SETTINGS / ROUTING / CONFIG
Shadowrocket Features and Settings
Set Global Routing first, then check rules and servers. Once the connection is stable, adjust On Demand, DNS, and diagnostic options.
This page is part of the official Shadowrocket guide for iPhone and iPad. Interface labels are kept in English. Menu locations and available options may vary; check the app as it appears on your device. See the App Store listing for system requirements.
- Supported devices: iPhone / iPad
- Use an existing subscription or server details
- Change one type of setting at a time
01 / GLOBAL ROUTING
Global Routing: Config, Proxy, and Direct
Global Routing determines how requests are routed. Find it in Home. The three commonly used modes are Config, Proxy, and Direct. These are not server protocols or connection quality ratings. Choose a mode for the task at hand rather than treating one as the right choice in every situation.
Use Config for everyday rule-based routing. To check whether the selected server is reachable, you can temporarily switch to Proxy. To compare against direct access on your current network, use Direct. After switching modes, make a fresh test request so that an existing connection does not skew the result.
| Option | How it works | When to use it | What to check |
|---|---|---|---|
| Config | Routes requests according to the rules in the active configuration. | Everyday rule-based routing when different destinations need different handling. | Which configuration is selected in Config, the order of the rules, and the final FINAL rule. |
| Proxy | Routes requests through a proxy, usually without using Config’s destination-based rules to choose the route. | Temporarily test the selected server and narrow down whether rules are involved. | The server selected in Home and settings such as DNS that may still affect requests. |
| Direct | Routes requests directly over the current network. | Compare direct access to see whether the issue occurs only on the proxy route. | Whether the current network can reach the destination. Direct does not remove the system VPN configuration. |
How to configure and verify
- In Home, open Global Routing and select the mode that fits the task.
- For Config, open Config and check which file is active. For Proxy, check the selected server in the SERVER list on Home.
- Reopen the destination or make a fresh request, then check the connection records to see how it was handled.
- After a temporary comparison, switch back to the mode you intended to use so troubleshooting settings are not left in place.
If Proxy works but Config does not, check rule matching and policy references first. If both fail, check the server parameters, DNS, and current network. This comparison can narrow down the cause, but it cannot prove that a particular setting is at fault.
02 / RULES & POLICY
Rule-based routing: match conditions and policies
A rule describes which requests match; a policy determines what happens to matching requests. In Config, view or edit the Rule section of the active configuration. Select Config in Global Routing to apply its rules. Rules are generally evaluated in order, so an earlier match may prevent later rules from being used. The order matters as much as the rule content.
| Rule keyword | What it matches | What to check |
|---|---|---|
DOMAIN | An exact domain name. | Check the domain used by the actual request; a page URL does not reveal every domain the page requests. |
DOMAIN-SUFFIX | A domain suffix and its related subdomains. | Avoid overly broad matches that affect subdomains you did not intend to include. |
DOMAIN-KEYWORD | A keyword contained in a domain name. | Check for unintended matches with other domains. |
IP-CIDR / IP-CIDR6 | IPv4 / IPv6 address ranges. | The address range, DNS resolution results, and resolution-related options in the configuration. |
GEOIP | A geographic classification assigned to an IP address. | This classification is based on the IP address; it does not indicate where a website's content or operator is located. |
USER-AGENT | The User-Agent available for a request. | Matching depends on whether request details are visible; do not assume every encrypted request can be matched. |
FINAL | Requests not matched by earlier rules. | Usually placed at the end, with an explicit fallback policy. |
A policy is not a rule type
DIRECT means a direct connection, REJECT means the request is denied, and PROXY means a proxy policy. A configuration may also reference custom policy group names; the actual route depends on how the group is defined and which option is selected. A rule that says PROXY does not, by itself, tell you which server will be used.
This is only an example of rule structure. example.com is a documentation-only domain, not a connection service. This snippet is not a complete file that you can use to replace an existing configuration.
DOMAIN-SUFFIX,example.com,PROXY
GEOIP,CN,DIRECT
FINAL,PROXYHow to edit rules and verify the result
Keep a copy of the original configuration, then change one rule in the active file. More specific conditions usually belong before broader ones, and FINAL goes at the end. After saving, check that Global Routing is still set to Config. Make a fresh request and use the available connection records to see which condition matched and which policy handled it.
