Official Manual · Glossary

Shadowrocket Glossary

First identify where a term appears, then consider what it controls. This glossary explains interface options, protocol names, rule syntax, and networking concepts separately. The same term can have a different scope in a different part of the app.

30 common terms
Interface terms stay in English
Each entry has a direct link

01 · Interface & Controls

Routing Modes & Connection Status

Global Routing sets how traffic is handled overall, while the connection toggle controls whether a connection is established. Do not confuse routing modes, individual rule actions, and test results.

Global Routing: An option on the Home screen for choosing the overall routing mode: Config, Proxy, or Direct. If rules do not seem to work, first check that Config is selected, then review the active configuration. Changing the mode does not change the server's protocol settings.

Config: In Global Routing, Config means requests are handled according to the current configuration, with rules determining their routes. As a screen name, Config is also the entry point for managing configuration files. Check whether the term refers to a routing mode or a file list.

Proxy: The proxy mode in Global Routing routes traffic primarily through the currently selected proxy, rather than applying the same choice to each request according to routing rules. It is distinct from PROXY in uppercase in a rule. Selecting Proxy cannot fill in missing authentication details or fix an incorrect port.

Direct: The direct mode in Global Routing sends requests to their destinations over a direct connection. It can help compare the local network path with the proxy path, but still depends on DNS, the destination service, and current network conditions. Direct does not mean every website is reachable.

On Demand: A feature that triggers connections based on conditions; check its behavior against the in-app conditions and system state. It determines when to connect, while routing rules determine how requests are handled. To troubleshoot automatic connections, check the relevant conditions as well as the Home screen toggle.

Connectivity Test: A way to check how a server responds under specified test conditions. Results depend on the test method, destination, and network state. A successful test does not mean every website is reachable, and the test duration is not download speed. If results are unexpected, check actual requests and error logs.

02 · Protocols

Connection Types & Configuration Requirements

The protocol type must match the existing server details. Changing the type in Add Server does not turn the same credentials into a different protocol. For a closer look at protocol trade-offs, see the Protocol guide →

Shadowsocks: A protocol that establishes proxy connections using a specified encryption method and credentials. Common settings include the server address, port, password, and encryption method. These details must match the server; do not guess the encryption method based on a name. Performance also depends on server load and the local network.

VMess: A proxy protocol with an authentication mechanism that typically uses a UUID and can work with different transport methods. A valid UUID is only one requirement; the transport path, server name, and TLS settings must also match. Check each field rather than repeatedly changing the entry name.

VLESS: A proxy protocol designed around streamlined authentication and forwarding, typically using a UUID. It is not interchangeable with VMess just because both use UUIDs. Connection protection depends on the security layer and transport settings. After importing, check that the type, authentication fields, and transport parameters match the source details.

Trojan: A proxy protocol commonly used with TLS and password authentication. Along with the server address and password, check the server name and certificate validation. Resolving the address does not guarantee that the TLS handshake will succeed. If you see a certificate error, check the name, device time, and server settings first.

HTTP / SOCKS5: These are two distinct proxy protocols, with different supported request types, authentication methods, and transport capabilities. The protocol name alone does not mean traffic is encrypted or indicate which types of traffic are supported. When adding a server, choose the type and security options that match the server details.

WireGuard: A tunnel protocol based on key-based identity and UDP transport. Its configuration includes PrivateKey, PublicKey, interface addresses, Endpoint, and AllowedIPs. Keys, addresses, and routing ranges each have a distinct role and cannot be substituted for one another. PrivateKey is sensitive; remove it before sharing troubleshooting details.

Hysteria2: A QUIC-based proxy protocol that relies on an available UDP network path. Its settings also include authentication and server name parameters. The number in the protocol name is part of the name, not an app version listed by this site. Speed and battery use depend on packet loss, transport load, and device state, so the protocol type alone is not enough to predict performance.

03 · Rule Keywords

Match Conditions & Policies

First understand what a rule matches, then what it does when matched. The domains and addresses below are examples of syntax, not usable server details. Rule order also affects the result.

DOMAIN: Matches an exact domain. For example, DOMAIN,example.com,DIRECT applies to example.com itself. It does not automatically cover all subdomains, and it does not match a full web URL. If a request uses a different domain, check the actual request log.

