Choose a Global Routing mode first, then check Config and your server. Find menu locations, setup steps, and requirements by feature to avoid changing multiple options at once and making issues harder to trace.
Shadowrocket is available for iPhone, iPad, Mac, Windows, Android, and Linux. The steps below use iPhone and iPad as a reference. Menus and system capabilities may vary on other platforms; follow the options shown in your version of the app.
The iPhone and iPad version costs $2.99 as a one-time App Store purchase. Check the App Store listing for system requirements. The Mac (Apple silicon and Intel), Windows, Android, and Linux versions are free.
Choose how to handle traffic first
Open Global Routing from Home. Config, Proxy, and Direct are three common modes that determine whether connections are handled according to rules.
What it is: Global Routing is the main control for traffic handling, not a server list or protocol type. With Config selected, the app applies the rules in the active configuration file. With Proxy, connections routed through the app are handled by the proxy. With Direct, they connect directly. Don’t use this setting alone to infer how system-restricted traffic or traffic outside the app is handled.
How to set it: For your first setup, select an existing, working server on Home, open Config to confirm the active configuration file, then return to Global Routing and choose Config. To check whether a rule is causing an issue, temporarily switch to Proxy and test the same destination again; restore your original setting afterward. To compare access over your current local network, temporarily choose Direct.
| Mode and interface label | How it handles traffic | When to use it | What to check |
|---|---|---|---|
| Config | Matches connections against the rules in the active configuration file. | For everyday routing based on domains, address ranges, and other conditions. | The active configuration file, rule order, and final policy. |
| Proxy | Handles connections routed through the app using a proxy. | To temporarily check whether the proxy server and destination are reachable. | The selected server and its connection settings. |
| Direct | Handles connections routed through the app directly. | To compare access over your local network or check for proxy-related issues. | Your local network, DNS, and the destination service. |
Keep in mind: Proxy can’t fix an unavailable server, and Direct doesn’t turn off the system VPN configuration. To stop the app from handling connections entirely, use the connection switch on Home. Some versions also show Scene, but it doesn’t change how the three basic modes in this section work. If you don’t need to switch scenes, troubleshoot with the clear-cut Config, Proxy, or Direct modes first.
Conditions determine what matches; policies determine where it goes
View the active configuration file in Config. Only when Global Routing is set to Config should you use this file to understand routing results.
What they are: Each rule consists of a matching condition and a handling policy. DOMAIN matches an exact domain; DOMAIN-SUFFIX matches a domain suffix; DOMAIN-KEYWORD matches a keyword in a domain. IP-CIDR and IP-CIDR6 specify IPv4 and IPv6 address ranges, respectively, while GEOIP matches based on the address’s geographic location. USER-AGENT uses request details; whether that information is available depends on the connection, so it shouldn’t be treated as a universal way to identify apps.
Where to find them and how to set them: Open the active configuration file from Config and check the [Rule] section. Order rules from specific to broad. Place exact domains or local network ranges appropriately, then use FINAL to set a policy for connections that don’t match earlier conditions. Keep a copy of the original configuration before editing, change one condition at a time, and confirm that this file is still active after saving.
[Rule]
DOMAIN-SUFFIX,example.com,PROXY
DOMAIN-KEYWORD,example,PROXY
IP-CIDR,192.168.0.0/16,DIRECT
GEOIP,CN,DIRECT
FINAL,DIRECTexample.com is a documentation domain. Write production rules to suit your own access needs and existing configuration.
Understanding policies: PROXY routes through a proxy policy, DIRECT connects directly, and REJECT blocks the connection. If the file references a custom policy name, confirm that the server or group it points to exists. Rules are usually evaluated in order, so an earlier, broader condition may prevent a later, more specific one from matching.
Keep in mind: A domain appearing in the configuration file doesn’t prove that its rule is active. Also check Global Routing, the active file, and the actual destination shown in connection logs. Some requests use an IP address directly or continue to other domains; use the logs to investigate instead of repeatedly broadening keyword matches. For an overview of each section, see .conf file structure explained.
Handle importing, updating, and selecting separately
Use Home to view and select servers, Add Server to add details, and Subscribe to manage subscriptions.
What they are: An individual server entry stores a set of connection details. A subscription retrieves and updates a group of server entries. Updating a subscription is different from updating a Config file: the former may change the server list, while the latter changes rules and other configuration content. After importing a server, you still need to select the right Global Routing mode and configuration file.
How to set them up: If you already have a subscription URL, choose Subscribe from Add Server on Home, enter the URL and a recognizable label, then save, update, and confirm that the list populates. If you have details for an individual server, enter the address, port, and authentication fields for its protocol. Shadowsocks, VMess, VLESS, Trojan, Hysteria2, and WireGuard use different fields; don’t just change the protocol name while leaving incompatible settings in place.
Scan QR Code and clipboard import are useful when you already have share details. After importing, check the protocol, address, and required settings, then run Connectivity Test. Test results can help narrow down issues but don’t replace checking actual access. List order doesn’t guarantee that the selected entry works. Give each subscription a distinct name and, after updating, check that the previously selected server is still there.
Keep in mind: Subscription URLs may contain access credentials, so don’t share the full URL or its QR code when troubleshooting. Before editing entries created by a subscription, check whether the next update will overwrite your changes. Save any details you need before deleting a subscription; removing it from the list is different from disconnecting. For full steps on importing, updating, sorting, deleting, and backing up, see the subscription and server management guide.
