Shadowrocket Official Manual · Glossary
Start by identifying where a term appears, then check whether it affects the connection, server list, or request routing. This page preserves English interface terms and protocol names while explaining common terms in five categories. Use the anchor links to jump to a section and compare it with the app as you work.
First distinguish where a setting appears from how it handles traffic. The same term can refer to different layers of settings depending on where you see it.
Home is the main screen for viewing the server list, choosing a server, and controlling the connection. It is also where you can check whether an imported entry appears. Selecting an entry only designates a candidate server; it does not establish a connection. Check the connection toggle, system permissions, and the result of an actual request.
Global Routing sets how traffic is handled overall: Config, Proxy, and Direct correspond to the modes shown in the interface. Choose Config when requests should be routed by rules. If you switch modes temporarily for troubleshooting, restore the original setting afterward so you do not mistake a test result for proof that the rules are active.
Config commonly has two meanings: the screen for managing configuration files, and the Global Routing mode that handles traffic according to a configuration. The first concerns importing, editing, and enabling files; the second determines the routing mode in use. Importing a file without confirming that it is enabled does not mean its rules are being matched.
In Global Routing, Proxy and Direct set the overall routing mode for a broad range of requests. They are not the uppercase PROXY and DIRECT used in rule rows: the former are mode choices, while the latter are the actions applied by individual rules. When troubleshooting, first check which layer you changed.
On Demand triggers connection behavior according to preset network conditions. Use it when the connection should start automatically as the network changes. It answers “when to connect”; Rule determines “how to handle requests after connecting.” Test it under the relevant network conditions rather than relying only on whether the toggle is on.
Use Settings to find app settings and Data to view related usage data; available items depend on the device and interface. Settings describe expected behavior, while data records observed activity. An increase in total traffic shows that data was transferred, but does not prove that a specific domain used the intended policy.
A protocol determines how the client communicates with a server; it does not determine which traffic is routed where. After choosing a protocol, enter authentication, transport, and security parameters from your server details. Do not assume fields can be copied unchanged between protocols.
Shadowsocks establishes a proxy connection using parameters such as an encryption method and password. The server address, port, encryption method, and password must match. Even with the right address, a mismatched encryption method or password can cause a failure. Preserve any additional transport parameters in the configuration; copying only the address and port may not be enough.
VMess authenticates using parameters such as a user ID. A typical configuration also includes transport, path, and TLS settings. A correct user ID is only one requirement; a mismatched path or transport can also prevent a connection. After importing, compare each field with the original details instead of guessing from the server name.
VLESS authenticates using a user ID and does not provide traffic encryption at the protocol layer. The actual security depends on the accompanying transport and security settings. Check the protocol, transport, and security parameters together; VLESS and VMess configurations are not interchangeable by simply changing the protocol name.
Trojan typically uses TLS and password authentication. The server name in the configuration may be used for the handshake and certificate verification. Check the name and transport parameters as well as the address, port, and password. If you see a certificate error, first verify the configuration, certificate validity, and device time rather than disabling verification.
Hysteria2 is based on QUIC and relies on UDP; its authentication and TLS parameters must match the server. If the current network restricts UDP, the connection can fail even when websites work through other means. Troubleshoot network transport conditions separately from server settings; a single timeout does not prove the password is wrong.
WireGuard establishes an encrypted tunnel using public-key authentication. The local private key, peer public key, connection endpoint, and address ranges each serve a different purpose. Keep the private key secret, and do not enter the local public key as the peer key. A recorded handshake and successful app access are separate checks; also verify addresses, routes, and DNS.
Rules are generally evaluated from top to bottom, and the matching rule’s policy is applied. example.com below is only a syntax example; these sample rules are not a complete configuration for every situation.
PROXY sends traffic through a proxy, DIRECT connects directly, and REJECT denies the request. These are rule policies, not protocol names. A policy applies only to requests that match its rule. The blue, green, and orange dots are visual aids; rely on the policy text and actual connection records.
DOMAIN matches a specific domain; DOMAIN-SUFFIX matches that domain and its subdomains, so the latter usually covers more. For example, DOMAIN-SUFFIX,example.com,PROXY can match the domain and its subdomains. This type of rule does not match URL paths; do not enter /login as a domain suffix.
DOMAIN-KEYWORD checks whether a domain contains a specified keyword, for example, DOMAIN-KEYWORD,example,PROXY. The keyword may appear in unrelated domains, making the rule broader than expected. To match only a domain and its subdomains, consider the more precisely scoped DOMAIN-SUFFIX instead.
