Official Manual / Glossary

Shadowrocket Glossary

Look up terms by screen or configuration purpose. App labels stay in their original English; explanations clarify their meaning, scope, and common points of confusion.

Interface Terms Protocol Settings Rule Syntax Setting Definitions

This is the official Shadowrocket website and manual. This page explains terminology; it does not replace step-by-step instructions. For your first setup, start with the tutorial; for a setting-by-setting reference, see Settings Reference. A term can appear in different places: Config is both the entry point for configuration files and a mode under Global Routing.

Interface

Interface & Controls

First distinguish the navigation entry, overall routing mode, and automatic connection conditions; then check the server or rules.

Home: The main screen for viewing and selecting servers and toggling the connection. A listed entry only means its details have been saved; it does not confirm authentication or access to a destination. When troubleshooting, check the selected entry, connection status, and Global Routing mode separately.

Global Routing: The mode selector determines how traffic is handled overall: Config, Proxy, or Direct. Changing the mode affects how connections are handled, so an enabled connection toggle alone does not tell you where traffic is going. These modes are distinct from the PROXY and DIRECT policies used by individual rules.

Config: In Global Routing, Config mode handles traffic according to the rules in the current configuration file. As a screen name, Config opens configuration file management. For domain-based routing, select this mode and confirm which file is active and what rules it contains.

Proxy: Proxy mode in Global Routing sends most traffic through the proxy path; it does not mean routing individual domains by rule. Selecting this mode cannot make an incorrect address or authentication setting work. Check that the selected server is available and test the specific destination.

Direct: Direct mode in Global Routing connects most traffic directly to its destination. It can help you compare access over the current network, but it does not verify the behavior of every app or system connection. DIRECT in an individual rule only determines how traffic matching that rule is handled.

On Demand: A mechanism that starts a VPN connection when saved conditions are met. Its behavior depends on the conditions, system state, and settings. It controls when a connection is attempted; it does not fix an incorrect address, password, or DNS setting. If the connection starts again after you disconnect manually, check the trigger conditions here.

Add Server: The screen for entering server details manually. Compare the type, address, port, and authentication fields with the information you already have, then check additional transport and TLS settings. Required fields depend on the protocol; do not assume the same settings work for every type.

Protocols

Protocol names identify the connection method, not its quality. Use the server details you already have to configure the connection.

Shadowsocks: A proxy protocol whose connection settings typically include a server address, port, encryption method, and password. The encryption method must match the server; a matching password is not enough. Enter any additional options exactly as specified in the server details instead of guessing.

VMess: A proxy protocol that authenticates using an identity and other parameters. Along with the address and port, check the transport method and any TLS options required by the server. Successful import only means the details could be read; it does not confirm that all connection settings have been validated.

VLESS: A proxy protocol that typically requires checking the identity, transport method, and security settings. Similar names do not make protocols interchangeable. When editing an existing entry, compare all fields with the original details instead of changing only Type and keeping every old value.

Trojan: A proxy protocol commonly used with TLS. Typical settings include the address, port, and password; make sure the TLS name also matches the server requirements. If certificate validation fails, check the settings and device time before considering any change to validation requirements.

Hysteria2: A QUIC-based proxy protocol whose connection behavior depends in part on how the current network handles UDP. Check authentication, TLS, and optional obfuscation against the server details. The protocol name does not guarantee higher speed; results depend on the network and server.

WireGuard: A key-based tunneling protocol configured with a local address, keys, a peer, and routing ranges. Unlike a setup that uses a single server password, its related fields need to be checked together. A private key is sensitive and should not appear in public screenshots or troubleshooting materials.

HTTP / SOCKS5: Two different proxy protocols that are not interchangeable just because their addresses and ports match. The server may require a username, password, or specific TLS settings; follow the information provided. These terms describe proxy connection methods, not the URL scheme in a browser's address bar.

Matching & policies

Rule Keywords

Check the match condition first, then the action. In Config mode, review the rule order in the active configuration file.

Rule: A configuration entry made up of a match condition and an action that determines how specific connections are handled. Routing rules are commonly evaluated in order, so a broad condition near the top can affect more specific entries below it. When troubleshooting, check the rule itself, its position, and the final fallback policy.

