Shadowrocket Routing Modes & Settings

Global Routing: Config, Proxy, and Direct

What it does: Global Routing determines how connections handled by Shadowrocket are routed. Config applies the rules in the active configuration; Proxy sends applicable connections through the proxy route; Direct accesses destinations over the current network. These are routing choices, not connection protocols, and they don't indicate whether a server is working.

Where to find it: Open Home and locate Global Routing. Before choosing a mode, check which server is selected and which configuration is active in Config. Importing a configuration does not activate it automatically.

Mode and interface label	Routing basis	When to use it	What to check
Config	Rules in the active configuration	Apply different policies based on domains, IP addresses, and other conditions	Whether the configuration is active, rule order, and final policy
Proxy	The currently selected proxy route	Temporarily test the proxy route to narrow down a routing issue	Server settings, connection status, and reachability of the destination
Direct	Direct access over the current network	Test the local network or temporarily use a direct connection	Local network, DNS, and destination access conditions

How to configure it: If you already have a working rule-based configuration, start with Config. If a destination fails, keep the network, server, and destination the same, then temporarily switch to Proxy for comparison. Test Direct when you need to check whether the local network can reach the destination. After switching modes, retry the connection—and, if needed, toggle the connection off and on—to avoid drawing conclusions from an existing session.

What to watch for: Proxy does not necessarily route all device traffic. System services, local network exclusions, and platform behavior can affect routing. If Proxy works but Config does not, check the rules and policy references first. If both fail, check the server and network. Restore your usual mode after testing; don't leave the app in a temporary test configuration.

Rule-Based Routing: Match Conditions and Policies

What it does: Each rule combines a match condition with a policy. DOMAIN matches a specific domain, DOMAIN-SUFFIX matches a domain suffix, and DOMAIN-KEYWORD matches a keyword in the domain. IP-CIDR and IP-CIDR6 specify IPv4 and IPv6 ranges, respectively; GEOIP matches based on an IP address's geographic location. Whether USER-AGENT can match depends on whether the relevant request information is available, so it should not be treated as a general app identification method.

Where to find it: Open Config and review the active configuration and its rules. In Home, select Config under Global Routing to route traffic according to that configuration. Server lists and rule lists serve different purposes: servers store connection settings, while rules determine which policy each connection uses.

How to configure it: Back up your current configuration first. Put narrowly scoped exceptions before broader rules. The examples below illustrate syntax only: example.com and example.org are documentation domains, not server details. Replace them with values suited to your needs and test the results.

[Rule]
DOMAIN,example.com,PROXY
DOMAIN-SUFFIX,example.org,DIRECT
DOMAIN,ads.example.com,REJECT
IP-CIDR,192.168.0.0/16,DIRECT
FINAL,PROXY

PROXY routes traffic through a proxy, DIRECT connects directly, and REJECT blocks the connection. FINAL is the fallback action when no earlier rule matches, so place it at the end of the rule list. If your configuration uses custom policy names, make sure each one exists and is referenced consistently; a name that isn't defined cannot be used as a route.

What to watch for: Rules are generally checked in order, so a broad match near the top can prevent a more specific rule from being reached. Domain and IP rules match different information, and results can also depend on DNS and caching. After editing, test a specific destination to confirm which rule matches. An incorrectly placed REJECT rule may block resources a page needs. Don't replace an entire configuration to fix a single destination.

Subscribe & Add Server: Manage Subscriptions and Servers

What it does: A server entry stores the address, port, protocol, and authentication details for a connection. A subscription reads a list of server details from an address you already have and can be refreshed later. A successful import only means the content was read; it doesn't guarantee the entries are still valid or that every server can connect on your current network.

Where to find it: Manage servers from Home and add an entry with Add Server. If you already have a subscription, choose Subscribe from the add menu. If you have a QR code, use Scan QR Code. The layout may differ across platforms, so look for the same English labels.

How to configure it: Make sure you already have subscription or server details. Paste subscription URLs exactly as provided, without adding spaces or line breaks. When adding a server manually, check the protocol, address, port, and authentication fields one by one. Shadowsocks, VMess, VLESS, Trojan, HTTP, SOCKS5, WireGuard, and Hysteria2 require different fields; follow the form for the selected protocol and the details you have. Don't change only the protocol name while keeping parameters from another protocol.

