OFFICIAL MANUAL · SETTINGS
In Home, check the selected server and Global Routing, then review Config and Settings. The connection toggle, routing mode and matching rules are separate settings and cannot replace one another.
This guide covers Home, Config, Data and Settings on iPhone and iPad. Item locations may vary by OS and app version; use the labels shown in your current interface. If an option is not shown, don’t guess based on a similar label elsewhere.
Shadowrocket is available for iPhone, iPad, Mac, Windows, Android and Linux. Mac versions are available for Apple silicon and Intel. To get the app, use the downloads for all platforms guide to choose the right version for your device.
01 · GLOBAL ROUTING
Global Routing determines how connections are handled. Choose Config for everyday rule-based routing, Proxy to temporarily check whether the proxy path works, or Direct to compare against a direct connection on your current network.
| Mode and Interface Label | How Connections Are Handled | When to Use It | Keep in Mind |
|---|---|---|---|
| Config | Matches rules in the currently enabled configuration and applies the corresponding policies. | Use when different destinations should be handled by PROXY, DIRECT or another defined policy. | First confirm the expected configuration is enabled, then check rule order and FINAL. |
| Proxy | Connections handled by the app are generally routed through the currently selected proxy server. | Temporarily check the server and proxy path without rule-based routing affecting the test. | This does not verify which rules match or guarantee that the server is available. |
| Direct | Connections handled by the app connect directly, without being forwarded through the selected proxy server. | Compare your local network, destination service and proxy path. | This does not turn off the connection toggle; the system may still show a VPN connection. |
Open Home, tap Global Routing, choose the mode you need, then return to confirm the displayed value. After switching, make a new web request. Existing long-lived connections may keep their previous state, so a page that was already open is not enough to confirm the new setting applies to every request.
If Proxy works but Config does not, first check the configuration, policy names and rule matches. If both fail, check the selected server and basic network before rewriting the configuration. When troubleshooting is done, restore your usual mode so a temporary Proxy setting does not keep changing how app traffic is routed.
02 · CONFIG / RULE
Review the active configuration in Config. A rule type describes what to match; the policy at the end of the rule describes what to do with a match. Treat these as separate parts.
Config is more than a place to store files: it determines which rules are currently in use. After importing or downloading a configuration, make sure it is selected and enabled, not just listed. Save a copy before editing and keep the configuration that was working. Change one type of rule at a time so you can connect each change to its actual effect.
| Rule Type | What It Matches | How to Configure and What to Check |
|---|---|---|
DOMAIN | An exact domain name. | Use for a single, specific hostname; it does not automatically cover all subdomains. |
DOMAIN-SUFFIX | A domain and its subdomains. | Use to match by domain suffix. Enter a domain, not a full web address. |
DOMAIN-KEYWORD | A specified string contained in a domain name. | This can match broadly, so watch for unrelated domains being caught. |
IP-CIDR / IP-CIDR6 | IPv4 or IPv6 address ranges. | Use for a defined network range; check the address family and prefix length. |
GEOIP | A category in an IP geolocation database. | Results depend on the database and resolved IP address. They do not indicate a website’s language or account region. |
FINAL | Connections not matched by any preceding rule. | Use as the final fallback and specify the policy to apply. |
Rules are generally evaluated in order, so put specific exceptions before broader rules. PROXY sends traffic through a proxy path, DIRECT connects directly, and REJECT blocks the connection. Any custom policy referenced in the configuration must also be defined. A misspelled name or invalid policy reference can make a rule look correct while preventing it from working as expected.
[Rule]
DOMAIN-SUFFIX,example.com,PROXY
IP-CIDR,192.168.0.0/16,DIRECT
FINAL,DIRECTThis example illustrates syntax only; it is not a complete configuration. Traffic to example.com and its subdomains goes to PROXY, the specified local address range uses DIRECT, and FINAL sends all remaining connections to DIRECT. Choose policies based on your own destinations and existing configuration. Don’t replace your entire configuration with this snippet.
