Official Manual · Browse by Term

Shadowrocket Glossary

Interface terms, protocol names, and Rule keywords remain in English. First identify which layer a term belongs to, then decide whether to change the connection mode, server parameters, or profile.

For step-by-step instructions, see Quick Start. For complete rule examples, see Configuration Reference. Before getting Shadowrocket, read the App Store Download Guide.

Interface / Switches

Interface & Options

These terms describe navigation options or connection modes. They are not server protocols and do not directly represent individual Rules.

Global Routing: This setting controls the overall connection mode: Config, Proxy, or Direct. To use rule-based routing, first check that Config is selected, then confirm the active profile. Editing Rules while Proxy is selected usually won’t produce the expected per-rule routing. When troubleshooting, note the original mode and change one option at a time to avoid mistaking a mode difference for a server issue.

Config: Config is both the entry point for managing profiles and a mode option in Global Routing; its meaning depends on where it appears. As a management option, it lets you view, edit, and select profiles. As a connection mode, it means requests are handled according to the current profile. Importing a profile does not make it active, so check which one is selected after importing.

Proxy: Proxy is the proxy mode in Global Routing. Requests are generally handled by the currently selected proxy, subject to system traffic and bypass settings. It is not a general label for protocols such as Shadowsocks or VLESS, and it does not indicate whether a server is available. You can temporarily use this mode to test the effect of Rules, then restore the original setting.

Direct: Direct is the direct mode in Global Routing. Targets are generally accessed directly over the current network. It can help you compare access to the same target on that network, but a successful direct connection does not confirm that proxy server settings are correct. The interface option Direct and the rule keyword DIRECT belong to different layers; changing one does not update the other.

On Demand: On Demand asks the system to establish a VPN connection when preset network conditions are met, such as conditions for different network environments. It controls when to connect, not whether a domain uses PROXY or DIRECT. After enabling it, check the system VPN configuration and trigger conditions. Also consider the current conditions when assessing what happens after manually disconnecting.

Connectivity Test: This test tool checks server connectivity. Results depend on the test method, target address, and current network. The displayed latency is the time taken by a specific test; it is not download speed and does not guarantee that every target is reachable. For meaningful comparisons, use the same test method. If a test fails, check the address, port, authentication, and actual request separately.

Protocols

The protocol determines how a connection is established. When using Add Server, follow the existing server details; do not infer authentication, transport, or certificate settings from the protocol name.

Shadowsocks: Shadowsocks connects to a server using a specified encryption method and credentials. The address, port, password, and encryption method must all match. If the connection fails after import, check each field rather than only the password. If the existing server details include additional transport parameters, enter them as specified; do not substitute options that merely seem similar.

VMess: VMess authenticates using a user ID and other parameters. Server details often also specify a transport and security options. A correct UUID alone does not guarantee a complete configuration; a mismatch in Host, path, or TLS settings can also prevent connection. After importing a share link, compare the fields with the original details. In particular, do not use a webpage URL path as the transport path.

VLESS: VLESS authenticates using a user ID but does not encrypt payloads itself. Connection security depends on the accompanying transport and security settings. Check the transport type, TLS-related fields, and other options together; entering only the UUID is not enough. If a field is missing, refer to the existing server details rather than guessing defaults from the protocol name.

Trojan: Trojan typically uses TLS with password authentication. The server address and the name associated with its certificate may need to be entered separately. If the connection fails, check the password, port, server name, and device time. Certificate validation issues are not the same as an incorrect password. Correct the name or certificate settings first; disabling verification should not be a routine configuration step.

Hysteria2: Hysteria2 is based on QUIC and typically uses UDP for transport. Authentication and other parameters should come from the existing server details. The number is part of the protocol name, not a Shadowrocket app version claim. UDP handling on the current network can affect connectivity, so a successful TCP test does not prove this connection will work.

WireGuard: WireGuard identifies peers by public key. Configuration typically includes a local private key, peer public key, Endpoint, addresses, and Allowed IPs. These fields are not equivalent to a standard server entry with an address and password. Do not include keys in public screenshots or troubleshooting records. Allowed IPs define the traffic scope for this tunnel; they do not, by themselves, reveal how other Shadowrocket rules will be applied.

SOCKS5: SOCKS5 is a proxy request protocol that can forward TCP connections and, when supported by both client and server, handle UDP. The name does not imply that the transport is encrypted. Whether a username and password are required depends on the server configuration. Check authentication requirements and UDP support separately; do not apply HTTP proxy fields to SOCKS5.

Rule / Policy

Rule Keywords & Policies

Rules check conditions in order and apply the specified policy when a match is found. The condition answers “what matches?”; the policy answers “what happens?”

[Rule]
DOMAIN-SUFFIX,example.com,PROXY
IP-CIDR,192.168.0.0/16,DIRECT
FINAL,DIRECT

Here, example.com is used only to illustrate the syntax. Put specific conditions first and FINAL last. The example’s PROXY policy must correspond to a server you already have and can use.

DOMAIN: DOMAIN matches an exact domain name. For example, DOMAIN,example.com,DIRECT applies to example.com itself. It does not automatically include every subdomain, such as www.example.com, and does not match webpage paths. To cover subdomains, use DOMAIN-SUFFIX rather than adding a wildcard to the exact domain.

DOMAIN-SUFFIX: DOMAIN-SUFFIX matches a domain and its subdomains, such as example.com and www.example.com. Enter only the domain in the condition; do not include https://, a port, or a page path. To apply a different policy to a specific subdomain, put the more specific DOMAIN rule before the suffix rule.

