Official Manual · Glossary

Shadowrocket
Interface Terms and Rule Keywords

Identify the term, then check which layer it belongs to. This glossary covers interface controls, protocol parameters, and rule actions in five categories. English names are kept as shown in the app; the explanations clarify their purpose without replacing the app’s labels.

Ready to get started? Follow the user guide. For help organizing existing subscriptions, see the subscription guide.

INTERFACE / CONTROLS

Interface and Controls

Check the Global Routing selection first, then review the individual rules. The connection toggle, routing mode, and automatic triggers serve different purposes and are not interchangeable.

Global Routing
The control for choosing how connections are handled overall. Common options are Config, Proxy, and Direct: use the configuration, route through a proxy, or connect directly. If rules do not seem to work, first check whether Config is selected, then review the configuration. In another mode, the rules may not apply to the current connection.
Config
In Global Routing, Config handles connections according to the currently selected configuration, usually letting rules determine how each destination is routed. As an interface item, Config is also used to manage and select configuration files. Check the screen you are on rather than assuming every occurrence refers to the same control.
Proxy
In Global Routing, Proxy routes connections through a proxy and can help test whether the proxy path is working. Switching to this mode will not fix an incorrect server password, TLS parameters, or expired authentication details. This mode is distinct from the uppercase PROXY rule action.
Direct
In Global Routing, Direct connects to the destination directly and can help compare the local network with the proxy route. Selecting it does not delete existing subscriptions or remove a VPN configuration from the system. When testing is done, restore the previous mode if needed so a temporary test setting does not become the default.
On Demand
Triggers connection behavior based on configured network conditions. The outcome depends on the conditions and current system state. Before setting it up, decide which network environments should trigger a connection, then test each condition. This is not a traffic-routing rule. If the connection state changes automatically, check both the On Demand conditions and the manual toggle—not just the server list.
Data
Use this entry to view traffic statistics and connection details, such as whether requests are being made and traffic is increasing. Client figures may use different measurement methods and reporting periods from the server, so they are not a reliable measure of remaining allowance. Before comparing numbers, check the measurement scope, reset time, and connection being monitored.
PROTOCOLS

Proxy Protocols

A protocol determines how the client and server exchange data. The descriptions below are for checking existing server details; do not switch protocols at random to try to connect.

Shadowsocks
A proxy protocol with common parameters including server address, port, password, and encryption method. Enter the details provided for the existing server, and do not assume that a correct password means every parameter is correct. A mismatched encryption method can cause latency tests and actual requests to fail.
VMess
A proxy protocol authenticated with parameters such as a user ID. The transport and TLS settings also affect connectivity. After importing, check the user ID, transport type, and any additional parameters required by the server—not just the server name. If authentication requires accurate time, check the device’s date and time settings as well.
VLESS
A proxy protocol that requires a user ID and matching transport settings. The protocol name alone does not mean transport encryption is enabled. A connection also depends on matching the server’s TLS requirements, transport, and other parameters. Changing only the type of a VMess entry does not make it a working VLESS configuration.
Trojan
A proxy protocol typically used with TLS. The authentication password, server name, and certificate validation settings must match. If you see a certificate error, first check the address, server name, and device time instead of disabling validation. Server reachability only confirms part of the network path; it does not mean TLS and authentication have succeeded.
Hysteria2
A QUIC-based proxy protocol. Check the authentication details, TLS parameters, and whether UDP is reachable on the current network. A failure on one network does not necessarily mean the subscription entry is invalid; the network path may be the issue. Do not treat this protocol as interchangeable with its predecessor. Import it according to the actual type of the existing server.
WireGuard
A network tunneling protocol that uses key pairs and tunnel addresses. Key settings include the local address, peer, public key, endpoint, and allowed IP ranges. Its fields differ from entries that use a username or password, so do not reuse those settings by default. Protect the private key when organizing configurations, making backups, or sharing screenshots for help.
HTTP / SOCKS5
Two distinct proxy protocols that may use a server address, port, and optional authentication details. Support for a particular transport and use of encryption depend on the specific protocol options and server capabilities. The entry name alone does not show that all traffic is encrypted or that the two types are interchangeable.
RULE ENGINE

Rule Keywords

Rules typically combine a matching condition with an action and are checked in the order specified in the configuration. First check what a rule matches, then how it handles the match, and finally whether an earlier rule matched first.

