Official Manual · Feature Reference

Shadowrocket Features and Settings

Start by choosing Global Routing, then check your configuration and servers. Once connected, use Data and Diagnostics to narrow down the issue. Change one setting at a time and keep a record of the original result for comparison.

For iPhone and iPad users with their own subscription or server details. Check the App Store listing for system requirements and compatibility.

Routing modes determine how traffic is handled
Rules determine the match result
Verify test results against other evidence

Global Routing: Config, Proxy, and Direct

Global Routing determines how the current connection routes traffic; it is not a server protocol selector. Open Global Routing from Home and choose Config, Proxy, or Direct. Before changing modes, note the current selection so you can restore it when troubleshooting is complete.

Mode	How it works	When to use it	What to check
Config	Handles requests using the rules and policies in the active configuration.	Everyday routing based on domains, addresses, and other conditions.	The active configuration, rule order, policy references, and final fallback rule.
Proxy	Routes traffic through the proxy mode instead of applying Config's usual rules one by one.	Temporarily check whether the selected server can handle the target connection.	The selected server's settings and any relevant exclusions in the configuration.
Direct	Connects directly to the destination.	Compare direct access on the current network.	The local network, DNS results, and the destination service's status.

Choosing and testing a mode

If you already have routing rules, first confirm which file is active in Config, then set Global Routing to Config. If you suspect a rule is selecting the wrong policy, temporarily switch to Proxy and compare using the same network and destination. To check whether the current network can reach a destination directly, test Direct. Change only the mode during each test. Changing the server, DNS, and network at the same time makes it hard to tell what affected the result.

A mode label does not prove that a connection works. Proxy does not guarantee that the server is available, and Direct does not mean the system connection switch is off. Check the connection status, request records, and actual access results before drawing a conclusion. Restore the mode you need after troubleshooting; leaving a temporary test mode enabled can change how traffic that depends on rules is handled.

Rule-Based Routing: Match Conditions and Policies

Rules specify which requests match; policies specify how those requests are handled. Check both.

View and manage rules in Config. Before testing, make sure Global Routing is set to Config and that you are editing the active configuration. Rules are generally evaluated in order, so put more specific conditions before broader ones. FINAL handles requests that do not match earlier rules. Adding a rule to a different, inactive file will not change how the current connection behaves.

Rule type	What it matches	Notes
DOMAIN	An exact domain.	Use when you want to handle one specific domain.
DOMAIN-SUFFIX	A domain suffix and its subdomains.	Check that the match does not include subdomains you do not want to affect.
DOMAIN-KEYWORD	A keyword contained in a domain.	Matches can be broad, so avoid short keywords.
IP-CIDR / IP-CIDR6	IPv4 or IPv6 address ranges.	Check the address range and prefix length; do not confuse a single address with an entire subnet.
GEOIP	A region associated with an address in a database.	A database's region classification does not indicate the language or business region of the destination service.
FINAL	Requests not matched by earlier rules.	Use as a fallback, after rules that need to match first.

PROXY, DIRECT, and REJECT

PROXY sends a request to a proxy policy, DIRECT connects directly, and REJECT denies the request. A configuration may also reference a named policy group; if it does, check the group's current selection as well as the rule. The Proxy mode in the interface and the PROXY rule keyword operate at different levels: the former selects a routing mode, while the latter is a rule action. They are not interchangeable.

[Rule]
DOMAIN,example.com,PROXY
DOMAIN-SUFFIX,example.org,DIRECT
DOMAIN,blocked.example,REJECT
IP-CIDR,192.168.0.0/16,DIRECT
FINAL,PROXY

These examples illustrate syntax and order; they are not complete files ready to replace your personal configuration. When adding a rule, test it with one destination before broadening the match. If traffic still uses another policy, check for an earlier matching rule and use request records to verify the actual domain or address. The domain shown on a page may not cover every request made by that service.

Subscriptions and Server Management

Server entries store connection parameters. Subscribe imports and updates a server list you already have; neither is the same as a complete routing configuration in Config. On Home, use Add Server to create a single entry, or choose Subscribe and enter an existing subscription. If you have a QR code, use Scan QR Code after confirming it comes from your own configuration source.

