Official Manual · Glossary
First distinguish interface options, match conditions, and policies, then look up specific parameters. This page keeps interface terms in English and explains common terminology by where it appears; each entry has its own anchor.
Shadowrocket is a paid client for Apple platforms, available exclusively on the App Store. A one-time app purchase ≠ a service plan; the connection guidance below assumes you already have your own subscription or server details.
01 / INTERFACE
These terms describe interface options or overall behavior; they are not syntax to paste directly into a config file.
The interface setting that determines how traffic is handled overall. The three common options are Config, Proxy, and Direct, shown in the interface as Config, Proxy, and Direct. This is a different settings level from policies in individual rules, and switching it may change whether the current config's rules are applied. If traffic is not routed as expected, check this setting first, then review the rules.
In Global Routing, Config means traffic is handled according to the currently enabled config; elsewhere, it may refer to a config-related interface option. Selecting Config does not send every request through a proxy—the outcome depends on the matching rule and its policy. Check the active config, rule order, and the final FINAL rule together.
The Global Routing option for routing traffic through a proxy overall; check the app settings to confirm its exact scope. It can help compare how the same request behaves under different routing modes, but it cannot fix incorrect server parameters. Do not confuse this option with the uppercase PROXY policy in a rule.
The Global Routing option for routing traffic directly overall. This differs from the DIRECT policy, which applies only to matching requests, and does not mean all network-related settings are disabled. For a meaningful comparison, keep the destination and local network the same rather than changing multiple conditions at once.
Triggers connection behavior based on configured network or access conditions, reducing the need to switch modes manually. Wi-Fi and Cellular are interface condition names to check, not standalone config syntax. After setup, test on each relevant network and check for conflicts with the manual behavior you expect.
The interface for entering details of a server you already have, usually by selecting a type and filling in the address, port, and authentication parameters. Available fields vary by protocol; check each one against your server details instead of entering only the address. Saving an entry only adds it—the entry still needs to be selected and tested.
Checks connectivity under specific test conditions. Results depend on the test target, current network, and server status. A successful test does not mean every app can connect, and the test time is not sustained download speed. When troubleshooting, compare the result with actual requests, matching rules, and connection logs.
02 / PROTOCOLS
The protocol determines how the two ends communicate. Choose one that matches the actual configuration of a server you already have, not just the protocol name.
A proxy protocol whose common connection parameters include a server address, port, password, and encryption method. The encryption method must match the server; changing it arbitrarily in the client will not preserve the connection. Check any additional parameters against the original server details to avoid omissions.
A proxy protocol that uses parameters such as a user ID for authentication; the connection may also involve transport and TLS settings. The same user ID does not mean transport parameters are interchangeable; path and server-name fields may also affect the handshake. After importing, compare all fields with the original details rather than checking only the protocol type.
A proxy protocol that uses a user ID for authentication. Do not infer transport-layer protection from the name alone. Check the transport settings, TLS, and server requirements using your existing configuration. Do not apply parameters from other protocols to a VLESS entry.
A proxy protocol commonly used with TLS; the password is only one of its connection parameters. The port, server name, and certificate verification settings may also affect connection setup. If you see a certificate error, first check the domain, certificate, and device time; do not make skipping verification the default fix.
A QUIC-based proxy protocol that depends on suitable UDP connectivity. When troubleshooting, check TLS and UDP reachability on the local network as well as the address and authentication details. If the same entry behaves differently on Wi-Fi and Cellular, the network path may be responsible; the protocol name alone cannot explain the cause.
A key-pair-authenticated tunnel protocol. Its configuration includes a local key, peer public key, Endpoint, and address. Public and private keys serve different purposes and must not be swapped; keep the private key secure as a credential. After connecting, check routing and DNS as well—a successful handshake does not mean every destination is reachable.
Two common proxy protocols may both use an address, port, and username and password, but they communicate differently. Do not interchange them just because the server address is the same; check UDP support and authentication against the specific settings. The protocol name alone does not guarantee encrypted transport, so confirm whether separate protection is configured.
03 / MATCH & POLICY
The first part of a rule describes its match condition; the second specifies its policy. Rules are generally checked from top to bottom, and the first match applies.
Matches an exact domain, for example DOMAIN,example.com,PROXY. This rule does not automatically match all subdomains; www.example.com must be considered separately. For a single, specific hostname, this narrower condition is often a good starting point.
Matches a domain suffix, for example DOMAIN-SUFFIX,example.com,PROXY, typically covering the domain and its subdomains. This is a match on domain hierarchy, not an arbitrary substring. If a subdomain needs separate handling, put its more specific rule before this one.