DOMAIN: A rule keyword that matches an exact domain, such as applying an action only to example.com. It does not automatically include every subdomain. To cover addresses such as www.example.com, add an explicit rule or consider DOMAIN-SUFFIX.

DOMAIN-SUFFIX: Matches a domain suffix, typically covering the specified domain and its subdomains. Enter a domain without a webpage path or query parameters. Because this covers more than a single exact domain, check that the same policy is appropriate for all relevant subdomains.

DOMAIN-KEYWORD: Matches based on whether a domain contains a specified keyword. It does not check whether the webpage body contains that word, and the match may cover more domains than expected. For a specific site, first check whether DOMAIN or DOMAIN-SUFFIX is a better fit.

GEOIP: Matches based on IP geolocation database results, not webpage language. Results depend on the destination IP, database contents, and DNS resolution. A site using distributed services may resolve to different IPs, so its name alone does not show whether a GEOIP condition will match.

IP-CIDR / IP-CIDR6: Used to match IPv4 and IPv6 address ranges. The CIDR prefix after the address determines the range; changing it affects how many addresses are covered, not just how the rule is written. When troubleshooting domain access, check the actual DNS results and do not overlook IPv6.

FINAL: The final action used when no earlier rule matches, usually placed at the end of the rules. It is not a condition for a specific domain; it provides a fallback policy for other connections. If many destinations without their own rules are handled unexpectedly, check the value of FINAL.

PROXY / DIRECT / REJECT: Common rule policies for routing traffic through a proxy, connecting directly, or rejecting a connection. These uppercase rule keywords are distinct from the Proxy and Direct interface modes. The actual route used by PROXY also depends on the proxy selection or policy group in the configuration.

How to read the rule snippet

The example below sends example.com and its subdomains through PROXY; FINAL sends all other connections through DIRECT. This illustrates syntax only and is not a complete configuration file. Actual behavior also depends on the current mode, other rules, and proxy settings.

DOMAIN-SUFFIX,example.com,PROXY
FINAL,DIRECT

Subscription & configuration

Subscriptions & Configuration

Server details determine where to connect; the configuration file determines how traffic is handled. Check them separately.

Server: A connection entry that stores settings such as protocol, address, port, and authentication; often called a node. Its name is only a label and does not prove its location, reachability, or speed. If the connection fails, check the fields and server status rather than relying on the displayed name.

Configuration File: A file that stores behavior settings such as rules and DNS, unlike a server subscription. Importing a file does not make it the active file; check the selection in Config. Keep the original file before switching so you can compare them if something changes unexpectedly.

Scan QR Code: The entry point for scanning a QR code containing connection details you already have. A QR code is just a way to encode those details. After scanning, check the protocol type and confirm that all required fields are present before connecting. Treat QR codes containing passwords or other credentials as sensitive information; do not share them publicly.

Settings & diagnostics

Settings

These terms help explain settings and test results; they do not mean every item needs to be changed.

DNS: The process of resolving a domain name to an IP address as part of a connection. Successful DNS resolution and a successful connection to the proxy server are separate things; changing DNS does not change the traffic route. When troubleshooting, check whether the domain resolves, which addresses it returns, and whether the connection then succeeds.

Connectivity Test: A test for checking whether a connection is reachable under current conditions. A successful test only shows that the path tested responded; it does not confirm that every site, protocol, or routing rule works. Consider the actual destination, current mode, and logs to identify the issue.

Ping: A test-related term for measuring response time for the selected method and target; it does not necessarily mean an ICMP test. Values from different methods, targets, and network conditions are not directly comparable. Lower latency does not mean higher throughput, and a timeout should be evaluated in light of the test method.

Log: Information about connection, DNS resolution, and rule processing that can help with troubleshooting. Visible fields depend on the log type and level. Check the time the issue occurred and distinguish authentication failures from resolution failures and connection timeouts. Before sharing logs, check for addresses, subscription credentials, or browsing activity.

iCloud Sync: Syncs app-supported data across eligible devices through iCloud; the scope depends on the settings. Syncing is not a standalone backup and does not determine App Store purchase records. When changing devices, check the purchasing account, sync status, and current configuration separately.