Check where a term appears before deciding whether it refers to an interface control, a protocol parameter, or a rule policy. English interface terms remain unchanged; the explanations clarify their purpose and scope.
The same word can mean different things in different places. In particular, distinguish Config / Proxy / Direct in Global Routing from the uppercase policy keywords used in rules.
Home is the main place to view server entries, select a connection, and control the connection toggle. An added entry appearing in the list only means its parameters were saved; it does not confirm that the server is reachable. Before first use, check the server information you already have, select an entry, and complete any required system authorization.
Global Routing determines the overall routing mode. Its common options are Config, Proxy, and Direct, referring to configuration-based, proxy, and direct routing. Config handles requests according to the current configuration; Proxy uses proxy routing; Direct connects directly. Before troubleshooting a rule, check this setting to avoid repeatedly changing rules in the wrong mode.
Config can refer either to the section for managing configuration files or to the configuration-based routing mode in Global Routing. As a section, it lets you view and select configurations; as a routing mode, it handles requests according to the current configuration's rules. Opening the Config screen does not confirm that a particular configuration is selected; check which file is currently in use.
Proxy is the proxy routing mode in Global Routing. It is related to PROXY in a rule, but they are not the same setting and Proxy does not specify the server protocol. After switching to Proxy, check the selected connection and its authentication parameters. Changing modes cannot fix incorrect server details.
Direct is the direct routing mode in Global Routing. It accesses destinations through the current network rather than through the selected proxy server. Selecting Direct does not remove server entries or clear configuration files. For a comparison test, keep the destination and other conditions the same, then restore the previous routing mode when you're done.
On Demand triggers connection behavior based on configured network conditions; it is not simply a speed optimization. Its behavior depends on the conditions set in the app, the system VPN configuration, and the current network. If the connection starts again after being turned off manually, check the On Demand conditions first, then look for duplicate or leftover system configurations.
Data shows traffic and request information recorded by the app. It can help determine whether a request passed through the client and which handling path it took. The figures depend on logging settings and the reporting period, and may not use the same billing criteria as a service provider. When comparing traffic, check the start and end times before treating the figures as equivalent.
Settings brings the app's settings together; available options depend on what the current app version displays. Unlike server entries, some settings here may affect overall behavior rather than a single connection. When troubleshooting, change one relevant setting at a time and note its original value so you can make a controlled comparison.
Connectivity Test checks a connection response using the selected test method and is useful for an initial reachability check. A successful test does not mean every website, app request, or persistent connection will work; the test destination may differ from the actual service. If a test fails, distinguish a timeout, an unreachable destination, and incorrect parameters, then compare the result with actual access.
A protocol name determines how to interpret its parameters; it is not a ranking of speed or reliability. The descriptions below assume you already have your own server details. Enter values according to the server's requirements.
Shadowsocks is a proxy protocol. Common parameters include the server address, port, encryption method, and password. The encryption method and password must match the server; an address and port alone are not enough to establish a working connection. If your existing details specify additional transport parameters, check each one rather than reusing fields from another protocol.
VMess is an authenticated proxy protocol. The ID and transport method are both part of the connection configuration. After importing an entry, check the address, port, ID, and any TLS, path, server name, or other fields specified in your existing details. A QR code being readable only means its format could be parsed; it does not confirm that the fields match the server.
VLESS is a proxy protocol. The ID and transport security settings are separate parameters. Selecting VLESS and entering an ID does not replace the transport method and security settings required by the server. If the connection fails, check each field against the details you already have, paying particular attention to similarly named fields.
Trojan is commonly used with TLS. Check the password, server name, and certificate verification separately. The connection address may be an IP address, while the server name used for TLS verification may be a domain; they serve different purposes. If you encounter a certificate error, check the time, name, and server configuration first. Disabling certificate verification should not be treated as a routine fix.
Hysteria2 is a QUIC-based proxy protocol that relies on the current network supporting the relevant UDP traffic. Check the authentication details, TLS parameters, and any other fields required by the server information you have. A webpage working over a direct connection does not prove that this protocol's transport path is available. Troubleshoot network reachability separately from authentication errors.
WireGuard is a key-pair-based tunneling protocol. Its configuration includes a local key, peer public key, interface address, peer endpoint, and routing scope. Public and private keys serve different purposes; keep the private key secure. When troubleshooting, check both endpoint reachability and whether the address and allowed routing scope match the peer configuration.
HTTP and SOCKS5 are different proxy protocol types; using the same server address does not make them interchangeable. They handle requests and destination addresses differently, and their authentication and transport security settings must also be checked separately. When using existing proxy details, confirm the type before entering the port and authentication fields. Do not infer the protocol from a commonly used port alone.
Rules answer, “What condition does this request meet?” Policies answer, “What happens when it matches?” The examples below illustrate syntax only. example.com is a sample domain, not a real connection service.
A rule usually consists of a match type, match value, and policy, for example DOMAIN-SUFFIX,example.com,DIRECT. In common first-match configurations, requests are checked in order, and an earlier match affects subsequent handling. If Global Routing is not set to Config, changes to rules may not behave as expected. Check the routing mode first.
DOMAIN matches an exact domain; DOMAIN-SUFFIX matches the specified domain and its subdomains. For example, setting the latter to example.com can match api.example.com. Both match domain names, not complete URLs, so do not include paths, query parameters, or a protocol prefix in a domain condition.
DOMAIN-KEYWORD matches a keyword appearing in a domain name and is useful when you need to cover a group of related names. A short keyword may also match unrelated domains. Before applying a reject policy, check actual request records. If you only need to match one specific domain, use a more precise condition.
