Shadowrocket Glossary: Interface Terms, Protocols & Rule Keywords

Interface & Controls

These labels appear on screens, in menus, or in connection settings. Similar names may apply to different things.

Home: The main screen for viewing servers, choosing a connection, and controlling the connection toggle. Selecting an entry only chooses the connection endpoint; it does not connect. Check the connection toggle and status as well. After importing an entry, verify it here before testing.

Global Routing: Global Routing controls how the client handles connections. It offers Config, Proxy, and Direct modes; it is not a server protocol selector. When troubleshooting unexpected traffic routing, check the selected mode first, then review the relevant rules.

Config / Proxy / Direct: Config applies the rules in the active configuration file; Proxy routes traffic through a proxy; Direct connects to the destination directly. These capitalized labels are Global Routing options, not the uppercase rule actions PROXY and DIRECT. Restore your usual mode after testing a temporary change.

On Demand: On Demand connects when configured network conditions are met. It controls when the client attempts to connect, not which rule a domain matches. If a connection starts again after you turn it off manually, check the On Demand conditions before looking at other settings.

Connectivity Test: Checks server connectivity using the selected method. Results depend on the test target, current network, and server status. The reported time is not download bandwidth and does not guarantee access to every website. Use the same test method when comparing results. If a test times out, check the address, port, and authentication details.

Data: View client traffic and connection logs to check whether requests occurred and whether traffic followed the expected route. Client statistics may cover different data from a provider's account statement, so they cannot show how much subscription quota remains. Remove server addresses, personal domains, and authentication details before sharing logs.

Settings: Manage common client settings. Some behavior is also controlled by the active Config file, so check for related configuration options when changing a toggle. When troubleshooting, change one setting at a time and note its original value so you can identify the cause.

Protocols

Protocol names describe how a connection works, not its quality. Use the server details you already have; don't guess parameters based on the protocol name.

Shadowsocks: A proxy protocol that uses parameters such as server address, port, encryption method, and password to establish a connection. After importing, check that the encryption method matches the server—not just the password. Keep any additional parameters in the entry as provided. Share links often start with ss://.

VMess: A proxy protocol that identifies users with details such as a UUID. Share links often start with vmess://. In addition to the address and port, transport, path, Host, and TLS settings may affect connectivity. A correct UUID won't help if the transport parameters don't match.

VLESS: A proxy protocol that uses UUID-based identity. Share links often start with vless://. The protocol name does not imply any particular transport security; check the transport and security parameters specified by the server. Don't reuse settings from another entry, even if both use the same address.

Trojan: A password-authenticated proxy protocol commonly used with TLS. Share links often start with trojan://. The connection requires the server address, port, password, and matching TLS parameters. Other details, such as the server name, must also match the source information. If you see a certificate error, check the domain and device time rather than bypassing verification.

Hysteria2: A QUIC-based proxy protocol that requires UDP support on the current network. Authentication details, server name, and other parameters must match the server. A failure on one network alone does not prove the server is unavailable; check the network conditions and test results.

WireGuard: A protocol that creates an encrypted tunnel using key pairs and Peer information. Configuration typically includes a private key, public key, endpoint, and address ranges. These fields serve different purposes and cannot be substituted for one another. Keep the private key confidential; don't include it in public screenshots, logs, or support requests.

HTTP / SOCKS5: Two common proxy protocols that typically use a server address and port; some servers also require a username and password. Check authentication, transport encryption, and UDP support against the specific server's capabilities. A protocol name does not guarantee encryption. Choose the entry type specified in the server details you already have.

Rule Keywords

Specify a match condition, then an action. When reading rules, check their order too: an earlier matching rule generally determines the result.

Rule: A rule that maps a connection destination to an action. A common format is “type, match, action,” such as DOMAIN,example.com,DIRECT. With Global Routing set to Config, rules are evaluated in the order in the active configuration. A rule being present does not mean every connection will match it.

DOMAIN: Matches an exact domain, for example DOMAIN,example.com,DIRECT. This rule does not automatically include subdomains such as www.example.com. To cover a domain and its subdomains, see DOMAIN-SUFFIX instead of adding multiple incomplete exact-match rules.

DOMAIN-SUFFIX: Matches a domain and its subdomains, for example DOMAIN-SUFFIX,example.com,PROXY. It can match both example.com and www.example.com, but it does not match any string that happens to contain the text. After adding it, check whether an earlier rule already matches the destination.

DOMAIN-KEYWORD: Matches a specified keyword contained in a domain name, for example DOMAIN-KEYWORD,example,PROXY. Its scope is generally broader than a specific domain suffix and may include domains you did not intend to route this way. For a single site and its subdomains, first consider whether a more precise match condition is appropriate.

