OFFICIAL MANUAL / GLOSSARY

Shadowrocket Glossary

Look up terms by interface location and configuration purpose. First distinguish the connection toggle, routing mode and rule policy, then check the parameters against server details you already have.

31 glossary entries
Interface terms remain in English
Rule examples use example.com

01 / INTERFACE

Interface & Toggles

First identify the screen you’re working in. Whether the connection is on, which route a request takes and whether a connection starts automatically under certain conditions are three separate questions.

Home: View server entries on Home. Select a server you already have, then operate the connection toggle. Turning it on means the client starts establishing or maintaining a connection; it does not guarantee that every destination is reachable. Before connecting for the first time, check the entry’s parameters, then test the connection and access.

Global Routing: Open Global Routing from Home and choose Config, Proxy or Direct to set how traffic is handled overall. This affects how requests enter the rules or proxy path; it does not change the server address or password. When investigating different results, note the current mode so you don’t mistake a routing change for a change in server details.

Config / Proxy / Direct: In Global Routing, Config uses the current configuration, Proxy routes through the selected proxy, and Direct connects to the destination directly. Config applies the rules in the active configuration. Before choosing Config, confirm the required configuration is enabled; Proxy still requires valid server details.

On Demand: Configure On Demand in the relevant settings to trigger connection behavior under specified network conditions. It controls when to connect, not which policy applies to a domain. If the connection turns back on after being switched off, check the On Demand conditions before investigating a connection fault.

Data: View client-recorded traffic statistics in Data to observe activity after connecting. Interpret the figures in light of the page’s stated scope, start time and reset behavior. A service provider may calculate usage differently, so don’t treat these figures as your account’s remaining allowance.

Settings: Find settings for client behavior in Settings. Names and available options depend on the current app interface. Record the original value before changing it, adjust one relevant option at a time, and retest on the same network. Similar names do not mean a global setting and a per-server parameter are the same thing.

02 / PROTOCOLS

Protocols

In Add Server, choose the protocol that matches the parameters you already have. The protocol determines what each field means; don’t copy only Address and Port and then choose a type at random.

Shadowsocks: In Add Server, choose Shadowsocks and enter the address, port, encryption method and password from your existing details. Both sides must use compatible parameters: even a correct password won’t help if the encryption method differs. Shadowsocks is a protocol name, not the name of a specific server or configuration file.

VMess: In a VMess entry, check the server address, port, user ID and transport fields. The user ID and transport settings must match the server. If TLS is enabled, also check the relevant name and certificate details. A successful import only means the entry was recognized; it does not replace a connection test.

VLESS: In a VLESS entry, enter the user ID and transport parameters from your existing details. Don’t reuse authentication fields from another protocol. VLESS itself does not provide complete transport encryption; connection security also depends on the selected transport, TLS and other settings. If the handshake fails, check authentication and transport details separately.

Trojan: In a Trojan entry, enter the address, port and password, then check the TLS parameters. Trojan uses TLS for transport; a mismatch between SNI and the certificate name may cause the handshake to fail. If you see a certificate error, first check the name, device time and certificate status rather than bypassing verification.

Hysteria2: Choose Hysteria2 as the protocol type, then enter the authentication and TLS parameters you already have. It is based on QUIC and relies on UDP, so being able to open regular web pages on the current network does not guarantee this connection path will work. Check the protocol and parameters first, then compare results across networks.

WireGuard: In a WireGuard configuration, check the local private key, Peer public key, endpoint and address ranges. The private key and peer public key serve different purposes and must not be swapped. Allowed IPs is not a list of domain names. A private key is sensitive: remove it from troubleshooting materials and never include it in public screenshots or notes.

HTTP / SOCKS5: In Add Server, select HTTP or SOCKS5 to match the actual type of service you already have, then check the authentication method. These are different proxy protocols; encryption in transit and UDP support depend on the specific configuration and service. The same address and port do not make the two types interchangeable.

03 / RULE KEYWORDS

Rule Keywords

Read the match condition first, then the action policy. These snippets show syntax only; PROXY must refer to a policy available in the active configuration.

Rules: Check matching conditions and policies in the rules section of the active configuration. Traffic is routed by those rules only when Global Routing is set to Config. Rules are usually checked from top to bottom, so a broad condition near the top may take precedence over later entries. After editing, save the changes and confirm the updated configuration is in use, then test against the same destination.

DOMAIN: Use DOMAIN,example.com,PROXY in a rule to match the exact domain and send it to the specified policy. It matches a domain, not a URL path, and does not automatically include every subdomain. To include subdomains, check whether DOMAIN-SUFFIX better fits the intended scope.

