Use the screen context to understand English interface labels, then distinguish protocols, rules and configuration. App labels remain in English. Each entry has its own anchor, making it easy to return here from a setup guide.
Shadowrocket is a cross-platform rule-based proxy client. The iPhone / iPad app costs $2.99 as a one-time purchase on the App Store; the Mac (Apple silicon and Intel), Windows, Android and Linux versions are free. Buying the app once does not include a service plan. The import instructions below assume you already have your own subscription or server details. See Get Shadowrocket for all platforms.
Identify the page, mode or control first. The same label can mean different things in different places; the entries below explain common interface contexts.
Choose how requests are handled overall. Common options are Config, Proxy and Direct. To route traffic according to rules in a configuration file, select Config and make sure the correct configuration is active. Changing this setting changes whether those rules apply, so check it first when troubleshooting routing—not the server settings.
As a page name, Config is where you manage configuration files and related settings. In Global Routing, it means requests are handled according to the selected configuration. Importing a file does not mean it is in use. Check both the active configuration and whether Global Routing is set to Config.
Here, Proxy means the mode in Global Routing that routes requests through a proxy rather than applying individual rules from a configuration. It is not a protocol such as Shadowsocks or Trojan, nor does it guarantee that a server is available. Distinguish the interface mode Proxy from the uppercase PROXY policy in a rule: one is a mode, the other a policy.
Here, Direct means the mode in Global Routing that sends requests over the current network's direct route. Direct connections still require a working network and DNS, and the destination may still be unreachable. It is related to the DIRECT rule policy, but the scope differs: a mode affects overall traffic handling, while a rule policy applies only to requests matching that rule.
Trigger connections based on preset conditions, useful when connection behavior should depend on the network environment. This setting answers “when to connect”; routing rules answer “how to handle a request.” They are separate controls. Test the result on both Wi-Fi and cellular networks, and note the original trigger settings before changing them.
Add your existing server details by selecting a type and entering its address, port and authentication parameters. Match each field to the information you have; do not guess the protocol from the port or name alone. Saving an entry stores its details in the client but does not verify that the remote service is reachable. For the full process, see the setup guide.
View server entries, the current selection, the connection toggle and other key details. When troubleshooting, first make sure the expected entry is selected, then check its connection status so you do not confuse results from another entry. A connected toggle only indicates that the connection process reached a particular state; verify access separately.
Choose a protocol that matches your existing server details. Speed, battery use and stability also depend on the transport, server load and network conditions; protocol names alone are not a basis for ranking performance.
Establishes a proxy connection using encryption, a password and other parameters. The client and server must use compatible settings. In addition to the address and port, check that the encryption method matches exactly. Enter any extra transport parameters as specified; a password alone may not complete the configuration.
Authenticates using a user ID and other details, and can work with different transport methods. Transport type, path and TLS settings can all affect connectivity; a device clock that is significantly off may also disrupt authentication. After importing a link, check the key parameters. Do not relabel details for another protocol as VMess.
Separates authentication from transport security: a user ID is used for authentication and does not mean that application data is encrypted. Check the transport method and security layer specified by the server. Keep required TLS, server name and related parameters together; two configurations are not equivalent just because they use the same user ID.
Typically connects over TLS and then authenticates with a password, so the password is not the only requirement. The address, port, server name used for TLS verification and certificate status can all affect the handshake. If a certificate error occurs, check the server details and device clock; disabling certificate verification is not a routine fix.
Uses QUIC for transport. Performance depends on UDP availability, packet loss along the route and bandwidth settings. Results may differ from entries using TCP when you switch networks. Set bandwidth parameters according to actual network capacity; overestimating them does not necessarily improve throughput. Monitor battery use separately during sustained high-speed transfers.
Creates a tunnel using key pairs and a virtual network interface. Configuration typically includes keys, an endpoint, interface addresses and allowed IP ranges. Keep private keys confidential; do not include them in public screenshots, articles or support requests. Access after the tunnel connects also depends on routing ranges, DNS and remote network configuration—not just the handshake status.
In a server type field, HTTP means an HTTP proxy; it does not mean the proxy can only access basic web pages. For HTTPS destinations, CONNECT can establish a tunnel, but this does not automatically encrypt the connection between the client and proxy server. Check the entry's actual security settings and server capabilities to determine whether that connection is encrypted.
Supports TCP connections and may handle UDP when both the client and server support it and the settings allow it. SOCKS5 does not provide transport encryption; entering a username and password does not encrypt the connection. Also check which end resolves domain names and whether the destination service requires UDP, as these differences can affect the result.
For a comparison of transport methods, field meanings and use cases, read the protocol guide. If your existing details specify a protocol, configure it accordingly before testing the connection.
A typical rule contains a type, a match value and a policy. Rules are generally evaluated in list order, so a broad rule near the top may take precedence over a more specific one. FINAL usually goes at the end.
