Shadowrocket is available for iPhone, iPad, Mac (Apple silicon and Intel), Windows, Android, and Linux. The menu paths below focus on iPhone and iPad. Menus and system permissions may differ on other platforms, so look for the same feature names in your version.
Global Routing: Config, Proxy, and Direct
Config, Proxy, and Direct control how traffic is handled overall; they are not three different servers.
What it does: Global Routing sets the overall traffic handling mode. Config applies rules from the currently selected configuration; Proxy sends traffic handled by the app through the proxy policy; Direct connects directly. For everyday routing by domain or IP, start with Config—not Proxy, which is not simply a more complete ruleset.
Where to find it and how to set it: Find Global Routing on Home and choose a mode. Before using Config, check which configuration is selected in Config. Before using Proxy, confirm on Home that the selected server connects. Change one mode at a time and test the same destination so you can identify the effect of each change.
| Option | How it works | When to use it | Check first |
|---|---|---|---|
| Config | Handles requests using the rules and policies in the selected configuration. | Everyday routing and checking how a specific domain or IP is handled. | Selected configuration, rule order, and final matching policy. |
| Proxy | Routes traffic handled by the app through the proxy policy. | Temporarily checking rule differences or basic server connectivity. | Selected server, authentication details, and whether the destination is reachable. |
| Direct | Connects directly to destinations for traffic handled by the app. | Comparing behavior on the local network to see whether the proxy route is involved. | Local network, DNS, and the destination service's status. |
Keep in mind: These modes do not replace system VPN permissions or guarantee that all system traffic is handled by the app. If a destination works in Proxy but fails in Config, check the rules and policies first. If it also fails in Direct, check the local network or destination service. After troubleshooting, restore your usual mode so temporary settings don't keep affecting traffic.
For a side-by-side explanation, see the three Global Routing modes.
Rule-Based Routing: Match Conditions and Policies
Rules determine what matches; policies determine what happens next.
What it does: Routing rules compare a request's domain, IP, or other available information with conditions in the configuration. When a rule matches, its associated policy is applied. DIRECT connects directly, PROXY uses a proxy policy, and REJECT blocks the request. If your configuration uses custom policy groups, also check which server or policy each group currently selects.
Where to find it and how to set it: Open the active configuration in Config and review its rules and their order. In general, put narrowly scoped, specific rules first and broader matches and FINAL later. Keep a copy of the original configuration before editing. Add a few rules and test them before expanding, so you can pinpoint problems instead of troubleshooting many changes at once.
| Keyword | What it matches | Notes |
|---|---|---|
DOMAIN | An exact domain name. | Use it to target a specific hostname. |
DOMAIN-SUFFIX | A domain suffix and its subdomains. | Check whether the rule also covers subdomains you don't intend to affect. |
DOMAIN-KEYWORD | A keyword in a domain name. | This can match broadly, so check for unintended matches before using it. |
IP-CIDR / IP-CIDR6 | IPv4 or IPv6 address ranges. | Matches depend on the actual destination IP, which can change with DNS resolution. |
GEOIP | A category in an IP geolocation database. | A database classification does not necessarily reflect where a service actually operates. |
USER-AGENT | Available User-Agent information. | Visibility is limited; this is not a general-purpose way to identify apps. |
FINAL | Requests not matched by any preceding rule. | Use as a fallback; don't place it ahead of specific rules. |
Minimal rule example
This example demonstrates rule-line syntax only; it is not a complete configuration to replace your existing file. example.com is a sample domain. Set the policy according to your configuration.
DOMAIN-SUFFIX,example.com,PROXY
GEOIP,CN,DIRECT
FINAL,PROXYKeep in mind: Rules are generally processed in order. A broad rule near the top can prevent a more specific rule below it from matching. Domain and IP rules also use different information: a domain rule alone does not guarantee the same result when an app connects directly to an IP. If routing doesn't match your expectations, first confirm Global Routing is set to Config, then check the connection log for the destination, matching rule, and final policy. Don't rely only on whether a page opens.
Protocols: Enter the Server Details
The protocol determines how the client communicates with a server; it does not decide which route a destination should take.
What it does: Shadowrocket can manage server entries using different protocols. The protocol type, authentication method, transport, and TLS settings work together to establish a connection. Entries with the same address and port are not necessarily equivalent. Available options depend on the platform and the features provided by the app.
