Shadowrocket Proxy Modes and Common Settings

What it does: The three modes correspond to Config, Proxy, and Direct in the interface. Config routes traffic according to the active configuration’s rules. Proxy sends intercepted requests through the proxy path, while Direct provides a direct-connection comparison. For everyday use, start with Config, then check the rule for the specific request.

Where to find it and how to set it: In Home, find Global Routing, choose a mode, then return to Home to check the selected server and connection toggle. Before choosing Config, open Config and make sure the required file is enabled. Importing a file without enabling it does not mean its rules are active.

What to watch for: “All” refers to traffic actually intercepted by the client; it does not guarantee that every system activity on the device is handled this way. Direct does not turn off the connection toggle; the client may still process and log requests. Restore the original mode after testing so a temporary change does not affect later checks. If Proxy works but Config does not, check the matching rule and its policy before rebuilding all server entries.

What they are: A rule consists of a match type, match value, and policy. DOMAIN matches an exact domain, DOMAIN-SUFFIX matches a domain suffix and its subdomains, and DOMAIN-KEYWORD matches a keyword in the domain. Suffix rules are generally easier to review than broad keyword rules. Enter only the domain, without a protocol prefix or webpage path.

IP-CIDR and IP-CIDR6 match IPv4 and IPv6 networks, respectively. GEOIP matches based on an IP address’s regional database entry; results depend on the database and resolution. USER-AGENT relies on a corresponding field being available in the request. Not every connection provides one, so it is not a general-purpose way to identify apps.

Where to find rules and how to edit them: Open Config and view the active configuration’s rules and their order. Rules are generally evaluated from top to bottom, and the first match determines the policy. Put specific exceptions before broader rules, and place the final fallback at the end. Keep a copy of the original file before editing. Change one type of condition at a time, then save and confirm that the edited configuration is still active.

DOMAIN,example.com,PROXY
DOMAIN-SUFFIX,example.org,DIRECT
DOMAIN-KEYWORD,ads,REJECT
IP-CIDR,192.168.0.0/16,DIRECT
FINAL,DIRECT

What to watch for: PROXY sends traffic to a proxy policy, DIRECT connects directly, and REJECT blocks the request. A configuration may also refer to custom policy group names; make sure each one exists. FINAL is the fallback when no earlier rule matches; it does not “test all rules again.” Broad keyword matches can affect unrelated destinations. If something behaves unexpectedly, check which rule matched the request rather than just looking for the destination name in the rule text.

What they are: A server entry contains the protocol, address, port, and authentication details needed for a connection. Subscribe updates a group of servers from a subscription URL you already have. Config manages rules and other configuration content. Successfully importing a subscription does not mean a configuration is selected, and enabling a configuration does not guarantee that every server it references exists.

Where to find these options and how to use them: From Home, open the add menu and choose Add Server. To import a subscription you already have, choose Subscribe, paste the full URL provided by your service provider, enter a name you can recognize, and save. When the update finishes, return to Home and check that the group appears, then select a server. If you already have the details for a single server, choose the matching Type and enter each value as provided. When using Scan QR Code, check the detected type and address before saving.

Fields vary across protocols such as Shadowsocks, VMess, VLESS, Trojan, HTTP, SOCKS5, WireGuard, and Hysteria2. Use the Type shown on your platform and the server details you already have; the same server address does not mean you can switch protocols. Keep the original values for TLS, SNI, transport paths, and other optional fields rather than guessing based on their names.

What to watch for: A subscription is a way to update entries, not proof that a connection works. If an update fails, check whether the URL is reachable, authentication is still valid, or the returned content can be parsed. If the update succeeds but the connection fails, check the selected entry and its settings. Updates may overwrite manual changes to entries in the group, so record or save any changes you want to keep. Subscription URLs, QR codes, and exported files may contain authentication details; redact sensitive information before sharing them.

What it does: On Demand triggers connection behavior based on network conditions. It controls when to connect; Global Routing controls how traffic is routed after connecting. Enabling On Demand does not add servers or configurations for you, nor does it verify an existing connection.

Where to find it and how to set it up: In Settings, find On Demand and review the available conditions before setting options for Wi-Fi, mobile data, or a specific network. For the first setup, add just one condition and note the expected behavior. For example, check that a Wi-Fi condition triggers as expected before adding conditions for other networks. This makes it easier to troubleshoot than changing several conditions at once.

