Official Manual · Settings

Shadowrocket
Features and Common Settings

First identify how requests are routed and when the connection starts, then check servers, DNS, and usage statistics. Change one type of setting at a time and keep a configuration you can restore.

Config / Proxy / Direct
On Demand
Data
Settings

01 · Request routing

Global Routing: Config, Proxy, and Direct

Global Routing determines how requests are routed; it does not verify whether a server is working. Go to Home → Global Routing and choose Config, Proxy, or Direct, then return to Home to check the connection status.

Mode	How requests are handled	When to use it	What to check first
Config	Routes requests according to the rules and policies in the active configuration.	For everyday routing by domain, address, or other criteria.	Whether the configuration is active, rule order, and final policy.
Proxy	Typically sends requests through the currently selected proxy server; system and app limitations may still apply.	To check server connectivity temporarily or compare results while troubleshooting routing rules.	Server settings, selected server, and network reachability.
Direct	Sends requests directly to their destinations over the current network, without routing them through the selected proxy server.	To establish a baseline on the current network or temporarily check direct access.	Whether the current network can reach the destination and DNS is working.

Choosing a mode: use Config day to day, compare modes when troubleshooting

If you already have a complete configuration, start with Config and confirm the active file on the Config page. To check a server, temporarily switch to Proxy and test the same destination again. If Proxy works but Config does not, check which rules match and where their policies point before changing server settings. When testing is done, switch back to your usual mode so you don’t leave a temporary troubleshooting setup in place.

Direct does not mean the connection is switched off. The client may keep the system VPN configuration connected while routing requests directly. To stop the current connection completely, return to Home and turn off the connection switch. If On Demand reconnects afterward, check its connection conditions too. Routing mode, connection status, and trigger conditions are separate settings; the status bar icon alone cannot confirm that requests are going through a proxy.

02 · Matching conditions

Rule-based routing: matching conditions and policies

Rules determine which policy handles each request. Find them in the active configuration under Config. A rule typically consists of a rule type, a match value, and a policy. Common policies include DIRECT, PROXY, and REJECT; a rule may also point to a policy group defined in the configuration. Policy group names are not protocol names, so confirm the destination exists before referencing it in a rule.

DOMAIN matches a full domain name; DOMAIN-SUFFIX matches a domain suffix; DOMAIN-KEYWORD matches a keyword in the domain. IP-CIDR and IP-CIDR6 specify address ranges, while GEOIP matches against IP geolocation data. USER-AGENT depends on the client being able to access the relevant request information, so it does not apply to all traffic and should not be treated as a general way to identify apps.

Setting up rules: put specific conditions first, then check FINAL

Rules in a configuration are typically evaluated from top to bottom, and the first matching rule determines how a request is handled. When adding a rule for a specific domain, check whether a broader condition above it might match first. FINAL handles requests that do not match any preceding rule and usually belongs at the end of the list. Save a copy before editing, then enable the configuration and test one known destination. Check the results against the connection records.

DOMAIN-SUFFIX,example.com,PROXY
IP-CIDR,192.168.0.0/16,DIRECT
FINAL,DIRECT

These snippets illustrate the syntax; they are not a complete configuration. The first routes a domain suffix through PROXY, the second sends a specified private address range through DIRECT, and the last handles all remaining requests. Actual access to a local network can also depend on system routing, network permissions, and configuration options. If a rule behaves unexpectedly, check the match records first, then investigate whether DNS resolution or the address matching conditions are involved.

Configuration updates can also change rules. If behavior changes after updating a remote configuration, compare the rule order, policy names, and DNS settings before and after the update—not just the file name. For field definitions and protocol parameters, see the Protocol Reference. To set up your first connection, follow the Getting Started Guide.

03 · Connection details

Subscribe and SERVER: update sources and the selected server

A server is a set of connection details; a subscription is a source for updating those details. This section assumes you already have your own subscription or server information. Check servers in the SERVER list on Home. To enter details manually, open Add Server, select Type, and enter the address, port, authentication, and transport settings provided by your service. To import an existing subscription, select Subscribe in Add Server, enter your subscription URL, save it, and wait for the list to load.

