Shadowrocket Features and Settings Guide - Shadowrocket Guide

GLOBAL ROUTING

When to Use Each Global Routing Mode

Global Routing determines how connections handled by Shadowrocket are routed. Open Global Routing from Home and choose Config, Proxy, or Direct. These options change the routing method; they do not create a server or fill in connection details. After making a selection, return to Home and check the selected server and connection toggle.

Mode	How it works	When to use it	What to check
Config	Routes traffic according to the rules in the currently enabled configuration.	When you need rules to route traffic based on domains, IP ranges, or other conditions.	Enabled configuration, rule order, and policy references.
Proxy	Routes traffic through a proxy, subject to system and app limitations.	When you want to check whether the current server can handle a specific connection.	Server availability, protocol settings, and the result of accessing the target.
Direct	Routes traffic directly. This does not test the proxy server.	When you want to check whether the local network can reach the target.	Local network, DNS resolution, and target service status.

Use Config for rule-based routing. If a target fails with Config but works with Proxy, first check which policy the rules selected instead of immediately switching protocols. If it also fails with Direct, check the local network and the target. A failed request alone does not prove the client is at fault.

Proxy and Direct are useful for comparison, but remember to restore the original mode after testing. Existing long-lived connections may not restart as soon as you switch modes. Make a fresh request to verify the change, and reconnect if needed after saving. Global Routing does not necessarily cover every system communication; system services and app-specific connection behavior can also affect what you observe.

RULE MATCHING

Rule Types, Policies, and Match Order

Rules specify which policy handles a connection. In Config, check the enabled configuration and its rules, and set Global Routing to Config. A rule type defines the match condition; a policy defines what happens after a match. They are not interchangeable. Usually, place narrowly scoped rules first, broader rules afterward, and check the fallback rule last.

DOMAIN

DOMAIN-SUFFIX

Matches by domain suffix. For example, example.com can match the domain and its subdomains. DOMAIN matches an exact domain, while DOMAIN-KEYWORD matches a keyword; overly broad keywords can catch targets you did not intend to match.

ADDRESS

GEOIP

Matches based on an IP geolocation database, not a website's language or content. Database records, DNS results, and the actual location of a service may differ, so you cannot determine which GEOIP condition will match just from a website's name.

NETWORK

IP-CIDR / IP-CIDR6

Matches IPv4 and IPv6 address ranges separately. Check the address family and prefix length before setting a rule. A domain may resolve to different addresses; an IPv4-only rule does not mean IPv6 connections will be handled the same way.

FALLBACK

FINAL

Acts as a fallback when none of the preceding conditions match. It has no domain or address range to match. Checking the policy assigned to FINAL can explain why a target without a specific rule still goes through a proxy or connects directly.

PROXY, DIRECT, and REJECT

PROXY routes a connection through a proxy, DIRECT connects without one, and REJECT blocks the matching connection. If your configuration uses custom policies or policy groups, make sure the referenced names exist and are spelled consistently. The snippet below illustrates rule syntax; it is not a complete configuration. The example domain is for demonstrating the rule structure only.

DOMAIN-SUFFIX,example.com,PROXY
GEOIP,CN,DIRECT
FINAL,PROXY

REJECT applies to a connection, not just one part of a webpage. If a page and its other resources share a domain, rejecting that domain may also break normal functionality. Conditions such as USER-AGENT require the client to have the relevant information and may not work for every encrypted connection. After changing rules, check the connection log for the target, matched rule, and final policy. Do not judge the result only by whether the page looks different.

For protocol fields and guidance on choosing a protocol, see the protocol reference. Rule mismatches and protocol setting errors occur at different stages. First check how the traffic was routed, then whether a connection could be established at that destination.

SERVER MANAGEMENT

Managing Existing Subscriptions and Servers

A server entry stores the address, port, protocol, and authentication details for one connection. A subscription retrieves and updates a group of entries. Manage both from Home. If you already have a subscription, tap Add Server, choose Subscribe, and enter the complete link. For details of a single server, choose its protocol and enter each field as provided. You can also use Scan QR Code if you have a QR code; check the imported details before connecting.

Check Imported Details Before Connecting

After saving, check the entry name, protocol, server address, and port, and make sure the selected entry is the one you intend to use. Shadowsocks, VMess, VLESS, Trojan, Hysteria2, and WireGuard use different parameter formats. Changing Type alone does not convert one protocol into another. Make sure additional fields, such as the TLS name and transport settings, match the details you have. Do not disable verification just to make a test pass.

Updating a subscription retrieves the remote list again; it does not guarantee that entry names or counts will stay the same. Check the subscription group before updating, then confirm your selection afterward. If you edited an entry generated by a subscription, a later update may overwrite your changes. Before relying on a standalone setting long term, check how the app saves and manages it.

Troubleshoot an Empty List Separately from a Failed Connection

If the list is empty, first check that the link was copied in full and contains no extra spaces. Make sure the response uses a supported subscription format, then check that the subscription is still valid. If entries appear but connections fail, check the address, port, authentication, and network reachability. Routing configuration in Config and the server list in Home serve different purposes; importing a subscription does not enable a suitable routing configuration.