Where to find it and how to set it: On Home, tap Add Server. Choose Type, then enter the details provided for your server. If you have a share link or QR code, use the matching import option. Get the server address, port, password or UUID, and transport details from your provider; don't guess based on how another entry looks.
For example, VLESS and VMess use different authentication fields; Trojan's password and TLS settings must match the server; and WireGuard keys, addresses, and allowed IP ranges each serve a distinct purpose. After importing, check Type and the key fields. Watch for extra spaces, missing parameters, and outdated details if your provider has made changes.
Keep in mind: Don't disable certificate verification just to get around a connection error. Check the device time, server name, and TLS settings first, then confirm the server is working. Protocol names are not a speed ranking; latency, throughput, and reliability also depend on the local network, server load, and destination service.
Subscribe and Server Management
Subscribe maintains the server list; Config defines how traffic is handled.
What it does: Subscribe imports and updates server details from a subscription URL. Individual server entries are useful for manually managing a small number of existing connections. A subscription, a server share link, and a full configuration file are different types of content. Don't paste them into the same field just because they are all links.
Where to find it and how to set it: On Home, tap Add Server, then choose Subscribe. Enter the subscription URL provided by your service provider and add a note to identify it. Save and update, then confirm that server entries appear and test one of them. For QR codes, follow the Scan QR Code instructions to identify the content, then check the imported fields after saving.
Three Checks After Importing
- Check the content type. An update should return the expected server list. If the link opens a sign-in page or error page, check that the URL is valid instead of creating the subscription again.
- Check the update result. A successful subscription update doesn't mean every server will connect. Test the specific entry you want to use.
- Check how entries are maintained. Subscription entries may be recreated during the next update. Before editing one manually, decide whether you need to save it as a separate entry.
Keep in mind: Subscription URLs may contain credentials that grant access to your account. Don't share them in public screenshots, chat logs, or diagnostic reports. If you suspect a URL has been exposed, get a replacement from your service provider and update it in the app. Before deleting duplicate subscriptions, check which group contains the server you've selected so you don't lose your current choice.
On Demand: Connect When Conditions Are Met
On Demand controls connection triggers; it does not replace Global Routing or rules.
What it does: On Demand uses the system's on-demand connection mechanism to start a connection when specified conditions are met. It operates separately from routing: On Demand determines when to connect, while Global Routing and configuration rules determine how requests are handled after connecting.
Where to find it and how to set it: Look for On Demand in Settings and configure the network conditions shown in your version. First confirm that a manual connection works, then enable on-demand conditions. If options are available for Wi-Fi, cellular, or specific networks, configure and test each one on the relevant network. Avoid adding many conditions at once.
A repeatable test sequence: note the current network and switch settings, join the network where you expect the connection to start, wait for the system to respond, then check the app's connection status and try accessing a destination. Switch to another network and confirm the result matches your expectations. Keep the same server and configuration throughout the test to limit variables.
Keep in mind: Turning off the main connection switch may not disable on-demand triggers. If the connection starts again after being disconnected, check the conditions in On Demand. System VPN permissions, other VPN configurations, and the timing of network changes can all affect the result. A VPN indicator in the system doesn't guarantee that a destination is reachable. If the connection keeps changing, disable On Demand and test manually before restoring conditions one at a time.
Data: Traffic Statistics and Routing Checks
Statistics show traffic that has already occurred; they are not a live speed guarantee or a provider's billing record.
What it shows: Data displays traffic information the app can record. Available views and metrics depend on the platform. Readings may cover different amounts of traffic when viewed by server, app, or connection. Consider upload and download directions, the reporting period, and whether statistics have been reset; don't compare just one cumulative figure.
Where to find it and how to use it: Open Data and confirm the current metric. Note the existing reading, then perform one small, clearly defined action—for example, open the same webpage or transfer a file of known size. Check the change afterward and use the destination, rule, and policy in the connection log to see whether traffic was handled as expected.
To compare two servers, use the same local network, destination, and similar test conditions, changing only the server each time. App identification depends on the platform and what traffic is visible; an app not appearing by name doesn't mean it generated no traffic. Background sync can also increase readings, so check for other activity before testing.
