Look up interface items, protocols, rules, and networking concepts. First identify which layer a term belongs to, then determine whether you need to change server parameters, a configuration file, or the overall connection mode. English names match the app interface and rule syntax.
Interface controls organize actions, while connection status reflects what is happening. Opening a screen or selecting a record does not, by itself, establish a connection.
Home is the main place to view the server list, current selection, and connection status. A server appearing in the list only means its record is saved; you still need to select a suitable record and start the connection. When troubleshooting, distinguish between a saved record, a selected server, and an established connection.
Global Routing determines the overall routing mode: Config, Proxy, or Direct. Config handles requests according to the rules in the current configuration; Proxy routes traffic through a proxy; Direct connects without a proxy. These modes are at a different level from the action on an individual rule.
On Demand uses the system’s on-demand connection mechanism to trigger a VPN connection when specified conditions are met. It controls when a connection attempt starts; it does not guarantee a valid server, correct authentication, or access to a destination website. If the connection starts again after you disconnect manually, check this setting along with your network conditions.
Add Server lets you enter a server record manually; the fields vary by protocol. Match the address, port, authentication fields, and transport parameters to the server details you already have. Do not guess based on the server name alone. After saving, select the record from the list and verify it with an actual request.
Settings is where you view and change app settings; it is different from the editor for individual server parameters. When troubleshooting, note the original value and change one setting at a time so you can identify what made a difference. The available options and their locations may vary; refer to the interface on your device.
Connectivity Test checks whether a specified destination is reachable under current conditions. Results depend on the test method, destination address, and local network, so one successful test does not mean every service is working. If a test fails, compare its results with DNS, request logs, and actual website access.
A protocol defines how the client and server exchange data. Using the same protocol name does not mean the parameters are identical; check authentication, transport, and TLS settings separately.
Shadowsocks is a proxy protocol. Common required details include the server address, port, encryption method, and password. The encryption method is part of the connection settings; a correct password alone is not enough. After entering or importing details, check that every character is intact and that the values match the server information you already have.
VMess is an authenticated proxy protocol. Identity and transport are separate parameter layers. After entering the identity, check the port, transport path, TLS, and other relevant settings. Authentication and transport failures can look similar, so check each layer instead of repeatedly changing the same field.
VLESS is a proxy protocol that typically requires an identity and transport parameters matching the server. The identity identifies the connection; it does not provide transport encryption or certificate verification. Use the complete parameters you already have and verify identity, transport, and security settings separately.
Trojan is commonly used with TLS and authenticates with a password or other credentials. The server address, port, TLS name, and certificate verification can all affect the connection, so a correct password does not rule out other issues. If you see a certificate error, check the server name and certificate configuration rather than bypassing verification.
Hysteria2 is a QUIC-based proxy protocol that relies on UDP for transport. If the current network restricts UDP, other types of connections working does not prove that Hysteria2 can connect. Enter authentication, TLS, and other parameters according to the configuration you already have. The protocol name does not guarantee a particular speed or stability.
WireGuard creates an encrypted tunnel using a key pair. The local private key and peer public key have different roles and cannot be interchanged. Address is the tunnel interface address, not the server’s public connection address; DNS and MTU affect name resolution and data transfer separately. Keep the private key secure. For details on each setting, see the WireGuard parameter guide.
HTTP and SOCKS5 are different proxy protocol types. Choose one based on the server information you already have; the same address and port do not make them interchangeable. Username and password requirements, as well as transport protection, depend on the server configuration and connection method. A protocol name does not guarantee encryption or support for every request type.
First check what a rule matches, then what it does when matched. The syntax below illustrates the structure; the example domain is not a ready-to-use configuration.
A Rule consists of a match condition and an action that determines how a request is handled. In Config mode, rules are generally checked from top to bottom, and the first match affects the result. More specific conditions usually belong before broader ones. After making a change, check which rule the request actually matched—not just whether the rule was saved.
DOMAIN matches an exact domain name, for example DOMAIN,example.com,DIRECT. It applies to the specified domain and does not automatically include all subdomains just because their names are related. To cover both a root domain and its subdomains, first consider whether DOMAIN-SUFFIX is a better fit.
DOMAIN-SUFFIX matches a domain suffix and typically covers the specified domain and its subdomains. For example, a suffix rule for example.com can match that domain and its subdomains; it does not match every name that happens to contain the same text. A webpage may request resources from several domains, so matching its main domain does not mean every resource follows the same route.
