This guide is for users who are new to Shadowrocket, can open the app, but are unsure what each entry does. You’ll learn the four bottom tabs, the four Global Routing modes, common rule actions, and entries such as Add Server, Subscribe, and On Demand.
Understand the four bottom tabs first
Shadowrocket’s bottom navigation usually centers on Home, Config, Data, and Settings. These are not four connection modes, but four management areas: Home selects servers and controls the connection, Config handles configuration files and rules, Data shows traffic records, and Settings manages app behavior. To find a setting, first decide whether it concerns a connection, routing rules, usage data, or app behavior.
Home is the page used most often. It shows the connection switch, current server, Global Routing, server list, and latency test results. The switch only starts or stops network handling; which server is used and whether traffic follows rules depend on the selected item and Global Routing.
Home: Connection entry point and current status
Each row in the server list represents a connection that was imported or added manually. After selecting a row, it becomes the active item. The latency value only shows the response time for the test request; it does not equal page-load speed or available bandwidth. If latency is blank, times out, or is high, check the test method, server availability, and local network separately.
The “+” in the upper-right corner of Home opens Add Server. If you already have connection details from your own provider, choose the matching Type—such as Shadowsocks, VMess, VLESS, Trojan, Hysteria2, or WireGuard—and fill in the required fields, including Address, Port, Password, UUID, or Public Key. Each protocol has different requirements, so do not enter one protocol’s parameters under another Type.
Config: Rule files, not the server list
The Config page stores configuration files used for traffic routing. A configuration file can contain rules, DNS behavior, and policy references, while server entries are mainly managed in Home. If a server connects but some domains take the wrong route, first check the active file and rule order in Config instead of repeatedly deleting servers.
- Home: Select a server, test latency, toggle the connection, and switch Global Routing.
- Config: Select and manage routing configurations, and check rule priority.
- Data: Monitor uploads, downloads, connection requests, and traffic changes.
- Settings: Adjust DNS, On Demand, Subscribe updates, and diagnostic options.
Global Routing: Config, Proxy, Direct, and Scene
Global Routing determines the overall handling mode for traffic. It appears on the Home page; Global refers to the routing decision, not a specific server. Common options include Config, Proxy, Direct, and Scene. After switching modes, new connections are handled according to the selected mode.
Config reads the active configuration file and evaluates rules in order. A domain matching DOMAIN-SUFFIX may use Proxy, while a local IP matching IP-CIDR can use Direct, and an ad domain can be sent to Reject by an explicit rule. Rules are usually matched from top to bottom, with the first match taking priority, so specific rules should come before broader ones.
Config
RecommendedRead the active configuration file and choose a policy using rules such as DOMAIN-SUFFIX, GEOIP, IP-CIDR, and FINAL.
Best for: routing everyday traffic by domain and network range
Proxy
Send traffic that can be handled to the current proxy path, generally without using ordinary routing rules to select Direct.
Best for: temporarily checking whether rules cause access differences
Direct
Connect directly to the destination without using the current server. The connection switch may remain on, but the routing result is Direct.
Best for: comparing behavior over the local direct connection
Scene
Use the behavior defined by the selected Scene for different network conditions. The exact result depends on the Scene configuration.
Best for: switching predefined modes by network environment
Proxy, Direct, and Reject: Actions that define the final result
Proxy, Direct, and Reject often appear at the end of rules and in Log or connection records. They answer “what should happen after a match,” while DOMAIN-SUFFIX, GEOIP, and IP-CIDR answer “what condition should be matched.” Conditions and actions are different concepts; identify them by their comma-separated positions when reading rules.
Proxy sends a matched connection through the proxy policy; Direct connects to the destination directly; Reject denies the request. Reject is not a connection error. If an explicit rule matches a domain with Reject, the resulting inaccessibility is expected. To restore access, locate and adjust the relevant rule instead of changing DNS and retrying.
DOMAIN-SUFFIX,example.com,PROXY
DOMAIN,local.example.com,DIRECT
GEOIP,CN,DIRECT
IP-CIDR,192.168.0.0/16,DIRECT,no-resolve
DOMAIN,ads.example.com,REJECT
FINAL,PROXYThe first line matches example.com and its subdomains and sends them to Proxy. The second matches only the exact domain local.example.com. The third uses GEOIP data to evaluate an IP range. The fourth matches the private 192.168.0.0/16 network and uses no-resolve to avoid an extra DNS lookup for the IP rule. The fifth actively rejects a specified domain. FINAL handles connections not matched by any earlier rule.
| Interface term or keyword | Function | What to check |
|---|---|---|
| DOMAIN | Match the complete domain name | Only handles the specified hostname |
| DOMAIN-SUFFIX | Match a domain suffix | Can cover subdomains under the same suffix |
| GEOIP | Match using the geographic database for the destination IP | Depends on the resolved destination IP and database contents |
| IP-CIDR | Match an IP range | For example, 192.168.0.0/16; the number after the slash is the prefix length |
| FINAL | Handle connections not matched by earlier rules | Usually placed at the end of the rule list |
Add Server and Subscribe: Two import paths
Add Server adds connection details, while Subscribe saves a subscription URL you already have. Both can start from the “+” in the upper-right corner of Home, but they produce different results: a manual entry usually creates one server item, while updating a Subscribe entry can generate a set of items returned by that URL. Shadowrocket does not provide line services, and a one-time app purchase does not include servers or subscriptions.
When adding Subscribe, use a URL from your own provider. For example, a test format could be https://example.com/sub?token=xxxx; this is only a format example and will not return usable content. A real URL is a connection credential, so do not expose it in screenshots, public logs, or shared text.
