Choose how traffic should be handled first, then configure servers, rules, and automatic connections. Change one setting at a time and verify the result with the same request.
This page covers common features on iPhone and iPad, explaining what each one does, where to find it, how to configure it, and what to watch for. Menus and available options may vary by device; see the App Store listing for system requirements.
Global Routing controls how traffic is handled after a connection is established. Open Global Routing from Home to choose one of three modes: Config, Proxy, or Direct—the corresponding interface labels are Config, Proxy, and Direct. This sets the overall handling mode; it does not select a server or turn on the connection. Check separately that a server is selected, the connection is enabled, and traffic is routed as expected.
What each mode does and what to check
Mode
How it handles traffic
When to use it
What to check
Config
Uses the rules in the active configuration file to choose how traffic is handled.
For everyday use when requests need different handling based on domains, addresses, or other conditions.
Check which configuration is active, the rule order, and the final FINAL rule.
Proxy
Handles traffic in Proxy mode; keep applicable system and connection exceptions in mind.
To briefly check whether a server can handle a particular request.
Check the selected server, then switch back to your usual mode after testing.
Direct
Handles traffic primarily through direct connections.
To check whether the current network can reach a destination directly, or to temporarily use a direct connection.
Access in this mode does not show whether a proxy server is working.
Choosing a mode: start with Config, then compare when troubleshooting
If you have a working configuration, start with Config. If a particular destination behaves unexpectedly, note your current settings, switch briefly to Proxy, and retry the same request. If the issue occurs only in Config, check the rules, policies, and DNS first. If it also occurs in Proxy, check the server settings and network. Direct provides a useful comparison, but results across modes can only narrow down the cause; they cannot identify it on their own.
After switching modes, make a new request. Existing connections may continue to use their original route, so checking a page that has not been refreshed can make old results look like the effect of the new setting.
02 · Configuration and policies
Rule-based routing: match conditions and policy actions
Rule-based routing separates what a request is from how it is handled. Rule types define the matching conditions; policies define the action taken when a rule matches. View, edit, and enable a configuration in Config, then set Global Routing on Home to Config for its rules to handle traffic. Importing a file without enabling it does not make it active for the current connection.
Rule types: identify requests
DOMAIN matches an exact domain, DOMAIN-SUFFIX matches the domain and its subdomains, and DOMAIN-KEYWORD matches a keyword in the domain. Address-based conditions include IP-CIDR, IP-CIDR6, and GEOIP; GEOIP results depend on IP geolocation data.
USER-AGENT requires access to the corresponding request information, so it is not suitable for identifying all encrypted traffic. FINAL catches requests that did not match earlier rules; check that its policy is what you expect.
Policies: choose how traffic is handled
PROXY uses a proxy policy, DIRECT connects directly, and REJECT rejects the request. A configuration may also refer to a custom policy name. Check which server or downstream policy that policy actually selects; the name alone does not tell you how traffic exits.
Rules are generally checked from top to bottom, and the first match determines the result. Place more specific rules before broader ones. After changing the order, check whether an earlier condition is capturing the request first.
The example domains illustrate syntax only; they are not working service settings. The first rule routes api.example.com to DIRECT before the second rule handles other matching requests for example.com. Save your original configuration before editing. For the full rule structure and explanations, see the rules manual.
03 · Connection details
Managing subscriptions and servers
A server entry contains the destination and authentication details for a connection. A subscription helps maintain existing server entries in bulk, while a configuration file mainly controls global settings and routing logic. These serve different purposes: updating a subscription does not update your current rules, and switching configurations may not change the server selected on Home. Before setup, identify whether you have an individual server entry, a subscription URL, or a configuration file URL.
Where to configure and how
Manage connection details in the server list on Home and through Add Server. Add existing subscriptions using the subscription option provided in the app; to work with a configuration file, go to Config. When adding a server manually, choose the correct protocol first, then check the server address, port, authentication details, and relevant transport settings. Shadowsocks, VMess, VLESS, Trojan, Hysteria2, WireGuard, and other protocols use different fields; changing only the protocol name does not make the other settings interchangeable.
After saving, return to Home, choose the server entry you want in the SERVER list, and confirm that it is selected. After updating a subscription, check that the default server is still present, that similarly named entries point to the expected addresses, and that selected policies still refer to valid items. After the first import or a bulk update, run Connectivity Test before checking access to a destination.
Important limitations
This manual assumes you already have your own subscription or server details. A one-time client purchase is not a service plan. Buying Shadowrocket gives you access to the app; you must obtain the connection details separately. This site does not provide, sell, or recommend servers or subscriptions. Subscription URLs may contain access credentials, so hide the full URL, authentication fields, and QR code when sharing troubleshooting details.
Shadowrocket is a paid client for Apple platforms, available exclusively from the App Store. See the App Store guide for purchase, installation, and how to verify the genuine app. The server steps on this page do not involve purchasing services beyond the app itself.
04 · Automatic connections
On Demand: connect when conditions are met
On Demand triggers or maintains connections based on conditions, which can reduce the need to turn the connection on manually. It controls when a connection starts, not how domains are routed. Whether traffic uses PROXY, DIRECT, or REJECT still depends on Global Routing and the active configuration. On Demand does not automatically fix server problems.
Where to find it and how to configure it
Look for On Demand in Settings and review the network conditions and options shown on your device. First confirm that manual connection and access work, then enable the conditions you need. If options for Wi-Fi, cellular, or specific networks are available, configure them to match your use case and note the original settings.
