Shadowrocket Features & Common Settings

Global Routing is where you choose a routing mode, usually from Home. Config applies the rules in the active configuration file; Proxy sends connections handled by the app through the selected server; Direct lets those connections reach their destination directly. System-exempt traffic, exclusions, and existing connections may be handled differently, so the mode name alone does not tell you how every connection on your device is routed.

Choose Config for everyday routing when different destinations need different handling. To check whether a rule is sending a destination through the wrong policy, briefly switch to Proxy for comparison. To see whether your local network can reach a destination directly, compare with Direct. After switching modes, reopen the destination or start a new request so you don’t mistake the result of an existing connection for the new mode’s behavior.

Rule-based routing determines whether a connection goes through a server, connects directly, or is rejected. Open Config and first check which configuration file is active, then review or edit its rules. Importing or saving a file does not activate it. Changes to an inactive file will not affect connection behavior on Home.

A typical rule contains a type, a match value, and a policy. DOMAIN matches an exact domain; DOMAIN-SUFFIX matches a domain and its subdomains; DOMAIN-KEYWORD matches a keyword in a domain. For precise control, prefer domain rules with clear boundaries. Broad keyword matches can catch unrelated destinations.

IP-CIDR and IP-CIDR6 match their respective address ranges. GEOIP uses an IP geolocation database; it does not identify website content or the user’s location. Whether a domain is resolved first, and which address is returned, can also affect IP-based rule matching. Check DNS settings along with the rules when troubleshooting.

[Rule]
DOMAIN,example.com,PROXY
DOMAIN-SUFFIX,example.org,PROXY
DOMAIN-KEYWORD,ads-example,REJECT
IP-CIDR,192.168.0.0/16,DIRECT
GEOIP,CN,DIRECT
FINAL,PROXY

When adjusting rules, place more specific exceptions before broader rules, and keep FINAL at the end as a fallback. Once an earlier rule matches, later rules are not evaluated, even if they are more specific. Change one group of rules at a time and note the destination, expected policy, and actual result. Avoid changing servers, DNS, and rules together, or it will be hard to tell which change made a difference.

For rules such as USER-AGENT that depend on request information, check whether the current connection provides the data needed to match. Don’t assume those fields are available for all traffic. For more on rule order and fallback behavior, see Custom Rule Priority and FINAL.

Add existing server details

On Home, tap Add Server to add an entry. Select the Type specified by your service provider, then enter the address, port, authentication, and transport details. Shadowsocks, VMess, VLESS, Trojan, Hysteria2, and WireGuard require different fields. Don’t reuse one set of parameters for another Type just because the address and port match.

When importing with Scan QR Code, check the source and review the fields it recognizes. A QR code only carries parameters; it does not verify them. After saving, select the intended entry on Home, run Connectivity Test, and try an actual connection. If the test fails, first check that all details were entered correctly, the authentication information is valid, and the service is active. Don’t assume the rules are at fault.

Import and update an existing subscription

If you already have a subscription URL, choose Subscribe from the add menu, paste the complete address, and save it. Subscription URLs may contain sensitive credentials, so avoid including them in screenshots, public documents, or chat logs. Leading or trailing spaces, line breaks, or missing query parameters can cause parsing errors or an empty list. A subscription URL and a regular web address may look alike, but they are not interchangeable.

When your service provider updates the list, use the update action for that subscription to fetch the latest entries. Updating the list does not replace the active Config, and an entry selected before the update may no longer be available. After updating, check the groups, selected server, and actual connection. Manual changes to subscription-generated entries may be overwritten during the next update; keep important details somewhere secure.

Check where an entry came from before deleting it

Before tidying the list, distinguish manually added entries from subscription entries. Deleting a subscription group may remove several server records, while changing a display name may not change connection settings. If you plan to replace a subscription, verify the new list first, then remove old entries. Don’t delete everything before confirming how to restore it. For parsing issues, see the Subscription Parsing Troubleshooting Checklist.

On Demand lets the system trigger a VPN connection when configured network conditions are met. Find the On Demand options in Settings and configure the conditions shown in your app. It serves a different purpose from the manual connection switch on Home: the switch controls the current connection, while On Demand may start a new connection when its conditions are met again.

