Shadowrocket Modes and Settings Guide | Shadowrocket Official Manual

The Three Global Routing Modes

Config, Proxy, and Direct are the three options shown in Global Routing.

Global Routing determines how connections handled by the app are routed. On Home, open Global Routing and choose Config, Proxy, or Direct for your current needs, then return to Home to check the connection status. Global Routing is not the connection toggle or the server list: selecting Proxy does not turn on the VPN, and switching servers does not change the routing mode.

Config is usually the right choice for routing different destinations according to rules. Use Proxy temporarily to compare results without rule policies, or Direct to check how a direct connection behaves. These comparisons help isolate problems; they are not a ranking of the modes. When testing is done, restore the mode you intended to use so a temporary setting is not left in place.

Option	How it works	When to use it	What to check
Config	Uses the rules in the currently enabled configuration to select a policy.	When you need to route traffic by domain, IP address, or region.	Check which configuration is enabled and the order of its rules.
Proxy	Routes connections handled by the app through a proxy path.	To test the selected server temporarily and narrow down rule-related issues.	Confirm the server is available and its settings are complete.
Direct	Uses a direct connection path.	To see how connections behave without a proxy server.	This does not turn off the VPN connection in system settings.

In Config mode, check which configuration is enabled

Config is both the name of the configuration screen and an option in Global Routing, but each serves a different purpose. Saving a file on the Config screen does not make it the active configuration; check which one is enabled. In rules, PROXY routes traffic through a proxy policy, DIRECT connects directly, and REJECT blocks the connection. If the configuration defines policy groups, also check which target each group currently selects.

Reconnect after changing modes

Existing connections may keep their previous handling state, so an unchanged screen does not necessarily mean the mode switch failed. Note the original mode, switch modes, then make a new request and check the connection log and matched rule. Changing the server, DNS, and mode at the same time makes results hard to interpret. Change one thing at a time.

Rule Types and Policies

Rules specify what to match; policies specify what to do with a match.

Rules route different destinations through different connection paths. Work in the active configuration on the Config screen; after editing rules, save the file and make sure Global Routing is set to Config. Rules are generally evaluated from top to bottom, and the first match determines the policy. Put specific conditions before broader ones, and place FINAL at the end as a fallback. Adding rules to a file does not guarantee they will be evaluated.

DOMAIN matches an exact domain. DOMAIN-SUFFIX matches a domain and its subdomains, while DOMAIN-KEYWORD matches a keyword in the domain. IP-CIDR and IP-CIDR6 define IPv4 and IPv6 ranges; GEOIP matches based on IP geolocation data. USER-AGENT relies on an identifiable User-Agent in the request, which is not available for every connection. Choose a rule type based on information you can actually observe, not just the app's name.

[Rule] · Syntax Example

[Rule]
DOMAIN,example.com,PROXY
DOMAIN-SUFFIX,example.org,DIRECT
IP-CIDR,192.168.0.0/16,DIRECT
GEOIP,CN,DIRECT
FINAL,PROXY

These domains are syntax examples, not a complete configuration to enable as-is. The first rule matches only example.com; the second covers example.org and its subdomains. The IP-CIDR example covers the specified private address range, and FINAL catches connections not matched earlier. Moving FINAL to the top prevents subsequent rules from being matched.

PROXY / DIRECT: Use the proxy policy or connect directly. To determine the actual exit for PROXY, also check the selected server or policy group.

REJECT: Rejects matching connections. A rule that is too broad can disrupt legitimate requests. Verify the target first; do not assume it can block all page content.

If rules do not behave as expected, check the current mode first, then the enabled configuration, and finally whether an earlier rule has already matched. Domain and IP rules rely on different matching information, and DNS results can also affect IP-based rules. For rule boundaries, configuration structure, and more examples, see the Rules Handbook. Adding duplicate rules is not a substitute for finding the cause.

Subscriptions and Server Management

Know whether you have server details or a configuration file before choosing an import option.

A server entry stores the address, port, protocol, and authentication details needed to connect. A subscription imports or updates these entries in one place; a configuration file stores rules and other connection settings. They are related, but they are not the same thing. If you already have a subscription, use Subscribe in the app. To add a single server manually, open Add Server from Home. After importing, check the entry in the list; seeing its name does not confirm that it connects.

