OFFICIAL MANUAL / GLOSSARY
Look up terms by screen location and technical layer. First identify whether a term refers to an entry point, connection protocol, matching condition, or handling policy, then decide which setting to change.
01 / INTERFACE
Screen names identify where to perform an action; toggles and routing modes determine how the app behaves. Seeing a server in the list does not mean a working connection has been established.
Home is the main place to select a server and control the connection. A saved entry in the list only means its details are stored; it does not confirm that a connection is active. Check the selected entry, the connection toggle, and the results of actual requests rather than treating the list status as proof of connectivity.
Add Server lets you enter existing server details manually. The protocol determines which fields are required. Fill in the address, port, authentication details, and transport settings using the information from your service provider. The name is only a local label; changing it does not change the connection destination.
Global Routing sets the overall routing mode: Config applies the rules in the current configuration, Proxy routes traffic in proxy mode, and Direct uses direct connections. When troubleshooting, distinguish the overall mode from the policy on an individual rule. Even correctly written rules may not take effect as expected unless Config is selected.
Config can refer either to the configuration-file management screen or to the Global Routing option that applies configuration rules. Its meaning depends on where it appears. The former is for importing, selecting, and editing files; the latter determines how requests are handled. Saving a configuration file does not mean it has been selected and applied.
On Demand triggers connection behavior when specified conditions are met. Configure it after verifying that a manual connection works. It cannot fix invalid authentication details or guarantee that a server is reachable. If the connection keeps reconnecting automatically, check the trigger conditions as well as the main toggle.
Connectivity Test checks reachability or response time using the selected test method. Results depend on the test target, local network, and server status. Lower latency does not mean higher throughput or guarantee that every request will succeed. For meaningful comparisons, keep the test method and network conditions consistent.
02 / PROTOCOLS
A protocol defines how a client and server communicate. The descriptions below help identify fields and troubleshooting conditions; they are not recommendations for choosing a server. Use the details provided for your existing connection.
Shadowsocks is a proxy protocol that typically requires a server address, port, encryption method, and password. The encryption method must match the server; do not substitute one just because its name looks similar. Availability also depends on server status and network conditions, not just whether a password is entered.
VMess is an authenticated proxy protocol. Connections may also require transport and TLS settings. After importing a configuration, retain the user ID, transport path, and related options provided. If authentication fails, verify the fields and check that the device date and time are correct.
VLESS is a proxy protocol. The protocol and transport-layer protection are separate considerations, so the name alone does not indicate connection security. The user ID, transport method, and TLS settings must match the server configuration. A server address alone is usually not enough to recreate a complete connection profile.
Trojan typically connects over TLS and uses a password for authentication. The server address, password, port, and TLS server name each serve a different purpose and are not interchangeable. If certificate validation fails, first check the server name, device time, and server certificate; disabling validation should not be a routine fix.
Hysteria2 is a QUIC-based proxy protocol that depends on UDP connectivity. Enter authentication, TLS, and any other required settings as specified in the original connection details. If performance changes on a different local network, check UDP reachability rather than concluding from a single test that the protocol or server is unavailable.
WireGuard uses keys to identify peers. A configuration typically includes keys, tunnel addresses, peer addresses, and allowed network ranges. Allowed IPs affect routing and peer matching; they are not simply a notes field. Understand the target network ranges before changing them, and never include a private key in screenshots or public troubleshooting posts.
HTTP and SOCKS5 are different proxy protocols, with differences in supported request types, authentication, and domain handling. The same address and port do not make the protocols interchangeable. Their names alone do not indicate that encryption is enabled; check how the connection is actually configured.
03 / RULES & POLICIES
When reading a rule, check the match type, match value, and handling policy in that order. example.com in the examples is only there to illustrate the syntax; it is not server information.
A rule matches requests against specified conditions and assigns a handling policy. Rules are generally checked from top to bottom, and a matching request is handled according to the corresponding policy. Put narrower exceptions before broader rules. If a rule does not seem to work, first check whether an earlier rule has already matched the request.
