Look up terms by screen and use case to distinguish connection modes, matching conditions, and handling policies.
English names are kept as they appear in the app and configuration files. Use the link beside a heading to jump to each term. For step-by-step instructions, see the tutorial; to check purchase history, see the App Store guide.
Identify the current mode before checking whether a configuration is taking effect. An enabled connection switch only means the system has started handling the relevant traffic; it does not prove that a website or server is reachable.
The control for choosing how traffic is handled overall. The three modes are Config, Proxy, and Direct. To route traffic by domain or IP rules, select Config and check the active configuration. Changing modes does not supply missing server authentication details or fix a remote connection error.
This label is used in two common contexts: the configuration management screen and the mode in Global Routing that handles traffic according to a configuration. Configuration management lets you view or edit files; selecting Config mode tells traffic to follow the active configuration. Saving a file without selecting the intended configuration may produce unexpected results.
These are modes in Global Routing for proxying or connecting directly, changing how traffic is handled overall. To check whether rules affect a result, temporarily switch modes if appropriate and make a new request. Restore the intended mode afterward, and do not confuse interface modes with uppercase rule policy keywords.
A mechanism that triggers a connection when configured conditions are met, useful when managing connections based on network conditions. It depends on the system VPN configuration and related conditions; it does not guarantee server availability. If a connection starts again after you disconnect manually, check On Demand settings before treating it as a fault.
The entry point for manually entering your existing server details. Select the protocol type, then check the address, port, and authentication fields. Forms for different protocols are not interchangeable, and fields with the same label, such as password or user ID, must match the original configuration. Saving confirms that the entry was created; you still need to test the connection.
A tool for checking reachability; interpret results in light of the selected test method. The reported time usually reflects a particular probe or request round trip, not download speed, and does not cover every website. If a test times out, check the network, server parameters, and the result of a specific request.
A protocol defines how two sides establish a connection; transport and security-layer settings may be configured separately. The descriptions below assume you already have your own subscription or server details. Use the corresponding configuration as your reference when entering parameters.
A proxy protocol with common parameters such as server address, port, encryption method, and password. The encryption method must match the server; do not change it at random to try to connect. When entering existing details manually, check for additional transport parameters so nothing is missed by copying only the address and password.
A proxy protocol that uses parameters such as a user ID to establish a connection and can work with different transport methods. Check protocol identity parameters separately from the transport path and security-layer settings. Even if the address and user ID match, a mismatched transport method or path can still prevent a connection.
A proxy protocol whose user ID, transport, and security-layer settings must match the server. The name VLESS alone does not tell you which security layer the connection uses. When entering details manually, check each field against your existing configuration instead of copying fields from another protocol.
A proxy protocol commonly used with TLS. Check both the authentication password and certificate settings. The server address and the name used for certificate validation may serve different purposes, so do not assume they are the same field. If you see a certificate error, check the name and device time, and keep certificate validation enabled.
A proxy protocol based on QUIC that uses UDP. Its performance depends on the network path, congestion, and server settings. Check the original values for fields such as password, sni, and obfs. If the network restricts UDP, changing rules alone usually will not resolve a handshake problem.
A VPN protocol that uses public and private keys and tunnel addresses. Common fields include PrivateKey, PublicKey, Address, and AllowedIPs. Treat the private key as sensitive information and never include it in a public support screenshot. Set MTU and address ranges according to the actual configuration rather than copying someone else’s values.
Two distinct proxy protocol types. Select the one supported by the server and check its authentication requirements. A destination website using HTTPS does not mean you should choose HTTP as the proxy type. The protocol name alone also does not tell you whether traffic between the client and proxy server is encrypted; check the transport settings.
A rule usually specifies the match type first, the value to match next, and the policy last. Asking “What does this match?” before “What happens when it matches?” makes issues easier to diagnose than looking at a keyword in isolation.
Matches one exact domain name. For example, DOMAIN,example.com,DIRECT applies to that domain itself. It does not automatically cover all subdomains or match URL paths. To handle different paths under the same domain differently, changing the domain in this rule is not enough.
Matches by domain suffix, usually covering the specified domain and its subdomains. For example, DOMAIN-SUFFIX,example.com,PROXY. Enter only the domain, not the scheme or page path. If a subdomain needs an exception, place its more specific rule before this one.