To check whether a rule works, first make sure Global Routing is set to Config, then make a new request to a specific destination. If you access a destination by IP address, domain rules may not match. If a service uses multiple domains, a successful homepage request does not prove that all its requests use the same policy.
03 · HOME / ADD SERVER
A subscription manages multiple server entries in bulk; the server selected in Home is the default proxy endpoint for current use. A successful import, a successful update and a working connection are three different things.
In Home, tap Add Server and choose the type that matches your existing details. To import a subscription, select Subscribe and enter the full subscription URL. If you have a QR code, use Scan QR Code, then check the entry type and key fields. Don’t use a regular website URL, account management page or configuration guide as a subscription URL.
When adding a server manually, match the protocol, server address, port, authentication details, TLS and transport fields to your existing information. Keep protocol names as written, such as Shadowsocks, VMess, VLESS, Trojan, HTTP, SOCKS5, WireGuard and Hysteria2. Don’t fill in fields at random just to save the form. Check the original details if you’re unsure, or read the protocol reference.
After updating a subscription, check whether the server list has changed, then confirm the default server by its selection dot in Home. The previously selected entry may have been removed or replaced. Similar server names do not mean the addresses or settings are the same. You can add a descriptive note to a manual entry, but the note itself does not change how it connects.
Before deleting a subscription, check which entries and original subscription URL you need to keep. Entries managed by a subscription may be overwritten the next time it updates, so direct edits may not last. To test settings individually, keep the original entry and create a clearly labeled test copy. Remove duplicates when finished to avoid selecting the wrong one.
04 · ON DEMAND
On Demand triggers connections based on system network conditions; it does not choose a PROXY or DIRECT policy for a domain. First establish a reliable manual connection, then set up automatic triggers.
Find On Demand in Settings and check its current toggle and available network conditions. For your first setup, select a server manually in Home and verify that it works, then configure On Demand options one at a time. If the system asks permission to add a VPN configuration, review the prompt and confirm. Use only the conditions available in your current interface; you don’t need to enable every option.
After enabling On Demand, switch between the Wi-Fi and cellular networks you actually use. Check whether the connection starts or stops as expected, then confirm Global Routing in Home is still set to the mode you need. An automatic connection does not guarantee the selected server works or that every request uses a proxy. Routing mode and the active configuration still determine how traffic is handled.
If the connection comes back after you turn it off manually, check On Demand first, then review the system VPN settings instead of repeatedly deleting subscriptions. To troubleshoot or stop automatic connections completely, temporarily turn off On Demand before using the Home connection toggle. Note your original settings and restore them after testing if needed.
On Demand does not mean data is continuously being transferred. Battery use and data consumption also depend on actual app activity, protocol, network stability and reconnection frequency. A VPN icon alone does not indicate unusual traffic. To investigate, compare On Demand trigger records and the Data observation period with what you were doing in your apps.
05 · DATA
Data shows traffic recorded by the app. It is not a service provider’s bill, network speed measurement or direct rating of connection quality.
Open Data and identify the displayed time range, traffic direction and units before comparing the figures with your activity. Upload and download represent different directions. If the page offers multiple time ranges or a clear option, check which range is selected first. Don’t treat one session’s figures as monthly usage, and don’t keep using the old starting point after clearing the data.
For a comparison test, note the current figures, pause unrelated background transfers, perform one specific action and check for a change. An increase only shows that recorded data was transferred; it does not by itself prove a domain matched PROXY. To check the policy, also review Global Routing, the configuration rules and any available connection logs.
App and provider statistics may differ because they use different start and end times, account for protocol overhead and retransmissions differently, or use different measurement methods. For remaining account data, check your existing service account records; don’t infer a billing result from a single figure in Data. When keeping troubleshooting notes, include the network type and test action—more useful than a screenshot of a cumulative total alone.
06 · SETTINGS
Keep a working setup as your baseline and change one setting at a time. DNS, test methods, shortcuts, sync and diagnostics solve different problems; changing every toggle at once is not a useful troubleshooting step.
