Look up terms by interface location and configuration purpose. Learn the difference between connection modes, protocol parameters, and rule policies.
This page retains interface terms, protocol names, and rule keywords in their original English. Use the context to identify a term's meaning before reading its definition. For example, interface Proxy and rule keyword PROXY are related but operate at different levels.
These terms appear in page navigation, connection settings, and test tools. When the same term appears in different places, first check whether it refers to a mode selected in the interface or a rule edited in a configuration file.
Controls how traffic is handled overall. The three common modes are Config, Proxy, and Direct. Config routes traffic according to configuration rules, Proxy sends applicable traffic through the selected proxy, and Direct connects directly. If a rule is not taking effect, first check whether Config is selected here.
Can refer to either the page for managing configuration files or the Global Routing mode that handles traffic according to configuration rules. The page lets you view, import, and select configurations; the mode determines whether connections follow those rules. Importing a configuration file alone does not select it or switch to the corresponding mode.
A feature that connects the VPN when specified conditions are met. Its behavior depends on whether it is enabled and on the conditions configured. It does not provide a server or replace routing rules. After changing it, test under the network conditions where you intend to use it to confirm that the connection starts as expected.
An entry point for adding server details. Select a protocol and enter the corresponding address, port, and authentication parameters. Get existing server details from your service provider; a link's appearance alone cannot tell you which fields are required. Saving an entry only records the parameters—you still need to select it and test the connection.
Checks connection reachability and response time, and is commonly used for Shadowrocket latency tests. Results depend on the test method, target, and current network; they do not measure sustained transfer speed. For meaningful comparisons, keep test conditions consistent and also check whether the services you need work as expected.
A protocol defines how the client and server communicate. The descriptions below explain field meanings; protocols are not interchangeable. Check all parameters against the server details you have before entering them.
Establishes a proxy connection using a specified encryption method and password. The server address and port identify the remote endpoint. The encryption method must match the server's; similar names do not make methods interchangeable. If authentication fails, check each parameter individually rather than changing several fields at once.
A proxy protocol that authenticates using parameters such as a user ID. Configurations commonly include transport and TLS options as well. Authentication, transport settings, and certificate validation are separate layers; correct user credentials do not mean the other layers are configured correctly. Follow the field mappings provided by your service provider.
Authenticates using a user ID, but the protocol name alone does not describe the security of the complete connection. The connection also depends on the transport, TLS, and other server requirements. Do not rename an entry for a different protocol and expect it to work; check all parameters against the target server's documentation.
Typically protects the connection with TLS and uses password authentication. The connection address, the domain required for TLS, and certificate validity can all affect the result. If you encounter a certificate error, check the domain, device time, and server certificate first. Disabling verification should not be the default fix.
These are two distinct proxy protocols, and some servers also require a username and password. Check the connection configuration to determine whether the client-to-proxy link is protected; the protocol name alone is not enough. Distinguish the proxy endpoint from the final destination, and do not enter a website address as the server address.
Creates an encrypted tunnel using public and private keys. Configuration usually includes a local key, peer public key, endpoint, and address parameters. Each key belongs in a specific field; public and private keys are not interchangeable. A private key is sensitive—do not share a complete configuration or a screenshot showing the key when troubleshooting.
A QUIC-based proxy protocol whose connection depends on whether the current network can carry UDP traffic reliably. In addition to the address and authentication details, check the TLS parameters and server protocol generation. If other protocols connect but this one does not, do not assume the password is wrong; check network conditions too.
The first part of a rule defines its match condition; the last part specifies the policy. The example.com domain and private address ranges below are for explaining the syntax only. Check the match scope and rule order against your own needs before using them.
Matches one exact domain and does not automatically include all its subdomains. Use an exact rule when you need to handle a specific hostname and keep the match scope narrow. Enter the domain itself, without the URL scheme or path.
DOMAIN,example.com,PROXYMatches a domain suffix, covering the specified domain and its subdomains. The example matches both example.com and its subdomains, but does not match arbitrary character sequences. If a subdomain needs different handling, put the more specific rule first.
DOMAIN-SUFFIX,example.com,PROXYChecks whether a domain contains a specified keyword. This can match a much wider range than a suffix rule, and short or common keywords can catch unrelated domains. List the intended matches first; if you only need a domain and its subdomains, use a more precise condition.
