Shadowrocket Glossary: App Terms, Protocols, and Rule Keywords - Shadowrocket iPhone Guide

Interface and Toggles:Check where you are before taking action

Home: Home is where you view the server list, choose a default server, and control the connection toggle. Importing an entry only adds its details to the list; it does not establish a connection. For your first setup, follow the Quick Start and check the selected server, connection toggle, and system permission in order.

Global Routing: Global Routing determines how traffic is handled globally. Common options include Config, Proxy, and Direct, with Scene available separately. This setting is independent of server selection. To troubleshoot where a request is going, check Global Routing first, then review the rules in your configuration.

Config: Config is the name of the page used to manage configuration files. As a Global Routing option, it applies the active configuration's rules to traffic. Before choosing it, confirm which configuration is active. A file appearing in the list does not mean it is selected.

Proxy: Proxy is the Global Routing option that sends traffic through the currently selected proxy. It can help distinguish a rule-matching issue from a server connection issue, but it cannot fix an incorrect address or authentication details. Note the original setting before switching, then restore it when testing is complete if needed.

Direct: Direct connects to a destination without using a proxy server. It does not remove servers from the list or turn off the client's connection toggle. If a destination remains unreachable, check your local network, DNS, and the destination itself rather than only checking server availability.

On Demand: On Demand starts a VPN connection when preset conditions are met; its behavior depends on those conditions and how the system handles them. It is not a global traffic policy and cannot replace server authentication. If the connection returns after you disconnect manually, check both the On Demand conditions and the current connection settings.

Protocols:Check parameter combinations against your existing details

A protocol name identifies a communication method; it does not indicate a speed ranking. Use the details provided for your existing server when choosing a protocol. Changing only the protocol name while keeping fields from a different protocol will not work.

Shadowsocks: Shadowsocks is a proxy protocol. Connection details commonly include a server address, port, encryption method, and password. The encryption method must match the server; having the right password alone is not enough to establish a connection. If the details include plugin settings, check those against the original instructions as well.

VMess: VMess uses parameters such as a user ID for authentication and supports different transport methods. When importing, check the transport type, path, and TLS fields as well as the address and port. An incorrect system clock can also affect authentication, so check it during troubleshooting.

VLESS: VLESS is a proxy protocol that must be understood alongside its transport and security settings. It is not the same as TLS, and the protocol name alone does not tell you whether a connection is encrypted. After importing, check the user ID, transport, and any security parameters required by the original details.

Trojan: Trojan is commonly used with TLS. The password, server address, port, and server name can all affect connectivity. A resolvable address does not guarantee that certificate validation will succeed. If you see a related error, check the server name and system clock first; skipping validation should not be treated as a routine fix.

Hysteria2: Hysteria2 is a QUIC-based proxy protocol. Connectivity depends on UDP reachability and server configuration. Keep the name Hysteria2 consistent with the imported details, and do not mix its authentication fields with those of another protocol. If it works on one network but not another, include differences in network paths in your troubleshooting.

WireGuard: WireGuard creates an encrypted tunnel using public and private keys and peer settings. Its configuration differs from a server entry that uses only a password. The private key, peer public key, endpoint address, and allowed IP ranges each serve a distinct purpose. Protect the private key when sharing screenshots or backups; it is not ordinary text to share publicly.

Rule Keywords:Distinguish match conditions from policies

Rules are usually evaluated in order. A match near the top can determine whether later rules are reached. The domains below are examples of syntax only; they are not server or subscription sources.

DOMAIN,example.com,PROXY
DOMAIN-SUFFIX,example.com,PROXY
IP-CIDR,192.168.0.0/16,DIRECT
FINAL,PROXY

DOMAIN: DOMAIN matches an exact domain. For example, DOMAIN,example.com,PROXY specifies an exact domain match. It does not automatically include all subdomains. When entering a domain, do not include a path, query parameters, or protocol prefix from a full URL.

DOMAIN-SUFFIX: DOMAIN-SUFFIX matches a specified domain and its subdomains, making it useful for applying the same policy across a domain. For example, a match for example.com can also cover www.example.com. It checks domain boundaries rather than searching for similar text anywhere in a string.