DOMAIN-SUFFIX: Use DOMAIN-SUFFIX,example.com,PROXY in a rule to match example.com and its subdomains. It checks the domain suffix boundary; it does not search an entire URL for an arbitrary string. Confirm the intended domain scope before configuring it, and don’t include a path or protocol prefix in the match value.

DOMAIN-KEYWORD: Use DOMAIN-KEYWORD with a specified string to match requests whose domain contains that string. This is broader than an exact-domain match and may catch similar-looking domains that aren’t the intended site. For a specific domain, prefer a more precise condition.

GEOIP: Use GEOIP,CN,DIRECT in a rule to select a policy based on the IP geolocation database record. It checks the destination IP, not the page language or the visitor’s location. Database records may not reflect where a service is actually hosted; if results look wrong, check the resolved address and matched rule.

IP-CIDR / IP-CIDR6: Use IP-CIDR to match IPv4 address ranges and IP-CIDR6 to match IPv6 ranges. In CIDR notation, the number after the slash is the network prefix length, not a port. Confirm the destination range before adding a rule: a prefix that is too broad may change the route for many unrelated requests.

FINAL: Check the end of the rule list for FINAL. For example, FINAL,PROXY applies the corresponding policy when no earlier rule matches. It is a fallback action, not a test of all servers or an automatic way to select the fastest one. If many requests fall through to FINAL, first check whether the preceding rules cover the intended destinations.

PROXY / DIRECT / REJECT: Read the policy markers at the end of the rules: DIRECT connects directly, REJECT blocks the request, and PROXY should be checked against its references in the active configuration. PROXY is not a server address or a fixed set of connection parameters. The Proxy routing mode and the PROXY rule marker belong to different levels; similar spelling does not make them the same setting.

04 / SUBSCRIPTION & CONFIG

Subscriptions & Configuration

The steps below assume you already have your own subscription or server details. This site provides the official guide; it does not provide, sell or recommend nodes or subscription services.

Server / Add Server: In Add Server, choose a protocol, then enter Address, Port and the authentication details that protocol requires. A server entry is a set of connection details, not a rule configuration. A domain and port alone are usually not enough; ask your own service provider for any missing fields.

Config: Manage and enable configuration files on the Config page. A file may contain rules, DNS settings and other options. Config in Global Routing instead means handling traffic according to the active configuration; the two uses of Config have different purposes. Before switching files, note which one was active and confirm the new file’s policy references match the server you intend to use.

Scan QR Code: Use Scan QR Code to read connection details from a QR code you already have. If prompted, allow camera access. A QR code can contain a single server link or a subscription URL; check each imported item. QR codes containing authentication details are sensitive too, so don’t share them publicly.

One-time purchase of the client: Buy Shadowrocket on the App Store to obtain a client license; a one-time client purchase is not a service plan. The purchase does not create a server, subscription URL or authentication details. You still need to import a configuration you already have. Shadowrocket is closed-source commercial software. Check the App Store listing for system requirements, compatibility and general purchase terms. Before buying, see the how to verify the official app guide.

05 / DNS & NETWORK

DNS & Networking

Check domain resolution, protocol handshakes and destination access separately. A single test only reflects the conditions and test method at that moment.

DNS: Check the resolution method in the DNS settings for the active configuration. DNS translates domain names into IP addresses. A domain that fails to resolve and a proxy server that cannot connect are problems at different stages; investigate them separately. Resolution results may also affect IP-based rules, so after changing DNS, check for changes in both resolution and rule matches.

DNS over HTTPS: Where supported, enter a DNS over HTTPS service address in DNS settings to send resolution queries over HTTPS. This protects the query in transit; it does not mean all app data follows the same proxy route. The resolver must still be reachable. If requests time out, check the service address, connection path and relevant rules instead of repeatedly changing multiple settings.

Connectivity Test / Latency: Run Connectivity Test to see the response under the current test method. A latency figure is not download speed, and a successful test does not prove that every domain or connection method will work. For a fair comparison, keep the network, test method and destination the same, then test the service you actually need to access.

TLS / SNI: Check SNI in the server’s TLS fields. SNI identifies the target server name during the handshake. TLS protects data in transit and verifies the peer’s identity using a certificate. The connection Address and certificate name may differ, but both must match the server’s actual setup. If certificate verification fails, first check the name, validity period and device time; don’t treat skipping verification as a routine fix.

MTU: Check MTU in the relevant protocol settings. It is the maximum size of a single packet transmitted over a network interface. An unsuitable value can cause fragmentation or stall some requests on certain paths, but MTU is not necessarily the reason a page fails to load. Record the original value, rule out authentication, DNS and routing issues, then change one value at a time and retest.

For step-by-step instructions, see the complete user guide. To verify the purchase source, see how to verify Shadowrocket on the App Store.