Shadowrocket Glossary: Interface Terms, Protocols & Rule Keywords

Interface & Controls

Connection Controls & Routing Modes

The connection toggle starts a connection; Global Routing determines how requests are handled. Confirm separately that the toggle is on, a server is selected, and the rules are taking effect.

Home: Home is the main screen for the connection toggle, saved servers, and current selection. A server in the list is only a saved entry; it doesn't confirm successful authentication or an established connection. Before connecting for the first time, check the selected entry, turn on the connection toggle, and verify the result with an actual request.

Global Routing: Global Routing selects the overall routing mode: Config, Proxy, or Direct. Config handles requests using the rules in the current configuration, Proxy routes them through a proxy, and Direct connects without a proxy. When troubleshooting how a site is handled, note the current mode first; otherwise, a rule change may not produce the expected result.

On Demand: On Demand starts a connection when configured network or access conditions are met. It can't restore an invalid server. First verify a manual connection, then add trigger conditions one at a time. If the connection starts again after you turn off the toggle, check whether the On Demand conditions are still met.

Add Server: Add Server is the entry point for manually entering details for an existing server. Choose the protocol first, then enter the address, port, and authentication details as provided. TLS and other transport settings must also match the server. The name helps identify the entry; it isn't a substitute for the server address.

Connectivity Test: Connectivity Test checks reachability and response time under specific test conditions. A successful test means that probe received a response; it doesn't guarantee that every site, UDP request, or large file transfer will work. If test results differ from actual browsing, consider the test method, destination, and connection logs.

Settings: Settings collects client-related options. Available items vary by platform and app version, so refer to the current in-app screen. When troubleshooting, note the original values, change one relevant option at a time, and repeat the same test request. Don't confuse server protocol parameters with global client settings.

Protocols

Protocol Types & Connection Settings

The protocol determines how the client communicates with a server; it doesn't directly indicate connection speed. Choose the type that matches your existing server details. Changing a menu selection alone can't convert one protocol into another.

Shadowsocks: Shadowsocks is a proxy protocol. Common parameters include the server address, port, password, and encryption method. The encryption method must match the server; don't substitute one based on a similar name. If the original details include a plugin or other transport parameters, check those too—not just the address and password.

VMess: VMess uses a user ID and other details for authentication and can work with different transport methods. After importing, check the user ID, port, transport type, and TLS settings—not just the server name. If authentication fails, also check that the device clock is accurate.

VLESS: VLESS authenticates with a user ID. The protocol and transport-layer security settings are separate concerns. A correct user ID doesn't mean you can omit TLS, the server name, or the transport path. If the connection fails, compare each setting with your existing configuration rather than repeatedly changing unrelated DNS settings.

Trojan: Trojan commonly uses TLS and password authentication. The address, port, password, and server name must correspond to the same server. Certificate verification failures and incorrect passwords are different issues; distinguish them in the error logs. Don't disable certificate checks just to pass a test. First verify the domain, device clock, and server certificate configuration.

Hysteria2: Hysteria2 is a QUIC-based proxy protocol that depends on UDP reachability. In addition to the server address and authentication details, check TLS and related settings against your existing configuration. If it fails on one network but works on another, UDP transport conditions may be worth investigating, but that alone doesn't establish the cause.

WireGuard: WireGuard uses key pairs to establish an encrypted tunnel. A typical configuration also includes an endpoint, tunnel addresses, and routing ranges. Public, private, and pre-shared keys serve different purposes and aren't interchangeable; keep the private key secure. Verify the handshake and whether traffic to the target address is routed as expected separately.

HTTP / SOCKS5: HTTP and SOCKS5 are different proxy protocol types; using the same address doesn't make them interchangeable. HTTP handles HTTP proxy requests, including CONNECT, while SOCKS5 uses its own negotiation when establishing a connection. Authentication requirements and UDP support also depend on the server implementation, so follow the details for your existing server.

Rule Keywords

Match Conditions & Actions

The first part of a rule describes what to match; the policy specifies what to do. Addresses such as example.com below are syntax examples, not server details you can connect to.

DOMAIN / DOMAIN-SUFFIX / DOMAIN-KEYWORD: DOMAIN matches an exact domain; DOMAIN-SUFFIX matches a domain and its subdomains; DOMAIN-KEYWORD matches a keyword within a domain. For example, DOMAIN-SUFFIX,example.com,PROXY sends matching requests to PROXY. The domain field isn't a full URL, so don't include a scheme or page path.

IP-CIDR / IP-CIDR6: IP-CIDR matches IPv4 address ranges, while IP-CIDR6 is for IPv6. A range is defined by an address and the prefix length after the slash. For example, IP-CIDR,192.168.0.0/16,DIRECT describes how to handle an IPv4 network range. These rules match addresses, not domain names; check the actual destination IP when reviewing a match.