DOMAIN-KEYWORD: DOMAIN-KEYWORD matches requests when the domain contains a specified string, so its scope is usually broader than an exact domain rule. A short keyword may match multiple unrelated domains. Check the actual matches after adding one to avoid affecting other requests with an overly broad condition.

IP-CIDR / IP-CIDR6: IP-CIDR matches IPv4 ranges, while IP-CIDR6 matches IPv6 ranges. The number after the slash indicates the prefix length. For example, 192.168.0.0/16 describes an address range, not a single address. DNS resolution, rule order, and the configuration's resolution options can all affect how address rules are matched.

GEOIP: GEOIP matches destination addresses according to IP geolocation database classifications, not webpage language or domain suffix. Database classifications may differ from a service's actual deployment location. If traffic is routed unexpectedly, check the resolved address and matching rule; a classification does not guarantee physical location.

FINAL: FINAL sets the policy for requests that do not match any earlier rules and is usually placed at the end. It does not disable the rules above it. If most requests reach FINAL, check the conditions and order of preceding rules, along with the current Global Routing option.

PROXY / DIRECT / REJECT: These uppercase terms are rule policies: PROXY sends traffic through a proxy, DIRECT connects directly, and REJECT denies the request. They serve a different purpose from the match conditions at the start of a rule, and they are not protocol names. If a request fails, first check whether it matched REJECT, then investigate network or authentication issues.

Subscriptions and Servers:Know the difference between connection details and configuration files

These actions cover importing and organizing details you already have. For steps on where to find them, how to refresh them, and how to back them up, see the Server Management Guide →

Server: A server entry is a set of connection details saved by the client. It usually includes a protocol, address, port, and authentication information, and is often called a node. An entry in the list does not mean the remote server is currently online. Its display name is only a label; the address and other fields in the entry determine the connection target.

Add Server: Add Server is the entry point for creating a server record manually. Selecting a protocol displays its corresponding fields. Fill them in using the details you already have; not every protocol uses only an address, port, and password. After saving, open the entry again to check that transport, path, and TLS settings have not been missed.

Scan QR Code: Scan QR Code reads connection details from a QR code, avoiding the need to enter long parameters by hand. A successful scan only means the client read content it could process; it does not prove the server is available. After importing, check the protocol and address, and avoid sharing QR codes that contain authentication details.

Configuration file: A configuration file organizes rules and related settings; it is not the same as a server entry or subscription URL. A subscription provides connection details, while a configuration determines how traffic is handled. Keep a restorable copy before making changes, and confirm the file is selected and active so you do not edit one that is not in use.

Connections and Diagnostics:Interpret results in context

Connectivity Test: Connectivity Test checks whether the current connection can reach a test target. Results depend on the test address, routing option, and network conditions at the time. A successful test does not mean every app or destination is reachable. If it fails, check the default server, connection toggle, and Global Routing first, then review the relevant parameters.

Latency: Latency is the time a request and response take under a particular test method. It is not download speed or a measure of long-term stability. Results from different test methods may not be directly comparable. After sorting by latency, verify the connection in practice, and interpret timeouts in light of your local network and server status.

DNS: DNS resolves domain names to addresses as one step in the connection process. Even after successful resolution, transport, authentication, or TLS verification may still fail. If only certain domains are affected, check the resolution result, relevant rules, and reachability of the destination. Do not assume the VPN status alone explains the issue.

TLS: TLS encrypts traffic and verifies server identity. The certificate and server name are common points to check. The connection address, HTTP Host, and TLS server name may differ, so follow the details you already have. If you encounter a certificate error, check the system clock, name, and certificate status first, and keep normal verification enabled.

VPN configuration: A VPN configuration is the system permission Apple requires before a client can handle the relevant network traffic. A system confirmation may appear the first time you connect. Allowing the configuration does not mean server authentication has succeeded. After the system shows a connection, check the result with Connectivity Test and by accessing the intended destination.

Data: Data shows traffic records and statistics; the available details depend on what the app displays. A traffic record only indicates that network activity occurred; it does not prove the requested service worked. When troubleshooting, consider the request time, matching rule, and error details. Remove sensitive information before sharing records.