Global Routing: Choose how traffic is handled
What it does: Global Routing determines how connections are routed when Shadowrocket handles them. Config, Proxy, and Direct are routing choices, not quality levels or protocols. Use Config for everyday rule-based routing. To isolate the effect of rules, temporarily compare results with Proxy or Direct.
Where to find it and how to set it: Open Home, find Global Routing, then choose Config, Proxy, or Direct. Before using Config, check which configuration is active in Config. Before choosing Proxy, select an available server on Home. After changing the mode, reconnect to the same destination; don't rely on a page that was already open.
| Mode | How it works | When to use it | Check first |
|---|---|---|---|
| Config | Routes connections according to the rules and policies in the active configuration. | For everyday rule-based routing when different domains or addresses need different handling. | The active configuration, rule order, and policies referenced by the rules. |
| Proxy | Routes traffic through a proxy overall; local network traffic and system-reserved routes may still be handled separately. | Temporarily check whether a rule is sending a destination over a different route. | The selected server, its protocol, authentication, and transport settings. |
| Direct | Connects directly, without forwarding traffic through the selected proxy server. | Compare with the local network to check whether the destination is reachable directly. | Whether the current network can reach the destination directly. |
Keep in mind: Proxy won't fix server authentication failures, and Direct doesn't mean that every network feature is disabled. Global Routing and the connection toggle on Home are separate controls. Restore the original mode after testing; don't leave a temporary troubleshooting setting in place. For step-by-step instructions, see Using Global Routing.
Rules: Understand match conditions and policies
What rules do and where to find them: In Config mode, rules select a handling policy based on the match conditions in the active configuration. Open Config, confirm which configuration is enabled, then review its rules. Rule keywords determine what matches; the policy at the end of a rule determines how to handle it. These are not interchangeable.
| Rule type | Matches | What to check |
|---|---|---|
| DOMAIN | An exact domain name. | Whether the rule should match only one specific hostname. |
| DOMAIN-SUFFIX | A domain and its subdomains. | Whether the suffix covers a broader range than intended. |
| DOMAIN-KEYWORD | A keyword contained in a domain name. | Whether it could match similarly named domains with a different purpose. |
| IP-CIDR / IP-CIDR6 | An IPv4 or IPv6 address range. | The address range, mask, and whether domain resolution is involved. |
| GEOIP | A region classification in an address database. | A database classification does not establish a service's actual purpose or ownership. |
| FINAL | The final handling for traffic that matches no earlier rule. | Whether the fallback policy is appropriate. |
How to set it up: Put specific rules before broader ones, and use FINAL as the fallback. The example below shows rule syntax only: example.com is a sample domain, not a complete configuration for everyday use. PROXY routes matching traffic through a proxy policy, DIRECT connects directly, and REJECT blocks matching connections. If the configuration references custom policy names, make sure those policies exist.
[Rule]
DOMAIN,example.com,PROXY
DOMAIN-SUFFIX,example.org,DIRECT
DOMAIN,blocked.example.com,REJECT
IP-CIDR,192.168.0.0/16,DIRECT
FINAL,DIRECTKeep in mind: A destination may use multiple domains and addresses, so changing only its homepage domain may not cover every connection. Check connection records to confirm which requests matched which policies. A Config file may also include DNS, policy groups, and other settings. After updating a remote configuration, check whether your local changes were retained; back up important edits first.
Subscriptions and servers: Keep connection details separate from rules
What they do and where to find them: Server entries on Home store connection details such as address, port, authentication, and protocol settings. Subscribe manages existing subscription URLs and updates. Config handles rules and related settings. Importing a server list doesn't configure routing rules, and enabling a rules file doesn't provide a connectable server.
How to set it up: If you already have a subscription, get its URL from your provider, choose Subscribe from the add menu, enter the URL, save, and update. To add a server manually, open Add Server, choose the protocol that matches the information you were given, then check the address, port, and authentication fields. Shadowsocks, VMess, VLESS, Trojan, WireGuard, and Hysteria2 require different parameters; don't reuse one protocol's fields for another.
If the details are provided as a QR code or in the clipboard, use the corresponding import option. After importing, open the entry to verify its protocol and server address. Give subscriptions clear names and group them by purpose. Then use Connectivity Test to compare them under the same test conditions. Sorting helps organize the list; don't delete other entries based on a single test.
Keep in mind: A subscription update may add, remove, or replace servers. Manually edited subscription entries may also change during a later update. Before deleting anything, check whether you're removing one entry or an entire subscription group. Subscription URLs often contain access credentials, so hide them before sharing logs or screenshots. For full instructions, see Managing Subscribe and Importing from a QR Code or Clipboard.
On Demand: Trigger connections based on conditions
What it does: On Demand triggers connection behavior under conditions you set. It controls when a connection is attempted; Global Routing controls how traffic is handled after connecting. On Demand won't fill in missing server details or guarantee that a server is reachable on every network.
Where to find it and how to set it: Find the On Demand options in Settings and configure the conditions available in the app. First confirm that a manual connection works, then enable On Demand. If you need different behavior for different network conditions, check each option individually instead of changing several at once. Test both the networks where it should trigger and those where it should not.
Keep in mind: When switching between Wi-Fi and cellular, the system has to establish a new network path; a brief reconnection doesn't necessarily indicate a configuration problem. If the connection starts again after you turn it off manually, check whether On Demand is still enabled. To troubleshoot, temporarily disable its conditions so you can run a repeatable manual test. Restore your preferred settings when you're done.
