Official Guide · Features & Settings
Start with Global Routing to check how traffic is handled, then review rules, servers and connection conditions. This guide assumes you already have subscription or server details and walks through each setting by purpose, location, steps and things to watch for.
Shadowrocket is a paid commercial app for Apple platforms. The App Store is the only place to get it. Check the App Store listing for system requirements.
Traffic routing
What it does: Global Routing determines how the client selects a connection route. Config, proxy and direct correspond to the options Config, Proxy and Direct in the app. These are routing modes, not servers, and they do not indicate which protocol a server uses.
Where to find it: Open Global Routing on Home to see the current selection. Here, Config is a routing mode; the Config tab at the bottom is for managing configuration files. They are related, but they are separate parts of the app.
| Option | How it works | When to use it | What to check |
|---|---|---|---|
| Config |
Selects a policy based on the rules in the active configuration. | Route traffic by domain, address or region for everyday use. | Check which configuration file is selected and review the rule order. |
| Proxy |
Sends traffic through the selected proxy in proxy mode. | Temporarily compare rule-based routing with a proxy connection. | Check that the selected server is available. This does not verify that each rule is correct. |
| Direct |
Handles traffic in direct mode. | Compare with access over your current network without a proxy. | A direct connection does not indicate the status of a proxy server. |
How to set it up: If you already have a complete routing configuration, first confirm the file in the Config tab, then set Global Routing to Config. To troubleshoot, temporarily switch to Proxy or Direct and test the same destination for comparison. Restore the original setting when you are done.
Keep in mind: Switching modes changes how traffic is routed; it does not fill in server addresses, authentication details or DNS settings. If a site works in Proxy mode but not in Config, check which rule matched and where its policy routes traffic before reimporting all your servers. Direct mode does not disable the system VPN configuration. To disconnect, check the connection switch on Home.
Configuration files and matching logic
What they are: A rule consists of a match type, match value and policy. The match condition answers, “What kind of request is this?” The policy determines what happens when it matches. PROXY routes traffic through a proxy, DIRECT connects directly, and REJECT blocks it. If your configuration references a custom policy name, make sure that policy is defined.
Where to find them: Open Config to check the active configuration file. Review the rules in the rule editor or in the file's [Rule] section. To apply these rules, set Global Routing to Config.
DOMAIN matches an exact domain; DOMAIN-SUFFIX matches a domain and its subdomains; DOMAIN-KEYWORD checks whether a domain contains a specified string. The last two have different scopes and should not be used interchangeably just because their names look similar.
IP-CIDR and IP-CIDR6 describe IPv4 and IPv6 address ranges, respectively. GEOIP matches based on IP geolocation data. Whether a domain request can be matched by an IP rule also depends on DNS resolution and configuration options.
How to set them up: Back up the current file, then add rules with clearly defined scopes for your destinations. Put specific conditions before broader ones, and use FINAL to route requests that do not match earlier rules. example.com below is only a syntax example; it does not provide a connection service.
[Rule]
DOMAIN-SUFFIX,example.com,PROXY
GEOIP,CN,DIRECT
FINAL,PROXYKeep in mind: Rules are checked from top to bottom, and a match usually ends further rule evaluation. A broad condition placed too early can prevent more specific rules below it from taking effect. FINAL is a fallback rule, not a way to “try every route again.” After editing, confirm that the file is saved and selected, then check the result with an actual request. For more on match scopes, see Rule Keywords and Matching Order.
Managing connection details
What they are: A server entry stores connection details such as its address, port, protocol and authentication. A subscription lets you retrieve and update a group of server entries. Subscriptions and routing rules are separate: importing servers does not configure traffic routing.
Where to find them: The SERVER section on Home lets you view and select existing servers. To enter details manually, choose Add Server. To import an existing subscription, choose Subscribe from the add menu. You can use Scan QR Code to read an existing QR code. Before importing, make sure its contents come from a configuration source you already have.
How to set them up: When adding a server manually, select the protocol used by the server, then enter its address, port and authentication details. Fill in TLS, transport and other optional fields using the information you already have; do not guess repeatedly to test the connection. After importing a subscription, check that the expected group appears, select a server and test it, then enable the connection.
Before updating a subscription, identify which entries it manages and which you added manually. Entries provided by a subscription may be replaced or removed during an update, so save any details you need before editing them. Servers in the same subscription do not necessarily use the same protocol or settings.
Keep in mind: Subscription URLs may contain access credentials. Do not share them in public screenshots, posts or diagnostic messages. If an import fails, first check that the URL is complete and has no extra spaces, then make sure your current network can retrieve its contents. A successful import only means the client read the entries; it does not mean every server will connect.
A one-time purchase of the client ≠ a connection plan. Buying Shadowrocket gives you access to the client, not a connection service. This site does not provide, sell or recommend servers or subscriptions. These instructions assume you already have your own subscription or server details.
For protocol fields, see the Protocol Reference. For the full sequence of adding a server and connecting for the first time, see the Getting Started guide.
Connection triggers
What it does: On Demand manages when a VPN connection starts based on preset conditions. It handles “when to connect”; Global Routing and configuration rules determine “how traffic is routed once connected.” Enabling the former does not automatically fix the latter.
