Shadowrocket
Proxy Modes and Common Settings
First decide how connections should be handled, then adjust rules and network settings. Browse by task, from the connection controls in Home to rules in Config and additional options in Settings.
This guide focuses on iPhone and iPad. Interface sections and available options depend on what appears in the app; check the App Store listing for system requirements. Any import instructions assume you already have your own subscription or server details.
When to use Config,
Proxy, or Direct
Global Routing controls how connections are handled overall; the selected server determines the destination used for proxy connections. These are separate settings.
What it is: Global Routing is where you choose how connections are handled. The configuration mode corresponds to Config, proxy mode to Proxy, and direct mode to Direct. It is not a protocol selector and does not import existing subscriptions into the app. Even with a server selected, changing the mode may route traffic differently.
Where to find it: Open Home, locate Global Routing, and choose a mode. Config here is a routing mode, not the Config tab at the bottom of the screen, which manages configuration files. The mode determines whether rules are applied; the tab determines which configuration is active.
| Mode | How it works | Typical use | What to check |
|---|---|---|---|
| Config | Handles connections according to the rules and policies in the active configuration. | Everyday routing by domain or IP address. | Confirm the configuration is selected, rules are in the right order, and policy targets are valid. |
| Proxy | Usually routes connections through the selected proxy target. Keep app and system limitations in mind. | Temporarily check whether rules are causing different access results. | Check that the selected server is available and its credentials and protocol settings are correct. |
| Direct | Uses a direct connection without the selected proxy server. | Check how the local network handles the request. | Check that the local network and DNS resolution work. Direct does not turn off the connection switch. |
How to set it: Choose Config when you have a working configuration and want rule-based routing. If you suspect a rule is sending a request the wrong way, temporarily choose Proxy and retry the same request. Choose Direct to compare against your local network. Note the original mode and restore it after testing so a troubleshooting change does not become a permanent setting.
What to watch for: After changing modes, test with a new connection; existing long-lived connections may retain their previous state. If Proxy works but Config does not, investigate the rules, policies, and relevant DNS settings rather than assuming a specific rule is wrong. No mode can fix invalid server credentials.
Read the Global Routing modes guide →Rules match connections;
policies determine how they are handled
What it is: Rules describe how particular connections should be handled. Common match conditions include domains, domain suffixes, domain keywords, and IP ranges; policies point to PROXY, DIRECT, REJECT, or a policy name defined in the configuration. A matching rule can still fail if its policy points to an unavailable target.
Where to find them: Open Config, confirm which configuration is selected, then review or edit its rules. Adding a configuration to the list does not activate it. When Global Routing is set to Config, check which file is actually in use.
Common Match Conditions
DOMAINmatches an exact domain name, making it useful for a single, clearly defined destination.DOMAIN-SUFFIXmatches a domain and its subdomains, making it useful for routing an entire domain scope.DOMAIN-KEYWORDmatches a keyword in the domain name; its scope may be broader than expected.IP-CIDRandIP-CIDR6describe IPv4 and IPv6 address ranges, respectively;GEOIPuses IP geolocation.FINALhandles connections that do not match earlier rules and is usually placed at the end of the ruleset.
How to set it: Back up the current configuration, place specific rules before broader ones, and set FINAL last. This snippet demonstrates rule syntax only; example.com is a fictional example domain, not a recommended routing configuration.
DOMAIN,example.com,DIRECT
DOMAIN-SUFFIX,example.com,PROXY
FINAL,DIRECTIn this snippet, the exact domain example.com matches the first rule. Its subdomains can match the second, while connections not matched earlier fall through to FINAL. The actual target used by PROXY depends on the selected server and the full configuration.
What to watch for: Rules are generally checked in order, so a broad match placed too early can prevent later, more specific rules from being reached. IP and domain rules use different information, and DNS results can affect what matches. If something behaves unexpectedly, check the connection log for the destination and matched rule before changing it. Avoid piling on exceptions without a clear reason.
