Check Global Routing first, then review rules, servers, and DNS. Change one setting at a time and keep a copy of your configuration so you can restore it.
Shadowrocket is available for iPhone, iPad, Mac (Apple silicon and Intel), Windows, Android, and Linux. See Download Shadowrocket for platform options. You don't need to reinstall the app or clear your existing configuration to follow this guide.
This setting chooses how connections are handled. It is not a server protocol or a speed setting.
What it does: Global Routing determines whether connections are handled mainly by your configuration rules, sent through the selected proxy, or connected directly. These options correspond to Config, Proxy, and Direct in the app. Config here is a routing mode; the Config tab at the bottom of the screen manages configuration files. The two are related, but they are not the same control.
Where to find it and how to set it: Find Global Routing on Home and select a mode. If you already have rules configured, Config is usually the right choice for everyday use. Check that the expected file is enabled on the Config screen. To see whether a rule is causing a problem, briefly switch to Proxy for comparison. To check whether your local network can connect directly, select Direct. Restore your usual mode after testing so a temporary troubleshooting setting doesn't become your default.
| Mode | How it works | When to use it | Keep in mind |
|---|---|---|---|
| Config · Configuration | Handles connections according to the rules and policies in the active configuration. | When you need to route traffic based on domains, addresses, or other conditions. | Check which file is enabled and review rule order. Importing a file does not enable it. |
| Proxy · Proxy | Routes connections primarily through the currently selected proxy. | As a brief comparison with rule-based routing, or to check whether a server is reachable. | This does not necessarily route all system traffic; behavior also depends on system and app settings. |
| Direct · Direct | Connects primarily through the current local network. | To check basic network connectivity or when a direct connection is needed. | This is not a stop switch. Check the connection status and routing mode separately. |
Rules answer “which connections?” Policies answer “how should they be handled?” Check the first matching rule, then the policy it references.
What they are: Rules are checked in configuration order, and the matching rule sends a connection to its assigned policy. DOMAIN matches a specific domain; DOMAIN-SUFFIX matches a domain and its subdomains; DOMAIN-KEYWORD matches a keyword in a domain. IP-CIDR and IP-CIDR6 describe IPv4 and IPv6 address ranges. GEOIP uses IP geolocation data. Whether USER-AGENT applies depends on whether the client can access the relevant request information; don't assume it can identify every connection.
Where to find them and how to set them: Open Config, confirm which configuration is active, then save a copy before editing its rules. Put narrowly targeted rules before broader ones, and use FINAL to handle connections that haven't matched earlier rules. DIRECT means a direct connection, and REJECT blocks a connection. In examples, PROXY represents a proxy policy. Check that the referenced policy group or server name actually exists; matching text alone does not make a reference valid.
[Rule]
DOMAIN-SUFFIX,example.com,PROXY
IP-CIDR,192.168.0.0/16,DIRECT
FINAL,PROXYThe first rule matches example.com and its subdomains. The second matches the listed local address ranges. The last rule handles connections that haven't matched earlier rules. This snippet illustrates the syntax; it is not a complete, ready-to-use configuration.
Existing connections may keep their previous state. After editing, start a new request to test the change; don't use a cached result from an old page to judge the new rule.
Keep in mind: Avoid adding lots of rules you can't explain. DOMAIN-KEYWORD may match more than expected. GEOIP results depend on the data and the IP address being resolved. Domain rules may not match when you enter an IP address directly. To block a destination, first identify the domain used by the actual request and avoid overly broad conditions that could affect other connections. If your configuration includes remote rules, check that they update successfully.
Server details, subscriptions, and rule configurations serve different purposes. Before importing anything, identify what kind of information you have.
What they are: A server entry stores the address, port, protocol, and authentication details needed to connect. Subscribe updates a group of server entries from a subscription URL you already have. Config stores settings such as routing rules. A successful subscription update means the content was fetched and parsed; it doesn't guarantee that every server can connect or that any related rules are enabled.
Where to find them and how to set them: Manage servers in the SERVER section on Home. Use Add Server to choose the type that matches your existing details. When entering information manually, check the address, port, password, and other authentication fields one by one. Use Scan QR Code to import an existing QR code, or add an existing subscription from the Subscribe menu. Confirm that the group and entries appear, then run Connectivity Test on a server and establish a connection to verify an actual request.
The protocol must match the server details you already have, such as Shadowsocks, VMess, VLESS, Trojan, WireGuard, or Hysteria2. Don't change it just to make a test pass. Check transport settings, TLS, server name, and other fields against the original information; these aren't universal options that can all be left blank. If a field is missing, check the original details rather than copying settings from another server.
Keep in mind: Updating a subscription can refresh entries, names, or groups. Record important manual changes separately and confirm how they are saved. Before deleting a group, check whether it contains servers you added individually. Subscription URLs and QR codes may contain authentication details; hide the full link, passwords, and identifying fields before sharing screenshots or diagnostics. If a test fails, keep the original entry and edit a copy so you can compare settings and restore them if needed.
Verify a manual connection first, then enable automatic triggers. Automation won't fix an underlying connection problem.
What it does: On Demand uses conditions supported by the system to trigger connections, for example based on the network you're using. It serves a different purpose from rule-based routing: On Demand controls when a connection is established, while Global Routing and Config control how requests are handled after it connects. It is not a scheduled task and does not control arbitrary app activity at any time.
Where to find it and how to set it: Look for On Demand in Settings and choose from the network conditions shown in your current app. Note the existing settings, then add one condition you can test repeatedly—for example, a connection behavior for a specific Wi-Fi network. After saving, switch to that network, check the system connection status, and test with a new request. If the system asks to add a VPN configuration for the first time, review and confirm its prompt.