Data: Review traffic and connection records
What it does and where to find it: Data shows the traffic statistics and connection information available in the app. Open Data and first check the scope of the statistics, traffic direction, and record details shown on screen. Use that information to identify what kinds of requests are being made. These statistics reflect network activity observed by the client; they are not your provider's billing records.
How to use it: To investigate an app or page, note the current statistics, perform one specific action, then return to Data and compare the changes. If the current screen shows connection details, check the destination and handling policy to see whether the request behaved as expected. Before clearing records or resetting counters, save any information you need and confirm what the action will affect.
Keep in mind: Cached pages, background refresh, reused connections, and traffic from other apps can affect what you see. An increase in traffic only shows that data passed through the relevant statistics path; it doesn't prove that the requested content loaded successfully. Client statistics and provider billing may use different measurement methods, so check your provider's records for remaining usage. Connection records may include visited domains; handle exported data as private information.
Settings: Adjust common options for specific needs
Settings brings together testing, system integration, and some network behavior options. Keep settings that are working as they are, and change an option only to address a specific issue. Some values may also come from the active Config, so changing a setting doesn't guarantee that the current connection uses it. Check both the configuration file and actual connection records.
DNS: Check the domain resolution path
What it does and where to find it: DNS resolves domain names to addresses. Check DNS-related options in Settings and the DNS section of the active Config. DNS is related to the proxy server address and TLS name verification, but these are separate settings. Don't enter the same value in fields just because their names seem related.
How to set it up and what to watch for: Note the current DNS settings first, then confirm the path used for DNS requests and whether the configuration specifies rules for them. If a domain fails while connecting by address behaves differently, check the resolution result. Change one setting at a time and retest. Adding multiple resolution options at random makes faults harder to isolate and doesn't guarantee faster DNS. If TLS verification fails, also check the server name, certificate, and device time; DNS may not be the cause.
Test Method: Compare Connectivity Test results consistently
What it does and where to find it: Test Method in Settings determines how connection tests are performed. When you run Connectivity Test on Home, interpret the result in light of the selected method. Different methods measure different stages, so their results aren't directly comparable.
How to set it up and what to watch for: Choose a test method first. If it offers a test target or timeout, note those settings too. Keep the local network and test conditions consistent when comparing servers. A successful test doesn't mean every destination is reachable, and lower latency doesn't mean higher sustained throughput. For a timeout, continue checking the local network, server settings, and test target. For details, see Latency Testing and Sorting.
Today Widget: Add a quick access point in the system
What it does and where to find it: Today Widget provides an entry point through a system widget. Check the available options in Settings, then look for addable widgets in the system's widget area. Availability, placement, and interactions depend on the current system and what the app displays.
How to set it up and what to watch for: First confirm in the app that the connection and selected server are correct. Then add an available widget and test its controls. A widget can reduce the steps needed to open the app, but it doesn't replace Config or server management. If the widget doesn't reflect the app's state, open the app to check the actual connection, then see whether the system widget needs refreshing.
iCloud: Distinguish syncing, recovery, and app purchases
What it does and where to find it: iCloud features sync or restore data supported by the app. Check the available options in Settings. They serve a different purpose from your App Store purchase history: getting the app again doesn't necessarily restore server entries or configuration files.
How to set it up and what to watch for: Before enabling iCloud, make sure the device is signed in to the required iCloud account and that the relevant service is allowed to use iCloud. When using multiple devices, confirm the data is saved on the original device, then check the sync scope and results on the other device. Avoid deleting or renaming many items on both devices at once. Keep a separate recoverable backup of important configurations; syncing doesn't preserve a version history of every change. Subscription credentials are sensitive and should be included in your account and backup security practices.
Diagnostics: Narrow down issues with a single reproduction
What it does and where to find it: Diagnostics helps collect or review information for troubleshooting. Find the relevant option in Settings. Use it alongside Connectivity Test on Home and connection records in Data: Connectivity Test helps check connection conditions, while Data helps show what requests actually occurred.
How to use it: Describe the issue precisely, such as “one domain fails while other destinations work,” rather than just “it doesn't work.” Note the Global Routing mode, selected server, and local network type. Enable only the diagnostics needed in the current screen, then reproduce the issue once. Match the records before and after the problem with the time of your actions, and look first for issues with resolution, connection, authentication, or rule selection.
Keep in mind: Diagnostic records may contain server addresses, subscription URLs, visited domains, and authentication details. Review and redact them before sharing. When troubleshooting is complete, restore any temporary logging settings to avoid accumulating unnecessary records. Don't change the server, DNS, rules, and test method all at once; if the issue goes away, you won't know which change fixed it.
Recommended order for checking common settings
For a newly imported configuration, start with a repeatable validation process before setting up automation or sync. The steps below separate server availability, rule behavior, and On Demand connections to reduce interference between checks.
- Check the server. Select an entry on Home and verify its protocol, address, port, and authentication fields. Keep Test Method unchanged, then run Connectivity Test.
- Check the routing mode. Confirm Global Routing. With Config selected, check the active configuration and the relevant rules. If you temporarily change the mode, note the original setting and restore it afterward.
- Check actual requests. After connecting, open a specific destination and review the corresponding changes in Data or available connection records. Distinguish a destination-specific failure from a connection-wide failure.
- Enable On Demand last. Once a manual connection works, configure On Demand and test network changes and the conditions that should trigger it.
- Organize and back up. Check subscription names, configuration backups, and iCloud sync results before adding shortcuts such as Today Widget.
Shadowrocket is a closed-source commercial app for Apple platforms. The App Store is the only place to get it; check the App Store listing for system requirements and purchase availability. This page explains its features and does not provide connection services. For step-by-step instructions, continue to the user guide. To manage multiple subscriptions and servers, see the official server management manual.