OFFICIAL MANUAL / GLOSSARY
Look up terms by screen location and what they match; distinguish connection settings from rule policies.
This page is part of the official Shadowrocket manual. English interface terms, protocol names, and rule keywords are kept in their original form. Explanations focus on using Shadowrocket on iPhone and iPad. After finding a term, check where it appears, then determine whether it affects server settings, routing, or the handling of an individual request.
01 / INTERFACE
The same English term can mean different things depending on where it appears. In particular, distinguish a Global Routing mode, a screen name, and an uppercase policy in a rule.
The main screen for viewing the server list, selecting a server, and controlling the connection toggle. A listed entry only means its details have been imported; it does not mean the remote service is reachable or a connection is active. When checking for the first time, review the selected entry, connection toggle, and system connection status separately rather than treating them as one state.
A setting that determines how traffic is handled overall. Config, Proxy, and Direct are the corresponding modes. If a domain is not being handled as expected, check the current mode first, then review the rule. Changing modes will not fix a server password, certificate name, or other connection setting.
In Global Routing, Config means traffic is handled according to the active configuration. Requests may be proxied, sent directly, or rejected based on rules, so this does not mean every request uses a proxy. As a screen name, Config is the entry point for managing configuration files. When following a guide, check whether Config refers to a mode or a screen; importing a file does not select it for use.
The Proxy mode in Global Routing handles traffic through a proxy instead of applying rules from the active configuration. It is different from the uppercase PROXY used in rules; similar wording does not make them the same setting. When testing, check that the selected server is valid. Changing modes cannot resolve an authentication failure.
The Direct mode in Global Routing handles traffic directly. If Direct is active, a request bypassing the proxy does not mean a rule is incorrect. To observe rule-based routing, switch back to Config first. Uppercase DIRECT at the end of a rule describes what happens when that rule matches; it does not change the global mode.
A mechanism that starts a connection when configured conditions are met; it is separate from manually toggling the connection. If the connection starts again after you stop it, check whether an On Demand condition is still being met instead of repeatedly deleting configurations. Note the original conditions before making changes, change one thing at a time, and observe the behavior under the same network conditions.
02 / PROTOCOLS
A protocol defines how two endpoints establish a connection and exchange data; it does not indicate service quality. Choose a type based on the server information you already have. Do not treat protocols as interchangeable based only on their names or test results.
A proxy protocol that requires matching server and client settings for the address, port, password, and encryption method. Text beginning with ss:// is usually a single-server share link, not necessarily a refreshable subscription. After importing, check that the encryption method matches the original details rather than checking only the display name.
An authenticated proxy protocol. A UUID is a common identity parameter, but it is not a complete connection configuration. Whether you need to enter transport, path, Host, TLS, or other settings depends on the actual server configuration. If the connection fails after import, compare each field with the original information and make sure the device's date and time are correct; simply replacing the server address may not help.
A proxy protocol whose identity, transport, and security parameters together make up the connection settings. A correct UUID does not mean the other fields are complete, and you cannot infer security options from the protocol name alone. When using existing vless:// share information, check that the relevant fields were retained after import, and do not change the server's required parameter combination without a reason.
A proxy protocol commonly used with TLS. The password is used for authentication, while TLS settings affect how the secure connection is established. The server address and the name used for certificate verification may serve different purposes; do not clear the name just because the address is an IP. If a certificate error occurs, check the name, device time, and original configuration before considering any change to verification settings.
A QUIC-based proxy protocol that depends on UDP availability on the underlying network. Even with the correct address, port, and authentication details, network restrictions can cause timeouts, so check the settings and network separately. Protocol versions with similar names are not necessarily compatible; use the type specified by the server information you have.
A key-based tunneling protocol that requires compatible interface addresses, peer details, and routing ranges. It does not use the usual username-and-password combination, so do not copy fields from another protocol. A private key is sensitive connection information; remove it before troubleshooting or sharing a configuration, and never show the full key in a public screenshot.
Two different proxy protocols that may use different handshakes, authentication methods, and supported traffic types. Even with the same address, an HTTP port cannot be used as a SOCKS5 port. Check the server details separately for UDP support, authentication requirements, and encryption; the protocol name alone is not enough to tell.
03 / RULE KEYWORDS
Identify what a rule matches before looking at its action. The examples below use the documentation domain example.com and do not provide a working connection service. Also check where each rule appears in the active configuration.
A rule keyword for matching an exact domain. For example, DOMAIN,example.com,PROXY applies to that exact domain. It does not match www.example.com just because the suffix is the same, and it does not match webpage paths. For a single, specific hostname, consider an exact match to limit the effect on other domains.
