode separately.
Proxy is the Global Routing mode that uses the proxy route. It can help you compare how a request behaves over that route. It is not the name of a domain rule in a rule file, and it does not confirm that the server settings are correct. Use the result to narrow down the issue, then restore the mode you need after testing.
Direct is the Global Routing mode that uses the direct route and can be compared with the current configuration behavior. Direct connections still depend on the local network, DNS resolution, and destination service; they do not bypass all network settings. If the direct and proxy results differ, check DNS, the destination address, and the rules rather than repeatedly switching modes.
On Demand starts a connection when configured conditions are met. It controls when a connection starts, not which route a domain uses; that depends on Global Routing and the current rules. If the connection starts again after you disconnect manually, check the On Demand conditions and system VPN settings before removing server details.
Protocols
The following entries explain technical concepts. Use the server details you already have when entering settings; the protocol, transport, security, and authentication details must be compatible.
Shadowsocks is a proxy protocol that uses an agreed encryption method and password. The server address, port, encryption method, and password must match the server details. Changing only the protocol name cannot convert a different server configuration to Shadowsocks. Preserve any additional parameters in the original details; a display name alone cannot confirm that the settings match.
VMess is an authenticated proxy protocol, and the identity is only one part of the configuration. The server's transport method, path, Host, and TLS settings may also affect the connection, so check each against the details you have. If the system clock is significantly wrong, correct it before distinguishing an authentication failure from a network reachability issue.
VLESS uses an identity for authentication. The protocol itself is not an encryption layer; connection security also depends on the configured transport and security settings. Matching identity details alone does not guarantee a connection: the server port, TLS name, and other settings must also match. Simply changing the type of a VMess entry does not make it a valid VLESS configuration.
Trojan typically uses TLS and password authentication for proxy connections. A correct password does not guarantee that TLS checks will pass. Check the server address, port, TLS name, and certificate verification settings together. If you see a certificate error, check the name and system clock first; disabling verification is not a general fix.
Hysteria2 is a QUIC-based proxy protocol. Connections depend on the authentication details, TLS settings, and whether the network supports UDP. The protocol name alone does not indicate throughput or latency; settings and network conditions matter too. If results differ across networks, note what changed, then check UDP reachability and the server settings.
WireGuard creates an encrypted tunnel using a key pair. Connection details typically include the peer public key, Endpoint, addresses, and route scope. Public and private keys serve different purposes and must not be swapped; never paste a private key into a public log. After the tunnel is established, check the destination networks and DNS too: a successful handshake does not mean every destination is reachable.
Rule keywords & policies
Rules are generally evaluated from top to bottom, and the first match determines how a request is handled. The snippets below illustrate syntax; they are not complete configurations to copy as-is.
DOMAIN-SUFFIX,example.com,PROXY
GEOIP,CN,DIRECT
FINAL,PROXYThe first field shows how a rule matches; the last field shows what happens after a match. FINAL is the final match, so it has no domain or network field. example.com is used as a documentation example.
DOMAIN matches an exact domain name. For example, DOMAIN,example.com,DIRECT applies only to that domain and does not automatically include its subdomains. Enter a domain, not a full URL with a path. A website may request multiple domains, so check request logs to see which destination matched rather than relying only on the address bar.
DOMAIN-SUFFIX matches on a domain suffix boundary. Entering example.com typically covers the domain itself and its subdomains. It does not search for matching text anywhere in a URL or match paths. A request will not reach this rule if an earlier rule already matched, so check rule order after adding it.
GEOIP matches a destination using an IP geolocation database, for example GEOIP,CN,DIRECT. Results depend on the database and the resolved address; they do not indicate a website's language, account region, or operator location. A domain using a CDN may resolve to different addresses, so note the actual destination IP when troubleshooting.
IP-CIDR matches IPv4 addresses using network notation. The number after the slash is the prefix length; 192.0.2.0/24 is an example range for documentation. Use IP-CIDR6 for IPv6 ranges; the two formats cannot be used interchangeably. A domain may resolve to different addresses and match different rules, so check the DNS result as well.
