Official Guide · Settings Reference

Shadowrocket Features & Settings

Check Global Routing first, then review the active Config and server. Connection mode, routing policy, and automatic connection each serve a different purpose—don’t treat them as the same switch.

Home · Connections & Servers
Config · Configurations & Rules
Data · Traffic Records
Settings · General Options

Keep a working setup before making changes
This guide assumes you already have your own subscription or server details. Shadowrocket is a closed-source commercial app for Apple platforms, available exclusively on the App Store. A one-time client purchase is not a service plan. This site does not provide, sell, or recommend nodes or subscriptions. See App Store purchase and authenticity checks, or follow the setup guide to import your first configuration.

Connection modes

Global Routing: Config, Proxy, and Direct

Global Routing determines how connections handled by Shadowrocket are processed. In Home, open Global Routing and choose Config, Proxy, or Direct. These options correspond to configuration-based routing, proxying, and direct access. This is separate from the connection switch in Home: choosing a mode does not establish a connection or confirm that the selected server is available.

For everyday routing by domain or address, use Config. To check whether a problem is related to rules, compare with Proxy; to see whether the same destination is reachable over your regular network, use Direct. Keep the destination the same during comparisons, then restore your original mode so a temporary setting does not affect later access.

Option	How it works	When to use it	What to check first
Config · Configuration	Processes connections using the rules and policies in the active configuration.	Routes specified sites through PROXY, while other traffic follows rules such as DIRECT or another policy.	Check that the intended configuration is selected, rules are in the right order, and policies point to valid servers.
Proxy · Proxy	Routes most traffic handled by the client through the selected proxy path.	Temporarily test the server path to distinguish a rule issue from a connection issue.	Check the selected server’s settings and availability, bearing in mind that system and app traffic capture has limits.
Direct · Direct	Accesses handled connections directly.	Check whether the current network can reach the same destination directly.	Check whether the regular network, DNS, and destination service are available.

Config is both the name of the configuration screen and an option in Global Routing. Keep the context in mind: saving a file on the Config screen does not mean it is active; selecting Config mode does not mean every destination will use PROXY. Check the rule that actually matches to determine the path.

Treat rules like a script

Rule: Match Conditions and Actions

In Config mode, routing rules select how to handle a connection based on conditions such as its domain or address. On the Config screen, select the active configuration and open its editor or rule viewer to review the Rule entries. Export a backup before editing, and change one rule at a time. If the configuration comes from a remote URL, check whether updating it will overwrite local edits.

Read rule conditions separately from their actions. DOMAIN matches a specific domain; DOMAIN-SUFFIX matches a domain and its subdomains; DOMAIN-KEYWORD looks for a keyword in the domain and generally matches more broadly. IP-CIDR and IP-CIDR6 match address ranges, while GEOIP checks the address’s geographic data. USER-AGENT depends on the relevant request information being available, so don’t assume it applies to every connection.

[Rule]
DOMAIN,example.com,PROXY
DOMAIN-SUFFIX,example.org,PROXY
DOMAIN-KEYWORD,example,DIRECT
IP-CIDR,192.168.0.0/16,DIRECT
FINAL,DIRECT

This is a rule syntax example, not a connectable server. PROXY sends matching traffic to a proxy policy, DIRECT accesses it directly, and REJECT blocks matching connections. If the configuration uses custom policy names, check that the corresponding policy groups are defined and selected. A name at the end of a rule does not create a working connection path.

Standard Rule entries are checked from top to bottom, and the first match determines the action. Put specific exceptions before broader conditions. FINAL is the fallback when no earlier rule matches, so place it at the end. To proxy only selected sites, list their DOMAIN or DOMAIN-SUFFIX rules first, then use FINAL,DIRECT. Keep in mind that a site may also request resources from other domains.

A successful connection doesn’t prove the rule is correct
To verify a rule, make a new request to the destination, then check the connection record for the target, matched rule, and policy. Existing long-lived connections may continue using their previous path. See the routing rules reference for syntax, configuration structure, and precedence.

Manage existing details

Subscribe and Add Server

A server entry stores the details for one connection; a subscription lets you fetch and update a set of existing server details in one place. Use Home to view and select servers and connect, Add Server to add an entry, and Subscribe options to manage subscription sources. The Config screen is for configuration files. Subscription URLs and rule configuration URLs serve different purposes; they are not interchangeable just because both are URLs.

