[Glossary]
Look up terms for the interface, protocols, rules, and configuration. First distinguish settings and controls from rule keywords, then check how a request is handled. English names match those used in the app and configuration files.
[Interface]
First identify whether a control affects the connection state, overall traffic mode, or a one-time diagnostic. An active connection does not mean every request passes through a proxy server.
Choose how traffic is handled overall: Config, Proxy, or Direct. Config applies policies using the current configuration’s rules; Proxy sends traffic through a proxy; Direct connects without a proxy. When troubleshooting routing, check that this is set to Config first—otherwise, changes to the Rule section may not have the expected effect.
Connect or disconnect when specified network conditions are met. This controls when a connection is established, while the Rule section determines how requests are handled. On Demand does not replace domain-based routing. If the connection returns after you disconnect manually, check the On Demand conditions before investigating other connection settings.
Add details for an existing server by choosing its protocol, then entering the address, port, and matching authentication parameters. TLS, SNI, and transport settings must also match the server; an address and port alone are not enough. After importing a single share link, you can review each field in the corresponding entry.
Check whether a server responds using the selected test method. The reported latency is the result of that specific measurement—not a download speed or a measure of access quality for every website. Results depend on the test target, network conditions, and method. If a test fails, also check whether real requests succeed and which policy they match.
DNS resolves domain names to IP addresses before a connection to the destination is made. A successful lookup does not guarantee a successful connection; for example, a domain may fail to load even when its IP address works. Before changing DNS settings, check the current configuration and network conditions. Cached results may also delay the effect of new settings on existing requests.
[Protocol]
Protocols define how the client and server communicate; they are not ratings of speed or reliability. Use the settings provided for your existing server, and don’t switch protocols at random when troubleshooting a connection.
A proxy protocol whose common required settings include the server address, port, encryption method, and password. The encryption method and password must match the server. A correct address with mismatched credentials will still fail. If the server requires additional transport settings, use the supplied details rather than borrowing fields from another protocol.
A proxy protocol that authenticates with a user ID and other parameters. Check the address, port, UUID, and transport options together. When using WebSocket, Host and Path are also part of the connection settings. If the connection still fails after import, check the server’s TLS and transport settings rather than repeatedly changing the UUID.
A proxy protocol that uses a user ID. The protocol itself is separate from its transport and security layers. The VLESS name alone does not tell you which encryption method is used, and VLESS and VMess do not share every setting. Check the UUID, transport, and security settings as a matching set, without mixing fields from different entries.
A proxy protocol typically used with TLS and password authentication. The password and certificate settings can both affect the connection. SNI specifies the server name during the TLS handshake and may differ from the connection address; use the details provided by the server. For certificate errors, check the name, device time, and certificate status. Don’t use Allow Insecure as a routine fix.
A QUIC-based proxy protocol that depends on suitable UDP network conditions and server support. Authentication, TLS, port, and obfuscation settings must match the server; don’t omit fields based on experience with other protocols. If a connectivity test fails, distinguish incorrect settings from how the current network handles UDP. The protocol name alone does not guarantee a particular speed.
Creates an encrypted tunnel using public and private keys, with configuration for Endpoint, addresses, and allowed address ranges. Private keys are sensitive; never include them in public screenshots, posts, or support requests. A successful tunnel handshake does not mean every destination is reachable. Also check routing ranges, DNS, and server-side forwarding settings.
To understand the difference between a share link and a subscription, see Share link formats explained.
[Rule]
Rules combine matching conditions with the policy to apply when a request matches, and are checked in order. The examples use example.com for illustration only; they do not provide servers or subscriptions.
[Rule]
[Rule]
DOMAIN,example.com,PROXY
DOMAIN-SUFFIX,example.org,PROXY
IP-CIDR,192.168.0.0/16,DIRECT
FINAL,DIRECTThis example routes the specified domain through PROXY, sends local network addresses through DIRECT, and uses FINAL,DIRECT as a fallback for other requests. Before using it, select the configuration containing these rules and set Global Routing to Config.
Matches an exact domain. For example, DOMAIN,example.com,PROXY applies only to that domain; it does not automatically include subdomains. Use it when you want to handle a single hostname. Don’t include a URL path or protocol prefix. If a service uses multiple domains, check which hostname each request actually uses.
Matches a specified domain and its subdomains. For example, DOMAIN-SUFFIX,example.com,PROXY covers example.com and api.example.com. It matches by domain hierarchy, not by searching for an arbitrary string. This is simpler than listing each subdomain, but make sure the entire domain range should use the same policy.
Checks whether a domain contains a specified keyword, for example DOMAIN-KEYWORD,example,PROXY. This can match a broader range than DOMAIN or DOMAIN-SUFFIX, including domains you did not intend to handle. Use it only when keyword-based matching is needed, and check real requests for unintended matches.
