Shadowrocket Glossary: Interface, Protocols, and Rule Keywords

01 / Interface and Controls

Pages and Routing Modes

Check where a term appears. Config serves different purposes in page navigation and in the Global Routing options.

Home #: The main page for viewing saved servers, the current selection, and connection controls. A server appearing in the list only means its details are saved, not that a connection is active. Check the connection status and test actual access.

Global Routing #: Sets the global routing mode for the current connection. Common options are Config, Proxy, and Direct, corresponding to configuration-based routing, proxy routing, and direct connections. If a rule is not taking effect, check this selection before changing the rule itself.

Config #: In Global Routing, Config means handling traffic according to the current configuration; this is typically the mode to use when verifying rule-based routing. In page navigation, Config is where configuration files are managed. Opening that page does not mean a configuration has been selected or enabled.

Proxy / Direct #: In Global Routing, Proxy sends traffic the client can handle through a proxy, while Direct connects without one. These are global routing modes, not server protocol types. Do not confuse them with the uppercase PROXY and DIRECT policy names used in rules.

On Demand #: Triggers a connection on demand when preset conditions, such as network conditions, are met, reducing the need for repeated manual actions. It does not check whether a subscription is valid or guarantee that the remote server is available. To verify it, check whether the conditions were met, whether a connection was established, and whether the destination is reachable.

Add Server #: Use this to enter server details manually. Select the correct protocol first, then fill in its fields. Use the address, port, authentication details, and transport parameters provided with your existing server information. Changing the protocol does not make the original parameters compatible automatically.

Connectivity Test #: Checks connectivity to a specified test target. Results depend on the test method, network conditions, and the target's status. A successful test does not mean every website is reachable, and a failed test does not by itself mean a subscription is invalid. Check actual requests and connection logs as well.

02 / Protocols

Connection Types and Parameter Requirements

A protocol is the communication method agreed upon by the client and server. Match the type and parameters to the service information you already have; do not infer speed, battery use, or reliability from a protocol name.

Shadowsocks #: An encrypted proxy protocol. Its basic parameters include the server address, port, encryption method, and password. The encryption method must match on the client and server. If authentication or connection issues arise, check the fields first rather than relying on test duration alone.

VMess #: A proxy protocol with authentication and encryption, typically configured with credentials such as a user ID. The transport method and its additional fields must also match the server. Correct address and user ID do not guarantee that the transport settings are complete.

VLESS #: A proxy protocol focused on streamlined authentication and forwarding, commonly used with additional transport or security mechanisms. The name VLESS does not mean TLS protection is included automatically. Check the authentication, transport method, and security fields separately.

Trojan #: A proxy protocol commonly used with TLS. The password and TLS connection settings both affect whether a connection succeeds. Check the server name, certificate validity, and system time. Disabling certificate verification should not be a routine troubleshooting step.

HTTP / SOCKS5 #: Two common proxy protocols. Both require the server address, port, and any authentication details. An HTTP proxy is not necessarily encrypted just because of its name. SOCKS5 UDP support depends on the server and usage conditions, so do not assume it based on the protocol type alone.

WireGuard #: A key-based tunneling protocol with parameters such as interface addresses, peer public keys, Endpoint, and AllowedIPs. AllowedIPs specifies address ranges routed through the tunnel; it is not a domain rule. Keep private keys confidential when troubleshooting.

Hysteria2 #: A QUIC-based proxy protocol that relies on UDP connectivity and matching authentication and TLS settings. Performance depends on packet loss, server resources, and network conditions. Set bandwidth-related fields according to the service information and actual conditions, not arbitrary higher values.

For help comparing parameters and use cases, see the protocol reference. Check the App Store page for system requirements.

03 / Rule Keywords and Policies

Match Conditions and Actions

Keywords answer “what to match”; policies answer “what to do.” The rules below illustrate syntax only. example.com is an example domain and does not refer to an actual service.

Rule #: A configuration entry that links a matching condition to an action policy, such as sending a domain through PROXY. Rules are generally matched from top to bottom, so a broad condition above may take precedence over a more specific one. After saving, check the actual match for a new connection.

DOMAIN #: Matches an exact domain. For example, DOMAIN,example.com,DIRECT applies only to that domain. It does not automatically cover subdomains such as www.example.com, and it does not match webpage paths or content.

DOMAIN-SUFFIX #: Matches on domain suffix boundaries. example.com covers the domain itself and its subdomains. This is not an arbitrary substring match: notexample.com does not have this domain suffix. Use it to organize rules by domain scope.