Setup: confirm the type, then check the settings

Shadowsocks, VMess, VLESS, Trojan, HTTP, SOCKS5, WireGuard, and Hysteria2 require different fields. Filling in only the address and port does not mean the configuration is complete; also check authentication, TLS, server name, and transport settings. If you have a QR Code or share link, use the corresponding import option, then verify that Type and the key fields match the original details.

A successful subscription update means the details were retrieved and parsed; it does not mean every listed server is currently reachable. After updating, return to SERVER and check the number of entries, their names, and the selected server. Then run Connectivity Test and try accessing a destination. If an expected entry is missing, first confirm that the subscription URL is complete and valid, and that the current network can reach it. Changing Global Routing repeatedly is not a substitute for checking the source.

What to watch for: don’t confuse Subscribe with Config

Subscribe is mainly for maintaining server details. Config may also include routing, DNS, and other behavior settings, so the two are not interchangeable just because their links look similar. A subscription update may overwrite entries it manages; keep a record before manually editing them. Before deleting a subscription or server, check whether any policies in the active configuration still reference it, so you don’t leave a name pointing to a connection that no longer works.

Subscription URLs and share links may contain access credentials. Don’t share their full contents while troubleshooting. A one-time app purchase is not a service plan; Shadowrocket purchases and your existing connection details are managed separately. This site does not provide, sell, or recommend servers or subscriptions. The only way to get the app is through the App Store. Before buying, see the How to verify the official app guide.

04 · Connection triggers

On Demand: connect by condition, not a substitute for routing rules

On Demand triggers the system VPN connection when its conditions are met. Global Routing determines how requests are routed after the connection is established. Go to Settings → On Demand to check the main switch and configured conditions. Available options may vary by device; check the current app interface. First connect manually from Home and confirm the configuration works, then enable On Demand. This helps avoid mistaking a server problem for an automatic connection issue.

Setup: start with one scenario

First decide which network scenario should trigger a connection, then configure the relevant condition. Avoid adding several overlapping conditions at once. After saving, switch to the network in question, check the connection status on Home, and visit a fixed destination. Record the Wi-Fi or cellular network, Global Routing mode, and server used during the test so you can assess automatic connection and request routing separately.

If the connection comes back after you turn it off manually, first check whether On Demand conditions were met again; this does not necessarily mean the switch failed. To temporarily stop automatic connections, adjust On Demand first, then turn off the connection on Home. Reconnecting when the network changes depends on system scheduling, network quality, and server status. Enabling this feature does not guarantee an uninterrupted connection or that all background requests will complete immediately.

05 · Usage records

Data: check the reporting range before interpreting changes

Data shows traffic and related statistics recorded by the client; it is not a billing record from your service provider. Open Data and first check the reporting and time ranges and categories shown, then compare uploads and downloads. If the page offers a reset option, record the current readings before resetting so you don’t mistake the new values for historical totals.

How to use it: compare the same time period

When investigating a rise in traffic, pause large transfers and background sync first, record a baseline, then perform one specific action and observe the change. To determine whether a type of request is going direct, check Global Routing, rule matches, and connection records together; a rise in total traffic alone is not enough to draw a conclusion. Check the labels currently shown in Data to see which categories are included and what each one means.

Client counters, system network statistics, and service provider statistics may use different sampling periods, protocol overhead, and calculation methods. Differences do not automatically indicate a problem. Data also cannot confirm whether a subscription has expired or how much usage remains; check the account records for your existing service. If traffic rises unexpectedly, review activity and requests before and after testing, then rule out background downloads and sync tasks one at a time.

06 · Everyday options

Settings: DNS, test methods, widgets, and sync

These settings address different issues. Record the original value before making changes, and change one setting at a time. The available options and where to find them depend on the current app interface.

DNS

Check DNS settings alongside request routing

DNS translates domain names into addresses. If a website won’t open, check for DNS resolution failures separately from server connection failures. First review the DNS settings active in the current Config, then check the related options in Settings. The configuration file and app settings may both affect DNS behavior; changing just one setting does not mean all requests use the same resolution path.