Connect manually first, then set up triggers
Find On Demand in Settings. Use the Wi-Fi, Cellular, and other conditions shown in your version of the app.
What it is: On Demand uses system-supported conditions to trigger a connection, which is useful when you want to connect automatically on certain networks. It controls when a connection starts, not whether a domain goes direct or through a proxy; that’s determined by Global Routing and your rules.
How to set it up: Turn off On Demand conditions first, then connect manually and confirm that the server, Config, and DNS work as expected. Next, open On Demand and set Wi-Fi or Cellular conditions to suit your needs. If the app offers conditions based on Wi-Fi network names, check each name carefully to avoid confusion between similar networks. After saving, check the connection status on both target and non-target networks, then test what happens when the device is locked, unlocked, or switches networks.
Keep in mind: System-triggered connections depend on specific conditions; On Demand doesn’t mean every app will always keep the same session active. If a connection drops and reconnects, check whether On Demand is still enabled before deleting the VPN configuration. To troubleshoot, temporarily turn off On Demand and use the manual switch so automatic reconnections don’t interfere with testing. Background behavior varies by platform, so don’t assume mobile conditions apply elsewhere.
Stats are for troubleshooting, not billing
Use Data to view the traffic stats and connection details available in your version of the app. Check what’s included before interpreting the numbers.
What it is: Data shows traffic handled by the app and related records. It can help you check whether a request appeared, identify its destination, and see whether a rule behaved as expected. Displayed stats depend on the logging scope, any cleared records, and how the connection was made. They don’t include all device network traffic or replace usage records from your service provider.
How to use it: When troubleshooting a webpage, note the current state, visit just one destination, then return to Data to look for the corresponding record. If rule or policy details are available, check the destination domain, matching condition, and handling policy together. If there’s no new record, first check the connection switch, whether the page actually sent a new request, and whether the request was served from cache.
Keep in mind: Save any records you need for comparison before clearing them. Upload and download stats may differ from file sizes shown by apps because of protocol overhead, caching, or the reporting period; don’t use them to judge whether server billing is accurate. Connection logs may include visited domains and other personal information, so review screenshots and logs before sharing them.
Keep the original value; change one thing at a time
Find these options in Settings. Availability and menu locations vary by platform and app version.
What it is and where to find it: DNS resolves domain names to IP addresses. Look for related options under DNS in Settings and in the [General] section of the configuration file. DNS settings, request routing, and caching can all affect what you observe, so changing one address alone doesn’t prove that DNS behavior has fully changed.
How to configure it and what to watch for: Note the current settings and check whether the active configuration includes DNS parameters. Adjust DNS only when there’s a clear indication of a resolution issue, such as a failed lookup or an unexpected result. After making a change, reconnect and revisit the same destination. If the app offers an option to clear the DNS cache, use it when needed. Don’t change DNS, servers, and rules at the same time, or you won’t know what caused the difference. If a connection is established but webpages won’t load, the server or destination service may be the issue.
What it is and where to find it: Test Method in Settings determines how Connectivity Test runs. Different methods check different stages, so their results aren’t directly comparable. A successful test only confirms that the path covered by that test responded.
How to set it and what to watch for: Choose a method offered in the app, and use the same method and test destination when comparing servers. Retest after switching between Wi-Fi and Cellular; results from one network don’t carry over to the other. If every entry fails, check your local network and the test destination first. If only one entry has an issue, check its server settings. Always verify with a real request; a successful test in the list doesn’t prove that every website is reachable.
What it is and where to find it: Today Widget is a quick-access feature that depends on system support. Check for related options in Settings, then configure it from the system’s widget gallery. It doesn’t replace the full settings in Home or Config.
How to set it up and what to watch for: Set up your server and Global Routing in the app first, then add a widget supported by your system. Check that the widget reflects the app’s current status. If it doesn’t update promptly, return to the app and confirm the actual connection state. Widget types, locations, and controls vary by system. If your device doesn’t show the option, don’t follow steps for a different system.
What it is and where to find it: iCloud options are in Settings. Availability depends on the platform, system account, and cloud permissions. Check the sync scope shown in the app; don’t assume that all servers, rules, and runtime states sync together.
How to set it up and what to watch for: Make sure you’re signed in to your own iCloud account and have allowed the necessary access. Save important local configuration before enabling sync. When setting up another device, compare local and cloud content before deciding what to do next, so you don’t delete entries before confirming the sync direction. Sync isn’t a separate historical backup. Subscription URLs and server credentials are sensitive, and exported files should be stored securely. For other platforms, use the data migration features they actually provide.
Reproduce the issue under the same conditions
Find Diagnostics in Settings. Compare its results with server tests on Home and records in Data; no single check tells the whole story.
What it is: Diagnostics brings together the troubleshooting tools available on your platform to help check network, DNS, and connection stages. Before running a check, decide what you need to find out: whether the local network works, the server responds, a domain resolves, or a particular rule takes effect. Each question requires different evidence.
How to use it: Note your network type, Global Routing mode, and configuration file name. Then reproduce the issue once using the same destination. Verify each item below in order, retesting after every change and saving the results before moving on.
Keep in mind: Before enabling additional logs, check what they save. Turn off any logs you no longer need once troubleshooting is complete. When describing an issue to someone else, include steps to reproduce it, error messages, and checks you’ve already tried. Don’t share full subscription URLs, passwords, or authentication details. For a step-by-step checklist, see Connected but no internet? Troubleshooting checklist.
To look up an interface label or rule keyword, see the glossary. To start with adding a subscription, follow the first-time setup guide.