When you have a working server and configuration, Config is usually the right choice for everyday use. Switch to Proxy temporarily to isolate rule-related issues, or use Direct to compare access over your local network. This guide explains how the three modes differ from the connection toggle, Config files, subscriptions, and On Demand, then walks through a one-variable-at-a-time troubleshooting process so routing mistakes aren’t mistaken for server failures.
1. What Config, Proxy, and Direct control
Shadowrocket’s Global Routing setting selects how traffic is routed; it is neither a server protocol nor proof that a connection is working. After choosing a mode, check the connection status on Home, the selected server, and the actual result of your request. “All” below means traffic handled by Shadowrocket; it does not mean every system communication on the device necessarily follows the same path.
Config: Route traffic according to the current configuration
RecommendedThe rules and policies in the current Config determine where traffic goes. Requests matching DIRECT connect directly; requests matching a proxy policy follow that policy. Traffic that matches no earlier rule is handled by a fallback such as FINAL—it does not automatically connect directly.
Best for: Everyday rule-based routing with a configuration that matches your needs
Proxy: Use the proxy path for all traffic
Instead of applying Config’s routing rules individually to decide whether traffic connects directly or through a proxy, this mode sends traffic through the current proxy path. If the selected server is unavailable, switching to Proxy won’t fix its address, authentication, or transport settings.
Best for: Temporarily routing everything through the proxy, or checking whether a problem is caused by routing rules
Direct: Use the direct path for all traffic
Traffic handled by the app connects directly to its destination without being forwarded through a proxy server. Servers can remain in the list, but selecting a server does not mean Direct will use it.
Best for: Checking whether your local network can reach a destination and establishing a direct-connection baseline
If Scene also appears under Global Routing, check the in-app scene settings to confirm which routing behavior is active. Scene is not a “more thorough” proxy mode. For the comparisons in this guide, select Config, Proxy, or Direct explicitly to avoid introducing scene conditions as another variable.
2. Switch modes on Home and check three separate states
The selected server, Global Routing mode, and connection toggle on Home are three separate states. Selecting a server without establishing a connection does not mean requests are going through it. Likewise, if the connection is active but the mode is still Direct, website access alone cannot tell you whether the proxy server works. Record the current states before switching modes.
- Open Home and check which server you want to test. This guide assumes you already have a service provider and subscription; get server settings and subscription links from your provider.
- On Home, open Global Routing and select Config, Proxy, or Direct. Return to Home and check the displayed mode.
- If you selected Config, open Config at the bottom of the screen and confirm which configuration file is active—not just that a file appears in the list.
- Return to Home, confirm the connection is active, then reload the same test page. If the result doesn’t change after switching modes, close the old page or end the existing connection and try again; reconnect if needed.
- Restore your original mode after testing. If you temporarily selected Proxy, remember that your everyday routing rules are no longer choosing the path.
3. How Config rules work: order and FINAL determine the outcome
Config is both the name of the configuration management section at the bottom of the app and an option under Global Routing. The former manages configuration files; the latter applies routing rules from the current configuration. A server subscription determines which servers are available to select, while routing rules determine which path requests use. They serve different purposes.
The following rules illustrate the syntax; they are not a complete configuration. example.com is a sample domain, and the proxy policy name must match the one in your actual configuration. Save a copy of the original file before making changes so you don’t overwrite existing policy groups or other required settings.
[Rule]
DOMAIN-SUFFIX,example.com,PROXY
IP-CIDR,192.168.0.0/16,DIRECT,no-resolve
GEOIP,CN,DIRECT
FINAL,PROXY| Rule | What it matches | Action in this example |
|---|---|---|
DOMAIN-SUFFIX | Matches example.com and its subdomains | PROXY |
IP-CIDR | Matches the 192.168.0.0/16 address range; no-resolve means this rule won’t actively resolve a domain | DIRECT |
GEOIP | Matches CN using the IP geolocation database; the result depends on the database and the destination IP address | DIRECT |
FINAL | Catches requests that did not match any preceding rule | PROXY |
Rules are evaluated in order, and the first match determines the route. In this example, the proxy rule for example.com comes before GEOIP, so you can’t infer that the request will connect directly just from the destination IP’s region. Put FINAL at the end; a fallback placed earlier would prevent later, more specific rules from taking effect.
- To connect a domain directly, add a rule that routes it to DIRECT in the appropriate position, then check whether an earlier rule already matches it.