Explore rule keywords and policy basics →Import an existing subscription
and manage individual servers
What it is: A subscription helps maintain multiple server entries; an individual server entry stores a connection target’s protocol, address, port, and authentication details. Shadowsocks, VMess, VLESS, Trojan, Hysteria2, WireGuard, and other protocols use different fields. Changing only the protocol name while keeping unrelated parameters will not work.
Where to find it: In Home, use Add Server to add an entry. For an existing subscription, choose Subscribe under the relevant type. You can also import existing share details using Scan QR Code or the clipboard import option; the available entry points depend on the current interface. These steps assume you already have your own subscription or server details.
How to set it up: Before importing, identify whether you have a subscription link, a server share link, or a configuration file. Enter a subscription link in the Subscribe field, save and update it, then check that servers appear in the group. For manual setup, select the protocol first, then verify the address, port, authentication details, and any required transport or TLS settings. Finally, select the server you want to use in Home.
Organize multiple subscriptions under names that are easy to recognize. Before updating, note which entry is selected; afterward, check that it is still present and selected. Remote content can change and add or remove entries, so do not treat a subscription list as a permanent local inventory.
What to watch for: Updating a subscription refreshes its list; it does not guarantee that every server will connect. Connectivity Test results are not download speeds; the test conditions, protocol handshake, and current network all affect the numbers. Before deleting a group, make sure you have the information needed to restore it. Hide full subscription URLs and authentication fields in screenshots.
Read the subscriptions and server management guide →Trigger connections based on network conditions
without replacing routing rules
What it is: On Demand can trigger or maintain the system VPN connection when specified conditions are met. It answers “when should a connection start?”; rules in Config answer “how should requests be handled after it starts?” Check these settings separately. Enabling On Demand does not create server details or routing rules.
Where to find it: Open Settings and look for On Demand options. Check the network conditions and actions currently available. The system asks you to authorize the VPN configuration when a connection is first set up; review the system prompt and allow it if appropriate.
How to set it: First turn off automatic triggers and verify a connection manually. Once the server, Global Routing, and configuration are working, enable On Demand and set the network conditions using the available options. If you add a Wi-Fi name condition, check that the name is exact and understand which action the condition triggers.
What to watch for: With On Demand enabled, the connection may restart when its conditions are met, so manually disconnecting may not keep it disconnected. To test automatic behavior, check the On Demand conditions, then switch to the relevant network and observe the result. Do not repeatedly remove the system configuration instead of checking the conditions. A system VPN indicator also does not guarantee that every request is routed through the proxy server.
Traffic statistics and connection logs
help verify what happened
What it is: Data provides a way to review traffic from the client’s perspective. Its statistics show data the app can record; they should not be treated as a service provider’s usage bill or a network speed test. Statistics periods, reset behavior, and remote billing methods may differ.
Where to find it: Open Data in the bottom navigation to view the statistics and logs available in the current interface. To investigate a specific request, use the app’s connection log and check its destination, time, and any available policy details. Available fields depend on the interface.
How to use it: Before testing, note the current counters and time. Visit a clearly identified destination, then return to Data and check for changes. Before resetting anything for a fresh comparison, confirm what the reset affects and save any information you need to keep. For a meaningful comparison, use the same network, destination, and action in both tests to reduce background activity.
What to watch for: A rising counter only shows that data was transferred; it does not prove the requested service worked. Failed connections can still generate DNS queries, handshakes, or retry traffic. To inspect logs, locate the request by time. Before sharing, hide domains, addresses, and information that could reveal personal activity; do not share complete sensitive logs.
Common supporting settings
adjusted one issue at a time
Check the following under Settings or the relevant section of the active configuration. Setting names are kept in English; available options and their locations depend on the current app interface.
