Shadowrocket Features
Start with how Global Routing works, then check rules, servers, and connection conditions. Each setting covers its purpose, location, steps, and limitations. For users with their own subscription or server details.
- Config / Proxy / Direct
- Rule matching and policy actions
- Connection checks and troubleshooting
The Three Global Routing Modes
Global Routing determines how requests are handled when the connection is active. Find it on Home; tap the current mode to review Config, Proxy, or Direct. Here, Config is a routing mode; the Config tab at the bottom manages configuration files. They are related, but are not the same entry point.
| Mode | How it works | When to use it | What to check |
|---|---|---|---|
Config Config |
Uses the rules in the active configuration to determine how each request is handled. | For everyday routing based on criteria such as domains and IP addresses. | Check that the intended configuration is active, and that rule order and the final action are correct. |
Proxy Proxy |
Generally sends requests through the selected proxy instead of routing them rule by rule. | To temporarily check whether the selected server can handle a request to a specific destination. | Check the selected server and relevant network and DNS conditions. |
Direct Direct |
Generally connects directly to the destination without forwarding requests through a proxy server. | To check direct access over the device's current network. | Check whether the local network allows access and whether the destination is reachable. |
Choose a Mode, Then Compare
For everyday rule-based routing, select Config and confirm the active configuration contains the rules you need. To troubleshoot a request, you can temporarily switch to Proxy or Direct for comparison. Use the same destination, keep network conditions as consistent as possible, and note the original setting. When testing is complete, restore your usual mode so a temporary change does not become a long-term setting by mistake.
The selected mode does not prove that a connection has succeeded. Even if the system shows VPN as connected, server authentication, DNS, or the destination connection may still fail. Proxy also does not mean all system traffic on the device necessarily follows the same route. Check actual requests and diagnostic records rather than relying on the status icon alone.
Rule-Based Routing and Policies
A rule specifies both what to match and what action to take. On the Config page, select an existing configuration and open its editor to review the rules. On Home, set Global Routing to Config. Back up the file before editing, confirm the edited configuration is active, then test it.
DOMAIN matches an exact domain; DOMAIN-SUFFIX matches a domain suffix and its subdomains; DOMAIN-KEYWORD matches a keyword in the domain. IP-CIDR and IP-CIDR6 specify address ranges. GEOIP matches against an IP geolocation database; its classifications do not necessarily reflect where a website's operator is based. The effect of USER-AGENT depends on whether the relevant request information is available; do not assume it can identify traffic from every app.
DOMAIN-SUFFIX,example.com,PROXY
IP-CIDR,192.168.0.0/16,DIRECT
FINAL,PROXYThese are examples of rule syntax, not a complete configuration or recommendations for specific websites. PROXY sends a request to a proxy policy, DIRECT connects directly, and REJECT rejects the request. A configuration may also refer to named policy groups. A policy group is not a server address; before using one, confirm that the group exists and has a valid selection.
Rule Order Determines the Match
Requests are generally checked from top to bottom, and the action for the first matching rule is applied. Place specific rules before broader rules that could override them. FINAL handles requests that have not matched earlier rules and belongs at the end. To troubleshoot, first identify the domain or destination address, then check the matching rule and action. Do not rewrite all your rules and DNS settings just because one request fails.
Subscriptions and Server Management
The server list on Home stores the details needed to connect. To import an existing subscription, use Subscribe in the add menu. To enter a single server manually, use Add Server. You can also choose Scan QR Code or import from the clipboard if that matches the details you have. Before importing, confirm the information is for your own service and is in the format required by the selected option.
When adding a server manually, select the correct protocol first, then enter the address, port, authentication, and transport settings one by one. Shadowsocks, VMess, VLESS, Trojan, HTTP, SOCKS5, WireGuard, and Hysteria2 use different fields; values such as passwords, public keys, and addresses are not interchangeable. Use the details provided for your service rather than guessing encryption methods or ports.
Updating Subscriptions and Manual Changes
A subscription update fetches the remote list again and may change server names, counts, or connection details. First confirm that the subscription URL is still valid, then use its update option. If the update fails, keep the existing list for comparison instead of deleting and recreating it right away. Automatic update triggers and options depend on the current app interface. Updating a list does not extend the service's validity period.
Give each subscription a name that makes its purpose clear, so you do not select a server based on duplicate display names alone. Manual changes to subscription-generated entries may be overwritten by a later update; back up any custom settings you want to keep. Before deleting a subscription, check which entries it contains and whether the currently selected server will also be removed.
The server list and rule configuration serve different purposes: one determines where to connect, the other which route requests take. Seeing a server does not mean a configuration is active, and importing a configuration does not mean a valid server has been added. For full instructions on updating, sorting, exporting, and deleting, see the subscriptions and server management guide.
On Demand Connections
On Demand lets you trigger or manage VPN connections based on configured conditions. Open On Demand in Settings, review the available network conditions and actions, then enable the options that fit your needs. Available options may vary by device and system environment; follow the wording shown in the app.
First confirm that your existing server, rules, and DNS work with a manual connection. Then configure On Demand conditions. Add one condition at a time and test connecting and disconnecting on the relevant network. If a condition depends on a Wi-Fi network name, check that the name matches exactly and consider how the device behaves when switching networks.
