Shadowrocket Glossary: Interface Terms, Protocols & Rule Keywords

Interface & Controls

Check what a setting controls, then what the current status tells you. An enabled toggle, a saved configuration, and access to a destination are three separate things to verify.

Home: The main screen for viewing the server list, current selection, and connection toggle. Entries may have been added manually or come from a subscription you already have. A listed entry only means it is saved. Before connecting, check which server is selected; afterward, verify that access works.

Global Routing: Sets the overall routing mode for the connection: Config, Proxy, or Direct. Config routes traffic according to the current configuration rules, Proxy routes traffic through a proxy, and Direct sends traffic directly. When troubleshooting, note the current mode first so you do not mistake a change in overall routing for a single rule taking effect.

On Demand: A feature that triggers VPN connection behavior under preset network conditions; the available conditions depend on the current app settings. It controls when the app tries to connect, not which rule handles each request. If the connection comes back after you disconnect manually, check the On Demand conditions before repeatedly deleting servers.

Add Server: An entry point for manually entering existing server details. Select the protocol first, then check the address, port, authentication, and transport settings against the information from your service provider. Fields differ between protocols; changing only the server address does not make settings from another protocol applicable.

Connectivity Test: A tool for checking server connectivity, usually reported as a duration or failure. The test method, target, and current network all affect the result, so latency is not a fixed property of a server. Lower latency does not necessarily mean faster downloads. If a test times out, check the actual connection and logs as well.

DNS: The process of resolving a domain name to an IP address, an essential part of accessing a domain. Resolution failures, unsuitable results, or an unexpected DNS request path can all prevent a page from loading. Check DNS settings and matched rules together; the connection toggle alone cannot confirm that DNS is working.

VPN Configuration: A configuration Apple systems use to manage network connections. The first time a connection is set up, you may be asked to approve adding it. System approval only grants the app the relevant connection permission; it does not mean remote server authentication succeeded. Review the prompt before proceeding. If configurations conflict, check the VPN settings already on your device.

Protocols

A protocol defines how the client and server communicate; it does not guarantee that a particular server is available. When entering details you already have, check authentication, transport, and encryption settings together.

Shadowsocks: A proxy protocol whose required details commonly include a server address, port, encryption method, and password. The encryption method must match the server; do not substitute one based on a similar name. If the existing configuration includes other related parameters, preserve them as specified instead of checking only the password after import.

VMess: A proxy protocol authenticated with parameters such as a UUID, and compatible with different transport methods. A correct UUID is only part of the check; the transport path, Host, TLS, and other settings may also affect connectivity. Compare each setting with the server details you already have, and do not treat the transport method as the protocol name.

VLESS: A lightweight proxy protocol authenticated with a UUID. The protocol itself does not encrypt data; connection security and availability depend on the accompanying transport, encryption, and server settings. Its fields and configuration combinations differ from VMess, so changing the protocol type alone does not convert a configuration.

Trojan: A proxy protocol commonly used with TLS and generally authenticated with a password. In addition to the address and port, check the server name and certificate verification settings. For certificate errors, first check the name, device time, and server certificate. Turning off verification should not be a routine fix.

Hysteria2: A QUIC-based proxy protocol that typically relies on UDP. UDP restrictions on the network, mismatched authentication parameters, or inconsistent TLS or obfuscation settings can all affect connectivity. A resolvable server address alone does not confirm the protocol is working; check the actual connection result.

WireGuard: A protocol that establishes an encrypted tunnel using keys. It involves a local key, peer public key, address, and Endpoint details. Public and private keys serve different purposes and are not interchangeable; the routing scope must also match the existing configuration. A private key is sensitive information and should be removed from troubleshooting screenshots and descriptions shared with others.

HTTP / SOCKS5: Two types of proxy protocols that require separate checks for address, port, and authentication. Standard HTTP proxies and SOCKS5 do not by themselves establish an encrypted tunnel; check the actual configuration for any additional encryption. Do not infer UDP support from the protocol name alone; verify it with the server's supported features.

Rule Keywords

Read each rule in this order: match type, match value, and action. The examples below are for explaining syntax only; do not replace an existing Config wholesale without checking it first.

Rules: A configuration entry that links request matching conditions to an action. Standard rules are checked in order, so the first match can determine how a request is handled. Changing a rule's position can therefore change the result. When troubleshooting, check which rule actually matched rather than only confirming that the file contains the rule you expect.

DOMAIN: A rule keyword that matches an exact domain, for example DOMAIN,example.com,DIRECT. This rule applies to the specified domain and does not automatically cover all its subdomains. If a page requests resources from other domains, check those requests separately rather than looking only at the address bar.

