Shadowrocket Features & Common Settings

What it is: Global Routing selects the overall routing mode. Config, Proxy, and Direct correspond to the options in the app. They are not three servers or speed settings: Config applies the rules in the active configuration; Proxy sends requests primarily through the proxy path; Direct uses direct connections by default. Exceptions depend on app settings and system network behavior.

Where to find it: Open Global Routing on Home to see the current selection. Before using Config, go to Config and confirm which configuration file is active. Importing a file into the list does not make it the active configuration.

How to set it: Choose Config for everyday routing by domain or address. To check whether your server can handle a request, temporarily switch to Proxy for comparison. To test direct access over your current network, temporarily switch to Direct. After each change, send a new request so you don’t mistake the result of an existing connection for the effect of the new setting.

What it is: Rule-based routing matches request details to an action. DOMAIN matches a specific domain, DOMAIN-SUFFIX matches a domain suffix, and DOMAIN-KEYWORD matches a keyword in the domain. IP-CIDR and IP-CIDR6 match address ranges, while GEOIP uses an IP geolocation database. USER-AGENT relies on a corresponding field visible in the request; don’t assume it applies to every encrypted request.

Where to find it: View and edit the active configuration’s rules in Config. Before making changes, check the file name, confirm it is selected, and review the existing policy definitions. A configuration file may also contain DNS and other settings, so switching files can affect more than the rule list.

How to set it: Keep a copy of the original configuration. Put specific matches before broader ones, then add a fallback rule. Rules are generally evaluated in order; when a rule matches, its policy is applied. FINAL is the fallback when no earlier rule matches. PROXY, DIRECT, and REJECT mean proxy, direct connection, and reject, respectively. A configuration may also refer to custom policy group names, which must match their definitions.

DOMAIN,example.com,PROXY
DOMAIN-SUFFIX,example.org,DIRECT
IP-CIDR,192.168.0.0/16,DIRECT
FINAL,DIRECT

Keep in mind: These are examples of rule syntax, not a complete configuration for every network. DNS resolution may happen before address-based rules are evaluated, and domain and address rules can match the same request differently. When verifying a rule, check the destination domain, resolved address, matching rule, and final policy—not just whether the site loads. For definitions, see the glossary.

What it is: Subscribe fetches a server list from your own subscription URL. You can also add a server manually by entering its connection details. Either way, you need to select a valid server and test the connection. Seeing an entry in the list confirms that it was imported or saved, not that the remote service is reachable.

Where to find it: On Home, tap Add Server. To import a subscription, select Subscribe and enter the URL. If you have a scannable QR code, you can also use Scan QR Code. When entering details manually, choose the type that matches your server information and fill in the corresponding fields. Available options and their locations may vary; follow what the app displays.

How to set it: Get the complete subscription URL from your own service provider. After pasting it, check for spaces, line breaks, or extra punctuation. Save and update the list, check the groups and entry names, then select a server and run Connectivity Test. To refresh an existing list, use the update option in the relevant subscription’s action menu. If automatic updates on app launch are enabled, verify the URL manually after the initial setup to confirm it returns data correctly.

https://example.com/sub?token=xxxx

Keep in mind: This example shows the URL format only and cannot be used to connect. Real subscription URLs may contain access credentials; don’t share them in screenshots, logs, or messages. Updating a subscription may replace entries managed remotely, so record any details before editing those entries manually. If an update fails, first check the URL’s validity, network access, and response format. Don’t immediately delete an older list that still works. Subscription updates and App Store app updates are separate operations with different purposes.

What it is: Shadowrocket supports multiple connection protocols, including Shadowsocks, VMess, VLESS, Trojan, HTTP, SOCKS5, WireGuard, and Hysteria2. A protocol defines how a client and server establish a connection. Changing the protocol name alone cannot make a server support a different communication method.

Where to find it: When adding a server manually, choose its type in Add Server. To inspect an existing entry, open its edit screen. Each type has different fields. Use the details provided for your server and the options shown in the app; don’t use one set of fields for every protocol.

How to set it: First check the address, port, and authentication details. Then check additional settings such as TLS, server name, transport, and any required path. For WireGuard, use the key and address details from its configuration. Hysteria2 availability also depends on how the network handles UDP. Only enter details explicitly provided for your server; don’t combine settings from different entries.

Keep in mind: The protocol name alone won’t identify why a connection failed. Check certificate validation, port reachability, authentication details, and transport settings separately. Don’t routinely disable certificate validation to fix a problem; first verify the system time, server name, and certificate chain. A protocol does not guarantee speed—actual performance depends on the network path and server status.

What it is: On Demand uses the system’s VPN on-demand feature to decide whether to connect based on configured network conditions. It controls connection triggers; it doesn’t determine the policy for each request—that’s Global Routing’s role. It also won’t fix an invalid subscription or incorrect server settings.

Where to find it: In Settings, open On Demand to review its options and rules. Before using it for the first time, authorize the system VPN configuration and confirm that a manual connection works. The available conditions may vary by device; follow the options shown in the app.

How to set it: Decide which types of networks should trigger a connection and which should not, then configure the conditions shown in the app, such as Wi-Fi, cellular, or a specific Wi-Fi network name. Start with one condition: switch to the target network, wait for the network status to settle, check the connection, and send a new request. Add more conditions only after confirming the first one, so overlapping rules are easier to troubleshoot.

