Official Manual / Terms and Definitions
Check where a term appears before deciding whether it refers to an interface option, a protocol parameter, or a rule action. This page keeps the original English terms and explains common usage across five categories. For an initial setup, start with Global Routing, Subscribe, and configuration files.
Capitalization and context matter: Proxy is a Global Routing interface option, while PROXY is a rule action. Config can refer to either a page or a routing mode. When a term has multiple meanings, use the page and context to interpret it rather than changing settings based on a translation alone.
01 / Interface & Toggles
These terms describe how connections are handled or where to check results. A successful test does not necessarily mean a webpage will load.
Sets the global routing mode for connections. The three options are Config, Proxy, and Direct. Choose Config to route traffic according to rules. Before troubleshooting, note the current option so you do not mistake a mode change for a rule change.
In Global Routing, this means connections are handled according to the rules in the current configuration. As a page name, it refers to configuration management. Choosing Config does not send every connection through a proxy; the actual route also depends on the active configuration, rule order, and final action.
The proxy mode in Global Routing, often called global mode, routes applicable connections through a proxy. It does not fill in server details or guarantee that the server is reachable. To troubleshoot a failure, check the selected server and authentication details.
The direct mode in Global Routing means applicable connections are not forwarded through a proxy server. It does not mean all system network settings are disabled, and the option alone does not determine VPN status. When comparing results, also note the connection toggle and current network.
Triggers a VPN connection when specified conditions are met. Whether it connects depends on the network and the conditions in effect. This controls when a connection starts; it does not replace rule-based routing. If the VPN reconnects after you disconnect manually, check whether a condition matches the current network.
Tests whether a server is reachable on the current network. The test duration or latency reflects only that test method and its conditions. A lower reading does not mean faster downloads, and a successful test does not guarantee access to every destination. Test an actual destination and check DNS, rules, and the connection route.
Shows traffic statistics. Before interpreting them, check what is being measured, the time range, and whether the counters have been reset. Cumulative usage is not current speed or necessarily the service provider's billing data. To troubleshoot routing, compare the change before and after an action, then check the connection logs.
02 / Protocols
Protocol names indicate which parameters are required; they are not a ranking of speed or reliability. Use the actual settings for the server you already have.
A proxy protocol. Common connection details include the server address, port, encryption method, and password. The encryption method must match the server, and the password cannot be replaced with an identity from another protocol. Check any additional transport parameters against the original details.
A proxy protocol that uses an identity and other parameters to establish a connection. Common configurations also specify transport, path, and TLS. Correct address and port alone are not enough: the identity, transport, and security settings must match. Check each separately instead of repeatedly changing rules.
A proxy protocol typically used with a specified transport and security settings. VLESS and VMess are not interchangeable by simply changing the name. When adding a server, keep the identity, transport parameters, and security options from the existing configuration.
A proxy protocol that commonly establishes connections with TLS and requires the correct password and server details. The connection address and the name used for certificate verification may serve different purposes; enter them as specified in your existing configuration. If you see a certificate error, check the name, device time, and certificate status first.
A QUIC-based proxy protocol that uses UDP. Authentication and TLS settings must match the server. The result can depend on whether the current network allows the required UDP traffic. If behavior changes after switching networks, compare network conditions first, then check whether rules are involved.
A protocol that creates a tunnel using keys. The configuration distinguishes the local private key, peer public key, tunnel address, and endpoint address. Do not swap the public and private keys; the private key is sensitive. DNS and MTU can also affect operation, so check the existing configuration rather than copying values from someone else.
A proxy protocol that may use username and password authentication, depending on the server. Confirm TCP and UDP support separately. SOCKS5 does not by itself imply encryption or guarantee that the server supports UDP forwarding. Check the specific service capabilities when configuring and testing it.
03 / Rule Keywords
Rules typically consist of a keyword, a match value, and an action. First check what the rule matches, then its position, and finally whether the action is what you expect.
Rules specify which connections match and what happens when they do. In a configuration, the rule section is marked [Rule]. Rules are usually checked in order, and the matching result is applied. Put specific conditions before broader ones, and make sure Global Routing is set to Config.
