First identify where the term appears, then check what it controls. English interface terms are retained to distinguish connection modes, server protocols, and rule policies when checking Shadowrocket settings.
For your first setup, start with Getting Started →. If you’re connected but having access issues, go to Troubleshooting → and check by symptom. A protocol name does not guarantee speed or availability.
Capitalized interface labels and uppercase policies in configuration have different roles. Check where a term appears before deciding what the setting does.
Home is the main screen for connection controls, Global Routing, and the SERVER list. A server entry in the list means its parameters are saved, not that it is connected. Before testing, check which entry is selected and the connection status so you don’t mistake an unselected server for the one in use.
Global Routing determines how connections are handled overall. Its three common modes are Config, Proxy, and Direct. To use rule-based routing, first make sure Config is selected. You can temporarily switch modes to compare results while troubleshooting, but restore the intended setting afterward; otherwise, even a correct rules file may not work as expected.
Config has two common meanings. In Global Routing, it means handling connections according to the active configuration; as a screen name, it opens configuration file management. On the Config screen, check which file is selected, not just whether a file has been imported. In tutorials, distinguish “switch to Config mode” from “open the Config screen.”
Proxy is the proxy mode in Global Routing, which routes traffic through the selected proxy. While troubleshooting, you can briefly compare it with Config to check whether rule selection is involved. Proxy here is a mode name, not the uppercase PROXY rule policy. Selecting proxy mode cannot fix incorrect server parameters.
Direct is the Global Routing mode that bypasses the selected proxy server. It still depends on the device’s network and the destination service, so it does not guarantee every request will succeed. It can help check whether the local network is working, but a successful direct connection does not prove the proxy server works.
On Demand is a system feature that triggers VPN connections when specified conditions are met. It is neither a server protocol nor a way to decide which rule applies to each destination. If the connection starts again after you disconnect manually, check whether On Demand is enabled and whether the current network meets its conditions. To troubleshoot unexpected connection behavior, temporarily disable the relevant conditions, observe the result, then restore them once you’ve identified the cause.
A protocol defines how the client and server communicate. After selecting a type, match each parameter to the server details you already have; an address and port alone are not enough.
Shadowsocks is a proxy protocol. Common connection parameters include the server address, port, encryption method, and password. The encryption method must match the server; the connection may fail even if the password is correct but the method is not. If your server details include additional transport parameters, check those too rather than removing them after import.
VMess uses parameters such as a UUID to identify users and can work with different transport types. The UUID, transport, TLS, Host, and path each serve different purposes; they are not interchangeable authentication details. If import succeeds but the connection fails, compare each setting with the original details instead of only changing the server address.
VLESS is a UUID-based proxy protocol. It does not inherently mean TLS, and the name alone does not tell you whether transport is encrypted. The connection also depends on the transport and its security settings. Even when another entry uses the same address, do not assume its protocol, path, or security parameters will work here.
Trojan is commonly used with TLS. Check the server address, port, password, and TLS parameters. The connection address and the name used for certificate validation may serve different purposes, so enter them as specified in the configuration you have. If certificate validation fails, check the name, device time, and server certificate; do not treat skipping validation as the default fix.
Hysteria2 is a QUIC-based proxy protocol, and connection performance depends on UDP communication over the current network. Match the authentication, TLS, and other server parameters. A single latency result cannot confirm that the configuration is complete. If performance changes after switching networks, compare network conditions first, then check the parameters; avoid changing several settings at once.
WireGuard is a tunneling protocol that identifies peers by public key. Its configuration includes keys, endpoint, and tunnel addresses. Public and private keys have different purposes and cannot be substituted; a tunnel address is not the server’s public address. After importing, check the peer details. Hide the private key and other sensitive parameters when sharing troubleshooting information.
HTTP and SOCKS5 are distinct proxy protocols, not two display names for the same protocol. Choose the type that matches the server, then check the username, password, and transport protection requirements. A port only identifies where to connect; it does not reveal the protocol. The name HTTP alone does not mean TLS is enabled.
A standard rule consists of a matching method, a value to match, and a handling policy. Check what matched first, then see how it is handled.
A Rule is a configuration entry that matches connections and specifies how to handle them. Rules are generally checked in order, so an earlier match can affect the result. After adding rules to a file, select that file and make sure the active mode uses its configuration. If traffic is routed unexpectedly, check which rule actually matched—not just whether the rule you expected is present.
