Look up terms by interface location and configuration purpose. First check where a term appears, then determine whether it refers to a connection mode, a protocol setting, or the outcome of a rule.
This page assumes you already have your own subscription or server details. Menu locations may vary by platform. Interface terms such as Home, Config, and Global Routing remain in English to help you follow along.
Find the interface option → check protocol settings → review rule matching → verify subscriptions and system permissions. Each term heading has its own link, making it easy to bookmark a troubleshooting step.
INTERFACE
First distinguish where an option appears from how it handles connections. The same term can mean different things in different parts of the app.
The main screen for viewing saved servers, the current selection, and the connection toggle. After importing, confirm that the entry appears and that the correct server is selected. A server in the list is saved information, not proof that a tunnel is connected.
The control for choosing how traffic is handled overall. Config, Proxy, and Direct correspond to different modes; Config is typically used when connections are handled by rules. This controls the overall mode, not where you add a server or the keyword for an individual rule.
In the navigation, Config is the screen for managing configuration files. In Global Routing, it is the option for handling connections according to the current configuration. After choosing it, verify which file is enabled. Downloading a configuration without selecting it does not mean its rules are active.
These are the two overall handling modes in Global Routing: Proxy routes typical traffic through a proxy, while Direct connects typical traffic directly. Direct does not turn off the client or disable all DNS and request handling. You can briefly compare the modes while troubleshooting, then restore your original settings.
A mechanism that triggers a system VPN connection based on configured conditions, which may include network types such as Wi-Fi and Cellular. It determines when a connection starts; rules determine where traffic goes. If the connection starts again after you turn it off, check these conditions rather than repeatedly deleting servers.
The option for manually adding a server using details you already have. Select the protocol, then enter the address, port, and authentication settings. Available fields vary by protocol. Check TLS, server name, and transport settings against the original details; an address and password may not be enough.
A tool for checking server connectivity, often used to check latency or identify entries that are temporarily unreachable. Results depend on the test method, current network, and destination response; they do not directly indicate download speed. When comparing entries, use the same test method and consider actual access results.
PROTOCOLS
A protocol determines how the client and server exchange data; it does not indicate the server's location or performance. Use your existing server details when entering settings.
An encrypted proxy protocol. Common settings include the server address, port, encryption method, and password. The encryption method must match the server; do not change it based on the protocol name. Check any additional parameters in your existing details as well—a shared address does not mean different protocols can use the same authentication information.
A proxy protocol whose connection settings typically include a UUID and may also specify transport and TLS options. The UUID, transport path, Host, and server name are separate fields and cannot replace one another. If the connection fails after importing, compare each setting with the original details rather than checking only the protocol name.
A proxy protocol that uses a UUID to identify the user and relies on corresponding transport and security settings. The name VLESS alone does not tell you whether TLS is enabled or what values to use for other settings. When entering details manually, preserve all authentication, security, and transport information from your source.
A proxy protocol commonly used with TLS, with a password as a typical authentication field. The server name and certificate verification settings must match the server configuration; the connection address and certificate name may serve different purposes. For certificate errors, check the name and device time first rather than treating disabled verification as a universal fix.
A QUIC-based proxy protocol. Check authentication, TLS, and related settings. QUIC uses UDP, so how the current network handles UDP may affect connectivity. The fact that another protocol connects does not prove this entry's settings or network conditions are correct.
A key-based tunneling protocol that commonly uses a private key, peer public key, tunnel addresses, and route ranges. A correct key does not guarantee correct routing or DNS; check these settings together. Private keys are sensitive: remove them before sharing configurations or troubleshooting screenshots.
RULE MATCHING
A rule typically consists of a match type, a match value, and an action policy. The keyword specifies how to match; the policy at the end specifies what to do when it matches.
DOMAIN matches an exact domain; DOMAIN-SUFFIX matches a domain and its subdomains; DOMAIN-KEYWORD checks whether a domain contains a specified keyword. Their matching scopes differ, and keyword matching is especially prone to unintended matches. For more precise control, identify the target domain before choosing a match type.
These rules match IPv4 and IPv6 address ranges, respectively. The prefix length after the slash defines the range. For example, 192.168.0.0/16 is a private IPv4 address range, not a single server. IP and domain rules match at different levels; when troubleshooting, consider the actual DNS result and rule order.
Matches destination addresses using regional data from an IP geolocation database, as in GEOIP,CN,DIRECT. Matching is not based on a website's language, the device's region, or a domain suffix. For sites using distributed services, destination IPs may change, and database results may differ from expectations.
