First identify which layer a term belongs to: interface settings control overall behavior, protocols define connection methods, and rules determine where requests go. This page retains the original English terms and explains their meanings and how to check them. Select a category or entry link to jump to it.
Check Global Routing first, then interpret the current toggle and test results. Mode names differ in capitalization from rule actions; do not treat them as interchangeable based on their meaning alone.
HomeThe main screen for viewing server entries, selecting the current server, and operating the connection toggle. A populated server list only means connection details have been saved. An enabled toggle does not mean every request will succeed; verify access to the destination and review connection logs.
Global RoutingA setting that determines how requests are handled overall. Its three modes are Config, Proxy, and Direct. To route requests by rules, first check that Config is selected. When troubleshooting, note the current mode so that a difference in mode is not mistaken for a rule failure.
ProxyThe proxy mode in Global Routing, which handles traffic through a proxy overall rather than selecting destinations rule by rule as in Config. It is distinct from uppercase PROXY in a rule: the former is an overall mode, while the latter is the action taken after a rule matches.
DirectThe direct mode in Global Routing, in which the connection does not pass through the selected proxy server. It can help check whether the current network can reach a destination directly, but does not indicate the proxy server's status. Uppercase DIRECT in a rule describes only that rule's action.
On DemandA feature that triggers or adjusts VPN connection behavior according to configured network conditions. It concerns when a connection is established, not domain-based routing rules, and does not select a server for you. Check these conditions if the connection reconnects automatically or behaves differently after a network change.
Add ServerAn entry point for manually entering existing server connection details. The selected protocol determines which fields need checking. The address, port, identity details, and transport settings must match the server; do not enter parameters for a different protocol. Check for extra spaces in copied text before saving.
Connectivity TestChecks connection reachability and displays test responses to help narrow down whether a server is unreachable or a connection has failed. Results depend on the destination, method, and current network. A lower latency figure does not mean higher download speeds, nor does it guarantee the same performance across websites and sustained transfers.
DNSThe resolution mechanism that converts domain names into IP addresses. A request usually needs an address before it can connect. Resolution paths, caches, and returned addresses can affect access and IP-based rule matching. If the connection toggle works but a domain cannot be reached, check DNS separately from the server connection.
The protocol type must match the existing server; it is not a speed setting that can be changed at will. Performance depends on the transport path, parameters, and server status. The protocol name alone cannot predict speed or battery usage.
ShadowsocksA protocol centered on encrypted proxy connections. Common parameters include the server address, port, password, and encryption method. The encryption method and password must match on both ends. Check any additional transport parameters in the existing details as well; entering only an address and port does not complete the configuration.
VMessA proxy protocol with user authentication; the UUID is a common identity parameter. Connections may also require settings such as the transport method, path, Host, and TLS, depending on the server. Checking only the UUID while overlooking the transport layer may still prevent a connection.
VLESSA lightweight proxy protocol that separates the protocol itself from the transport security layer. Correct transport and security settings are still required in addition to identity details. A similar name does not mean that all VMess settings can be used as-is. Check the type and fields against your existing connection details rather than simply changing the protocol name.
TrojanA proxy protocol commonly used with TLS. The password is used for authentication, while TLS provides transport security. The server name, certificate verification, and connection address each serve a different purpose. A correct address does not guarantee that the other fields are correct. For certificate errors, check the name and certificate rather than disabling verification.
HTTP · SOCKS5These are two different proxy protocols, not two spellings of the same protocol. Select the type used by the server. Check authentication requirements and whether secure transport is configured separately; choosing a proxy protocol does not by itself mean the connection is encrypted.
WireGuardA key-pair-based tunneling protocol. Common configuration fields include keys, peer endpoint, tunnel addresses, and routing scope. Keys and addresses serve different purposes, so do not use a regular proxy password in their place. A private key is sensitive connection information and should not be shared in full while troubleshooting.
Hysteria2A QUIC-based proxy protocol whose connection performance depends on UDP reachability, congestion control, and server configuration. Check authentication, TLS, and related transport parameters against the existing service details. A connection failure on one network does not prove the same configuration will fail on other networks.