After importing, give each entry a recognizable name and run Connectivity Test. Then select the server you want to use in Home. After updating a subscription, check that your selected server is still available. Back up any local changes you want to keep before updating, as subscription updates may replace managed content. A subscription is not the same as a full Config: updating a server list does not necessarily provide all your routing rules.

What to watch for: Subscription URLs may contain access credentials. Don't share them in public screenshots, logs, or chats. If an update fails, check that the URL is complete, the current network can reach it, and the credentials are valid before trying again. There's no need to delete all existing entries first. This site doesn't provide, sell, or recommend servers or subscriptions; it explains how to use information you already have.

On Demand: Connect Automatically Under Defined Conditions

What it does: On Demand lets the system attempt a connection when specified conditions are met. It controls when to connect; Global Routing controls how connections are routed once connected. Enabling On Demand won't fix incorrect server settings or guarantee that every existing session stays active when the network changes.

Where to find it: Open Settings, find On Demand, and review the conditions and exceptions available on your platform. If the current app doesn't show an item with that exact name, follow the settings available in that version rather than substituting system settings from another platform.

How to configure it: First, connect manually and confirm that the server, DNS, and rules work. Then enable On Demand. If network conditions are available, start with one clear scenario—for example, connect under a specified network condition. Save the setting, switch networks, check the system connection status, and test access to a destination. Retest both the trigger and exit conditions every time you add an exception.

What to watch for: If the connection comes back after you turn it off manually, an On Demand condition may have triggered again; the switch may still be working as intended. To stop testing completely, turn off On Demand before disconnecting. On public networks that require a web sign-in, complete the sign-in first, then check the connection. Avoid repeatedly changing protocol settings while the network itself is unavailable.

Data: Check Usage, Not Connectivity

What it does: Data shows statistics for traffic handled by the app, such as uploads, downloads, and changes in usage. It covers only the traffic visible to the app; it is not your carrier bill or the server-side billing record. Refer to the current interface for the statistics period, reset behavior, and available breakdowns.

Where to find it: Open Data and check the statistics range before comparing values. If your platform offers views by connection or time, select the range that matches your test. Don't subtract cumulative totals from different periods and assume the difference represents a single visit.

How to configure it: You can usually leave the statistics as they are; no changes are needed to start using the app. To compare usage, note the time and reading before the test, pause other ongoing downloads, perform one consistent action, and check the change afterward. Before resetting statistics, save any records you need and confirm what the reset will affect.

What to watch for: Background sync, image loading, and connection retries can all use data. An increase alone doesn't prove a page loaded successfully, and no increase doesn't necessarily mean a server is unavailable. Check the routing mode and connection status, and test an actual request. Usage statistics can show changes, but confirming a connection requires tests and, where needed, logs.

Settings: DNS, Test Methods, and Everyday Tools

DNS: Check Name Resolution Alongside Routing

What it does and where to find it: DNS resolves domain names to IP addresses. Review DNS options in Settings, and check whether the active Config also defines DNS settings. Configuration-level settings may affect actual behavior, so don't rely on a single value in the Settings screen.

How to configure it: Note the original value before making changes, and first confirm whether the issue occurs only when accessing domains. If the network works but a specific domain fails, check the DNS address format, whether it's reachable from your current network, and whether the configuration specifies another value. Use a resolution method known to suit your environment. Change one setting at a time, reconnect, and make a new request before comparing results.

What to watch for: Successful DNS resolution doesn't guarantee a connection to the destination. And if a destination works by IP address, that doesn't mean you can replace all domain requests with IPs; certificates and service selection may depend on the domain. DNS isn't a universal fix for connection problems. In particular, don't change DNS, servers, and routing modes all at once and then try to identify the cause.

Test Method: Keep Connectivity Tests Comparable

What it does and where to find it: Test Method selects how connectivity is tested. Find it in Settings, then return to Home to run Connectivity Test. The available methods depend on the options listed in your current app.