IP-CIDR and IP-CIDR6 match IPv4 and IPv6 address ranges, respectively. The prefix length after the slash defines the network range. For example, IP-CIDR,192.168.0.0/16,DIRECT describes an IPv4 address range, not a single server port. An IPv4 rule alone does not mean matching IPv6 requests will use the same policy.
GEOIP matches based on a region recorded in an IP geolocation database, for example, GEOIP,CN,DIRECT. A region is not the same as a website’s language, domain suffix, or the location of its operator. Resolution results and database contents can also change. To handle a specific domain precisely, consider placing a more specific domain rule above it.
FINAL is the fallback used when none of the preceding rules match. A common form is FINAL,PROXY, usually placed at the end of the list. It does not reprocess requests already matched by an earlier rule. If the fallback policy is correct but traffic still takes the wrong route, check the preceding rules rather than repeatedly changing FINAL.
Server entries store connection parameters, configuration files define rules and settings, and subscriptions fetch and update entries in bulk. Identify what you imported first, so you know which screen to check for changes after an update.
Subscribe fetches and updates a group of server entries using a subscription URL. Get subscription details from your provider. A successful update usually means the list was refreshed, not that routing rules were updated. If the number or names of entries change, check the group and selected entry before testing the connection.
SERVER refers to server-related content; Add Server opens the form for adding a server when you have complete connection details. To enter details manually, identify the protocol first, then check the address, port, authentication, and transport settings. The display name is for identification only; changing it does not change the server address.
Scan QR Code reads importable content from a QR code, which is only a container and is not necessarily a single server configuration. Check the content type, protocol, and parameters before saving. A QR code may contain a password or subscription URL; obscure it as well as any nearby text when sharing a screenshot.
A share link encodes server connection parameters as text, such as a string beginning with a protocol identifier like ss:// or vmess://. It serves a different purpose from a subscription URL used for bulk updates. Links may contain authentication details, so store them securely. When importing, avoid copying extra spaces or mistaking the display name for the connection address.
A configuration file can contain sections such as [General] and [Rule] for general settings and rules. The filename alone does not tell you what rules it contains. After importing, confirm which item is enabled, then check the Global Routing mode. Keep a copy before editing so you can restore a working configuration if a rule matches unexpectedly.
iCloud Sync keeps configuration data in sync where supported by the relevant system and app settings. Check the actual interface to see what is synced and which options are enabled. Syncing is not an independent backup or a way to restore a store purchase. Save important configurations separately before deleting or editing anything; do not assume an older copy will remain in iCloud.
Every test result is specific to its target, time, and method. Reproduce one clearly identified request, then check the network, DNS resolution, handshake, and rules separately. Do not treat a single latency test as a complete measure of availability.
Connectivity Test checks whether a specified target can complete a particular connection process. Results depend on the test address, method, and current network. Success means only that the relevant steps completed under those test conditions; it does not guarantee access to every website or app. If a test fails, note the target and error message, then compare them with an actual app request.
Latency is the time required to complete a particular test interaction, usually measured in milliseconds. It is not download bandwidth or a measure of sustained transfer stability. For a meaningful server comparison, use the same network, target, and test method. A timeout may also mean the target is unreachable or the protocol is restricted; it does not necessarily mean the server is permanently unavailable.
DNS resolves domain names to IP addresses. Resolution results and caching can affect subsequent connections and some rule matches. dns-server = system means to use the system DNS settings. When troubleshooting, check the domain, returned address, and final policy together; changing DNS does not mean all requests will use a proxy.
TLS encrypts and authenticates traffic in transit. SNI specifies the requested server name during the handshake, and that name may differ from the connection address. If a certificate or handshake error occurs, check the server name, certificate validity, device time, and original configuration in turn. Disabling verification is not a substitute for correcting a misconfigured field.
TCP and UDP are common transport-layer protocols; different apps and proxy protocols may rely on different transports. A successful TCP test does not prove UDP is available, and being able to open a webpage does not mean all real-time communications are working. Test each case against the specific app, selected protocol, and current network conditions.
Connection logs show request targets, matched rules, handling policies, and error messages, helping distinguish import, rule, and transport issues. Record the time clearly, then make one request to the target. Before sharing logs, remove server credentials, full subscription URLs, and personal information; keep only the error text needed for troubleshooting.