OFFICIAL MANUAL / SETTINGS

Shadowrocket Features and Settings

First decide how traffic should be handled, then configure connection conditions and diagnostics. This guide explains common features by what they do, where to find them, how to configure them, and what to keep in mind.

Global Routing sets the routing mode
Config contains the rules
Settings controls app behavior

This guide covers Shadowrocket on iPhone and iPad and assumes you already have your own subscription or server details. Menu locations and available settings may vary; check the app on your device. See the App Store page for system requirements.

01 / ROUTING MODE

Global Routing: Config, Proxy, and Direct

What it does: Global Routing determines how the client handles traffic overall. Config mode uses Config, proxy mode uses Proxy, and direct mode uses Direct. Here, Config is a routing mode; the Config tab at the bottom is where you manage configuration files. Keep the two meanings distinct.

Where to find it: Open Home and select Global Routing to see the current mode. Before switching, note the current mode, selected server, and configuration name so you can restore them after troubleshooting.

Option	How it works	When to use it	What to check
Config	Uses the current configuration's rules to choose a policy.	When requests need different routes based on domain or IP.	The selected configuration, rule order, and final rule.
Proxy	Routes all traffic handled by the client through a proxy.	For a quick check that the proxy connection itself works.	Server settings, connection status, and the result for the target request.
Direct	Routes all traffic handled by the client directly.	For a quick comparison with direct access or to narrow down a routing issue.	Whether the current network can reach the target directly.

How to configure it: For rule-based routing, select Config and confirm the active file on the Config page. If only one destination is affected, briefly switch to Proxy to compare results on the same network and server. Restore the original mode when finished. Change one variable at a time so the results are meaningful.

Keep in mind: A routing mode is not a server and cannot supply missing server credentials. Selecting Proxy does not guarantee that the server is available; selecting Direct does not disable the system VPN configuration. The client only handles traffic within its scope, so “global” does not mean every system request follows the same route.

02 / RULES AND POLICIES

Rule-Based Routing: Match Conditions and Policies

What it does: A rule typically consists of a type, a match value, and a policy. The type specifies how to identify a request; the policy determines what happens when it matches. DOMAIN matches an exact domain, DOMAIN-SUFFIX matches a domain suffix, and DOMAIN-KEYWORD matches a keyword in the domain. IP-related rule types include IP-CIDR, IP-CIDR6, and GEOIP.

Where to find them: Open Config, confirm the active configuration, then review or edit its rules. Check the entries before and after a rule, not just the target domain: an earlier match may already determine how the request is handled.

How to configure them: Decide whether the target should go direct, through a proxy, or be rejected, then choose the most precise match condition available. DIRECT means direct access, PROXY selects the proxy policy, and REJECT rejects the request. For a custom policy group, use the exact name defined in the configuration. These examples demonstrate rule syntax; they are not a complete configuration for every network.

DOMAIN-SUFFIX,example.com,PROXY
GEOIP,CN,DIRECT
FINAL,PROXY

The first example routes requests matching example.com and its subdomains through PROXY. The second uses IP geolocation data to determine whether to route directly. The final FINAL rule handles requests that did not match an earlier rule. DNS results and the geolocation database affect IP-rule matching, so the domain text alone cannot predict every outcome.

Keep in mind: Rules are generally evaluated in order, so place more specific conditions before broader ones. USER-AGENT depends on request information being visible and does not work with every encrypted request. REJECT blocks requests that match the condition; it cannot distinguish how different content on the same domain is used. If a rule causes unexpected blocking, disable only the rule you just added and test again instead of rewriting the entire configuration.

03 / SUBSCRIBE AND SERVER

Subscriptions and Servers: Import, Update, and Organize

What they are: Subscribe manages a set of server details provided by an existing subscription. With manual entry, you fill in each connection parameter yourself. Updating a subscription refreshes its remote entries; it does not update the app and may not include rule configurations. Servers, subscriptions, and configuration files are separate layers, so check each one independently.

Where to find them: View the server list in Home and add details with Add Server. To add an existing subscription, choose the Subscribe type from the add menu. Use Scan QR Code for a QR code; for clipboard imports, follow the prompt or menu option shown in the app.

How to configure them: Before adding a subscription, make sure its URL is complete and includes all query parameters. For a manual server entry, select the type first, then fill in the address, port, password, and other authentication fields using the details you already have. For example, Trojan and VMess use different authentication fields, so do not copy values from one type of form to another. Enter parameters for Shadowsocks, VLESS, Hysteria2, WireGuard, and other types according to their respective requirements.

After importing, check that the entry names and count look right, then test one server. If you manage multiple subscriptions, give them names that make sense to you and keep track of which subscription each entry belongs to. This helps distinguish subscription-provided servers from manually added ones. If entries change after an update, compare them with the content returned by the subscription.

Keep in mind: Subscription updates may overwrite fields managed remotely, so manual edits to those fields may not persist. Back up your data before deleting a subscription or clearing entries in bulk. Subscription URLs, QR codes, and share links may contain authentication details; keep them out of public screenshots and logs. See the subscription and server management guide for updating, sorting, deleting, and backing up entries.

04 / CONNECTION CONDITIONS

On Demand: Connect Automatically Based on Conditions

What it does: On Demand uses the system's on-demand mechanism to control connection behavior based on configured network conditions. It answers “when to connect”; Global Routing answers “how to handle traffic once connected.” These settings work together but are not interchangeable.

Where to find it: Look for On Demand in Settings and review the available conditions and actions. If the app asks to update the system VPN configuration, read the system prompt carefully before allowing the change.

