Shadowrocket Features and Common Settings
Choose how traffic is routed before adjusting rules and connection conditions.
This page focuses on using Shadowrocket on iPhone and iPad. It explains what common features do, where to find them, how to configure them, and what to watch for. Interface labels remain in English; available options and menu paths may vary by app version.
Global Routing: Three Traffic Modes
What it does: Global Routing determines how the traffic handled by the client is processed. Config follows the rules in the active configuration; Proxy routes handled traffic through the selected proxy; Direct connects handled traffic directly. “Global” refers to the client's routing choice—it does not mean that all device traffic is automatically captured.
Where to find it and how to set it: Open Global Routing from Home and choose Config, Proxy, or Direct. For everyday rule-based routing, Config is usually the right choice; confirm which configuration is active in the Config screen. For troubleshooting, briefly switch to Proxy or Direct and compare results for the same destination. Restore the original mode when testing is complete.
| Option | How it works | When to use it | What to check |
|---|---|---|---|
| Config | Applies the rules in the active configuration to select a policy. | Route traffic according to its destination during everyday use. | Whether the configuration is active, rule order, and the final policy. |
| Proxy | Routes handled traffic through the selected proxy. | Temporarily check whether the server and proxy route are working. | Selected server, authentication details, and connection result. |
| Direct | Connects handled traffic directly to its destination. | Check whether destinations are reachable directly over the local network. | Whether the current Wi-Fi or cellular connection is working. |
What to watch for: Choosing Config does not automatically provide rules suited to your needs, and choosing Proxy will not fix expired server credentials. Direct is not the same as disconnecting the client: Direct is a routing mode, while disconnecting stops the current connection. When comparing results, keep the destination, network, and server unchanged. Changing several variables at once makes it harder to identify the cause.
Rules: Match Conditions and Policies
What they do: Each rule consists of a match type, match value, and policy. In Config mode, rules are generally evaluated from top to bottom, and the first match determines how traffic is handled. DIRECT connects directly, PROXY sends the request through a proxy, and REJECT blocks matching requests. FINAL is the fallback rule used when no earlier rule matches; it is not a server name.
Where to find rules and how to edit them: Open Config and use the edit option to inspect the active configuration. Save a copy before making changes. Put narrowly scoped rules first, followed by broader conditions and FINAL. The snippet below illustrates the syntax; it is not a complete configuration for every use case.
[Rule]
DOMAIN,example.com,PROXY
DOMAIN-SUFFIX,example.org,DIRECT
IP-CIDR,192.168.0.0/16,DIRECT
FINAL,PROXYCommon match types
DOMAIN matches an exact domain; DOMAIN-SUFFIX matches a domain and its subdomains; DOMAIN-KEYWORD matches a keyword in the domain name. Keyword matches can cover more than expected, so check for unintended matches before adding one. Domain rules match hostnames, not full URLs or page paths, and cannot distinguish individual pages on the same domain.
IP-CIDR and IP-CIDR6 specify IPv4 and IPv6 ranges, respectively. GEOIP checks an IP database, so results depend on its coverage and update status. USER-AGENT relies on information available in the request; not every connection provides data that can be matched this way. Choose a rule type based on the destination information you can actually observe.
What to watch for: REJECT applies only to matching requests; it does not guarantee that a specific page element will be removed. A broad rule can also disrupt normal features when resources share a domain or connection. If a rule matches unexpectedly, check rule order and the actual destination in the logs, then narrow the match. Avoid masking an earlier mistake with more catch-all rules.
Subscriptions and Server Management
What they do: A server entry stores the address, port, protocol, and authentication details needed to connect. Subscribe retrieves and updates a set of servers from an existing subscription. Subscriptions primarily manage server details, while Config defines rules and global parameters. After importing servers, check that Global Routing and the active configuration match your needs.
