Official Manual · Glossary

Shadowrocket Glossary

First identify the screen you're on, then consider what the term applies to. This glossary retains English interface labels and original rule keywords, organized into five categories. For step-by-step instructions, see the user guide; for connection issues, consult the troubleshooting guide.

01 · Interface and Toggles

Screens and Connection Modes

Capitalization and screen context affect what interface terms mean. In particular, distinguish the Config screen, the Config mode in Global Routing, and uppercase policies in rules.

Home: The main screen for viewing the server list, selecting the current server, and controlling the connection. An entry in the list only means its parameters have been loaded; it does not mean the server is reachable. After connecting, verify actual access and rule matching.

Global Routing: Sets the overall traffic handling mode. The three common options are Config, Proxy, and Direct. Before troubleshooting, check which option is selected so you don't mistake its effect for a rule failure.

Config: As a screen name, Config refers to configuration file management. In Global Routing, Config means traffic is handled according to the active configuration. Opening the Config screen and enabling a configuration are separate actions; after importing a file, check which configuration is actually in use.

Proxy / Direct: In Global Routing, Proxy and Direct set the overall mode to proxy or direct connections. They are not at the same level as the uppercase PROXY and DIRECT at the end of rule lines. With the overall mode set to Direct, a PROXY rule alone does not guarantee that traffic will use a proxy.

On Demand: A mechanism that triggers connections based on configured network conditions. It is not a scheduled speed test or an automatic way to select the fastest server. After enabling it, test on your usual Wi-Fi and cellular networks, and while switching networks. Also check the relevant trigger conditions after manually disconnecting and reconnecting.

Add Server: The entry point for manually entering details for a server you already have. Select a protocol first, then fill in Address, Port, and the authentication fields. Required parameters differ by protocol, so don't reuse another protocol's settings just because some field names look similar.

02 · Protocols

Protocols for Server Parameters

A protocol name identifies connection and authentication methods, not a speed tier. Use the complete parameters provided for your server, and don't infer the transport method or TLS settings from the protocol name alone.

Shadowsocks: A protocol that carries proxy traffic using an agreed encryption method and password. The address, port, encryption method, and password must match the server. Changing the display name won't fix an authentication failure, and you can't choose an encryption method based on personal preference.

VMess: A proxy protocol with authentication, often using a UUID as one of its identity parameters. Check the transport method, Host, Path, and TLS settings separately. A correct UUID does not mean the connection parameters are complete; some authentication processes are also affected by the device's clock.

VLESS: A proxy protocol that separates identity from transport security. A UUID alone does not mean the connection is encrypted. Check the transport and security settings specified by the server; VMess parameters are not interchangeable with VLESS parameters.

Trojan: A proxy protocol commonly used with TLS and password authentication. Common fields to check include Address, Port, Password, and SNI. The server address may differ from the domain used by its certificate. If you see a certificate error, check the hostname and server settings rather than disabling certificate verification.

Hysteria2: A QUIC-based proxy protocol whose connection behavior depends on server settings and how the current network handles UDP. Enter authentication details, the TLS name, and other parameters as specified by the server. The protocol name does not guarantee speed, and a timeout does not necessarily mean the password is wrong.

WireGuard: A protocol that creates an encrypted tunnel using public and private keys, which serve different purposes. Check that the keys correspond, along with the peer address and routing parameters. A private key is sensitive information and should not be shared in troubleshooting materials.

HTTP / SOCKS5: Two common proxy protocol types. The server may also require a username, password, or TLS. HTTP CONNECT can establish a tunnel, but that does not mean the connection to the proxy server itself uses TLS. The name SOCKS5 alone does not indicate whether the connection is encrypted.

03 · Rule Keywords

Match Conditions and Policies

A rule typically specifies a match type, a condition, and then a policy. Rule order is also part of the configuration: a broad rule that matches first can prevent later, more specific rules from being evaluated.

[Rule]: The rules section of a configuration file checks match conditions in order and selects the corresponding policy. Rules are not a server list and do not create connection credentials. When troubleshooting a match, check the active configuration, Global Routing mode, and rule order.

DOMAIN / DOMAIN-SUFFIX / DOMAIN-KEYWORD: DOMAIN matches a full domain, DOMAIN-SUFFIX matches a domain and its subdomains, and DOMAIN-KEYWORD matches a keyword appearing in a domain. Conditions usually take a domain, not a full URL: omit the scheme, page path, and query parameters. Short keywords can match too broadly.

