Official Guide / Features

Features and Common Settings

Choose Global Routing first, then check rules and servers. Automatic connections, usage statistics, and diagnostics address different issues.

Compare routing modes First connection guide

01 / Traffic Handling

Three Global Routing Modes

The mode determines how traffic is handled; the server determines the proxy endpoint. Check them separately.

Global Routing is where you choose a traffic-handling mode, usually from Home. This section covers Config, Proxy, and Direct. These are not connection-quality ratings, and they do not change server addresses or authentication details. Before use, check the current mode, selected server, and Config to avoid mistaking a mode issue for a server failure.

Mode	How it works	When to use it	What to check
Config · Configuration	Handles traffic according to the rules and policies in the active configuration.	When connections need different handling based on domains, IP addresses, or other conditions.	The active configuration file, rule order, policy references, and FINAL.
Proxy	Routes traffic intercepted by the client through the current proxy path.	To briefly check whether a server can handle proxy requests, or when all traffic should use the proxy.	The selected server, protocol settings, and availability of the proxy path.
Direct	Handles traffic intercepted by the client as direct connections.	To troubleshoot the local network or when a direct connection is required.	Whether the destination is reachable directly on the current network and whether automatic connection is still enabled.

How to set it: choose a mode, then make a new request

Open Global Routing from Home, choose a mode, then return and confirm the displayed value. With Config, also select the configuration to use under Config. With Proxy, check which server is selected on Home. After changing modes, reopen the destination or make a new connection to test it. Existing long-lived connections may continue using their original route, so a page that was already open is not a reliable test.

Note: Direct does not turn off the client’s connection switch, and Proxy does not mean all device traffic can bypass system restrictions. What the client can intercept depends on the operating system’s network mechanisms and app behavior. If Scene is also shown, check its settings for the relevant situation; it is separate from the three basic modes in this table.

02 / Matching and Policies

Rule-Based Routing and Config

Rules determine what matches; policies determine how matched traffic is handled.

Rule-based routing sends different connections along different paths. Open the active configuration under Config to view or edit its rules. The rules discussed here apply only when Global Routing is set to Config. Before making changes, back up the original configuration and confirm which file is selected. Add one rule with a clearly defined scope; do not replace rules, DNS, and server settings all at once.

Rule types at a glance

DOMAIN: Matches an exact domain name, useful when handling a specific hostname.
DOMAIN-SUFFIX: Matches a domain suffix and its subdomains. Use it to cover a domain family, taking care to distinguish domains with similar names but different suffixes.
DOMAIN-KEYWORD: Matches a keyword in a domain name. Its scope is usually broader than an exact domain, so check for unrelated requests before adding one.
IP-CIDR / IP-CIDR6: Match IPv4 / IPv6 address ranges, respectively. The prefix length determines the range; do not confuse a single address with an entire subnet.
GEOIP: Matches an address using an IP geolocation database. The database result does not indicate where a website is based, and may change when the resolved IP address changes.
FINAL: Sets the handling policy for connections that did not match earlier rules. It is usually placed at the end of the rule list.

How to set it: specific rules first, fallback rules last

Rules are generally checked from top to bottom, and the first matching rule determines how a connection is handled. This snippet explains the syntax; it is not a complete configuration to replace your own. example.com is a sample domain. PROXY should refer to a working proxy path, DIRECT means a direct connection, and REJECT blocks matching connections.

DOMAIN-SUFFIX,example.com,PROXY
GEOIP,CN,DIRECT
FINAL,PROXY

Note: If you use a custom policy group, the policy name at the end of a rule must match the name in the configuration. Broad matches placed first can prevent more specific rules from taking effect. If a site behaves unexpectedly, first check which rule matched the new request, then decide whether to change the rule type, order, or policy. Do not judge a rule solely by whether a page loads.

For explanations of rule keywords and interface terms, see the glossary. When making your first changes, keep a copy of a configuration that connects successfully as a fallback.

03 / Connection Details

Subscriptions and Server Management

Subscribe handles bulk updates; Add Server handles individual connection details.

A server entry stores connection details such as the protocol, address, port, and authentication. A subscription uses an existing link to retrieve and update a group of servers. Neither is a rules configuration file. To add a single server, open Add Server from the add option on Home and enter its details for the relevant protocol. If you already have your own subscription, enter its link under the relevant Subscribe option and save it. Menu locations can vary by platform; use the options shown in your app.

