Official Manual / Terms & Definitions
Browse interface labels, protocol names, and rule keywords by category. Each entry keeps the original English term, explains what it means, and lists what to check when using it. Follow the links to jump to the relevant explanation.
This page covers Shadowrocket on iPhone and iPad. Check the App Store page for system requirements. For step-by-step instructions, see the Getting Started guide; for configuration context, see the User Manual.
01 / Interface & Controls
Confirm which screen you’re on before checking a specific setting. The connection toggle, test results, and traffic readings answer different questions and are not interchangeable.
Home screenHome shows the server list, lets you choose a default server, and provides the connection toggle. After importing, tap the dot beside the server you want, then connect. An enabled toggle only means the connection process has started; verify the result with tests and actual access.
Add ServerAdd Server is where you enter the details for a single server. The selected Type determines which fields are required. Use your existing service details for Address, Port, and authentication; don’t guess the protocol from a name. After saving, return to Home and select the entry. Saving does not confirm that the remote server is reachable.
SettingsSettings groups app behavior and related options. Different options can affect testing, connections, or data management. Note the original value before changing anything, and adjust only one setting directly related to the issue at a time. If you change several options at once, it’s hard to tell which one made a difference.
DataData shows recorded upload, download, and total traffic. Before interpreting the numbers, check the current view, reporting period, and last reset time. The app’s measurements may use a different basis from your carrier’s billing, so don’t assume the figures should match. If usage rises unexpectedly, check connection records for the relevant requests rather than relying only on the total.
Connectivity TestConnectivity Test checks whether a test destination is reachable under the current connection conditions. Select a default server and connect before running the test, so you don’t mistake a result from an unconnected state for a proxy result. A successful test applies only to that destination and network at that moment. If a particular site still won’t load, check its rules, DNS, and the destination service.
DNSDNS resolves domain names to addresses that can be reached, making it one step in accessing a website. A resolution failure is different from a failed connection to a proxy server, so check them separately. After changing DNS settings, cached results or existing connections may persist temporarily. Retry under clearly defined test conditions instead of stacking multiple changes.
02 / Routing Modes
The three commonly used modes are Config, Proxy, and Direct. Before editing rules, check Global Routing to avoid repeatedly changing a config that isn’t being used.
Global RoutingGlobal Routing determines the active routing mode: Config, Proxy, or Direct. It is separate from server selection: the mode determines how connections are handled, while the selected server provides the remote proxy endpoint. If rules don’t seem to work, first check whether Config is selected, then inspect the active config.
Config modeWhen Config appears in Global Routing, connections are handled according to the rules in the active config. The config management screen is also called Config, but opening it does not switch the routing mode. To route a specific site through a proxy, confirm both that the right config is active and that Config is selected in Global Routing.
Proxy modeProxy mode forwards connections handled by the app through a proxy. It can help you compare results with Config mode, but it does not confirm that the selected server has authenticated successfully or that every destination is reachable. If a site works in Proxy mode but fails in Config, check which rule matches its domain and which policy that rule uses.
Direct modeDirect mode does not forward the relevant connections through a proxy server. Use it to check access over the local network. Direct is a Global Routing option; the uppercase rule action DIRECT is a separate term. After switching to Direct, a server may remain selected in the list, but that does not mean traffic is going through it.
On DemandOn Demand triggers system VPN behavior based on configured conditions. It does not choose a new server for every request. Before enabling it, confirm that a manual connection works, then check each trigger condition. It cannot fix an expired subscription, incorrect authentication details, or an unreachable remote server. If connections start unexpectedly, also check the system VPN status.
LatencyLatency is usually shown in milliseconds and represents response round-trip time under a particular test method. Check how the result was measured before comparing numbers. A lower result does not mean higher bandwidth or more stable sustained transfers. When comparing servers you already have, test on the same network and at roughly the same time, then check actual page loads rather than relying on a single number in the list.
03 / Protocols
A protocol name identifies the connection technology, not whether a service is available. When adding a server, use the details you already have. Authentication, transport, and TLS settings are separate and should not be swapped or guessed.
ShadowsocksShadowsocks is an encrypted proxy protocol. Common required details include the server address, port, encryption method, and password. The encryption method must match the server; don’t replace it just because another option sounds newer. If the connection fails after import, first compare the fields and any additional transport requirements with the original details, then check the remote server and network.
VMessVMess is a proxy protocol that authenticates with parameters such as a user ID. The connection also depends on the accompanying transport method. The user ID, transport path, hostname, and TLS settings are separate fields; an address and port alone are not enough. If authentication or the handshake fails, check that the device clock is accurate, then compare each field with the service details.
VLESSVLESS is a proxy protocol; its name does not include the full transport and security configuration. Enter the user ID, transport method, and related security parameters using the details you already have. Don’t copy fields blindly from another protocol entry: even with the same address and port, authentication and handshake requirements may differ.
TrojanTrojan is a proxy protocol commonly used with TLS. Both password authentication and the TLS handshake must be configured correctly. The connection address may differ from the server name used for TLS validation, so enter them separately according to your service details. If you see a certificate error, check the name, device clock, and server certificate. Don’t treat disabling validation as the default fix.