On Demand triggers connections; it cannot fix an incorrect password, an unavailable server, or an incomplete configuration. It may also reconnect after you disconnect manually. If that happens, check the trigger conditions in On Demand instead of repeatedly removing the system VPN configuration. To pause troubleshooting, turn off the relevant On Demand settings first, then disconnect manually. Restore the options you noted when you are done.
Data Usage
Data shows traffic usage recorded by the client. Open the Data page and check the reporting scope, time range, and upload and download labels shown in the interface. Then perform one specific network action and review the result. If the app offers a reset option, note the existing figures first so you do not lose a useful comparison.
Usage statistics can show whether traffic changed over a period, but cannot by themselves prove that a webpage loaded fully. Retries, connection setup, or partial resource transfers can all generate traffic, as can background activity. For a useful comparison, stop unnecessary concurrent activity, repeat the same request, and review the connection records as well.
Client statistics may use different measurement criteria from your service. Protocol overhead, reporting scope, reset time, and simultaneous use across devices can all cause discrepancies. Data cannot replace remaining-usage information from your service, and should not be used to estimate subscription validity. If usage seems unusually high, first check the reporting period, then look for background apps and repeated requests.
Settings and DNS
DNS resolves domain names to destination addresses and is an important step before a connection can be established. Check the relevant options in Settings; the active configuration file may also contain DNS settings, so review both. Before changing a global option, note its current value and distinguish between DNS provided by the device's network and DNS specified by the configuration.
If a server latency test succeeds but a webpage will not load, first determine whether domain resolution or the connection that follows is failing. Check the DNS address format and reachability, confirm that the resolution method works with the active configuration, then review the request records for the same domain. Support for encrypted DNS does not mean any address will work; the address, protocol, and connection path must be compatible.
Change One DNS Setting at a Time
Save the current configuration before making a single change and testing again. Do not change the server, Global Routing, and DNS at the same time; otherwise, it is hard to identify what caused the result. IP-based rules may depend on resolved addresses, and DNS changes may affect which rules match. After restoring resolution, check which routing action actually matched.
If things get worse after a change, restore the settings you recorded and continue troubleshooting. Clearing the cache can help you observe the resolution process again, but cannot fix an unreachable DNS service or an incorrect rule. Before sharing diagnostic records, hide private domains, subscription URLs, and authentication details; include only the fields needed to reproduce the issue.
Test Method and Diagnostics
Test Method selects how connectivity tests are performed; check it in Settings. Connectivity Test on Home runs tests on the server list. Choose a test method that fits your troubleshooting goal, then test the server. If the selected method requires a target address, confirm that the address is valid and accessible as expected.
Test methods examine different parts of the connection. Establishing a basic connection does not mean authentication or the target request succeeded; request-based tests are also affected by the test destination, DNS, and current network. For a meaningful comparison, keep the test method and destination the same. A low latency result reflects conditions at that moment and does not replace testing with your actual workload.
How to Use Diagnostics
Diagnostics helps collect or review information for troubleshooting; look for the relevant option in Settings. First confirm that the device's basic network works, then check server settings, domain resolution, the matching rule, and the destination connection. Reproduce the issue with one specific request and note the network conditions and steps taken. Avoid sending many requests at once, which can obscure useful clues.
Logs and diagnostic results may contain private information such as server addresses and visited domains. Review them before sharing, and remove subscription credentials, passwords, and private keys. Do not share a complete configuration. If errors occur during authentication, recheck the connection details. If they occur only for specific domains, start with DNS and rules instead of repeatedly reinstalling the app.
For the full first-connection check, see the getting started guide. The goal of diagnostics is to identify where a connection fails, not to keep switching options until it works once by chance.
Today Widget and iCloud Sync
Today Widget Shortcuts
Options for Today Widget are in Settings, where you can configure supported widgets or shortcuts. Check which options are available in the app, then add a widget in the system's widget management screen. Whether it appears, which actions it supports, and where it can be placed depend on the device's system and current app support. Do not assume every device has the same layout.
Widgets are useful for everyday actions you have already verified, but they do not replace checking servers and rules. If the result is unexpected after switching through a widget, return to Home and check the selected server, connection status, and Global Routing. If the widget has not refreshed, open the app to confirm the actual status rather than relying on its displayed text.
iCloud Sync and Independent Backups
Check the iCloud sync options in Settings and make sure the system allows the app to use iCloud. Before syncing, confirm that the configuration and subscriptions on the current device are complete. On a new device, wait for syncing to finish, then check the files, server list, and current selection. Follow the app's instructions and what is shown on your device; do not assume every setting and status will be restored.
iCloud sync is not a separate backup: deletions and changes may propagate to other devices, and offline content may not have uploaded yet. Before deleting items in bulk, replacing a configuration, or switching devices, export anything you need to keep and store it safely. Configurations and subscriptions may contain sensitive details; keep backups somewhere you control rather than sharing them publicly as ordinary attachments.
Restoring an App Store purchase and restoring your configuration are separate steps. The first restores your eligibility to get the app; the second restores your own service details and settings. After reinstalling, check that your information is complete and test a connection. Check the App Store page for purchase eligibility and system requirements.