DOMAIN-SUFFIX matches domain suffixes and is useful for covering a domain and its subdomains. For example, DOMAIN-SUFFIX,example.com,PROXY matches the example.com domain and routes it through PROXY. It does not match webpage paths or search for an arbitrary string within a URL.
GEOIP matches an address based on its classification in a geolocation database, for example, GEOIP,CN,DIRECT. The database classification does not identify where a website operator is based and may change as addresses or database entries are updated. If the result is unexpected, check the actual destination IP and any earlier rules.
IP-CIDR and IP-CIDR6 match IPv4 and IPv6 address ranges, respectively. The prefix length after the slash determines the range covered. These rules match addresses, not domain-name text. If a domain resolves to multiple addresses, whether a request matches depends on the destination address actually used.
FINAL is the fallback rule used when no earlier rule matches, so it belongs at the end of the rule list. For example, FINAL,DIRECT sends requests not handled by earlier rules through DIRECT. Placing FINAL earlier prevents subsequent rules from being matched.
PROXY, DIRECT, and REJECT are rule policies meaning route through a proxy, connect directly, and reject the request, respectively. PROXY does not name a specific server; the route depends on the current selection and configuration. REJECT blocks matching requests but does not guarantee that every instance of a particular type of content will disappear from a page.
DNS resolves domain names to IP addresses and is one step in establishing many network connections. A resolution failure, a change in the resolved address, and a failure later in the connection are different problems. Changing DNS settings will not fix every authentication or connectivity issue; distinguish the resolution result from the actual request path when troubleshooting.
04 / SUBSCRIPTION & CONFIGURATION
The steps below assume you already have a subscription or server details. Subscription updates, configuration changes, and data sync address different needs and are not interchangeable.
Subscribe reads server lists and other information from a subscription URL. Get any subscription you need from your service provider. Updating reloads remote content; it does not extend the service period. A subscription URL may contain personal authentication details, so do not share it in troubleshooting posts.
A server entry stores the protocol and authentication details needed to connect to a remote endpoint. Its name in the list is usually just a label for identification. An entry can remain even when the service is no longer valid. If it is updated from a subscription, later remote updates may overwrite manually edited fields; note the source before making changes.
A configuration file brings together rules, DNS settings, and other behavior. It is not the same as a subscription that contains only a server list. After importing a file, confirm that it is selected and check the Global Routing mode. Keep a recoverable copy before editing to avoid confusion from changing several settings at once during troubleshooting.
URL Rewrite modifies or otherwise processes request URLs according to specified conditions. It is different from routing rules that choose PROXY or DIRECT for a request. Whether it works depends on the matching conditions and whether the request can be processed. It is not a general-purpose switch for reading all encrypted request content and may not apply to every webpage.
iCloud Sync transfers app-supported data between eligible devices and depends on your iCloud sign-in, permissions, and sync settings. It is separate from restoring App Store purchase records. When moving to a new device, check separately that the app is available and the required configuration has synced; these are not the same process.
05 / APP STORE & ACCOUNT
Shadowrocket is a paid Apple-platform client, primarily for iPhone and iPad. Check the App Store listing for compatibility, system requirements, and whether the purchase is universal for Mac, Apple TV, and Apple Vision.
The App Store is the only place to get Shadowrocket. Check the App Store listing for price, system requirements, and compatibility. To verify the app, check the developer, Shadow Launch Technology Limited, the official icon, and app ID 932747118 rather than relying on the name shown in search results.
Your Apple ID’s store region affects app availability, billing currency, and payment requirements. It is not determined solely by your device’s current location or interface language. If you cannot find the app, first check the account and region used for Media & Purchases. Region changes may involve balance, subscriptions, and payment requirements; follow the prompts shown by the system.
Purchased Items lets you find existing purchases on your account and get the app again. When moving to a new device or reinstalling, check using the original purchasing account. Restoring the app does not restore local server or configuration data. If the purchase is missing, first check the account, hidden purchases, and current store status instead of paying again.
A one-time purchase means paying for the client through the App Store. The price and purchase terms are listed on the App Store page. A one-time client purchase is not a service plan: using the connection features still requires an existing subscription or server details. Get subscriptions from your service provider.