Shadowrocket
Features and Common Settings

What it does: Global Routing offers three modes: Config, Proxy, and Direct. They apply rule-based routing, route traffic through a proxy, or connect directly, respectively. It is not a protocol selector and does not fill in server details for you. The server selected in Home is the proxy target for the standard PROXY policy; a specific policy or policy group in your configuration may use a different target.

Where to find it and how to set it: Open Global Routing from Home and choose a mode for your needs. Then return to check the selected server and connection toggle. Config is usually the right choice when using an existing ruleset. To check whether a rule affects a destination, temporarily switch to Proxy and compare. To test direct access over your local network, choose Direct. Restore your original mode after testing so a temporary change does not become your everyday setting.

What to watch for: If a destination works in Proxy but fails in Config, first check which rule matches, where its policy points, and whether the configuration is enabled—not the server itself. If both modes fail, check the server details, DNS, and current network. A failure in Direct does not by itself indicate a proxy configuration problem; the destination may simply be unreachable directly from your current network.

What it does: In Config mode, rules use a destination's domain, address, or other available information to select a policy. DOMAIN matches an exact domain; DOMAIN-SUFFIX matches a domain suffix; DOMAIN-KEYWORD matches a keyword in the domain; IP-CIDR and IP-CIDR6 describe IPv4 and IPv6 address ranges; GEOIP matches by the region associated with an address. USER-AGENT relies on information available in a request and is not a general-purpose substitute for per-app routing.

Where to find it and how to set it: In Config, open the configuration file you plan to use and edit it. Add rules under the [Rule] section. Save the file, make sure it is selected as the active configuration, and set Global Routing to Config. Rules are evaluated from top to bottom. Put specific destinations first, broader matches later, and use FINAL as the fallback.

[Rule]
DOMAIN,example.com,PROXY
DOMAIN-SUFFIX,example.net,PROXY
IP-CIDR,192.168.0.0/16,DIRECT
IP-CIDR6,fc00::/7,DIRECT
FINAL,DIRECT

This tutorial example sends specified domains through PROXY and the listed local address ranges through DIRECT. Other requests are handled by FINAL,DIRECT. The example domains are not subscription or server addresses. PROXY routes through a proxy policy, DIRECT connects directly, and REJECT blocks the request. These names describe actions, not different protocols.

What to watch for: A broad rule placed too early can override more specific rules below it. Rules involving IP addresses also depend on domain resolution results; connection reuse, caching, and app behavior can affect what you see in a test. After making a change, send the request again and check which rule matched—do not rely on the connection icon alone. For the full configuration structure and more examples, see the rule reference.

What they do: Subscribe imports and updates a server list; Add Server lets you enter or import a single server. A subscription is not a rules configuration file, and updating a server list does not replace Config. Fields vary by protocol—including Shadowsocks, VMess, VLESS, Trojan, HTTP, SOCKS5, WireGuard, and Hysteria2. Choose the matching type and use the details you already have; an address and port alone may not be enough.

Where to find them and how to set them up: From Home, open the add menu and choose Add Server. If you have a subscription, choose Subscribe, paste the link from your service provider, and save it. For a single server, check the type, address, port, and authentication fields. Enter additional options such as TLS, SNI, and transport settings as provided. Before using Scan QR Code, make sure the code contains the expected server or subscription details, not an ordinary webpage URL.

After importing, return to Home and check that the expected item appears in the list. Select the server you want to use, then run Connectivity Test. An item appearing in the list only means its contents were recognized; it does not confirm valid authentication or a working connection. When subscription contents change, update it using its corresponding action, then check that your selected item is still available.

What to watch for: Subscription links may contain access credentials. Do not include them in public screenshots, shared configurations, or support posts. Automatic updates may overwrite local changes to subscription-generated items, so manage any manual entries you need to keep separately. If an update fails, first check that the link is complete and still valid, then check whether your current network can reach it. Do not delete all your configurations and hope for the best.

What it does: On Demand uses the system's on-demand connection mechanism to try to connect when configured network conditions are met. It operates at a different level from Global Routing: On Demand controls what triggers a connection, while Global Routing controls how traffic is routed once connected. Enabling On Demand does not choose the right server or fix an expired subscription or incorrect authentication details.

Where to find it and how to set it up: Open On Demand in Settings and review the available conditions and options. Start with automatic triggers turned off. Connect manually and test webpage access first to confirm that the server and Config work. Then enable the conditions you need. If the interface offers conditions for network type or network name, review each one carefully so a setting intended for a specific network does not trigger more broadly.

What to watch for: If the connection comes back after you disconnect manually, check whether the On Demand conditions are still being met before assuming the toggle is broken. To keep the connection off, disable on-demand triggers before using the connection toggle. Network changes, system behavior, and other VPN configurations can affect results. Test separately on Wi-Fi and mobile networks, and verify actual access even when the connection icon appears.

