Official User Manual · Features and Settings

Shadowrocket Settings Guide

First, check your server in Home, then select Config under Global Routing. Once the connection works, adjust DNS and On Demand. This page explains common features by what they do, where to find them, how to configure them, and what to watch for—so you can check each item without changing everything at once.

Everyday routing: Config Servers: Home Troubleshooting order: servers → rules → DNS

The Three Global Routing Modes

Global Routing determines how traffic is handled overall; it does not fill in missing server details. Open Global Routing from Home to see Config, Proxy, and Direct. When using the English interface, select these labels as shown. First choose a server you already have with complete settings, then select a routing mode. Changing modes will not fix an incorrect password, an expired subscription, or an unreachable server.

For everyday use, select Config so the rules in the active configuration determine where traffic goes. If some sites work while others do not, temporarily compare Proxy and Direct: Proxy can help determine whether the selected server can handle requests, while Direct can help test access over your current network. Change one setting at a time and retry the request. When testing is complete, switch back to Config.

Interface option	How traffic is handled	When to use it	Notes
Config	Uses the rules in the current Config to select PROXY, DIRECT, or another defined policy.	For everyday routing by domain, address, or region.	First confirm which configuration is active and check the order of its rules.
Proxy	Routes intercepted traffic through the proxy path.	Temporarily compare server connectivity to distinguish rule issues from server issues.	Still depends on the selected server. This does not cover traffic the system or an app does not hand to the client.
Direct	Routes intercepted traffic through a direct connection.	Check whether your current network can reach the destination directly.	Direct does not turn off the client's connection switch or stop On Demand.

Read how to use the three Global Routing modes →

Rule-Based Routing: Match Conditions and Policies

Rule types define what to match

Open the active configuration in Config and review its rules. DOMAIN matches an exact domain, DOMAIN-SUFFIX matches a domain and its subdomains, and DOMAIN-KEYWORD matches a keyword in a domain. IP-CIDR and IP-CIDR6 match address ranges; GEOIP matches based on the region associated with an address.

Prefer conditions with a clearly defined scope. DOMAIN-KEYWORD may match unexpected domains. USER-AGENT depends on the relevant request information being available and should not be treated as a universal way to identify all encrypted traffic.

Policies define what happens after a match

PROXY routes a request through the proxy path, DIRECT connects directly, and REJECT denies the request. A configuration may also refer to custom policy names; each name must be defined in the configuration. Changing only the text at the end of a rule is not enough.

Rules are generally evaluated in order, so put specific conditions before broader ones. FINAL handles requests that did not match any earlier rule. When troubleshooting, check which rule matched instead of just looking for a keyword somewhere in the file.

Edit and verify rules in Config

Keep a copy of the current configuration, then edit one rule and save. Return to Config to confirm the edited file is active, then select Config under Global Routing. The snippet below shows rule syntax only; example.com is a sample domain, not a complete configuration for every use case.

[Rule]
DOMAIN-SUFFIX,example.com,PROXY
GEOIP,CN,DIRECT
FINAL,PROXY

The first rule sends the sample domain and its subdomains through PROXY. The second sends requests matching addresses in the specified region through DIRECT, and the last handles everything else. Domain rules and address rules use different matching criteria, and DNS results can affect subsequent address rules. If the same site matches a different rule on another network, the rule may still be saved correctly—check the resolved address and connection records.

ConfigGlobal RoutingPROXYDIRECT

Subscribe and Add Server

Servers, subscriptions, and configuration files serve different purposes: a server stores connection settings, a subscription stores the address used to refresh a server list, and Config stores routing rules. Do not enter a subscription URL as a server address.

Subscribe: Import an Existing Subscription

From Home, open the add menu and choose Subscribe. Enter a subscription URL you already have and a recognizable name, save it, then update it. When the import finishes, return to Home, check that servers appear in the list, and run Connectivity Test on one of them.

Updating a subscription refreshes its remote list; it does not automatically fix connection problems. If an update fails, check that the URL is complete and still valid, and that your current network can reach it. Avoid repeatedly deleting and recreating subscriptions, as this can lose existing groups and notes.

