Shadowrocket supports multiple proxy and tunneling protocols. The Type must match your existing configuration; changing its name cannot change the protocol supported by the server. This guide compares eight common types, then explains the differences between authentication, transport and routing rules. It is intended for users who already have a subscription or connection details and need to confirm how to import them and test the connection. This site does not provide, sell or recommend nodes, subscriptions, proxy services or invitation codes.
Common protocols and transport characteristics
Start with the protocol name supplied by your provider, then verify the fields. A protocol defines how the two ends authenticate and exchange data; transport methods such as TCP, UDP, WebSocket and QUIC describe how that data is carried. They operate at different layers: WebSocket is not a server type alongside VLESS, and the port alone does not identify the protocol.
| Protocol type | Design and transport | Parameters to verify |
|---|---|---|
| Shadowsocks | An encrypted proxy protocol that can carry TCP and UDP; available features depend on the implementations and configuration at both ends. | Address, port, Password, encryption method; enter plugin parameters as specified in the original configuration. |
| VMess | Uses parameters such as a UUID for authentication; can be paired with different transport methods and TLS. | UUID, transport method, TLS, and any other authentication parameters required by the original configuration. |
| VLESS | A lightweight authentication protocol that does not encrypt traffic on its own; it requires the security layer specified in the configuration. | UUID, security layer, transport method; if Flow is used, it must match the server. |
| Trojan | Typically establishes a connection over TLS and uses password authentication. | Password, port, TLS server name, and certificate verification requirements. |
| HTTP | An HTTP proxy that can establish a connection to the destination using CONNECT; check separately whether the proxy connection itself uses TLS. | Proxy address, port, authentication details, and whether TLS is enabled. |
| SOCKS5 | A general-purpose proxy protocol that handles TCP; UDP forwarding requires support from both client and server. | Address, port, authentication details, and server-side UDP support. |
| WireGuard | An encrypted Layer 3 tunnel over UDP that identifies peers with keys; it is not a username-and-password proxy. | Private Key, Peer public key, Endpoint, tunnel addresses, and Allowed IPs. |
| Hysteria2 | Uses QUIC over UDP; the network must allow the required UDP traffic for the connection to work. | Address, port, authentication details, TLS, and any obfuscation or bandwidth parameters in the original configuration. |
Bottom line: match the configuration first, then check the network
Select the Type that matches your existing configuration and keep its original parameters. If Hysteria2 or WireGuard will not connect, check the relevant UDP path instead of switching to a different Type.
This table is a guide to common types, not a complete feature list or a speed ranking. Performance can vary with server load, network routes and configuration; a protocol name alone does not mean a connection will be faster.
Authentication, TLS and ports: three separate layers
The address and port specify where to connect; a Password, UUID or key is used for authentication; TLS covers the secure handshake and certificate verification. After importing, seeing a server name in the list only confirms that the entry was saved—it does not mean its parameters have been validated by a connection.
- Authentication fields are not interchangeable. A UUID commonly used by VMess or VLESS is not a WireGuard Private Key, and a subscription URL is not a Trojan Password.
- The connection address may differ from the TLS name. A configuration can connect by IP address while checking TLS against a domain name. Keep the specified server name; do not clear it arbitrarily.
- The same port does not mean the same protocol. TCP 443 and UDP 443 are different transport endpoints. Being able to browse HTTPS sites does not mean the network allows the UDP traffic Hysteria2 requires.
- Check the cause of certificate errors. First verify the device time, server name and whether the configuration has expired. Do not treat disabling certificate verification as a general fix.
WireGuard’s Allowed IPs specify destination networks that can be sent to a Peer and affect tunnel routing; they are not a DNS server list. DNS, MTU and tunnel addresses each serve a different purpose. Adding only the keys does not complete all network settings.
Import and verify an existing configuration in Home
The steps below use the iPhone/iPad interface. If you already have a subscription, import it first; enter fields manually only when you have the complete parameters for a single server. A subscription URL is used to retrieve configuration, not as the protocol for the proxy connection itself. One subscription can contain multiple Types.
-
Verify the source
Open the configuration instructions for your existing service and check whether you were given a subscription URL, a single-server share link or a WireGuard configuration file. Note the stated protocol and required parameters.