Before configuring On Demand, establish a stable manual connection and confirm that the selected server and Global Routing behave as expected. Then start with one condition and test what happens when it is met, when it is no longer met, after the device wakes from the Lock Screen, and when the network changes. Avoid stacking several conditions at once; when one overrides another, it can look as though the connection keeps restarting after you turn it off.

If the device reconnects, first check whether On Demand is still enabled, then review the system VPN settings and any other relevant automation conditions. To stop automatic connections temporarily, address the triggering conditions instead of repeatedly toggling the Home switch. Trigger timing can vary by system environment, so test by switching networks after saving your settings.

Data shows the traffic statistics and related records available in the app. Before interpreting upload, download, or total figures, check the time period and scope shown on screen. Records may cover the current connection, a specific item, or a reporting period. Don’t add figures with different scopes together, or assume one screen shows all network usage on your device.

To check whether an action generated traffic, note the starting figures, open the destination on its own, and wait for the transfer to finish. Then return to Data and compare. Background sync, media preloading, and the app’s own requests can also generate traffic. A short-term increase can help narrow down the cause, but it cannot prove on its own that a domain matched a particular policy.

Your service provider may use different billing periods, protocol overhead, or counting rules. If Data does not match the provider’s usage figure, check how each one is calculated. Before clearing statistics, save any records you need and check what the clear action affects. Resetting local records does not change remote usage. To verify routing, check connection details for the specific request against the active rules rather than relying on total traffic.

DNS: Check how domains are resolved

DNS resolves domain names to addresses used for connections. When reviewing DNS options in Settings, also check whether the active Config contains DNS parameters. Changing one screen alone does not guarantee that the actual resolution path has changed. Note the original settings before making changes, ensure the address and format meet the selected option’s requirements, and check how DNS requests are routed.

If a domain cannot be reached, an IP-based rule behaves unexpectedly, or some resources load intermittently, check the resolution result and compare it with the address used for the connection. A domain may return multiple addresses, and cached results may be outdated. After changing settings, make a new request and, if needed, use the relevant clearing option in the app. One successful visit after changing DNS does not prove that every connection issue is fixed.

Test Method: What Connectivity Test tells you

Test Method determines how a connection test is performed. Look for it among the test options in Settings. Different methods check different layers; a successful test does not guarantee that authentication, the destination website, or the entire transfer will work. First confirm the test method and target, then run Connectivity Test for the selected server from Home.

When comparing entries, keep the test method, target, and local network consistent, and run tests close together in time. A missing result for one entry may be due to the target or probe method, so also test a destination you actually need to reach. Don’t treat a single test result as a long-term reliability measure, or change unrelated settings just to get a lower number.

Today Widget: Quick access to status and controls

Today Widget settings control what appears or can be done through the related widget. Check the options available in Settings, then add the widget from a system-supported widget screen. Availability, setup, and available actions depend on your system and the app’s support; a particular layout is not guaranteed on every device.

Widgets are useful for a quick status check, but their display may refresh with a delay. After using a widget control, return to Home to confirm the actual connection status and selected server. Don’t rely on the widget text alone to confirm a successful connection. If it disagrees with the app, check the status in the app first, then review system widget refresh and availability.

iCloud: Verify what actually synced

iCloud features can save or sync supported app data between eligible devices. Check the relevant options in Settings, along with the Apple Account signed in on your device and its iCloud permissions. Before enabling sync, read what the app says is included. Don’t assume that every server, configuration file, statistic, and system VPN status will sync.

When using multiple devices, keep a copy of important information first, then wait for sync to finish and check each list. After a configuration file syncs, confirm that it is selected as the active file and that its associated servers are valid. Sync is not a separate backup: deletions and edits may propagate to other devices. Handle connection credentials with care, too.

Diagnostics: Gather clues about a specific failure

Diagnostics lets you view diagnostic information or run checks provided by the app. Find it in Settings, note the network, Global Routing mode, selected server, and steps leading up to the issue, then reproduce the problem once. Different diagnostic checks answer different questions; first determine whether you are checking DNS resolution, connection setup, or subsequent data transfer.

When reviewing results, relate the destination address and failure stage to your configuration. Don’t change several settings in a row based on a single error message. Before saving or sharing diagnostic details, remove sensitive information such as subscription URLs, authentication details, and personal browsing records. Diagnostics can help locate a problem, but it cannot fix service-provider issues or replace checking your server details.