Rules are generally evaluated from top to bottom, and the first match determines how a request is handled. To read a rule, check the match type first, then the match value, and finally the action.
DOMAIN-SUFFIX,example.com,PROXYDOMAINMatches an exact domain name and is suitable for rules targeting a specific hostname. Matching example.com does not automatically match www.example.com. If the destination uses other domains, check actual request logs rather than relying only on the browser address bar.
DOMAIN-SUFFIXMatches a domain suffix and is generally used to cover a specified domain and its subdomains. It checks domain-level boundaries rather than an arbitrary substring. For example, to cover example.com and its subdomains, it is easier to maintain than listing every full domain separately.
DOMAIN-KEYWORDChecks whether a domain contains a specified string. Its match scope may be substantially broader than DOMAIN or DOMAIN-SUFFIX. Shorter keywords are more likely to match domains you did not intend to include. If traffic is routed unexpectedly, check the placement and contents of these broad-scope rules.
GEOIPMatches using a destination IP's geographic database record, for example GEOIP,CN,DIRECT. A database classification does not promise a physical location, network quality, or service availability. DNS resolving a domain to a different address, or a preceding rule matching first, can also change the outcome.
IP-CIDR · IP-CIDR6Used to match IPv4 and IPv6 ranges respectively. The prefix length after the slash determines the range, for example 192.168.0.0/16. These rules match addresses, not domain text. An IPv4-only range does not cover the same destination's IPv6 address; check the actual connection address as well.
FINALThe final rule applied when none of the preceding rules match. It is usually at the end of the rule list, for example FINAL,PROXY. This keyword does not always route through a proxy; the following action determines the destination. Check this line when troubleshooting requests not covered by specific rules.
PROXY · DIRECT · REJECTRule actions meaning use a proxy, connect directly, and reject the request, respectively. They are not domain or address match conditions. In particular, if REJECT matches, the request is denied as a result of the rule; do not immediately attribute this to a server fault. First find the specific matching rule.
The server list answers “where to connect”; a configuration file answers “how to handle requests.” Importing server details does not mean the required routing rules have also been imported or enabled.
SubscribeSettings for managing an existing subscription. A subscription URL is generally used to retrieve and update server entries; it is not the same as a Config file. If the list is empty after an update, check that the link is complete, the content format is correct, and the service is available. Subscription URLs may contain access credentials and should not be shared publicly.
ConfigIn the configuration section, Config means a file containing rules and related settings. In Global Routing, it is the mode that processes requests using the current configuration. Use context to distinguish the two. Importing a file does not mean it is in use; after editing rules, check the selected file and routing mode.
A set of connection parameters saved in the client, usually including the protocol, address, port, and identity details. The entry's display name is only a label for identification. Saving successfully means the details have been added to the list, not that the remote service is available. Entries with the same name may use different addresses or protocols.
Scan QR CodeAn entry point for reading existing connection details from a QR code, useful for importing information you already have. A QR code is only a way to carry text; check the protocol and key fields after importing. Treat QR codes containing passwords or identity details as sensitive information.
Shadowrocket is a paid, closed-source app for Apple platforms. The App Store is the only place to get it. Purchase history, client configuration, and existing network services are separate matters and should be checked independently.
Check the developer Shadow Launch Technology Limited, the official icon, and app ID 932747118 together. Do not rely on a similar name alone. You can verify the app ID in the product page URL as id932747118. See the purchase verification guide for steps.
An App Store entry for checking apps associated with the purchasing account, useful for locating Shadowrocket when changing or restoring a device. If the purchase is not listed, first check that the store is signed in with the account used to buy it. Restoring access to the app and restoring server details are different matters; the latter depends on an existing backup or imported information.
This refers to how the client is purchased. The US storefront price is approximately US$2.99; check the App Store page for the current price. A one-time client purchase ≠ a network service plan. Buying the app does not provide a server or subscription; you still need your own connection details to use it.
A storefront is the product display and pricing region associated with an App Store account. It affects search results, available products, and local prices. Shadowrocket is primarily for iPhone and iPad; Mac, Apple TV, and Apple Vision are also listed on the same product page. Check the App Store page for system requirements, device compatibility, and Universal Purchase availability.