Keep in mind: If a connection returns after you turn it off manually, check whether On Demand is triggering it before deleting configurations. Network changes, system connection management, and condition order can all affect what you see. To troubleshoot, temporarily disable On Demand and verify that a manual connection works reliably, then restore conditions one at a time. To stop connections completely, check both automatic triggers and the main switch.
Use these statistics to understand connections handled by the app. They don't replace provider billing figures or a real download test.
What it shows: Data displays traffic and connection information; the details depend on the current app version. Use it to check whether a request reached the app or where a connection went after you changed a rule. Upload, download, and total traffic are observational metrics, not server quality ratings. Increased traffic also doesn't mean a page finished loading.
Where to find it and how to use it: Open Data and check the reporting period, then compare the figures before and after a controlled test. If the app shows connection details, use the destination, connection time, and policy to interpret the result. Save anything you need for comparison before clearing records or resetting statistics. Compare results only when the reporting scope is consistent.
Keep in mind: App statistics may differ from system cellular-data totals and provider usage figures. Repeated connections and background requests also generate traffic. Don't use these numbers as an exact measure of every app on your device. Records may include domains and addresses, so share only the fields needed for troubleshooting. To check speed, run a real transfer to the same destination and note the network conditions.
Just because an option exists doesn't mean you need to change it. Keep settings that work reliably and adjust only what relates to a specific issue.
What it is and where to find it: DNS resolves domain names to IP addresses. Its behavior may depend on both Settings and the active Config. If a website won't open, DNS is one thing to check, but not every connection failure is a DNS problem.
How to set it: Note the current DNS settings and check whether the configuration file defines DNS separately. Identify which part of resolution you need to change, then adjust one option at a time. Request the same domain again and compare the result. When choosing a DNS service, consider its traffic path and privacy practices; don't replace all your settings based on a single latency reading.
Keep in mind: Being able to connect by IP address but not by domain suggests a possible DNS issue, but it isn't conclusive. The TLS server name, cache, and IPv6 reachability can also affect the result. After making a change, distinguish cached results from new connections and check that the resolved address matches the connection behavior.
What they are and where to find them: Test Method selects how connections are tested and is usually found in Settings. Connectivity Test on Home runs a test against a server. Different methods check different stages, so don't compare results without considering the method used.
How to set it: Choose from the test methods shown in your app. Keep the method, server, and network conditions the same when repeating a test. If the test uses a target, keep that consistent too. First check whether the test completes, then compare how the result changes. Don't treat one unusually low reading as representative of long-term performance.
Keep in mind: A reachable port doesn't confirm successful authentication, and one successful request doesn't mean every destination is reachable. If a test times out, check the local network, server address and port, protocol settings, and system time in that order. Don't just increase the timeout without investigating the cause of the failure.
What it is and where to find it: Today Widget provides a quick access point through system widgets. Look for related options in Settings. Add and arrange widgets in the system's widget interface; availability and actions depend on your current system and app version.
How to set it up: First confirm that your selected server, Global Routing mode, and manual connection work in the app. Then add an available Shadowrocket widget in the system's widget editor. After using it for the first time, return to the app and check that the result matches what you expect.
Keep in mind: A widget is a shortcut, not a replacement for configuration management, and it can't fill in missing server details. If the widget and app show different states, open the app to check first, then check whether the system has refreshed the widget. Don't assume a connection succeeded based only on the widget label.
What it is and where to find it: iCloud sync transfers supported data. Check the relevant options in Settings and your system iCloud settings. Sync is not the same as a standalone backup: changes and deletions may propagate to other devices, so don't treat sync as an archive that keeps every previous version.
How to set it up: Confirm that your devices use the intended iCloud account and that the system allows Shadowrocket to use iCloud. Then enable sync using the options currently available in the app. Before enabling it for the first time or moving to a new device, save a restorable copy of your configuration. After sync completes, check Config, server entries, and related settings one by one.
Keep in mind: Don't assume temporary states, logs, or system permissions will transfer between devices. Subscription URLs may contain authentication details; store exported copies somewhere secure. Before editing on two devices at once, decide which copy to keep and wait until you have confirmed sync results before making more changes.
What it is and where to find it: Diagnostics helps collect or review information for troubleshooting. Look for it in Settings. Available tools and output vary by app version. Choose tools based on the part that is actually failing instead of running every option in sequence.
How to use it: Note when the issue occurs, the network type, Global Routing mode, selected server, and what happens. Reproduce the issue once, then review the relevant output. Focus on errors close to the time of failure and compare them with connection records in Data. For a complete process, follow the symptom-based steps in Troubleshooting.
Keep in mind: Diagnostic records may contain addresses, domains, and authentication details. Hide subscription URLs, passwords, and other sensitive information before sharing; don't publish your entire configuration. Interpret individual errors in context—normal retries or cancellations don't necessarily mean every connection failed.
For every change, be able to say what changed, how to reproduce the issue, what happened, and how to roll back.
If you haven't made your first connection yet, start with the Shadowrocket setup guide. For repeatable connection failures, follow Troubleshooting. Purchase recovery, platform options, and downloads are covered in Download Shadowrocket. There's no need to keep deleting the app just to troubleshoot a setting.
Platforms and pricing: Shadowrocket for iPhone and iPad is a one-time $2.99 purchase on the App Store; check the App Store listing for system requirements. The Mac (Apple silicon and Intel), Windows, Android, and Linux versions are free, with installers available from this site at /dl/. App pricing is separate from the cost of any service you already use.