Official Manual · Glossary

Shadowrocket Glossary

Interface and controls, protocols, rule keywords, subscriptions and configuration, accounts and purchases.

Interface labels and protocol names are kept in their original English. Each entry explains what a term does and what you should not infer from it. Use this glossary when you already have your own subscription or server details. For first-time setup, start with the tutorial; for connection issues, work through the troubleshooting guide.

Connection and routing controls

Interface and controls

Check the current Global Routing mode before interpreting test results. The connection toggle, automatic connection triggers, and the action for an individual request are separate things.

Interface and controlsHome: Home is the main place to check connection status, Global Routing, Connectivity Test, and the SERVER list. On first launch, Not Connected means no connection has been established. Starting a connection may prompt you to allow the addition of a VPN configuration. A change in connection status only indicates a change in tunnel state; check separately whether the destination website is reachable.

Interface and controlsGlobal Routing: Global Routing determines how traffic is handled overall: Config follows the configuration rules, Proxy uses the proxy route, and Direct uses a direct connection. To route traffic by domain or IP rules, select Config and make sure the intended configuration is selected. You can temporarily switch modes to compare results while troubleshooting, but restore the original setting afterward so the test mode does not become your everyday configuration.

Interface and controlsConfig: Config refers both to the configuration file management screen and to the Global Routing mode that handles traffic according to the configuration. Open the Config screen to manage files; select Config mode to use the current configuration's rules. Importing a file does not mean it has been selected. If rules do not take effect, check both.

Interface and controlsProxy / Direct: In Global Routing, Proxy sends traffic over the proxy route, while Direct connects directly. These modes are useful for temporarily comparing the two paths. The capitalized interface labels are distinct from the all-caps rule actions PROXY and DIRECT. If a destination works with Direct, that does not confirm the proxy settings are correct. A successful Proxy test does not confirm that rules in Config are ordered correctly.

Interface and controlsOn Demand: On Demand starts a connection when configured conditions are met; it controls when the connection starts. Rule determines how an individual request is handled once connected. Check these separately. If the connection comes back after you turn it off, review the On Demand conditions and test again on the current network.

Interface and controlsConnectivity Test: Connectivity Test checks server reachability using the selected test method. Results depend on the current network, test target, and server response. The reported time is not a measure of sustained download speed and does not guarantee access to every website. To compare results, keep the test method and network conditions consistent, then verify with requests to the actual destinations.

Interface and controlsAdd Server / SERVER: Add Server lets you enter the protocol, address, port, and authentication details for a server you already have. The SERVER list displays these connection entries. Saving an entry only means the details have been entered; it does not confirm successful authentication or connection. When adding one manually, check the protocol type first, then verify its transport and security settings instead of choosing a type based on its name alone.

Interface and controlsDNS: DNS resolves domain names to IP addresses, a step required before many network connections can be established. Check the DNS resolution path separately from the path used for subsequent requests; a DNS failure does not necessarily mean the proxy server is unreachable. When troubleshooting, check the resolution result and error first, then review the DNS settings in the configuration. Avoid changing several DNS options at once.

Identifying server settings

Protocols

A protocol defines how the client and server communicate; it is not a rating of speed or reliability. The terms below help identify connection details you already have. Check the current app interface for supported options and settings.

ProtocolsShadowsocks: Shadowsocks is a proxy protocol. Common settings include the server address, port, password, and encryption method. The encryption method must match the server's settings; using the right password will not compensate for a mismatched method. If your connection details include additional transport settings, check those too. An address and password alone may not be enough to complete the configuration.

ProtocolsVMess: VMess is an authentication-based proxy protocol. A connection typically uses a user ID and associated transport settings. The same address and port can support different transports, so also check the path, Host, and TLS fields. If authentication fails, check that the device time is accurate rather than repeatedly changing the displayed server name.

ProtocolsVLESS: VLESS authenticates using a user ID; the connection method also depends on the transport and security settings configured on the server. VLESS and VMess are different protocols, so similar fields do not make them interchangeable. If you need to check an imported entry manually, verify each setting against the server details you have rather than applying defaults from another protocol.