Choose the right format before adding

When adding a server manually with Add Server, select the Type that matches your existing details, then enter the address, port, authentication details, and relevant transport options. Shadowsocks, VMess, VLESS, Trojan, WireGuard, and Hysteria2 require different fields; entering only the server address is not enough. Scan QR Code and clipboard import can save typing, but check each imported field afterward.

Keep source boundaries in mind when updating

When managing existing subscriptions, give each source a recognizable name. After updating, check the server count, groups, and current selection. An update may replace entries from that source, so edits to an individual server may not persist. If you need to keep personal changes, first check whether the app offers a copy or local-save option, and keep those entries separate from subscription-managed records.

Before deleting anything, confirm whether you’re removing one server, an entire subscription, or a Config file. They may be related, but they are separate data. If a subscription update fails, check that the URL is complete, access credentials are valid, and the current network can retrieve its contents. Don’t post a full URL containing credentials in public feedback, and don’t repeatedly import the same URL instead of troubleshooting it.

Connection triggers

On Demand: Connect When Conditions Are Met

On Demand triggers connection behavior based on preset network conditions. It controls when to connect, not which route a website uses. Review or edit conditions from the On Demand screen; the exact location and available options depend on the current app interface. Before enabling it, make sure manual connection, the selected server, and Config are working.

Start with a specific use case, such as whether to connect automatically on a particular Wi-Fi network, and add only the conditions needed for it. If the interface offers network-type or Wi-Fi name options, check the names and the order of the conditions. Avoid adding many overlapping conditions at once, or it may be hard to tell what triggered a behavior after switching networks.

After saving, test on the network you normally use, then switch to another network and check again. Automatic reconnection may depend on system scheduling, device state, and network changes. On Demand can’t make an unavailable server work or fix a policy name in a rule. For ongoing troubleshooting, pause automatic triggers and connect manually to avoid repeated state changes during testing.

VPN authorization and automatic connection are separate
The first time you connect, the system may ask permission to add a VPN configuration. That’s part of the system authorization process. On Demand sets connection conditions on top of an existing configuration. A VPN status indicator means the related connection is active; it does not mean every destination uses the same policy.

Check access

Data: Traffic Stats and Connection Records

Data shows traffic and connection details recorded by the client. Open Data and first check the scope, time period, or reset state of the current stats, then review items such as upload and download. These figures reflect what the client observed within the relevant stats range; they are not total device network usage or a billing statement for an existing subscription account.

To verify a rule, note the current data or use the available clear option, visit a single destination, then check the new connections. Focus on the target domain or address, the policy used, and any displayed match details. A page may load images, APIs, and other resources from multiple domains, so it’s normal to see several connections for one page.

An increase in the stats only shows that traffic passed through the relevant path; it doesn’t prove that the page content loaded completely. Background tasks may also generate traffic. When comparing results before and after a change, use the same network and destination and keep the test scope similar. Before clearing records, preserve any useful troubleshooting clues. Hide private domains, addresses, and authentication details when sharing feedback.

Name resolution

DNS: Separate Resolution from Connectivity

DNS resolves domain names to addresses needed for connections. It relates to proxy protocols and routing policies, but it is a separate layer: a server connection can succeed while a destination domain fails to resolve, and a domain can resolve even when its service port is unreachable. Check these stages separately instead of changing every setting as soon as a page fails.

Where to check and change settings

First review the available DNS options in Settings, then check whether the active Config includes resolution settings. Entries such as General and Host in a configuration file may affect the result; changing one general option may not change all DNS behavior in the active configuration. Check the current option descriptions and diagnostic results to understand how the configuration and general settings interact.

Note the original value before making changes, and identify the issue: a resolution timeout, an unexpected address, or reachability on a particular network. Use an existing DNS setting suited to your network, change one thing at a time, and retest the same domain. Don’t change DNS, rules, and servers all at once; even if access is restored, you won’t know which change helped.

Keep caching and domain rules in mind

After changing DNS settings, existing caches and long-lived connections may temporarily keep results unchanged. Use the app’s available clear or reconnect options, then make a new request. Rules such as DOMAIN-SUFFIX use domain information, while IP-CIDR checks address ranges; consider both the domain and address observed for a request. One returned address does not prove that every request uses the same policy.

Common Settings

Test Method, Widgets, and Sync

Settings brings together general options for testing, display, sync, and diagnostics. Options and their locations may vary by device and app interface. The sections below explain them by purpose; read the descriptions next to each option before changing it. If you’re unsure about an advanced setting, leave it unchanged to avoid turning a targeted troubleshooting step into a full configuration rebuild.