What to check when adding or updating

When adding a server manually, choose the protocol that matches your existing server details, then check the server address, port, authentication details, and protocol-specific options. Parameters for Shadowsocks, VMess, VLESS, Trojan, WireGuard, and other protocols are not interchangeable. A successful save only confirms that the entry was created; it does not mean the remote service is available. Select the entry, run Connectivity Test, and verify access to an actual destination.

When importing a Subscribe link, keep it intact, including query parameters, and check for spaces or line breaks introduced during copying. Updating a subscription rereads its contents and may add, change, or remove server entries. Before editing an entry generated by a subscription, consider whether the next update will overwrite your changes. Keep a separate record of personal settings you need to retain; temporary edits are not a reliable long-term storage method.

Multiple Lists and Sensitive Information

If you manage multiple subscriptions, use notes to distinguish their sources and purposes, and confirm which list an entry belongs to before removing it. The same note does not mean the parameters are identical, and repeated addresses do not necessarily mean entries are duplicates: ports, protocols, and authentication methods may differ. After deleting an entry, check whether Config still references it or its policy name, so rules do not point to a removed item.

Subscription links may contain access credentials, and QR codes, exported data, and diagnostic records may include server details. Do not share them in public screenshots. This site does not provide, sell, or recommend servers or subscriptions. To verify remote parameters, use information you already have and contact the relevant service provider rather than guessing by repeatedly changing unrelated settings.

On Demand: Triggering Connections by Conditions

Get a manual connection working first, then set up automatic triggers. Automatic connections cannot fix incorrect server parameters.

On Demand determines whether to trigger a connection based on conditions such as the network. Open On Demand in the app, review its current rules and actions, then configure conditions for Wi-Fi, cellular networks, or domains as needed. The setting's location and available options may vary; check what is shown in the app on your device rather than inferring the layout from another device.

Enable conditions one at a time

Start with a scenario you can repeat, such as connecting when you join a known Wi-Fi network. Check the spelling and spacing of the network name, then confirm the action is what you expect. After saving, switch to that network and check the system connection status and actual access results. Once the first rule works, add other network conditions. Avoid adding several overlapping rules at once.

Domain-based conditions also depend on when the system makes a DNS request or accesses a domain. Entering a domain does not mean that the same action will immediately apply to every related request. If conditions overlap, check their order, actions, and actual match results. Different behavior after switching networks may also mean the current network cannot reach the server; distinguish that from a trigger failure.

How On Demand and Global Routing Differ

On Demand triggers a connection; Global Routing and Config determine how traffic is handled after connection. An automatic connection succeeding does not mean routing is correct, so check the current mode and configuration. If the connection comes back after you disconnect manually, first check whether On Demand is still enabled rather than immediately deleting the server. To pause automatic behavior, turn it off in the relevant settings and check the status again.

Data: Reading Traffic Statistics

Data shows traffic information recorded by the app. Open Data and check the current view's statistics scope, time range, and units before reading upload and download figures. If the page offers a reset option, keep any records you need for comparison before resetting. Values after a reset cannot be directly compared with the previous cumulative totals.

Using statistics to help troubleshoot

To troubleshoot, note the current figures, open a single destination, then return to Data and check what changed. An increase in traffic while a page still fails shows that traffic was recorded, not that the destination's service request succeeded. Check DNS, the destination's response, and the rule policy as well. Background apps may also generate traffic, so do not attribute every increase during that period to the page you just opened.

Data is not a service provider's remaining-usage page, nor is it the same as cellular usage in the device's system settings. The starting point, network scope, protocol overhead, and billing method may differ, so do not use the app's cumulative totals to estimate a remote account balance. Likewise, traffic appearing in Data does not prove that a request used a proxy policy. To determine its route, check Global Routing, the matched rule, and request records.

To reproduce an issue, use a consistent observation period and note the current network; this is more useful than a screenshot of a single cumulative figure. Do not keep clearing records just to get tidy-looking numbers. What matters is a comparable change before and after an adjustment, not an isolated value.

Settings: Common Options and Diagnostics

Review the active configuration before changing app settings. Options in the configuration file may also affect the final behavior.