Keep in mind: If the connection comes back on after you turn it off manually, the switch may be working as intended—On Demand may have triggered another connection. To investigate repeated reconnections, note the rules, temporarily disable On Demand, and test a manual connection. On public Wi-Fi, resolve any captive portal sign-in first; repeated reconnections cannot replace network authentication.

What it is: Data provides a way to review traffic, including recorded uploads, downloads, and related request activity. Use the statistics to help check whether an access attempt generated traffic or used the expected server. They are not a remote service’s billing records, and totals alone can’t confirm which rule matched.

Where to find it: Open Data and check the statistics’ time range, categories, and start time. If the current view offers dimensions such as server or app, confirm which one is selected. How accurately activity can be attributed to an app depends on the information available to or identifiable by the system; don’t assume every record is precisely attributed.

How to set it: Before testing, note the current reading. Visit a single destination, then check the additional traffic. Where request details are available, use them to verify the domain, policy, and server. Before resetting statistics, save any useful information, then use the reset option in the app. Speed tests, video preloading, and background sync can all affect readings, so minimize these variables during testing.

Keep in mind: Differences in measurement, protocol overhead, recording periods, and background activity can make local readings differ from server-side records. A small amount of traffic may come from establishing a connection or background requests; it doesn’t necessarily indicate a problem. To troubleshoot slow speeds, check the destination’s response, server connectivity, and network changes rather than relying on total traffic. For more, see the troubleshooting guide.

DNS: Resolution Source and Connection Path

What it is and where to find it: DNS translates domain names into addresses used to connect. Review the DNS options in Settings and the DNS configuration in Config. System DNS, custom DNS, and DNS over HTTPS are different approaches to name resolution. Changing the resolution method doesn’t automatically fix every connection problem.

How to set it and what to keep in mind: Record the current value first, confirm the DNS service is reachable from your network, and enter details in the format required by the field. For DNS over HTTPS, use the complete and correct service URL, and make sure the DNS service itself can be reached. After saving, send a new request and check the resolution result and subsequent connection. Configuration file parameters may affect the actual behavior, so don’t assume a single option in Settings determines the entire connection path.

Test Method: Understanding Test Results

What it is and where to find it: Find Test Method in Settings. It determines how Connectivity Test runs. A TCP connection test mainly reflects whether a connection can be established to the specified port. Other methods may also depend on the destination’s response, so interpret results according to the selected method.

How to set it and what to keep in mind: When comparing servers, use the same test method and destination, and retest under similar network conditions. A successful test doesn’t guarantee that a destination website is available, and a shorter test time doesn’t mean faster sustained downloads. If a test fails, check the port, test destination, and actual proxy connection separately.

Today Widget: Quick Access

What it is and where to find it: Today Widget is a shortcut for the corresponding system area. Review its options in Settings, then add it using the widget management options provided by the system. Availability and supported actions depend on the device’s system and what the app displays.

How to set it and what to keep in mind: First select a server and verify a manual connection in the app. Then add the shortcut and check its status and controls in the system interface. The shortcut can’t fill in missing subscription details. If its displayed status doesn’t match what you expect, return to Home and check the actual connection; avoid repeatedly tapping it and toggling the connection back and forth.

iCloud: Sync Scope and Conflicts

What it is and where to find it: Review the iCloud sync options in Settings to sync the data listed in the app between eligible devices. Syncing does not restore an App Store purchase, and it doesn’t mean that every connection state, system authorization, or statistics record will transfer.

How to set it and what to keep in mind: Check each device’s iCloud status and app permissions, then review which items are set to sync. Keep a local copy of your configuration before enabling sync for the first time. Once syncing is complete, check the important fields. Changes made on two devices at the same time may conflict; make changes on one device first, then check the other. Don’t assume a subscription has expired just because sync hasn’t completed, and don’t rely on sync as your only backup.

Diagnostics: Keep Useful Evidence

What it is and where to find it: Diagnostics provides tools for investigating network and connection problems. Find them in Settings. It helps collect clues but doesn’t automatically identify the cause of every error. Interpret the results alongside the network conditions, Global Routing mode, and selected server at the time of the problem.

How to use it and what to keep in mind: Note what you did and any messages shown when the problem occurred, then check the items provided by the tools. If needed, keep diagnostic records only while reproducing the problem, then restore your usual settings. Before sharing a record, check for subscription URLs, authentication details, personal domains, and network addresses, and remove sensitive information. The error type and sequence of events are usually enough; you don’t need to share your entire private configuration.

1. Establish a working baseline. Confirm that your basic network works, select your own server on Home, and verify a manual connection by accessing a destination. If you can’t establish a baseline, troubleshoot the server settings or network first instead of adding rules.
2. Enable the intended configuration. Select the file you need in Config, set Global Routing to Config, and test one request expected to use a proxy and one expected to connect directly. Record the actual policies, not just whether the pages load.
3. Change one setting at a time. Back up your configuration before changing DNS, rules, or the test method. For each change, record the original value, why you changed it, and the test result. If a new problem appears, restore that setting first; avoid making several changes in a row, which can obscure the cause.
4. Enable automation last. Configure On Demand and sync only after manual connections are stable. Switch networks once, reopen the app, and check the subscription status to confirm that automatic behavior matches the manual baseline.

This page explains how the features work together. For a complete walkthrough from importing to connecting, read the first-time setup guide. If you can connect but some requests fail, follow the relevant symptoms in the troubleshooting guide. To purchase or redownload the app, see how to verify the official listing: check the developer, Shadow Launch Technology Limited, the official icon, and app ID 932747118.