For everyday use, select Config, then check your rules and selected server. Switch to Proxy or Direct only for temporary troubleshooting. Change one setting at a time.
Available for iPhone, iPad, Mac, Windows, Android, and Linux. The steps below use the iPhone and iPad interface; on other platforms, look for the same feature names in the corresponding interface. Options and availability depend on the current client.
A single switch does not determine how Shadowrocket handles a connection. Global Routing sets the overall handling mode; rules in Config determine which policy applies to each request; the server selected in Home provides the actual route for connections that need a proxy. Each has a separate role: changing servers will not fix incorrect rules, and updating a subscription does not switch the active configuration.
Before you begin, have your own subscription or server details ready. This site does not provide, sell, or recommend servers or subscriptions. The one-time app purchase is separate from any service plan; the app's price has no bearing on whether your existing service is available.
Config means configuration, Proxy means proxy, and Direct means direct connection. These explanations are in plain English; select the options by their exact English names in the app.
What it is: Global Routing selects the overall routing mode; it does not set the server protocol. Where to find it: Look for Global Routing in Home. How to use it: Select Config for everyday rule-based traffic handling. Use Proxy or Direct briefly when comparing proxy and normal network behavior.
| Mode | How it works | When to use it | What to check |
|---|---|---|---|
| Config | Uses the rules in the active configuration to determine how each connection is handled. | Everyday rule-based routing; choose how traffic is handled by domain or address. | Check that the active configuration is correct, rule order makes sense, and policy targets are available. |
| Proxy | Handles traffic managed by the client in proxy mode. | Temporarily check whether a problem is related to traffic rules. | Check whether the selected server can connect. This mode does not route all device traffic. |
| Direct | Handles traffic managed by the client in direct mode. | Temporarily compare the normal network path with the proxy path. | Check whether the destination is reachable over the normal network. This mode does not turn off the connection switch. |
What to watch for: If a site works in Proxy but not in Config, first check which rule matched and which policy it uses. Treat this as a troubleshooting clue, not proof of a configuration error: DNS resolution and existing connections can also affect the result. After changing modes, make a new request; if needed, close the old connection and compare under the same conditions.
When troubleshooting is done, restore your usual mode. Leaving Proxy enabled can change your normal routing behavior; leaving Direct enabled may send requests that need a proxy over the direct connection. Changing modes cannot fill in missing server details; TLS, transport, and authentication settings must still be correct.
First identify the rule that matches a request, then check the policy assigned to it.
DOMAIN matches an exact domain. DOMAIN-SUFFIX matches a domain and its subdomains, while DOMAIN-KEYWORD matches a keyword in the domain. IP-CIDR and IP-CIDR6 specify IPv4 and IPv6 address ranges; GEOIP matches by the region associated with an address. USER-AGENT matches the corresponding request field, but only when that traffic can be identified. It is not a universal way to identify encrypted connections.
DIRECT connects without a proxy, PROXY uses the corresponding proxy policy, and REJECT blocks the connection. A rule may also reference a policy group defined in the configuration; check the group name and its selected option. FINAL handles requests that did not match earlier rules. It is not a high-priority override and usually belongs at the end of the rule list.
Where to find them: Open Config, confirm which configuration is active, then view or edit its rules. How to set them up: Keep a copy of the configuration first. Place narrowly scoped, clearly defined rules before general ones. Rules are typically matched from top to bottom, and the matching policy is applied. A specific rule for a domain will not take effect if a broader rule matches first.
DOMAIN-SUFFIX,example.com,PROXY
GEOIP,CN,DIRECT
FINAL,PROXYThis example illustrates syntax and rule order only: example.com and its subdomains use PROXY, then GEOIP rules are evaluated, and unmatched requests go to FINAL. It is not a complete configuration for every network. After editing, make a new request to the target domain and check the connection log to confirm the policy; do not rely solely on the connected status shown on the Home screen.
What to watch for: Some address-based rules depend on DNS results, so DNS settings can affect matching. Do not add several similar rules every time something goes wrong. First confirm the domain and that the target policy exists, then check rule order and caching. For more terms, see the quick reference.
Use Subscribe to manage a source that provides multiple servers, and Add Server to manage an individual server's settings.
What they are: A subscription is a source for retrieving and updating a server list. An individual server entry contains connection details such as protocol, address, port, and authentication. Updating a subscription refreshes its entries; it does not guarantee that a server is available or update traffic rules in Config.
Where to find them: In Home, use the add option to find Subscribe. For manual setup, choose Add Server; to import from a QR code, choose Scan QR Code. How to set them up: Enter the complete subscription URL provided by your own service provider in the appropriate field, save it, update the list, and select a server. To add a server manually, choose its protocol first, then enter the address and authentication details you have. Fields for protocols such as VLESS, VMess, and Trojan are not interchangeable.
What to watch for: Subscription URLs may contain personal authentication details. Do not include them in public screenshots, logs, or discussions. Entries generated by a subscription may be overwritten when it updates. If you need to keep changes, save a separate copy first and make sure it fits your update workflow. Before deleting a subscription, check whether you need to keep its servers; do not confuse updating a subscription with removing it.