Where to find them and how to set them up: From Home, open the add menu and choose Add Server. If you already have a subscription, choose Subscribe, enter the subscription URL provided by your service provider, and save it. Then update the subscription and review the returned entries. If you have complete server details, choose the matching type in Add Server and enter them manually. You can also use Scan QR Code to import your own shared details. After importing, check the name and type, then select the server you want to use.
Check Protocols and Parameters
Shadowrocket supports protocols and connection types including Shadowsocks, VMess, VLESS, Trojan, HTTP, SOCKS5, WireGuard, and Hysteria2. Check the app for currently available options. The same protocol name does not mean the fields are interchangeable: verify the address, port, authentication details, and applicable TLS or transport settings individually. Don't switch types at random to try to fix a connection.
Shared content may contain a single server, a subscription URL, or another type of configuration. Check what you have before importing; for example, don't enter a configuration URL in the server address field. Treat any URL, QR code, or exported file containing authentication details as sensitive, and don't post it in a public forum.
Update, Organize, and Back Up
Updating a subscription retrieves server information from the remote source; names, entry counts, and fields may change. Note which server is currently selected before updating, then check the selection again afterward. To customize an individual entry, save a separate copy first so a later subscription update does not overwrite your changes. Before deleting anything, distinguish between removing one server and removing the entire subscription.
What to watch for: A successful subscription update only means the returned content was retrieved and parsed; it does not guarantee that every server can connect. An update failure does not necessarily indicate an app issue. Check that the URL is complete, access is still authorized, and the current network can reach the subscription address. For detailed import and organization steps, see the Subscriptions and Server Management Guide.
On Demand: Connect When Conditions Are Met
What it does: On Demand uses the system's on-demand connection mechanism to request a connection when configured conditions are met. It controls when to connect; Global Routing and rules determine how traffic is handled after connection. They can be used together but are not interchangeable. On Demand cannot make an unavailable server work again.
Where to find it and how to set it up: Look for On Demand options in Settings. First confirm that the server and configuration work manually, then set the behavior using the network conditions available in the interface. If you want different behavior on Wi-Fi and other networks, check each condition and action, save, and test on the relevant networks. When prompted to approve system VPN settings, read the prompt before granting permission.
What to watch for: On-demand rules are triggered by network changes and requests, so they do not guarantee a continuous connection. If a connection returns after you disconnect manually, check whether an On Demand condition is still being met. To pause this behavior, explicitly disable the relevant on-demand options and check the system connection status. Don't assume the connection will stay off based on a single switch in Home.
Data: View Traffic and Connection Records
What it shows: Data displays traffic and connection information visible to the client. Use it to check whether an action generated a request, how the request was handled, and whether any unusual entries appeared during troubleshooting. Its totals depend on what the client handles and records; they do not represent all network activity on the device.
Where to find it and how to use it: Open Data and use the statistics or log view available in the current interface. To troubleshoot a website, note the time, make one request, then return to Data and check the destination and connection result for that period. To monitor a new, short time window, use the available clear or reset option after confirming you no longer need the existing records.
What to watch for: Data statistics are not a substitute for your cellular carrier's billing records or a service provider's usage figures; measurement scope and refresh intervals may differ. Connection records may include domains, IP addresses, and timestamps. Review and redact sensitive details before sharing diagnostic information. If an entry is missing, check logging options, connection reuse, and whether the traffic was handled by the client before assuming no request was made.
Settings: A Practical Order for Making Changes
Settings brings together options for client behavior, testing, sync, and diagnostics. Keep a working baseline, change one option at a time, and note the results before and after each change. Settings and parameters in the configuration file can both affect behavior, so check the active Config when troubleshooting rather than relying on a single toggle.
DNS: Domain Name Resolution
What it does and where to find it: DNS resolves domain names to addresses used for connections. Related options may appear in Settings and as global parameters in Config, such as dns-server. The example below shows how to specify system DNS; it illustrates the parameter and is not a replacement configuration.
