Shadowrocket Features: Routing Modes & Settings

01 / Routing

Three Global Routing modes

Config, Proxy, and Direct determine the routing logic used for connections; they are not three different servers.

What it is: Global Routing is where you choose the overall routing mode. Config applies the rules in the active configuration to decide where requests go. Proxy sends applicable traffic through the selected proxy server. Direct bypasses the selected proxy server. Before troubleshooting whether a rule is working, first check that Global Routing is set to Config.

Where to find it and how to set it: Open Global Routing from Home, select a mode, then return to confirm the current selection. Use Config for existing rule-based routing. Temporarily choose Proxy to test whether the selected server can handle a specific request, or Direct to compare access over your current network without that server. Change only this setting at a time and keep other conditions unchanged so the results are comparable.

Global Routing modes at a glance
Interface label / meaning	How it works	When to use it	What to check
Config / configuration	Routes requests according to the active Config’s rules and policies.	For everyday routing by domain, IP, and other criteria.	The active configuration, rule order, and policy references.
Proxy / proxy	Applicable traffic is routed through the selected proxy server.	To temporarily test a server and the path to a destination.	The currently selected server and its settings.
Direct / direct	Traffic bypasses the selected proxy server.	To check direct access over the local network.	The current network, DNS, and destination service status.

Keep in mind: Proxy cannot fix incorrect authentication details, and Direct is not a universal fix for network problems. Existing long-lived connections may continue using their previous route after you switch modes, so start a fresh request when testing. If you changed modes only for troubleshooting, switch back to your usual Config afterward to avoid mistaking a test setting for your everyday routing setup.

02 / Matching and handling

Rule types and policies

Rules determine whether a request matches; policies determine what happens after a match.

What it is: Rule-based routing compares request details against specific conditions. DOMAIN matches an exact domain, DOMAIN-SUFFIX matches a domain and its subdomains, and DOMAIN-KEYWORD matches a keyword in the domain. IP-CIDR and IP-CIDR6 specify IPv4 and IPv6 ranges, while GEOIP matches based on an IP address’s geographic location. Rule types are not server protocols: do not enter protocol names such as VLESS or Trojan as rule types.

Where to find it and how to set it: Open Config, confirm which configuration is active, then review its rules. More specific conditions generally belong before broader ones. FINAL handles requests that did not match an earlier rule. Common actions include DIRECT, PROXY, and REJECT; rules may also refer to policy groups already defined in the configuration. A policy group reference must exactly match its configured name.

DOMAIN-SUFFIX,example.com,PROXY
IP-CIDR,192.168.0.0/16,DIRECT
FINAL,DIRECT

This snippet illustrates syntax only: example.com and its subdomains use PROXY, the specified local IPv4 range uses DIRECT, and other unmatched requests use FINAL,DIRECT. It is not a complete, general-purpose configuration, nor does it mean every home or office network should use the same settings. Keep a copy of your existing configuration before editing, and make sure the fallback policy suits your needs.

Keep in mind: With top-down matching, a broad rule near the beginning may catch a request before a more specific rule can match. Adding a DOMAIN-SUFFIX line alone does not prove that routing has changed. Also check that Global Routing is set to Config, the configuration is active, and the destination is not using a different domain or an IPv6 address. For more on rules and settings, see the detailed settings guide.

03 / Connection details

Existing subscriptions and server management

Subscribe manages updates to existing subscriptions; Add Server manages individual server details. Neither is a Config rules file.

Subscribe: import and update

An existing subscription contains server details that the app can read. On Home, open the add menu, choose Add Server, select Subscribe, and enter your existing subscription URL. Save, then check the list to confirm that the servers were read. The exact menu location may vary by app version.

Updating a subscription reloads its source. After an update, check that the selected server is still listed and that policy groups in your configuration still match the intended entries. A server name appearing in the list does not confirm successful authentication or that every server is working.

Add Server: enter details individually

To add a server manually, first select the protocol that matches your existing server details. Then enter the Address, Port, and any required authentication, transport, and TLS settings. Shadowsocks, VMess, VLESS, Trojan, Hysteria2, and WireGuard use different parameter formats; changing only the protocol name while keeping fields from another protocol will not work.

After importing with Scan QR Code, review the details too—especially the address, port, and security options. A label helps identify an entry but does not replace its actual server address or authentication details. Save, return to Home, and select the entry you want to use.

How to set it up: Complete one import method first. Avoid creating entries manually and repeatedly updating a subscription at the same time, which can leave confusing duplicates. Use clear labels to distinguish entries by purpose, and check whether the active configuration still refers to an entry before deleting it. If a subscription update fails, check that the URL is complete, the source is reachable over your current network, and its response is in a format the app can read.

Keep in mind: Treat subscription URLs, QR codes, and authentication details as sensitive. Hide them before sharing screenshots. A one-time app purchase is not a service plan: purchasing the app grants the right to use the client, while server details and subscriptions must be supplied by the user. This site does not provide, sell, or recommend servers or subscriptions. For the full first-time import workflow, see Quick Start.

04 / Connection triggers

On Demand connections

On Demand controls when a connection is triggered. It does not replace Global Routing or decide whether a domain should use Direct or a proxy.