If the list is empty, first check the source URL and its response, then check your service status. If entries appear but connections fail, check server details and network conditions instead. These problems occur at different stages; repeatedly importing the subscription will not resolve them. For the import steps, see Getting Started.
Controls when a connection is attempted; rules that determine where requests go are a separate layer.
What it is: On Demand uses conditions supported by the system to trigger connection behavior. Where to find it: Look for On Demand in Settings. Available conditions depend on the system and client; check the options shown in your app. How to set it up: Turn off automatic triggers first. Verify the server, Config, and connection permissions manually, then add the On Demand conditions you need one at a time.
What to watch for: When On Demand is enabled, manually disconnecting may trigger a new connection if its conditions still apply. This does not necessarily mean the switch is broken. During testing, note the network conditions and check the results after both entering and leaving each trigger condition. To pause automatic connections, adjust or turn off On Demand before using the connection switch, so repeated triggers are not mistaken for a server problem.
A network change does not guarantee that existing connections will remain unaffected. Switching between Wi-Fi and cellular may require connections to be re-established, and background behavior is also subject to system scheduling. On Demand cannot fix an invalid subscription or server, and it does not replace traffic rules. After testing its triggers, verify that actual requests use the expected policy.
What it is: Data shows traffic recorded by the client. Use it to check whether requests occurred during a period of use and whether traffic levels look as expected. Where to find it: Open Data and review the statistics available in the current interface. The breakdown and reporting period may vary by platform.
How to use it: First check whether the displayed figure is a total or a value for the current period. Then make a repeatable request and compare the values before and after. If you plan to reset the statistics, note any figures you need to keep so you do not lose a useful troubleshooting reference. When comparing downloads and uploads, keep the direction clear and do not confuse transfer rate with cumulative traffic.
What to watch for: The client, device system, and service provider may count traffic differently. Protocol overhead, connection time, and reporting periods can also vary, so Data is not a billing statement for your service. An increase shows activity but does not prove that a particular webpage request succeeded. If the figure has not changed, first confirm that you are viewing the right period and scope.
Record the original value, then change one setting at a time. Check both settings in the configuration and global settings.
What it is: DNS resolves domain names to addresses and is a prerequisite for connections and some rule matching. Where to find it: Look for DNS in Settings, and check whether the active Config contains related settings. How to set it up: First identify which source is actually in effect, then enter a reachable DNS service for your network. Keep the original value so you can restore it.
What to watch for: Do not change DNS solely because a connection failed. Successful domain resolution and a successful connection to the destination are separate steps; caching and existing connections may also affect the result after a change. If the issue concerns IPv6 only, check that the address and route match. Avoid changing DNS, protocol, and rules all at once.
What it is: Test Method determines how the corresponding connectivity test is performed. Where to find it: Look for Test Method in Settings and use it with Connectivity Test in Home. How to set it up: Choose a method available in the current interface. Compare results on the same network, with the same server, and within a similar time frame.
What to watch for: Different methods may measure different things, so their results are not directly comparable. A timeout may be caused by the test target, and a successful test does not mean every website or app will work. Use actual requests to the destination and diagnostic logs for the final assessment.
What it is: Today Widget provides quick actions when supported by the system. Where to find it: Look for Today Widget in Settings, then check whether it can be added in the system's widget management interface. How to set it up: Configure the options shown, verify the connection in the app, and then test the widget.
What to watch for: Whether the widget can be added, refreshed, and what it displays depend on the system version. If the current system does not offer it, do not look for a setting that is not there; connect from Home instead. Widget status may be delayed, so return to the app to check the connection.
What it is: iCloud features save or sync data supported by the client across compatible Apple devices. Where to find it: Look for iCloud in Settings and check iCloud permissions and account status in the system settings. How to use it: Save a local copy first. Confirm whether you are uploading, restoring, or syncing, then follow the prompts.
What to watch for: Check the interface for the scope of sync; do not assume all server credentials and runtime status are synced. Editing on multiple devices may overwrite changes or cause conflicts, so decide which copy to keep first. iCloud here does not share configurations across all platforms and is not where you restore an App Store purchase.
What it is: Diagnostics provides information supported by the current client to help distinguish issues with resolution, connection, authentication, or rule processing. Where to find it: Look for Diagnostics in Settings. If diagnostics are elsewhere on your platform, follow the current interface. How to use it: Enable or run the relevant diagnostics as needed, reproduce the issue once, then review results from that time period.
What to watch for: Diagnostic results are clues, not an automatic diagnosis or fix. Do not interpret a single timeout as proof that the entire network is unavailable. Before saving logs, check whether they contain subscription URLs, server addresses, or authentication details, and remove sensitive information before sharing. After troubleshooting, restore any temporary logging options to an appropriate level.
Check one layer at a time. This makes issues easier to reproduce and settings easier to restore than resetting several at once.
If you have not completed your first import, start with Getting Started. For rule keywords, see the quick reference. For App Store purchase, system installation, or restoring a purchase, visit the download guide for all platforms and FAQ. These issues are separate from Global Routing and do not require rewriting rules.