ProtocolsTrojan: Trojan is a proxy protocol commonly used with TLS. The authentication settings and server name must be correct. The server address, name used for TLS, and name covered by the certificate may need to be checked separately. For certificate errors, check the name, validity, and device time; disabling certificate validation is not a routine fix.

ProtocolsHysteria2: Hysteria2 is a QUIC-based proxy protocol that requires UDP reachability along the network path. Authentication, TLS, obfuscation, and bandwidth-related settings should match the server details you have. Check the app interface for the available fields. The protocol name does not guarantee speed; packet loss, server load, and settings all affect performance.

ProtocolsWireGuard: WireGuard uses key pairs and peer configuration to create an encrypted tunnel. In addition to the endpoint, settings include tunnel addresses and allowed routes. The private key and peer public key serve different purposes and cannot be used interchangeably. Do not share configurations that contain a private key. To determine whether a destination is reachable after import, check the peer's allowed IP ranges and the routes in use.

ProtocolsHTTP / SOCKS5: HTTP and SOCKS5 are different proxy protocols; choose the type actually provided by the server. Whether a username and password or transport encryption are required depends on the service settings, not the protocol name alone. Supported request types and UDP capabilities may also differ, so a successful test for one type of request does not mean others will work.

Matching conditions and actions

Rule keywords

Rules are checked from top to bottom, and the action for the first match is applied. The domains and addresses below are examples for explaining syntax, not usable connection service details.

Rule keywordsRule: Rule links matching conditions to actions and is commonly written in the [Rule] section of a configuration file. In Config mode, requests are checked against rules in order. The action for the first match is applied; later rules that look more specific are not checked. Put exceptions or narrowly scoped rules first, broader conditions afterward, and the fallback last.

Rule keywordsDOMAIN: DOMAIN matches one exact, complete domain name and does not automatically cover its subdomains. For example, DOMAIN,example.com,PROXY matches example.com, but this rule does not also match www.example.com. To cover an entire domain and its subdomains, consider DOMAIN-SUFFIX instead of trying to list every subdomain.

Rule keywordsDOMAIN-SUFFIX: DOMAIN-SUFFIX matches a specified domain and its subdomains, making it useful for applying the same action across a domain tree. For example, DOMAIN-SUFFIX,example.com,PROXY matches example.com and api.example.com, but not every domain that happens to contain the text example.com. If a subdomain needs a different action, put its exception rule before this one.

Rule keywordsDOMAIN-KEYWORD: DOMAIN-KEYWORD checks whether a domain name contains a specified keyword. It usually matches more broadly than DOMAIN or DOMAIN-SUFFIX. For example, DOMAIN-KEYWORD,example,PROXY may match multiple unrelated domains containing example. Use it only when broad matching is intended, and check for unintended matches.

Rule keywordsGEOIP: GEOIP uses an IP geolocation database to determine the region associated with a destination address, then applies the specified action. It indicates how the address is classified in the database, not the webpage's language, the visitor's location, or whether a service is available. A domain may resolve to distributed addresses, and database classifications can vary. When troubleshooting, check the actual resolved address and the rule that matched.

Rule keywordsIP-CIDR: IP-CIDR matches IPv4 address ranges. The prefix length after the slash sets the range. For example, IP-CIDR,192.168.0.0/16,DIRECT specifies a direct connection for this private address range. Whether a domain request triggers a DNS lookup for matching also depends on the relevant options. Check the range before making changes; avoid using an overly broad network range for a single address.

Rule keywordsIP-CIDR6: IP-CIDR6 matches IPv6 address ranges and corresponds to IP-CIDR for IPv4. For example, IP-CIDR6,::1/128,DIRECT matches the IPv6 loopback address. If a destination uses IPv6, checking IPv4 rules alone will not explain every request. Check the resolution results and IPv6 routes too.

Rule keywordsFINAL: FINAL sets a fallback action for requests that did not match any earlier conditions and is usually placed at the end of the rules. For example, FINAL,DIRECT sends remaining requests over a direct connection, while FINAL,PROXY sends them over the proxy route. FINAL does not override earlier matching rules. Before changing it, confirm how unmatched traffic should be handled.