If a page loads its main content but images or sign-in fail, check the relevant domains separately instead of broadening a keyword rule again and again. A page may request resources from multiple domains. Checking them one by one makes it easier to preserve reproducible troubleshooting results than replacing the entire configuration. See the beginner-to-advanced guide for more on configuration structure.
03 / SERVER & SUBSCRIBE
Subscriptions and servers: identify what you have
The SERVER list in Home is where connection entries are managed. An individual server entry contains a protocol and its required parameters; a subscription retrieves and updates multiple entries. These serve different purposes from the rules in Config: importing a server list does not import a rules file, and switching rules files does not update server credentials.
Add existing details to the app
If you already have the details for a single server, start with Add Server, select the protocol specified in your details, and fill in each field. Shadowsocks, VMess, VLESS, Trojan, WireGuard, Hysteria2, and other protocols require different fields. Do not reuse parameters from another protocol just because the names look similar. Use your existing details for the address, port, authentication, and TLS options.
If you already have a subscription URL, choose the Subscribe type in Add Server, enter the URL, and save it. Then use the subscription update option in the app to retrieve the list. If you have a compatible QR code, you can use Scan QR Code, but check the recognized details after scanning. Subscription URLs are sensitive; do not share the full URL, authentication details, or QR code while troubleshooting.
Updating and selecting are separate actions
Updating a subscription retrieves its contents again; selecting a server determines which connection entry is currently in use. After an update, check that the group and entries are present, then verify the current selection. If a provider renames or removes an entry, you may need to reselect it. An “update complete” message alone does not mean the connection is working.
Connectivity Test can provide an initial check of an entry, but a successful test does not mean every destination is reachable or that the active rules will select that entry. If a test fails, first check whether the subscription can be retrieved, whether the parameters are complete, and whether the current network can reach the server. Then consider other settings, changing one factor at a time.
04 / ON DEMAND
On Demand: connect when conditions are met
On Demand lets the system trigger a VPN connection based on configured conditions. It can reduce the need to connect manually. It controls when a connection starts; it does not replace Global Routing decisions or fix invalid server parameters. Verify the connection and access manually before enabling it.
Where to configure On Demand
Look for On Demand options in Settings and follow the conditions available in the current interface. First confirm that the system allows Shadowrocket to add a VPN configuration, then set the network conditions you need. If the app offers network type or Wi-Fi conditions, read each one carefully rather than assuming its scope from the switch label alone.
- First disable automatic triggers and verify that the current server and Config work manually.
- Turn on On Demand, set the conditions you need, and note the values before and after.
- Switch to the network scenario you expect and check the system VPN status and connection status in Home.
- Also test a scenario where it should not connect to confirm the conditions match your intended boundaries.
Why does it reconnect after I disconnect?
If a trigger condition is still met, the system may reconnect after you disconnect manually. Check On Demand first rather than repeatedly removing the system VPN configuration. To pause connections, adjust or turn off the relevant trigger conditions, then check the system and app status.
On Demand does not guarantee a particular battery impact. Network instability, repeated reconnects, background requests, and data transfer can all affect the system's battery usage figures. For a meaningful comparison, keep network conditions and usage similar, and check the system battery page. Do not draw conclusions from a brief, one-off change.
05 / DATA
Data: monitor usage, not billing
Data shows the traffic statistics provided by the app. Open Data and identify the statistic type, time range, and units before comparing uploads and downloads. Different views may cover different periods or connections; data for one connection should not be treated as total network usage for the entire device.
Use traffic stats to help troubleshoot
To check whether an action generated traffic, note the current statistics, perform one specific action—such as reloading a page—and return to Data to check for a change. If other apps are transferring data in the background, the result is only an indication. Check the connection records to help identify the source.
App counters, system cellular data counters, and provider billing may use different measurement methods, including different time periods, protocol overhead, and reset schedules. Data is useful for spotting trends and troubleshooting, not for checking a provider balance or replacing a carrier bill.
Record a baseline before resetting stats
If the current interface offers a statistics reset, record the data and time period you need before using it. Resetting affects before-and-after comparisons, but does not update subscriptions, change rules, or restore server availability. Traffic does not prove that a request reached its destination; verify access in the relevant page or app.