IP-CIDR matches IPv4 ranges, while IP-CIDR6 matches IPv6 ranges. The number after the slash is the network prefix length. For example, IP-CIDR,192.168.0.0/16,DIRECT describes a private IPv4 address range. Whether domain requests are resolved and included in address matching also depends on configuration options; an IP range rule is not a domain suffix rule.
GEOIP matches destination addresses using an IP geolocation database; it does not use webpage language or the user's location. Geolocation results may change with database contents and network deployment, and do not directly indicate where a website operator is based. If a domain resolves to different addresses, matching may also change. Check the current resolution results.
FINAL handles requests that match none of the preceding rules and is usually placed at the end of the rule list. FINAL,PROXY sends those remaining requests to the PROXY policy; it does not prove that every request uses a proxy. When checking the fallback policy, also look for an earlier rule with an overly broad match.
PROXY, DIRECT, and REJECT are uppercase rule policy keywords for proxying, direct connections, and rejecting requests. The connection used by PROXY depends on the current configuration and selection. REJECT blocks matching requests; an overly broad condition may affect sign-ins, images, or app APIs. It is not the same as comprehensively filtering a category of content.
DNS resolves domain names to addresses and is an important step before accessing a destination. DNS resolution and request routing are related, but use different settings. A domain resolving successfully does not guarantee that the subsequent connection will work. When troubleshooting, distinguish a resolution failure from an unexpected address or a connection failure, then check the configured DNS server and rule behavior.
URL Rewrite rewrites URLs or handles requests according to configured match conditions. Unlike routing rules that match a domain and select a policy, its effect on a request depends on the request type, visible information, and configuration conditions. Before enabling it, understand the match scope and keep a copy of the original configuration. It does not guarantee that every page or app will behave differently.
The steps below assume you already have your own subscription or server details. First identify whether you are importing a single connection entry, a server list, or a configuration file, then choose the appropriate section.
Subscribe is an interface term for adding and updating subscriptions. A subscription URL fetches content provided by a service provider and may contain access credentials, so avoid sharing it in public screenshots or chat logs. After adding it, check that the expected entries were parsed. Saving the URL does not confirm that the server list was retrieved successfully.
SERVER refers to a server entry; Add Server is where you add connection parameters. An entry typically includes a type, address, port, and the authentication and transport settings required by that protocol. A remark is only a label for identification; it cannot replace the actual parameters. After saving, select the entry and test the connection.
Scan QR Code reads connection information encoded in a QR code; the code is only a data carrier. Check its source before scanning, then verify the protocol, address, and required parameters instead of relying on the entry name alone. If the QR code contains subscription credentials or authentication details, treat them as sensitive information.
A configuration file organizes rules, DNS, policies, and other supported settings. It serves a different purpose from an individual server entry: a server list shows which connections are available, while a configuration can specify how requests are routed. After importing a file, confirm that it is selected, and keep a copy before making changes so you can compare it with the original behavior.
A subscription update requests the subscription URL again and parses the returned content. If the provider changes the list, updating is generally how to retrieve those changes. A successful request, parseable content, and actual changes to the entries are three separate checks. If the list is empty afterward, check the URL, the provider's service status, and the returned content. Repeatedly adding the same URL is not a substitute for troubleshooting.
Latency is the response time measured by a particular test method; the target and method affect the result. Lower latency does not necessarily mean higher throughput or a stable long-running connection. For a useful comparison, keep the test target, network, and timing as consistent as possible, and also test access to the actual services you use.
iCloud sync covers app-supported data across devices; check the options and scope shown in the app. Data syncing and App Store purchase restoration are separate processes: the former handles content, while the latter handles eligibility to get the app. Before switching devices, check the sync setting and confirm that the data has synced. Keep important configurations safe rather than assuming everything has synced because you're signed in.
Shadowrocket is available only on Apple platforms, primarily iPhone and iPad. Check the App Store listing for compatibility, system requirements, and purchase eligibility on Mac, Apple TV, and Apple Vision.
The App Store is the only place to get Shadowrocket. Check the product page for its price, compatibility, and update history. Verify an authentic listing by checking all three: developer Shadow Launch Technology Limited, the official app icon, and app ID 932747118. Do not rely on a similar name or search result ranking alone.
The Apple Account used for Media & Purchases determines the store purchase identity and may differ from the account used for iCloud. The App Store country or region affects app availability, local currency, and payment options; it is not determined solely by the device language. If you cannot find the app or restore a purchase, first check the current store account and region, then confirm which account was used for the purchase.
Purchased items lets you find and redownload apps you bought previously; the name and location of this section may vary by system version. When changing or restoring a device, first make sure you're signed in with the Apple Account used for the App Store purchase, then look for Shadowrocket. Redownloading the app does not restore server, subscription, or configuration data; check your app data and backups separately.
One-time purchase describes how the app is paid for. Shadowrocket is a closed-source commercial app. The US store price is approximately $2.99; prices are shown in local currency in other storefronts, and the actual amount is shown on the App Store page. A one-time app purchase does not include a service plan or the subscription or authentication details needed to connect to a server.
Family Sharing is Apple's family purchase-sharing feature; it does not automatically sync in-app settings or subscriptions. Check the App Store listing for Shadowrocket's purchase eligibility and sharing conditions. If a family member cannot find the app, check their store account, Family Sharing purchase settings, and the app listing. Being part of a family group alone does not guarantee eligibility.