Official Guide / Glossary
Find settings by their original English labels, then understand how they affect connection behavior.
This page distinguishes interface modes, rule policies, and server parameters. Similar names do not mean the same thing: Proxy is a mode name, PROXY is a rule policy, and the meaning of Config depends on where it appears.
01 / Interface & Toggles
First, identify the screen and current mode. Capitalized names in the interface and all-caps policies in configurations have different meanings.
The main entry point for the server list, selecting the current server, and the connection toggle. A server record in the list means its settings are saved; it does not mean a connection has been established. When troubleshooting, check the selected record, connection status, and Global Routing separately.
The global mode selector determines how traffic is handled: Config, Proxy, or Direct. Use Config for rule-based routing, and check the active configuration. Switching modes changes the traffic path, so note the original selection before testing.
In Global Routing, Config means traffic is handled according to rules in the current configuration. In the configuration management screen, Config refers to the configuration file. Selecting Config does not send all connections through a proxy; the result depends on the matching rule and policy. Check where the term appears before interpreting it.
The proxy mode in Global Routing sends traffic through a proxy path instead of deciding separately for each connection according to regular routing rules. It can help test whether a server works, but it cannot fix incorrect authentication or TLS parameters. Do not confuse the interface mode Proxy with the rule policy PROXY.
The Direct mode in Global Routing connects traffic to its destination without forwarding it through a proxy server. This is not the same as turning off the overall connection toggle. A Direct test only shows how the destination behaves over the current network; it does not prove that a server record is valid.
On Demand connects when conditions configured in the app are met. Before enabling it, understand what each condition does and confirm that a manual connection works. If a connection starts again after the network changes, check the On Demand conditions instead of repeatedly changing server parameters.
A test for connection reachability. Results depend on the test method, target, and network at the time. One successful test does not mean every site or app will work, and one failure does not necessarily mean the server is down. For meaningful comparisons, use the same test method and verify with an actual connection.
DNS resolves domain names to IP addresses, an important step before connecting to a destination. Resolution results can affect subsequent address matching and the connection path, but successful DNS resolution does not mean the destination is reachable. If a domain behaves unexpectedly, check DNS settings, rules, and the destination connection rather than changing only one of them.
02 / Protocols
A protocol name indicates which fields to enter; it does not rank connection speeds. Type, authentication, transport, TLS, and other parameters must match the server details.
A proxy protocol that uses parameters such as an encryption method and password. Check the server address, port, encryption method, and password; copying only the address is not enough. Keep encryption method names unchanged and preserve the exact capitalization and symbols in passwords.
A proxy protocol that uses identity parameters such as a UUID and can use different transport methods. A correct UUID is only one requirement; the transport type, path, Host, TLS, and other fields must also match. If the connection fails after import, compare the original parameters instead of switching protocol types at random.
A proxy protocol that configures authentication separately from transport protection. The UUID identifies the user, while connection protection also depends on settings such as TLS. A record cannot be converted between this protocol and VMess simply by changing Type; create it using the complete parameters provided by the server.
A proxy protocol that typically uses TLS and Password for authentication. In addition to Address, Port, and Password, check fields such as SNI if required by the server. If certificate validation fails, check the domain and certificate requirements first rather than weakening validation.
A QUIC-based proxy protocol that requires a working UDP path. Authentication details, port, and related transport settings must match the server. If the current network restricts UDP, this record may fail even when other connections work; consider the network conditions when troubleshooting.
A protocol that creates an encrypted tunnel using public and private keys. Its configuration includes a local key, Peer, public key, Endpoint, and address ranges. Public and private keys serve different purposes and cannot be interchanged. A private key is sensitive; remove it before sharing troubleshooting materials. Also check the route settings for the connection path.
Two different proxy protocols, each requiring the correct address, port, and applicable authentication details. The protocol name alone does not prove that a connection is encrypted; transport protection depends on the actual configuration. When selecting Type, follow the server details rather than guessing from the port number.
03 / Rule Keywords
The first part of a rule describes what to match; the policy at the end describes how to handle it. The domains and addresses below illustrate syntax only and are not server details.
A configuration entry that selects a connection handling policy based on conditions. Rules are typically evaluated from top to bottom, and the matching policy is applied. A broad rule placed first may prevent more specific rules below it from matching. Before reviewing rules, check that Global Routing is set to Config.
Matches an exact domain, for example DOMAIN,example.com,DIRECT. This rule applies to example.com; it does not automatically match all its subdomains just because their names are related. To cover a domain and its subdomains, first understand the scope of DOMAIN-SUFFIX.
Matches a domain and its subdomains, for example DOMAIN-SUFFIX,example.com,PROXY. It covers example.com and www.example.com, but does not match any string that happens to contain the domain. Do not include the scheme or path from a full URL in the domain field.
