Shadowrocket Features and Settings

What it does: Global Routing is where you choose the overall routing mode. Config routes traffic according to the active configuration file. Proxy sends ordinary requests handled by the app through the selected proxy route. Direct connects without a proxy. Proxy here is a mode in the interface; PROXY in a rule is a policy keyword. They operate at different levels.

Where to find it: Open Home, then tap Global Routing to see the current selection. For everyday rule-based routing, choose Config and check in Config that the intended configuration file is active. To troubleshoot whether a server is working, you can temporarily choose Proxy. Then return to Home and check the selected server and connection toggle.

How to set it up: Choose Config, then visit one destination expected to connect directly and another expected to use a proxy. If only the latter fails, note what happened and temporarily switch to Proxy to try again. If Proxy works but Config does not, check rule order, policy targets, and the active configuration. If both fail, check the server settings, DNS, and your current network.

What to watch for: Switching modes usually affects new connections; existing connections may keep their previous state. End the relevant requests and try again, reconnecting if needed. Restore your original mode when testing is complete. Don’t leave a temporary troubleshooting option as your everyday setting, and don’t assume Proxy routes all system traffic through the same path.

What they do: A rule typically consists of a match type, match value, and policy. The match type identifies the request; the policy determines what happens when it matches. Rules are checked from top to bottom, and the matching rule’s policy is applied. Which rule a destination matches matters more than the number of rules.

Where to find them: Open Config, select the active configuration, and use its edit option to review the Rule section. Save a copy before making changes, and make sure you’re editing the file in use—not another file in the list. Rules work as expected when Global Routing is set to Config.

How to set it up: Put specific exception rules before broader rules, and keep FINAL at the end. This example shows syntax and order only: requests for the example domain use PROXY, and FINAL sends all other requests to DIRECT. It’s not a complete configuration for every network and contains no server details.

[Rule]
DOMAIN-SUFFIX,example.com,PROXY
FINAL,DIRECT

What to watch for: Domain and IP rules match different information. The final match can depend on whether a request retains its domain name, DNS results, and rule order. Match types such as USER-AGENT depend on specific request fields and aren’t a universal way to identify all encrypted requests. After changing a rule, make a new request and check the actual policy in the connection log.

Don’t replace the entire configuration to fix one destination. Start by adding a narrowly scoped test rule and confirm that it matches before reorganizing anything. When using REJECT, check carefully for unintended matches that could block sign-ins, images, or shared APIs. For more on rule order, see Rule Matching and FINAL: A Reference.

What they are: A server entry stores the address, port, authentication, and protocol settings for one connection. A subscription retrieves and updates a group of entries. A subscription link is not a server address, and a server list is not the same as a routing configuration file. Successful import only means the content was recognized; you still need to select a server and test the connection.

Where to find them: Check the server list on Home. Tap Add Server to add an entry and choose a type that matches its contents. To import a subscription, choose Subscribe and enter the full URL. Config is primarily for managing configuration files. If you see a subscription option there, check whether it imports a configuration or a server list. Scan QR Code can read an existing QR code; verify its source and format before importing.

How to set it up: When adding a server manually, select a type—such as Shadowsocks, VMess, VLESS, Trojan, HTTP, SOCKS5, WireGuard, or Hysteria2—based on your provider’s instructions, then enter each parameter. A correct address and port don’t necessarily make an entry complete; some types also require TLS, Server Name, a transport method, or other fields. Don’t guess missing values from the protocol name. See the protocol reference for field details.

Get subscription links from your service provider. When pasting a link, check for leading or trailing spaces, line breaks, or truncation. Save it, update the subscription, and confirm the expected groups and entries appear. Give subscriptions and manually added entries recognizable names. If you need to temporarily change a server from a subscription, save it as a separate entry so a later update won’t overwrite your changes.

What to watch for: Before deleting a subscription group, check whether you need to keep any of its entries. If an update fails, distinguish between an inaccessible link, an unsupported response format, and connections failing after the list updates; each requires a different troubleshooting approach. Don’t share subscription URLs, full QR codes, or authentication details in public screenshots. Treat synced and backed-up data as sensitive if it contains credentials.

What it does: On Demand uses the system’s on-demand connection mechanism to attempt a connection when specified network conditions are met. It controls when to connect; Global Routing controls how traffic is routed after connection. They can work together, but neither replaces the other.

Where to find it: Open Settings and look for On Demand to review the available network conditions and actions. Options may vary by system and version, so follow what’s listed on your current screen. When authorizing the connection profile for the first time, follow the system prompts, then test the automatic connection.

How to set it up: First, connect manually and verify that the server, configuration, and DNS work. Then enable On Demand. Add one condition at a time—for example, set a connection action for a specific network—and switch networks to check that it behaves as expected. If a condition uses a Wi-Fi name, enter it exactly as shown on your device; similar names can refer to different networks.

What to watch for: On Demand can’t make an unavailable server work, and it doesn’t guarantee that the system will keep the app running in the background. System permissions, network changes, and other VPN configurations can affect when it triggers. To stop automatic connections temporarily, turn off On Demand before disconnecting; otherwise, the connection may start again when a condition is met. There’s no need to repeatedly delete and recreate all your configurations.

What it does: Data shows traffic and connection activity recorded by the app. Use it to check whether requests are being handled, whether data is being transferred, and whether connections are repeating unexpectedly. These statistics reflect what the app observes; they aren’t a provider’s billing record or a complete log of all network activity on the device.