-
Import a subscription
Go to Home → tap “+” in the top-right corner → set Type to Subscribe, enter your subscription URL in URL, then save. The example address
https://example.com/sub?token=xxxxis fictional and cannot be used to connect. -
Verify the type
Return to Home and open the imported entry’s edit screen to check Type, address, port and authentication fields. To add a server manually, go to Home → “+” → Type and choose the protocol that matches the original configuration.
-
Test the connection
On Home, tap the dot to select a server and turn on the connection. Allow the VPN configuration when prompted the first time, then run Connectivity Test and check whether websites load.
-
Verify after an update
When an update is needed, update the subscription from Home, then confirm that the selected server is still there and its Type and parameters still match the original configuration. Updating the configuration does not reconnect every existing connection.
Protocol and Global Routing: check them separately
A correct protocol does not guarantee that a request to a particular destination will use that server. Home → Global Routing controls the routing mode; the server selected on Home determines the proxy exit; an enabled profile in Config provides rules and policies. Do not change Type to fix a rule that is not matching.
Config: route traffic using a profile
RecommendedUse the rules and policies in the active configuration. First check the enabled profile in Config, then go to Home → Global Routing → Config. For routine checks, use a rules profile you have already verified.
Best for: everyday use when direct and proxied destinations need different handling
Proxy: check the proxy connection
Routes traffic handled by the app through the proxy. This helps reduce interference from ordinary routing rules during testing, but it will not fix an incorrect password, an invalid certificate or an unreachable server.
Best for: briefly confirming whether the selected server can establish a working connection
Direct: check direct connectivity
Uses a direct connection without the selected server as a proxy exit. If a website loads only in Direct mode, continue checking the proxy path rather than assuming the device has lost network access entirely.
Best for: checking whether the current network can reach the destination directly
Scene: check scene settings
Routes traffic according to the scene settings. When troubleshooting, check the active scene and its associated configuration; the server selected on Home alone does not reveal the actual route.
Best for: switching conditions when you already have scene configurations set up
Rule keywords are not protocols either. DOMAIN-SUFFIX matches domain suffixes, IP-CIDR matches IP ranges, GEOIP matches using an IP geolocation database, and FINAL handles connections that did not match earlier rules. The example below shows rule syntax only; do not replace your entire configuration with it:
[Rule]
DOMAIN-SUFFIX,example.com,PROXY
IP-CIDR,192.168.0.0/16,DIRECT,no-resolve
GEOIP,CN,DIRECT
FINAL,PROXYRules are generally evaluated in order, with specific rules placed before the fallback FINAL rule. If the configuration uses policy groups, check the selection within each group too. Settings → On Demand manages conditions for on-demand connections; it does not change protocol authentication details. If connections keep restarting automatically, check these settings instead of repeatedly deleting servers.
Identifying protocols and troubleshooting connection failures
How can I tell which protocol a link uses?
Start with the original configuration instructions and the link’s purpose. A single-server link may include a protocol prefix, but the contents of a regular HTTPS subscription URL cannot be identified from its domain alone. After importing, open the entry’s edit screen on Home to check Type and compare it with the provider’s instructions. Do not guess from the server’s display name.
Will changing VLESS to Trojan make it faster?
No. It does not switch the capabilities of the server. The two protocols use different authentication and handshakes, so changing Type directly usually leaves mismatched fields. Restore the original Type. If your existing configuration provides multiple protocols, import each separately and compare them on the same network, to the same destination and at roughly the same time.
Hysteria2 times out, but another type connects. What should I do?
First verify the Hysteria2 port, authentication details and TLS name, then repeat the test on another network available to you. If the behavior changes with the network, check for UDP restrictions. A timeout alone does not prove that the password is wrong or the protocol is unavailable.
Why do websites still fail to load when latency tests work?
A single latency measurement or port check does not prove that a complete proxy request succeeds. Run Connectivity Test on Home, make sure Global Routing is not set to Direct, then check the rules, policy selection and DNS in Config. Change one setting at a time and record the specific error before and after.
The protocol name changed after a subscription update. Should I change it back manually?
First check the configuration instructions for your existing service to confirm whether the server entry has changed. An update may replace the address, port or entire connection entry. Recheck the Type and current selection; do not force old passwords or transport parameters into a new entry.