Add Server: Enter Your Existing Details

In Add Server, first choose the protocol used by your server, then enter its address, port, and authentication details. Shadowsocks, VMess, VLESS, Trojan, WireGuard, and Hysteria2 use different fields; do not apply one protocol's settings to another. If your details include TLS, a server name, or a transport type, check each one. The display name is only a label and cannot replace the actual server address.

After importing existing share details using Scan QR Code or the clipboard, open the entry and check its key fields. Scanning a code is just an input method; it does not verify that the remote server is online. Keep QR code images, share links, and pages containing authentication details secure. When troubleshooting, share only the field names and relevant symptoms, not the full details.

Subscribe: Keep the Update Link

When using a subscription address you already have, check that it is complete, accessible, and returns a format supported by the app. A subscription update typically reloads the remote list, so do not rely on subscription-generated entries to preserve local changes you need long term. Note your current selection before updating; afterward, check which entries changed and confirm your selected server is still there.

If the list is empty after an update, first check that the subscription is still valid, that the network could reach the address, and that you did not enter a regular webpage URL instead of a subscription. Do not repeatedly delete all your configurations in an attempt to restore the list. Check separately whether the rules file managed in Config is enabled; a successful subscription update does not mean the rules configuration has changed. For the full import process, see the Getting Started Guide.

On Demand

Automatically triggers a connection; it does not replace routing rules.

On Demand asks the system to establish a VPN connection when configured conditions are met. It is useful when you want to reduce manual steps. On Demand controls when to connect; Global Routing controls how connections are routed afterward. In Settings, review the On Demand options and their conditions before enabling them. The available network and Wi-Fi conditions depend on what the app currently displays.

When setting this up for the first time, get a manual connection working before enabling On Demand. Test in two stages: check whether it connects on a network where you expect it to trigger, then switch to one where it should not. This helps distinguish an incorrect trigger condition from an unavailable server.

When pausing a connection, check whether On Demand can still trigger a reconnection. If the connection returns after you turn it off on Home, the toggle may be working as expected—the system may have met an On Demand condition again. If the device has multiple VPN configurations, check which one the system is using so you do not mistake another configuration's status for Shadowrocket's.

Data and Usage Statistics

Shows traffic recorded by the app; it is not a billing statement.

Data shows traffic recorded by the app. Open Data and check the displayed time range, reporting period, and units before interpreting the upload and download figures. These indicate traffic direction, not server quality. Low usage during a period may simply mean no new requests were made; it does not by itself indicate a connection problem.

To compare the effect of an action, note the current figures, perform one specific action, then return to Data and check the change. If the screen offers a reset option, check what it clears first and save any statistics you need. Avoid repeatedly resetting data while trying to review changes from the same period.

The app's statistics, system cellular data usage, and usage records from your service may use different measurement methods, connection scopes, overhead calculations, and reporting periods. Data is best used to observe usage trends. For cellular billing or remote usage, check the relevant source separately. An increase in traffic alone does not prove that a rule matched as expected; check the connection log to confirm the route.

Common Settings

Change settings for a specific reason, and note the original value and why you changed it.

DNS: Check the Resolution Path

DNS translates domain names into addresses needed for connections. Check DNS behavior against the DNS settings in Settings and the active configuration, rather than relying on a single field. Before making changes, note the current settings and check whether they are specified by the configuration in use. If an IP address works but its domain name does not, DNS is one area to investigate; that alone does not prove DNS is the cause of every problem.

Avoid stacking multiple DNS addresses from unknown sources. After a change, start a new test connection and check the same destination. Also verify that IPv4 and IPv6 behavior matches your expectations. DNS changes can affect both domain resolution and subsequent IP rule matching, so note the DNS settings while troubleshooting to keep test conditions consistent.

Test Method: Keep Tests Consistent

Test Method determines how connection tests are performed. Check the setting in Settings before running Connectivity Test from Home. When comparing servers, use the same method; otherwise, the results may reflect different processes. Test duration only describes responsiveness at that time with that method. It does not directly measure webpage loading speed or sustained transfer performance.