Matches a domain by suffix, including its subdomains. For example, using example.com as the condition can cover that domain and its subdomains. A suffix here means a domain-name level, not any text that happens to appear at the end. If a site's resources use other domains, check those separately; one suffix rule does not necessarily cover every related request.
Matches domains that contain a specified string, usually covering more than an exact-domain or suffix rule. Unrelated domains containing the same keyword may also match, so confirm the intended scope before adding one. It checks the domain, not webpage text, search terms, or URL paths. For tighter control, first check whether a narrower condition is appropriate.
Matches based on an IP geolocation database, not a site's language, operator location, or page content. Database records may differ from the actual service location, and sites using a CDN may resolve to different addresses. When troubleshooting, consider the IP for that request and the rule order; do not assume a region based only on the site's name.
Keywords for matching IPv4 and IPv6 address ranges. The prefix length after the slash determines the size of the subnet. Address rules match IP addresses, not domain text; if a domain resolves to a different address, the matched range may change. Check the address family and prefix length before adding a rule, so you do not match an entire subnet when you intended to match one address.
A fallback keyword used when none of the preceding rules match. For example, FINAL,DIRECT sends remaining requests directly. Put FINAL at the end of the rule list so later, more specific rules can work as intended. Changing the fallback affects every request not covered above; confirm the scope before saving and testing.
Policy markers in rules that represent proxy, direct, and reject actions. They usually appear where the rule specifies what to do with a match. DOMAIN and similar keywords answer “what to match”; these markers answer “what happens next.” The policy field may also refer to a policy group defined in the configuration. Check the group name and its selected policy, not just the rule condition.
Rules are generally checked from top to bottom, and later rules do not automatically override an earlier match. Put a precise exception before any broader rule that could match it, and leave FINAL at the end. If a rule looks correct but does not work, first check whether an earlier rule already matches before adding a duplicate.
04 / SUBSCRIPTION & CONFIG
The server list answers “which remote services can be connected to”; a configuration file answers “how should traffic be handled.” They are related, but importing, refreshing, and selecting them for use are separate actions.
An interface term related to subscription management. A subscription usually retrieves and refreshes a set of server entries from a URL. Use a subscription URL you already have and import it according to its link type. A server list and a configuration file are different things. An update only means the app attempted to retrieve the list again; it does not prove every server in it can connect.
The entry point for adding server details. When entering them manually, select the correct protocol first, then fill in the address, port, and authentication details using the information you already have. Required fields vary by protocol; do not assume a blank field should be filled the way it is for another protocol. Check the saved entry before testing the connection. For step-by-step instructions, see the setup guide.
A remote service the client connects to when establishing a proxy connection. A server entry in the app usually stores its connection settings. The display name is just a label; it does not confirm the location, availability, or authentication status. If a connection fails, check the actual address, port, and protocol settings rather than relying on the label.
A file for organizing rules, DNS, and other runtime settings, unlike a subscription that only describes a server list. Importing a configuration file and selecting it are separate actions; having the file does not mean it is active. Keep a recoverable copy of the existing settings before editing. Afterward, check the active configuration and Global Routing to confirm whether the intended rules are being applied.
Text that encodes connection settings with a protocol-specific prefix, usually describing one server entry, such as ss:// or trojan://. It is different from a subscription URL used to refresh a list; importing one entry does not enable future list updates. A share link may contain a password or other authentication details. Do not share the full text or QR code when troubleshooting.
05 / DNS & NETWORK
Name resolution, establishing a connection, and loading content are separate stages. A test result only describes the part of the process it actually covers. Keep test conditions consistent when troubleshooting.
The process of resolving a domain name to an IP address, often required before a connection can be established. Successful resolution does not guarantee the connection will succeed, and normal server latency does not prove that DNS for the target website is working. Distinguish the server's domain from the target website's domain, note which step fails, and check the relevant DNS settings instead of changing everything at once.
A test used to help check connectivity. The result depends on the target, test method, and network conditions at the time. Success only shows that the path covered by that test was reachable; it does not guarantee that every website, protocol, or resource will load. If the test succeeds but a webpage fails, continue by checking the target domain's DNS resolution, the matching route, and the specific request error.
The time a test request takes to make a round trip, usually shown in milliseconds. It reflects the response time under the conditions of that test. Latency is not bandwidth and does not directly indicate webpage load speed; results from different test methods are not directly comparable. To assess an issue, repeat the test with the same network and target, and consider the actual connection results rather than choosing the lowest number.
A transport-layer protocol that does not provide the same reliable, ordered delivery as TCP; applications using it can handle packet loss and retransmission according to their own protocols. Whether a service works depends on support from the client settings, server, and underlying network. If some services work while others time out, check whether they use different transport methods. A webpage loading does not by itself rule out a network issue.