Look up a term as it appears in the interface, then check the corresponding setting. Protocol types, match conditions, policies, and purchase records are explained separately so concepts from different layers are not confused.
Capitalization matters: the interface mode Proxy and the rule policy PROXY are not the same setting. Config can refer to the screen entry or to a configuration mode in Global Routing.
First, check which screen you are on and the current mode. Having servers in the list, turning on the connection, and routing requests as expected are three different states.
The main screen for viewing servers, choosing a default server, and controlling the connection. A successful import only means the entry was added to the list; it does not confirm that the authentication details are correct or that the current network can reach the server. Before connecting for the first time, check the selected entry, then the connection toggle and system permissions.
The entry point for manually entering existing server details. Choose the protocol based on the information from your provider, then check the address, port, authentication, and transport settings. The fields shown vary by protocol. Do not assume the setup is complete after entering only a name and address; the name is just a label for identification.
As a screen entry, this is where you manage and select configuration files. As a Global Routing mode, it means requests are handled according to the rules in the configuration. Saving a file does not mean it is selected for use. If rules are not taking effect, check both the active file and the Global Routing mode.
This setting controls the overall routing mode. The three common modes are Config, Proxy, and Direct. Config routes traffic according to the configuration rules, Proxy uses proxy routing, and Direct connects directly. This is a global mode setting, distinct from the policy keyword at the end of an individual rule.
A mechanism that starts the VPN connection when specified conditions are met; it does not update subscriptions on a schedule. Whether it activates also depends on system permissions, the current network, and in-app conditions. If the connection turns back on after you manually disable it, check On Demand before assuming the app is malfunctioning.
A diagnostic tool for checking connectivity. A successful test only confirms that the path worked under the conditions of that test; it does not show that every site, protocol, and rule path will work. If the result is unexpected, continue troubleshooting by checking the default server, Global Routing, DNS, and actual request logs.
The process of resolving a domain name to an IP address, usually before connecting to the destination. A resolution failure may make a domain unreachable, but even successful resolution can be followed by a connection failure caused by routing or server issues. Avoid changing several DNS and rule settings at once; preserve the original configuration and test changes one at a time.
A protocol defines how two endpoints communicate and authenticate; it does not directly indicate speed. Use the parameters for your existing server, and do not change the protocol based on its name alone.
A protocol that uses a specified encryption method and authentication details to carry proxy traffic. The server address, port, password, and encryption method must match the server; a correct password with the wrong encryption method can still cause connection failures. Keep any other parameters included with the existing entry rather than copying only a few fields.
A proxy protocol that uses identity information such as a UUID; authentication parameters are only part of a complete setup. Transport, Host, path, and TLS settings may also affect connectivity and should follow the server requirements. Changing a VMess entry's type to VLESS does not convert the protocol.
A proxy protocol that uses UUID authentication but does not encrypt payloads itself. Connection security depends on accompanying transport settings such as TLS, so a UUID alone does not mean the configuration is complete. Check identity, transport, and security settings separately, and do not confuse the server domain with its display name.
A proxy protocol commonly used with TLS and authenticated with a password. In addition to the server address and password, check the server domain and certificate validation settings. If a certificate error occurs, first verify the domain, device time, and server certificate; disabling validation is not a routine fix.
A QUIC-based proxy protocol that uses UDP at the transport layer. Authentication and TLS settings must match the server, and UDP handling on the current network also affects reachability. If the connection fails, distinguish configuration errors from transport-path issues rather than assuming how it will behave on a network based on the protocol name alone.
A protocol that creates an encrypted tunnel using public and private keys, a peer address, and related network settings. Public and private keys serve different purposes and cannot be interchanged; also check the address and routing range when importing. A private key is sensitive: hide it when asking for help, and never post the full configuration publicly.
Two different proxy protocol types with different connection negotiation and supported behavior. Set the address, port, authentication method, and TLS usage according to the actual server settings; common port numbers alone do not identify the protocol. The protocol name also does not guarantee that all data is encrypted, so check the actual transport settings.
To learn more about authentication and transport settings, see VMess vs. VLESS: Field-by-Field Comparison.
The rules at the beginning describe what to match; the policy at the end describes how to handle it. The snippets below illustrate syntax and are not complete configuration files.
Matches domain suffixes, including the specified domain and its subdomains. For example, DOMAIN-SUFFIX,example.com,PROXY can match example.com and api.example.com. It does not match arbitrary strings containing the text; a match uses the policy specified at the end of the rule.