If a server entry fails the test, first check whether the test target is reachable in your current environment, then verify the server address, port, and authentication details. If only a particular app has access problems, check the connection log for its actual destination. Do not repeatedly change configurations based on a single test result in the list.

Today Widget: Check What the Shortcut Controls

Today Widget provides a quick system-level view and shortcut controls. Check its options in Settings, then add or review it through the system's available widget controls. How it appears depends on the capabilities currently provided by the system and app; do not assume it is in the same place on every device.

After using a shortcut, return to Home to check the actual connection status, selected server, and Global Routing mode. The widget is a control, not a separate configuration. If its status has not refreshed, check both the in-app status and the system VPN status. Avoid rapidly toggling it, which can make the result harder to interpret.

iCloud Sync: Check the Scope Before Syncing

iCloud options sync content within the scope supported by the app. First check that you are signed in to your own Apple Account on the device and that iCloud access is allowed in system settings. Then review the sync scope actually offered in Settings. Do not assume that all connection logs, statistics, or sensitive fields sync, or treat app purchase history and configuration sync as the same thing.

Before editing content on another device, check both devices and their sync status. Keep a recoverable copy of the configuration if needed. If content does not match, first check the network, account, and sync permissions, then decide which copy to keep. Restoring an app purchased from the App Store does not necessarily restore its configuration files and server details.

Diagnostics and Connection Troubleshooting

Use the symptoms to identify the problem area, then choose the relevant diagnostic information.

Diagnostics can help investigate connection problems. Look for Diagnostics in Settings and run the checks available on the current screen. Interpret the results alongside the time, network, Global Routing mode, and destination. A single error message usually cannot explain the whole problem or justify changing unrelated advanced settings.

Describe the symptoms. Distinguish between a connection that will not start, all destinations failing after connection, a problem affecting only certain domains, and a failed subscription update. These issues involve different stages.
Check the basics. Verify the selected server, authentication details, enabled configuration, and routing mode. Make sure the device's network is working, then run Connectivity Test.
Isolate variables. Keep the server unchanged and compare Config with Proxy. If the results differ significantly, check the rules, policy groups, and DNS. Restore the original mode after testing.
Test again and take notes. Change just one setting, reconnect, and record what happens. If there is no improvement, restore the original value instead of stacking temporary changes.

Diagnostic information may include domains visited, server addresses, or authentication details. Before saving or sharing it, check for sensitive information and redact it. Keep only the error type, time, and steps needed to explain the problem. Do not post a full subscription address publicly; use an example domain such as example.com when describing its format.

Settings Checklist and FAQs

Before leaving Settings, confirm the current state matches your expectations.

A full check should cover four things: connection status on Home, the current Global Routing option, the selected server, and the configuration enabled in Config. If you use On Demand, also check its trigger conditions. Keeping a record gives you a consistent baseline for troubleshooting without having to change everything each time.

Why is traffic still going through a proxy when Config is selected?

Config means traffic is handled according to rules; it does not mean every connection is direct. Check whether the matched rule uses PROXY or traffic falls through to FINAL,PROXY. Also confirm the intended configuration is enabled, rather than merely saved in the list.

Do I need to turn off the connection when switching to Direct?

Direct and turning off the connection are different actions. Direct changes the connection path; turning it off stops the current connection. To pause connections completely, also check whether On Demand may trigger another connection and verify the VPN status in system settings.

Does a successful Connectivity Test mean every app will work?

No. The test covers only the process used by the selected Test Method. Actual access also depends on the destination, DNS, rules, and remote response. Make a request to the specific destination again and check how that connection was handled.

Do rules change when a server subscription is updated?

Check each imported item separately. The server list and rules configuration serve different purposes. Updating a server subscription does not necessarily update or enable a rules file. Check the updated list, then go to Config to verify the active file and its rules.

Which settings should I adjust first?

First import your existing server details or subscription and verify the connection settings. Then confirm Global Routing and test a manual connection. Once the basic connection works, set up rules and On Demand. For the steps, see the Getting Started Guide; for advanced rule syntax, see the Rules Handbook.