Official Guide · Glossary
Look up terms by interface location and configuration purpose. First distinguish where to connect, which requests use that connection, and when it starts. Then adjust the relevant settings without confusing protocols, routing, and automatic connection conditions.
Interface labels, protocol names, and rule keywords are kept in their original English. Each term has a direct anchor. For the complete workflow, see the setup guide; for how settings work together, see features and settings.
Interface & Toggles
Home manages connection options, Global Routing determines how traffic is handled, and On Demand controls when a connection starts. Check these three layers separately to narrow down an issue instead of repeatedly toggling everything.
Interface & Toggles
The place to manage existing servers and subscriptions, choose a connection, and check its status. A server in the list only means its details are saved; it does not mean the VPN is connected or the destination service is reachable. On first use, check the selected item, then check the connection toggle and the VPN status shown by the system.
Interface & Toggles
Choose an overall routing mode: Config, Proxy, or Direct. Config applies the current configuration rules, Proxy routes eligible connections through the proxy policy, and Direct connects without a proxy. This setting does not provide a server and is not the connection toggle. If rules do not seem to apply, first check whether Config is selected.
Interface & Toggles
Starts a VPN connection when specified network conditions are met, useful for automatic connections under defined circumstances. On Demand controls when to connect; routing rules control how requests are handled after connecting. If the VPN reconnects after you disconnect manually, check the On Demand conditions. You can temporarily turn this feature off when testing a manual connection to reduce variables.
Interface & Toggles
The entry point for manually adding server details you already have. Enter the address, port, and authentication parameters required by the actual protocol. Required fields vary by protocol; do not reuse a password or user identifier from one protocol in another. After saving, check Type, address, port, TLS, and other details before testing the connection.
Interface & Toggles
Tests connectivity for a list item. Results depend on the target, test method, and current network. Test duration is usually shown in milliseconds, but it does not measure download speed or sustained transfer performance. Use the same method when comparing results. After a single failure, also check actual access and connection logs.
Interface & Toggles
DNS resolves domain names to IP addresses and is an important part of accessing services by domain. A successful DNS query only means an address was returned; it does not guarantee that the connection will succeed. The result can also affect IP-based rule matching. When troubleshooting, check resolution, rule matches, and connection exit separately. Do not change DNS solely because a webpage will not load.
Proxy Protocols
A protocol defines how a client communicates with a server; its name does not guarantee a particular speed or quality. The notes below explain technical terms only. Use the actual parameters for the server you already have, and do not infer authentication or transport settings from the protocol name.
Proxy Protocols
A proxy protocol with common parameters such as server address, port, encryption method, and password. The client and server must use the same encryption method; checking only the password is not enough to ensure a successful connection. If your existing configuration includes other parameters, retain them and compare each one with the server details.
Proxy Protocols
A proxy protocol that authenticates using an identifier and other parameters; UUID is a common identity field. Transport method, path, Host, TLS, and other settings must match the server. A correct UUID does not mean all parameters are correct. If a connection fails after import, check the transport settings rather than repeatedly changing the identifier.
Proxy Protocols
A proxy protocol that authenticates using a user identifier. The protocol name alone does not mean transport encryption is enabled; the connection also depends on the transport method and security settings such as TLS. Changing the Type of a VMess entry to VLESS is not a valid conversion. Use the corresponding parameters supplied for the server.
Proxy Protocols
A proxy protocol commonly used with TLS. The password is used for authentication, while the server name and certificate validation affect the TLS handshake. The connection address may differ from the name used to validate the certificate; enter each according to your existing configuration. If you see a certificate error, check the name, certificate validity, and device time instead of disabling certificate validation.
Proxy Protocols
Two general-purpose proxy protocols that may use an address, port, and username and password, but work differently. Do not assume a connection is encrypted based on the protocol name alone; confirm TLS use and UDP support separately. Select the Type that matches the actual service, and do not enter an ordinary website address as a proxy endpoint.
Proxy Protocols
A key-pair-based tunneling protocol. Configuration includes a local private key, peer public key, endpoint address, and address ranges. A private key is sensitive information and should be kept only in an environment you control. Remove it before sharing troubleshooting screenshots. After importing, check the address ranges and routing; a complete endpoint alone is not enough.
Proxy Protocols
A QUIC-based proxy protocol that relies on UDP. Common checks include the port, authentication details, TLS server name, and any obfuscation parameters. A working TCP connection does not prove that this protocol is available. If performance changes across networks, check UDP reachability. Set bandwidth-related parameters according to your actual setup.
Read the protocol overview →Rule Keywords
Rules are usually checked from top to bottom, and the first match determines how a request is handled. First decide whether to match a domain or an IP address, then choose a keyword. After making changes, check the actual match in Config mode under Global Routing.
Rule Keywords
Matches an exact domain. For example, DOMAIN,example.com,PROXY specifies that domain only and does not automatically include its subdomains. Do not include https://, a port, or a webpage path in the domain field. If a request uses a different subdomain, add a rule for it or use an appropriate suffix match.
Rule Keywords
Matches the specified domain and its subdomains. For example, DOMAIN-SUFFIX,example.com,PROXY can match example.com and www.example.com. Do not add *. or enter a full URL. This matches domain boundaries, not an arbitrary string anywhere in the text.
