Settings / Feature Index

Shadowrocket Features and Settings

Use Global Routing to see how requests are handled, then check Config, server details, and Settings. This page explains what each feature does, where to find it, how to configure it, and what to watch for on iPhone and iPad.

Shadowrocket Guide - Official Manual

Understand the three layers before changing settings

Server details determine the protocol, address, and authentication used for a connection. Rules in Config determine which policy handles each request. Settings affect behavior such as testing, display, and sync. Changing one layer does not automatically fix problems in the other two.

This guide assumes you already have your own subscription or server details. New users can start with the Getting Started Guide. For explanations of individual options, see the Settings Reference. Menu locations may vary slightly by device; follow what appears in your app.

The app is a one-time purchase; connection service is separate. This is the official Shadowrocket website and manual. It does not provide, sell, or recommend nodes or subscriptions. Shadowrocket is available only on Apple platforms, and the App Store is the only place to get it. See Getting the App for purchase and authenticity details. Check the App Store listing for system requirements.

01 / Global Routing

When to use Config, Proxy, and Direct

What it is: Global Routing is where you choose how traffic is routed overall. The three common options are Config, Proxy, and Direct. They describe how traffic is handled, not three sets of servers or connection quality levels. Changing modes does not alter authentication details in a subscription.

Where to find it: On Home, tap Global Routing to open the options. Before switching, note the current mode and selected server so you can restore them after testing. Config mode is related to the Config tab at the bottom, where configuration files are managed, but the two are not the same operation: the mode determines whether rules are used, while the tab lets you select and edit the file containing those rules.

Option	How requests are handled	When to use it	What to check afterward
Config	Uses rules in the currently enabled configuration to select a policy.	For everyday routing based on conditions such as domain names and addresses.	Confirm the enabled file, rule order, and policy names.
Proxy	Routes traffic through a proxy; system bypass settings and related configuration may still affect requests.	As a brief comparison to check whether a problem is related to routing rules.	Make sure the selected server is valid. Switching modes does not fix server parameters.
Direct	Connects directly, without forwarding traffic through a remote proxy server.	To check direct access on the current network.	Use the same test target and network conditions, then restore the original mode.

How to set it up: If you have a working rules configuration, select Config and confirm that the intended file is enabled on the Config tab. If a request behaves unexpectedly, switch to Proxy briefly for comparison, then switch back to Config and check which rule matched. Direct is useful as a baseline for direct connections; it is not a universal fix for connection problems.

What to watch for: The VPN icon in the status bar does not tell you whether a request passed through a remote server. It indicates the system’s network tunnel status, not that every request uses the same policy. Existing long-lived connections may continue after you change Global Routing. Start a new request before comparing results, and if needed, close and reopen the relevant app.

02 / Config · Rule

Rule types, policies, and matching order

What it is: A rule combines a matching condition with an action. DOMAIN matches an exact domain, DOMAIN-SUFFIX matches a domain and its subdomains, and DOMAIN-KEYWORD matches a keyword in a domain. IP-CIDR and IP-CIDR6 match address ranges, while GEOIP matches based on IP geolocation data. The rule type determines what is matched; policies such as DIRECT, PROXY, and REJECT determine what happens when it matches.

Where to find it: Open Config, identify the currently enabled configuration file, and inspect its Rule section. When editing the file directly, rules go under [Rule]. Make sure you are editing the file that is actually enabled. Saving changes to a different file does not make its rules apply to the current connection.

How to set it up: Start with a small number of clearly targeted rules. example.com below is a documentation example, not a server address. The first line routes that domain and its subdomains through PROXY. The second sends a specified local address range to DIRECT. The final FINAL rule sets a fallback policy for requests that did not match earlier rules.

[Rule]
DOMAIN-SUFFIX,example.com,PROXY
IP-CIDR,192.168.0.0/16,DIRECT
FINAL,DIRECT

Rules are generally checked from top to bottom, and the first match determines how a request is handled. Put specific exceptions before broader conditions, and place FINAL at the end. If an earlier rule already covers a wide range, a more specific rule added later may never match. Changing the fallback policy can affect many requests without their own rules, so be clear about your default behavior before making changes.

What to watch for: DIRECT connects directly, PROXY uses a proxy policy, and REJECT blocks matching requests. If your configuration refers to a custom policy name, check that it exists, is spelled consistently, and points to a valid policy. A domain-based rejection applies only to requests that match the relevant condition; it does not mean every related request from an app will be blocked.

