Shadowrocket
Routing Modes and Settings

Global Routing is on Home. For everyday routing based on domains or addresses, choose Config. To temporarily check whether the selected server can handle a request, use Proxy. To see whether the current network can reach a destination directly, use Direct. After changing modes, make a new test request; existing connections may keep their previous session state.

The interface labels are Config, Proxy, and Direct. Proxy in the interface is a mode name, while PROXY in a rule is a policy keyword. They are related, but selecting Proxy does not enable a particular rule.

Config: Rules Determine the Policy

Open Config and select the configuration file you want to use, then return to Home and set Global Routing to Config. Importing a file does not automatically select it; even correctly written rules only take effect in a mode that uses them. For testing, try one destination expected to match PROXY and another expected to match DIRECT, then check both results. Do not assume the entire configuration is correct just because one website loads.

Proxy: Test the Proxy Route

On Home, check the selected item in the SERVER list, choose Proxy, and turn on the connection. Here, “global mode” means applying proxy handling consistently to requests managed by the app; it is not an absolute description of all device activity. If Proxy works but Config does not, focus on rule matching and the active configuration. When troubleshooting is done, restore the mode you need.

Direct: Test the Current Network Path

On Home, set Global Routing to Direct and revisit the destination. Direct cannot make an unreachable destination reachable, and it does not turn off the connection switch; it changes the handling policy. To stop the current VPN connection completely, use the connection switch on Home. If a local network device is unreachable, compare the result with Direct first, then return to Config and check the relevant address rules.

Rules are usually viewed and edited in the Rule section of the active Config. DOMAIN matches an exact domain, DOMAIN-SUFFIX matches a domain suffix and its subdomains, and DOMAIN-KEYWORD matches a keyword in the domain. Address conditions can use IP-CIDR and IP-CIDR6. GEOIP relies on IP address location data; it does not determine a result based on the language used in content or the user’s location.

Common policies include PROXY, DIRECT, and REJECT, which route requests through a proxy, connect directly, or reject the request. Rules are generally checked from top to bottom, and the first matching rule determines the result. Put specific exceptions before broader conditions and leave FINAL as the last fallback. The examples below illustrate syntax only; their domains do not refer to services you need to visit.

[Rule]
DOMAIN,example.com,PROXY
DOMAIN-SUFFIX,example.org,DIRECT
DOMAIN-KEYWORD,ads,REJECT
IP-CIDR,192.168.0.0/16,DIRECT
FINAL,PROXY

Save the original configuration before editing and confirm that the file still loads afterward. Avoid adding many unchecked rules at once: for example, a short DOMAIN-KEYWORD may match unrelated domains, and an overly broad address range may affect local network access. USER-AGENT depends on relevant information being available in the request, so it is not a reliable catch-all condition for all traffic.

When changing DNS, Host, or URL Rewrite, keep each configuration section’s purpose in mind; do not mix these settings into Rule. See the Rule Reference for full syntax, priority, and section details. The key here is to confirm that Config is active, then test the matching result.

Subscribe imports and updates a server list from an existing subscription URL; SERVER displays the available server entries. To add an existing subscription, go to Home, open Add Server, choose Subscribe, enter the URL, and save. To add a server manually, select the protocol that matches your existing server details. The fields depend on the protocol; do not substitute parameters from one protocol for another.

After saving, return to Home and check that the expected entry appears in the list, then select the server you want to use. A server name is only a label; it does not confirm that the protocol, authentication, or destination address is correct. Run Connectivity Test, then turn on the connection and test an actual request. A response from one test does not mean every destination is reachable.

Updating a Subscription: Check the Group, Then Refresh

Find the update action for the relevant subscription, refresh only the group that needs updating, and check for a success result. An update may add, remove, or rename servers, so verify that the currently selected item is still available afterward. If the group is empty or the item count changes unexpectedly, first check that the URL is valid and the network is working. Do not immediately delete all configurations and import them again; you could lose your existing selections and notes.

A subscription URL may contain access credentials, so treat it as sensitive information. Do not include the full URL in public screenshots, web pages, or diagnostic logs. An existing subscription and a Config file are different things: the former mainly manages server entries, while the latter contains rules and other settings. Updating a subscription does not replace checking the active rules file.

Protocol Fields: Use Your Existing Server Details

Protocols such as Shadowsocks, VMess, VLESS, Trojan, and Hysteria2 use different connection and authentication fields. When adding a server, confirm the protocol first, then check the address, port, authentication details, and relevant transport settings. Do not disable verification options just to make one test pass. If a required parameter is missing, check your original server details rather than guessing at values.

On Demand triggers a VPN connection based on the conditions you set; it does not replace Rule, which determines how each request is handled. These are two separate settings: On Demand controls when to connect, while Global Routing controls how traffic is handled after connecting. On Demand will not fix incorrect server details or misconfigured rules.