Matches according to an IP geolocation database, for example GEOIP,CN,DIRECT. A database classification does not tell you the language of a website or who operates it; CDN use and address changes can also affect results. If an earlier domain rule matches, a later GEOIP rule will not select a different policy for that request.
Matches destinations using IPv4 or IPv6 address ranges. The number after the slash is the network prefix length. For example, IP-CIDR,192.168.0.0/16,DIRECT covers the corresponding private address range. This matches IP addresses, not domain text. For domain requests, also consider the resolved address and whether an earlier rule has already matched.
Matches recognizable User-Agent content, for example USER-AGENT,ExampleApp*,DIRECT. This does not route traffic by application process. Requests from the same app may use different identifiers, and other programs may use the same one. The relevant content may not be visible in encrypted requests, so don’t assume this rule covers all traffic from an app.
Set a fallback policy for requests that match no earlier rules, usually as the last line in the Rule section. FINAL,DIRECT sends the rest directly; FINAL,PROXY sends the rest through a proxy. These produce very different default behavior. When troubleshooting why a domain used a proxy, check both the specific matching rule and FINAL.
A policy keyword in a rule that sends matching requests to a proxy policy; it does not specify a particular protocol. Whether a request succeeds also depends on the selected server, authentication, and connection state. This differs from the Proxy mode in Global Routing: PROXY is the result of an individual rule, while Proxy sets the overall traffic handling mode.
Connects matching requests directly to their destination without forwarding them through a proxy server. DIRECT rules can still apply in Config mode, so an active connection does not mean these requests use a proxy. Direct connections depend on the local network, DNS resolution, and destination service; the policy name does not guarantee availability.
Rejects matching requests to prevent them from connecting. Define the match carefully: an overly broad domain keyword or address range may disrupt normal functionality. If a page is missing content, first check whether its requests match REJECT and then narrow the rule if needed, rather than changing all policies.
For match order, section structure, and more examples, see the Rule reference.
[Config]
Subscriptions are mainly for importing and updating server lists; configuration files organize rules and related settings. Both can be provided as links, but a URL alone does not tell you where to import it.
Import and update a server list using a subscription URL. Get subscriptions from your provider. The list may change when updated, so consider whether your edits to an entry will be overwritten next time. Subscription URLs may contain credentials. Hide sensitive parts of the full URL when asking for help, and never share a link that can be used directly.
A single server connection entry, sometimes called a “node” in Chinese. It contains more than an IP address: the protocol, port, authentication, transport, and TLS settings must work together. One address can have several different configurations. A single share link typically imports one entry; it does not automatically provide the ongoing list updates that a subscription does.
Config can refer to a configuration file or its management controls. A file can contain sections such as General, Rule, Host, and URL Rewrite, each for a different purpose. Having a server list does not mean routing rules are enabled: select the intended configuration and check the Global Routing mode. Keep a copy of the original before editing, then check section headers, commas, and rule order so you can restore it if something goes wrong.
Applies rewrites and other handling to requests whose URLs meet the specified conditions. It is not the same as PROXY or DIRECT in the Rule section. Whether a rule can affect a request depends on its match conditions and whether the relevant content is available to the feature. HTTPS also has visibility and certificate requirements; adding a rewrite does not change every encrypted request.
[Platform]
Shadowrocket is available for iPhone, iPad, Mac, Windows, Android, and Linux. Download sources and installer formats vary by device; see the download guide for the relevant links.
Get Shadowrocket for iPhone / iPad from the App Store. Check the App Store listing for system requirements. Verify the developer, Shadow Launch Technology Limited, the official icon, and app ID 932747118 rather than relying on the name alone. The iPhone / iPad version costs $2.99 as a one-time purchase; the Mac / Windows / Android / Linux versions are free and available from this site’s /dl/ directory.
Choose the right Mac installer for your processor. Check About This Mac for chip or processor information before downloading the corresponding DMG. The Apple Silicon and Intel versions are the same product, not separate apps, so don’t guess based only on the computer’s purchase year. If Mac says it cannot verify the developer on first launch, check the download source, then use Open Anyway under Privacy & Security.
After verifying the installer source from this site, follow your operating system’s prompts to authorize the first launch or installation. On Windows, after confirming the file source, select “More info → Run anyway” in SmartScreen. On Android, allow the app used to download and open the APK to install unknown apps. The steps for a “damaged” warning on Mac and execution permissions for Linux AppImage are different; don’t apply instructions for another platform.
When moving to a new iPhone / iPad or reinstalling, use the original purchasing account to find Shadowrocket in the App Store’s Purchased section. The section name may vary by system version. If the price appears again, check the account and store region before making another purchase. The iPhone / iPad version is a one-time $2.99 purchase; Mac / Windows / Android / Linux versions are free, so just download the appropriate installer again.