06 / SETTINGS
Common Settings: change and verify one option at a time
Settings options affect different behaviors. Record the original value, change one option at a time, and retest the same destination after each change. Some DNS behavior may also be controlled by the General section of the active Config, so check the configuration source as well. Menu locations and options may vary; use what appears in the current app.
DNS: check resolution paths and results
DNS resolves domain names to IP addresses, an important step before a connection can be established. Check the DNS-related options in Settings and the General section of the active Config for the resolver and related settings. Changing one address does not guarantee that every request follows the same path; check the resolution and routing setup in the active configuration.
Before changing DNS, note the original value, then test resolution and access using the same domain. If the connection address works but the domain request fails, check DNS first. If the domain resolves but the connection fails, also check the route to the destination and server status. Successful resolution only means an address was returned; it does not guarantee that the connection will succeed. DNS changes are not a universal fix for access problems.
Test Method: compare Connectivity Test results consistently
Test Method selects the testing method available in the app. Look for it under the test-related options in Settings. Before comparing servers, keep the test method, destination, and network conditions consistent, then run Connectivity Test from Home. Different methods check different things, so their results should not be ranked together.
A test result is a measurement under specific conditions, not a promise of sustained speed. If an entry responds to a test but an app still fails, check the protocol parameters, route to the destination, and rules. Do not repeatedly replace a configuration that may already be correct based on a single test.
Today Widget: verify the status after using shortcuts
Today Widget works with the corresponding system widget entry for quick viewing or actions. Check the related options in Settings, then add it using the widget management controls available on your system. The entry may vary by system version and device; follow what is shown on your device if the same option is unavailable.
A shortcut makes routine actions easier, but it does not replace initial setup. After changing a server, Global Routing, or On Demand, return to the app and verify the status before using the shortcut. If the displayed status looks wrong, check Home rather than relying on the widget text to determine the request route.
iCloud: check what will sync and where it will go
iCloud features save or sync data within the scope supported by the app. First check that the device is signed in and allowed to use iCloud in system settings, then review the available sync, backup, or restore options in Settings. These actions may cover different data; read the app's prompts instead of assuming all servers, configurations, and statistics will be transferred.
Before restoring, overwriting, or using an import option such as Import from Cloud JSON, save the local data you need to keep and check that the cloud content is from the expected source. Importing JSON is not the same as ongoing sync. After syncing, check the selected server and active configuration. VPN permissions must also be verified separately on the device.
Diagnostics: collect clues from a reproducible request
Diagnostics helps investigate connection issues. Look for the diagnostic options in Settings. Before starting, note the network conditions, Global Routing mode, and steps that reproduce the issue. Then make one clearly defined request that fails and review the diagnostic results or logs available in the current interface.
Logs may contain private information such as domains, server addresses, subscription details, or authentication fields. Review and redact sensitive details before saving or sharing logs; include only the error type and context needed to investigate. Use diagnostic results to narrow down the cause, not to copy someone else's settings without matching conditions. Restore any temporary changes when troubleshooting is complete.
07 / CHECK BEFORE CHANGING
Settings checklist for connection problems
Troubleshoot from basic details to rules, then automation, to reduce conflicts between changes. After each step, retest the same destination. If you find a difference, understand why before changing anything else.
- Check the current network. Make sure the device is connected to a working network. If needed, compare with Direct under the same conditions.
- Check the server. Verify the protocol, address, port, and authentication details you already have, and confirm the correct entry is selected in Home.
- Check Global Routing. Temporarily use Proxy to isolate rule-related factors, then switch back to Config and check the active file.
- Check Rule and DNS. Review the matched rule, policy reference, and resolution result. Confirm that FINAL matches your expectations.
- Check automatic triggers. If the status keeps changing, review the On Demand conditions and system VPN status.
- Keep diagnostic clues. Record the steps that reproduce the issue, check Diagnostics, and remove sensitive details before sharing.
For a walkthrough from the first launch, read the user tutorial. To learn in chapters, from getting the app and authorization through importing and maintenance, read the beginner-to-advanced official guide. Check app purchase and authenticity details for purchase information, device compatibility, and system requirements; the App Store listing is the source of truth.