DOMAIN-KEYWORD checks whether a domain name contains the specified keyword. Its match scope is usually broader than an exact-domain or suffix rule. Short, common keywords may match domains you did not intend to include. Use this rule only when that broader scope is needed, and check request logs for unintended matches.
GEOIP matches based on a country or region associated with an IP in a geolocation database, for example GEOIP,CN,DIRECT. Database attribution does not reveal a server’s precise physical location or indicate access speed. For domain requests, also consider whether DNS resolution or address selection changed which IP was matched.
IP-CIDR and IP-CIDR6 match IPv4 and IPv6 address ranges, respectively. The prefix length after the slash determines the range; it is not a port number. Adding an IPv4 rule does not cover the same service’s IPv6 addresses. When checking a connection, note which address type it actually uses.
FINAL handles requests that did not match earlier rules and is usually placed at the end as a fallback. FINAL,PROXY and FINAL,DIRECT handle remaining traffic differently, so do not check only the domain rules above them. Moving a fallback rule earlier can prevent more specific rules below it from being checked.
PROXY sends a request through a proxy, DIRECT connects to the destination directly, and REJECT blocks the request. These are rule actions and should be distinguished from the overall Proxy and Direct modes in Global Routing. A PROXY match still requires a valid server and correct parameters; a rule match does not guarantee a successful connection.
Server subscriptions maintain connection records, while configuration files organize rules and other settings. Importing, syncing, and backing up serve different purposes and should not be treated as interchangeable.
Subscribe uses a subscription link you already have to maintain the server list, re-reading the content returned by that link each time it updates. A subscription link may contain authentication details, so keep it as secure as a password. After an update, compare changes to the returned subscription content. Updating the server list does not update the rules configuration.
SERVER refers to a record containing server connection details, often called a server or node in Chinese-language documentation. The display name helps identify the record; the connection itself depends on the address, port, protocol, authentication, and related transport parameters. Identical names do not imply identical settings, and renaming a record does not change the server’s network capabilities.
Config can refer to the interface for managing configuration files or to Config mode in Global Routing; use the context to tell which one is meant. Configuration files organize rules, DNS, and other settings, while server subscriptions primarily maintain server records. Importing a file does not mean it is active; check the current configuration and overall routing mode as well.
Scan QR Code uses the camera to read recognizable connection details from a QR code and may require camera permission the first time. A QR code is only a way to carry information; it does not guarantee that the parameters are complete or valid. After importing, check the protocol, address, and authentication fields. Avoid sharing QR codes that contain connection credentials.
A share link encodes connection parameters in a protocol-specific format and may contain a server address, authentication details, and transport settings. A link for sharing one server is different from a subscription link that updates an entire list; do not use them interchangeably just because both are text links. After importing from the clipboard, check that special characters and fields were preserved.
iCloud Sync keeps app-supported data in sync across devices; the actual scope depends on app settings and system status. Sync is not the same as a full backup, so after moving to a new device, check the servers, current configuration, and connection settings individually. Manually exported files may also contain sensitive parameters. For more information, see configuration backups and device migration.
Requests pass through several stages. Distinguish domain resolution, server connection, authentication, and content transfer so you can troubleshoot the stage where the failure occurs.
DNS resolves domain names to records such as IP addresses and is a common first step when accessing a website. A DNS response does not mean the destination is reachable, and normal server latency does not prove that name resolution is working. If a webpage will not load, first determine whether the failure is in DNS resolution or in the connection and transfer stages that follow.
Latency is the time taken by a specific test; its meaning depends on the test method and destination. Lower latency does not mean higher download bandwidth, nor does it guarantee that other websites or apps use the same route. Keep test conditions consistent when comparing results, and verify them against actual requests.
TLS protects data in transit, while SNI indicates the server name being accessed during the TLS handshake. The connection address and this name may differ; follow the existing server configuration for each. For certificate errors, check the name, certificate chain, and device time rather than simply ignoring the error to decide whether the connection is correct.
UDP is a datagram transport protocol used by some tunnel protocols, real-time communications, and DNS requests. UDP-based connections require support from the local network, server, and relevant settings. A working webpage does not prove that the UDP path is working; use a test that matches the affected service.
MTU is the largest packet size a link can carry; tunnel encapsulation uses additional space. An unsuitable value may allow a connection to start but cause problems transferring some content. That symptom alone does not identify the cause. Record the original value, follow the configuration you already have, and retest the same service after making a change.