How to set it: check the protocol, then each field

When adding a server manually, first select the protocol that matches your server details, then enter the address, port, and authentication fields. Parameters for protocols such as Shadowsocks, VMess, VLESS, Trojan, WireGuard, and Hysteria2 are not interchangeable. TLS, transport, and name fields must also match the server requirements. A matching address alone is not enough to establish a connection.

You can import an existing share link from the clipboard or use Scan QR Code to read a QR code. After importing, check the protocol, host, and group; seeing a name in the list does not mean all details are complete. QR codes and share links may contain authentication details. Hide sensitive information before taking screenshots or recordings, or forwarding them.

What to watch for: update, test, and delete separately

Subscribe updates refresh the relevant entries based on the subscription contents. Manual edits to subscribed entries may be overwritten by a later update. Use recognizable labels to organize multiple subscriptions and avoid selecting the wrong one when names are similar. If an update fails, check the original link and your current network before trying again; do not immediately delete the entire group. Before deleting anything, check for manual entries or backups you need to keep.

Connectivity Test can check whether a server is reachable, but a single test result does not represent actual throughput or guarantee access to every destination. After selecting a server, verify it with Global Routing and a real request. For update behavior, sorting, and backups, see the subscription and server management guide.

04 / Automatic Triggers

On Demand Connections

It determines when to try to connect, not which rules a website uses.

On Demand triggers connections based on network conditions. Use it when you want connections to start automatically on specified Wi-Fi or cellular networks. Find On Demand in Settings, review the available network conditions and existing rules, then configure it to suit your needs. It has a different role from Global Routing: On Demand triggers the connection, while Global Routing handles traffic after the connection is established. They are not interchangeable.

How to set it: test each network condition separately

First make sure manual connections work, then enable On Demand. Check Wi-Fi and cellular conditions separately. If the app lets you match a Wi-Fi network by name, enter the exact network name if needed. After saving, leave Settings, switch to the network you want to test, and check the system VPN status and the client’s connection status. Test one condition at a time to avoid overlapping triggers that make it unclear which rule took effect.

Note: Once enabled, a manual disconnect may be followed by another connection attempt when the conditions are met. To disable it temporarily, check On Demand as well as the connection switch on Home. Complete any required sign-in on public Wi-Fi before testing the connection. If other VPN configurations are present on the device, check whether they also connect automatically to avoid conflicts.

On Demand cannot fix an expired subscription, an incorrect password, or an unreachable server. A brief interruption after switching networks should also be distinguished from a server failure. To troubleshoot, temporarily disable automatic triggers and connect manually to the same server. Once the manual connection is stable, re-enable On Demand and test the original conditions one by one.

05 / Reviewing Results

Data Usage Statistics

View traffic recorded by the client; these figures do not replace your carrier or service provider’s usage records.

Data shows traffic statistics and records available in the client. Open Data and check the statistics scope, direction, and time period shown before reading values such as upload and download totals. Details and retention may vary by platform. Do not treat a cumulative figure for one connection as daily usage, or assume the client’s statistics record all network traffic on the device.

How to use it: note the baseline, then test one thing

To check whether an action generated traffic, note the current value, open one destination or make one request, then check the value again. To compare results before and after a change, keep the test destination, network conditions, and steps consistent. Configuration changes, background app activity, and existing connections can all affect the figures. An increase alone does not prove which rule or server handled the traffic.

Note: Client and service provider statistics may differ because of billing periods, protocol overhead, or measurement methods. Clearing app data, reinstalling, or resetting statistics may prevent historical values from accumulating. If usage seems unusually high, first check the time period and background requests, then review connection records. To find a matched domain or connection error, check the relevant records or Diagnostics rather than relying on the summary alone.

06 / Common Options

Settings Reference

Keep the current value, change one item at a time, and revert if it does not help. Avoid stacking changes.

DNS: Domain Resolution and Connection Paths

What it is and where to find it: DNS translates domain names into addresses used to make connections. Related settings may be found both under DNS in Settings and in the active Config. Before troubleshooting, identify which configuration is in use; checking just one menu may not be enough. A successful DNS response does not mean the returned address is reachable over the current connection path.