Matches an exact domain, for example DOMAIN,example.com,PROXY. It does not automatically include all subdomains or match a complete webpage URL. Do not include a protocol prefix, path, or query parameters in the domain field.
Matches a specified domain and its subdomains, for example DOMAIN-SUFFIX,example.com,PROXY. The domain here is an instructional example. For actual use, confirm the target domain and avoid changing the routing of unrelated connections with an overly broad match.
Matches a keyword contained in a domain, for example DOMAIN-KEYWORD,example,PROXY. The keyword does not have to appear at the end, so the rule may match multiple unrelated domains. If you only need to cover one domain and its subdomains, consider whether DOMAIN-SUFFIX is more precise.
Matches IPv4 ranges using an address and prefix length, for example IP-CIDR,192.168.0.0/16,DIRECT. The prefix length determines the range; a smaller number usually covers more addresses. For IPv6 ranges, use IP-CIDR6 rather than mixing the two address types.
Matches destination addresses using an IP geolocation database, not the website's language, domain text, or the user's location. Database records may differ from a server's actual deployment location. To troubleshoot an unexpected match, check the resolved address and the rule that matched it.
Specifies the final action when no preceding rule matches, for example FINAL,PROXY. It is usually placed at the end of the rules and does not mean every connection in the configuration uses this action; earlier matches still determine the route for those connections.
These three uppercase terms are rule actions: proxy, direct, and reject. The actual proxy exit for PROXY also depends on the current server or policy settings. These actions are not at the same level as Proxy and Direct in Global Routing.
04 / Subscriptions & Configuration
A server entry provides connection parameters; a configuration file organizes how connections are handled. Identify the content type before importing, and check what will be replaced before updating.
An entry point or setting for importing and updating a subscription you already have. The imported content depends on the link type; a server list and a full configuration are not the same thing. Get the link from your own provider. It may contain access credentials, so do not post it publicly or share screenshots that reveal it.
An entry point for manually adding a single server. Select the actual protocol first, then enter the address, port, and matching authentication or transport parameters. Unlike a subscription update, a manually entered record usually needs to be maintained by you; it will not automatically receive new details when the provider changes its settings.
The process of resolving a domain name to an address. The result affects subsequent connections and some IP-based rule matches. Successful resolution does not mean the destination connection will succeed, and using a proxy does not mean all DNS requests follow the same route. Check DNS settings and the final connection path separately.
A text configuration for organizing rules, DNS, and other settings. It is not the same as a single server entry, and it does not necessarily include a usable server. After importing, check whether it is selected as the active configuration. Before replacing it or applying a remote update, preserve local changes to avoid overwriting existing rules.
For a first import, follow this sequence: identify the type of information you already have → choose the import method → check the server entry → select Global Routing → test the connection. For specific steps and common failure points, see the Shadowrocket setup guide. Return to the rule categories on this page to understand matching behavior.
05 / App Store & Purchase
Shadowrocket is a paid client for Apple platforms, available exclusively through the App Store. Check the App Store listing for system requirements and purchase availability.
On the product page, check the developer, Shadow Launch Technology Limited; the official icon, which should match the one on this site; and app ID 932747118 in the URL. Do not rely on the name or search result ranking alone. Before getting the app, verify each detail using the App Store listing verification guide.
A payment for the right to use the client. Check the App Store listing for the current price and purchase availability. A one-time client purchase is not a proxy service plan. Existing subscriptions or server details are separate; buying the app does not generate connection details.
The App Store entry for finding previous purchases and downloading the app again. When changing devices, use the Apple Account associated with the original purchase to check your purchase history. Restoring the app does not restore local server or configuration data, so check that your details are still available after reinstalling. Check the App Store listing for Family Sharing availability.
This glossary explains terminology; it does not replace checking your configuration. If a connection fails, first check the network, server parameters, and current Global Routing mode, then check DNS and rules. Change one setting at a time and record the results before and after each change to identify the layer causing the problem.