DOMAIN-KEYWORD,example,PROXYUses an IP geolocation database to determine whether a destination address belongs to a specified region. This describes how the database classifies the destination IP—not the visitor's location or where the website operator is based. Changes to DNS results or the database can affect the match.
GEOIP,CN,DIRECTUsed to match IPv4 and IPv6 address ranges. The number after the slash is the network prefix length, not a port. The IPv4 example covers a private address range; the IPv6 example covers the loopback address. The wider the range, the more carefully you should check its effect on other destinations.
IP-CIDR,192.168.0.0/16,DIRECT
IP-CIDR6,::1/128,DIRECTSets the final policy for traffic that did not match any earlier rule, and is usually placed at the end of the rule list. It is a fallback for unmatched traffic, not an override for existing matches. If placed too early, it can prevent later specific rules from matching.
FINAL,PROXYA policy keyword in a rule that sends matching connections through a proxy. The server used depends on the current selection and policy references in the configuration. This is not the same setting as Proxy in Global Routing: the rule keyword determines the result for a specific rule, while Global Routing controls the overall mode.
Sends matching destination connections directly, without using the proxy specified by that rule. Success still depends on the local network, DNS results, and destination service. DIRECT in a rule only applies to matching traffic; it does not switch Global Routing to Direct.
Rejects matching connections, which is useful for requests that should not be sent. An incorrect match scope may also block connections needed for sign-in, verification, or loading content. Keep a recoverable copy of the configuration before adding this type of rule, and check that related services still work afterward.
DOMAIN,example.com,REJECTNames in square brackets mark configuration sections and organize different types of content. Putting a rule in the wrong section will not make it work just because the keyword is correct. Save a recoverable copy of the configuration before editing.
Holds general options supported by the configuration file, rather than a list of rules evaluated against individual requests. Field names, values, and separators must follow the relevant syntax. Do not assume that an interface switch can be entered as a field or that every option applies to the current configuration.
Contains routing rules, which are usually evaluated from top to bottom. The first match determines the policy for the corresponding traffic. Put specific exceptions before broader conditions, and usually place FINAL at the end. When troubleshooting, check both the syntax of a rule and whether an earlier rule already matches.
[Rule]
DOMAIN,example.com,PROXY
IP-CIDR,192.168.0.0/16,DIRECT
FINAL,PROXYDefines static domain mappings that point specified names to configured addresses. It affects name resolution; it does not select a PROXY, DIRECT, or REJECT policy. If a destination service changes its address, an outdated mapping may cause access problems. Avoid keeping fixed addresses that have not been checked.
Organizes URL rewrite rules, which process matching URLs rather than selecting a proxy server. It is not interchangeable with rules in [Rule] that route traffic by domain or IP. Whether a request can be processed also depends on its type and related settings; one expression does not mean all traffic will be rewritten.
Subscription content, server authentication, and App Store purchase records serve different purposes. Shadowrocket is available only on Apple platforms, primarily for iPhone and iPad. The App Store is the only place to get it; check the App Store listing for system requirements.
A way to retrieve and update a set of entries through a link. The response may contain a server list or a configuration file. Get subscription links from your service provider, and check the import option and content type before importing. Links may contain access credentials, so conceal sensitive parts when troubleshooting.
A record of the remote endpoint the client connects to and its parameters, typically including the address, port, protocol, and authentication details. It is distinct from a rule and from the policy that determines where a request goes. A display name helps identify an entry but does not prove that its protocol parameters or connection are correct.
An app record in the App Store associated with the Apple Account used for the purchase. Use it to find Shadowrocket when changing devices or reinstalling the app. Restoring access to the app does not restore server parameters or configuration files. See the App Store listing for cross-device purchase eligibility. For steps, see How to Restore Purchased Items.
A one-time purchase of the Shadowrocket client itself; see the App Store listing for the price. A one-time client purchase is not a service plan. After purchasing the app, you still need your own subscription or server details. This site provides the official manual and does not provide, sell, or recommend servers or subscriptions.
Use the glossary to clarify terminology, then see the relevant sections for setup steps and troubleshooting. Before purchasing, check the App Store listing for the developer, Shadow Launch Technology Limited, the official icon, and app ID 932747118.