- To check local network access, first identify the destination’s address range. 192.168.0.0/16 is only an example and doesn’t cover every local network address.
- After editing, leave Global Routing set to Config, then make a new request and check which rule and policy it matches. You can’t verify these routing rules while Proxy or Direct is selected.
4. Use different approaches for everyday routing and troubleshooting
Everyday use calls for consistent configuration behavior; troubleshooting calls for as few variables as possible. Don’t mix the two: if you change servers, update a subscription, and modify DNS all at once, even if access is restored, you won’t know which change fixed the issue.
Approach: Keep your everyday configuration fixed and compare routing modes separately
Everyday use
- Set Global Routing to Config and confirm the current configuration’s rules and FINAL route.
- Use server and policy-group selections you’ve verified; don’t guess the actual route based on their names.
- After updating a subscription, check that the server you rely on is still available.
Temporary troubleshooting
- Keep the network, server, and test destination the same.
- Record the results of new requests in Config, Proxy, and Direct, one at a time.
- Change just one setting per test, then restore the original configuration and mode.
Bottom line: Proxy is a way to compare routing behavior, not a fix for every connection problem. Whether Config is appropriate depends on whether its rules meet your needs.
Protocols are not alternatives to Global Routing. Shadowsocks, VMess, VLESS, Trojan, Hysteria2, and WireGuard describe how a server connection works; Config, Proxy, and Direct determine how requests are routed. Don’t change Type, Port, or authentication fields just to switch routing modes. Keep those settings consistent with the information from your provider.
5. Narrow down the issue based on test results
Compare results using the same destination and record the specific failure, such as a connection timeout, a name resolution failure, or an error returned by the page. “It won’t open” isn’t specific enough to pinpoint the cause. The examples below help interpret test results; they don’t guarantee that any particular route will work.
| Observed result | Check first | Next step |
|---|---|---|
| Accessible in Proxy, but not in Config | Matched rule, policy-group selection, and DNS differences | Switch back to Config and check the rule and policy that the request actually matched. Don’t rebuild all your servers right away. |
| Accessible in Direct, but not in Proxy | Current proxy path and server settings | Check Address, Port, and authentication details. If the protocol uses TLS, check the relevant TLS fields too. |
| Not accessible in either Proxy or Direct | Local network, destination service status, and DNS results | Try another destination you know is accessible, then check whether the network requires authentication first. |
| The old page behaves the same after switching modes | Connection reuse, caching, or connection status | Make a new request and, if needed, reconnect before testing again. |
- First confirm that your local network is working. If the network requires web-based authentication, complete it before testing.
- Keep the same server, temporarily select Proxy, and test the same destination with a new request.
- Switch back to Config and test again. If the request fails only in Config, focus on the matched rule, policy, and related DNS settings.
- Select Direct for comparison, but don’t treat a successful Direct request as proof that the proxy server has been verified.
- If you need to check the server further, contact your provider and describe the failure. Share the mode and error details, but don’t post a full subscription link containing authentication information.
6. Common questions about subscriptions, On Demand, and switching modes
If I select Proxy, do I still need to turn on the connection?
Yes. Global Routing only selects a routing mode. Return to Home, check the connection status, and make a new request. Selecting Proxy by itself does not establish the proxy connection.
Why doesn’t Config route traffic as expected after I update my subscription?
Updating the server list doesn’t rewrite routing rules. First check the selected server on Home, then open Config and verify the active configuration, rule order, and policy-group references. Get the subscription link from your provider, and check that its references are still valid after updating.
Do I still need to select Config if On Demand is enabled?
Check them separately. Settings → On Demand manages the conditions for connecting on demand; Global Routing controls how traffic is routed after connection. Check the On Demand conditions first, then return to Home and verify the routing mode. On Demand does not replace routing rules.
What’s the difference between Direct and turning off the connection?
Direct is a routing mode while the app is connected; turning off the connection toggle disconnects the current connection. To check network behavior after disconnecting completely, turn off the connection and check whether On Demand reconnects under its configured conditions.
Why don’t I have a server after buying Shadowrocket?
Buying the app does not include a server subscription. Shadowrocket is a closed-source commercial app available exclusively on the App Store; get a subscription from your service provider. Buying the app does not automatically create a server list.
Keep a brief record you can review later: the original mode, what you changed it to, the destination you tested, and the result. When you return to everyday use, check the server, Global Routing mode, and connection status on Home. For help with the interface, see the tutorial; for rule keyword definitions, see the glossary.