Subscription links may contain access credentials. When reporting a problem, describe the error without sharing sensitive details. Redact link parameters, authentication fields, and personal addresses from screenshots and logs, and never post a complete link in a public forum. For import steps, see the getting started guide.

ON DEMAND

Setting Up and Testing On Demand

On Demand lets configured conditions trigger the system to establish a VPN connection. It controls when to connect, not how traffic is routed after the connection is established; that depends on Global Routing and the current configuration. It is also separate from automatic subscription updates and will not restore invalid server details.

Find On Demand in Settings and review the conditions available in your app version. Set them to match the networks you actually use. Before enabling automatic triggers, connect manually from Home and confirm that the server works. If you use Wi-Fi conditions, check each network name and its associated action to avoid making a network you meant to exclude a trigger for connecting.

After setup, test in environments that do and do not meet the conditions, and check both the system VPN status and the app's connection status. If the VPN reconnects after you disconnect manually, On Demand may have been triggered again; this does not necessarily mean the toggle is broken. For troubleshooting, note the original conditions, pause On Demand, run a manual test, and restore the settings afterward.

DATA

Understanding Data Usage and Connection Results

Data shows traffic information recorded by the app. Open Data and first check the scope and meaning of the figures shown, then compare items such as upload and download. Traffic counts indicate that the app observed data transfer; they do not confirm that a target page loaded correctly or that every request used the intended policy.

To check the effect of an action, note the current counts, make one specific request, then return and compare. If the current screen offers a reset option, use it only after confirming you no longer need the history. Resetting affects only the relevant statistics, not usage recorded by a service. Background apps and system activity can also generate traffic, so minimize other transfers while testing.

Data is not a universal place to check a subscription's remaining allowance. App statistics and billing records for an existing service may differ because of reporting periods, protocol overhead, or reset times. When investigating a usage discrepancy, compare the time range and measurement basis first. For access problems, check connection logs, DNS, and server status instead; traffic figures alone do not indicate whether a connection works.

SETTINGS & DIAGNOSTICS

A Practical Order for Checking Common Settings

Settings groups options for connections, tests, and related features. Some options may also be controlled by the current Config. Follow the options displayed in your version of the app: note the original value, change one setting, then verify the result. Avoid changing DNS, test, and automatic connection options across multiple configurations at once, or it will be difficult to identify what caused the change.

DNS: Check Which Layer Controls It

DNS resolves domain names to addresses, which can affect connections and some rule matches. First check DNS options in Settings, then see whether the current Config also specifies DNS settings. Changing one place does not necessarily mean the change has taken effect. When using an existing configuration, understand how it routes DNS requests and handles fallback resolution.

If a domain cannot be reached but an address can, DNS is one possible area to investigate, but that is only a clue. Certificate names, server requirements, and caching can also cause differences. After changing DNS, make a fresh request and reconnect if needed, then check the diagnostic results. Do not assume a setting is correct just because a resolved address looks familiar.

Test Method and Connectivity Test

Test Method selects how a connection test is performed; Connectivity Test runs the test. Check Test Method in Settings, then return to the server list and test the entries you want to check. Different methods measure different things, so results are not direct measures of download speed. Do not rank entries using values from different test methods.

A successful test means the test completed under its specific conditions; it does not guarantee that every target is reachable. Assess a failed test in light of the method, target, and current network, as network conditions can limit some tests. For a meaningful comparison, use the same method and network. The final measure is whether the connections you actually need work.

Today Widget is a helper feature for system widgets. Find its option in Settings, then add or manage the widget wherever your device's system allows. Available locations, appearance, and controls depend on the system environment and the app's current implementation; refer to what your device displays.

A widget should not replace a full check in Home. If its status does not match what you expect after using it, return to the app and confirm the connection toggle, Global Routing, and selected server. Complete the initial setup and any required system authorization in the app.

iCloud: Syncing Is Separate from Purchase History

iCloud features sync data supported by the app. Check the sync options in Settings and confirm that iCloud is available in your device's system settings. Before expecting data to appear on another device, confirm that both devices use the right account and have the required sync permissions and network access. Changes may not appear immediately on another device.

The sync scope depends on the app's current documentation; do not assume it includes all server credentials, usage history, or system VPN permissions. Keep a recoverable copy before making important configuration changes. App Store purchase history and iCloud data sync are separate mechanisms: restoring a purchase does not restore configuration, and importing configuration does not complete a purchase.

Diagnostics: Preserve Clues Before Changing Settings

Diagnostics helps collect and review information for troubleshooting connections. Find the relevant option in Settings, reproduce the issue once, then review or export the diagnostic information currently available. Record the network type, Global Routing mode, target domain, current configuration, and error behavior. These details can help identify whether the issue occurs during DNS resolution, connection setup, or rule handling.

Before sharing logs, check whether they contain subscription links, authentication details, personal domains, or other sensitive information, and redact as needed. Diagnostic logs capture observations from a period of time; they are not a complete record of every past action. If changing a setting resolves the issue, note what changed rather than resetting other options in bulk.

This guide focuses on features for iPhone and iPad. For Mac, Apple TV, and Apple Vision compatibility, system requirements, and purchase eligibility, refer to the App Store listing. Interface layouts may vary by device, so the locations described here may not be the same on every device.