Rule Keywords
Matches a specified string appearing in a domain, for example, DOMAIN-KEYWORD,example,PROXY. Its scope is generally broader than an exact-domain or suffix match and may catch domains you did not intend to route this way. For more precise control, consider DOMAIN or DOMAIN-SUFFIX, and check the rule order for an earlier match.
Rule Keywords
Matches an IPv4 address range expressed as a network address and prefix length, for example, IP-CIDR,192.168.0.0/16,DIRECT. The number after the slash is the network prefix length, not a port. The rule applies to the destination IP. If a request starts with a domain name, also consider the resolved address and the current DNS behavior.
Rule Keywords
Matches an IPv6 address range, for example, IP-CIDR6,2001:db8::/32,DIRECT; the address is shown for syntax only. An IPv4 subnet rule cannot replace an IPv6 rule, and the same domain may resolve to both address types. If an IP rule does not match, first confirm which address type the connection actually uses.
Rule Keywords
Matches a target address using location records in an IP geolocation database, for example, GEOIP,CN,DIRECT. It does not use webpage language, domain suffix, or the user's location to decide. Database records may also differ from the actual deployment location of a service. For more precise control of a domain, place a specific domain rule above it.
Rule Keywords
A fallback used when no earlier rule matches, for example, FINAL,PROXY. It is usually placed at the end of the rule list; placed too early, it prevents later rules from being checked. If traffic is routed unexpectedly, check both the specific rules above it and the final policy instead of changing FINAL alone.
Rule Keywords
The action taken when a rule matches: PROXY uses the proxy policy, DIRECT connects without a proxy, and REJECT blocks the connection. These uppercase rule keywords and Proxy and Direct in Global Routing operate at different levels; they are not the same toggle. Put each policy where the rule requires it. If REJECT blocks a connection, repeatedly testing the server usually will not help.
Subscriptions & Configs
Subscriptions mainly manage connection options, while configuration files mainly describe how traffic is handled. Do not distinguish them by the appearance of a link alone. Before importing, confirm what the content is for and keep the original details safe. Do not include authentication information from a subscription URL in public screenshots.
Subscriptions & Configs
A way to retrieve and maintain a server list using a subscription URL you already have from your own service provider. It is not a single server, and it does not necessarily include complete routing rules or DNS settings. After importing, check that the returned list and groups are as expected. Do not enter a webpage information URL as a subscription URL.
Subscriptions & Configs
A set of connection endpoint details, typically including protocol, address, port, and authentication parameters; often called a node. The display name is just a label for identification and does not prove the server's location, speed, or availability. If you have multiple entries, organize them by source and use a consistent test method to check availability rather than choosing by name alone.
Subscriptions & Configs
In configuration management, Config is the entry point for configuration files, which can contain rules, DNS, and other handling settings. In Global Routing, it is the mode that applies configuration rules. Importing a configuration file does not mean it is selected or that the routing mode has changed to Config. Keep a copy of the original before editing, then check which file is active and how requests are actually handled.
See the Config settings guide →Subscriptions & Configs
The process of requesting an existing subscription URL again to refresh server details. This is different from updating Shadowrocket through the App Store. An update may change the list or overwrite source fields, so local manual edits may not persist. If an update fails, check the URL, its validity, and network connectivity, then review the returned error. Repeatedly adding the same subscription may create duplicate entries.
See subscription troubleshooting FAQs →Subscriptions & Configs
A configuration feature that rewrites or redirects request URLs according to conditions. It addresses a different problem from routing rules that choose between direct and proxy connections. An overly broad match can affect requests that were working correctly, so understand the rule before enabling it. Processing HTTPS content also requires the relevant decryption conditions; adding a rewrite rule alone does not enable it automatically.
App Store & Account
App purchase records, server details, and configuration files are separate. After restoring the app, check that your connection details are still available. For store region, compatibility, and purchase eligibility, see the installation guide.
App Store & Account
The only place to purchase and get Shadowrocket. It is primarily used on iPhone and iPad; check the compatibility section of the same store listing for details about Mac, Apple TV, and Apple Vision. System requirements, compatibility, and purchase availability are as stated on the App Store page. The storefront linked from a product page may differ from your account's current store region, so check the information shown before purchasing.
See the App Store guide →App Store & Account
A payment model where the client is purchased once. The US storefront price is about US$2.99; other storefronts display local currency, and the actual price is shown on the store page. A one-time app purchase is not a service plan and does not include a server or subscription. You will need your own server details to connect.
See pricing and purchase details →App Store & Account
Check the product using the official icon, developer name Shadow Launch Technology Limited, and app ID 932747118; do not rely on the name “Shadowrocket” alone. Confirm the app ID from id932747118 in the product page URL, and check that the icon matches the official icon used on this site. Shadowrocket is a closed-source commercial app; refer to the App Store for purchase and update information.
App Store & Account
The App Store entry for finding purchases made with the original account. When switching devices or reinstalling, check the purchase history using the original purchasing account. Restoring the app and restoring its in-app configuration are separate steps; getting the app again does not mean server details have been synced. Purchase eligibility for iPhone and iPad and Family Sharing conditions are as stated on the App Store page.
See how to switch devices or reinstall →