Official Manual / Defined Terms
Browse terms by interface and configuration role. Interface labels and syntax remain in English; explanations clarify their meaning, scope, and common points of confusion.
First, distinguish modes, conditions, and actions
In Global Routing, Proxy is a global mode; PROXY at the end of a rule is a handling policy. The former determines the overall routing approach, while the latter specifies what happens when a rule matches. When troubleshooting, check the mode first, then review rule order and the final policy.
This glossary assumes you already have your own subscription or server details. A one-time purchase of the client app is not a service plan. This site does not provide, sell, or recommend servers or subscriptions. Shadowrocket is a paid app for Apple platforms. Before getting the app, read the App Store purchase verification guide.
01 / Interface
Identify the screen first, then determine whether an action changes a server record, routing mode, or connection status.
Primarily used to view saved servers, the current selection, and connection status. A server listed here has been saved, but that does not mean a connection is active. For a first-time setup, follow the getting started guide to import, select, and authorize the connection in order.
The entry point for manually adding details for an existing server. Choose the protocol type first, then fill in the matching fields. Use the server details you already have for the address, port, authentication, transport, and TLS settings. Changing the display name alone will not fix incorrect connection parameters.
Choose a global routing mode. The three common options are Config, Proxy, and Direct. This setting determines the overall handling of requests; it is not a server protocol option. Before checking a specific routing rule, confirm whether Config is selected.
In Global Routing, Config means requests are handled according to the rules in the active configuration file. The same request can take different routes depending on rule order, DNS results, and the selected policy. This mode shares its name with the Config screen for managing configuration files, so use the screen context to tell them apart.
A Global Routing mode that handles requests through a proxy route, often used to check whether the current proxy connection is available. It does not mean every type of traffic on the device must use the same route; system traffic and related configuration have their own limits. It is also distinct from PROXY in an individual rule.
A Global Routing mode that handles requests through a direct route. Selecting Direct is not the same as turning off the connection switch: one changes routing, the other changes connection status. Note the selected mode before and after troubleshooting to avoid mistaking a routing change for a server change.
A mechanism that triggers connection behavior when conditions set in the system and app are met. It determines when to attempt a connection; it does not check whether a subscription is valid or continuously test whether every website is reachable. If a connection starts again after you turn it off, check the relevant conditions before repeatedly disconnecting manually.
02 / Protocols
Protocol names describe how communication works, not a speed tier. When importing a server, check its authentication, transport, and security parameters together.
A proxy protocol with common parameters including server address, port, password, and encryption method. The encryption method must match the server configuration; do not substitute one based on a similar name. Check any additional transport parameters in your server details as well, rather than verifying only the password.
A proxy protocol that uses parameters such as a UUID for identification. UUID, transport, and TLS belong to separate fields, so getting one right does not mean the full set is complete. If the connection fails, also check that the device time is accurate and that the specified path and hostname match the server details.
A proxy protocol that identifies users with a UUID and does not encrypt payloads by itself, so consider the transport and security settings in use. It is not interchangeable with VMess by simply changing the protocol name. When adding an existing server, check the UUID, transport, server name, and related security parameters against your server details.
A password-authenticated proxy protocol commonly used with TLS. In addition to the password, check that the connection address, TLS server name, and certificate match. If certificate verification fails, check the name and device time first; skipping verification is not a routine fix.
A QUIC-based proxy protocol that relies on UDP. Whether it connects and how it performs depend on UDP reachability, network congestion, server resources, and matching parameters. The protocol name alone does not guarantee lower latency or higher throughput, and cannot replace testing on the actual network.
A VPN protocol that uses public and private keys to identify peers, with a parameter structure different from protocols based mainly on passwords or UUIDs. Check the endpoint, keys, tunnel addresses, and routing scope against the configuration you already have. A private key is sensitive; remove it before sharing troubleshooting materials.
03 / Match & Policy
The first part of a rule specifies the match condition; the last part specifies the action. Preserve keyword capitalization and comma structure, and back up the current configuration before editing.
Rules connect request characteristics to handling policies and are usually listed in the [Rule] section of a configuration file. They generally match from top to bottom, so earlier applicable rules can prevent later ones from taking effect. To understand a result, check the condition, position, and policy—not just whether a domain appears in the list.
Matches an exact domain, for example DOMAIN,example.com,DIRECT. It does not automatically include subdomains such as www.example.com. To cover both a domain and its subdomains, understand the matching scope of DOMAIN-SUFFIX before choosing a rule.