DOMAIN-SUFFIX
Matches a domain and its subdomains by suffix, such as example.com and its subdomains. This is not a substring match at any position. To match just one exact domain, check how DOMAIN is used. Enter a domain, not a full URL with a path and query parameters.
GEOIP
Matches a destination IP using an IP geolocation database. Results depend on the database contents and update status. It does not verify a server’s precise physical location or measure latency or bandwidth. The IP returned when a domain is resolved can affect whether this rule matches.
IP-CIDR
Matches IPv4 ranges using CIDR notation. For example, 192.0.2.0/24 is a documentation-only example range. The number after the slash defines the range, not a server port. For IPv6 ranges, check IP-CIDR6. Before changing the range, make sure you will not include unrelated destinations.
FINAL
Handles connections that did not match any preceding rules, and is usually placed at the end of the rule list. It is a fallback match, not a marker for “highest priority.” If placed incorrectly, later rules may never get a chance to match. When checking why a destination uses a proxy or connects directly, review both its specific rule and the FINAL action.
PROXY
A proxy action in a rule that routes matching connections through a proxy. The actual route depends on the current selection and policy settings in the configuration; this line alone does not tell you which outbound route will be used. Keep it distinct from the capitalized Proxy mode in Global Routing.
DIRECT
A direct-connection action in a rule. Matching destinations connect directly over the current network. DIRECT does not guarantee reachability: DNS, the local network path, and the destination service all affect the result. If a destination that should connect directly is routed through a proxy, check whether a broader rule matched earlier.
REJECT
A rule action that rejects matching connections and blocks access to specified destinations. If part of an app stops working, check whether a relevant domain or IP is unintentionally matched by this action. Test only the necessary scope and keep the original configuration so troubleshooting one destination does not disrupt overall behavior.
RULE-SET
References a rule set so that a group of matching conditions can be maintained separately. Its position still affects rule order, so placing the set earlier or later can change results. After updating a set, check that its contents loaded successfully and distinguish rule-set updates from server subscription updates.

Learn more about proxy modes and rule-based routing →

SUBSCRIBE / CONFIGURATION

Subscriptions and Configuration

These instructions assume you already have your own subscription or server details. Shadowrocket Hub is the official Shadowrocket website and manual; it does not provide, sell, or recommend servers or subscriptions.

Subscribe
An entry for managing existing subscriptions, including importing or updating server entries. Subscription management is not a way to purchase Shadowrocket or generate server details automatically. Before updating, check the link and its group. Afterward, review the entries to confirm they changed; the list still being present does not prove the update succeeded.
Add Server
An entry for adding a server manually. Select the protocol and enter the address, port, and authentication details from your existing server information. Fields vary by protocol, so do not enter unrelated parameters in similarly named fields. Saving an entry only stores its configuration; select it and test the connection separately.
Subscription
A URL or data source for retrieving a group of server details and subsequent updates. Its contents may change over time. Subscription links often contain access credentials, so protect them like passwords and do not include them in public screenshots or website files. If an update fails, check the link, network reachability, and response format in that order rather than repeatedly deleting all entries.
Configuration File
A file containing rules, DNS, and related policy settings. Its purpose differs from a subscription that contains only server details. Importing servers does not necessarily replace the current rules, and switching configurations does not necessarily change existing subscription groups. Keep a recoverable copy before making changes, and adjust one type of setting at a time so you can identify the cause of any change.
Purchased Items
Find your previous app purchases in the App Store. When changing or restoring a device, first check the Apple ID used for the purchase. Redownloading the app does not restore local servers, rules, or other configurations; check your backups separately. Check the App Store page for device compatibility, system requirements, and Universal Purchase details.

See the full steps for importing, updating, and backing up →

NETWORK / DIAGNOSTICS

Networking and DNS

Test results are only part of the picture. Check DNS resolution, network reachability, authentication, and actual access separately; this is more effective than repeatedly changing several settings at once.

DNS
A system that resolves domain names to IP addresses and other records, an important step before many network connections can be made. Successful resolution does not guarantee that the destination service is reachable, and a failed lookup does not necessarily indicate a proxy authentication problem. First check whether the domain resolves to a reasonable result, then check routing and the server connection to keep each troubleshooting stage distinct.
DNS over HTTPS
DNS queries sent over HTTPS, commonly abbreviated as DoH. It changes how DNS requests are transported; it does not automatically replace routing rules or provide server authentication details. After setting it up, verify DNS service reachability, destination resolution, and whether the actual connection behaves as expected.
Connectivity Test
Checks reachability using the selected test method. Results reflect the network and test destination at that time. A successful test does not mean every website or app is accessible, and a timeout needs to be assessed in the context of the method and destination. Use consistent test conditions when comparing servers, then verify with an actual request.
Latency
The time a specific test request takes to receive a response, usually shown in milliseconds. A lower value does not mean higher throughput or prove that a connection will remain stable. Packet loss, route changes, and destination load also affect performance. Use sorting for an initial comparison, then test actual access under the same network conditions.

How to Check an Unfamiliar Term

First determine whether it refers to an interface item, a protocol parameter, or rule text, then check where the current step takes place. To resolve a specific issue, follow the user guide to test a connection. For organizing, updating, or deleting multiple subscriptions, follow the subscription guide step by step.

Back to the category list ↑
Get Shadowrocket on the App Store