After setup, test connection behavior on each relevant network. When switching networks, wait for the system to finish reconnecting, then check the connection status on Home. A status bar indicator alone does not confirm that every destination is accessible as expected.
Reconnections and battery use
With On Demand enabled, a condition may trigger a new connection after you disconnect manually. To stop automatic connections temporarily, check On Demand first, then use the connection switch on Home. Otherwise, repeatedly toggling the switch may not change the condition causing reconnections.
Battery use also depends on request frequency, network quality, and how often the connection reconnects. For a fair comparison, use similar observation periods and check the system's battery usage records. Do not assume that enabling On Demand will necessarily increase or decrease battery use.
05 · Usage monitoring
Data: traffic statistics and before-and-after checks
Data shows traffic activity recorded by the app. Open Data from the bottom navigation and check the displayed statistics, time range, and categories available on your device. Upload and download values can indicate that data was exchanged, but they do not confirm that a page loaded successfully or prove that traffic matched a particular rule.
For a repeatable test, note the current values and connection mode, close unrelated foreground tasks, and make one specific request. Then return to Data and compare the numbers. Background sync, system requests, and other apps may also generate traffic, so treat changes in the statistics as supporting evidence only. To assess routing, also check any available connection logs and rule-match information.
06 · Common options
Settings: DNS, testing, sync, and diagnostics
Settings brings together common app-level options, but not all connection parameters are controlled there. Some come from a configuration file in Config; others are part of individual server entries. Before troubleshooting, confirm which configuration is active, then check the relevant items in Settings. For similarly named options, read the descriptions to understand their scope.
DNS: check the resolution path first
What it is and where to find it: DNS resolves domain names to addresses. Check DNS under Settings and in the global parameters of the active Config. Resolution results can affect address-based rule matching and may also affect the destination used to establish a connection.
How to configure it: Keep settings that already work, check whether the active configuration specifies DNS parameters, then adjust the resolution method to suit your network. After making a change, test the same domain again and consider whether cached results or existing connections could affect what you see.
What to watch for: Do not change multiple DNS options at once while troubleshooting. A domain resolving successfully does not mean server authentication succeeded; likewise, a successful server connection does not prove the destination domain can be resolved. Check resolution, connection establishment, and the destination's response separately.
Test Method: understand what the test measures
What it is and where to find it: Test Method in Settings determines how connection tests are performed. It affects how server reachability is measured; it does not change routing rules or act as a general connection speed boost.
How to configure it: Choose a test method based on the options and descriptions shown in the app. If you need to specify a test target, use an address whose response you can verify. After changing the method, run Connectivity Test on Home and compare results using the same method.
What to watch for: A failed test may be caused by the target, test method, or network restrictions; it does not immediately mean all requests will fail. A successful test confirms only that the test path worked at that time. Check the actual destination you need, and do not compare values from different test methods as if they were the same metric.
Today Widget: quick actions and status
What it is and where to find it: Today Widget provides quick views and actions where supported by the system. Check its options in Settings; how and where it can be added depends on the device's operating system.
How to configure it: First set up a working configuration and select a server in the app, then add an available widget using the system's instructions. Before changing the connection from the widget, confirm it shows the expected item. Afterward, return to Home to verify the connection status.
What to watch for: Widget information may refresh with a delay and cannot replace a full connection check. If your system does not offer the relevant option, follow the capabilities of your device; do not assume your device has the same controls as another device with a different layout.
iCloud: keep a copy before syncing
What it is and where to find it: iCloud features support data sync or cloud actions within the app's available capabilities. Check the relevant options in Settings and confirm availability against your system's iCloud status.
How to configure it: Confirm that the device is signed in to the intended iCloud account and that the system allows the app to use iCloud, then review the specific sync options in the app. Before working across devices, keep a copy of the current working configuration. After syncing, check the file contents and server entries.
What to watch for: Sync is not the same as a historical backup or restoring an App Store purchase. Configurations may contain sensitive connection details, so check what will be synced. Do not assume that temporary state, statistics, or system VPN settings will all transfer completely.
What it is and where to find it: Diagnostics provides troubleshooting tools under Settings. Use it to gather information when a problem occurs, rather than leaving every logging option enabled without understanding its effect.
How to configure it: Note the network type, Global Routing mode, active configuration, and destination that failed, then run the relevant diagnostic as described in the app. Change one condition at a time and keep before-and-after results to distinguish DNS, server connection, rule, and destination response issues.
What to watch for: Diagnostic output may include domains, addresses, and request details. Review it and hide authentication information and personal data before sharing. Turn off any temporary options when troubleshooting is complete. For unclear errors, continue with the FAQ and check the relevant issue type.
07 · Setup order
Change one setting at a time and keep evidence
Check the basics. On Home, confirm the selected server; in Config, confirm which file is enabled. Server details and configurations should come from information you already have.
Check the traffic mode. Note whether Global Routing is set to Config, Proxy, or Direct before deciding what behavior to test.
Establish a working baseline. Connect manually and run Connectivity Test, then try the actual destination. Do not add automatic connection conditions until the basic connection works.
Change one variable. Modify just one rule, DNS option, or server parameter, then retry the same request. If needed, close the old connection before checking again.
Configure automation last. Once manual use works, adjust On Demand, Today Widget, and sync options. If a problem appears, restore the previous settings to avoid obscuring the cause with successive changes.
Use this page to understand what each feature does. For a first-time setup, follow the tutorial step by step; check the rules manual for configuration structure and rule syntax. This lets you verify connection status, rule behavior, and destination access separately.