DOMAIN-KEYWORD: DOMAIN-KEYWORD matches a string appearing in a domain. For example, the keyword example could match multiple unrelated domains. Its scope is usually broader than a specific suffix and may include similarly named targets with different purposes. Before using it, confirm the intended scope. When you can describe the target precisely, prefer a more specific condition.

GEOIP: GEOIP matches a target address using an IP geolocation database, for example GEOIP,CN,DIRECT. The result describes the database’s geographic classification of the target IP, not the visitor’s location or the website’s operator. DNS results and database contents both affect the match, so GEOIP is not a substitute for every exact domain rule.

IP-CIDR: IP-CIDR matches an IPv4 address range. For example, 192.168.0.0/16 represents a network range; the number after the slash is the prefix length, not a port. Use IP-CIDR6 for IPv6 ranges rather than adapting the IPv4 example. To match a target address for a domain request, also consider DNS resolution and the effects of rule options.

FINAL: FINAL sets the policy for requests that do not match earlier rules and is usually placed at the end of the Rule section. It needs no domain or address condition, for example FINAL,DIRECT. If placed earlier, it will usually prevent later rules from handling unmatched requests. When troubleshooting rule order, check its position first.

PROXY: PROXY is the proxy policy in Rule text. Matching requests are handled through a proxy; the server used depends on the current selection and configuration. It is not a protocol type and does not include an address, port, or authentication details. Keep it uppercase and distinguish it from Proxy in the Global Routing interface: one is the outcome of an individual rule, the other an overall connection mode.

DIRECT: DIRECT is the direct policy in Rule text. Matching requests connect directly to the target. The result still depends on the current network, DNS, and target service, so it does not guarantee a successful request. This policy is often used for local network ranges, but set the condition to match your actual network and avoid making the range too broad.

REJECT: REJECT is the reject policy. Matching requests do not proceed to establish a normal connection to the target. It is neither a replacement proxy server nor an automatic fix for network problems. If some page resources fail to load, check whether a reject rule matches the relevant domains, then assess whether its condition is too broad or its position is inappropriate.

Subscription / Configuration

Subscriptions & Profiles

A server list determines “where to connect”; a profile determines “how to handle requests.” Importing one type of data does not mean the other is ready too.

SERVER: A server entry stores the details needed to establish a connection, including the address, port, protocol, and authentication parameters. The fields vary by protocol. Server availability is required to connect; the display name is only a label for identification. A server entry can come from a single share link or a subscription, but the two are updated differently. If you edit an entry manually, check whether a subscription update will overwrite your changes.

Profile: A profile is a text file that organizes settings such as General, Rule, Host, and URL Rewrite, each with a different purpose. It is not a server subscription, and seeing PROXY in the file does not mean it contains usable server details. Keep a recoverable copy before editing. After saving, check the active file in Config and confirm that Global Routing is set to Config if you want to use it.

General: General is the section for common profile settings, often including DNS and bypass behavior, for example dns-server = system. Enter each value according to its own syntax; do not apply Rule’s comma-separated format here. After changing one setting, check its effect before adjusting others to make it easier to identify and revert changes.

Host: The Host section maps specific hostnames to addresses, for example localhost = 127.0.0.1. It handles the relationship between names and addresses; it does not choose a PROXY or DIRECT policy. A static mapping may become invalid if the target address changes, so check for an outdated entry when a particular domain continues to have access issues.

URL Rewrite: URL Rewrite processes request URLs according to specified patterns; it does not select a connection policy like Rule. A rule usually needs a match pattern, target, and handling method. Characters such as periods in regular expressions must also be escaped correctly. What can be seen in HTTPS requests is limited by encryption and related settings, so do not assume a single Rewrite rule can handle every URL.

System / Account

System & Account

Keep app purchases, system authorization, and network details distinct. Restoring the app does not restore server details, and a system status of connected does not confirm that access to a target has been verified.

DNS: DNS resolves domain names to IP addresses. A resolution failure may prevent a webpage from opening or affect access to a specific target. DNS and proxy server authentication are separate steps; changing DNS settings cannot fix an incorrect password or an unavailable server. When troubleshooting, note the current DNS settings and consider the connection mode and domain rules to determine how DNS requests are handled.

VPN Configuration: The first time you turn on the connection switch, the system may ask permission to add a VPN configuration for storing and managing Shadowrocket network connections. This system entry is not server data and does not mean a working server is available. If the entry is deleted, start a connection from the app and complete system authorization again, then separately verify the server and target access.

Apple ID: Apple ID is used for App Store purchases and purchase history. The current store region affects app availability and the displayed currency. Before purchasing, check which account is signed in to the App Store rather than relying only on the device’s iCloud sign-in status. Shadowrocket is available exclusively through the App Store; check the App Store page for system requirements and device compatibility.

Purchased: Purchased is the App Store section for viewing past purchases and redownloading apps. Its name and location may vary with the system interface. When switching devices or reinstalling, check your purchase history using the original purchasing account. Redownloading the app does not automatically restore in-app subscriptions or profiles. To verify the genuine app, also check the developer, Shadow Launch Technology Limited, the official icon, and app ID 932747118.

iCloud Sync: iCloud Sync stores or transfers app data between devices through iCloud. Check the options shown in Shadowrocket for the exact sync scope. It is separate from App Store purchase history, and enabling sync does not mean every item has been backed up. Before switching devices, confirm the sync status and that essential data can be restored. Keep subscription URLs and authentication details confidential.

Continue to the Rules & Configuration Reference →

Back to term categories ↑