OFFICIAL MANUAL / GLOSSARY
Identify which layer a term belongs to before changing a setting: interface controls are for actions, protocols describe how connections work, rules match destinations, and policies determine how connections are handled. This page keeps the original English terms and explains their meanings without renaming items in the app.
01 / INTERFACE
The same English term may appear in different places. Check whether it is a page title, a mode option, or a button before interpreting it. The exact location may vary by app version.
Home is the main screen for viewing and selecting servers and controlling the connection toggle. Selecting a server chooses an available proxy route; it does not establish a connection or mean all traffic will use that server. Check the connection status and Global Routing mode to see how traffic is actually handled.
Global Routing controls the overall routing mode: Config, Proxy, and Direct. Config applies the rules in the current configuration; Proxy sends connections controlled by that mode through a proxy; Direct connects them to their destinations directly. When checking whether a rule is working, first make sure the app is not in another mode used for temporary testing.
On Demand uses network conditions to decide when to start or maintain a connection. It controls when to connect, not which action to use for a particular domain. Its behavior also depends on system permissions, network changes, and the conditions currently set. If the connection starts again after you disconnect manually, check these conditions before removing a server.
Add Server is where you enter details for a server you already have. Fill in the address, port, and authentication parameters for the actual protocol. Fields vary by protocol; a password, UUID, and other identifiers are not interchangeable. After saving, select the entry and test its connectivity. A successful save does not confirm that the remote parameters are valid.
Connectivity Test checks whether a server is reachable under the current network and test conditions. The latency shown is a single test result: the target, test method, and network fluctuations all affect it, so it does not indicate sustained download speed. If the test succeeds but an app fails, check the app's destination, DNS, and matching policy.
Settings brings together DNS, test methods, and other client behavior. Available options depend on the current interface. Before making changes, note the original values, adjust one relevant setting at a time, and test the same target again. For an explanation of individual options, see the Settings reference.
Data shows traffic statistics recorded by the client. Distinguish upload, download, and the reporting period; views by server and by app measure different things, so their values are not directly interchangeable. These figures are not billing records from a remote service. To check routing, compare connection records and changes over the same time period.
02 / PROTOCOLS
Protocols define how the client authenticates with a server and transfers data. Use the parameters you already have: similar protocol names do not make their fields interchangeable, and the name alone does not indicate connection speed.
Shadowsocks connects to a server using a specified encryption method and credentials. Common required parameters include the server address, port, password, and encryption method. The method selected in the client must match the server's; checking only the password is not enough. If your details include additional transport parameters, enter each one in the corresponding field. Do not assume an entry with missing fields is a complete configuration.
VMess authenticates using parameters such as a user ID and can use different transport methods. The UUID, transport type, path, and TLS-related fields each serve a purpose; do not import only the address and port and guess the rest. Authentication or time-related issues can also cause failures, so first check that the device clock is accurate.
VLESS handles authentication separately from underlying transport security. Selecting VLESS alone does not mean transport encryption is fully configured. Check the UUID, transport method, and any TLS or other security parameters required by the configuration you have. VLESS and VMess are different protocols; switching between them does not make all fields interchangeable.
Trojan typically uses TLS and authenticates with a password. The server address, port, password, server name, and certificate verification all affect the result; a correct password does not guarantee the other fields are correct. If certificate verification fails, check the server name and device clock first. Disabling verification is not a standard fix.
Hysteria2 is based on QUIC and requires a working UDP path. Its authentication details and TLS parameters must also match the server. Performance varies with packet loss, bandwidth, and network restrictions, so it cannot be assumed to be faster than other protocols. If the connection fails, distinguish incorrect parameters from UDP restrictions on the current network.
WireGuard creates an encrypted tunnel using public and private keys and peer parameters. Common settings include the local address, peer public key, endpoint, and allowed IP ranges. A private key is sensitive and must not appear in public screenshots or troubleshooting records. After the tunnel connects, check routing and DNS too: a successful handshake does not mean every destination is reachable.
HTTP and SOCKS5 are two distinct proxy protocols, not alternate spellings of the same option. Whether a username and password are required depends on the server settings you have. The protocol name alone does not guarantee encryption between the client and proxy or UDP support. Select the actual protocol and check authentication, transport security, and supported traffic separately.
03 / RULES & POLICIES
Rules are generally evaluated from top to bottom, and the first matching rule determines the action. Read match conditions separately from actions. If several rules could apply to a destination, check their order rather than simply confirming that a domain appears somewhere in the list.
DOMAIN matches an exact domain name, making it suitable for a single specific hostname. For example, DOMAIN,example.com,DIRECT applies to example.com; it does not automatically include all its subdomains. If the destination is api.example.com, check the exact hostname or use an appropriate match type.
DOMAIN-SUFFIX matches a specified domain and its subdomains, making it useful for applying one policy across a domain hierarchy. DOMAIN-SUFFIX,example.com,PROXY can match example.com and api.example.com, but not every domain that happens to contain that string. It matches domain hierarchy, not paths in a web address.