DOMAIN matches an exact full domain name. For example, DOMAIN,example.com,DIRECT matches example.com. It does not automatically cover subdomains such as www.example.com just because they share the same main domain. Enter a domain as the match value; do not include the URL scheme, path, or query parameters.
DOMAIN-SUFFIX matches a domain suffix. For example, DOMAIN-SUFFIX,example.com,PROXY covers example.com and its subdomains. Use it to handle a domain and its subdomains together; it cannot distinguish pages by URL path. Check the scope before adding the rule so a need limited to one host does not affect the entire domain.
DOMAIN-KEYWORD checks whether a domain contains the specified keyword. It usually covers more than a specific domain suffix, so the keyword may match unrelated domains. Use it only when matching a domain fragment is necessary, and check connection logs to see what actually matched.
IP-CIDR matches IPv4 address ranges; IP-CIDR6 matches IPv6 ranges. The prefix length after the slash determines the size of the range. For example, IP-CIDR,192.168.0.0/16,DIRECT describes a private address range, not a single domain. Domain and IP rules operate at different matching levels, so check the destination’s resolved address and the rule order when troubleshooting.
GEOIP matches using an IP geolocation database. The result depends on the destination IP and the database in use. It does not identify webpage language, a domain suffix, or the user’s location, and the database may differ from the service’s actual deployment. For distributed services, check the actual connection address rather than inferring the match from the site name.
FINAL is the fallback rule used when no earlier rule matches, and is usually placed at the end of the list. For example, FINAL,PROXY. It does not override connections matched by earlier entries. Before changing it, decide how unmatched connections should be handled; changing the fallback is not a universal fix for all traffic.
PROXY sends a matched connection through a proxy, DIRECT connects without a proxy, and REJECT blocks the connection. These uppercase rule policies are different from the Proxy and Direct modes in Global Routing. A PROXY match does not mean the server is available, and a DIRECT match does not guarantee the destination is reachable. If REJECT matches, first check that blocking the connection is intended by the configuration.
Server details, subscription URLs, configuration files, and App Store purchase records serve different purposes and cannot replace one another.
Subscribe reads server entries from a subscription URL you already have. Later updates may add, remove, or change entries in the list. A subscription URL may contain access credentials, so don’t share it in screenshots, comments, or troubleshooting notes. After importing, check that the entries appear in the list. To find out whether rules and DNS settings are included, inspect the original content rather than assuming they are included because it is called a subscription.
Add Server is where you enter server parameters; SERVER is the list of server entries shown on Home. An entry typically includes a protocol, address, port, and authentication details. Its name is only a label for identification. After saving, select the entry and test it. A familiar name or successful import does not mean the connection parameters are complete.
A configuration file organizes settings such as rules and DNS, unlike a subscription that mainly provides server parameters. A file appearing on the Config screen does not mean it is selected or that the active mode will apply its rules. Before editing, save a recoverable copy. Change one category of settings at a time and note what you changed so you can compare results or roll back if something goes wrong.
Purchased Items is where you find your App Store purchase history. After changing devices, make sure the App Store is signed in with the account used for the original purchase. Shadowrocket is available only through the App Store; check the App Store page for purchase eligibility and system requirements. A one-time purchase of the client is not a service plan, and purchase history does not replace backups of server details or configuration files.
See how to restore purchases →The connection toggle, DNS results, and test duration are different indicators. Record them separately; no single value replaces a complete access check.
DNS resolves domain names to IP addresses and is an important part of accessing services by domain name. A response from a server test does not mean the destination domain will resolve, and successful resolution does not guarantee the connection will be established. If a webpage won’t load, check the DNS settings in the active configuration, network reachability, and the actual resolution result. Avoid changing several DNS options at once.
See DNS troubleshooting →Connectivity Test checks the connection using the selected test method. Results depend on the test target, current network, and related settings. A successful test only means that this particular check received a response; it does not mean every website or app is reachable. When troubleshooting, note the test method first, then test the actual destination. Don’t compare results from different methods as if they were equivalent.
Latency is the time from starting a test to receiving a response, usually measured in milliseconds. It is not a measure of how much data can be transferred per second. Lower latency does not prove higher throughput, and it does not replace checks for stability, DNS, or destination access. If a test times out, check the server parameters, network conditions, and test target before deciding whether to try another target from your existing list.