Official Manual · Features

Shadowrocket Features & Common Settings

Start by choosing Global Routing, then check your rules and servers. Review each feature by where to find it, how to configure it, and what it affects.

Follow the step-by-step guide Downloads for all platforms
  • Config / Proxy / Direct
  • Rules & Policies
  • Settings Checklist
01 · Global Routing

Config, Proxy, and Direct modes

Global Routing sets the overall connection handling mode. Selecting a server does not mean every connection will use it.

On Home, open Global Routing and choose Config, Proxy, or Direct. These are three routing modes; the interface labels remain Config / Proxy / Direct. For everyday use, start with Config so the rules in the active configuration determine how each connection is handled. Switch to another mode temporarily only when you need to narrow down a problem.

Mode and interface labelHow it worksWhen to use itKeep in mind
ConfigHandles connections according to the rules and policies in the active configuration.For everyday use when different domains, addresses, or network activities need different handling.Check which Config is active and which policies its rules reference.
ProxyRoutes traffic through the proxy path, subject to the system and client’s handling limits.To check temporarily whether rule-based routing is causing a problem.This is not a speed boost. Switching to this mode will not fix a server that is down.
DirectRoutes traffic through the device’s current network connection without the proxy path.To compare against the regular network path and check whether the proxy path is involved.This does not turn off the client’s connection switch or guarantee that other settings have no effect.

How to switch and verify

On Home, note the current Global Routing mode and selected server. Switch to one other mode, then access the same destination over the same network. Start a fresh connection where possible to avoid misleading results from a reused connection. If Proxy works but Config does not, check the matching rule and its policy reference. If Direct fails too, first check the local network, destination service, and system time. Restore the original mode after comparing; do not leave a temporary troubleshooting setting in place.

02 · Rule / Config

Rules match connections; policies determine how they are handled

First identify the matching rule, then check which policy it points to.

What it does and where to find it

Rule-based routing selects a handling path based on conditions such as domain names and IP addresses. In Config, select the configuration in use and review its Rule entries. Rules are generally evaluated in order, so put more specific conditions before broader ones. The final FINAL rule handles connections that did not match an earlier rule.

DOMAIN matches an exact domain; DOMAIN-SUFFIX matches a domain and its subdomains; DOMAIN-KEYWORD matches a keyword in the domain. IP-CIDR and IP-CIDR6 specify IPv4 and IPv6 address ranges, respectively. GEOIP matches based on IP geolocation data. USER-AGENT depends on the relevant request information being available and is not suitable as an app-identification condition for every connection.

How to configure rules and what to watch for

DIRECT means connect directly; REJECT means reject the connection. Interpret PROXY according to the proxy policy defined in the active configuration. Any custom policy name must also exist in that configuration. A rule can be written correctly and still fail to work as expected if its policy reference is invalid.

[Rule]
DOMAIN-SUFFIX,example.com,PROXY
IP-CIDR,192.168.0.0/16,DIRECT
FINAL,PROXY

These are syntax examples, not complete files that can replace an existing configuration. Keep a copy before editing, change one set of conditions at a time, then use connection logs to confirm the match. REJECT only blocks connections that meet its conditions. Rejecting a domain can also disrupt normal functionality when that domain serves multiple types of content.

03 · Subscribe / Add Server

Managing existing subscriptions and servers

A subscription is a way to update server details; a configuration file groups rules and settings. They serve different purposes.

Subscribe: update existing server details in one place

From the add menu on Home, choose Subscribe if available in your interface. Enter a subscription URL you already have and give it a recognizable name. Save it, run an update, and check that the expected entries appear in the server list. Updating a subscription syncs the details returned by that source; it does not necessarily change the rules in the active Config.

Before importing, check that the URL is complete, especially for extra spaces or line breaks and missing query parameters introduced during copying. Subscription URLs may contain credentials; protect them like passwords and do not paste them into public logs or screenshots. If an update fails, identify the error first: an unreachable address, failed authentication, and an incompatible response format require different fixes. Avoid repeatedly deleting all your configurations.

Add Server: enter a single server manually

To add a server manually, open Add Server, select the correct protocol, then enter the address, port, and authentication details from your existing server information. The fields for Shadowsocks, VMess, VLESS, Trojan, HTTP, SOCKS5, WireGuard, and Hysteria2 are not interchangeable. Values labeled “password” or “key” may also use different formats.

If you use Scan QR Code, confirm that the QR code contains the server details you intend to import, then check the protocol and fields after importing. Give each entry a note that makes its purpose clear rather than relying on its position in the list. Before deleting an entry, check its source: subscription entries may reappear after the next update, while manually created entries should be backed up separately.

Switching servers and testing: what the results mean

After selecting a server, use Connectivity Test to check connectivity under the current conditions. The result reflects a particular method, destination, and point in time. It does not guarantee that every site is reachable or measure bandwidth. If an existing page does not change after switching, start a new request and check that Global Routing is still sending the destination to the intended policy.

04 · On Demand

Triggering connections based on network conditions

On Demand controls when a connection is established; it does not determine the policy for an individual connection, which is handled by Rule.

What it does and where to find it

On Demand uses the system’s on-demand connection mechanism to trigger connection behavior based on configured network conditions. Look for On Demand in Settings; available conditions and actions depend on what the current client displays. Before setting it up, confirm that you can establish a connection manually so server issues are not confused with automatic triggering problems.