What it does: Data shows traffic recorded by the app and can help indicate whether data was transferred during a connection. Read the figures in the context of the displayed time range and categories. They may not match all network traffic on the device or the usage reported by your service provider. Background traffic, protocol overhead, and differences in measurement periods can all cause discrepancies.

Where to find it and how to use it: Open Data and check the time range or statistic currently shown. To compare a specific action, note the starting value, stop unrelated downloads, visit a clearly identified destination, and then check for a change. If the interface offers a reset option, consider whether you need the history before resetting. Resetting local statistics does not change usage recorded by your service provider.

What to watch for: An increase in traffic only shows that data was transferred. It does not prove a request used PROXY or that a page finished loading. Check request and rule details to verify routing; check your service provider's records to verify usage. If Data keeps increasing while you are not interacting with the app, check background apps, system sync, and ongoing transfers before deciding whether to disconnect.

DNS: domain resolution and configuration inheritance

What it does and where to find it: DNS resolves domain names to addresses. Review the DNS settings in Settings and the [General] section of the active Config. Resolution and proxying are separate steps: a successful connection does not mean the resolved address is what you expected, and successful resolution does not mean the server can reach the destination.

How to configure it and what to watch for: Record the current configuration first. Then check whether the active configuration specifies DNS and whether system resolution or another setting overrides it. When making a change, use only resolution settings you understand and change one source at a time. Do not change DNS, the server, and rules together, or it will be difficult to tell what made a difference. Send a new request to test, keeping system, app, and client caches in mind. Changing DNS is not a universal fix for connection problems.

Test Method: keep test conditions consistent

What it does and where to find it: Test Method in Settings selects how Connectivity Test runs. Different methods can test different stages, such as establishing a connection or receiving a response from the test destination, and are not automatically equivalent. The method, destination, and timeout can all affect the result.

How to configure it and what to watch for: Read the description of each method and choose one that suits your troubleshooting goal. When comparing servers, keep the test method, destination, and network conditions the same. A single timeout does not prove a server is permanently unavailable. Test again, try accessing the destination, and then check authentication, TLS, and reachability. If the test passes but a webpage fails, continue troubleshooting DNS, rules, and the specific app's behavior.

Today Widget: check the status before using shortcuts

What it does and where to find it: The Today Widget provides a shortcut when supported by the system. Check the corresponding item in Settings; whether you can add it also depends on the system's widget support. It can show or switch status, but it does not replace the full server and routing settings in Home.

How to set it up and what to watch for: Find Shadowrocket in the system's available widget gallery, then configure the displayed information using the options provided by the app. Before using a shortcut, check the selected server and Global Routing. Afterward, return to the app or verify access by testing a destination. The system may delay refreshing widget content, so do not rely on an outdated widget status to judge the connection.

iCloud sync: back up before merging

What it does and where to find it: iCloud features save or sync app-supported data across supported Apple devices. Check the corresponding item in Settings. The actual sync scope is described in the interface; do not assume that servers, configurations, history, and all settings are synced.

How to set it up and what to watch for: First make sure the devices use the intended iCloud account, that the system allows the app to use iCloud, and that you have a separate backup of important configurations. Then enable sync or restore data. After moving to a new device, check the item count, active configuration, and selected server individually. Seeing files appear does not mean all settings match. Syncing does not share service-provider authorization; the number of devices allowed to use a server depends on the terms of your existing service.

Diagnostics: collect details to reproduce an issue

What it does and where to find it: Diagnostics helps investigate connection and network problems. Check the corresponding entry in Settings to see which diagnostic tools are available. Diagnostics are useful for identifying where a failure occurs, rather than simply reporting that a connection could not be made.

How to use it and what to watch for: Note the network type, Global Routing mode, selected server, and destination that failed before running diagnostics relevant to the issue. Keep other conditions unchanged when comparing results before and after a change. Before sharing results, remove subscription links, authentication details, personal addresses, and other sensitive information. Include only the necessary error description and sanitized context.

1. Record the original state. Note the active Config, Global Routing mode, server, and setting you plan to change. Back up the configuration file before editing. Store backups containing credentials securely.
2. Establish a basic connection. Select a server, connect manually, and run Connectivity Test. Then visit a known destination. If the basic connection fails, check the server details and current network before changing rules.
3. Check actual routing. In Config mode, test one destination expected to use PROXY and another expected to use DIRECT. Check the policy result for each request. Testing a single destination cannot verify the entire configuration.
4. Enable automatic features last. Once manual operation is stable, enable On Demand or change sync behavior. Repeat the checks after switching networks and confirm that automatic connections trigger under the intended conditions.
5. If it fails, revert one change. Restore the most recent setting you changed and test again. A repeatable sequence is easier to troubleshoot than changing several toggles at once.

For the full steps to import a subscription and connect for the first time, read the setup guide. For more rule examples, see the rule reference. If you encounter a specific error, use the categories in frequently asked questions to investigate. If you have not downloaded the app yet, visit the download guide and choose your platform.