Shadowrocket Glossary: Interface, Protocols & Rule Keywords

Interface & Controls

Separate where you make a change from how connections are handled. Pay particular attention to the context around Config, Proxy, Direct, and uppercase rule policies.

Home: Home is the main screen for viewing server entries, selecting a connection, and controlling the primary connection switch. First confirm that the list contains a usable entry, then check Global Routing, and finally turn on the connection. Seeing an entry in the list does not mean the VPN is connected. Results also depend on the selected server, active configuration, and network status.

Global Routing: Global Routing determines how connections are handled globally. Common options are Config, Proxy, and Direct. Config processes connections according to the active configuration rules; Proxy primarily uses the selected proxy; Direct primarily connects to destinations directly. Before troubleshooting routing results, check this setting to make sure you're not testing in a different mode than the one you intended.

Config: Config has two common meanings: as a screen name, it refers to managing configuration files; as a Global Routing option, it means processing connections according to the configuration. Importing a file and selecting it are separate actions. After saving, confirm that the intended configuration is active. When following a guide, check whether it refers to the screen or the mode rather than relying on the name alone.

Proxy: Proxy is a Global Routing mode that primarily sends connections through the currently selected proxy. It is not a server protocol and does not mean the server has passed a connectivity test. Unlike PROXY in a rule, Proxy controls the overall routing mode, while the rule keyword specifies what happens when that rule matches.

Direct: Direct is a Global Routing mode that primarily connects to destinations directly. It can help compare direct access on the current network. Selecting it does not remove the VPN configuration from the system, nor does it indicate whether the primary connection switch is off. To pause the client connection, check the switch on Home separately.

On Demand: On Demand is a feature that triggers a VPN connection when configured conditions are met; it is not a server protocol. When enabled, qualifying network requests may trigger another connection. If the connection comes back after you stop it manually, check the relevant conditions first. Before changing them, decide when you want a connection to start, then test each change separately.

Add Server: Add Server is the entry point for manually adding server details. Select the correct type based on the information you have, then enter the address, port, and authentication parameters. Required fields vary by protocol, so don't reuse one set of parameters for a different type. If any details are missing, check the original source first. Avoid sharing server addresses, passwords, or other authentication details in public screenshots.

Data: Data shows traffic recorded by the client; refer to the current app screen for the specific statistics shown. These figures use the client's own measurement and are not the service provider's quota or billing records. When comparing readings, check the time range, whether the counter was reset, and the traffic used during the connection. A single reading can't establish whether a charge is incorrect.

Settings: Settings contains app preferences and behavior options, which are separate from the configuration contents in Config. Before changing anything, note the original value and confirm whether the setting affects the whole app or only the current configuration. For troubleshooting, change one setting at a time and retest the same destination to identify what changed the result.

Protocols

A protocol defines how the client communicates with a server. Support for a protocol does not mean every address and set of authentication details can be used together.

Shadowsocks: Shadowsocks is an encrypted proxy protocol. Common parameters include the server address, port, encryption method, and password. The encryption method must match the server; a correct address alone may not be enough to connect. After importing an existing entry, check that all parameters are present, and don't mix up its password or encryption method with authentication fields for another protocol.

VMess: VMess is a proxy protocol that typically uses a UUID as part of its authentication, along with specific transport settings. In addition to the address and port, you may need to check TLS, the transport path, and Host. A valid UUID does not mean the other fields can be left blank; use the complete server details you already have.

VLESS: VLESS is a proxy protocol whose authentication ID, transport, and security settings must each match. The protocol name alone does not tell you whether a connection is encrypted, and it doesn't replace checking security settings such as TLS. If a connection fails, compare the imported fields with the original details, then check the network. Don't keep changing the UUID without checking the other settings.

Trojan: Trojan is a proxy protocol commonly used with TLS. The server password and certificate verification settings must match. The server address and the name used for certificate verification may serve different purposes, so follow the original details when entering them. For certificate errors, check the name, device time, and certificate status rather than routinely disabling verification.

Hysteria2: Hysteria2 is a QUIC-based proxy protocol that depends on UDP support from the network. A connection may time out despite correct authentication details if the current network or server does not allow UDP traffic. Fields with the same name in other protocols may mean something different; use the parameters for the selected protocol when importing and checking an entry.

WireGuard: WireGuard is a key-based tunneling protocol. The local and peer keys, addresses, and endpoint details must be paired correctly. A private key is sensitive: don't confuse it with a public key used for verification or share it publicly. After importing a configuration, check the addresses, routing ranges, and DNS settings. A successful handshake alone does not mean every destination is reachable.

Rule Keywords

Rules specify a matching condition, then a policy for handling the connection. They are generally evaluated in order. A broad condition placed too early can prevent later, more specific rules from taking effect.

DOMAIN: DOMAIN matches an exact domain name. For example, DOMAIN,example.com,DIRECT applies only to the specified domain. It does not automatically include subdomains such as www.example.com, and it doesn't match URL paths. To cover a domain and its subdomains, learn about the scope of DOMAIN-SUFFIX.

