Shadowrocket Setup Guide Add a subscription and configure rules

Rule: from specific rules to FINAL

When Config is selected in Global Routing, the rules in the configuration determine how requests are handled. Rules are usually checked from top to bottom, and the first match determines the policy. Put specific domain and local network rules before fallback rules. Edit the active file in Config, then confirm it remains selected after saving. In the snippet below, the example domain uses PROXY, local network addresses use DIRECT, and FINAL handles all other requests. Actual results also depend on domain resolution, rule conditions, and whether the policy is available.

[Rule]
DOMAIN-SUFFIX,example.com,PROXY
IP-CIDR,192.168.0.0/16,DIRECT
FINAL,DIRECT

Global Routing: check the current mode first

Global Routing on Home offers Config, Proxy, and Direct modes: use the configuration, route requests through a proxy, or connect directly. To use rule-based routing, select Config first, then check the active configuration and current server. When troubleshooting, you can temporarily compare the same destination across modes, changing only one setting at a time and restoring it after testing. Changing modes does not correct server authentication details or replace checking DNS and connection logs.

[Rule]
DOMAIN,example.com,DIRECT
FINAL,PROXY

This snippet shows rules used with Config; it does not change Global Routing.

Subscribe: import content you already have

Prepare a subscription URL you already have. In Add Server, select Subscribe, enter the URL, and save. To import an existing QR code, use Scan QR Code. After importing, check that the item appears and review its type and required fields, then select an item to test. Updating a subscription may change items maintained remotely, so avoid keeping important local edits only in subscription-generated entries. Subscription URLs may contain access credentials; hide the full URL and authentication details when asking for help. This guide explains how to import a subscription but does not provide or recommend subscriptions.

[General]
dns-server = system

Subscribe imports connection items; the DNS settings above belong to Config. Check them separately.

Add Server: check parameters by Type

Shadowrocket supports protocols including Shadowsocks, VMess, VLESS, Trojan, and Hysteria2. In Add Server, select Type first, then enter the Host, Port, and authentication fields using server details you already have. Required parameters vary by protocol; the transport, TLS, and server name cannot be inferred from the protocol name alone. Review each field after importing a link, and do not copy fields from one protocol to another. PROXY policies can only work when the connection item is configured correctly.

[Rule]
DOMAIN-SUFFIX,example.com,PROXY
FINAL,DIRECT

PROXY in a rule is a handling policy, not a protocol name.

On Demand: how connection conditions and rules differ

On Demand triggers connections based on configured conditions. Find its options in Settings. First test a manual connection and basic access, then adjust trigger conditions one at a time. This helps distinguish automatic connection behavior from a configuration that was not saved. On Demand controls when a connection starts; Rule controls how requests are handled while it is active. They do not replace each other. If you need to stop a connection manually or investigate network changes, check the On Demand status as well. After restoring the original conditions, see whether repeated connections continue.

[Rule]
IP-CIDR,192.168.0.0/16,DIRECT
FINAL,PROXY

This snippet shows how requests are routed; check On Demand conditions in the relevant settings.

Config: saving, selecting, and applying changes

Config manages the files that determine how requests are handled. Common sections include General and Rule. Keep a copy of the original file before editing, and change one clearly identified option at a time. After saving, check that the intended configuration is selected and that Global Routing uses it. Otherwise, the file may have changed without affecting requests as expected. Remote configuration updates may overwrite remotely managed content, so back up long-term local changes separately. This example uses system DNS and sends unmatched requests to DIRECT; that does not make it suitable for every network.

[General]
bypass-system = true
dns-server = system

[Rule]
FINAL,DIRECT

Data: check the scope and time period first

Traffic information in Data can help you observe requests handled by the client and changes in usage. Before reading the statistics, check the displayed time period and scope, then compare the results before and after one specific action. Traffic records are not the same as server-side billing and cannot, by themselves, confirm whether a destination was reached. When troubleshooting routing, review Data alongside the current rules and connection status. If you have just changed the configuration or reset the records, establish a new baseline rather than comparing data from different periods.

[Rule]
DOMAIN,example.com,DIRECT
FINAL,PROXY

Rules determine handling policies; interpret changes in statistics in light of actual requests and the reporting scope.

iCloud: keep a backup beyond syncing

Before moving to a new device, check the iCloud options in Settings and confirm your system account, available storage, and sync status. The account used for app purchases and the system iCloud account serve different purposes; a purchase record does not confirm that configuration has synced. Keep a copy of your current configuration and separately note any subscription details you will need to import again. After migration, check the active Config, existing items, and Global Routing, then test the connection. Sync is not the same as a historical backup, and accidental edits may sync too, so export an extra copy before important changes.

[General]
dns-server = system

[Rule]
FINAL,DIRECT

Diagnostics: narrow down connection issues step by step

When a connection fails, first confirm that your current network is working. Then check the selected item, authentication fields, and Global Routing. Connectivity Test can provide clues; Diagnostics and Log in Settings help identify the stage where a failure occurs. A successful test does not mean every destination is reachable, and a failed test does not automatically point to a rule. Use one fixed test destination and compare connection, DNS, and rule results in sequence, changing one variable at a time. Before sharing logs, remove subscription URLs, authentication details, and other sensitive information.

[General]
dns-server = system

[Rule]
FINAL,DIRECT