Where to find it: Open On Demand in Settings to review the available conditions. The options and their location may vary; use the app's current screen as your guide. You may also need to check the VPN configuration in system settings.
How to set it up: First disable automatic triggers, then connect manually and verify that you can access your destination. Make sure the server and configuration both work. Next, set the network conditions you need, changing one at a time. Switch to the target network and check the system VPN status, the connection status on Home and the actual access result to confirm that the trigger behaves as expected.
Keep in mind: On Demand does not repair server problems or guarantee that existing sessions will survive a network change. If the connection starts again after you disconnect manually, check the On Demand conditions and system VPN settings instead of repeatedly toggling the connection. When troubleshooting, note the original conditions, temporarily disable automatic triggers, test manually, then restore your settings.
Usage records and statistics
What it shows: Data displays traffic recorded by the client, letting you track upload and download changes during a period of use. Treat it as a troubleshooting clue—not a bandwidth test or a server-side billing record.
Where to find it: Open the Data tab at the bottom. Check which statistics and time range are displayed before reading the numbers. Do not directly compare or add figures from different measurement scopes, time periods or devices.
How to use it: To track the effect of an action, first note the current statistics and time, then perform a repeatable task and return to Data to compare the changes. If the page offers an option to clear statistics, save any records you need first. Clearing statistics does not refresh server status.
Keep in mind: Background apps, system requests and connection retries can also use traffic. Client-side and server-side statistics may differ in scope, time range and how protocol overhead is counted, so a discrepancy does not by itself mean either side is wrong. To check whether a rule matched, review connection records alongside the request; do not infer the routing policy from a change in traffic alone.
Common Settings
Settings brings together app preferences and related tools. Some behavior may also be controlled by the active configuration file, so distinguish app settings from file parameters before making changes. The options below depend on what is currently shown in the app; you do not need to enable them all.
What it is and where to find it: DNS resolves domain names to IP addresses. Check related options under DNS in Settings; the active configuration file may also include DNS parameters in its [General] section. Before changing settings, note which configuration file is active so you can account for its effect on name resolution.
How to set it up and what to check: Enter DNS parameters based on your existing network and configuration requirements. Change one item at a time, then test the same domain again. A successful server test does not guarantee a webpage will load: DNS resolution may fail, return an unsuitable result or be followed by a connection failure. Do not replace all DNS settings based on a single test result. First identify whether the failure is in resolution or connection; see Troubleshooting DNS Resolution Failures.
What it is and where to find it: Test Method selects how connectivity is tested. Find it in Settings. Use Connectivity Test on Home to run a test. Different methods may cover different parts of the connection.
How to set it up and what to check: When comparing servers, keep the test method, target and current network the same, and repeat the test to observe results. Do not combine figures from different methods into a single comparison. A successful test does not guarantee access to every website, and the test time is not the same as actual download speed. If the test fails but browsing works, first check the test target and method.
What it is and where to find it: Use Today Widget to view or configure related shortcuts and controls. Check its options in Settings. Whether you can add it in the relevant system location depends on the widget options available on your device.
How to set it up and what to check: First select a server and verify the connection in the app, then add the shortcut using the system's widget-editing controls. After using a shortcut, return to Home to check the actual status. Widgets may take time to refresh, so a displayed message is not a complete connection diagnosis. A widget cannot add server details that have not been imported.
What it is and where to find it: iCloud features save or sync data within the scope supported by the app. Check the relevant options in Settings and confirm that system settings allow Shadowrocket to use iCloud. iCloud sync and restoring an App Store purchase are separate processes.
How to set it up and what to check: First keep a copy of important settings on your current device, then read the in-app details about what syncs and how uploads or restores work. Before another device loads the data, check its contents and modification time to avoid replacing your active configuration with an older version. Restoring a purchase does not restore server credentials. After syncing, check the selected server, configuration file and routing mode on each device.
What it is and where to find it: Diagnostics provides tools for troubleshooting and can be found in Settings. Use it to gather clues; one result alone cannot confirm that every part of the connection is working.
How to use it and what to check: Note the failed destination, current network, routing mode and steps to reproduce the issue before running diagnostics. Save the results that relate to this failure, without mixing in unrelated information from later changes. Before sharing records, hide access credentials in subscription URLs, passwords, authentication fields and other personal information. Compare diagnostic results with DNS, server connectivity and rule matches; diagnostics do not replace those checks.
Checklist Before and After Changes
Start troubleshooting with a repeatable baseline. Note the current network, selected server, configuration file and Global Routing, then test access to a specific destination. This makes it possible to tell whether a change affected the result, rather than mistaking network fluctuations for a successful setting change.
Connectivity Test and note the Test Method. Do not rely on a single number without context.Config, verify the active file and its rules. If you switch to another mode for comparison, restore the original setting afterward.On Demand and shortcuts, then observe the connection state after switching networks.Keep a recoverable copy before editing configuration files. Make subscription updates, configuration changes, DNS adjustments and network switches separately where possible. If you change several settings at once, even a restored connection will not tell you which change fixed it.
Follow the Getting Started guide to complete the initial setup step by step. See the Protocol Reference for protocol fields and selection guidance, and the App Store Purchase and Listing Verification Guide for purchase restoration and store listing details. The developer is Shadow Launch Technology Limited; the app ID is 932747118.