How to configure it: Turn off automatic triggers first, then connect manually and confirm that the current server and configuration work. Add one clearly defined condition. For example, if you need different behavior on different Wi-Fi networks, check the network name and how the condition matches it. If you add multiple conditions, verify each action and match. After saving, switch to the relevant network, check the connection status, and test a known destination.

Keep in mind: With On Demand enabled, a condition may reconnect after you disconnect manually, making it seem as if the connection turns back on by itself. When troubleshooting this, check On Demand before repeatedly deleting servers. On-demand rules cannot restore invalid credentials or guarantee uninterrupted connections when networks change. After disabling them, confirm that the app and system VPN show consistent statuses.

05 / TRAFFIC COUNTERS

Data: Traffic Monitoring and Statistics

What it does: Data displays the traffic statistics provided by the client. Use it to see whether an action generated traffic, help determine whether requests passed through the client, and compare changes using the same measurement scope. It is not a billing page for your connection service.

Where to find it: Open Data and read the labels beside each counter to identify its scope, direction, or time period. Available statistics can vary by device and interface. Do not infer measurements that the page does not show.

How to use it: Before troubleshooting, note the current counters and time. Minimize background activity, make one request, then return to Data and compare the results. If you reset the statistics, save any history you need first, then monitor from the new starting point. Keep the routing mode, server, and network unchanged during the test.

Keep in mind: Both uploads and downloads can use data, and connection maintenance, background apps, and protocol overhead can add traffic. Client statistics may not match your provider's billing figures or the device's cellular data counters. Check remaining usage in the management interface for your own service. An increase in the counter shows that traffic was generated; by itself, it does not prove that the requested content was successfully received.

06 / SETTINGS REFERENCE

Settings: DNS, Tests, Shortcuts, and Sync

Settings brings together options that affect app behavior. Keep a known-working baseline, change one setting at a time, and note why you changed it. If the current configuration file also defines related parameters, check it too rather than relying on a single value in the Settings screen.

DNS: Check the Resolution Path First

What it does and where to find it: DNS resolves domain names to addresses. Check the related options in Settings and in the active configuration's DNS settings. Successful DNS resolution and a successful proxy connection are separate steps. If a domain cannot be resolved, a normal server latency result does not mean the destination will open.

How to configure it and what to keep in mind: First check which DNS settings are in use and where they come from, then adjust them to suit your network. If you use encrypted DNS, the resolver itself must also be reachable. After changing settings, test the same domain again; caching and existing connections may affect the result. Randomly switching DNS is not a universal fix. If only certain domains fail, check the rules and returned addresses as well.

Test Method: Understanding Test Results

What it does and where to find it: Test Method determines how servers are tested. Find it in Settings, then run a test using Connectivity Test in the server list. The result reflects the route used by the selected test method, not the overall performance of every app request.

How to configure it and what to keep in mind: Use the same test method when comparing servers. If the method requires a target address, keep that the same too. A low latency on one test does not mean higher throughput, and a timeout may be caused by the test target or current network. Run the test again, then cross-check with a real request. Do not judge connection quality by ranking servers from a single number.

Today Widget: A System Shortcut

What it does and where to find it: Today Widget provides settings for system-level shortcuts or quick access. Check Settings to see whether the option is available on your device. Whether you can add a system widget and what it displays depend on the components offered by your system and app.

How to configure it and what to keep in mind: If the shortcut is available, confirm the server and routing mode in the app first, then add the corresponding widget in the system's widget manager. Test it once to make sure its action matches the app's status. A shortcut saves steps; it does not replace initial VPN authorization or configure server authentication fields.

iCloud: Sync Scope and Conflicts

What it does and where to find it: iCloud options sync app data within the supported scope. Check the sync option and its description in Settings, then verify the app's iCloud access in system settings. The interface indicates which data is included.

How to configure it and what to keep in mind: Back up your data before working across devices. Make sure both devices use the same Apple Account and allow time for syncing to complete. Avoid bulk-deleting or renaming the same entries on both devices at once. If data is missing, check sync settings and network access before importing it again. Sync is not a complete backup, and it cannot replace app purchase records, subscription status, or connection credentials.

07 / DIAGNOSTICS

Diagnostics: Isolate Connection Problems by Layer

What it does: Diagnostics helps you inspect connection status and error clues. The goal is not to “fix every setting” at once, but to identify whether the issue is with the local network, DNS resolution, the server connection, rule selection, or the destination's response.

Where to find it: Look for Diagnostics or the relevant diagnostic option in Settings, then check the tools and logs available in your version of the app. When reviewing logs, match the timestamps and confirm that an error corresponds to the test you just ran.

How to troubleshoot: Temporarily disable automatic triggers and establish a repeatable test setup. Then collect results in the order below. Record each result as you go; there is no need to reconfigure a layer you have already verified as working.

Confirm that the device has a working network connection and that its system clock is accurate.
Check the server address, port, authentication fields, and status of your existing service.
Run Connectivity Test and note the Test Method used.
Test a specific destination and compare the results in Config mode with a brief test using Proxy.
Review diagnostic clues from the same time and determine whether the issue is DNS resolution, the connection, or policy selection.
Restore the original routing mode and On Demand settings, then test your usual use case again.

Keep in mind: Before sharing diagnostic materials, remove subscription URLs, authentication details, QR codes, and information that could identify your activity. Do not publish the entire configuration. If only rule-based routing fails, check the configuration first; if all modes fail, start with the shared network and server dependencies. For more scenarios, see Troubleshooting. Look up unfamiliar keywords in the Glossary.