Conditions such as USER-AGENT also depend on the request type and which fields are visible, so they are not a general substitute for domain rules. When troubleshooting, check actual requests and match records before changing rules. Avoid adding multiple broad conditions just because one test failed. See the Glossary for more rule keywords.

03 / Subscribe · Add Server

Managing existing subscriptions and servers

What it is: A subscription is a way to retrieve and update server entries in bulk. Each server entry contains a protocol, address, port, and authentication parameters. Updating a subscription refreshes its entries; it does not automatically enable a rules configuration. After updating the server list, check Global Routing and Config separately.

Where to find it: Manage the server list on Home. Use Add Server to enter existing server details or add a subscription of type Subscribe. If you already have a QR code, use Scan QR Code. After importing, open the entry and check its type and fields rather than relying on its display name.

How to set it up: First, ask your information provider to confirm that the subscription URL is complete. Enter it in the address field for Subscribe and save. After the update, check that the expected entries appear, then select one and run Connectivity Test. For manual setup, match the protocol to your existing server details, then check the address, port, authentication, TLS, and transport parameters individually.

Protocols such as Shadowsocks, VMess, VLESS, Trojan, Hysteria2, WireGuard, Snell, and TUIC use different fields. Similar-looking fields do not necessarily mean the same thing, so do not copy one protocol’s parameters into another protocol’s form. Set transport and TLS options according to your server details, not by toggling them at random based on network behavior.

What to watch for: A subscription URL may contain access credentials. Don’t include it in public screenshots, chat messages, or shared configuration files. Before deleting a subscription group, check whether it contains manual entries you need to keep. After a bulk update, recheck the current selection in case an entry changed or was removed. Renaming or editing subscription-managed entries may be undone by a later update, so save important details first.

04 / On Demand

Connect based on network conditions

What it is: On Demand triggers or maintains the system VPN connection according to configured conditions. It controls when a connection is established; Config rules determine how requests are routed. Enabling On Demand does not fix server parameters or mean that all traffic uses PROXY.

Where to find it: Look for On Demand in Settings and configure the network conditions available in your current interface. The first time you use the system VPN feature, read the system authorization prompt. System VPN settings may also show the status of On Demand, so check them alongside the in-app settings.

How to set it up: First, confirm that the server and rules work with a manual connection, then configure On Demand. Choose conditions that match your needs, such as distinguishing between Wi-Fi and cellular networks. If the interface lets you set conditions by Wi-Fi network name, select the intended network carefully. Change one type of condition at a time, then switch to the relevant network and check whether the connection starts as expected.

What to watch for: After On Demand is enabled, a manual disconnect may be followed by an automatic reconnect when the conditions are met again. That does not necessarily mean the switch is malfunctioning. To stop the connection temporarily, first check and disable the relevant On Demand conditions, then disconnect. Public Wi-Fi sign-in pages, network changes, and other VPN configurations may also affect behavior. For troubleshooting, switch back to a manual connection to make a clear comparison.

05 / Data

Understanding data usage and its limits

What it is: Data shows traffic recorded by the app. Use it to check whether data was transferred during a connection and whether upload or download totals changed. These figures cover only what the app can observe; they are not carrier billing figures and cannot replace usage records from the server side.

Where to find it: Open Data and identify the scope, time range, and units shown. Different views may show different measurements, so use the field labels as your guide. If the interface offers a reset or clear option, note the current figures first so you don’t lose a useful comparison point.

How to check: Run a controlled test: pause unnecessary background activity, note the figures before testing, open a specific page, then return to Data and compare. For comparisons across multiple tests, use the same network and content where possible, and note the Global Routing mode so a routing change isn’t mistaken for unusual data usage.

What to watch for: Rising data totals do not prove that a request succeeded; retries, background sync, and protocol overhead can also use data. Little or no increase does not necessarily mean the server failed: a cached response or a request that never used the current connection can affect what you see. Consider request records, the actual response, and test timing together. Don’t infer the cause of a connection problem from a single data figure.

06 / Settings

A practical order for checking common settings

In Settings, first separate options that affect request handling from those that only affect testing or display. Interface terms below are kept in English; exact locations and available options depend on the device. If you’re unsure of a default value, note the current setting first. Don’t use a screenshot from another device as a substitute for checking your own settings.