How to configure it: When comparing servers you already have, keep the test method, network, and destination the same. If you can set a test destination, first make sure it responds reliably. If a result looks unusual, wait briefly and test again, then compare it with actual access rather than choosing based on a single displayed value.

What to watch for: Different test methods measure different stages, so their results may not be directly comparable. A displayed response time is not download speed and doesn't represent how every app will perform. Changing the test method only changes how the test is run; it doesn't change a server's protocol or authentication settings.

Today Widget: Check the Connection After Using Shortcuts

What it does and where to find it: Today Widget provides a shortcut when supported by the system. Find its settings in Settings, then add it to the relevant area using the system's instructions. Availability and supported actions depend on your platform and operating system.

How to configure it: Choose a server, configuration, and mode in the main app, then confirm a successful connection before adding the shortcut. The first time you use it to switch settings, return to Home and check the selected items and connection status to make sure everything worked as expected.

What to watch for: A shortcut isn't a separate configuration. If its display doesn't update right away, open the main app to check the status instead of tapping repeatedly and triggering multiple changes. Automatic connection conditions may still take effect after a manual action, so consider On Demand as well.

iCloud: Check What Will Sync Before You Start

What it does and where to find it: On supported Apple devices, iCloud options can save or sync data supported by the app within the same account. Find the iCloud option in Settings, and check that your system allows Shadowrocket to use iCloud.

How to configure it: Save a local backup on the source device before enabling sync. Once it finishes, check the configuration names, rules, and server entries on the other device. Confirm the sync scope using the options shown in the app. Connection permissions, network access, and actual connectivity still need to be checked separately on each device.

What to watch for: Don't treat iCloud as an instant, complete, conflict-free backup. Check the sync status before editing the same content on two devices. iCloud also isn't a universal way to migrate configurations across platforms. For cross-platform transfers, check which import formats the destination app supports and protect any credentials in the configuration.

Diagnostics: Find the Stage Where a Connection Fails

What it does: Diagnostics helps inspect and collect connection-related information so you can distinguish issues with configuration loading, DNS resolution, server connections, and destination responses. Logs help with troubleshooting; they don't fix issues automatically. Interpret each error in context, including when it occurred and what action triggered it.

Where to find it: Open Settings and look for Diagnostics and the available log tools. Before capturing logs, note the current server, Global Routing mode, and configuration name so the logs match the conditions you're describing.

How to configure it: Start with a repeatable issue, such as one domain that won't open. Note the test time, enable the diagnostics you need, and reproduce the issue once. Check the DNS result, connection errors, and matched policy around that time. If only Config mode fails, focus on the rules instead of immediately replacing all your servers.

What to watch for: Logs may contain domain names, IP addresses, subscription credentials, or server details. Review them before exporting, and remove sensitive fields and unnecessary details before sharing excerpts. Turn off detailed logging when you're done; leaving it enabled can increase storage and processing overhead. For a complete symptom-based workflow, see the troubleshooting guide.

Recommended Checks After Setup

Features depend on one another: start with a working network and complete server details, then check routing modes and rules, and finally configure automatic connections and shortcuts. Verify each step in the order below to keep cause and effect clear and make it easier to roll back changes that don't work.

Check the network first. Make sure you've signed in to the network and that it works. If the network itself is unavailable, stop and resolve that before changing app settings.
Check the server. Verify the details you already have, run Connectivity Test, select the server, and try an actual request. Compare the test result with real-world access.
Check Global Routing. Test the same destination with Config, Proxy, and Direct. Note which modes fail, then restore your usual mode.
Check rules and DNS. Confirm the active configuration, rule order, and final policy. Change one setting at a time, then make a new request before checking the result.
Check automatic features. Once a manual connection is stable, enable On Demand, then test shortcuts such as Today Widget. After syncing, check the status on each device.
Keep a way to roll back. Save a working configuration and a record of changes. If something goes wrong, undo the last change first, then use Diagnostics to collect information from the relevant time.

To set up a connection from scratch, read the setup guide. For explanations of protocols and rule keywords, see the glossary. This page covers features and settings; find app availability and platform requirements on the download page.