Shadowrocket Glossary: App Terms, Protocols & Rules | Shadowrocket Hub

Find terms by setting and purpose

English terms are kept as they appear in the app. Uppercase rule keywords and title-case interface options are explained separately to avoid confusing routing modes with rule actions.

App settings

Check the mode and connection target first

The page determines where to make changes; the connection mode determines how traffic is handled; test tools provide a snapshot of connectivity.

Home: Home is the main screen for viewing server entries and subscription groups and choosing a connection. A server appearing in the list only means its details have been imported; it does not mean a connection is active. Before connecting, make sure the selected item and Global Routing mode match your intent.

Global Routing: Global Routing determines how the client handles traffic. Common options are Config, Proxy, and Direct. To route traffic by rules, select Config and confirm the active configuration. If rules are not taking effect, check this setting first before repeatedly editing them in another mode.

Config: In Global Routing, Config means connection handling follows the rules in the active configuration. As a page name, Config is where configuration files are managed. The two are related but are not the same entry point. Downloading a configuration file is not enough: make sure it is selected, then check the final rule and policy references.

Proxy / Direct: Proxy is the proxy mode in Global Routing, while Direct connects without a proxy. Use them to compare connection paths. Do not confuse these interface labels with the uppercase PROXY and DIRECT keywords in rules. After temporary troubleshooting, switch back to Config if you need rule-based routing, then test the target request.

On Demand: On Demand settings trigger connections when supported network conditions are met. They do not update subscriptions or fix incorrect server parameters. If a connection starts again after you turn it off manually, check this setting and the system VPN settings. Available conditions and menu locations vary by platform.

Add Server: Add Server is for manually entering server details you already have. The protocol, server address, port, authentication, and transport parameters must all match; entering an address alone does not complete the setup. Keep the original details before making changes, and distinguish the server address from the server name used for TLS.

Connectivity Test: Connectivity Test checks whether an item can connect. Results depend on the test method, target, and current network. A successful test does not mean every website or app is accessible, nor does it confirm that every rule matched. Check the actual request and diagnostic logs to confirm how the connection was handled.

Latency: Latency is the time a test request takes to receive a response, usually measured in milliseconds. A lower figure does not mean faster downloads; throughput also depends on bandwidth, congestion, and remote server load. For meaningful comparisons, use the same network and test method at similar times. If a test times out, investigate the cause.

Proxy protocols

Check the protocol, transport, and security layer separately

A protocol name is not a complete set of connection parameters. The descriptions below explain technical roles only; enter the details provided for your existing server.

Shadowsocks: Shadowsocks is a proxy protocol. A connection typically requires a server address, port, password, and encryption method. Both ends must use the same encryption method; do not replace it with an option simply because it seems newer. If the connection fails after import, check these basic fields first, then confirm the remote port is reachable.

VMess: VMess uses parameters such as a UUID to identify the user, and must match the server configuration. Depending on the connection details, it may also require a transport method, path, Host, and TLS settings. Even a correct UUID will not work if the transport settings differ. Compare each field rather than checking authentication alone.

VLESS: VLESS uses credentials such as a UUID for authentication, but does not encrypt payloads on its own. Understand the security layer and transport in the context of the actual deployment. Changing a VMess entry's type to VLESS does not necessarily make it work. Check all server-provided parameters instead of guessing the TLS or other settings from the protocol name.

Trojan: Trojan commonly uses TLS with password authentication to establish a proxy connection. The server address, port, password, and server name must match the remote configuration; certificate verification failures can also interrupt a connection. Check the parameters and device time first. Disabling certificate verification should not be the default fix.

Hysteria2: Hysteria2 is a QUIC-based proxy protocol that requires UDP connectivity on the current network. Enter authentication, TLS, and other connection parameters as specified by the server; the protocol name alone is not enough to infer them. If results change when you switch networks, check UDP reachability and network restrictions rather than repeatedly changing the password.

WireGuard: WireGuard connects using key pairs and tunnel parameters, commonly including a peer address, public key, and tunnel address. Keys are not ordinary passwords, and public and private keys have different roles. Protect the private key when importing or backing up a configuration. Check address ranges and routing settings as well as the peer address.

HTTP / SOCKS5: HTTP and SOCKS5 are proxy protocols with different connection negotiation and authentication methods. Their names alone do not guarantee that the connection between the client and proxy server is encrypted; check the security settings separately. HTTPS between your device and a website is a separate matter from encryption on the proxy connection.

TLS: TLS is a security layer for connection encryption and authentication, not a Global Routing mode. The connection address, server name, and identity on the certificate may be separate fields, but they must match the server configuration. For handshake errors, check the device time, server name, and certificate parameters before treating the issue as a connectivity problem.

Rule keywords

Match conditions first, then apply the action

Rules are usually checked from top to bottom. A broad rule placed too early can prevent more specific rules below it from taking effect.

Rules: A rule typically contains a match type, a match value, and an action to determine how a request connects. Rules are generally evaluated in order, and the first match determines the result. When troubleshooting, check the rule content, its position, and the current routing mode—not just whether the target domain appears in the file.

DOMAIN / DOMAIN-SUFFIX / DOMAIN-KEYWORD: DOMAIN matches an exact domain, DOMAIN-SUFFIX matches a domain suffix, and DOMAIN-KEYWORD matches a keyword in the domain. A suffix rule can cover the domain and its subdomains, while keyword matching may have a broader scope. Enter only the required domain or keyword; do not include a full webpage path as a domain.