Open the add page
Go to Home, tap “+” in the upper-right corner, and open Add Server.
Choose Type
For one connection, choose the protocol that matches the available details. For a subscription URL, set Type to Subscribe.
Fill in the required fields
For Subscribe, enter the URL and a label. For a manual connection, enter Address, Port, and the authentication fields required by the protocol; for example, enter 443 as the server port if that is what your details specify.
Save and update
After saving, return to Home. A subscription entry can be refreshed with pull-to-refresh or its corresponding Update action.
Select, then test
Select an item and run a latency test before enabling the connection. A latency result only confirms a response from the test path; it does not prove that every domain rule is correct.
Data and Log: Statistics and diagnostics are different
Data is mainly for viewing traffic changes during use. Upload and download values can show whether a connection generated data, but they cannot by themselves prove whether a rule used Proxy or Direct. A rising counter only confirms network transfer; to identify the domain, destination, and policy result, also check Log or Connectivity Test.
Log is a per-connection troubleshooting tool. Records commonly include the domain, destination IP, port, matched rule, and final policy. For example, HTTPS sites commonly use destination port 443; if a record shows a domain matching DOMAIN-SUFFIX and using DIRECT, return to Config and inspect that rule instead of judging only by the server latency shown in Home.
Use symptoms to identify where to check
- Data barely changes: confirm that the connection switch is on, the current network is working, and the app is actually making requests.
- Data shows traffic but the destination will not open: check the domain, port, policy, and error stage in Log.
- Only some domains fail: check the order of DOMAIN, DOMAIN-SUFFIX, and FINAL in Config.
- A local network device cannot be reached: check for the relevant IP-CIDR rule and confirm that the final action is Direct.
- Access returns after switching to Direct: focus on the server parameters, current policy, and DNS resolution path.
Settings: On Demand, DNS, and subscription behavior
Settings manages app-level behavior. Common entries include On Demand, DNS, Subscribe options, Connectivity Test, and logging settings. These switches may affect every connection, so record the original state before changing anything, change one item at a time, and retest with the same website on the same local network.
On Demand triggers connections based on conditions. The exact path is Settings → On Demand. After enabling it, continue checking the conditions and current network scene; turning on the main switch without suitable conditions does not mean every network change will trigger a connection as expected. When troubleshooting automatic connections, distinguish between “not triggered,” “triggered but connection failed,” and “connected but routed through Direct.”
Open Settings
Open Settings at the bottom, then enter On Demand.
Check the main switch
Check whether On Demand is enabled and confirm that the required conditions are configured.
Switch networks and retest
Switch between a known-working Wi-Fi network and cellular data, and observe whether the connection state changes according to the conditions.
Check routing
Return to Home and check Global Routing. If it is Direct, access may still appear to use a direct connection even when the connection was triggered.
Review the records
Use Log to distinguish an unmet condition, a server connection error, a DNS resolution failure, or an unexpected rule match.
DNS resolves domain names to IP addresses. If the latency test returns a value but a domain will not open, while direct access to a known IP behaves differently, DNS is one layer to investigate. Do not change the server, Global Routing, DNS, and configuration file at the same time, or you will not know which change made a difference.
Why is traffic still direct when the Home switch is on?
Check Home → Global Routing. If it is currently Direct, traffic will use Direct even with the connection switch enabled. To use rule-based routing, switch back to Config and confirm that the correct configuration file is selected.
Should I choose Proxy or Config?
Use Config when you need to route different domains and network ranges separately. Proxy is better for a short comparison test, such as checking whether a Direct rule is causing the problem.
What should I do when latency is normal but a website will not open?
First check whether Log contains a record for the destination domain, then review the matched policy, destination port, and DNS result. A successful latency test only means that the test request received a response.
Why are there no servers after saving a subscription?
Return to Home and use pull-to-refresh or the relevant Update action, and check that the URL is complete. If it times out, verify the current network, connection state, and Subscribe update behavior in Settings.
Does Reject mean the server failed?
No. Reject is an explicit denial action in a rule. In Config, locate the matching DOMAIN or DOMAIN-SUFFIX rule and confirm that the result is consistent with the purpose of the configuration.
Turn the interface terms into one complete workflow
A complete workflow can be understood as follows: in Home, use Add Server or Subscribe to add connection details you already have, then select a server; in Config, select the configuration file used for routing; return to Home and set Global Routing to Config; after enabling the connection, monitor traffic in Data and use Log to check whether DOMAIN-SUFFIX, IP-CIDR, or FINAL matched Proxy, Direct, or Reject; when automatic triggering is needed, configure the conditions under Settings → On Demand.
This workflow also applies to troubleshooting. Home answers “is it connected, and which item is selected?” Config answers “which rules are being used?” Data answers “is traffic being generated?” Log answers “what happened to the specific request?” Settings answers “how is app-level behavior configured?” Checking each layer in order helps prevent rule issues from being mistaken for server issues, and prevents an expected Direct result from being mistaken for a failed connection.
- Wrong connection item: check the selected entry and protocol fields in Home.
- Wrong routing direction: check Global Routing and rule order in Config.
- Automatic connection issue: check the switch and conditions under Settings → On Demand.
- Subscription content has not changed: run Update and check the Subscribe URL and network used for the update.
- A specific request failed: trace it layer by layer using the domain, IP, port, policy, and error details in Log.
Shadowrocket is a closed-source commercial app for Apple platforms, primarily used on iPhone and iPad. Compatibility with Mac, Apple TV, and Apple Vision can be checked on the same App Store product page; system requirements are as listed on the App Store page. The only official source is the App Store. When verifying the app, check the developer name, Shadow Launch Technology Limited, and app ID 932747118.