Test Method: Set the Conditions for Connectivity Test

Test Method selects how connectivity is tested and is usually found alongside other test options in Settings. First decide whether you’re checking basic connectivity or the ability to reach a test destination through a proxy, then choose an available method. Return to Home to run Connectivity Test on an existing server. For a meaningful comparison, keep the method and test destination the same.

A test result reflects conditions at that moment and with that method; it is not a long-term speed guarantee. A test may fail while websites work because the method or test destination is unsuitable. A successful test alongside a failing website may point to that site’s rules, DNS, or service status. Don’t reorder every server based on one test result.

Today Widget: A Shortcut, Not a Routing Policy

Today Widget settings support displaying app information or quick actions through a system widget. Check the available options in Settings and add the widget where the system allows. Its appearance and refresh behavior depend on the device and system support, so don’t assume every device has the same options.

After using a widget action, return to Home if needed to confirm the connection status and selected server. The widget doesn’t replace rules in Config or fill in missing server details. If it temporarily looks out of sync with the main screen, check the main screen first, then see whether the system widget has refreshed.

iCloud Sync: Check What’s Included

iCloud sync can sync app-supported data between eligible devices. Before checking its settings in Settings, confirm that you’re signed in to your own Apple Account, iCloud permissions are available, and you understand the scope described by the option. Don’t assume connection records, all credentials, and every local file will sync.

Before changing devices, check sync status and export separate backups of important configurations. After restoring on the new device, review subscriptions, servers, Config, Global Routing, and On Demand in turn. Verify the connection manually before restoring automatic connection conditions. App purchases and configuration sync are separate mechanisms; restoring a purchase does not restore your configuration.

Troubleshoot by symptom

Diagnostics: Verify One Part at a Time

Diagnostics helps gather and inspect clues about connection issues. Open the relevant diagnostic tools from Settings; available tools depend on what the current app interface shows. Before you start, describe a reproducible symptom: do all destinations fail, is one domain affected, or does the issue occur only after switching networks? A specific symptom makes it easier to decide what to check next.

Record the current state. Note Global Routing, the selected server, the active configuration, and the network type. Keep the original configuration and pause automatic connection conditions that could change the state during testing.
Check the underlying network. Confirm that the device’s current network can access the internet normally. If the network itself is having issues, address that first so you don’t mistake it for a rule problem.
Check server details. Compare Type, address, port, and authentication fields with your existing details, then run an appropriate Connectivity Test. When entering details manually, watch for extra spaces and missing fields.
Check domain resolution. Check the resolution result for the same domain that failed. A domain that won’t resolve and an address that can’t be reached are different problems and should be handled separately.
Check the route. In Config mode, make a new request and use the records to check the matched rule and policy. If needed, briefly switch to Proxy for comparison, then restore the original mode.
Summarize results and restore settings. Note which change affected the result, undo changes that didn’t help, and confirm that your everyday settings and On Demand are back to the intended state.

Logs may include subscription URLs, server details, visited domains, or authentication data. Review and redact sensitive fields before exporting or sharing, and include only what’s needed to investigate the issue. Diagnostic tools provide evidence, not an automatic fix. If a test doesn’t reproduce the issue once, that doesn’t prove it’s gone.

Common Settings Questions

Why do some connections still use DIRECT in Config mode?

Config means routing is determined by the configuration, not that every connection uses PROXY. Check which rule matches the destination and whether FINAL,DIRECT is the fallback. Also confirm that the active configuration is the one you just edited.

Do I still need rules with On Demand enabled?

Consider them separately. On Demand determines when a connection is triggered; Global Routing and Config determine how it is handled after it connects. Verify manual connection and routing first, then enable automatic triggers.

Why did my local changes change after a subscription update?

Server entries managed by a subscription may be regenerated from the source when it updates. First distinguish local entries, subscription entries, and routing rules. Save important changes separately and check the selected item after updating.

Where can I check system compatibility after configuring the app?

Shadowrocket is primarily used on iPhone and iPad. Compatibility with Mac, Apple TV, and Apple Vision, as well as all system requirements, is as stated on the App Store page. See how to verify the App Store purchase and check the three authenticity details.

For steps starting with your first import, continue to the setup guide. To review the complete rule structure and keywords, see the routing rules reference. For both, follow the same approach: back up first, change one thing at a time, verify with a new request, then decide whether to keep the change.