OFFICIAL MANUAL / GLOSSARY

Shadowrocket Glossary

Find a term by where it appears in Settings, then check the relevant parameters. This glossary in the Shadowrocket Help Center keeps interface labels, protocol names, and rule keywords in English to help distinguish what you select, what gets matched, and how a connection is handled.

The import guidance below assumes you already have your own subscription or server details. These definitions do not replace step-by-step instructions. For initial setup, see the setup guide.

01 / INTERFACE

Interface & Settings

First, check where the setting appears. The same English term can refer to a screen, an option, or a rule policy, depending on the context.

Global Routing: Selects the overall routing mode: Config, Proxy, or Direct. With Config selected, connections are routed according to the rules in the current configuration. With another mode selected, you cannot infer the result from the rule list alone. Check this setting before troubleshooting routing to avoid repeatedly editing rules while the overall mode is set differently.

Config: In configuration management, Config refers to the configuration file and its management options. Under Global Routing, Config means handling connections according to configuration rules. Opening a configuration file does not make it the active one. Before making changes, check which file is current and whether it is enabled, and keep a recoverable copy.

Proxy / Direct: These are the two options under Global Routing for choosing how connections are handled overall: proxy or direct. They are at a different level from the uppercase PROXY and DIRECT keywords in rule text; similar names do not mean identical behavior. Proxy still requires valid server settings, while Direct depends on network reachability.

On Demand: A mechanism that lets the system trigger connections when configured conditions are met, such as network or domain conditions. It controls when a connection starts; it cannot fix an incorrect password, certificate, or server address. Test manual connections first, then add trigger conditions one at a time. If you want to stay disconnected, check whether any condition could reconnect automatically.

Add Server: Use this option to add a server entry, selecting the protocol and filling in the parameters from your existing connection details. The same address and port do not mean that authentication, TLS, or transport settings can be reused across protocols. Check each field before saving, then confirm that you are using the intended entry—not another entry with the same name.

Connectivity Test: Shows the result of a connection test under specified conditions. The result depends on the test target, method, and network at the time. A successful test only confirms that the tested path completed that operation; it does not mean every website or app will work. When troubleshooting, consider the test result alongside actual requests, matched rules, and DNS behavior.

DNS: Resolves domain names to network addresses, a step required before many connections can be established. A resolution failure, an unsuitable result, and a failed proxy handshake are different issues, though all can look like a connection problem. Before changing DNS settings, note the original values and distinguish how the domain is resolved from the routing policy applied to the connection afterward.

02 / PROTOCOLS

Protocol names and parameter boundaries

The protocol type should match your existing server details. Changing the protocol name alone does not convert a connection or predict how it will perform.

Shadowsocks: A proxy protocol that requires the client and server to use the same encryption method and password. If your existing details include a plugin or other extension parameters, check those against the original information too; the basic fields may not be enough. If authentication fails, first check that all parameters are present and copied correctly, including any extra spaces, rather than changing the rules.

VMess: A proxy protocol that typically requires checking identity information such as a UUID, as well as transport, path, and TLS settings. A correct server address is only one requirement; mismatched transport settings can also cause a handshake failure. After importing, compare the entry against your original connection details, paying particular attention to fields that are not shown in the entry name.

VLESS: A proxy protocol that requires authentication, transport, and security settings to match the server. The protocol name alone does not confirm that encryption or other security settings are enabled, and does not replace checking fields such as TLS and server name. When troubleshooting a Shadowrocket VLESS connection, verify all parameters first, then check the rules and whether the destination is reachable.

Trojan: A proxy protocol commonly used with TLS. The password, server name, and certificate verification settings can all affect the connection. The connection address and the server name used for TLS verification may serve different purposes, so do not change them to match just because they differ. For certificate errors, check the name, certificate validity, and device time rather than disabling verification.

Hysteria2: A proxy protocol based on QUIC that uses UDP and has its own congestion control. Performance on a given network still depends on packet loss, latency, server resources, and configuration; the protocol name does not guarantee speed. If the network restricts UDP traffic, connections may fail. Check authentication and TLS settings as well.

WireGuard: A key-based tunnel protocol. Configuration typically includes the local key, tunnel address, peer public key, and routing scope. Keys have corresponding roles: do not swap the public and private keys, and do not share the private key. When troubleshooting a Shadowrocket WireGuard configuration, check the endpoint, address range, and DNS—not just whether the configuration saved successfully.

HTTP / SOCKS5: Two types of proxy protocol. Before connecting, confirm which type the server supports and whether it requires a username and password. The protocol name does not mean that the transport is encrypted; check the authentication method and security layer in the specific configuration. Do not confuse the remote proxy server’s port with a local service port used by the app.

03 / RULES & POLICIES

Rule keywords & Policies

Keywords describe matching conditions; policies describe what happens when a rule matches. The examples below explain syntax only. example.com is a sample domain, not a service address.