GEOIP: Matches a destination based on its country or region in an IP geolocation database, for example GEOIP,CN,DIRECT. This checks the IP database entry, not the page text, domain suffix, or user's location. DNS results, database contents, and rule order can all affect the match.

IP-CIDR / IP-CIDR6: Matches IPv4 and IPv6 address ranges, respectively. The number after the slash is the prefix length. For example, IP-CIDR,192.0.2.0/24,DIRECT specifies an IPv4 range. If a domain resolves to different addresses, different rules may match; interpret address-range rules alongside DNS results.

FINAL: The final rule applied when none of the preceding rules match, for example FINAL,PROXY. It is usually placed at the end of the rule list to specify how remaining connections are handled. FINAL does not target a specific domain. If many requests reach it, check whether earlier conditions cover the actual destinations.

PROXY / DIRECT / REJECT: Rule actions: PROXY routes traffic through a proxy, DIRECT connects directly, and REJECT blocks the connection. These appear in the action position of a rule; they do not specify the server protocol. Uppercase DIRECT applies only to connections matching that rule. It is not the same as setting Global Routing to Direct.

Subscriptions & Configuration

Distinguish server lists, rule files, and synced data. Have your own subscription or server details before importing anything.

Server / Add Server: Server refers to an entry containing details such as protocol, address, port, and authentication. Add Server opens the manual entry form. A Chinese-language guide may call an entry like this a “node”; it is not a service included with the app purchase. After adding an entry, check its fields and test connectivity before selecting it.

Config: In the context of a configuration file, Config contains rules, DNS, and other settings; it is not the server subscription list. In Global Routing, Config with the same name means routing according to the configuration. After importing a file, make sure it is selected. An imported but inactive file does not mean its rules are in effect.

DNS: The process of resolving a domain name to an IP address. The result may be used in subsequent IP-based rule matching. If the server connects but some domains won't load, DNS is one area to check. Keep the original values when changing DNS settings, and test domain resolution and access to the destination separately rather than blaming every failure on the server.

Scan QR Code: An import option that reads server or subscription information from a QR code; camera access may be required to scan one. A QR code is only a container for information and does not guarantee that its contents are complete, valid, or compatible with the client. Check the source before importing, then verify the entry type. Don't share QR codes containing credentials publicly.

URL Rewrite: A feature that rewrites request URLs or applies specified actions based on matching conditions. It is not a standard routing rule that decides whether to connect directly or through a proxy. Modifying HTTPS requests may require additional configuration and authorization; adding a Rewrite alone does not guarantee it will work. Use it only when you understand the rule's source, scope, and effects, and keep a recoverable copy of the original configuration.

iCloud Sync: Syncs data supported by the app across eligible devices through iCloud; it does not refresh a subscription with a service provider. The available data depends on the app's options, account, system permissions, and network. Sync is not a full backup. Save any configuration details you need before changing devices, and keep credentials secure.

Platforms & Installation

Shadowrocket is available for iPhone, iPad, Mac, Windows, Android, and Linux. Downloading an app and granting system permissions are separate steps.

App Store / Purchased: The App Store is where you get the iPhone / iPad version; Purchased shows the purchase history for the associated account. Check the product page for the developer, Shadow Launch Technology Limited, the official icon, and app ID 932747118. When reinstalling or moving to a new device, first make sure you're using the original purchasing account, then check Purchased. Purchase history and server details stored in the app are separate data.

Apple Silicon / Intel: The Mac installer comes in two processor variants. Check the chip or processor in About This Mac, then choose the corresponding .dmg. If you see a warning that the developer cannot be verified on first launch, confirm the installer came from this site, then look for “Open Anyway” under Privacy & Security. If macOS says the app is damaged, download it again. If the issue persists, follow the installation permission guide; a system warning is not a connection issue.

SmartScreen / Install unknown apps: SmartScreen is a Windows security warning; Install unknown apps is an Android setting that authorizes an installation source. After confirming that the installer came from this site, choose “More info → Run anyway” on Windows if that option appears. On Android, follow the system prompts to allow installs from the current source. These steps address installation permissions only; they do not fix server, subscription, or DNS settings. See installation permissions for details.

deb / rpm / AppImage: Common Linux package formats: deb is generally used by Debian-based distributions, while rpm is used by Fedora and other distributions with compatible package management. AppImage usually needs executable permission before launch; compatibility still depends on the system and its dependencies. Choose the format for your distribution instead of assuming a different format will fix every launch issue. See the Linux installation guide for commands and permission steps.

VPN Configuration: The system configuration and permissions the client needs to handle network traffic; you may be asked to confirm them the first time you connect. This is not a server account or subscription URL, and it does not mean the system has verified that the remote service is available. If you delete the configuration by mistake, start a connection in Shadowrocket and follow the system prompts to authorize it again. Test the connection separately after authorization.