DOMAIN-SUFFIX: A rule keyword that matches a specified domain and its subdomains, for example DOMAIN-SUFFIX,example.com,PROXY. It applies a consistent policy across the same domain hierarchy; it does not match every domain that happens to contain that text. Check the requested domain and its place in the hierarchy rather than treating a keyword match as a suffix match.

GEOIP: A rule keyword that matches a destination using an IP geolocation database, for example GEOIP,CN,DIRECT. A database record does not indicate where the organization behind a website is located. For distributed services, check the actual resolution result as well. If the rule does not match as expected, check DNS results, rule order, and the database's location data.

IP-CIDR / IP-CIDR6: Rule keywords for matching destination addresses by IPv4 or IPv6 network range, for example IP-CIDR,192.0.2.0/24,DIRECT. The prefix length after the slash determines the range; it does not indicate a port. If a device uses both address types, a rule for only one may not cover every connection.

FINAL: A fallback rule used when no preceding rule matches, for example FINAL,PROXY. It specifies which policy handles the remaining requests; it does not mean the current connection succeeded. It is usually placed after regular rules. Before changing it, decide how unmatched traffic should be handled.

PROXY / DIRECT / REJECT: Rule actions for proxying, direct connections, and rejecting traffic. These are at a different level from the Proxy and Direct options in Global Routing: the former describe a rule's outcome, while the latter set the overall routing mode. Keep the keywords unchanged in the configuration, and confirm that the current mode uses the rule.

Subscriptions & Config

Keep server lists, configuration files, and synced data distinct. A successful import only confirms that the data was read; you still need to verify that it works with your current network and connection.

Subscription: A source for reading and updating server entries through a link, using subscription details you already have. Updating a subscription refreshes entries from that source; it does not update traffic-routing rules in Config. Links may contain credentials, so keep them secure. If an update fails, first check whether the original link is still valid.

Server: A connection entry containing an address, port, protocol, and authentication details, also commonly called a node. Each entry represents a set of connection parameters; it does not mean the remote service is currently available. After switching entries, test the connection again. Do not rely on a name, region label, or previous test result alone.

Config: A configuration file that contains rules, policies, and related settings; Config is also the name of its interface entry. After saving or importing a file, check which Config is selected and whether Global Routing is set to use Config. Keep the original file before making changes, and adjust one setting at a time so you can restore and compare if something goes wrong.

Scan QR Code: An entry point for reading configuration data from a QR code; the imported content depends on the data encoded in the code. Check the source before scanning, then verify the protocol, address, and authentication fields. Successful recognition does not mean the connection will work. QR codes may contain full credentials, so do not include them in public screenshots.

URL Rewrite: A feature that matches request URLs against a configuration and applies actions such as rewriting or redirection. It differs from rule-based routing that selects a proxy or direct connection. Its behavior depends on the matching expression, action, and whether the request can be observed by the relevant mechanism. When troubleshooting unexpected page redirects, check the relevant entries first; avoid changing DNS and routing rules broadly at the same time.

iCloud Sync: A mechanism for syncing some app data through iCloud when the relevant settings allow it; the available data depends on the current app options. It is separate from App Store purchase history, and downloading a purchased app does not mean all configuration will reappear automatically. Before switching devices, check the sync status and keep your existing subscription details, server information, and important Config files.

App Store & Accounts

Purchase history helps you get the app; connection settings determine how it works. Shadowrocket is a paid commercial app for Apple platforms, primarily used on iPhone and iPad.

App Store: The only place to purchase and get Shadowrocket. On the product page, check that the developer is Shadow Launch Technology Limited and verify the official icon and app ID 932747118. Check the App Store page for system requirements and device compatibility. Install and update the app through the App Store. See How to verify the official listing for the link and steps.

Apple ID: The account associated with App Store purchases. The account used for iCloud may differ from the one used for Media & Purchases; check the latter when looking for purchase history. Store region affects product availability and payment details, so availability depends on what the current account's App Store page shows.

Purchased: The App Store section for finding purchases made with the original account; its name and location may change with system updates. When changing devices or reinstalling, first make sure you are using the original purchasing account, then look for Shadowrocket in your purchases. Restoring the app is separate from restoring subscriptions, servers, and Config. For the steps in order, see Restore a previous purchase.

One-Time Purchase: A one-time purchase of the app. Check the App Store page for the current price. A one-time app purchase ≠ a service plan; buying the app does not create a server or subscription. Check the same App Store page for compatibility with other Apple devices and whether the purchase is universal.