Which Protocols Does Shadowrocket Support? A Quick Guide to Shadowsocks, VMess, VLESS, Trojan, and Hysteria2

Quick guide: Protocol, transport, and routing are different settings

Shadowsocks, VMess, VLESS, Trojan, HTTP, SOCKS5, WireGuard, and Hysteria2 each define how a client communicates with a server. The address and port are just the connection endpoint; the password, UUID, keys, and transport settings together determine whether the connection can be established. Display names in the list can be customized, so a name that mentions a protocol does not mean the Type is set to that protocol.

The transport layer determines how data is delivered, such as over TCP, WebSocket, or QUIC. TLS provides encryption and identity verification for the relevant connection layer. Global Routing determines how a particular request is handled. Changing Global Routing will not fix an incorrect password or make a network that blocks UDP carry QUIC.

Identify and check an existing configuration in Add Server

Adding a server manually is useful for checking a single entry; an existing subscription keeps its source and can be updated in one place. In either case, verify the original settings first. Subscriptions may contain access credentials, so do not share full URLs, QR codes, passwords, or private keys when troubleshooting.

1. Open the add-server screen

   Go to Home → tap “+” in the upper-right corner to open Add Server. In Type, select the protocol that matches your existing configuration. Do not guess based on the display name.

2. Check the endpoint

   Use your existing configuration to enter the address and port. In the address field, enter only the hostname or IP required by that field. Do not paste an entire share link as the hostname, and do not assume 443 is the default port for every protocol.

3. Check authentication

   For Shadowsocks, verify the encryption method and password. For VMess and VLESS, verify the UUID. For Trojan and Hysteria2, check the relevant authentication details. For WireGuard, verify the local private key and peer public key. These credentials are not interchangeable.

4. Check the transport

   Check TLS, the server name, and the underlying transport against the existing configuration. If it uses WebSocket, also verify the path and Host. A resolvable address does not mean these fields can be skipped.

5. Save and test

   After saving, return to Home, select the entry, and run Connectivity Test. Then test access to a specific destination. If you use an existing subscription, go to Home → “+” → select Subscribe under Type and enter your own subscription URL. After updating, check the entries again to make sure the subscription has not overwritten local changes.

Shadowsocks, VMess, and VLESS: Distinguish authentication from encryption

These three protocols often appear in existing subscriptions, but their settings differ. Shadowsocks relies on both sides using the same encryption method and password. VMess uses parameters such as a UUID for authentication and has its own data-protection mechanism. VLESS does not encrypt content by itself; having a UUID does not mean the connection is protected by TLS.

For example, if the existing configuration requires the WebSocket path /gateway, entering / points to a different endpoint. The required Host may also differ from the connection address. Resolving the domain and reaching the TCP port only confirms that the initial connection steps work; it does not verify the authentication or path.

• The Shadowsocks encryption method must match exactly. Do not assume similarly named methods are the same algorithm.
• VMess authentication involves time checks. If authentication fails, also check that the date and time on your Apple device are correct.
• Check the VLESS UUID and security-layer settings together. Disabling the security layer is not a troubleshooting fix.

Trojan and Hysteria2: Both use a security layer, but have different transport requirements

A typical Trojan configuration uses TLS for authentication and proxy traffic. In addition to the password, check the certificate, server name, and actual connection address. The connection IP may differ from the domain in the certificate. If the existing configuration specifies a server name, keep it rather than replacing it with the address field value.

Hysteria2 is based on QUIC, uses UDP at the transport layer, and incorporates TLS. It is not interchangeable with other Hysteria protocol generations just because the names are similar. If a network restricts UDP, a TCP service can work while Hysteria2 times out. In that case, check the network conditions and port protocol first instead of repeatedly changing the authentication string.

• Trojan: Check the address, port, password, and TLS server name. If you see a certificate error, first check the device time, server name, and certificate validity.
• Hysteria2: Check the authentication details, TLS settings, and any obfuscation or bandwidth parameters specified by the existing configuration. Only enter these if they are included in the configuration; do not add them yourself.
• Check for both: If the source configuration uses port 443, confirm whether TCP, UDP, or both must be allowed. The same port number does not mean the same network path.
• Performance comparisons: Compare under the same network, destination, and test window. A protocol name does not tell you its throughput, and a latency test is not a substitute for sustained transfer testing.

HTTP, SOCKS5, and WireGuard: Different purposes and credentials

HTTP and SOCKS5 are commonly used with existing proxy endpoints. An HTTP proxy can use CONNECT to create a tunnel to a destination, but that does not automatically mean the client-to-proxy connection uses TLS. If the destination uses HTTPS, its TLS connection and encryption of the proxy connection are separate matters.

SOCKS5 supports different commands and authentication methods, but the protocol name alone does not guarantee that the server and network support UDP. A standard HTTP proxy should not be treated as a general-purpose UDP tunnel either. If your use case depends on UDP, check the specific configuration and what it supports in practice.

WireGuard is a key-based tunneling protocol, not a standard proxy with a username-and-password setup. The peer public key is not the local private key, and Endpoint is the peer's network address, not the tunnel address assigned to your device. Mixing up these addresses can leave the endpoint reachable while communication through the tunnel still fails. Keep your private key on your own device and in trusted configurations; never include it in a public screenshot.

Once the protocol is correct, use Global Routing to check for rule issues

Use Home to select a connection and server, Config to manage configuration files, and Settings for app preferences. Proxy, Direct, Config, and Scene under Global Routing are routing modes, not protocols. During troubleshooting, note the original setting before changing it temporarily. Scene behavior depends on the configured scenes, so also check which scene is currently active.

For example, DOMAIN-SUFFIX,example.com,PROXY selects a policy based on a domain suffix; IP-CIDR,192.0.2.0/24,DIRECT matches an address range; GEOIP relies on IP geolocation data; and FINAL handles traffic that matches no other rule. These keywords determine where traffic goes, not which protocol it uses. The examples illustrate syntax and match criteria; they are not complete rules to substitute directly into an existing configuration.

FAQ: Importing, testing, and using a configuration

Choose in this order: use a protocol explicitly provided by your existing service, make sure all required settings are present, confirm the network meets its transport requirements, and then assess performance under consistent conditions. A list of supported protocols cannot replace the server configuration or guarantee that one protocol will be faster on every network.