Rule keywordsPROXY / DIRECT / REJECT: PROXY, DIRECT, and REJECT are common rule actions: use the proxy route, connect directly, or reject matching requests. They answer what to do after a match; they are not server addresses or matching conditions. If a broad REJECT rule appears first, later PROXY rules cannot choose a route again for requests that have already been rejected.

Rule keywordsUSER-AGENT: USER-AGENT matches information in the User-Agent field of an HTTP request to identify the client characteristics the request declares. Whether it works depends on whether that request information is visible. It is not a way to identify apps across all traffic. Request headers can also change, so do not rely on this as the sole basis for long-term routing.

The same rules can produce different results in a different order

To reject ads.example.com while routing the other subdomains of example.com through PROXY, put the more specific reject rule first, followed by the domain-suffix rule. See Rule Types Explained for more examples of matching scope.

[Rule]
DOMAIN-SUFFIX,ads.example.com,REJECT
DOMAIN-SUFFIX,example.com,PROXY
FINAL,DIRECT

Connection entries and file structure

Subscriptions and configuration

Importing a server list is not the same as importing routing rules. First identify whether you received a subscription URL, a single connection entry, or a configuration file, then choose the corresponding action.

Subscriptions and configurationServer: A Server is an entry containing a connection endpoint, protocol, and authentication settings. It is also commonly called a node in Chinese-language guides. The list name helps identify an entry and may differ from the actual server address; it does not indicate location or connection quality. When troubleshooting, check the actual settings and whether the entry was added manually or updated from a subscription, so an update does not overwrite manual changes unexpectedly.

Subscriptions and configuration.conf: .conf is a common file extension for Shadowrocket configuration files. A file can contain sections such as [General], [Rule], [Host], and [URL Rewrite]. It describes global settings, routing conditions, or request handling; it is not a server subscription list. Keep a copy of the original before editing, select the modified configuration, and test each item in Config mode.

Subscriptions and configurationHost: The [Host] section sets local domain mappings so specified domains use configured resolution results. It changes which address a domain resolves to, not which action a request uses; routing is still handled by the relevant rules. A Host field in a server entry may specify the hostname used for transport. Check where the field appears; these are not the same setting.

Subscriptions and configurationURL Rewrite: URL Rewrite handles request URLs based on matching conditions. It is different from Rule, which determines whether traffic uses a proxy or direct route. Whether a rewrite works depends on the matching expression, the rewrite action, and whether the app can read the relevant request information. Confirm the target URL and expected result before configuring it. Use it only for requests you understand, and disable new entries temporarily to compare results when something goes wrong.

Official listing and purchase records

Accounts and purchases

App purchases, server services, and local configuration are managed separately. For purchases and restoration, refer to the information currently shown in the App Store. App access does not mean your configuration is backed up.

Accounts and purchasesVerify the official App Store listing: Shadowrocket is available only on Apple platforms, and App Store is the only place to get it. Verify the official icon, developer Shadow Launch Technology Limited, and app ID 932747118 in the product page URL; a matching name in search results alone is not enough. System requirements and purchase eligibility for iPhone, iPad, and other compatible devices are as listed on the App Store page.

Accounts and purchasesOne-time purchase: A one-time purchase applies to the client app itself. Shadowrocket is closed-source commercial software. Buying the app does not include a server, subscription, or service allowance. Check the App Store purchase confirmation for the current price and currency. Users must obtain and maintain their own connection details.

Accounts and purchasesPurchased items: Purchased items is the App Store section for finding purchase records and redownloading apps. When changing or restoring a device, first check which account was used for the purchase. Restoring the app is separate from restoring server details or configuration files; redownloading the app does not guarantee that the original configuration will return. Compatibility, Universal Purchase, and Family Sharing eligibility are as listed on the App Store page.

To verify the product page and purchase steps, see Verify the official App Store listing. For instructions in the order you will use them, continue to the Shadowrocket tutorial.