IP-CIDR / IP-CIDR6: These match IPv4 and IPv6 address ranges, respectively; the prefix length after the slash determines the range. For example, 192.168.0.0/16 represents an IPv4 range, not a single host. Before writing a rule, confirm which address type the traffic actually uses.

GEOIP: Matches a target IP using its geographic classification in an address database; it does not determine the device's location. Database records may differ from a service's actual deployment or business location, so GEOIP is not a substitute for every precise domain rule. Results may also change when the resolved address changes.

FINAL: Handles traffic that did not match any preceding rules and is usually placed at the end of the rules section. It provides the final destination; it does not override results after all rules run. If placed too early, it can prevent later rules from matching.

PROXY / DIRECT / REJECT: Rule policies: PROXY routes traffic through a proxy policy, DIRECT connects to the destination directly, and REJECT blocks matching requests. DIRECT does not bypass every system network setting, and REJECT is not simply a way to hide page elements. Whether a policy applies still depends on the preceding match conditions.

Rule Syntax Example — Not an App Screen

The example below uses sample domains to show the field structure. Review it against your own needs before use; FINAL,PROXY sends traffic that did not match earlier rules through PROXY.

[Rule]
DOMAIN-SUFFIX,example.com,PROXY
IP-CIDR,192.168.0.0/16,DIRECT
DOMAIN-SUFFIX,example.org,REJECT
FINAL,PROXY

04 · Subscriptions and Configurations

Imported Content and What Can Be Restored

First identify whether you have a single-server share link, a server subscription, or a remote configuration file. Even if all three can be shared by link or QR code, they may require different import options.

Subscription: Uses a URL from a service provider you already use to fetch and update server entries. It is separate from purchasing the app. Subscription URLs may contain access credentials, so don't paste them into screenshots or logs. If an update fails, first determine whether the URL is unreachable, the content is in the wrong format, or the subscription itself has an issue.

Server: A remote service that carries a proxy connection, also commonly called a node. Each list entry typically includes a protocol, address, port, and authentication parameters. The display name is just a label for identification; changing it does not change the server address or its availability.

Configuration File: A text file for organizing rules, DNS, and other supported settings; its main purpose differs from that of a server subscription. After importing it, check whether it is enabled. Remote updates may overwrite local changes, so keep a recoverable copy before editing and make sure you understand what each enabled section does.

iCloud Sync: Syncs supported data through iCloud; available items and entry points depend on the current app interface. It is not a complete backup of all system permissions and connection states. After moving to a new device, check that your configuration is present, which one is active, and whether your server credentials are still valid.

Purchased: An App Store entry for finding previous purchases and redownloading the app. You must use the Apple Account used for the original purchase. Restoring the app and restoring its configuration are separate actions; redownloading Shadowrocket does not restore server details. Check the App Store listing for system requirements, Family Sharing, and Universal Purchase availability.

05 · DNS and Networking

Resolution, Testing, and Connection Security

Connection toggles, domain resolution, server authentication, and access to the actual service are separate checks. Success at one stage only confirms that stage's conditions are met; it does not replace end-to-end verification.

DNS: The process of resolving a domain to records such as IP addresses. Results can change with the network and service deployment. Successful resolution does not mean the destination port is reachable, and a successful server test does not mean all domains resolve correctly. Record resolution failures separately from subsequent connection failures.

DNS over HTTPS: A way to send DNS queries over HTTPS, commonly abbreviated as DoH. It protects the transmission of those resolution requests; it does not mean all application traffic goes through a proxy. The configured resolver must also be reachable, or requests may stall or fail before the application connection begins.

Connectivity Test / Latency: Connectivity Test checks a connection under specific test conditions; latency usually refers to the time taken by that test. Results depend on the test method, target address, and current network, and cannot be translated directly into download speed. A timeout may also be caused by the test target or resolution path, so check actual access as well.

TLS / SNI: TLS protects a connection; SNI identifies the target hostname during the handshake. Address may be the connection address, while SNI must match the server's TLS configuration. If the certificate name doesn't match, check the domain, certificate, and device clock rather than disabling verification.

URL Rewrite: A feature that rewrites request URLs according to configured conditions. It differs from rule-based traffic routing, which selects where traffic goes. Whether it works depends on request visibility, match conditions, and related settings; it cannot be assumed to handle arbitrary encrypted content. Enable only rewrite options whose purpose you understand.