Official Manual · Glossary

Shadowrocket Glossary

Check where a term appears before deciding what it affects. This glossary groups terms by interface, protocols, rules, configuration, and purchases. It keeps the original English labels and explains their function and common points of confusion.

Interface labels are case-sensitive
Rules are checked from top to bottom
Use your existing server details for protocol settings

01 / interface

Interface & Controls

These labels help you find screens, switch modes, and check connection status. A selected mode, the system connection switch, and a test result each tell you something different.

Interface & ControlsHome: Home is the main screen for viewing server entries, selecting the active server, and controlling the connection switch. After importing an entry, make sure the intended server is selected, not just visible in the list. A listed entry, an enabled switch, and working requests are three separate things to verify.

Interface & ControlsGlobal Routing: Global Routing determines how requests are routed overall. Config, Proxy, and Direct correspond to the modes shown in the interface: Config follows the active configuration, Proxy uses the proxy route, and Direct connects directly. This is not a server protocol selector, and changing modes will not correct server authentication settings.

Interface & ControlsConfig: Config can refer to the configuration file management screen or the mode in Global Routing that follows the active configuration. Viewing or editing a file on the screen does not make it the active configuration. To use its routing rules, check both the active configuration and the Global Routing selection.

Interface & ControlsProxy: Proxy is the Global Routing mode that sends affected requests through the proxy route. It does not replace checking the server address, authentication details, and reachability. Note the difference in capitalization and context from the PROXY rule policy, which describes what happens when a rule matches.

Interface & ControlsDirect: Direct is the Global Routing mode that handles requests over a direct connection. Selecting Direct does not turn off the system VPN configuration or remove server entries. It can help you compare direct and proxy routes when troubleshooting, but one test cannot prove that every destination is reachable.

Interface & ControlsOn Demand: On Demand starts a connection when preset conditions are met. Its behavior depends on both app settings and the system VPN configuration; it is not an indicator that a connection will always be available. If the connection returns after you disconnect manually, check the relevant conditions and the system VPN settings.

Interface & ControlsConnectivity Test: Connectivity Test checks whether a connection is available, and its results reflect network and server conditions at the time of testing. Passing once does not mean every domain, app, or protocol will work; failing once does not pinpoint an authentication error. Consider the active server, Global Routing mode, and the destination you're testing.

Interface & ControlsData: Data shows the app's recorded traffic usage and can help you see whether data was transferred during a connection. App statistics may use different scopes, periods, and calculation methods from your provider's billing. Check your provider's account records for remaining allowance; don't treat the local figure as a bill.

Interface & ControlsSettings: Settings is where you manage app options; the options available depend on the current app version. When troubleshooting, note the original values and change one related option at a time. If you change several settings at once, even an improvement won't reveal which change made the difference.

02 / protocols

Protocols

Protocol names determine how connection parameters are interpreted; they are not speed ratings. Before adding a server, check its protocol type and fill in the corresponding fields.

ProtocolsShadowsocks: Shadowsocks is a proxy protocol. A typical configuration includes the server address, port, encryption method, and password. The encryption method must match the server; don't substitute one based only on a similar name. Check any additional parameters provided by your service provider, not just the address and port.

ProtocolsVMess: VMess uses an ID and other parameters for authentication; its configuration may also include transport and TLS settings. A correct ID confirms only part of the authentication details, not that the transport settings match. If a connection fails after import, compare the relevant fields with the original details instead of repeatedly changing Global Routing.

ProtocolsVLESS: VLESS is a proxy protocol. Check the user ID, transport, and security settings separately. The protocol name alone does not tell you which encryption or certificate verification conditions are in place. Use the complete server details; don't copy security settings from a different configuration.

ProtocolsTrojan: Trojan is commonly used with TLS, and both the authentication password and certificate settings can affect connectivity. The server address and the name used for TLS verification may serve different purposes, so enter them as specified in your existing configuration. If certificate verification fails, check the name, device time, and server certificate before considering any change to verification.

ProtocolsHysteria2: Hysteria2 is a QUIC-based proxy protocol, so UDP reachability can affect how well it connects. Authentication, TLS, and other related settings must also match the server. Protocol support does not guarantee that the current network path is usable; check network conditions separately from the configured fields.

ProtocolsWireGuard: WireGuard is a tunneling protocol that uses public-key authentication. Its configuration includes details such as the local private key, peer public key, peer address, and allowed address ranges. Allowed address ranges affect which destinations use the tunnel; they are not just authentication settings. Keep the private key confidential and remove it from screenshots or diagnostic text before sharing.

ProtocolsHTTP / SOCKS5: HTTP and SOCKS5 are different proxy protocols. In Add Server, choose the type that matches the server. Their authentication methods, DNS handling, and UDP capabilities are not interchangeable. Support for a proxy protocol does not mean traffic is encrypted by default; check the relevant settings separately.