Matches based on the geographic region associated with an IP address, not a webpage's language or the domain suffix. The result depends on the address matched and the geographic database in use. A domain may resolve to multiple addresses, so its name alone cannot predict the result of every match.
Matches IPv4 address ranges. The prefix length after the slash determines the range. For example, IP-CIDR,192.168.0.0/16,DIRECT applies DIRECT to that range. Broader ranges can cover more addresses, so check for effects on other destinations before making changes.
Matches IPv6 address ranges, a different address family from the one covered by IP-CIDR. Adding IPv4 subnet rules alone does not automatically cover IPv6 requests. If behavior differs for the same domain, check the actual connection address rather than only whether it matched an IPv4 rule.
The final rule handles requests that did not match any preceding rules. For example, FINAL,PROXY sends remaining requests through PROXY. It is not a standalone “force proxy for all requests” switch; rules that matched earlier still determine how their requests are handled.
A rule policy keyword that sends traffic through a proxy, usually written at the end of a rule. The actual route also depends on the currently selected server and related settings. It is similar in name to the Proxy mode in Global Routing, but one is the result for an individual rule and the other is an overall routing mode.
Connects directly to the destination without using a proxy server as the request's exit. DIRECT does not mean the request bypasses system networking, nor does it guarantee a particular DNS path. If the destination is unreachable, changing the rule to DIRECT will not restore the connection by itself.
Rejects requests matching the rule rather than retrying through another server. If a domain or app consistently fails to connect, check whether it is accidentally matching REJECT. When adjusting a rule, narrow its match and verify its order instead of deleting every related rule.
Matches an exact domain. For example, DOMAIN,api.example.com,PROXY applies only to the specified domain. It does not automatically match example.com or other subdomains. To cover a domain and its subdomains, first understand the scope of DOMAIN-SUFFIX, then choose the appropriate keyword.
Server entries hold connection parameters, configuration files hold settings such as rules, and subscriptions retrieve and update entries. They are related, but they are not interchangeable.
A subscription type for centrally retrieving and updating server entries; its URL comes from a provider the user already uses. An update may change entry names, counts, and parameters, and can overwrite manual edits. Subscription URLs may contain identifying information, so keep them secure when copying, backing up, or asking for help.
A connection entry in the app, also commonly called a node, containing a protocol, address, port, and authentication details. Its name is only a local label; renaming it does not change the server's location or capabilities. A test timeout does not necessarily indicate a malformed entry; check the server status and current network as well.
A configuration directive that pairs a match condition with a policy, such as routing a domain through PROXY or DIRECT. Rules are generally evaluated in order, so moving the same rule can change the result. Save the original file before making changes and test with a specific request rather than checking only whether the file saved successfully.
A text file that stores settings such as rules and DNS, and may contain sections such as [General] and [Rule]. It is not a server subscription, and importing a configuration file does not mean you have a server you can connect to. Saving a file, selecting it for use, and changing Global Routing are separate actions; check each one.
A way to save and sync supported data using an Apple Account and the app's sync settings. App purchase records and configuration sync are separate; after redownloading the app, check your servers, configuration files, and which file is selected. Before switching devices, save any necessary configuration separately and keep the old device's data until you have verified everything on the new device.
Purchasing the app, restoring purchase records, and restoring configuration data are three separate steps. Store information helps verify the product and compatibility; it does not provide connection details.
The only place to purchase and install Shadowrocket. Verify the official icon, developer Shadow Launch Technology Limited, and app ID 932747118; do not rely on the name shown in search results alone. Purchases and updates are handled through the App Store. For the verification steps, see Verify the official app.
The place to find purchases made with the original Apple ID and redownload the app; the exact label may vary by system version. If a purchase is missing, first check the account and storefront used to make it. Restoring the app does not automatically restore server and rule data, so check your backups or sync results too.
A one-time purchase of the client app. The US storefront price is about $2.99; the actual price is listed on the App Store, and other storefronts show local currency. A one-time client purchase ≠ a service plan; buying the app does not include a server or subscription. Connection details still come from a provider the user already uses.
The supported devices and system requirements listed on the App Store. Shadowrocket is primarily used on iPhone and iPad. Mac, Apple TV, and Apple Vision compatibility can also be checked on the same store page; refer to the App Store listing for system requirements and whether purchases are universal. Do not infer purchase eligibility from the device name alone.
If you understand the terms but still have questions about setup, follow Getting Started for the full process. To install or restore the app, see the official App Store download guide.