DNS: Identify Where the Problem Occurs

DNS resolves domain names. Check related options in the DNS section of Settings and in the active Config. Record the current DNS settings before changing them, and follow the requirements of your existing configuration. Distinguish between a domain that fails to resolve, a connection that fails after resolution, and a connected destination that returns an unexpected response; each calls for a different approach.

Retest using the same domain after changing a setting, keeping in mind that caching may temporarily make the results look unchanged. If only some domains fail, check their rules, resolution path, and IPv4 / IPv6 results rather than routing every request through the same policy. Changing DNS will not fix an incorrect port, authentication details, or an unavailable remote server. Investigate the observed error instead of repeatedly switching DNS addresses.

Test Method: Understanding the Scope of Connectivity Test

Check Test Method in Settings, then run Connectivity Test from Home. The test method determines what is measured and what counts as success, so times from different methods are not directly comparable. If the method requires a test target, make sure that target is reachable. An issue with the target may affect the result without reflecting the server's overall capabilities.

One successful test does not mean every site, transport, or service is working; a single timeout does not prove the entire configuration is broken. Retest, then check the address, port, protocol parameters, system time, and current network. Finally, verify access to a destination you actually need. Record the test method alongside the result rather than comparing a number on its own.

Today Widget: Quick Actions and Status Checks

Today Widget provides related shortcuts and status information. Check the Today Widget option in Settings, then use the widget-adding controls provided by your device's system. Availability, appearance, and available actions depend on the current system and what the app displays; layouts may differ between devices.

After using a shortcut, return to Home to check the selected server, Global Routing, and connection status. The widget provides an action or status display; it does not verify server parameters. If the status after a shortcut differs from what you expected, check the app's status and On Demand conditions. Do not assume a connection is established based only on the widget's appearance.

iCloud: Sync Does Not Restore Purchases

Before using iCloud sync, check the sync switch and the content involved in Settings, and confirm the system allows the app to use iCloud. On a new device, check the sync results before making further changes. If content does not appear right away, first check your account, network, and system permissions; repeatedly creating entries may cause confusion.

Do not assume sync will migrate every setting and sensitive field intact. Check what actually synced, keep recoverable records of important configurations, and store exports securely. iCloud sync and restoring an App Store purchase address different issues. To reinstall the app, see Restore a Previous Purchase; a sync switch cannot replace checking your purchase history.

Diagnostics: Collecting Evidence for a Specific Issue

Find Diagnostics in Settings and use the tools available in the current app to check the connection or records. Before you start, describe the symptom: do all requests fail, does one domain fail, or does the issue occur only after changing networks? Record the current Global Routing mode, configuration, server entry, and conditions when the error occurs, then reproduce it once. This helps keep unrelated records from obscuring the key error.

Diagnostic tools report what they observe; they do not guarantee an automatic fix. When reviewing logs, focus on errors that match the time and the relevant requests. Do not infer the whole cause from a single warning. Before sharing records, remove credentials from subscription links, authentication fields, and personal network information. Error types, reproduction steps, and necessary redacted parameters are usually more useful for troubleshooting.

Settings Checklist

Start by checking whether a basic connection can be established, then confirm that requests use the intended policies, and only then configure automation and sync. Follow these steps to reduce misdiagnoses caused by changing several settings at once.

Confirm you have complete details. Check the server protocol, address, port, and authentication fields. After importing a subscription, make sure the list contains an entry you can select.
Check the current routing mode. Review Global Routing on Home. If you use Config, check the active file and its policy references, not just a saved configuration.
Establish a manual connection first. Complete any required system VPN authorization, then verify with Connectivity Test and an actual destination. Do not add new automatic connection conditions while testing.
Check rules and DNS one at a time. For one failing destination, check which rule matches. Change one setting at a time and keep before-and-after records; restore the original value if there is no improvement.
Set up On Demand and sync last. Once the basic connection is stable, enable On Demand conditions, widget actions, and iCloud, then verify each one separately.

For initial setup, continue with the Getting Started Guide. To check your purchase and device compatibility, see the App Store Purchase Guide. This page is the feature reference in the Shadowrocket official manual; available options may vary in the app.