DOMAIN-KEYWORD checks whether a domain contains a specified string, usually matching more broadly than an exact-domain or suffix rule. For example, the keyword ads may match multiple domains containing that sequence. Check the risk of false matches before using it to block connections; domains containing the same string do not necessarily belong to the same service.
IP-CIDR matches IPv4 address ranges; IP-CIDR6 is for IPv6. The prefix length after the slash determines the range. For example, IP-CIDR,192.168.0.0/16,DIRECT applies DIRECT to that IPv4 range. Domain traffic may involve DNS resolution, so interpret address-based matches in light of the DNS results too.
GEOIP uses an IP geolocation database to determine a destination's region. It does not classify traffic by a website's display language, domain suffix, or provider's registered location. Database classifications can differ, and services may use distributed IP addresses. If a rule matches unexpectedly, check the destination IP and consider using a more specific domain or address rule.
FINAL determines what happens when none of the earlier rules match and is usually placed at the end of the ruleset. FINAL,DIRECT sends the remaining connections to DIRECT; it does not force all connections to go direct. Changing this rule affects traffic not covered by earlier rules. When testing, first check whether an earlier rule already matches the destination.
PROXY is a rule action that sends matching connections through the corresponding proxy route. A working server with valid parameters is still required. It is related to Proxy mode in Global Routing, but is a setting at a different level. Adding a PROXY rule does not create a server or fill in its authentication details.
DIRECT connects matching traffic to its destination over the current network without using a proxy route for that connection. The result still depends on the local network, DNS, and destination service; direct access is not guaranteed to work. DIRECT in a rule applies only to matches, while Direct in Global Routing is an overall mode.
REJECT blocks matching connections and is usually used with specific domain or address conditions. If a page resource fails to load, check whether an overly broad rule matched it before assuming the server is down. Identify the destination and matching rule before making changes; narrowing the match is easier to review than deleting rules wholesale.
04 / SUBSCRIPTION & CONFIG
A server entry provides connection parameters, a subscription maintains entries in bulk, and a configuration file defines rules and related settings. Each serves a different purpose; importing one does not mean the others are ready too.
Subscribe imports and updates server entries in bulk using a subscription URL you already have. Get the URL from your own service provider. An update may add, change, or remove entries; it does not automatically change Global Routing. Subscription URLs may contain access credentials, so obscure the full URL and any sensitive parameters in screenshots and troubleshooting details.
SERVER refers to a server entry used to connect, usually containing a protocol, address, port, and authentication parameters. A name shown in the list only confirms that the entry exists, not that it is currently available. Names help identify entries; the parameters and remote server status determine how the connection works.
Config can refer to the configuration file management screen or to the Config mode in Global Routing; use its context to determine which. Configuration files can organize rules, DNS, and other settings, unlike subscriptions that provide only a server list. After importing a file, check which configuration is active so you do not edit one that is not in use.
Scan QR Code imports server or subscription information from a QR code; it is an import method, not a proxy protocol. Check the recognized type and parameters before saving, as a QR code may contain sensitive credentials. If the image is blurry or its format is incompatible, ask the person who provided the information to confirm the original details.
iCloud Sync transfers some client data when the relevant account and settings are in place. The actual scope depends on the sync options in the app. Sync settings, server availability, and App Store purchase records are separate and cannot replace one another. Before switching devices, check the sync status and separately keep any necessary information safe; do not treat sync as a verified backup.
05 / DNS & NETWORK
Successful domain resolution, an established transport connection, and a working app response are three separate stages. Check them in order when troubleshooting to avoid attributing every failure to server latency or a rule.
DNS resolves domain names to IP addresses and other records, helping the client find a destination; it does not guarantee that the connection will succeed. System DNS and custom DNS may use different resolution paths and return different results. After changing DNS settings, check name resolution, the actual destination address, and the matching rule separately rather than simply refreshing the page once.
DNS over HTTPS sends DNS queries and responses over HTTPS and is commonly called DoH. Enter the full endpoint URL provided by the DNS resolver. It changes how DNS queries are transported; it does not automatically route all app traffic through a proxy. The endpoint must itself be reachable, and its connection route must work with the current network and rules.
TLS provides transport encryption and authentication; SNI specifies the requested server name during the handshake. The connection address and server name may differ, but enter the values from your existing parameters rather than substituting another domain. If certificate verification fails, check the name, certificate validity, and device clock, then review the server configuration.
UDP is a datagram transport protocol used by some apps and protocols based on QUIC. Whether UDP can pass through a proxy depends on the client configuration, server capabilities, and intervening network; enabling a setting alone cannot guarantee it. If web pages work but some real-time communication does not, check the UDP path and relevant rules separately.
After looking up a term, return to the original screen and check its context before changing the related setting. For how settings interact, see the Settings reference; to understand overall modes, see Proxy modes explained.
Back to term categories ↑