GEOIP: GEOIP matches the target IP according to its location in a geolocation database. It does not identify the webpage language or the user's current location. Results may vary with the database and target address; for domain requests, also consider the resolved IP. If a domain needs a fixed action, consider a more specific domain rule placed earlier.

IP-CIDR / IP-CIDR6: IP-CIDR matches IPv4 address ranges, while IP-CIDR6 matches IPv6 address ranges. The prefix length after the slash defines the range. An incorrect prefix can make the range too broad or too narrow; it is not a port number. When troubleshooting dual-stack connections, check IPv4 and IPv6 rule coverage separately.

FINAL: FINAL is the fallback rule used when none of the earlier rules match, and usually belongs at the end of the rule list. It still needs an action, such as PROXY. Check the preceding rules to confirm the fallback behaves as expected; placing FINAL too early can affect later matches.

PROXY / DIRECT / REJECT: These uppercase keywords specify what to do when a rule matches: PROXY sends traffic through a proxy, DIRECT connects directly, and REJECT blocks the connection. They are actions, not match conditions or protocol names. For custom policy groups, check which item is actually selected within the group; the action name at the end of a rule may not reveal the final route.

DNS: DNS resolves domain names to IP addresses, a step that happens before many connections. A resolution failure and a proxy handshake failure occur at different stages. The DNS resolution path should not be assumed to be the same as the path used for the subsequent connection. For issues affecting specific domains, check the resolution result, cache, and rule logs in turn.

URL Rewrite: URL Rewrite changes a request URL when specified match conditions are met, for example by redirecting a matching address to another one. It serves a different purpose from rules that select proxy or direct routing, and does not allow arbitrary changes to encrypted request content. If you only need rule-based routing, there is no need to add rewrite settings from an unknown source.

Example rule structure: the left side is the match condition, and the end specifies the action. This illustrates syntax only; it is not a complete configuration for every device.

DOMAIN-SUFFIX,example.com,PROXY
GEOIP,CN,DIRECT
FINAL,PROXY

Continue reading: Proxy mode and rule-based routing ›

Subscriptions & configurations

Distinguish server lists from local settings

Subscriptions update connection details; configurations determine how traffic is handled. Syncing, restoring purchases, and updating subscriptions each deal with different data.

Subscription / Subscribe: A subscription retrieves and updates a set of server details. Get its URL from your own service provider. It may contain sensitive account credentials, so do not share screenshots or paste it into discussion forums. After adding it, check that the list is populated and the entries look right. A subscription is not a complete rule configuration.

Server / SERVER: A server entry is a set of connection parameters, typically including an address, port, protocol, authentication, and optional transport settings. The display name is just a label; changing it does not alter the remote address or connection capabilities. Entries can be added manually or imported from a subscription, but their maintenance and update methods may differ.

Configuration file: A configuration file can store rules, DNS, policies, and other settings; a subscription primarily provides a server list. After importing a file, check that it is selected and that its policy names correspond to available items. Keep a copy of the current working configuration before replacing it so you can restore the previous settings if something goes wrong.

Subscription update: A subscription update reloads the same URL and syncs the latest details provided by the service provider. Manual changes to subscription entries may be overwritten by a later update, so first determine whether you are editing a standalone entry or subscription content. If an update fails, check the network, URL, and service status. Avoid repeated imports that create duplicate groups.

Scan QR Code: Scan QR Code reads connection details encoded in a QR code. It may contain a single server or other supported content. Successful scanning only means the content could be read; it does not confirm that the parameters are correct or the server is available. Check the type and fields before and after importing, and treat QR codes containing authentication details as sensitive.

iCloud sync: iCloud sync transfers supported data between Apple devices, usually with the same Apple Account and the relevant permissions enabled. It does not refresh subscriptions or replace App Store purchase records. Before switching devices, check the purchasing account, what can be synced, and your local backup separately. Do not assume every connection state will be restored automatically.

Store & account

Keep app downloads separate from connection services

These App Store terms mainly apply to iPhone / iPad. For other platforms, download Shadowrocket from the download page on this site.

App Store storefront and account region: The App Store storefront is determined by the region of the Apple Account used for purchases. It affects app availability, displayed currency, and available purchase options. It is separate from the device language, current location, and proxy exit location; changing networks does not change the storefront. Check the App Store listing for system requirements. If the app does not appear in search, first verify the storefront region and product details.

Verify the official app: On iPhone / iPad, check that the App Store listing shows developer Shadow Launch Technology Limited, the official icon, and app ID 932747118. A similar name does not mean it is the same product; verify all three details. For Mac, Windows, Android, and Linux, download the installer from this site's download page at /dl/shadowrocket/ and follow its instructions for allowing the app to run.

One-time purchase: The iPhone / iPad app costs $2.99 as a one-time App Store purchase. The Mac / Windows / Android / Linux versions are free; actual prices may vary by storefront. Buying the app does not include a proxy service plan or provide a server or subscription. To restore an iPhone or iPad purchase, use the original purchasing account. Connection details must be imported or restored separately.

Purchased: Purchased is the App Store record of apps associated with a purchasing account, used to find and redownload Shadowrocket when switching devices or reinstalling it. It records the app purchase, not server lists, subscription URLs, or rule configurations. If the app is missing, first check that you are using the original purchasing account, then review your purchase history and relevant display settings in the App Store.

For help with storefront regions, purchase history, or moving to a new device, see the App Store guide. If an existing entry cannot connect, use Troubleshooting to identify whether the issue is with importing, DNS resolution, the handshake, or rule matching.

Back to categories ↑