DNS: Identify which layer controls resolution
What it is and where to find it: DNS resolves domain names to addresses. Related options may appear in Settings under DNS and in the DNS fields of the active Config. Check both; a single toggle does not tell you the actual resolution path.
How to set it: Save the current values first. Determine whether you are using system DNS, custom DNS, or DNS over HTTPS, then change only the setting relevant to the issue. When testing the same domain again, account for caching and use connection logs to check whether resolution and access each succeeded.
What to watch for: Encrypted DNS is not the same as proxy routing, and successful resolution does not mean the destination port is reachable. The server address itself may need to be resolved first, so an unsuitable setup can create a connection dependency. Keep a working configuration unless you have clear evidence of a problem.
Test Method: Affects test conditions, not actual speed
What it is and where to find it: Test Method in Settings selects how servers are tested. It affects how Connectivity Test measures a connection and which stage the result most closely represents.
How to set it: Read the description of the current method, then compare the same set of existing servers. If the interface lets you choose a test target, use the same target throughout. After changing the method, run the tests again; do not rank results from different methods together.
What to watch for: A lower test result does not guarantee faster sustained transfers. If a test fails, distinguish an unreachable target from a failed handshake or a local network issue. Confirm the result with sustained access to the service you actually use.
Today Widget: A quick view from the system
What it is and where to find it: Today Widget settings provide quick viewing or actions supported by the system. Look for the relevant option in Settings, then check whether it is available in a system location that supports widgets.
How to set it: Use the available options to configure what is shown or what action is available. After adding it, check that its status matches the app. Widget support depends on the current device and the capabilities available in the app.
What to watch for: A shortcut cannot replace checking the full configuration. Its displayed status may need to refresh. If a connection problem occurs, open Home and verify the server and Global Routing instead of relying only on the widget indicator.
iCloud: Understand sync, recovery, and backups
What it is and where to find it: iCloud features can save or sync data where supported. Check the iCloud options provided by the app in Settings, and confirm that the system allows the app to use iCloud.
How to set it: Before enabling sync, save a recoverable copy of important data and review what will sync and any overwrite warnings. After switching devices, confirm that syncing is complete before relying on the connection. Do not assume server selection, statistics, and every setting will transfer together.
What to watch for: Restoring an App Store purchase reinstalls the app purchase; it does not restore in-app configuration. Sync can propagate changes and is not a complete substitute for a separate backup. Treat subscription URLs and authentication details as sensitive information and protect them accordingly.
Diagnostics: Identify the problem layer and preserve useful evidence
What it is and where to find it: Diagnostics provides tools to help investigate issues; look for it in the related tools section of Settings. It can collect and inspect diagnostic information available to the app, but does not automatically fix server settings or routing rules.
How to use it: Note when the issue occurred, the network in use, Global Routing mode, and selected server before running diagnostics related to the problem. Reproduce the issue once and save the results you need. Compare them with a normal scenario instead of changing settings repeatedly and collecting a large log afterward.
What to watch for: Diagnostic data may include domains, addresses, configuration snippets, or authentication details. Review and redact sensitive information before sharing. Diagnostic output alone does not prove that the issue is local or remote.
Checks to run after setup
- Confirm your details. In Home, check the selected server and protocol fields. After importing a subscription, confirm that the intended entry is selected.
- Confirm the mode. Check Global Routing. If using Config, also confirm the active configuration and relevant policy targets.
- Test manually. Try a clearly defined action, then check Data or the connection log for changes at the corresponding time.
- Change one setting at a time. To troubleshoot, change only one of the mode, server, or DNS settings, and start a new connection after each change.
- Restore your normal setup. After troubleshooting, restore the intended mode and check On Demand, sync, and shortcuts so temporary changes are not left in place.
For first-time setup, follow the user guide from import through connection testing. If you manage multiple existing subscriptions, use the subscriptions guide for step-by-step checks. Refer to the App Store listing for app purchases, device compatibility, and system requirements. Read the App Store purchase verification guide before getting the app.