DNS: domain resolution and rule matching

What it is and where to find it: DNS resolves domain names to addresses and can affect domain access and the evaluation of some address-based rules. Check the DNS options actually available in Settings, and also inspect the [General] section of the active Config. Checking only one location may miss settings that are currently in effect.

How to set it up and what to watch for: Note the current resolution method before changing it, and make changes only to address a specific issue. In a configuration file, dns-server = system is one way to use system DNS; it is not a universal recommendation for every network. Before setting a custom DNS address, confirm that it is reachable and that its transport requirements are met. Change one factor at a time, then retry the same domain. Successful resolution does not guarantee that the connection will work; also check rules, TLS, and server status.

Test Method: Choose what the test measures

What it is and where to find it: Test Method determines how Connectivity Test runs. Find it among the test options in Settings. Methods may test different stages: a port check focuses on basic connectivity, while a request-based test may also involve a specified target and its response.

How to set it up and what to watch for: First, decide what you want to check from the available options, then run repeated tests against the same server. To compare results, keep Test Method, test target, and local network consistent. Test results are not a direct promise of page-loading speed. If basic connectivity succeeds but the service does not, check DNS resolution, certificates, transport parameters, and the target’s response rather than reordering servers based on a single test.

Today Widget: View and control options

What it is and where to find it: Today Widget is a system widget setting for choosing the content or controls Shadowrocket provides. Check the relevant option in Settings, then look for it in the device’s system widget editor. Available widget formats depend on the device’s operating system and what the app currently offers.

How to set it up and what to watch for: Enable only the content you want to see, then check how it appears in the system interface. Widgets may refresh periodically, so their displayed status is not a substitute for the current connection status in the app. If a widget action doesn’t have the expected effect, open Shadowrocket to verify the state instead of tapping repeatedly and changing the conditions you’re troubleshooting. Before showing your screen publicly, check for personal information such as custom names.

iCloud: Sync scope and recovery requirements

What it is and where to find it: iCloud options work with app data sync or backup. Check the sync options actually available in Settings, then confirm the app’s iCloud access and available storage in system settings. Synced data and App Store purchase history use separate mechanisms; restoring one does not restore the other.

How to set it up and what to watch for: On the original device, confirm that the data you want to keep is saved, then enable the relevant sync options. On the new device, sign in with the same iCloud account and check that the data is complete. Don’t assume servers, subscriptions, configuration files, and logs all sync in the same way; check each category separately. Sync is not the same as versioned backup. Deletions or overwrites may sync to another device, so keep a restorable copy of important configurations separately.

Diagnostics: Use records to narrow down issues

What it is and where to find it: Diagnostics provides troubleshooting tools. Look for it in Settings, then check the Log or connection records shown in the app. Different diagnostic tools cover different stages. First determine whether the connection failed to start, DNS resolution failed, or a specific request wasn’t handled by the expected rule.

How to check and what to watch for: Note when the problem occurred, the network type, Global Routing mode, and current selection. Reproduce the issue once, then check records from around that time. Change log level or recording scope only as needed, and restore the original settings afterward. Before sharing records, remove subscription URLs, authentication fields, visited domains, and personal network information. A single error may be a consequence of an earlier failure, so consider the sequence of events.

07 / Check

Retest under the same conditions after making changes

Keep a rollback point when troubleshooting settings. Save a copy of the current configuration or note what you change, then check the selected server, Global Routing mode, and active Config in order. Unless you have a clear reason, don’t change DNS, rules, transport parameters, and On Demand all at once. Even if the result changes, you won’t know which setting made the difference.

Check the local network. Note whether you’re using Wi-Fi or cellular, and confirm that the system network can establish connections. If the network requires a sign-in, complete that process first.
Check the server details. Verify the protocol and authentication parameters, run Connectivity Test, and note the Test Method. After updating an existing subscription, recheck the selected server.
Check the routing conditions. In Config mode, check the enabled file and matching rules. For comparison, switch briefly to Proxy or Direct, then restore the original mode after testing.
Send a new request. Avoid interference from old long-lived connections, cached data, or background tasks. Use Data and diagnostic records to review this test, without combining results from different times.
Restore and record changes. Revert any changes that didn’t help. For changes that worked, record why and when they apply, then re-enable any On Demand and sync options you need.

If only one domain has a problem, start by checking its rules and DNS resolution. If all tests fail, check the network and server details first. If the issue happens only after switching networks, check the On Demand conditions. Narrowing the problem to one layer is easier to verify than repeatedly changing several switches.