After saving, switch networks and check that the system connection status matches the status in Shadowrocket. First make sure a manual connection works. If manual connection already fails, adding automatic triggers will only make the problem harder to isolate. Background behavior and available conditions vary by platform; use the options shown on your device.

What to watch for: After a manual disconnect, the system may reconnect if the trigger conditions are still met. That does not mean the toggle is broken. To pause connections, turn off On Demand temporarily before disconnecting. If public Wi-Fi requires a sign-in, complete that first and then test automatic connection. Avoid changing routing mode, DNS, and trigger conditions at the same time.

What it shows: Data displays traffic figures recorded by the client, including upload, download, and totals over time. If your platform offers views by server or app, you can use them to check server usage and traffic sources. App categories depend on system capabilities and do not show that every activity on the device has been identified.

Where to find it and how to read it: Open Data and check the current view, reporting range, and units before reading the figures. Upload is data sent from the device; download is data received. Instantaneous speed and cumulative traffic are different measurements and should not be compared directly. To test a rule, note the current figures, make one request to the destination, then check whether the relevant entry increased and confirm the policy in the request logs.

To start a new observation period, note any figures you need before using the reset option, and confirm what will be reset and over what range. Do not assume statistics start from the day of installation or reset every time you connect; check the current interface and reset behavior. Usage limits and validity periods shown in a subscription come from the subscription response and are separate from Data’s local statistics.

What to watch for: Data, system settings, and service provider figures may differ because of protocol overhead, retries, reporting methods, and observation periods. Increased traffic only shows that data was transferred; it does not prove that a particular domain rule matched. A cached page may load normally while adding almost no traffic. See the guide to reading Data traffic statistics for more detail.

DNS: check the resolution path first

What it is and where to find it: DNS translates domain names into IP addresses. Check the DNS settings in Settings alongside DNS content in Config; neither alone tells you the full resolution path. Domain rules, IP rules, and differing DNS results can also affect one another.

How to configure it: If the connection works, keep the current resolution method as a baseline. If domains fail to resolve or return unexpected addresses, note the domain, network, and error, then check whether the DNS address is reachable. For DNS over HTTPS, enter a complete, valid resolver endpoint. Reaching that endpoint also depends on the network and configuration, so adding it does not guarantee an improvement.

What to watch for: Successful DNS resolution does not mean the destination service is available. After changing DNS, existing connections and cached results may delay the effect; verify the change with a new test request. See the DNS settings guide for an overview of resolution methods.

Test Method: keep test conditions consistent

What it is and where to find it: Test Method is in the testing options in Settings and determines which method Connectivity Test uses. Different methods check different levels of connectivity, so results in the list are not necessarily a measure of actual webpage load speed.

How to set it: Choose from the options available in the current interface. To compare results, use the same method, destination, and network. Choose a destination known to be reachable and reasonably consistent in its responses. Test one known-good entry first, then compare others, so an issue with the test destination does not lead to a false conclusion.

What to watch for: No response from a particular test method does not necessarily mean requests cannot connect. A response does not prove that every protocol and destination works. Confirm with an actual connection and request logs; do not switch servers repeatedly based on a single test.

Today Widget: quick status and shortcuts

What it is and where to find it: Today Widget provides a system widget and status display on supported devices; related options are available in Settings. Where widgets can be added, how they appear, and when they refresh depend on the system version. Check which widget features your device supports.

How to set it up and what to watch for: First verify the connection in the app, then add the widget from the system’s widget editor. If you need to control the connection, check whether the system requires you to unlock the device or return to the app. Widgets may refresh with a delay. If the display differs from the app, check Home and the system connection status instead of treating an old reading as current.

iCloud sync: check what syncs before resolving conflicts

What it is and where to find it: On Apple devices that support iCloud sync, check the relevant options in Settings. Sync is not the same as a device backup, and it does not mean every runtime state, log, and statistic is copied between devices.

How to set it up: Confirm that each device uses the intended iCloud account and that the system allows the app to use the relevant service. Then check the sync scope listed in the client. Before syncing multiple devices for the first time, keep recoverable copies of important configurations on each device. Make a small change on one device, wait for it to appear on the other, then continue editing.

What to watch for: Do not edit the same content on multiple devices at once or repeatedly toggle sync before it finishes. Exported files may contain server authentication details and should be stored as sensitive files. Do not assume that another platform behaves the same way just because it has an option with the same name. See Settings reference for more options.