Shadowrocket
Features and Settings

01Global Routing: Choose How Traffic Is Handled

Global Routing determines how connections handled by Shadowrocket are processed; it is not a server protocol setting. Open Global Routing on Home to check the selected mode. Use Config for rule-based routing in everyday use, Proxy to temporarily check whether the proxy path works, or Direct to compare results over a direct connection. Changing modes does not re-import a server or fix incorrect server settings.

Before changing modes, note the current selection. Choose a mode for the test, visit a specific destination, record the result, then restore your usual setting. If Proxy works but Config does not, check the configuration and rules before changing protocols. If the interface also shows Scene, review that scene's configuration separately; this table covers only the three basic modes: Config, Proxy, and Direct.

02Rule: Rule Types and Policies

Rule-based routing compares connection details with rules in order, then applies the matching policy. Open Config, confirm which configuration is active, then review or edit its Rule. Interpret results according to configuration rules only when Global Routing is set to Config. Before troubleshooting, keep a copy of the current configuration so you can undo changes if editing several rules causes unexpected results.

DOMAIN matches an exact domain, DOMAIN-SUFFIX matches a domain suffix, and DOMAIN-KEYWORD matches a keyword in the domain. IP-CIDR and IP-CIDR6 specify IPv4 and IPv6 address ranges, respectively; GEOIP matches by IP address geolocation. Choose a rule type based on whether you have a domain or an IP address. Do not use a URL path or query parameters as a DOMAIN value.

PROXY sends traffic to the proxy policy, DIRECT connects directly, and REJECT blocks the connection. Colors are only visual cues; use the English policy names to identify each action. Rules are evaluated from top to bottom, and matching stops at the first match. Put specific exceptions before broader rules, and place FINAL at the end as the fallback policy for connections that match no earlier rule.

The example.com shown above is for explaining syntax only, not a service endpoint. Keyword rules can match more domains than expected, so check the actual match records after making changes. For detailed examples of rule order and policies, see Custom Rules and the FINAL Fallback.

03Subscribe and Server Management

Server entries store the protocol and settings needed to connect. Subscribe manages a set of entries from a subscription you already have. Rules and server lists serve different purposes: rules determine how traffic is routed, while the server list determines which server a proxy connection uses. Even if the list contains entries, confirm that the selected server is valid and check the Global Routing mode.

Add Server: Check Existing Details

On Home, open the add menu and choose Add Server. Select Type based on your existing server details, then enter the address, port, and any required authentication, transport, or TLS settings. The fields differ across Shadowsocks, VMess, VLESS, Trojan, HTTP, SOCKS5, WireGuard, and Hysteria2; do not apply one protocol's settings to another. Before saving, check the port, capitalization, and additional options—not just the address.

Subscribe: Check Import and Updates Separately

From the add menu, select Subscribe, enter your own subscription URL, and save it. After an update, check that the groups and entries look as expected, then select a server and run Connectivity Test. A subscription can be parsed even if some of its servers cannot connect. A test result also does not guarantee access to a particular website; verify by opening the destination itself.

Scan QR Code and clipboard import are useful when you already have shared server details. After importing, open the entry and check its Type and key settings. If you manage multiple subscriptions, use clear labels, check for manually edited entries before updating, and confirm the impact before deleting a group. Subscription URLs and shared server details may contain credentials; do not expose them in public screenshots, logs, or discussions. For steps on updating, organizing, and backing up entries, see the Server Management Manual.

04On Demand: Connect Automatically Based on Conditions

On Demand determines whether to start a connection automatically based on configured network conditions; it does not replace Rule-based site routing. First verify on Home that the server and configuration work manually, then open On Demand in Settings and check its toggle and conditions. Available conditions depend on the current app interface. You do not need to change DNS or rules just to enable this feature.

Be clear about what you need before configuring On Demand: should the app connect automatically when the network changes, or stay disconnected on certain networks? Set the conditions offered in the interface, then check the results on networks where the conditions are both met and not met. Also check the system VPN status and the connection status in the app. Turning the connection on manually once does not confirm that automatic triggers are configured correctly.

If the connection starts again after you turn it off, check On Demand before deleting servers. For troubleshooting, temporarily disable On Demand so you can control the connection manually. Restore the conditions you need after troubleshooting. Network changes can also affect system behavior, so distinguish between a connection that did not start and one that connected but cannot access the destination.

05Data: View Traffic Statistics

Data shows traffic recorded by the client. Open Data and first identify the scope and categories shown, then review figures such as upload and download. These statistics represent recorded traffic within the displayed scope; they are not a billing statement from a server provider and do not, by themselves, prove that a destination is being accessed through PROXY.

To observe the effect of an action, note the statistics before testing, visit a specific destination, then return to Data and compare. Background activity on the device can also generate traffic, so keep the test focused. If the interface offers different scopes, use the same one for comparisons. Record any statistics you need before clearing them.