Add Server: Enter a Single Server

Open Add Server and select the protocol that matches the information you have. Then enter the address, port, and authentication details. Shadowsocks, VMess, VLESS, Trojan, WireGuard, Hysteria2, and other protocols use different fields. Fill in an option only when the supplied server details specify it.

Fields such as TLS, transport, and server name must be consistent with one another. Do not change a setting just because another option seems more common. Use the types available in the current client. Save the entry, then return to Home and select it.

Import an individual share link from the clipboard or use Scan QR Code. First check whether it contains server details or a subscription update URL. Do not use an account page URL, a web address that requires a logged-in session, or incomplete QR code text as a Subscribe link.

Read the guide to subscription updates, organizing multiple subscriptions, sorting, and backups →

Multiple Protocols and Choosing a Server

A protocol describes how the client communicates with a server; it does not guarantee a faster connection. Select HTTP, SOCKS5, or another protocol based on the server details you have. With the wrong protocol, a connection may reach the address and port but still fail to authenticate or transfer data. Organize your list with notes about purpose, protocol, or group so similar test results are not mistaken for identical settings.

Connectivity Test reports a response using the current test method. A single timeout does not prove a server is unavailable, and a successful test does not prove that every destination is reachable. Test the same server again, try opening the target page, then check the rules and DNS to narrow down the issue.

On Demand: Connect on Demand

On Demand triggers connections based on system network conditions; it does not check whether a server is available. Find On Demand in the client to review its conditions and main switch. Its location and supported conditions depend on the platform and current interface. Before enabling it, confirm that a manual connection works with your server, Config, and DNS. This helps separate basic connection problems from automatic triggering behavior.

Note the current manual connection status and selected server, then confirm that a real request succeeds.
Open On Demand and review the existing conditions. If the interface offers network type or Wi-Fi conditions, configure them individually to match your needs. Avoid adding multiple overlapping conditions at once.
After enabling it, switch to the network you want to test. Check the system connection status, then reopen the target app and try again.
To stay disconnected, turn off On Demand before disconnecting. Turning off the connection switch in Home alone may allow a matching condition to reconnect later.

If the connection turns back on immediately after you switch it off, check On Demand before deleting the system connection configuration. If it does not trigger after a network change, check whether the condition matches, whether the system allows a connection, and whether the saved server is still available. Background behavior varies by system, so opening the app manually is not the same as a background trigger.

Data: Traffic Statistics and Connection Activity

Data shows traffic recorded by the client and can help determine whether requests are going through the current connection and whether an action generated traffic. Check uploads, downloads, and connection records in Data or the equivalent statistics screen on your platform. Categories and coverage depend on the labels shown in the interface. For troubleshooting, note the current values, perform one test action, then check again. This makes changes easier to identify than opening several apps at once.

Data statistics are not the service provider's billing records or a complete count of system network usage. Background apps, retries, connection overhead, and differences in measurement scope can all affect the numbers. To check remote usage, use the records for a service you already have; do not estimate it from the client's cumulative totals alone.

Before resetting statistics, check which period the interface is showing and save any records you need for troubleshooting. If a reset option is available, follow the on-screen instructions. A reset is only for tracking local changes; it does not reset remote usage. Before sharing Data or connection records, hide server and subscription addresses, authentication details, and any information that could reveal personal browsing activity.

Common Settings

Settings includes operating preferences and system integration options. Keep the working setup unchanged, then adjust one item at a time. Retest with the same server, destination, and network. Some DNS or connection settings may also be controlled by the current Config; confirm which setting is active before changing both the configuration file and Settings.

DNS: Domain Name Resolution

What it does: DNS resolves domain names to addresses needed for connections. If resolution fails, the server may be reachable while the destination site remains unavailable.

Where to find it and how to configure it: Check the DNS-related options in Settings and the active Config. First see whether a DNS server has been specified manually and whether it is reachable from your current network. Then make changes as required by the existing configuration. Avoid entering multiple addresses from unknown sources with different purposes.