How to set it: Keep the current DNS settings and back up the configuration first, then check for manually specified resolvers, domain overrides, or other DNS rules. Make one change based on the active configuration, reconnect, and send a new request to a domain. Do not enter a server address, subscription URL, or arbitrary web address in a resolver field.

Note: DNS caches and existing connections may prevent a change from showing up immediately. Domain rules, IP rules, and DNS results are related. If one destination behaves unexpectedly, first check whether it resolves, whether its address is reachable, and how the rules handle it. Then decide whether DNS needs to change.

Test Method: Consistent Connection Testing

What it is and where to find it: Test Method in Settings controls the method used for relevant connection tests. Results reflect how that method and destination performed at the time; they are not a general speed rating. Check the active test method before using Connectivity Test.

How to set it: Choose an option actually shown in the app that suits your troubleshooting task. If you need to specify a test destination, use one known to be reachable and stable. When comparing servers, keep the method, destination, and network consistent, and repeat the tests. Do not rank results gathered under different conditions.

Note: A test timeout does not necessarily mean all proxy requests are failing, and a successful test does not guarantee a specific service will work. Test results do not translate directly into download speeds. Always test the destination you need to access.

What it is and where to find it: Today Widget is an entry point related to system widgets. Check Settings for a corresponding option, then see whether it can be added from the system’s widget editor. Availability depends on system support; if the option is missing, that does not necessarily mean the client configuration is damaged.

How to set it: First select a server and mode in the client, then complete an initial connection before adding a system-provided widget. After using a shortcut, return to Home to check the actual status, especially after switching networks or changing the configuration.

Note: A widget is a shortcut and information display, not a separate rules configuration. Its status may take time to refresh. When using a lock screen or shared display, check whether it shows a server name you do not want to share.

iCloud: Sync and Backup Limits

What it is and where to find it: iCloud options save or sync the data listed in the interface on supported devices and system configurations. Check the sync switch in Settings and make sure Shadowrocket is allowed to use the relevant iCloud features in system settings. Do not assume that every platform, field, or historical record will sync.

How to set it: Back up important information on the original device first. Then confirm that the target device uses the same iCloud account and that the app has permission to access the relevant features. After sync completes, check servers, configurations, and current selections individually. Avoid making many edits or deletions on both devices at once, as it can be difficult to tell which change overwrote the data.

Note: Sync is not a backup of previous versions, and accidental deletions may sync as well. Subscriptions and configurations may contain authentication details, so manage system account and device access carefully. After migrating, verify system connection permissions and the actual network status again.

Diagnostics: Review Error Context

What it is and where to find it: Diagnostics provides troubleshooting tools or information, usually accessible from Settings. It helps narrow down a problem but does not automatically correct incorrect server settings. Choose the relevant diagnostic option in the current interface, then review the results alongside when the issue occurred and which destination was involved.

How to set up and use it: First note the current network, Global Routing mode, server, and configuration, then reproduce the issue once. Keep relevant error details and distinguish in turn between DNS resolution failures, connection timeouts, authentication failures, and rule rejections. Change one variable at a time and repeat the same request to see whether it helped.

Note: Diagnostics may include visited domains, server addresses, or authentication details. Before sharing, check for and hide subscription links, passwords, and personal information; include only what is needed to identify the issue. When troubleshooting is complete, return any temporarily enabled detailed logging to the level you need for everyday use.

Checklist

What to check after changing settings

Check the network. First make sure the current Wi-Fi or cellular connection works. Complete any required web sign-in before continuing.
Check the server. Confirm the selected entry, protocol, and authentication details. Distinguish manually added entries from those updated through Subscribe.
Check the mode. Under Global Routing, check Config, Proxy, or Direct. With Config, also check the active configuration and which rule matched.
Make a new request. Do not rely on an existing long-lived connection. Use Data and Diagnostics to review the results of the same test.
Re-enable automatic triggers. After confirming a manual connection works, enable On Demand again and test network switching. Keep a record of the settings so you can revert them.

If you still cannot identify the issue, continue with the troubleshooting categories in the FAQ. If you have not completed your first import, return to the setup guide to establish a basic connection you can test, then add rules and automatic connection settings one at a time.