Official guide · Browse by category

Shadowrocket Glossary

First, distinguish interface modes, protocols, and rule policies, then review the config. English labels are kept as they appear in the app; explanations clarify their purpose and limits.

Interface labels kept in English
Grouped by purpose
Examples are illustrative, not real configs

Home / Settings

Interface & Controls

This category covers where to take action and when connections are made. If you're new to Shadowrocket, start with Home, Global Routing, and Connectivity Test, then follow the Getting Started guide to connect.

Home: The main screen for connection controls, status, Global Routing, and the SERVER list, where you can select an existing server. Before connecting, status text such as Not Connected may appear. Turning on the switch starts the connection process; it does not mean every request has been verified.

Global Routing: The control for choosing how traffic is handled overall. Common options are Config, Proxy, and Direct. They determine whether traffic follows config rules, uses a proxy route, or connects directly. If a rule change has no apparent effect, first check whether this is set to Config.

Config / Proxy / Direct: In Global Routing, the three modes are Config, Proxy, and Direct. Config handles requests according to the current rules; Proxy uses a proxy route; Direct connects directly. These are overall modes, not protocol types. Do not confuse them with the uppercase PROXY and DIRECT policy keywords in rules.

On Demand: A feature that triggers connection behavior when configured conditions are met, reducing the need for repeated manual actions. It determines when to connect; Rule determines which route a request takes. If a connection starts unexpectedly, check both the On Demand conditions and the current system connection status.

Add Server: The screen for manually entering details for a server you already have. Choose the appropriate Type and check the address, port, and authentication settings. Required fields vary by protocol; do not reuse a password, UUID, or TLS setting from one protocol for another.

Connectivity Test: Checks server connectivity using the selected test method. A successful test means a response was received under those test conditions; it does not mean every website is reachable. If the test fails, consider the method, target, and local network before drawing conclusions.

Latency: The time a test request takes to complete a specified round trip, usually measured in milliseconds. It is not a file transfer rate. Compare results only when the test method, target, and network conditions are similar; one low reading does not prove a connection will remain stable.

Type / Transport / TLS

Protocols

A protocol defines how the client and server communicate. Choose one based on the configuration of a server you already have, not its name or test results. The same protocol can also use different transport settings.

Shadowsocks: An encrypted proxy protocol. Connection details commonly include the server address, port, password, and encryption method. The encryption method must match the server; an address and port alone are not enough. After importing, check that all required fields are present.

VMess: An authenticated proxy protocol that commonly uses a server address, port, and UUID. Other settings may include transport, Host, Path, and TLS. Use the values specified by the server; matching protocol names do not make settings interchangeable.

VLESS: A lightweight proxy protocol that typically uses a UUID for identification and works with a specific transport. The protocol name alone does not mean transport encryption is enabled. Check the transport layer, security settings, and server requirements separately.

Trojan: A proxy protocol commonly used with TLS and authenticated with a password. The address, port, password, and server name used for TLS verification can all affect connectivity. If a certificate error occurs, check the certificate and name rather than simply bypassing verification.

Hysteria2: A QUIC-based proxy protocol that relies on a UDP path and uses connection settings such as authentication and TLS. If the network blocks UDP, the connection may fail. Check the server configuration and network conditions; the protocol name alone cannot predict how well it will work.

WireGuard: A protocol that creates a tunnel using a key pair, with settings such as a private key, peer public key, endpoint, and address. A private key is sensitive; do not share a complete config publicly when troubleshooting. A reachable endpoint does not guarantee that tunnel addresses and routes are correct.

HTTP / SOCKS5: Two different proxy protocols. Choose the type supported by the server you already have, not based on the type of website you want to visit. Authentication and supported traffic may differ; seeing HTTP or SOCKS5 does not mean transport is encrypted.

TLS: A mechanism for protecting data in transit and verifying the peer's identity, not a standalone server entry type. The server name, certificate validity, and device time can affect the handshake. Follow the server's requirements and retain appropriate certificate verification.

Match → Policy

Rule Keywords & Policies

Check the match condition first, then the policy at the end. The domain names and addresses below illustrate syntax only. For the full matching order, config sections, and examples, see the Rules Reference.

Rule: A set of rules in a config that matches requests and assigns policies. When Global Routing is set to Config, rules are typically checked from top to bottom, and the policy for the first match is applied. Put specific conditions before broader ones to avoid an earlier rule matching first.