DOMAIN-KEYWORD #: Checks whether a domain contains a specified string. For example, the keyword example may match multiple unrelated domains. Its scope is generally broader than DOMAIN or DOMAIN-SUFFIX. Assess the risk of false matches before using it; it does not define an exact set of domains for one website.

GEOIP #: Matches a destination IP based on its regional attribution in an IP database, not the page content or operator location. Results depend on the database and changes to the destination address. If a domain resolves to different addresses, the same website may match differently.

IP-CIDR / IP-CIDR6 #: Match IPv4 and IPv6 address ranges, respectively. The prefix length after the slash determines the range. For example, 192.168.0.0/16 is an IPv4 range, not a single device. Confirm the target range before assigning a policy to avoid routing a broader range incorrectly.

FINAL #: Sets the final action when none of the preceding rules match, for example, FINAL,DIRECT. It is usually placed at the end of the rule list. Changing the fallback policy affects every connection not covered by an earlier rule, so do not verify it using only a website already matched by a specific rule.

PROXY / DIRECT / REJECT #: Rule policy names for routing through a proxy, connecting directly, and rejecting a connection, respectively. The destination for PROXY depends on the current server selection or configuration. REJECT blocks matching connections; it does not remove webpage elements or guarantee that all page content is filtered.

DNS #: The process of resolving a domain name to an IP address. The result and resolution path can affect rule matching and connection behavior. Changing DNS will not automatically fix authentication errors or server failures. Troubleshoot resolution failures, connection failures, and unexpected policy behavior separately.

Read rules in order, not one line at a time

These two lines show the basic structure for sending a specified domain through a proxy and connecting directly for everything else. Before testing, select Config in Global Routing and confirm that the current configuration and proxy path are working.

DOMAIN-SUFFIX,example.com,PROXY
FINAL,DIRECT

Read the rule keyword guide →

04 / Subscriptions and Configuration

Import, Update, and Test

Server information, subscription URLs, and configuration files serve different purposes. Identify which type of information you have before choosing an import option.

Server #: The remote endpoint details used by the client to connect, typically including an address, port, protocol, and authentication parameters. Often called a node. A display name is only a label for identification; it does not prove location, speed, or availability. Check the parameters and test the connection.

Configuration file #: A text-based configuration containing settings such as rules and DNS. Unlike a subscription, it is not primarily used to provide server entries. Check the content and source before importing, then confirm that the file is selected. Saving a file alone does not mean its rules are being used by the current connection.

Subscription update #: Requests an existing subscription URL again to refresh its server entries or parameters. This is not an App Store app update or a repurchase. If it fails, check that the URL is still valid, the request succeeded, and the returned content can be recognized.

Latency #: The response time measured under specific test conditions; its exact meaning depends on the target and test method. Lower latency does not mean higher bandwidth or prove that every website is reachable. For a meaningful comparison, use the same network, target, and method wherever possible.

Scan QR Code #: An import option that reads connection details from a QR code. A code may also contain plain text or unsupported content. After scanning, check that the recognized protocol, address, and parameters are complete. Successful recognition and saving do not verify the remote connection.

05 / System Permissions and Accounts

Authorization, Purchases, and Data Recovery

System connection permission, App Store purchase history, and iCloud data sync are separate processes. When moving to a new device, check each one separately rather than relying on the status of another.

VPN configuration #: The system may ask for permission to add a VPN configuration the first time you connect, enabling the network extension to establish a connection. Granting permission only completes system authorization; it does not confirm server authentication or successful access. If you deny or remove the configuration, reconnect in the client and check the system prompt.

Apple Account #: The account associated with App Store purchases and purchase history. Its purpose is distinct from the account used for iCloud sync. To restore the app, first check that the App Store is signed in to the original purchase account. Refer to the App Store page for system requirements and availability by account region and purchase eligibility.

Purchased items #: The App Store entry point for finding purchases made with the original account and downloading the app again. The label may vary with the system interface. When changing devices or reinstalling, use the original purchase account to find Shadowrocket. Restoring the app does not automatically restore all locally stored server information.

iCloud sync #: Syncs supported data when account, system authorization, and app settings allow it. Sync is not a complete backup or a way to restore App Store purchase history. Before changing devices, confirm that the data you need can be restored and keep any exported credentials secure.

One-time purchase #: The purchase model for the app itself. Check the App Store page for pricing and purchase eligibility. A one-time client purchase is not a service plan; connecting still requires a subscription or server information you already have. Restore purchase history and connection settings separately.