FINAL handles requests that did not match earlier rules and is usually placed at the end of the rule list. FINAL,PROXY and FINAL,DIRECT specify different final routes; there is no one setting that fits every configuration. If many requests unexpectedly use the final policy, check the scope and order of the preceding rules first.
PROXY is a policy name in rules that selects the proxy route. The actual egress depends on the current selection and configuration. It is neither a server address nor a protocol name. A PROXY match tells you the handling direction; to confirm whether the connection succeeds, check the selected server, authentication, transport, and DNS.
DIRECT sends matched requests over the direct route, typically for destinations accessed through the current local network. It does not bypass all DNS processing or guarantee that the destination is reachable. DIRECT in a rule applies to matching requests; Direct in Global Routing is an overall mode. Be clear about which level you are checking.
REJECT blocks requests matched by a rule. Its scope depends on the domains, addresses, or other conditions the rule can identify. A single domain may serve different kinds of content, so an overly broad rejection can disrupt normal features. If part of a page is missing, check the match log and narrow the rule instead of expanding the reject list.
Subscriptions & configurations
The server list answers “where to connect”; the configuration file answers “how to handle requests.” You can use both, but importing one does not mean the other is configured.
Subscribe fetches and updates server entries using a subscription link you already have. The returned data determines what the link provides. Subscription links may contain access credentials, so hide the full URL before sharing logs or screenshots. If the list is empty after an update, distinguish a fetch failure from invalid returned data or a parsing failure; do not assume all servers are unavailable.
A Server is a connection entry that typically contains an address, port, protocol, and authentication details. You can add one in Add Server using details you already have. The list's label is just for identification; changing it does not change the server. When copying settings, check for leading or trailing spaces and make sure each value goes in the right field. Do not enter the display name as the host address.
A configuration file stores settings such as rules, DNS, and policies; its contents determine which settings it includes. Importing a file and selecting it for use are separate actions, so confirm which file is currently active after making changes. Keep a working copy before editing and change one related setting at a time to identify what caused a difference.
Where supported by the app, iCloud Sync transfers data through iCloud and depends on your account, system permissions, network, and in-app settings. It is separate from App Store purchase history; reinstalling the app does not by itself confirm that your data has been restored. After switching devices, check which items actually synced and which configuration is selected, and keep important data backed up.
DNS & networking
Each test covers only some of the conditions. Record the network, destination, and mode to compare results instead of comparing a single number.
DNS resolves domain names to IP addresses, and routing choices and subsequent connections may depend on the result. Successful resolution does not mean the destination port is reachable, and a failed connection is not necessarily caused by DNS. When troubleshooting, record the domain, resolved address, and request path separately. After changing DNS settings, account for cached results and avoid changing several variables at once.
Connectivity Test checks whether a specified destination is reachable under the test conditions. Interpret the result in light of the method used. Passing the test does not mean every website, protocol, or long-running transfer will work. If the test and actual browsing behave differently, check the destination domain, Global Routing, and rule matches instead of simply repeating the test.
Latency measures the time between a request and its response. Different test methods, such as a TCP handshake or an HTTP request, may produce different results. Lower latency does not mean higher sustained transfer speed or prove a connection is stable. For a useful comparison, keep the network and test method the same, test at similar times, and check actual service behavior too.
URL Rewrite changes request URLs based on matching conditions; it is separate from choosing the proxy or direct route. Whether a URL can be rewritten depends on which requests the client can see, the rule conditions, and related settings. HTTPS requests have additional processing boundaries. To troubleshoot a rewrite, first confirm that the request is visible, then check the matching expression and target URL.
If you are importing details you already have for the first time, follow the setup guide step by step. If a connection is established but behaving unexpectedly, use the troubleshooting guide for the relevant symptom. A protocol name or test result alone cannot identify the cause.
Shadowrocket is a closed-source commercial app available across platforms. The iPhone and iPad version costs $2.99 as a one-time App Store purchase; check the App Store listing for system requirements. The Mac (Apple silicon and Intel), Windows, Android, and Linux versions are free, with installers available from this site at /dl/. See the download guide for platform-specific options and the system approval steps shown when opening the app for the first time.