Matches a specified string anywhere in a domain name, making it broader than an exact domain or domain suffix match. A short keyword may match domains you did not intend to include. Check the potential scope before using it; DOMAIN or DOMAIN-SUFFIX is usually a better fit for precise matches.
Matches a destination based on its location in an IP geolocation database, for example GEOIP,CN,DIRECT. The result depends on database records, not the site's content language, operator, or visitor location. Changes in resolution and differences between databases can also affect matching.
Used to match IPv4 and IPv6 address ranges, respectively. The number after the slash is the network prefix length. For example, 192.0.2.0/24 represents an address range, not a port. Check the address family and prefix to avoid matching a broader range than intended.
A fallback rule used when none of the preceding rules match, for example FINAL,PROXY. It has no domain or IP matching condition and is usually placed at the end of the rule list. Changing FINAL can affect many connections not covered by more specific rules, so understand the intent of the whole configuration first.
Policies for proxying, connecting directly, and rejecting a connection, respectively. They are actions applied after a rule matches, not domain matching methods. The actual egress for PROXY also depends on the selected server or policy. When changing an action, keep the matching condition unchanged to avoid changing multiple variables at once.
04 / Subscriptions & Configurations
Subscriptions mainly manage server collections; configuration files mainly define connection behavior. Successful import, correct parameters, and actual availability are three separate things to verify.
A subscription imports and updates a server collection. Get the subscription link from your service provider. An update reloads remote content and may add, change, or remove records. Links often contain identifiers, so treat them as sensitive information and do not include them in public screenshots or troubleshooting posts.
The entry point for adding a server record. When entering details manually, select the correct Type first, then check Address, Port, and the relevant authentication fields. Different protocols show different fields, so do not reuse the same set of parameters for all of them. After saving, select the record and test the connection; saving does not check the remote service.
An import option that reads QR code contents. The result depends on whether the code contains a single share link or other recognizable content. Successful scanning does not mean the parameters are still valid; check the record type and key fields after import. QR codes containing authentication details are sensitive and should not be shared publicly.
The system clipboard can pass along copied share links, and the app may show a system permission prompt when reading it. Copy the complete link and avoid including explanatory text, quotation marks, or line breaks. Check the clipboard for authentication details after use; do not paste the original link when reporting an issue.
A connection record in the list, usually containing a protocol, address, port, and authentication fields. It is also commonly called a node. The display name is just a label and does not verify the server's location or current availability. Records with the same name may have different parameters, so check the fields themselves.
The response time under specific test conditions; it is not the same as transfer speed. The test target, method, and current network all affect the result, and a high ranking does not guarantee the best real-world performance. To judge whether a record is suitable, also check destination access, connection stability, and error messages.
A file that stores connection behavior settings such as rules and DNS. It is different from a subscription that provides a server collection. Adding a server does not automatically create routing rules suited to your needs. After importing a configuration, check that it is selected and verify its behavior with Global Routing set to Config.
A configuration mechanism that rewrites request addresses or performs specified actions based on matching expressions. It does not select a proxy egress. Expressions and actions affect matching requests, so keep their scope clear. Handling HTTPS content may require additional conditions; enabling rewriting does not mean it applies to every request automatically.
Syncs app-supported data across devices using iCloud; the actual scope depends on the options in the app. Sync is not the same as a separate backup, and deletions or changes may also sync. Before switching devices, save any important configuration and subscription details separately. After restoring, check servers, rules, and the current selection one by one.
For complete steps to import, update, and organize your data, see Subscription and Server Management Guide →
05 / Purchases & Accounts
Shadowrocket is a paid client for Apple platforms and is available exclusively on the App Store. Refer to the App Store listing for pricing, system requirements, and purchase eligibility.
Check the official icon, the developer Shadow Launch Technology Limited, and app ID 932747118 in the product page URL. A similar name is not a substitute for verifying all three. Review the store listing before purchasing; the download guide explains where to check these details.
See the verification steps →A purchase for the right to use the client. A one-time client purchase is not a service subscription. Buying the app does not include servers or a subscription; get subscription links from your service provider. This is the Shadowrocket official website and guide; it does not provide servers. The price shown on the App Store listing is the current price.
The App Store section for finding previously purchased apps. Purchase records are associated with the account used to complete the purchase. When switching devices or reinstalling, first confirm that you are using the account associated with the purchase history. Getting the client again does not automatically restore all servers and configurations; check app data separately.
See the restore guide →The device and operating system compatibility listed on the App Store page. Shadowrocket is primarily used on iPhone and iPad; details for Mac, Apple TV, and Apple Vision are also available on the same listing. Refer to the App Store page for system requirements and purchase eligibility rather than relying on a device name alone.