GEOIP: GEOIP matches destination addresses by region using an IP database, for example, GEOIP,CN,DIRECT. Database entries, DNS responses, and the content delivery network used by a destination can all affect the result. GEOIP can't precisely identify where a website operator is based and shouldn't replace checks for rules targeting specific domains.

FINAL: FINAL sets the policy for requests that haven't matched any preceding rules and is usually placed at the end of the rule list. For example, FINAL,PROXY sends remaining requests to PROXY. If a broader rule earlier in the list matches, the request won't be evaluated again just because FINAL appears at the end.

PROXY / DIRECT / REJECT: These three uppercase keywords are rule policies: PROXY routes through a proxy, DIRECT connects directly, and REJECT blocks the request. They're at a different level from the Proxy and Direct options in Global Routing. If a REJECT rule matches, check what that rule is meant to do rather than immediately blaming a server timeout.

Rule: A Rule combines a match condition with an action. Rules are usually checked in configuration order, and the matching rule determines how a request is handled. Put specific exceptions before broader rules that could match them. After editing, save and confirm the current Config, then test the same destination to check which rule matches. Avoid changing several things at once, which makes results harder to interpret.

Subscriptions & Configurations

Importing, Parsing & Verifying Content

Server entries store connection settings, subscriptions retrieve or update content, and Config holds settings such as rules. A successful import completes only one step; check the selected entry and verify actual access too.

SERVER: SERVER refers to a remote server entry the client connects to, typically including the protocol, address, port, and authentication details. In this glossary, a server entry means a connection profile, not a subscription. Names and region labels help identify entries; use the settings and test results to assess whether they can connect.

Config: Config can refer to a configuration file containing settings such as rules and DNS, or to the Global Routing mode that handles requests according to a configuration. Having a file, selecting it, and setting the overall mode to Config are separate states. Keep a copy of the original before editing. After saving, confirm which configuration is active and check how a test request matches its rules.

DNS: DNS resolves domain names to IP addresses; resolution and establishing a proxy connection are separate steps. If a domain won't load, distinguish a DNS timeout, an unexpected response address, and a server connection failure. Note the original DNS settings before changing them, then retest the same domain. A successful lookup alone doesn't guarantee that the connection or routing will work.

Latency: Latency is the response time for a test using a specific method and destination, usually shown in milliseconds. A lower number doesn't necessarily mean more bandwidth, and it doesn't measure long-duration transfers, packet loss, or the experience across all apps and services. For a useful comparison, keep the network and test method the same, and verify with actual access.

URL Rewrite: URL Rewrite changes how URLs are handled based on matching expressions. It's different from routing rules that choose a proxy or direct connection. Whether it takes effect depends on the match conditions, request type, and related settings. Don't assume it can inspect the full contents of every encrypted request. Limit the scope of changes and keep a copy of the original configuration so you can restore it.

Scan QR Code: Scan QR Code reads connection or configuration data stored in a QR code; it isn't a proxy protocol. After scanning, check the protocol, address, authentication, and additional settings, and confirm the content comes from a configuration you already have. QR codes may contain sensitive credentials, so don't share screenshots of them.

Installation & Platforms

Download Options & Installer Formats

Shadowrocket is a closed-source commercial app available across platforms. The iPhone and iPad app is a one-time $2.99 purchase on the App Store. The Mac (Apple Silicon and Intel), Windows, Android, and Linux versions are free; download options and operating system requirements are covered on the download page.

App Store: The App Store is the download channel for iPhone and iPad; check the product page for current system requirements. On the product page, verify the developer, Shadow Launch Technology Limited, the official icon, and app ID 932747118. To get the app, see the App Store link and instructions in the iPhone / iPad section of the download page.

Purchased: Purchased is where you can find apps acquired with your Apple Account. When changing or restoring a device, use the original purchase account to find Shadowrocket. You can restore the purchase on iPhone or iPad using the same account, though availability for download also depends on device compatibility and App Store status. If you're prompted to pay again, first check which account is signed in for App Store purchases.

Apple Silicon / Intel: These options refer to your Mac's processor type. Check About This Mac, then choose the matching DMG installer. The download page lists separate Apple Silicon and Intel versions, available from /dl/shadowrocket/ on this site. If macOS says the developer can't be verified the first time you open the app, confirm the download source, then choose “Open Anyway” in Privacy & Security. See the installation approval guide for other prompts.

deb / rpm / AppImage: Linux uses different package formats: Debian / Ubuntu typically use deb, Fedora and some other distributions typically use rpm, while AppImage compatibility depends on the runtime environment. AppImage files need execute permission after download; use the appropriate installation steps for package-manager installs. Choose an installer from this site's Linux downloads section, then follow the installation table to check permissions and dependencies.

This glossary helps you find settings; it doesn't replace step-by-step instructions. Continue with the first connection guide, or check symptoms in the troubleshooting manual.