Matches a string contained in a domain, for example DOMAIN-KEYWORD,example,PROXY. Its scope may be broader than expected: any domain containing that string may match. Before using it, list the domains to handle and check whether a more specific DOMAIN or DOMAIN-SUFFIX rule would work.
Matches based on the destination IP's location in a geolocation database, for example GEOIP,CN,DIRECT. It does not use website language, account region, or the user's current location; results may also depend on the resolved address and database. For precise handling of a domain, do not rely on geolocation alone.
Matches IPv4 and IPv6 address ranges, respectively. The prefix length after the slash determines the range size. For example, IP-CIDR,192.168.0.0/16,DIRECT describes an IPv4 private address range. Before adding a rule, confirm the destination address type; an IPv4 rule does not replace the corresponding IPv6 check.
Matches identifiable User-Agent information in a request; it does not read the identities of all apps on the device. Its use is limited by traffic type, request visibility, and how the traffic is handled, so it is not a general-purpose app identification feature. Confirm that the current request actually provides information the rule can match.
A fallback rule used when none of the preceding rules match, usually placed at the end of the list. For example, FINAL,PROXY sends remaining requests to PROXY; it does not override rules that already matched. If a request takes an unexpected route, check preceding rules before changing FINAL.
A policy keyword that routes matching requests through a proxy. The actual connection also depends on the currently selected server or related policy settings. A PROXY match only specifies the routing direction; it does not confirm that server authentication, transport, or access to the destination will succeed. Distinguish it from the Global Routing Proxy option by context.
A policy keyword for connecting directly to the destination in a rule, for example DOMAIN-SUFFIX,apple.com,DIRECT. Direct requests still depend on the local network, DNS, and destination service working properly; success is not guaranteed. It describes how matching requests are handled and does not mean Global Routing as a whole is set to Direct.
A policy keyword that rejects matching requests. If the condition is too broad, it may also block images, login APIs, or other resources a page depends on, leaving parts of the page missing. Start with a specific domain condition and, if something breaks, check match logs and rule order first.
04 / CONFIGURATION
Section names define what parameters do. The same domain in different sections may affect entirely different stages.
A config section for general parameters, such as dns-server = system. These settings may affect multiple types of requests; they are not rules for just one domain. Save a copy of the current config before making changes, then test one parameter at a time to make it easier to roll back.
DNS resolves a domain name to an IP address, a separate step from establishing the application connection. Resolving an address does not mean it is reachable, and a successful proxy connection does not mean DNS is configured correctly. Check the resolution result, DNS query path, and final connection path separately.
A section for match rules and their policies, commonly written as DOMAIN-SUFFIX,example.com,PROXY. Rules are generally processed from top to bottom, so put specific exceptions before broader conditions. After editing, check both syntax and that the active config contains these rules.
A section that maps domains to specified addresses, for example localhost = 127.0.0.1. This mapping affects address resolution; it does not select PROXY or DIRECT for the domain. Since a destination address may change, use fixed mappings only for a clear purpose and review them when they are no longer needed.
A section that processes request URLs using matching expressions. Check that each match pattern is paired with the intended replacement. This differs from domain rules in [Rule], which select a connection policy; the presence of this section does not mean every encrypted request can be rewritten. Check escaping, match scope, and applicable requests to avoid redirect loops.
05 / SUBSCRIPTION & ACCOUNT
App purchase history, server access credentials, and subscription collections are different things. Restore and update each separately.
A subscription-related type or interface for importing or updating a collection of servers you already have. Get the link from your own service provider. Updating a subscription fetches the collection again and may change entry addresses, names, or counts; it does not update the Shadowrocket app. Subscription links may contain authentication details, so do not display or forward them casually.
Information needed to connect, such as the address, port, protocol, and authentication parameters; an individual entry is also often called a node. This is different from a subscription containing multiple entries, and adding one entry does not create a subscription update relationship. When sharing troubleshooting details, hide passwords, private keys, and other authentication data; include only the error information needed.
The time it takes to receive a response under specific test conditions; its meaning depends on the test method and target. Latency is not bandwidth, and a lower value alone does not prove faster or more stable sustained transfers. When comparing entries, use the same network and test method where possible, then consider real-world results.
The account used to check App Store purchase history and redownload the app. When purchasing, confirm which account is signed in to the store. It is separate from an account for an existing connection service, and purchasing the app does not add server details automatically. Check the App Store page for system requirements, compatibility, and whether the purchase is universal.
The App Store area for finding purchases made with the original account and redownloading the app; the exact name varies by system version. When changing devices or reinstalling, first check the original purchase account and store status rather than buying again immediately. Restoring the app is different from restoring a subscription, server entries, or Config; restore those from your own backup or original details.