For example, you can set different connection behavior for specific Wi-Fi networks if the available options allow it. The network name is a condition; whether a connection is established is the result. Once connected, Global Routing and the active configuration still determine how traffic is handled.

How to configure rules and what to watch for

Start with one condition that is easy to verify. Save it, switch between the matching network and another network, and check whether the connection behaves as expected. If you have multiple conditions, review their order and how they overlap. During testing, distinguish between turning off the connection manually and an On Demand rule triggering it again; automatic reconnection does not mean the switch is broken.

On Demand does not guarantee that the app will keep running in every system state or that all existing connections will remain uninterrupted while networks change. To stop On Demand triggers completely, review the On Demand settings as well as the connection switch on Home.

05 · Data

Viewing traffic statistics and connection clues

Data shows traffic information recorded by the client. Open Data and first check the time period and type of statistics shown, and whether there is a reset option. Then review the upload and download values. Available statistics may vary by platform and interface; compare values only when they cover the same scope.

To check whether an action generated traffic, note the current value, perform one specific access, then return to see what changed. Before resetting statistics, save any results you want to compare; a reset changes the baseline for future comparisons. An increase only shows that the client recorded data. On its own, it does not prove that a page loaded fully, a rule matched correctly, or the remote app processed the request successfully.

Data is not a billing statement from a service provider. The client’s statistics may differ from provider measurements because of differences in scope, protocol overhead, retransmissions, and remote-side accounting. Do not use them to calculate remaining usage. If traffic rises unexpectedly, check system background activity and connection logs to identify the source. Do not change DNS, protocols, and multiple rule sets based on traffic figures alone.

06 · Settings

DNS, test methods, and utility features

Adjust settings for a specific purpose. Note the original value before editing, then decide whether to keep the change after testing.

DNS: domain name resolution

DNS translates domain names into addresses used to make connections. DNS-related options may be available in Settings and in the active Config. First identify which layer you are editing and check how the settings take effect. Do not assume a change on one screen overrides every configuration.

Use a DNS address you understand and can reach, and make sure its format matches the selected resolution method. If a domain fails but a known address connects, DNS is one possible cause. If the server itself is unreachable, simply changing DNS is unlikely to help. Also consider IPv6, caching, and differences in the addresses returned on different networks.

Test Method: what the test measures

Check Test Method in Settings to confirm which method Connectivity Test uses. Available options depend on the current interface. Different methods check different parts of the connection, so a result from one method cannot be treated as the conclusion of another.

When comparing servers, keep the test method, destination, and device network the same, then run a few tests to check consistency. One successful test does not prove that authentication, domain resolution, and actual app requests all work. A failed test may also be caused by limitations of the method or destination. Verify with a real request from the app instead of ranking servers by a single result.

Today Widget: quick status and actions

Today Widget is a quick-access feature available when supported by the system. It can show status or perform actions provided by the client. Look for the relevant option in Settings and check the system’s widget management screen to see whether it can be added. Availability and actions depend on what the system and current client support.

After setup, run an action from the widget, then return to Home to check the actual connection status. The widget may take time to refresh, so do not rely on its displayed text or icon alone. If the widget is not available on your system, use the in-app controls instead; there is no need to change network settings to look for it.

iCloud: sync and recovery

On Apple devices that support iCloud, first check your system account, iCloud permissions, and related options in Settings. Then confirm which data the current feature actually syncs. Sync, export, and backup are different things; do not assume that all server credentials, rules, and runtime state will stay in sync automatically.

Before syncing across devices for the first time, keep usable copies of important configurations on each device. Make a small change on one device, wait for sync, and check the result on the other. Avoid making bulk edits on both devices at the same time, since it can be hard to tell which changes took precedence. On shared devices, review account access to avoid exposing configurations that contain credentials.

07 · Diagnostics

Troubleshoot along the connection path

Record the symptoms and context first, then use diagnostics to narrow down the cause.

Diagnostics provides troubleshooting clues. Look for the relevant option in Settings; available tools and recorded details depend on the interface. Before you start, note the device network, Global Routing mode, active Config, selected server, and destination address. Also identify whether the issue occurs before connecting, during domain resolution, or after the request is sent. The same symptom can have different causes; a precise description helps you choose the right next step.

  1. Check the basic network first. Confirm that the device can access the internet, the system time is correct, and the destination service is available. If only one destination fails, do not immediately rebuild the entire server list.
  2. Next, verify the server details. Check the protocol, address, port, authentication fields, and related transport parameters. If the issue started after a subscription update, compare the entries before and after the update rather than changing protocol parameters at random.
  3. Then check the routing path. Use available connection logs to confirm the domain, matching rule, and final policy. If Config and Proxy behave differently, check rule order, policy names, and DNS results first.
  4. Finally, change one thing at a time. Change only the network, server, mode, or one setting, then start a new request and record the result. This makes it possible to identify what caused the change and prevents multiple edits from masking one another.

Before sharing diagnostic logs, remove credentials from subscription URLs, passwords, keys, and unnecessary device information while retaining the error type and relevant timing. Do not publish a complete configuration file containing sensitive fields. Diagnostics helps inform a diagnosis; it does not promise an automatic fix. After troubleshooting, restore temporary modes and test settings, and keep a final configuration you can explain.