What it is and where to find it: On Demand manages connection behavior based on configured network conditions. Find the relevant options in Settings. Its role differs from Config: On Demand controls when a connection starts, while Config controls routing after the connection is running. Knowing the difference helps distinguish a connection that reappears after a network change from a problem with the rules file.

How to set it up: First, connect manually and confirm that the server, DNS, and routing work. Then configure the network conditions actually available under On Demand. Check your Wi-Fi and cellular scenarios separately, and use the network names as they appear on your device. After saving, test by switching networks and checking whether the connection behaves as expected; do not rely on the settings screen alone.

Keep in mind: When enabled, On Demand may trigger a connection again whenever its conditions are met. If you are troubleshooting why a connection will not stay off, check On Demand as well as the connection toggle on Home. To undo a change, disable the relevant On Demand condition and test again. This feature cannot compensate for invalid server details: a trigger firing and a usable connection are separate outcomes.

05 / Usage insights

Data usage statistics

Check the statistics scope and time period first, then use upload and download figures to understand usage.

What it is and where to find it: Data summarizes traffic the app can observe. Open Data and check which item is being measured and which views are available. If the app offers views by server or by app, the server view helps show how traffic is distributed across servers; the app view helps identify traffic generated by apps. Upload and download figures measure data volume—not latency—and do not directly indicate connection quality.

How to use it: Note the statistics scope and readings before testing, make one specific request, then return to see what changed. To investigate a rule, consider Data alongside the current Global Routing mode, selected server, and connection logs. Background activity on the device may also generate traffic, so do not attribute every increase during a test to the page you just opened.

Keep in mind: A single page visit often involves multiple domains and connections, so an increase in a server’s traffic is only a clue; it cannot prove by itself that every request used the same policy. Different views, reporting periods, or resets can make readings from two checks incomparable. Data is not the service provider’s billing record. To explain a discrepancy, first align the reporting period and scope.

06 / Common settings

Settings checklist

The sections below explain settings by purpose; they do not assume every device starts with the same values. Actual options depend on the app and active configuration.

DNS: domain name resolution

What it is and where to find it: DNS resolves domain names to addresses used for connections. Check both the DNS-related options in Settings and any relevant settings in the active Config. Looking at only one may not explain how names are actually resolved.

How to set it up and what to check: First determine whether the problem is a DNS resolution failure or a connection failure. Then check the resolved address, request path, and reachability over the current network. Avoid changing several options at once. Resolved addresses also affect rules that use IP conditions. After making a change, start a fresh request and verify that local network resources are still reachable.

Test Method

What it is and where to find it: Test Method in Settings determines how connection tests are performed. Interpret Connectivity Test results in light of this setting. Different methods test different things, so one type of result cannot establish whether another network function works.

How to set it up and what to check: Note the current method, choose from the options available, and retest on the same network with the same server. If the method tests access to a destination, check that the destination itself is reachable. A successful connection test does not mean every website is accessible; if a test fails, determine whether the cause is the test destination, authentication, transport, or current network.

Today Widget: quick access and controls

What it is and where to find it: Today Widget provides quick information and controls through system widgets. Check the corresponding option in Settings, then open the system’s widget management screen to see whether it has been added. Available widget features depend on the device’s operating system and what the app supports.

How to set it up and what to check: First select a server and establish a working connection from Home, then configure the widget. Widgets are useful for everyday shortcuts, but they cannot replace a full troubleshooting check; displayed status may also lag behind due to refresh intervals. If the status looks wrong, check Global Routing, the selected server, and the system connection status in the app.

iCloud: configuration sync

What it is and where to find it: iCloud options sync supported app data across devices. Check the sync option in Settings and confirm that the app is allowed to use iCloud in system settings. Refer to the app’s on-screen description for what sync includes; do not assume every local setting moves to another device.

How to set it up and what to check: Keep a copy of important configurations, enable the sync options you need, and wait for the other device to finish loading them. Avoid editing the same configuration on both devices at once so you can tell which changes were kept. App purchase eligibility, subscription source updates, and iCloud configuration sync are separate mechanisms. After syncing, check the selected server, active configuration, and system authorization on the device.

Diagnostics

What it is and where to find it: Diagnostics lets you collect and review diagnostic information. Find it in the relevant section of Settings. It can help narrow down a problem, but it does not correct server settings automatically or guarantee that a connection will succeed.

How to use it and what to check: Note the network, Global Routing mode, and steps taken when the problem occurs. Reproduce it once, then review information from around that time. Before sharing diagnostic data, check for subscription URLs, server addresses, or authentication details and redact them as needed. When troubleshooting is complete, restore your usual logging settings to avoid retaining unnecessary detail.

07 / Troubleshooting workflow

A verification sequence from configuration to access

Change one condition at a time so each observation has a clear cause.

Check connection details first. Confirm that the existing subscription was read successfully, or that the manually entered server Address, Port, authentication, and transport settings match the source details. Matching names do not guarantee matching settings.
Then check the routing mode. Use Config for everyday rule-based routing and confirm which configuration is active. If you temporarily switch to Proxy or Direct, note why you are testing and restore the original setting afterward.
Start a fresh request. Close the old page or connection and try again, then review Data and diagnostic information. Do not draw conclusions just because the connection toggle is on or a single test produced a result.
Enable automatic behavior last. Once manual connections are stable, configure On Demand, widgets, and sync. Test the results by switching networks and checking the other device.