Sets a fallback policy for connections that do not match earlier rules, usually at the end of the rule list. FINAL,DIRECT and FINAL,PROXY produce different results, so FINAL does not inherently mean proxy. If traffic takes an unexpected route, check both this rule and any earlier rule that matched.
Uppercase policy values in rules: PROXY routes traffic through a proxy, DIRECT connects directly, and REJECT blocks the connection. These are not protocol names or server import formats. The interface options Proxy and Direct are related to the uppercase rule values, but work at a different level; note where the term appears when reporting an issue.
Rules are generally checked from top to bottom. The first matching rule determines the action, and a similar rule later in the list does not automatically override it. Put precise rules that need priority before broader rules that might match first. After editing, confirm the file is saved and selected, then test the same destination again.
SUBSCRIPTIONS & CONFIGURATION
Subscriptions sync existing server details; configuration determines how connections are handled. Importing, updating, selecting, and connecting are separate steps—one does not replace checking the others.
The option for importing and updating a subscription you already have, which typically contains multiple server entries. A subscription URL may include access credentials; do not post it in logs, screenshots, or support requests. This site explains how to manage existing subscriptions. For organizing server entries, see the Server Management Guide.
In the client, this usually means a connection entry containing a protocol, address, port, and authentication settings. Multiple entries may use the same underlying infrastructure, and list names are just labels. Check the settings and connection results to determine whether an entry works; a region or description in its name is not enough.
Reloads an existing subscription URL and syncs server entries with the returned content. A successful update means the content was read, not that every server is reachable or that a rule file was updated. If an update fails, first check that the URL is complete and accessible on your current network, then review the error message.
A common file extension for Shadowrocket configuration files, which can contain sections such as [General], [Rule], [Host], and [URL Rewrite]. These files organize settings and handling logic; they are not server subscriptions. Keep a copy before editing, then verify which file is selected so you can trace the effects of your changes.
DNS resolves domain names to IP addresses and is an important part of accessing websites. A page may fail to load even when the server connection works if domain resolution fails. Distinguish DNS failures from connection timeouts and rule matching issues. Avoid changing DNS and routing settings all at once, so you can compare results.
A configuration section that rewrites request URLs or applies actions based on configured conditions. It concerns request content and match expressions, not proxy route selection, and does not replace routing rules such as DOMAIN-SUFFIX. Check the match scope and action before editing; if something goes wrong, compare with the previous configuration and restore settings one at a time.
The option for importing connection details from a QR code. What gets imported depends on the data encoded in the code. After scanning, verify the protocol, address, and required fields; successful recognition does not mean the connection works. QR codes may contain passwords or subscription credentials, so treat them as sensitive configuration when sharing.
SYSTEM & INSTALLATION
System permissions, app purchase records, and server settings are separate. Before installing or restoring the app, confirm the device, account, and file source.
The configuration and authorization the system needs to create a tunnel for the app. You may see a prompt to add it the first time you turn on the connection. Allowing it does not import a server or mean the connection is established. If you accidentally tap Deny, return to the app and try connecting again, then check the existing configuration in system VPN settings. Confirm which item you are changing before you proceed.
The App Store option for finding existing purchases. When changing devices or reinstalling, first check the account used for the purchase. The iPhone / iPad version is a one-time $2.99 purchase on the App Store; the Mac / Windows / Android / Linux versions are free. Verify the developer, Shadow Launch Technology Limited, and app ID 932747118. Check the App Store listing for system requirements.
The processor type an installer is built for, which is not the same as the operating system. On Mac, check the chip or processor in About This Mac and choose the Apple Silicon or Intel version; each uses a different DMG installer. For Windows, Android, and Linux, follow the labels on the all-platform download page rather than relying on the device's appearance.
A confirmation the system may request during installation or the first launch. Before proceeding, confirm the installer is from this site's /dl/ path. In Windows SmartScreen, follow the prompt to view “More info”; on macOS, check “Open Anyway” in Privacy & Security; on Android, allow your current browser to install unknown apps. For platform-specific steps and Linux execution permissions, see the installation permissions guide. Do not disable system-wide protections just to install the app.
Once you understand a term, follow the guide for your current task. You do not need to change every setting at once.
Follow the steps in order: add your existing details, check Global Routing, turn on the connection, and verify the result. Complete one connection you can check before adjusting rules.
Read the setup guide →Learn how Subscribe, manual fields, QR code imports, update settings, and backups work together. Keep the original details before cleaning up duplicate entries.
View the server management guide →