Shadowrocket’s interface is easier to navigate when you understand three areas: Home manages connections and servers, Config manages configuration files, and Settings contains app options. Proxy and Direct describe how traffic is handled. This guide is for users who have installed the app and already have their own service and subscription. Follow the steps to find key controls, understand connection status, review routing, and check results, with examples and practical checks.
Home, Config, and Settings: Know Where to Go
Home is where you manage everyday connections. The connection switch, Global Routing, Connectivity Test, and SERVER details are all related to the current connection. Config is where you manage configuration files, including rules and DNS settings. Settings contains app options such as On Demand. These are not three connection modes, and simply opening a page does not change the connection switch.
When you see an English label, first determine whether it names a page, an option, or a status. Config can refer to the configuration-file page or an option under Global Routing. Proxy can describe a routing mode or appear in a policy or connection log. Its location provides context; a single label does not tell you how the entire device is behaving.
| Label | Where it appears | What it means and what to check |
|---|---|---|
| Home | Main screen | Check connection status, select a server, and open Global Routing or Connectivity Test. |
| Config | Configuration-file page | Manage and select configuration files. Keep a working copy before editing. |
| Settings | App settings page | Adjust app options. Settings such as On Demand are found here. |
| SERVER | List on Home | Shows server entries. Selecting an entry does not mean a working connection has been established. |
| Data | Traffic statistics or data area | View sent and received data. Check the reporting period, direction, and units. |
| Not Connected | Connection status | The client VPN connection is not established. This does not mean the device itself has no network connection. |
This guide uses the English interface on iPhone and iPad as a reference. Layouts may differ across devices; follow the screen you see. Shadowrocket is available only through the App Store on Apple platforms. Check the App Store page for system requirements.
Not Connected and Connected: Connection Status Does Not Confirm Website Access
Not Connected means the client VPN connection has not been established. The first time you connect, the system may ask for permission to add a VPN configuration. This authorization is needed to set up the system network extension. Verify which app initiated the request, then follow the system prompt. Connected means the client connection is established, but it does not confirm that the current server, DNS, or every route to a destination is working correctly.
Troubleshoot in this order: check the status, review Global Routing, then inspect the specific request. Otherwise, it is easy to mistake “the system connection is established” for “all traffic is going through the current server.” With Direct selected, a change in connection status does not mean a request is using a proxy route.
-
Verify the Server
Go to Home → SERVER. Confirm that the selected entry is from your existing configuration, and check its address, port, and protocol rather than relying on its display name alone.
-
Check Routing
Go to Home → Global Routing and note the selected option. If you intend to use rules from a configuration file, check that Config is selected.
-
Connect
Return to Home and turn on the connection switch. If the system asks to add a VPN configuration for the first time, follow the prompt to authorize it, then check whether the status changes from Not Connected.
-
Test a Request
Go to Home → Connectivity Test and review the result, then open the page you actually need. Confirm the test result and access to the target page separately.
Global Routing: Proxy, Direct, Config, and Scene
Global Routing sets the overall traffic-handling mode. Proxy routes traffic through a proxy, Direct sends traffic directly, and Config routes traffic according to rules in the current configuration. “Global” refers to traffic the client can handle; it does not mean every app or system service can bypass platform restrictions.
Scene applies routing arrangements based on configured scene conditions. It is not a transport protocol or a more powerful connection mode than Proxy. Before judging whether a request will go direct or through a proxy, check the scene conditions, the associated configuration, and the actual result.
Two Checks: Verify Rules and Isolate Routing Issues
Check Whether Rules Are Applied
- Home → Global Routing → Config。
- Confirm the active configuration file on the Config page.
- Make a new request to the same destination and check the matched rule and its policy.
Check Whether the Proxy Route Works
- Note the current Global Routing selection.
- Temporarily select Proxy and test the same destination again.
- Restore the original selection after testing, then decide whether the rules need adjustment.
Change one condition at a time. If Proxy works but Config does not, check the rules, policies, and DNS further; this alone does not prove the entire configuration file is wrong.
Config and Rule Keywords: Distinguish the Page from the Routing Option
Selecting a configuration file on the Config page specifies the source of rules and other settings. Selecting Config under Global Routing tells Shadowrocket to handle traffic according to that configuration. If you edit a file without confirming it is active, or leave Proxy or Direct selected, the results may not match your expectations. Back up the file before editing. Afterward, confirm the changes are saved and the file is active, then make a new request.
Config in the Interface
- Entry point
- Config page
- What it refers to
- The configuration file and its rules, DNS settings, and other contents
- Related option
- Home → Global Routing → Config
- Check in this order
- Back up, edit, save, confirm it is active, and test again
The file exists, the file is selected, and the request matches the expected rule: these are three separate checks.