Matches a domain and its subdomains, for example DOMAIN-SUFFIX,example.com,PROXY. It checks domain suffix boundaries; a matching string anywhere in the name is not enough. If a specific subdomain needs a different policy, put its exact-match rule before the broader rule.
Matches according to the target IP's classification in a geographic database. Results can vary with database updates, IP address allocation, and DNS resolution; they are not a real-time measurement of a server's physical location. If a domain rule and GEOIP produce different results, check rule order and the actual target IP.
Matches IPv4 address ranges, for example IP-CIDR,192.168.0.0/16,DIRECT. The prefix length after the slash defines the address range; it is not a server port. Use IP-CIDR6 for IPv6 ranges and keep address families distinct rather than copying an IPv4 rule as-is.
A fallback rule used when no earlier rules match, for example FINAL,DIRECT. It usually belongs at the end of the rule list; otherwise, later rules may never get a chance to match. The policy after FINAL determines where unmatched requests go, not the route for every request in the configuration.
A proxy policy identifier in a rule. It means a matching request uses the corresponding proxy route. It does not create a server or fill in missing authentication or transport parameters. Unlike Proxy mode in Global Routing, PROXY is the outcome of an individual rule and must be understood in the context of the current mode and selected proxy.
A direct policy identifier in a rule. It means the request is not forwarded through a proxy server. The request can still be affected by the local network, destination service, and DNS settings, so a direct connection can fail too. DIRECT does not turn off Shadowrocket or prevent other rules from taking effect.
Rejects requests that match a rule, for example DOMAIN,example.com,REJECT. It handles requests; it does not remove visual elements from a page or distinguish all content hosted on the same domain. An overly broad rejection rule can also affect sign-in, images, and other features that work normally.
04 / Subscription & Config
Server records describe what to connect to; configuration files describe how to handle requests. Both may be imported from the same source, but serve different purposes and should be checked separately.
A way to retrieve and update server records from a subscription URL you already have. The content available for import depends on the format returned. A successful subscription update only means the data was retrieved or parsed; it does not mean every server can connect. Subscription URLs may contain access credentials, so avoid sharing them publicly. Purchasing the client app and subscription status are independent.
A set of server parameters for connecting, usually including an address, port, protocol, and authentication details. The display name is only a label; it does not confirm the server's actual location, availability, or network performance. When troubleshooting, compare fields with the original details you already have instead of guessing from the name.
A text file that stores handling options and rules, commonly in sections such as [General], [Rule], [Host], and [URL Rewrite]. It is not the same as a server subscription. After importing servers, check which configuration file is currently in use. Keep a recoverable copy before editing, and make sure you are changing the active file rather than a different file with the same name.
An entry point for importing compatible server or subscription details from a QR code. A QR code is only a data carrier; whether it can be imported depends on its contents and format, and not every image contains connection details. After importing, check the type and key fields. Avoid sharing QR codes that contain passwords or subscription credentials.
05 / Settings & Diagnostics
Test results, logs, and sync each answer different questions. Change one setting at a time and record what you observe before and after.
The screen for managing app settings; the available options depend on the actual interface on your device. App-level options and configuration-file parameters belong to different layers, even when their names are similar. Record the original value before making changes. If you're unsure how settings are inherited, consult the Settings reference before testing.
The process of resolving a domain name to an IP address. In a configuration, dns-server = system means the system resolver is used. Successful DNS resolution and a successful website request are separate steps; later stages may still be affected by rules, connectivity, or the destination service. Before changing DNS settings, determine whether the issue occurs during name resolution or connection establishment.
A tool that checks reachability using a specified test method. Interpret the result in light of the test target and method. The displayed time is not download speed and does not guarantee that all app requests will work. Keep the network and test conditions consistent when comparing results, then cross-check failures with real requests and logs.
Logs that help trace connections, DNS resolution, and rule processing. Reproduce one clear action first, then search by time and destination so you do not mix results from different requests. Logs may contain visited domains, server addresses, and authentication details; remove sensitive information before sharing them.
A configuration mechanism that processes URLs using match expressions and specified actions, commonly found in the [URL Rewrite] section. Its role differs from Rule, which determines request routing, so the same matching approach cannot be substituted directly. For encrypted requests, what information is visible and whether extra configuration is needed depends on the specific operation; do not assume all request contents can be read.
Syncs supported app data across eligible devices using iCloud. Check the system account, iCloud permissions, and in-app settings. Sync is not a historical backup of every change, and deleted content may also be synced. Before switching devices, save any configuration you need separately, then verify server records and the active configuration on the new device.