Shadowrocket Glossary: Interface, Protocols & Rule Keywords · Shadowrocket Docs

01 / INTERFACE

Interface & Toggles

First check which page and mode you're on, then determine whether a toggle is affecting the connection. For the full procedure, see Getting Started.

Home: The main screen for viewing server entries, the current selection and the connection toggle. A successful import only means the entry was added; it does not mean the entry is selected or connected. Before testing, check the selected entry and the toggle state. If the page has multiple groups, make sure the entry selected is the one you intend to test.

Global Routing: A global option that determines how requests are handled overall: Config, Proxy or Direct. If rules seem not to be working, check this setting first rather than immediately editing the rules. Record the current mode when testing, since changing it changes the conditions you're diagnosing.

Config / Proxy / Direct: In Global Routing, Config applies the rules in the current configuration, Proxy uses proxy mode, and Direct uses direct mode. Config here is a mode, not the configuration file management page; Proxy and Direct are also distinct from the uppercase rule actions. Before returning to everyday use, check that the app is no longer in a temporary test mode.

On Demand: A mechanism that triggers a VPN connection when system conditions are met, not a server speed test or an automatic repair feature. If the connection starts again after you disconnect manually, check for active On Demand conditions and the VPN configuration in system settings. When troubleshooting, note the conditions, temporarily disable them and compare the results.

Add Server: An entry point for manually entering details for an existing server. Select a protocol first, then fill in the corresponding fields. Match the address, port, identity or password, transport and TLS settings to the server details; do not guess based on names. After saving, return to Home, check the selection and test the connection.

Connectivity Test: Checks whether an entry is reachable on the current network. Results depend on the test target, network path and test method. The reported latency is not download speed and does not guarantee that every website will load. If results look unusual, test again on the same network and under the same conditions, then compare with actual access and logs.

02 / PROTOCOLS

Protocols

The protocol name determines how its settings are interpreted. After importing, check the settings against the server details you already have; a protocol name does not guarantee speed or reliability.

Shadowsocks: A protocol that sends proxy traffic using an agreed encryption method and authentication settings. The client and server must use matching settings. Check at least the address, port, password and encryption method—not just that the password is correct. Preserve any additional transport settings in the server details when importing.

VMess / VLESS: These are two different proxy protocols. Even if both entries include a UUID, their protocol types are not interchangeable. Check the identity fields, transport, Host, path and TLS settings; the specific fields depend on how the server is configured. VLESS does not imply that transport encryption is enabled, so verify settings such as TLS separately.

Trojan: A proxy protocol that uses TLS for transport and password authentication. Authentication and certificate validation are separate checks. If the connection fails, check the password, connection address, port and SNI individually rather than disabling certificate validation. A certificate mismatch may also result from an incorrect server name or device time.

Hysteria2: A QUIC-based proxy protocol that relies on UDP connectivity on the current network and requires correct authentication and TLS settings. If it keeps timing out on one network, compare the results on another before assuming the settings are wrong. The same protocol does not mean different servers share authentication, obfuscation or bandwidth-related settings.

WireGuard: A protocol that creates an encrypted tunnel using public-key cryptography. Check the local private key, peer public key, Endpoint, addresses and routing scope together. A server address alone is usually not enough for a complete configuration; an incorrect routing scope may make some requests unreachable. Private keys are sensitive—redact them from troubleshooting notes and screenshots.

HTTP / SOCKS5: Two proxy protocols that require the address, port and any optional account authentication to match the server. The protocol name alone does not mean the connection is encrypted with TLS; check the transport settings. SOCKS5 UDP support also depends on the server and client configuration, so a single webpage test is not enough to verify it.

TLS / SNI: TLS establishes an encrypted connection and verifies the peer's identity. SNI specifies the server name during the handshake. The connection address may be an IP while the certificate is for a domain; in that case, enter the name from the server details rather than copying the address. For validation errors, check the name, certificate expiry and system time before investigating the server.

03 / RULE KEYWORDS

Rule Keywords

Read the match condition first, then the action at the end. The syntax below explains rules; it is not a recommendation to replace an entire configuration.

Rule: Rules select an action based on a domain, address or other request attributes. They are usually evaluated from top to bottom, and the matching rule is applied. A broad rule above a specific one may take precedence, so both order and conditions matter. Before editing, make sure Global Routing is set to Config and keep a copy of the current file.

DOMAIN / DOMAIN-SUFFIX / DOMAIN-KEYWORD: DOMAIN matches an exact domain, DOMAIN-SUFFIX matches a domain and its subdomains, and DOMAIN-KEYWORD matches a keyword contained in a domain. These match types have different scopes; a short keyword may affect domains you did not intend to include. For a single host, check whether an exact domain is appropriate; use a suffix condition when you need to cover a group of subdomains.

