For everyday use, choose Config to let the active configuration determine how connections are routed. Proxy and Direct are better suited to temporary tests and troubleshooting. This guide uses Home → Global Routing on iPhone and iPad as its reference and is for users who already have their own provider subscription and want to understand routing modes and rules. Mac, Windows, Android, and Linux users can apply the same routing principles; menu locations vary by platform.
1. Global Routing vs. the Connection Toggle
Shadowrocket’s Global Routing setting controls how intercepted connections are handled; it is not the connection toggle. Choosing Proxy does not mean the proxy connection is working, and choosing Config does not guarantee that suitable routing rules are installed. To check whether everything is working, verify the connection status, active configuration, and policy applied to actual traffic.
Home is where you check the connection, select a node, and open Global Routing. Config is for managing configuration files, while Settings is for adjusting app preferences. These pages have different purposes. In particular, Config in Global Routing is a routing mode, whereas Config in the bottom navigation opens configuration management. They share a name but are separate controls.
If Scene is also shown, it is a separate, scenario-based option—not another name for Config, Proxy, or Direct. Unless you have a specific need for scene-based settings, start by testing the three modes covered here. Avoid changing scene conditions and rules at the same time.
2. How Config, Proxy, and Direct Handle Connections
Config
RecommendedRoutes connections according to the rules and policies in the active configuration. A match can send traffic DIRECT or to a proxy node or policy group. Connections that match no earlier rule are typically handled by FINAL. Config does not mean “use a direct connection if nothing matches.”
Best for: Everyday use when you need rules to route traffic by domain, IP address, or other criteria.
Proxy
Uses a proxy route for connections within its routing scope instead of applying ordinary routing rules to choose DIRECT or a proxy on a rule-by-rule basis. Whether a connection succeeds still depends on the selected node, network reachability, and protocol settings.
Best for: Briefly testing the proxy route or checking whether a rule selected the wrong policy.
Direct
Uses a direct route for connections within its routing scope. This is useful for checking whether the current network can reach a destination, but it does not turn off the app connection or guarantee that DNS and other settings return to system defaults.
Best for: Checking the local network, LAN resources, and direct connectivity.
“Global” does not mean that every type of packet on the device necessarily passes through a remote server. System routing, exclusions, DNS settings, and protocol capabilities can all affect what happens. Switching modes also will not fix an incorrect UUID, password, TLS setting, or server port. Don’t treat a mode switch as a universal fix.
3. Set Config for Everyday Use in Five Steps
These steps assume you already have a working subscription or node and a configuration file. This site does not provide, sell, or recommend nodes or subscriptions. A node list in a subscription and a rule set in Config are separate things: a successful node update does not mean your routing rules have been added or updated.
-
Check your node
Open Home, make sure your node list is not empty, and select a working node. If your configuration uses a policy group, check which option is selected within the group. A node appearing in the list does not by itself confirm that the proxy route works.
-
Check your configuration
Open Config and confirm that the configuration you intend to use is selected. Check that its rule targets correspond to existing policies, especially the proxy policy name and the destination set by FINAL.
-
Choose a routing mode
Go to Home → Global Routing → Config. This selects a routing mode; it does not re-import a configuration or automatically download rules suited to your network.
-
Connect
Return to Home and turn on the connection. The first time, follow the system prompt to allow adding a VPN configuration. If a public Wi-Fi network requires you to accept terms, sign in to the network first, then check the connection status.
-
Check your requests
Make one new request that should go direct and another that should use the proxy. Then check the connection log for the destination, matched rule, and policy. Don’t rely only on the VPN icon in the status bar to confirm that routing is correct.
Existing long-lived connections may not immediately switch to the new mode after you change Global Routing. When testing a browser, make a new request. For apps with persistent connections, close the connection and try again. Otherwise, what you see may reflect a session established before the change, not the new settings.
4. Config Results Depend on Rule Order and FINAL
Rules are generally checked from top to bottom, and the policy for the first match is applied. Put specific exceptions before broader rules and define an explicit fallback at the end. The syntax below illustrates rules; it is not a complete file ready to replace your configuration. PROXY in this example must refer to a proxy policy that is actually available in your current configuration.