Hysteria2Hysteria2 is a QUIC-based proxy protocol that uses UDP. Performance depends on packet loss, network restrictions, and server settings. If the current network cannot carry UDP reliably, the connection may fail before it is established; changing domain rules alone won’t fix that. Match authentication, TLS, and related parameters to your service details. The protocol name does not guarantee a particular speed.
WireGuardWireGuard is a key-based VPN protocol. Its configuration includes a private key, peer public key, interface address, endpoint, and routing range. Public and private keys have different roles and cannot be substituted. Never share a private key in screenshots or support requests. Check addresses and routes together when troubleshooting; an endpoint responding does not confirm that the full configuration is correct.
HTTP / SOCKS5HTTP and SOCKS5 are two proxy protocol types. The server must support the selected type and its authentication method. The protocol name alone does not tell you whether traffic between the client and proxy is encrypted; check the transport settings separately. For UDP traffic, confirm that both the protocol and server support it. A successful TCP connection is not enough to establish that.
04 / Rule Keywords
Rules are generally checked from top to bottom, and the first matching rule determines what happens. The domains and addresses below are examples for explanation only; they are not working servers and should not be copied into an existing config as replacements.
DOMAIN exact domain matchDOMAIN matches an exact domain. For example, DOMAIN,example.com,PROXY routes that domain through a proxy. It does not automatically include other subdomains such as www.example.com. Use it for an exception that applies to one host. To include a domain and its subdomains, see DOMAIN-SUFFIX.
DOMAIN-SUFFIX domain suffix matchDOMAIN-SUFFIX matches a domain suffix, typically including the specified domain and its subdomains. For example, DOMAIN-SUFFIX,example.com,PROXY can handle requests within that domain scope, but it won’t cover every other domain referenced by a webpage. If some page resources still fail, check the hostnames those resources actually use.
DOMAIN-KEYWORD domain keyword matchDOMAIN-KEYWORD checks whether a domain contains a specified keyword, for example DOMAIN-KEYWORD,example,PROXY. It usually matches more broadly than an exact-domain or suffix rule and may catch domains you did not intend to include. If the target is known, prefer a more specific condition and place specific exceptions before broader rules.
GEOIP IP geolocation matchGEOIP matches an address using an IP geolocation database, not the website’s language, registration location, or domain suffix. A website may use addresses in multiple regions, and database classifications may not match expectations. If a domain rule and a GEOIP rule produce different results, check rule order first, then verify the resolved address and database information.
IP-CIDR / IP-CIDR6 address range matchIP-CIDR is for IPv4 ranges; IP-CIDR6 is for IPv6 ranges. The prefix length after the slash determines the range covered. For example, IP-CIDR,192.168.0.0/16,DIRECT sends that IPv4 range directly. On a dual-stack network, an IPv4 rule does not also cover IPv6. Before making changes, confirm which address type the request actually uses.
FINAL fallback ruleFINAL handles connections that did not match any earlier rule and belongs at the end of the rule list. FINAL,DIRECT sends everything else direct; FINAL,PROXY sends everything else through a proxy. These create different default behavior. A fallback rule cannot override an earlier match, so don’t troubleshoot by changing only the last line.
PROXY / DIRECT / REJECT rule actionsPROXY means forward through a proxy, DIRECT means connect directly, and REJECT means deny the connection. These are rule outcomes, not match conditions. A request matched by REJECT will not start working just because you select a different server. Rules can also refer to named policy groups; check the group definition to confirm the final route instead of relying on the policy name alone.
05 / Subscriptions & Configs
The steps below assume you already have your own subscription or server details. This is the official Shadowrocket website and manual; it does not provide, sell, or recommend nodes, subscriptions, or connection services.
Subscribe importSubscribe imports a server list from a subscription URL you already have. Your own service provider supplies the URL, which may contain private access credentials; don’t share the full link when asking for help. Updating a subscription fetches its contents again, so an update failure, an empty list, and a server that won’t connect are separate issues to troubleshoot.
Server entryA Server entry stores an address, port, protocol, and authentication details. What people commonly call a node is usually this kind of connection entry. Names and region labels are only for identification; they don’t prove that a remote server is available or indicate its actual performance. A successful import only means the details were read. Before connecting, select the entry as the default server and check that its details are valid for the current network.
Config fileA Config file organizes rules, DNS, and related settings. It is different from a subscription that only lists server details. After importing a file, check which one is active, then select Config in Global Routing to apply its rules. Before replacing or updating a config, keep a copy of your own changes; don’t assume local exception rules will be preserved automatically.
iCloud synciCloud sync transfers app-supported data through your Apple account in the cloud; the exact scope depends on the options in the app. This is separate from App Store purchase records, and restoring a purchase does not guarantee that server details have been restored. Before changing devices, confirm sync status and keep a backup of important configs. If the two devices have conflicting data, preserve both copies before choosing which one to use.
If the terms are clear but you still can’t connect, look up the issue by symptom in the FAQ. Avoid changing the server, DNS, and the entire rule set at once, so you can compare results under consistent test conditions.