Rules: A configuration entry that pairs a matching condition with an action. Rules are usually checked from top to bottom, and the action for the first match is applied. A broad rule near the top can prevent a more specific rule below it from taking effect. After editing, check the order, policy names, and current Global Routing mode—not just whether each individual rule is valid.

DOMAIN / DOMAIN-SUFFIX / DOMAIN-KEYWORD: DOMAIN matches an exact domain, DOMAIN-SUFFIX matches a domain and its subdomains, and DOMAIN-KEYWORD matches a keyword in a domain. For example, DOMAIN-SUFFIX,example.com,PROXY sends matching connections to PROXY. Keyword matches generally cover a broader range than exact domain matches, so consider whether they could catch unrelated domains.

IP-CIDR / IP-CIDR6: These rules match IPv4 and IPv6 address ranges, respectively. The prefix length after the slash sets the subnet size. For example, IP-CIDR,192.168.0.0/16,DIRECT applies DIRECT to that IPv4 range. Some matching processes involve domain resolution. When troubleshooting, distinguish a destination that is already an IP address from one obtained through DNS before matching.

GEOIP: Matches based on classifications in an IP geolocation database, not webpage language, domain suffix, or account region. Database records may differ from where a service is actually hosted, and a service may use addresses in multiple regions. If a match is unexpected, check the actual destination IP, its database classification, and any earlier rules instead of relying on the website name.

FINAL: Handles connections that did not match any earlier rule. This final fallback belongs at the end of the rule list. For example, FINAL,DIRECT uses DIRECT when nothing above matches; it does not mean all connections will go direct. If many connections reach FINAL, first check whether earlier conditions cover the destinations before changing the fallback policy.

PROXY / DIRECT / REJECT: Rule policies: PROXY sends a connection through a proxy, DIRECT connects directly, and REJECT blocks the connection. The actual exit used by PROXY depends on the current selection and configuration; PROXY is not a server address. A failure after a REJECT match is the result of the rule, so check whether a reject rule applies before troubleshooting the connection.

04 / SUBSCRIPTION & CONFIGURATION

Subscriptions & configuration files

Identify whether you have a subscription URL, an individual server entry, or a complete configuration file before choosing where to import it. This site does not provide, sell, or recommend servers or subscriptions.

Server entry: A set of parameters describing a connection endpoint. It commonly includes the protocol, server address, port, and authentication details, and may also include transport and TLS settings. The entry name is just a label; changing it does not change the connection parameters. Two entries with the same name may point to different endpoints, so check their fields rather than comparing names alone.

Configuration file: Organizes general settings, rules, and other configuration sections, often including [General] and [Rule]. A server subscription and a configuration file serve different purposes; updating a subscription does not replace all routing logic. Keep the original file before importing a new one, and check which file is actually in use.

Latency: The response time measured by a specific test method, affected by the test target, protocol flow, and network conditions at the time. A Shadowrocket latency test does not translate directly into download speed or, by itself, show how websites, video, or other services will perform. Compare results under consistent test conditions, and check whether actual requests succeed separately.

URL Rewrite: Rewrites request URLs or other content according to matching conditions. This is separate from routing rules that determine how a connection is handled. A rewrite may not happen if no rule matches, the request is outside the feature’s scope, or encrypted content is not visible. Before using it, clarify the purpose and scope; for encrypted requests, understand the certificate and privacy implications.

05 / APP STORE & ACCOUNT

App Store & Accounts

Shadowrocket is available only on Apple platforms, primarily iPhone and iPad, and the App Store is the only place to get it. Check the App Store listing for compatibility, system requirements, and whether Universal Purchase is supported.

Verify the App Store listing: On the product page, check the developer, Shadow Launch Technology Limited, the official icon, and app ID 932747118—not just the name in search results. You can identify the app ID in the product page URL as id932747118; the icon should match the official icon used on this site. For steps and verification details, see the download guide.

Apple ID store region: The store region associated with the account used for Media & Purchases. It affects app availability, payment methods, and the currency displayed. Device language, current location, and store region are separate settings. If you cannot find the app, first check the purchasing account and its store region. Changing regions is also subject to Apple’s account requirements; changing the device language alone will not change the result.

Purchased apps: An App Store record associated with the purchasing account. When changing devices or reinstalling, look for the app in the relevant app list. First confirm that Media & Purchases is signed in with the account used for the purchase; menu names may vary by system version. Redownloading the app and restoring local subscriptions or configuration files are separate tasks; check your backups for the latter.

One-time purchase: Describes how the app is purchased. The US storefront price is about $2.99; check the current App Store listing for the price and local currency in each storefront. A one-time purchase of the client is not a service plan: buying the app does not provide a server or subscription. You’ll need your own connection details, and app purchases are separate from any service fees.

Back to category index ↑