IP-CIDR / IP-CIDR6: These match IPv4 and IPv6 address ranges, respectively. The prefix length after the slash determines the range. A shorter prefix generally covers more addresses, and an incorrect value may send unrelated requests to the same action. Rule matches may also change when a domain resolves to different addresses, so check the actual target IP.

GEOIP: Matches based on classifications in an IP geolocation database, not the user's current location. Database records, service hosting locations and domain usage may differ, so a classification is not an absolute guide to how a service should be handled. If a rule behaves unexpectedly for a particular site, check the target IP first, then consider a more specific domain rule.

FINAL: A fallback rule used when no earlier rule matches, usually placed at the end. FINAL,PROXY sends unmatched requests to PROXY; it does not mean earlier requests all use a proxy. If many requests unexpectedly reach FINAL, check whether the rules above match the actual request domains or addresses.

PROXY / DIRECT / REJECT: Common actions at the end of rules: send requests to a proxy policy, connect directly or reject the connection. The actual PROXY route depends on the current server selection and configuration; DIRECT does not guarantee that the destination is reachable. These uppercase rule keywords are not the Proxy and Direct options in Global Routing.

URL Rewrite: A configuration feature for handling request URLs according to matching conditions. It is different from changing servers, modifying DNS or ordinary domain-based routing. Its effect depends on request visibility, protocol and related settings; adding a rule does not mean every HTTPS request will be handled. If a page redirects unexpectedly, record the original rule and disable one item at a time to compare results.

Example: The first rule matches a domain suffix and uses PROXY; the second is a fallback for other requests. example.com is an example domain, not a service endpoint.

[Rule]
DOMAIN-SUFFIX,example.com,PROXY
FINAL,DIRECT

04 / CONFIGURATION

Subscriptions & Configurations

Distinguish server entries from rule files: updating one does not mean the other has been updated. Subscriptions and QR codes are for handling details you already have.

SERVER: An interface term for a server entry. A usable entry typically combines a protocol, address, port and authentication settings. The displayed name is only a label; matching names do not mean the settings or actual route are the same. When troubleshooting, check the fields rather than changing only the display name.

Config: In the context of configuration file management, Config is the page for viewing, importing and selecting configurations. A file may include General, Rule and other sections. After importing, confirm which file is actually in use; seeing a filename in the list does not mean it has taken effect. This page is related to, but is not the same as, Config mode in Global Routing.

Scan QR Code: An entry point for scanning a QR code containing existing server or configuration details. A QR code is only a data carrier; it does not guarantee complete content or a trusted source. After scanning, check the protocol, address and authentication fields, then confirm the details are expected before saving. QR codes containing credentials should be protected like the original links and not shared publicly.

05 / SYSTEM & STORE

System & App Store

System authorization, data sync and purchase history are separate. Redownloading the app does not restore configurations or server details.

DNS: DNS resolves domain names to IP addresses as part of domain access. If connectivity tests return results but websites cannot be reached by domain name, check the resolution settings and returned address, and compare behavior on the current network. dns-server = system means using the system DNS settings; results may still differ across networks.

VPN Configuration: The configuration and authorization that allow Apple systems to let Shadowrocket create a network tunnel. A system confirmation prompt may appear the first time you connect. Authorization only allows the connection to be established; it does not verify server authentication, DNS or rules. If the toggle cannot be enabled, check VPN settings in the system first, then follow the Troubleshooting guide.

iCloud Sync: Syncs eligible data according to account and app settings; check the app for details about what can be synced. iCloud data and App Store purchase history are separate, so a purchase record does not tell you whether a configuration is stored. Before changing devices, check sync status and keep any necessary backups. After restoring, confirm that configuration files and server entries are present.

Purchased Items: The App Store section for checking purchase history and redownloading apps; the exact account page labels may vary by system version. If Shadowrocket is missing, first check that Media & Purchases uses the original purchasing account, then check the store region and purchase history. See Restore a Previous Purchase for the full checklist. After redownloading, confirm that configuration data is also available.

One-Time Purchase: The payment model for purchasing the Shadowrocket app, a closed-source commercial app available exclusively through the App Store. A one-time app purchase is not a proxy service subscription; you still need your own subscription or server details to connect. Check the App Store listing for pricing and eligibility, including general purchase and Family Sharing availability.

App Store Compatibility: The section of the App Store listing for checking supported devices and system requirements; expand it before purchasing. Shadowrocket is primarily used on iPhone and iPad; Mac, Apple TV and Apple Vision are also listed under compatibility on the same App Store page. Refer to the App Store listing for all system requirements. To verify the genuine app, check the official icon, developer Shadow Launch Technology Limited and app ID 932747118.

For step-by-step instructions, continue to the relevant guide. If something goes wrong, first note the current mode and the exact error message.

Import and connect for the first time → Troubleshoot by symptom → Verify the App Store listing →