[Rule]
DOMAIN-SUFFIX,example.com,PROXY
IP-CIDR,192.168.0.0/16,DIRECT,no-resolve
GEOIP,CN,DIRECT
FINAL,PROXY| Rule | What this example does | What to check |
|---|---|---|
DOMAIN-SUFFIX | Routes example.com and its subdomains to PROXY. | Enter the domain only—no https://, path, or port. |
IP-CIDR | Routes connections matching 192.168.0.0/16 to DIRECT. | This range does not cover every private address. no-resolve prevents this rule from actively resolving domain names. |
GEOIP | Matches CN using the IP geolocation database, then routes the connection to DIRECT. | This depends on the IP address and database result, not the webpage’s language. |
FINAL | Routes connections that did not match an earlier rule to PROXY. | Changing this to DIRECT also changes the outcome for unmatched connections. |
This is why two devices can both use Config and still get different results: their rule order, policy group selections, or fallback destinations may differ. When troubleshooting, compare the active configurations—not just the single word shown in Global Routing.
5. Compare Proxy and Direct by Changing One Variable
The key to a useful comparison is changing just one condition. Keep the network, destination, and node the same; note the result in Config, then briefly switch to Proxy or Direct. Don’t update a subscription, change DNS, or switch nodes at the same time, or you won’t know which change affected the result.
Compare routes: Test both paths with the same destination
Test with Proxy
- Path: Home → Global Routing → Proxy.
- Use the same node and make a new connection to the same domain.
- If Proxy works but Config does not, check whether Config matched DIRECT, another policy group, or an unavailable node.
- If Proxy also fails, check the node settings, current network, and server status.
Test with Direct
- Path: Home → Global Routing → Direct.
- Choose a destination that should already be reachable directly. Don’t use a restricted destination to test your local network.
- If Direct works but Config does not, check whether a rule is sending the connection to an unavailable proxy.
- If Direct also fails, first check Wi-Fi sign-in, the system network, and the destination itself.
When testing is done, return to Home → Global Routing → Config and verify the fix with a new connection. One test result can help narrow down the cause, but it is not enough to identify the problem on its own.
When recording a destination, distinguish its domain from its IP address. For example, HTTPS commonly uses destination port 443 and HTTP commonly uses port 80, but neither is necessarily the port used by a proxy server. Don’t change the server port in Add Server to 443 just because a webpage uses that port; the node port must match the details from your own provider.
6. Common Misconceptions: Subscriptions, DNS, and On Demand
Why can’t Config connect even though the subscription updated successfully?
Updating a subscription usually refreshes the node list; it does not ensure that every routing rule points to the right policy. First check the node in Home, then check the active file and policy names in Config, and finally review the matched rules for the failed connection. A successful update and a reachable route are two separate checks.
If I can connect after switching to Proxy, does that prove DNS is working?
No. Changing modes can change the connection route and related DNS behavior, so also check the resolved address, destination IP, and connection log. Accessing an HTTPS site by IP address can also cause a certificate/domain mismatch, so this is not a substitute for testing a request to the normal domain.
Does Settings → On Demand replace Config routing?
No. Settings → On Demand triggers connections based on system conditions; Global Routing determines how intercepted connections are routed. When troubleshooting automatic connections, note the current On Demand settings so you don’t mistake a newly triggered connection for a mode that failed to save.
Why might the VPN indicator still appear after choosing Direct?
Direct is a routing mode, not a button to turn off the tunnel. The system may continue to show VPN status while the app connection is enabled. To stop traffic interception, check the connection toggle in Home. If On Demand is also configured, review its automatic connection conditions as well.
Does switching to VMess or VLESS change what Config means?
No. Shadowsocks, VMess, VLESS, Trojan, Hysteria2, and WireGuard are protocols used for proxy connections; Config, Proxy, and Direct are routing modes. Incorrect protocol settings can make the proxy route fail, but they do not automatically turn Config into Direct.
7. Checklist Before Returning to Everyday Settings
After troubleshooting, restore any temporary changes and leave the setup in a state you can use day to day. Config is recommended when the active rules meet your needs and the proxy policy works—not simply because selecting Config means you can ignore the configuration. Fix rule-related issues in the rules; if the node is the problem, check the details from your own provider. Don’t mask the cause with a permanent global mode change.
- Home → Global Routing is set back to Config, and the connection status is as expected.
- The correct file is selected in Config, FINAL has a clearly defined destination, and every policy name points to an available target.
- New direct and proxy test connections match the expected rules and policies.
- Review any DNS, node selection, or Settings → On Demand changes made during troubleshooting.
- When contacting your provider, share only the error details they need. Don’t disclose subscription links, tokens, or full credentials.