What to watch for: DNS settings are not a universal speed boost. After changing them, retry the request and, if needed, reconnect to rule out stale cache. If only certain domains fail, also check the matching rule, resolved address, and destination service status.

Test Method

What it does: Test Method determines how Connectivity Test checks a server; it does not directly reflect the browsing experience.

Where to find it and how to configure it: In Settings, find Test Method and select an option available in the current client. If the interface lets you set a test target, choose one you can verify is reachable and suitable for testing. Return to Home and retest the same servers.

What to watch for: Test methods check different layers. Establishing a lower-level connection does not confirm that authentication, DNS, and access to the destination page all work. Compare servers using the same method and network conditions; do not mix results from different times or targets.

Today Widget: Quick Actions

What it does: Today Widget provides quick access to information or actions supported by the system, reducing the steps needed to open the client.

Where to find it and how to configure it: If the current iPhone / iPad version offers Today Widget, check the related options in Settings, then use the system's widget editing screen to add a widget offered by the client. Available actions depend on what the widget shows.

What to watch for: Widget content may need to refresh. If the expected option is missing, first check whether your system and client version still offer that widget type. Do not assume its location is the same in every version. Quick actions cannot bypass system connection authorization.

iCloud Sync: Configurations Across Devices

What it does: iCloud syncs data listed by the client between devices that support the feature; it is not a full system backup.

Where to find it and how to configure it: Confirm that you are signed in to your own iCloud account and have allowed the relevant access. Then check the iCloud sync options in Settings. Keep a local copy of your configuration before enabling sync, and review the sync scope shown in the current interface.

What to watch for: Avoid editing the same content on two devices at once. Save on one device and wait for sync to finish before checking on the other. Subscription credentials are sensitive; understand where they are stored and who can access the account before backing up or syncing them.

Diagnostics and Troubleshooting Order

Diagnostics helps collect information about connections and app behavior. Find Diagnostics, or the equivalent diagnostic option in your version, under Settings. First note the network, selected server, Global Routing mode, and action that produced the issue, then use the available tools. Relate diagnostic results to the request being tested; without a timestamp and context, a record may not show which layer failed.

Check the server first: In Home, confirm the selected entry and check its address, port, protocol, and authentication details, then run Connectivity Test. A successful subscription import only confirms that the list was retrieved; it does not mean every server can connect.
Then compare routing modes: Test the same destination with Proxy and Config. If Proxy works but Config does not, check which rule matched and whether custom policies are defined correctly. If neither works, check the server and DNS.
Check DNS separately: Confirm whether the failure affects specific domains and look for resolution errors. Do not change the server, DNS, and rules at the same time, or you will not know which change helped.
Finally, check system conditions: Review connection authorization, On Demand conditions, and behavior when switching networks. If needed, turn off automatic triggering and first confirm that a manual connection works consistently.

Before exporting or copying information from Diagnostics, check for subscription credentials, server authentication details, and personal activity records. Troubleshooting usually requires the error type, steps taken, and relevant settings—not a complete sensitive link. Once the issue is resolved, restore your everyday Config and revert temporary test changes one at a time.

The connection switch is on. Why won't a page load?

Turning on the switch means the client is trying to establish or maintain a connection; it does not guarantee that a request will succeed. Check the server and run Connectivity Test, compare Proxy and Config using the same destination, then check DNS. If only one app is affected, restart its connection and check its network status.

I changed a rule. Why does Data still show the old route?

First confirm that Global Routing is set to Config and that the edited configuration is selected. Existing connections may continue using their previous route. Send a new request, then check its connection record. Do not use changes in cumulative traffic to determine whether a new rule matched.

Will a usable server be available automatically after I get the client?

You need to import a subscription or server details you already have. A one-time client purchase does not include a service plan. The iPhone / iPad version costs $2.99 as a one-time App Store purchase; the Mac / Windows / Android / Linux versions are free. Getting the client and managing connection details for an existing service are separate.

Follow the getting-started guide for your first connection →