03 / rules

Rule Keywords

A rule typically consists of a match type, a target, and a policy. Rules are checked in order, so specific rules should come before broader ones.

Rule KeywordsDOMAIN: DOMAIN matches an exact domain name and is suited to a specific hostname. For example, DOMAIN,example.com,DIRECT matches example.com but does not automatically include all subdomains. A domain rule targets a hostname, not a full webpage URL with a path.

Rule KeywordsDOMAIN-SUFFIX: DOMAIN-SUFFIX matches a domain suffix and can cover both a specified domain and its subdomains. For example, targeting example.com can also match www.example.com. It does not match an arbitrary string anywhere in the domain; use DOMAIN-KEYWORD when you need to match a particular substring.

Rule KeywordsDOMAIN-KEYWORD: DOMAIN-KEYWORD checks whether a domain contains a specified string, which may match far more than one domain. For example, the keyword example could match domains with different suffixes. Consider the risk of unintended matches; short, common strings are rarely precise identifiers for a specific site.

Rule KeywordsGEOIP: GEOIP matches based on the geographic classification of the destination IP in an address database. It does not identify a website's language, domain suffix, or the user's location. Database records may differ from a service's actual operating location and can change as IP addresses change. For consistent matches on a specific domain, don't rely only on geographic classification.

Rule KeywordsIP-CIDR / IP-CIDR6: IP-CIDR matches IPv4 address ranges, while IP-CIDR6 matches IPv6 ranges; the number after the slash is the network prefix length. For example, IP-CIDR,192.168.0.0/16,DIRECT specifies an IPv4 range. Check the address family when reviewing a target: an IPv4 rule alone does not cover the corresponding IPv6 traffic.

Rule KeywordsFINAL: FINAL is the fallback rule used when none of the preceding rules match, and usually belongs at the end of the list. For example, FINAL,PROXY sends remaining requests through PROXY. If a fallback rule appears too early, later rules may never be checked, so review both the rule contents and their order when troubleshooting.

Rule KeywordsPROXY / DIRECT / REJECT: These are rule policies: PROXY uses the proxy route, DIRECT connects directly, and REJECT blocks the request. A policy describes what happens after a rule matches, not what the rule matches. PROXY does not include server credentials; the proxy route still depends on an active server or the policy defined in the configuration.

04 / configuration

Subscriptions & Configuration

Server entries contain connection parameters; configuration files contain rules and related behavior. They can be used together, but importing one does not complete all setup.

Subscriptions & ConfigurationAdd Server: Add Server is where you add server details. The Type must match the protocol of your existing server. Check the address, port, authentication details, and transport parameters together; don't mix fields from different entries. After adding a server manually, return to Home, select the entry, and test the connection.

Subscriptions & ConfigurationConfiguration File: A configuration file contains rules and related settings; it is not the same as a subscription that provides server entries only. After importing a file, check whether it is selected as the active configuration and whether Global Routing is set to Config. Remote updates may affect local changes, so save the original content before editing in case you need to restore it.

Subscriptions & ConfigurationDNS: DNS resolves domain names to IP addresses. Successful resolution and a successful connection are separate steps. If a domain fails while a test using its IP behaves differently, check DNS as one possible factor, but don't assume that this identifies the cause. Note the original settings before changing DNS, and check whether the active configuration has its own DNS settings.

Subscriptions & ConfigurationURL Rewrite: URL Rewrite applies rewrite rules to matching URLs; this differs from rule-based routing, which only selects a connection route. A rewrite may change the request target or how it is handled, so consider both the match conditions and the rewrite action. Processing encrypted requests also requires the appropriate conditions; adding a rule does not guarantee that it will take effect.

05 / app store

App Store & Purchase

App purchases, server services, and configuration data are separate things. Shadowrocket is available only on Apple platforms, and the App Store is the only place to get it.

App Store & PurchaseVerify the App Store Listing: Before purchasing, check that the developer is Shadow Launch Technology Limited, the official icon matches the one on this site, and the product page shows app ID 932747118. Similar names or search ranking are not substitutes for checking all three. iPhone and iPad are the primary devices; compatibility, system requirements, and purchase eligibility for Mac, Apple TV, and Apple Vision are as shown on the App Store listing.

App Store & PurchaseOne-Time Purchase: A one-time purchase is the payment model for the app. Check the App Store listing for current pricing and purchase eligibility. A one-time app purchase is not a server plan and does not provide server connection details. You still need an existing subscription or server information to connect; get those details from your service provider.

App Store & PurchasePurchased Items: Purchased Items refers to the purchase history in your App Store account, where you can find the app when reinstalling or changing devices. Make sure you're signed in to the account used for the original purchase; check the App Store listing for the current restoration conditions. Being able to download the app again does not automatically restore local configuration, server details, or other data.

Need to check the App Store listing or restore a purchase? See how to verify the listing and how to restore a purchase. For other connection issues, browse the FAQ.