Before making changes, record the original value, visit a known domain, and check the results in Diagnostics or the connection records. Change one DNS setting at a time and test again; avoid changing the routing mode, server, and DNS simultaneously. Successful DNS resolution does not guarantee that the connection will work. Also check that the destination is reachable, the rule policy is correct, and the server name matches the TLS settings.

Test Method

Different test methods produce results you can’t compare directly

Test Method determines how Connectivity Test checks a connection. Select a method available in the current interface under Settings → Test Method, then return to Home and run Connectivity Test. If you can choose a test destination, confirm that it is reliably reachable and note the selected method and network environment.

A successful test means the test conditions received a response; it does not mean every website or app request will work. To compare servers, keep the test method, destination, and network the same, then try accessing the destination directly. If one method fails but access works, check the test destination and how the test works before deleting server details based on a single result.

Today Widget

A widget is a shortcut, not a live status page

Today Widget configures the shortcuts or information provided by the system widget. Check the Today Widget options in Settings, then use the system’s widget editor to add items supported by the current device. Available content and placement depend on the interface offered by the app and system.

Select a server and verify the connection in Home before using the widget as a shortcut. The system may limit how often widgets refresh. If you see an outdated status, open the app to confirm rather than tapping repeatedly to force an update. A widget does not replace Config and cannot confirm on its own which rule a request matched.

iCloud

Check what syncs and keep a copy before making changes

iCloud features can save or sync app data in supported device and account setups. First check available iCloud storage and the app’s access permissions in system settings, then review the iCloud options in Settings. Check the current interface to see which data is included in sync.

Sync does not guarantee that every configuration can be restored automatically. Save a recoverable copy before important changes, and check Config, the server list, and connection results on a new device. Synced data may include connection credentials, so protect your account access and device passcode. App purchases are managed by the App Store and are separate from configuration data stored in iCloud.

07 · Troubleshooting

Diagnostics: gather details before changing settings

Diagnostics is where you check runtime information and troubleshooting clues; it is not an automatic repair button. Open Diagnostics in Settings and review the available checks. Compare them with the connection status on Home, Connectivity Test, and relevant records to distinguish server connection, DNS resolution, rule matching, and destination access issues. Each diagnostic result answers a different question; passing one check does not replace full testing.

Troubleshooting: create a repeatable, minimal test

Note the current network, selected server, Global Routing mode, and active Config.
Choose one specific destination, run a single test, and save the error details and relevant records.
Change just one variable—for example, temporarily switch from Config to Proxy and visit the same destination.
Compare the diagnostic records to see what changed. When done, restore the original mode and undo the change if needed.

If the same server fails with multiple destinations, first check the address, port, authentication details, and whether the service is active. If only Config mode fails, check the rules and policies first. If domain resolution fails, check DNS separately. If the current network cannot provide reliable basic access, fix the network issue before continuing to troubleshoot the client.

More settings don’t necessarily mean better results. Issues that can be reproduced on a fixed network, with a fixed destination and one setting changed at a time, are usually easier to diagnose. If you still can’t access the internet, see Can’t access the internet even though the connection is on? A step-by-step checklist, and check the server, mode, DNS, and rules in order.

Settings FAQ

Why does the system still show a VPN status after I select Direct?

Direct selects a request route in Global Routing; it does not disconnect the VPN. To stop the current connection, turn off the switch in Home and check whether On Demand will trigger it again. Check the mode, rules, and connection records to see whether requests went through a proxy; the status bar alone can’t tell you.

A rule change didn’t work. What should I check first?

First confirm Global Routing is set to Config and that you edited the active configuration. Then check the rule order, whether a broader condition appears above it, whether the policy destination is valid, and how FINAL is set. If needed, establish a new test connection so you’re not still observing a connection made before the change.

Why does Connectivity Test still fail after a successful subscription update?

Retrieving a subscription and connecting to a server are separate steps. First check the selected server’s settings and whether it is active, then verify Test Method, the test destination, and the current network. Finally, try accessing the destination directly to determine whether the test conditions are limited or the connection itself is failing.

Will my purchase and configuration both be restored when I switch devices?

Purchase records and configuration data are managed separately. First check the original purchase in the App Store, then restore your data using the sync or backup method you actually enabled. Check the App Store product page for compatibility and system requirements. After restoring, review your servers, Config, and On Demand conditions.