Matches a specific full domain, for example DOMAIN,example.com,DIRECT. This does not automatically cover every subdomain; api.example.com must be handled separately. For a single, specific hostname, an exact match is easier to verify than a broader rule.
Matches a domain and its subdomains. For example, DOMAIN-SUFFIX,example.com,PROXY can match example.com and its subdomains. This is not a match for any string containing the text; domain boundaries still matter. Before using it for related services, confirm that they belong to the same domain hierarchy.
Matches when a domain contains a specified string, for example DOMAIN-KEYWORD,example,PROXY. The scope may be broader than expected because other domains containing the same characters can also match. For a specific service, consider DOMAIN or DOMAIN-SUFFIX first, then decide whether a keyword match is necessary.
Matches according to the target IP's location in a geolocation database, for example GEOIP,CN,DIRECT. It does not use webpage language, site branding or the user's current location, and the database location may differ from the actual server location. If a domain resolves to a different IP, the match may change.
Describes an IPv4 network using an address and prefix length, for example IP-CIDR,192.168.0.0/16,DIRECT. The number after the slash is the network prefix length, not a port; a larger number usually matches a smaller range. For local network rules, check the actual subnet to avoid including unrelated addresses.
Matches an IPv6 address range, such as IP-CIDR6,2001:db8::/32,DIRECT, which uses a documentation-only example address. IPv4 rules do not automatically cover IPv6, and a domain may resolve to both address types. If access differs from expectations, check routing for both address types rather than reviewing only IPv4 settings.
Sets how requests that did not match earlier rules are handled, for example FINAL,PROXY. It usually appears at the end of the rule list to give unmatched requests a defined route. If a request always reaches FINAL, check the types, domains and order of earlier rules before assuming the server is at fault.
PROXY routes a request through a proxy, DIRECT connects directly, and REJECT denies the request. The specific proxy route also depends on the current selection and configuration. These are rule policies, not protocols or measures of bandwidth and connectivity. A rule may also refer to a custom policy group; make sure the group is defined in the configuration before using it.
Server entries, subscriptions and configuration files serve different purposes. A successful import, update and connection each indicate a different stage; do not rely on just one status message.
Retrieves or updates subscription content you already have; the exact function depends on the screen and type of information. An update usually fetches the remote content again, so the number, names or settings of entries may change. Check whether local edits could be overwritten, then review the current selection after updating rather than assuming the same entry is still active.
Retrieves updateable server details or configuration from a URL. Get the link from your existing service provider. Different URLs may return different formats; a server subscription does not necessarily include a full set of rules and DNS settings. Authentication details in the URL are sensitive: hide the full address when troubleshooting and never post it publicly.
In the client, this usually means a set of remote connection details, including the protocol, address, port and authentication information. The displayed name is just a label and does not establish the server's location, speed or availability. Entries with the same address can still connect differently if their protocols, ports or authentication settings differ.
Organizes rules, DNS and other settings; its scope depends on the file's contents. Check separately whether the file was imported, selected and applied. Before using an external configuration, review key content—especially the final policy, remote resources and rewrite rules—and save a copy of the original so you can restore it.
When the relevant settings and account conditions allow it, iCloud syncs supported data. Check the app's settings for exactly what is included. Sync depends on system permissions, network status and cloud availability, so it may not complete immediately. This is separate from App Store purchases: sync handles app data, while purchase history handles transactions. Check both when moving to a new device.
This site does not provide, sell or recommend servers or subscriptions. For instructions on importing details you already have, see the setup guide; for format mismatches, failed updates and other issues, see troubleshooting.
Test readings are observations made under specific conditions. To troubleshoot, change one setting at a time and record the network, current entry and destination so you can compare results.
Resolves a domain name to an IP address before the connection can proceed. The route used for DNS requests may differ from the route used for application traffic, and the resolved IP can affect IP-based rule matches. After changing DNS settings, account for caching and check “does it resolve?” and “can it connect?” separately rather than treating them as the same problem.
Checks an entry's connectivity using the current test method. Results depend on the test target, network conditions and parameters. A successful test does not mean every site is accessible, and a failed test needs to be interpreted in context. When comparing entries, keep test conditions consistent, then verify access to the actual destination instead of drawing conclusions from a single number.
The time taken for a request and response under a particular test condition, usually measured in milliseconds. Different test methods may include different steps, so their results are not directly comparable. Low latency does not mean high bandwidth or fast sustained downloads; also consider packet loss, jitter, server load and real-world performance.
Rewrites or redirects a request URL based on conditions. This changes how the request address is handled, not which connection route it takes. URL rewriting and rule-based routing are different features; URL Rewrite cannot replace routing rules such as DOMAIN-SUFFIX. What can be inspected or modified in encrypted requests depends on related settings. Do not enable unknown rewrite content just to troubleshoot an ordinary connection issue.
For a first-time setup, follow this order: import details you already have → check Global Routing → enable the connection → verify access. If the connection works but access does not match expectations, check rule matches, DNS and the current selection first. Avoid changing several parameters at once.