Open On Demand from Home, check the current toggle and condition list, then configure the network conditions available in the app. Add one type of condition at a time. After saving, switch to a network that meets the condition and check whether it triggers, then test on a network that does not meet it. Layouts may vary; do not assume a condition intended for one network applies to every network.

If the connection comes back after you disconnect manually, first check whether On Demand is still enabled and whether the current environment meets its trigger conditions. To pause automatic connections, review the On Demand settings rather than repeatedly using the Home toggle. Network changes, waking the device, and existing sessions can affect what you see. Allow the system to update its state, then make a new request to verify the result.

The Data page shows traffic recorded by the app. First identify the type of entry and reporting period shown, then compare upload and download figures. If the page offers a reset option, save any records you need before resetting. Resetting the client’s statistics does not change the status of the remote account associated with an existing subscription.

To check whether an action used traffic, note the reading beforehand, make one specific request, then return to Data and compare the change. Background tasks, requests from other apps, and connection keep-alive activity can also use traffic, so do not treat the difference between two readings as the precise usage of one web page. An increase only shows that data was transferred; it does not by itself confirm that the destination loaded completely.

To troubleshoot traffic routing and rule behavior, consider Data alongside the current Global Routing mode, Config, and request records. Do not treat the client’s statistics as a remaining allowance or billing record. To check usage on your own service, consult its account records and note that reporting periods and calculation methods may differ.

DNS: Check Where the Active Resolution Settings Come From

DNS resolves domain names to addresses, and the results may affect address-based rule matching. Check the DNS settings in Settings and the active Config to determine which settings are actually in use before changing the resolution method or server. If a domain fails to load but access by address behaves differently, DNS is one area to investigate, but that alone does not prove a DNS issue.

Note the original values before making changes, then make a new request afterward. If needed, handle the cache using the options available in the app. Do not change DNS, rules, and servers all at once, or it will be difficult to identify the cause. Some configurations depend on a particular network path; switching to a different set of addresses may not help and could affect local network name resolution.

Test Method: Use the Same Method for Comparisons

Test Method determines how connectivity tests are performed and can be found among the related test settings in Settings. Choose one method, then run Connectivity Test on the same set of servers. Different methods test different stages of a connection, so do not compare their results as if they were directly equivalent. A fast test response does not mean high sustained throughput or guarantee that every app request will succeed.

If a test involves a destination address, use one you understand and keep it unchanged during comparison tests. If a particular test fails, cross-check with an actual request first, then check whether the protocol and test method are suitable. Do not delete a server based on a single number.

Today Widget: Check Your Selection Before Using Shortcuts

Today Widget provides shortcuts for viewing information or taking actions. Check the related options in Settings, then add it to the appropriate area using the method supported by the system. Whether the entry appears and which actions are available depend on the current system and app interface. Before using a shortcut, confirm the selected server and Global Routing mode on Home.

Shortcuts reduce the number of steps; they do not determine which configuration suits the current network. If the displayed status differs from what you expect, open the app and check the connection rather than assuming it succeeded based on a single view in the shortcut area.

iCloud: Check What Will Sync

Check iCloud sync settings in Settings, and make sure the device allows the app to use iCloud. Before enabling sync, review the items listed by the app; do not assume subscriptions, configurations, credentials, and history all sync in the same way. Confirm sync status on each device and keep recoverable copies of important configurations.

Before editing the same data, wait for the previous device to finish syncing to avoid conflicts from simultaneous edits on multiple devices. iCloud sync is not the same as restoring an App Store purchase: App Store manages purchases and redownloads, while configuration sync depends on the app settings and account status. Handle configurations containing credentials with care.

Diagnostics provides tools for investigating connection issues and can be found in Settings. Run the available checks and review their results, distinguishing between the current network, domain resolution, server connection, and destination request. A diagnostic result describes the state at the time of testing; it cannot establish long-term availability, and a single error does not mean every destination is unavailable.

1. Check the basic network. Confirm that the current Wi-Fi or cellular connection is working. If needed, compare the same destination using Direct and note the difference between the two paths.
2. Check SERVER. Verify the selected entry, protocol, port, and authentication details. After updating an existing subscription, confirm that the selected entry has not changed.
3. Run Connectivity Test. Use the same Test Method throughout and consider the results alongside actual requests; test figures are not a speed guarantee.
4. Switch to Proxy for comparison. If Proxy works but Config does not, return to Config and check rule order, policies, and FINAL. If both fail, continue checking the server and network conditions.
5. Check automatic and related settings last. Review On Demand, DNS, and sync status. Change only one variable at a time, then decide whether to keep or revert it after testing.

Before saving or sharing diagnostic information, remove the full subscription URL, server authentication details, and other personal information. Keeping only the reproduction steps, mode used, and relevant error description is usually more helpful for troubleshooting. For the full process from importing details to connecting, see Getting Started. To edit rules individually, see the Rule Reference.