OFFICIAL MANUAL / GLOSSARY

Shadowrocket Glossary

Look up interface terms by their on-screen names and rule keywords by their matching scope. App and configuration terms stay in English; explanations clarify what each term does and what it does not imply.

33 glossary entries
Distinguish interface labels from configuration syntax

01 / INTERFACE

Interface and Toggles

Check where an option appears, then determine whether it affects the entire connection or an individual request.

Home: The main place to view server entries, choose a connection, and control the connection. Selecting an entry only chooses which server to connect to; it does not establish a working connection. When getting started, import your details, confirm the selected entry, then connect and test access.

Global Routing: This option determines how traffic is handled overall. Common modes are Config, Proxy, and Direct, corresponding to configuration rules, proxy routing, and direct connections. When troubleshooting, note the current selection first so a change in mode is not mistaken for a server issue. Whether rules are applied depends on the selected mode.

Config: In Global Routing, Config handles traffic according to the active configuration rules. Elsewhere, it may refer to the configuration management screen. Before selecting this mode, make sure the intended configuration is active, not merely imported. Rule order, policy names, and the final rule all affect the outcome.

Proxy: In Global Routing, Proxy handles traffic using a proxy policy and is often useful for temporarily comparing connection paths. It is not the same as a single line in the rule list, and it does not guarantee access to every destination. You still need usable server details, and should consider DNS and network conditions.

Direct: In Global Routing, Direct uses a direct connection rather than sending requests through a proxy server. Compare it with other modes to see whether an issue involves the proxy path. Selecting Direct does not remove or turn off the system VPN configuration; check them separately.

On Demand: On Demand settings trigger connection behavior when specified conditions are met. They operate differently from domain-based routing rules. Before configuring them, decide which network conditions should connect or disconnect. If the connection starts again after you disconnect manually, check the On Demand conditions before changing server parameters repeatedly.

Connectivity Test: Use this tool to check server reachability and response time under the current test conditions. Results reflect the network, test method, and target at that moment; they do not directly indicate download speed or how every website will perform. Keep conditions consistent when comparing results, and verify with actual access tests.

02 / PROTOCOLS

Protocols

A protocol name describes a communication method, not service quality. Parameters must match your existing server details.

Shadowsocks: A proxy protocol that requires matching addresses, ports, passwords, and encryption methods on the client and server. Entering the correct address alone is not enough to connect. When adding details manually, check the encryption method carefully; do not substitute one based on a similar name.

VMess: A proxy protocol that typically uses a UUID for identification. A working connection may also depend on transport and security settings. A correct UUID does not mean the Host, Path, or TLS parameters are correct. If a connection fails after import, check the full set of fields against the original details rather than changing only the port.

VLESS: A proxy protocol whose identity, transport, and security parameters must be considered together. The protocol name alone does not describe every connection requirement. If your existing details include fields such as Server Name or Path, check them against the original values instead of filling them in or omitting them based on guesswork.

Trojan: A proxy protocol commonly used with TLS and password authentication. The server address, port, password, and certificate name can all affect the connection. If certificate validation fails, first check the address, Server Name, and system time. Disabling validation is not a routine fix.

Hysteria2: A QUIC-based proxy protocol that depends on the current network supporting the required UDP traffic. Changes in network conditions can affect reachability even when the parameters stay the same. Check authentication, TLS parameters, and UDP connectivity separately; a successful domain lookup alone is not enough.

WireGuard: A protocol that creates an encrypted tunnel using public and private keys. Check the local address, peer public key, Endpoint, and routing scope. A private key is sensitive and must not appear in public screenshots or troubleshooting notes. A successful handshake confirms only some connection requirements; continue by checking routing and DNS.

HTTP / SOCKS5: Two common proxy protocol names. Check authentication methods and supported request types against the actual server settings; the protocol name alone does not indicate whether a connection is encrypted. When adding an entry, confirm the Type, address, port, and authentication fields so you do not enter one protocol’s parameters under another type.

03 / RULES & POLICIES

Rule Keywords and Policies

Keywords determine whether a rule matches; policies determine what happens when it does.

Rules: A rule typically consists of a match type, match criteria, and an action policy. Rules are evaluated in the order shown in the configuration, so a broad rule may match before a more specific one. Checking a single line is not enough. Rules also depend on Global Routing being set to Config.

DOMAIN / DOMAIN-SUFFIX / DOMAIN-KEYWORD: DOMAIN matches an exact domain, DOMAIN-SUFFIX matches a domain and its subdomains, and DOMAIN-KEYWORD matches a keyword in a domain. Each has a different scope; keyword matching is especially prone to unintended matches. When adding a domain rule, do not include a URL path or query parameters.

GEOIP: Matches based on an IP geolocation database, not a webpage’s language, domain suffix, or the user’s location. Results depend on the database and the resolved address. If a domain uses different addresses, it may match a different rule, so check the connection logs as well.