Matches a string contained in a domain name, useful when you intentionally need to cover multiple related domains. A short keyword may also match unrelated domains, so this is not a simple substitute for DOMAIN-SUFFIX. If a rule matches unexpectedly, first check whether the keyword is too broad.
Matches according to how the destination IP is classified in a geographic database, for example GEOIP,CN,DIRECT. Database classification does not indicate a website’s display language, where its operator is based, or where the user is located. A domain may also resolve to different addresses, so check the actual destination IP when investigating a rule result.
Used to match IPv4 and IPv6 address ranges; the number after the slash is the network prefix length. For example, 192.168.0.0/16 represents an IPv4 network, not a single host. Setting an IPv4 rule does not mean IPv6 traffic will automatically match the same condition.
The final handling rule when none of the preceding rules match. It is usually placed at the end of the rule list. FINAL,DIRECT and FINAL,PROXY provide different fallback behavior, so choose according to your needs. When investigating why a destination connects directly or through a proxy, check whether it falls through to this rule.
Built-in rule policy keywords for proxying, connecting directly, and rejecting requests. They go in the policy field and cannot replace a domain or address condition. PROXY still depends on an available proxy selection, while DIRECT does not mean a request bypasses the device’s local network.
Rules are generally checked from top to bottom. Put specific exceptions before broader conditions, then use FINAL as a fallback. If two rules cover the same target, the later rule may never take effect. After making a change, save it, confirm the active configuration, and test again with a new request.
[Rule]
DOMAIN,status.example.com,DIRECT
DOMAIN-SUFFIX,example.com,PROXY
FINAL,DIRECTFor a line-by-line explanation, see the DOMAIN-SUFFIX rule examples.
A server entry describes how to connect, a subscription updates entries in bulk, and a configuration file organizes rules and general settings. Identify the content type before importing so you do not mistake one operation for another.
A subscription imports your existing subscription URL and retrieves or updates server entries from its remote content. Subscription URLs may contain credentials, so treat them as sensitive. A successful update means the content was retrieved and parsed; it does not guarantee that every server can connect or that a complete rule configuration has been activated.
A set of connection parameters saved in the app, usually including the protocol, address, port, and relevant authentication details. It is also often called a node. Its display name is for identification and does not prove its actual location or performance. After switching entries, you may need to reconnect; make a new request to verify the change.
A text configuration for organizing general settings, rules, and policies. It may contain sections such as [General] and [Rule]. It is not the same kind of content as a server subscription. Before making changes, keep a copy that you know works. After importing, confirm that the intended file is selected and check its rules and related settings.
DNS resolves domain names to IP addresses; DoH carries DNS queries over HTTPS. Successful name resolution does not guarantee that the subsequent connection will work, and changing the resolver does not change the traffic route. Check resolution results, rule matches, and the destination connection separately, and avoid changing several settings at once.
The entry point for reading connection details from a QR code. The result may be a single server entry or a subscription URL. A QR code is only a way to carry data; it does not verify that the content is correct. Before saving, check the protocol, address, and other parameters. If the format is not recognized, compare the details with your original configuration.
Continue in order: Import an existing configuration, select Global Routing, and test the connection.
Shadowrocket is a paid client for Apple platforms, primarily iPhone and iPad. Compatibility with Mac, Apple TV, and Apple Vision, along with system requirements, is as listed on the App Store page.
The only place to get Shadowrocket, and the place to check its price, compatibility, and purchase availability. Verify the official icon, developer Shadow Launch Technology Limited, and app ID. The name or position in search results alone is not enough. See how to verify the genuine app for detailed steps.
The app identifier in the App Store product URL. Shadowrocket’s ID is 932747118, shown in the URL as id932747118. It identifies the specific app; it is not an account number or proof of purchase. Check this identifier even if the language or currency differs between storefronts.
The app’s purchase model. The US storefront price is about $2.99; actual prices vary by storefront and are shown on the App Store page in local currency. A one-time app purchase is not a service plan. Connecting still requires your own existing subscription or server details. Buying the app and maintaining connection details are separate things.
The App Store section for viewing purchase history and downloading the app again. If you get a new device or reinstall the app, first check which store account you are using and its purchase history. Restoring the app does not restore its in-app configuration; check server details and rules separately. Family Sharing availability depends on the App Store listing and account settings.