DOMAIN: Matches an exact, full domain name, not a URL's path or query parameters. DOMAIN,example.com,PROXY routes that domain through PROXY; it does not also match every subdomain, such as www.example.com.

DOMAIN-SUFFIX: Matches a domain and its subdomains, making it useful for organizing rules by domain hierarchy. DOMAIN-SUFFIX,example.com,PROXY can match example.com and its subdomains, but not any domain that merely contains this text.

DOMAIN-KEYWORD: Matches requests to domains containing specified text, usually covering a broader range than an exact-domain rule. DOMAIN-KEYWORD,ads,REJECT is a syntax example, not a recommendation to reject every domain containing that text. Check for unintended matches before using it.

GEOIP: Matches requests based on the geographic classification of the destination IP in a geolocation database, for example GEOIP,CN,DIRECT. The classification does not indicate the language used in content, the service operator's location, or the origin of its content. Results also depend on the resolved address and database.

IP-CIDR / IP-CIDR6: Rule types for matching IPv4 and IPv6 address ranges; the number after the slash is the network prefix length. IP-CIDR,192.168.0.0/16,DIRECT is an example of a local network range. Use IP-CIDR6 for IPv6 ranges and check the prefix carefully.

USER-AGENT: A rule type that matches readable User-Agent information in a request. It does not identify all traffic from any given app. Whether it can match depends on the protocol, encryption, and visibility of request details; not every connection exposes this field.

FINAL: A fallback rule used when none of the preceding rules match. It is usually placed at the end of the Rule list. FINAL,PROXY sends requests not covered by earlier conditions through PROXY. If FINAL appears too early, subsequent rules will not work as intended.

PROXY / DIRECT / REJECT: Common rule policies for routing through a proxy, connecting directly, or rejecting a request; keep their uppercase spelling. Policies describe how to handle a request, while conditions such as DOMAIN describe what to match. Check the current server and policy settings to determine the actual PROXY route.

DNS: The mechanism that resolves a domain name to an IP address for the next connection step. It can also affect IP-based rule matching. Successful resolution and a successful connection are separate: distinguish a DNS failure from an unreachable address or a failed server connection.

Subscribe / Config

Subscriptions & Config Files

Server entries, subscriptions, and rule configs are separate things. The explanations below assume you already have your own subscription or server details. This site does not provide, sell, or recommend servers or subscriptions.

SERVER: The area in Home that displays existing server entries, which may be added manually or imported from a subscription. Names are labels for identification; connections depend on the protocol, address, port, and authentication settings. After selecting a different entry, verify how requests are handled.

.conf: A file containing config text, commonly organized into sections such as General, Rule, Host, and URL Rewrite. Each section serves a different purpose. The Config screen manages configs, while Config in Global Routing is a mode that routes traffic according to a config. After importing, confirm which config is active.

Host: A config section for specifying domain mappings, which can affect the destination address returned for a domain. It is not the Host field in an HTTP request header and does not replace the PROXY or DIRECT policy. If you set a fixed address, consider whether it may change and whether the certificate name still matches.

URL Rewrite: A config feature that rewrites request addresses and other content based on conditions, unlike Rule, which selects a traffic policy. It can change request behavior, and its applicability depends on the visibility of request details. Before importing, review the conditions and results; when troubleshooting, disable items one at a time to narrow down the cause.

App Store / Purchase

Store & Account

Purchasing the app, restoring a purchase, and importing connection details are separate tasks. Shadowrocket is a closed-source commercial app for Apple platforms, primarily used on iPhone and iPad.

App Store: The only place to purchase and download Shadowrocket, and the source for pricing, system requirements, and update history. Before purchasing, verify the developer, Shadow Launch Technology Limited, the official icon, and app ID 932747118. See the How to verify the official app guide for details.

One-time purchase: A payment for a license to use the client. The US storefront price is approximately $2.99; the actual price and currency are shown on the App Store page. A one-time client purchase is not a service plan; connecting still requires your own subscription or server details.

Purchased: The App Store section for finding apps purchased with the current account. If you switch devices or reinstall, look for Shadowrocket here first. Purchase history and local config are separate; redownloading the client does not automatically restore all servers and rules. See the Restore a previous purchase guide.

Storefront & Compatibility: The storefront affects how an app is listed, its billing currency, and whether it can be purchased; device compatibility determines whether it can run on your device. Support for Mac, Apple TV, and Apple Vision is also listed on the same App Store page. Refer to the App Store listing for system requirements, device compatibility, and purchase eligibility.