Where to find it: Open Data to view the upload, download, and connection details available on the current screen. Check the reporting period, whether the figures apply to the current session, and whether there’s an option to clear or reset them. Different statistics may cover different time periods, so compare like with like.

How to use it: To troubleshoot a specific visit, note the current figures, open just one destination, and make the request again. Check whether the data changes; if connection details are available, review the destination, policy, and error message. Before resetting statistics, save any records you still need so you don’t lose evidence for comparison.

What to watch for: Rising upload or download totals only show that data was transferred; they don’t prove that the destination returned the expected page. Protocol overhead, retries, system reporting periods, and provider accounting can all cause discrepancies. Proxy traffic statistics also can’t be used to estimate all Direct traffic. When sharing troubleshooting details, include the time, error type, and policy, but hide personal domains, addresses, and authentication details.

DNS: Check Where Settings Take Effect

What it does and where to find it: DNS resolves domain names to addresses. Check DNS options in Settings, and review the General section of the active Config file for any DNS parameters. Global settings and the configuration file can both affect the result, so checking only one screen may not tell you which values are actually in use.

How to set it up and what to watch for: Keep a known-working baseline and enter an address format supported by the DNS service. Change one setting at a time, then reconnect and make a fresh DNS request. Don’t change DNS, servers, and rules all at once to troubleshoot one website. A successful lookup doesn’t guarantee a successful connection: distinguish DNS errors from reachability and TLS errors. For internal domains, check that the selected DNS service can resolve them; names that only work on a local network may not resolve through other DNS routes.

Test Method: Know What the Test Measures

What it does and where to find it: Test Method in Settings controls how Connectivity Test is performed. Some methods check a port connection; others send a specific request and observe the response. Their results don’t all mean the same thing.

How to set it up and what to watch for: Choose a method offered on the current screen that suits the server, then run Connectivity Test from Home. To compare entries, keep the test method, target, and network conditions the same; otherwise, you’re comparing different setups. A fast response doesn’t predict sustained download speed, battery use, or performance across all sites. A failed test may also be caused by the test target, so verify with an actual request.

Today Widget: Quick Access from the System

What it does and where to find it: Today Widget provides a shortcut or status view through the system’s widget feature. Look for related options in Settings, then check the system’s widget manager to see if the widget is available. Availability depends on system support.

How to set it up and what to watch for: Complete setup and authorization in the app first, then add an available widget using the system’s steps. Check that its status matches Home. A widget is for quick actions, not configuration editing, and it can’t bypass system connection permissions. Its status may update with a delay; if there’s a connection issue, return to the app for details. If the system doesn’t list the widget, don’t follow steps intended for another platform.

iCloud: Configuration Sync and Data Coverage

What it does and where to find it: iCloud options save or sync data that the app supports across Apple devices. Check sync settings in Settings, then confirm iCloud and the app’s permissions in system settings. Don’t assume that all runtime states, history, or individual fields are included in the sync.

How to set it up and what to watch for: Back up important configurations before enabling sync. Check permissions on each device signed in to the same Apple Account, then verify configuration names and contents after syncing. If there’s a conflict, save both copies before choosing which one to keep. Avoid editing the same configuration on multiple devices at once. Configurations containing server credentials are sensitive data. iCloud sync isn’t a universal cross-platform solution and doesn’t restore App Store purchases.

Diagnostics: Gather Details About a Failed Request

What it does and where to find it: Review the available diagnostic options under Diagnostics in Settings. Diagnostics can help identify whether an issue occurs during DNS lookup, connection setup, authentication, or the request itself. They don’t change server settings or repair a remote service automatically.

How to set it up and what to watch for: Enable the logging options available on the current screen as needed. Note the start time, reproduce the failure once, then review or export the relevant results. Turn off any temporary detailed logging afterward to avoid retaining unnecessary data. Before sharing, check for subscription URLs, passwords, authentication fields, server addresses, and personal browsing records. Share only the relevant excerpts; hiding a name on screen isn’t enough if the full link is still visible.

A connected status and correctly routed traffic are two different things. Once the system shows a connection, verify the request path and response too. Follow the checks below, changing one variable at a time and keeping the steps needed to reproduce the issue.

1. Start with Home: Make sure the selected server is from the intended group and that a subscription update hasn’t led you to select an old entry with the same name. Confirm the connection is actually established; don’t rely on the toggle position alone.
2. Next, check Global Routing: For everyday use with Config, confirm the active configuration and target policy. Temporarily switch to Proxy for comparison if needed, then restore the original setting.
3. Check Config: Review the relevant rules from top to bottom, including policy groups and FINAL. After editing, reselect the file or follow the on-screen prompt to apply the changes, then make a new request.
4. Check DNS: Distinguish a lookup failure from a connection failure. Keep known-working settings for comparison, and don’t change multiple DNS parameters at once.
5. Review Data and Diagnostics: Reproduce the target action once, then use the timestamp and error details to identify where the request stopped.
6. Restore automation last: Once the manual connection is stable, re-enable On Demand, syncing, or shortcuts. Check that everything still works as expected after switching networks.

If the server connects successfully but one destination consistently fails, check its rules, DNS, and service status instead of repeatedly importing the same subscription. If several destinations fail, check the server settings, subscription validity, and local network. For setup steps, see the quick-start guide. Browse Frequently Asked Questions to find solutions, or look up interface labels and rule terms in the glossary.