If traffic changes unexpectedly, check Global Routing, the rule that actually matched, and the connection records rather than assuming the server is at fault. Record Direct and Proxy test results separately so you do not conflate different connection paths. To verify service usage, refer to the account records for your existing service and how its usage is measured.

06Settings: Adjust Common Options

Settings brings together options for client behavior and related tools. Open a setting, read its description, and note its current value first. If an option is also affected by the active Config, check that too. The sections below explain common options by function; menu paths and available choices may vary, so use the current app interface rather than relying on an older layout.

DNS: Separate Name Resolution from Connectivity

DNS resolves domain names to IP addresses. If a webpage does not load but Connectivity Test returns a result, DNS is only one possible cause; also check the rules, server, and destination. Review the DNS options in Settings and the DNS settings in the active configuration. Check for manually specified values before deciding which one to change. Avoid changing DNS, servers, and routing mode at the same time, or you will not know which change made a difference.

Note the original value before making a change, then retest the same domain and use the records to determine whether the failure occurred during resolution or connection. Domain rules and address rules rely on different information, and changes to DNS results can affect subsequent address-rule matching. Do not judge DNS settings by the loading speed of a single webpage. For a complete troubleshooting approach, see DNS Settings and Webpage Resolution Troubleshooting.

Test Method: Keep Tests Consistent

Test Method controls how Connectivity Test is run. Check the selected option in Settings, then keep the test method and destination consistent when comparing servers. Different methods may check different parts of the connection, so results cannot be compared without considering the method. If an entry returns no result, check whether it meets the selected method's requirements before deleting it.

A successful test means only that the path covered by that test responded; it does not guarantee that every website, protocol, or step in the connection works. After changing Test Method, run the test again and separately open the page you need to access. This lets you compare the test result with actual use.

Today Widget: Quick Access and Controls

Today Widget settings control the display or quick actions available through the related system widget. Check the corresponding option in Settings, then open the device's system widget manager to see what can be added. Available locations and actions vary by system; refer to what the device actually displays. After using a widget, return to Home to check the server, Global Routing, and connection status. The widget's appearance alone does not show which path a connection uses.

iCloud: Keep a Copy Before Syncing

iCloud options enable the sync or cloud storage features provided by the app. Before using them, check the iCloud status in the device's system settings, then review the related options and descriptions in Shadowrocket. Do not assume that turning on a single switch syncs all servers, configurations, and statistics; check which items the app includes.

Before using multiple devices, keep a copy of important configurations and avoid editing the same content on both devices at once. After syncing, check the active Config, selected server, and Global Routing on each device. A completed sync does not mean the connection is fully configured. Configurations and subscriptions containing credentials are sensitive; take care when saving or sharing them.

07Diagnostics: Use Records to Find the Problem

Diagnostics provides tools to help distinguish network, DNS resolution, and connection issues. Find Diagnostics in Settings and run the checks available in the current interface. Before you begin, note the network, selected server, Global Routing mode, and destination where the issue occurs. Reproduce the problem once so you can match the diagnostic records to that action.

Review the results in order: did the domain resolve, did the connection start, which policy was used, and did the server return a usable response? Different tools test different things, so success at one step does not guarantee success at the next. If Proxy works but Config does not, check the matching rule first. If both fail, review the server details and current network. If only one domain is affected, focus your checks on that domain.

Before saving or sharing diagnostic information, check for subscription URLs, server credentials, full configurations, and access records that should not be public. Remove sensitive details first. When describing a problem, include the steps and how to reproduce it; that is more useful than simply saying “unable to connect.” For a step-by-step checklist, see Troubleshooting: Connected but Unable to Access the Internet.

08Verification Steps After Changing Settings

Features can affect one another, but avoid changing several at once. If you are new to the app, follow the Getting Started Guide to import your existing details and connect manually, then add rules, On Demand, and sync one step at a time. Keep a recoverable copy of any configuration that already works as a baseline for comparison.

1. Check the input. Verify the server protocol, address, port, and authentication settings. Confirm that the subscription updated successfully and that the intended entry is selected.
2. Check the mode. On Home, review Global Routing. Choose Config, Proxy, or Direct for a specific test, then restore your usual mode afterward.
3. Check the route. In Config, review the matching rule, policy, and FINAL. Make sure a broad rule does not take precedence over a specific exception.
4. Check the result. Visit the destination and use Data and Diagnostics to understand what happened. Record test responses separately from whether the page was accessible.
5. Restore automatic behavior. Once basic access works, re-enable the On Demand and sync settings you need, then check behavior after switching networks.

This guide focuses on use on iPhone and iPad. For system requirements and compatibility with other Apple devices, refer to the App Store listing. Menu locations and options may vary; use the current app interface as your reference.