Rule keywords
- DOMAIN-SUFFIX
- Match by domain suffix
- GEOIP
- Match based on IP geolocation database results
- IP-CIDR
- Match by IPv4 address range
- FINAL
- Final policy used when no earlier rule matches
Rules are evaluated in order. Check earlier rules first if they might match the destination.
The example below shows the syntax for the [Rule] section of a configuration file; it is not a complete configuration. example.com and 192.0.2.0/24 are documentation examples and cannot be used to test a real service. Here, PROXY and DIRECT are policy keywords, not buttons to look for by those exact names in the interface.
[Rule]
DOMAIN-SUFFIX,example.com,PROXY
IP-CIDR,192.0.2.0/24,DIRECT,no-resolve
GEOIP,CN,DIRECT
FINAL,PROXYno-resolve means the IP rule does not actively trigger a domain lookup for matching; it does not disable all DNS. GEOIP,CN,DIRECT uses an IP database for matching; it does not classify sites by their displayed language. If an earlier DOMAIN-SUFFIX rule matches a domain, later GEOIP and FINAL rules will not determine its policy.
Subscribe, Type, and Protocol Names: Import Source vs. Connection Protocol
Subscribe indicates the subscription import type. Shadowsocks, VMess, VLESS, Trojan, Hysteria2, WireGuard, and others are connection protocol names. A subscription may contain multiple server entries; use the information provided with your existing service to verify each entry’s protocol and settings. An HTTPS subscription URL does not mean the servers it contains use HTTPS as their protocol.
- Where to add it: Go to Home → “+” in the upper-right corner → Type → Subscribe. Enter your own subscription URL and save. The example URL
https://example.com/sub?token=xxxxis only for identifying the field; it cannot be used to connect. - What an update does: Updating a subscription fetches its entries again. It does not upgrade the client or refresh every rule in Config.
- Check the settings: The server address, port, password or identity details, TLS, and transport settings must be compatible. Port
443alone does not confirm the protocol or that the connection will work. - After updating: Return to Home and check that the selected entry is still the one you expect, then test the connection. Check the update result and the current selection separately.
Data and Connectivity Test: Check Statistics, Latency, and Access Separately
Interpret Data according to the page or area where it appears: it refers to data or traffic statistics, not a routing mode. First check the reporting period, then the upload or download direction and units. A rising total means data is being counted, but the total alone cannot show whether a specific domain used Proxy. Client statistics are not a substitute for a service provider’s billing records.
Connectivity Test checks reachability. Results depend on the test target, method, and network conditions at the time. A successful test does not guarantee that other domains, ports, or UDP requests will work. The displayed time is not a download speed; milliseconds cannot be converted into throughput.
| What you observe | What it tells you | What to check next |
|---|---|---|
| Connected, but the page times out | The client connection is established, but access to the destination still has a problem | Check Global Routing, the current server, DNS, and the policy matched for that destination. |
| Data counters change | There is data activity within the reporting scope | Check the specific request log to confirm the destination and route; do not rely on the cumulative total alone. |
| Connectivity Test succeeds | The destination was reachable under those test conditions | Test the actual page you need and distinguish differences in destination from differences in protocol. |
| Behavior is unchanged after editing a rule | It is not yet clear that the new rule was applied to the request | Check that Config is selected under Global Routing, verify the active file and rule order, then make a new request to the destination. |
Settings and On Demand: Automatic Connection Does Not Select Rules
Settings → On Demand lets you configure conditions for connecting on demand. It controls when the client VPN connection is established or disconnected. Global Routing controls how traffic is handled while connected; they serve different purposes. If an existing on-demand condition reconnects after you manually turn the connection off, check the condition first instead of repeatedly changing server settings.
Before making changes, note the existing conditions. Change one item at a time and test separately on the relevant Wi-Fi and cellular networks. System authorization, network changes, and existing connections can all affect the results; one network change cannot establish what will happen in every network environment.
Why Does All Traffic Still Use a Proxy After I Select a File in Config?
Go to Home → Global Routing and check whether Proxy is still selected. To route traffic according to file rules, select Config, return to the Config page to confirm the active file, then make a new request to the same destination.
Why Does the Connection Come Back After I Turn It Off?
Go to Settings → On Demand and check for a connection condition triggered by the current network. To troubleshoot manually, first pause the relevant on-demand setting and watch the connection switch. Restore the setting afterward if needed.
Does an Increase in Data Mean This Page Is Using Proxy?
No. First check Global Routing on Home, then use the rules and policy records for the specific request to determine its route. Activity from other apps may also affect the statistics.
The Subscription Updated Successfully. Why Can’t I Access the Site?
A successful update only means the subscription content was retrieved. Return to Home and confirm the selected entry, check Global Routing, run Connectivity Test, then check DNS and access to the actual destination separately.