DNS resolves domain names to IP addresses. Check DNS-related options in Settings and whether the current Config includes DNS settings; the configuration file may affect actual behavior. If you have no specific requirement, keep the working settings as they are. If you have a prescribed DNS setup, enter the values from your source and record the original settings first.
If a domain won’t open but its IP address responds, DNS may be involved, but that alone is not conclusive; HTTPS sites also depend on certificates and hostnames. After changing DNS, make a new request rather than relying on a cached result. Changing DNS does not fix server parameters. Avoid changing IPv6, rules and server settings at the same time, or it will be harder to identify the cause.
Test Method determines how relevant tests are performed. Review the available options in Settings and choose one. Methods may test different stages of a connection, so compare results only when the method and network conditions are similar. After changing methods, don’t treat the old and new results as a direct measure of server quality.
After choosing a method, return to Home and run Connectivity Test, then try the service you actually need. A successful test does not mean every website is accessible, and a failed test needs to be considered alongside its target and your current network. If only one test method fails, first check its requirements instead of deleting every server.
Today Widget provides quick status checks and actions where supported by the system. Check the related options in Settings, then add the widget using the method available in your current system. If your system or app version does not show the widget, don’t change connection settings just to look for it.
After using the widget, return to Home and check the server, connection toggle and Global Routing. Widget status may take time to refresh and does not replace a connection test. If information is visible on the Lock Screen, review system display permissions to avoid exposing unnecessary server notes in public.
iCloud sync transfers data supported by the current version between your personal devices. It is separate from refreshing a server list with an existing provider. Check the sync option in Settings, confirm the devices use the intended iCloud account, make sure system access is allowed and verify that the network is available. Save important configurations before enabling sync, then compare local and cloud contents so you don’t mistake older data for new settings.
After changing something on one device, allow time for sync and check the result on the other device instead of assuming connection status, system permissions and every setting will transfer completely. Server passwords, subscription URLs and keys are sensitive; understand what data is synced. System VPN permissions must still be confirmed separately on each device.
Diagnostics lets you collect and review connection-related information from its entry in Settings. First note the network, selected server, Global Routing mode and steps to reproduce the issue, then run the available diagnostic tools. Try to reproduce one specific issue rather than generating unrelated requests that obscure useful information.
Review the output to identify where the problem occurs: connection failure, authentication failure, DNS resolution or an unexpected response from the destination. Diagnostics helps narrow down the cause; it is not a lasting conclusion about every destination. Before sharing logs, redact subscription parameters, authentication details, keys and unnecessary personal browsing records. Turn off detailed logging when you’re done if you no longer need it.
07 · CHECK ORDER
Keep the original settings and check in layers—server, mode, configuration, DNS, then diagnostics. This makes problems easier to isolate than changing several toggles at once.
If you haven’t made your first connection yet, follow the first connection tutorial to import details, select a server, allow the VPN configuration and verify the connection. If you only need help understanding protocol fields, see the protocol reference; changing Global Routing is not a substitute for checking protocol settings.
First check the enabled file in Config, the rule matched by the specific destination and its policy, then check FINAL. A Proxy test only shows that the proxy path worked for that particular test; it does not confirm every policy in Config works. Don’t change server settings you’ve already verified.
Check On Demand and the system VPN settings first. Subscription updates refresh server information; On Demand triggers connections automatically. Temporarily turn off On Demand while troubleshooting, then see whether the manual connection toggle stays in the expected state.
A change in traffic does not prove the destination request succeeded. Background activity, connection retries or partial requests can all generate traffic. Check the server, Global Routing, rules and DNS for the same destination, then use Diagnostics to narrow down the cause.
Usually not. Routing mode, DNS and subscription contents are separate. Update or re-import only if the subscription URL or existing server details have changed, or an entry is actually missing. Before deleting anything, keep the original details and any configuration copies you need.