IP-CIDR / IP-CIDR6: These match IPv4 and IPv6 address ranges, respectively, using an address and prefix length to define the range. Changing the prefix length changes the scope; do not confuse a single address with an entire network. Confirm which address type the destination uses so you do not cover only one.

FINAL: The final rule applies when none of the preceding rules match and is usually placed at the end of the rule list. It determines how all other requests are handled, but does not override requests already matched by an earlier rule. If every destination falls through to FINAL, check the preceding match criteria and rule order first.

PROXY / DIRECT / REJECT: Rule actions: PROXY sends traffic through the proxy path, DIRECT uses a direct connection, and REJECT denies the request. These uppercase policy names are not the same setting as Proxy and Direct in Global Routing. REJECT applies to a matching request scope; it cannot selectively remove arbitrary content from a domain.

USER-AGENT: Matches readable User-Agent information in a request, not an app’s display name. Relevant information may not be directly visible in encrypted requests, so this is not a universal way to identify apps. If matching behaves unexpectedly, first confirm that the request contains information that can be matched.

Rule syntax example, not a complete configuration

This example illustrates the relationship between match types and policies only. example.com is a domain used for demonstration; before using a rule, check the policy definitions and order in your active configuration.

DOMAIN-SUFFIX,example.com,PROXY
GEOIP,CN,DIRECT
FINAL,PROXY

04 / SUBSCRIPTION & CONFIG

Subscriptions and Configuration

Importing, updating, configuring rules, and syncing data are separate operations and cannot replace one another.

Add Server: The entry point for creating a server entry manually from your existing server details. Usually, select a Type first, then fill in fields such as Address and Port. Required fields vary by protocol. Check each value against the original details before saving; filling in every field does not guarantee that the parameters are correct.

Scan QR Code: A way to import existing server or subscription details by scanning a QR code. Scanning reads encoded content, but you should still check the type, address, and name afterward. A QR code may contain full credentials, so check who can see it before sharing an image; do not post it publicly as a decorative graphic.

Subscription Update: Reloads remote subscription content and refreshes the corresponding local server entries; it does not update the Shadowrocket app. Changes to the remote content may add, remove, or alter entries. Before updating, note how you named and organized your entries. Afterward, confirm that the selected entry is still the one you intend to use.

Configuration File: A text configuration for storing rules, policy associations, and related settings. It is different from a subscription that provides only a set of servers. After importing a configuration, confirm that it is active. Keep a recoverable copy before making changes, then verify each change individually to avoid changing multiple variables at once.

DNS: DNS resolves domain names to IP addresses, affecting the destination of subsequent connections and some rule matches. Successful resolution does not mean the port is reachable or server authentication will succeed. If access fails only by domain name, check DNS results separately from connection failures.

URL Rewrite: A configuration feature that rewrites request URLs or related request behavior under specified conditions. It does not route traffic through a proxy policy. Its effect depends on the protocol, encryption, and information available to read. Understand the matching scope before using it, and keep a rollback configuration in case of unexpected redirects or failed requests.

iCloud Sync: When enabled in the relevant settings, iCloud syncs supported data; check the in-app documentation for the exact scope. Sync status and App Store purchase eligibility are separate systems. Redownloading the app does not restore every configuration, and syncing is not a substitute for keeping a separate backup before making changes.

For step-by-step instructions, see Managing Subscriptions and Servers. If you’re new to Shadowrocket, start with the Getting Started guide.

05 / APP STORE & ACCOUNT

App Store and Account

Purchase eligibility, app data, and connection services are managed separately, so check each one separately when restoring access.

Verifying the App Store Listing: Check the developer, Shadow Launch Technology Limited, the official icon, and app ID 932747118. Shadowrocket is available exclusively through the App Store on Apple platforms, primarily for iPhone and iPad. Check the App Store listing for device compatibility and system requirements.

One-Time Purchase: This refers to the payment method for the Shadowrocket client. The US storefront price is approximately $2.99; check the App Store listing for the current price. A one-time client purchase is not a connection plan. Connection features require your own subscription or server details. Check the App Store listing for purchase eligibility on other devices.

Purchased Items: Use your App Store account’s purchase history to find and redownload apps you’ve bought, such as after changing or restoring a device. First confirm that you are signed in to the same store account used for the original purchase. Redownloading the client does not automatically restore your original subscription credentials; check app data separately.

App Store Region: Determines the App Store storefront your account can access, including product listings and payment conditions. It is separate from the system display language. If you can’t find the app, check your account’s storefront, age rating restrictions, and account status first. Changing regions can affect payment methods and existing account benefits, so review the system prompts before proceeding.

For the full purchase, verification, and redownload steps, see the App Store Download Guide. If you understand the terms but still have connection issues, continue with Frequently Asked Questions.