[General]
dns-server = systemHow to configure it and what to watch for: Check your current configuration before deciding whether to change the resolution method. Use a custom server address only if you understand the network configuration it belongs to. If a website won't load but a latency test returns a result, DNS is one possible cause, not the only one. After making a change, retry the same domain and, if needed, clear the DNS cache using the option provided in the app. Avoid changing multiple DNS and routing options at once.
Test Method and Connectivity Test: How to Interpret Results
What they are and where to find them: Find Test Method in Settings and choose how the client runs Connectivity Test. Different methods check different parts of the connection, so results cannot be compared without considering the method used. If the interface lets you set a test target, choose one you know and can reach reliably.
How to configure it and what to watch for: When comparing your servers, keep the test method, target, and network the same, then test the service you actually need. A lower test result does not mean higher sustained throughput or prove that every destination is reachable. A failed test also needs to be considered alongside authentication, DNS, and destination availability; don't remove an entry based on a single result.
Today Widget: Quick Access and Status
What it does and where to find it: Today Widget provides quick status or actions in the system's widget area. Look for related options in Settings. Its appearance and availability depend on current system and app support. It supplements common actions but does not replace the full controls in Home or Config.
How to set it up and what to watch for: First check which information the app can display, then add the widget from the system's widget management screen. Return to the app afterward to confirm the actual connection status. If the widget has not refreshed, open the app to check; its last displayed information alone does not confirm whether a connection is active or stopped.
iCloud Sync: Carry Settings Across Devices
What it does and where to find it: The iCloud options in Settings sync data supported by the app. Availability also depends on the device's iCloud sign-in, system permissions, and network connection. Check the app's documentation for what is included; iCloud sync is not a complete backup of all device data.
How to set it up and what to watch for: Before switching devices, confirm that sync has completed on the original device and keep a separate recoverable copy of important configurations. On the new device, check that configurations and servers are present before editing or deleting anything; this helps prevent unverified changes from syncing to other devices. Restoring an App Store purchase and syncing data through iCloud are separate processes: restoring the app does not guarantee that its configuration will also return. For purchase and installation details, see Restore Purchases.
Diagnostics: Gather Clues for Troubleshooting
What it does and where to find it: Look for Diagnostics in Settings and use the available diagnostic or logging features to see where a connection fails. Diagnostic results are clues for troubleshooting, not a guarantee of server quality or successful access.
How to use it and what to watch for: Prepare steps to reproduce the issue before enabling the necessary logging. Reproduce it once within the shortest practical time window, save the information you need, then restore your usual logging settings. Before sharing diagnostic files, check subscription URLs, authentication fields, server details, and connection records. Keep the error type and timeline, but don't publish a complete configuration.
Troubleshooting Order When Settings Don't Work
The more complex the configuration, the more important it is to troubleshoot in a consistent order. Check the basic network first, then server details, routing and DNS, and finally automation and sync. This helps keep subscription access, connection parameters, and rule matching from getting conflated.
- Check the local network: Pause on-demand connections and disconnect the client. Check whether the current network can reach a known working destination. If needed, repeat the same test on Wi-Fi and cellular.
- Check server details: Confirm that the intended entry is selected and verify its type, address, port, and authentication parameters. If you use a subscription, check the update result, but don't assume a successful update means the server can connect.
- Check Global Routing: Temporarily switch to Proxy for comparison. If Proxy works but the same destination fails in Config, check the active configuration, rule order, and final matching policy first.
- Check DNS and the destination: Use DNS settings and Data records to distinguish a resolution failure from a connection failure or an error returned by the destination service. Even if Connectivity Test returns a result, verify access to the destination you actually need.
- Restore your usual settings: When testing is complete, restore your intended Global Routing, On Demand, and logging options. Save the working configuration and note the final changes so you can repeat the checks later.
If initial setup is not complete, follow the Getting Started guide to import and verify your setup step by step. If you can already connect and just need to organize servers, continue with the subscription update guide. Shadowrocket is a paid app for Apple platforms, available exclusively on the App Store. Check the App Store listing for system requirements, and review the purchase verification steps before buying.