DOMAIN-SUFFIX: DOMAIN-SUFFIX matches by domain suffix. Entering example.com covers that domain and its subdomains. Enter only the domain—not the URL scheme or page path. When checking a rule's scope, consider all services under the domain to avoid changing how every subdomain is handled just to affect one page.

DOMAIN-KEYWORD: DOMAIN-KEYWORD checks whether a domain contains a specified string, usually matching more broadly than an exact domain rule. The same string may appear in unrelated domains, so it is not reliable proof that a domain belongs to a particular website. If you only want to handle one known domain, use a more specific condition.

GEOIP: GEOIP uses an IP geolocation database to determine the region associated with a destination IP, as in GEOIP,CN,DIRECT. It does not check a webpage's language, an account's region, or the website operator's location. Database entries, DNS results, and content delivery networks can all affect the match. Check connection records rather than inferring the result from a website's name.

IP-CIDR: IP-CIDR matches destination IPv4 addresses using CIDR notation, for example IP-CIDR,192.0.2.0/24,DIRECT. This address is for documentation only. The prefix length after the slash determines the range; it is not a port number. IPv6 addresses use the corresponding IP-CIDR6 rule. Before editing, confirm the address type and network boundary.

FINAL: FINAL is the fallback rule used when none of the preceding rules match, for example FINAL,PROXY. It usually belongs at the end of the rule list, since an early fallback can prevent later conditions from being evaluated. If many connections reach FINAL, check whether earlier conditions are too narrow or misspelled, and confirm that Global Routing is set to Config.

PROXY: PROXY is a rule policy keyword that sends matching connections through a proxy. The specific exit depends on the current selection and configuration. The keyword itself does not include a server address or authentication details, nor does it guarantee availability. Don't confuse this uppercase rule policy with the Global Routing Proxy mode: a rule policy takes effect only when its rule is evaluated and matches.

DIRECT: DIRECT is a rule policy keyword that connects directly to the destination when a rule matches, without using a proxy server for that connection. Whether direct access succeeds still depends on the network, DNS results, and destination service. It does not turn off the entire client; other connections in the same configuration may use different policies.

REJECT: REJECT rejects connections that match a rule; it does not mean “retry through another route.” If the condition is too broad, it may also block legitimate requests for sign-in, images, or app APIs. If one feature fails, check whether a reject rule matches, then narrow its scope. Avoid deleting the entire configuration as a first step.

Subscriptions & Configurations

Subscriptions update server entries; configurations define connection behavior. First identify which information you need, then choose the appropriate import and troubleshooting steps.

Server entries: A server entry is a set of addresses, ports, protocols, and authentication parameters saved by the client. It's also commonly called a node. The name shown in the list is just a label; it doesn't establish the server's actual location, speed, or availability. Before editing an entry, check whether it was added manually or managed by a subscription, since a later subscription update may overwrite managed entries.

Configuration files: A configuration file describes rules, DNS, and related connection behavior; it is not the same as a subscription containing server entries. Importing a configuration does not necessarily provide a usable server, and importing a subscription does not set up rules. Before use, check the configuration's source, contents, and suitability for your needs. In Config, confirm which file is active so you don't save a file without selecting it.

DNS: DNS resolves domain names to IP addresses and is an important step before connecting to a destination, but successful resolution does not guarantee a successful connection. Check the DNS resolution route and the route used for the actual connection separately; an IP result alone doesn't show where traffic exits. When troubleshooting, distinguish between a domain that won't resolve, an unexpected resolution result, and a connection that times out, then adjust the relevant setting.

Connectivity Test: Connectivity Test checks server reachability using the selected test method; the displayed time applies only to that test. Lower latency does not mean higher download speed, and one successful test does not mean every website or service will work. For a useful comparison, keep the test method and network consistent, then verify access to the actual destination rather than relying on one number.

App Store & Purchases

Purchase records determine whether you can get the app. Server and subscription details are separate; check both separately when moving to a new device.

App Store: The App Store is the only place to buy and get Shadowrocket. iPhone and iPad users should verify the app details on its product page. Availability depends on the store region for your current account. If search results show similarly named apps, check each detail carefully. Compatible devices and system requirements are as listed on the App Store page. Before getting the app, read the official purchase and download guide.

App ID: Shadowrocket's App Store app ID is 932747118, shown as id932747118 in the product page URL. To verify the app, also check the developer, Shadow Launch Technology Limited, and the official icon; a similar name alone isn't enough. The app ID identifies the product, not an account or subscription credentials.

One-time purchase: A one-time purchase pays for the right to use the client app. The US storefront price is about $2.99; prices appear in local currency in other storefronts, and the App Store page shows the current amount. A one-time client app purchase ≠ a service plan. Buying the app does not automatically include a server or subscription. Get any subscription you already have from your service provider and import it separately using the setup guide.

Purchased: Purchased refers to apps associated with an App Store purchasing account. You can use this record to get the app again when changing or reinstalling a device. First, make sure you're signed in with the Apple ID used for the purchase, then look for the app in the account's apps or purchase history. The exact menu name depends on the device. Getting the app again is separate from restoring subscriptions or configurations; see the guide to restoring purchased apps.

Continue with a task

Once you've confirmed the terms, return to the relevant steps and check your settings. For rules, first check Global Routing and the active configuration, then compare rule order and match results.