Keep in mind: App statistics may differ from system or provider statistics because of differences in coverage, connection overhead, and reporting periods. Before resetting anything, record the current readings and check which data the reset affects. Don't assume disconnecting automatically resets the totals. If traffic looks unusual, check persistent connections and background activity first, then decide whether to adjust rules.
For a detailed walkthrough, see the Data traffic statistics guide.
Settings: Common Options and Troubleshooting
Keep a working baseline and change one setting at a time.
Settings brings together connection, testing, display, sync, and diagnostic options. The sections below explain what each setting does; its location and availability depend on your version of the app. Record the original value before making changes. When troubleshooting, first determine whether the problem affects one destination or all destinations, then choose what to check.
DNS: Tell Resolution Failures from Connection Failures
What it does and where to find it: DNS translates domain names into IP addresses. Look for DNS-related options in Settings, and check whether the selected Config includes DNS settings. How these two sources of settings work together depends on the selected configuration and the app's documentation.
How to set it and what to keep in mind: Keep the current DNS settings and note which domains fail. Check whether the issue affects domain names only. If you need to change a setting, change just one DNS-related option at a time, then compare the resolution result with the connection log. Clearing the cache is not a long-term fix. Changing DNS, rules, and servers all at once makes it hard to identify the cause, even if access is restored. For IPv6, also check whether the local network and server route support the relevant addresses.
Test Method: Understand What Connectivity Test Measures
What it does and where to find it: Test Method selects how Connectivity Test runs. Look for the option in Settings. The result reflects a specific probe under specific conditions, not the actual loading time of every website.
How to set it and what to keep in mind: Use the same Test Method when comparing servers. If the method lets you choose a test destination, keep that the same too. Run Connectivity Test on an existing server from Home, then visit the service you actually need. A lower number doesn't guarantee faster downloads, and a timeout may be related to the probe destination. If the result doesn't match your browsing experience, check whether a connection was actually established instead of deleting a server based only on the test result.
Today Widget: System Shortcut and Status Check
What it does and where to find it: Today Widget provides a shortcut on systems and app versions that support it. Look for related options in Settings, then configure it in the system's widget management screen.
How to set it and what to keep in mind: First select a server and configuration in the app and grant VPN permission, then add an available widget. After using the widget, return to Home to confirm the connection status if needed. System refresh behavior can affect what the widget displays, so its text alone can't confirm that a destination is reachable. If your system doesn't offer the widget, use the controls in the app.
iCloud: Keep a Local Copy Before Syncing
What it does and where to find it: iCloud supports data sync or import features where available. Look for sync options in Settings, and confirm you're signed in to the required system account and have allowed the app to use iCloud. Import from Cloud JSON imports specific content; it is not the same as updating a Subscribe entry.
How to set it and what to keep in mind: Before syncing, check which data the app says will be included and keep a copy of important configurations. Editing on multiple devices at once can cause conflicts or overwrite changes. If the data differs, stop editing and decide which copy to keep. Don't assume sync includes system VPN permissions, the current connection state, or every local setting; check each item after moving to another device.
Diagnostics: Use Logs to Narrow Down Problems
What it does and where to find it: Diagnostics collects or displays information useful for troubleshooting. Look for it in Settings. It can help identify whether a problem occurs during DNS resolution, connection, authentication, or a later request; it won't automatically fix incorrect settings.
How to use it and what to keep in mind: Note the current Global Routing mode, configuration, and server. Reproduce the issue once, then check the log entries from that time. Before sharing diagnostic files, redact subscription URLs, passwords, UUIDs, keys, and personal information. Turn off any detailed logging enabled just for troubleshooting when you're done, to avoid collecting unnecessary data.
Before You Continue
Confirm where to get the app, then follow the setup steps to connect.
Get the iPhone and iPad app from the App Store for a one-time purchase of $2.99; check the App Store listing for system requirements. The Mac (Apple silicon and Intel), Windows, Android, and Linux versions are free. Desktop and Android installers are available on this site under /dl/. See Get the App for platform options and the steps to allow the app to open for the first time.
After installing and importing your details, test the setup with one destination you can access repeatedly. Confirm that a manual connection works, then add rules, on-demand conditions, and sync one at a time. This makes the setup easier to maintain than changing several settings at once.