DOMAIN-SUFFIX: Matches a domain suffix. For example, DOMAIN-SUFFIX,example.com,PROXY can cover example.com and its subdomains. Its scope is broader than DOMAIN, but it does not match any string that happens to contain the text. Before adding it, confirm that all those subdomains should use the same policy.

GEOIP: Matches using an IP geolocation database; results depend on its data and the resolved address of the destination. IP geolocation does not indicate user location, or the actual service location. A domain may resolve to multiple addresses, so do not infer the match from the website name alone.

IP-CIDR: Matches IPv4 address ranges. For example, IP-CIDR,192.168.0.0/16,DIRECT describes a private address range. The number after the slash is the network prefix length, not a port or connection count. An overly broad range may also match addresses that should be handled differently.

IP-CIDR6: Matches IPv6 address ranges, a different address family from the one handled by IP-CIDR. If a destination has both IPv4 and IPv6 addresses, IPv4 rules alone do not mean every request path has been checked. If results differ, check which address family is actually in use.

FINAL: Handles requests that did not match any earlier rules and usually serves as the fallback at the end of the list. FINAL,DIRECT sends remaining requests over a direct connection; it does not disable preceding rules. To investigate unexpected routing, find the rule that actually matched first, then check whether the request fell through to FINAL.

PROXY / DIRECT / REJECT: These are rule policies: PROXY sends requests through a proxy, DIRECT uses a direct connection, and REJECT denies the request. They describe the action after a match, not a protocol type or matching condition. Distinguish the uppercase policies from Proxy and Direct in Global Routing by where they appear.

04 · Subscriptions & Configurations

Entries, Files & Purchase Records

Updating a subscription, switching configurations, and updating the app are three separate actions. The explanations below assume you already have your own subscription or server details; purchasing the app does not create them.

Server Entry: A connection record containing a server address, port, authentication details, and protocol settings; it is also often called a node. The display name in the SERVER section is only a label and does not confirm the server's location, speed, or availability. When entering details manually with Add Server, match each field to the information you already have.

Configuration File: A text configuration for organizing rules, DNS, and other settings. It serves a different purpose from an individual server entry. After importing a file, check which one is active and consider its effect alongside Global Routing. Keep a working configuration before replacing a file so you can compare or restore it.

Rule: A configuration entry made up of a matching condition and a policy, such as matching a domain and choosing DIRECT. Rules are generally checked in order; a broad condition may match first and prevent a more specific rule later in the list from taking effect. To investigate a problem, check which rule actually matched rather than only searching the file for the domain.

Purchased Items: An App Store option for finding existing purchase records. When switching devices or reinstalling, first check that you are using the Apple ID used for the purchase. Shadowrocket is a one-time purchase; see the App Store listing for current pricing and whether Universal Purchase applies. A one-time app purchase is not a service plan, and restoring the app does not restore server information.

05 · DNS & Networking

Name Resolution, Handshakes & Response Times

A request may involve name resolution, establishing a connection, a security handshake, and data transfer. Success at one stage does not guarantee success at the next; use the stage where the error occurs to narrow down the issue.

DNS: A system that resolves domain names to records such as IP addresses. The results are an important input for the connection that follows. A successful lookup only means a response was received; it does not mean the address is reachable or the destination service is working. DNS queries and app traffic do not necessarily take the same path, so check them separately.

DNS over HTTPS: A way to send DNS queries over HTTPS, commonly called DoH, which protects queries between the client and the resolver. The resolver must still be reachable, and its domain may itself require an initial lookup. Enabling DoH does not mean all app traffic will use a proxy.

TLS: A security protocol that protects connections and verifies the identity of the other party. It is not the same thing as a proxy protocol type. Certificate validation can fail because of the server name, certificate expiration, trust chain, or device time. Check these details instead of assuming the password is at fault.

SNI: An extension in the TLS handshake that specifies the target server name, helping a service at a shared address select the right website and certificate. It may differ from the IP address used for the connection, but must match the server setup. If the name does not match, the handshake may fail even when the port is reachable.

Latency: The response time measured using a specific test method. Interpret it alongside the test type, destination, and local network conditions. Low latency does not mean high throughput or guarantee stable large-file transfers. Keep test conditions consistent when comparing results, and consider actual access and error logs.