Global Routing: Choose how traffic is handled
Global Routing determines how traffic is handled; it does not fix incorrect server settings. For everyday use, Config typically lets the active configuration's rules decide which requests use PROXY, DIRECT, or REJECT. Switch to Proxy or Direct temporarily only when comparing behavior. The three modes are named Config, Proxy, and Direct in the app.
Steps: Open Home, go to Global Routing, and check the selected mode. After switching, return to Home and verify the selected server and connection toggle, then retry the request. A changed mode label does not mean an existing connection has been re-established using the new mode. For a clean test, close the target app's existing connection or reopen the page.
| Mode | How it works | When to use it | What to watch for |
|---|---|---|---|
| Config | Uses the rules and policies in the active Config. | For everyday routing by domain, IP address, and other conditions. | Check rule order, policy names, and FINAL—not just the server. |
| Proxy | Routes intercepted traffic through the currently selected proxy. | Compare with Config to see whether routing rules are causing the difference. | Switching to Proxy will not restore an unavailable server. |
| Direct | Handles intercepted traffic as a direct connection. | Useful for checking connectivity on the local network itself. | It does not turn off the connection toggle or guarantee direct routing for every app. |
Choosing a mode: If a destination works in Proxy but not in Config, check which rule it matches before changing protocols. If Direct also cannot reach a destination that should be accessible directly, check Wi-Fi, cellular service, and the destination itself. After comparing modes, switch back to Config to avoid leaving a temporary troubleshooting setting in place.
Routing rules: Match conditions and policies
Each rule has two parts: what to match and what to do when it matches. DOMAIN and DOMAIN-SUFFIX are match types; PROXY, DIRECT, and REJECT are policies. Match types describe the target, while policies determine how to handle it. Rules are generally evaluated in order: put specific exceptions before broader rules, and use FINAL at the end to handle traffic that has not matched anything else.
Steps: Open Config, confirm which configuration is active, then open its editor and review the rules. Keep a recoverable copy before saving. Afterward, confirm that the file is still enabled and Global Routing is set to Config. Editing an inactive file will not change the routing currently in use.
| Rule type | What it matches | Limitations |
|---|---|---|
DOMAIN | An exact domain name. | Best for a single, specific hostname. |
DOMAIN-SUFFIX | A domain and its subdomains. | Check the suffix's scope to avoid affecting unrelated services. |
DOMAIN-KEYWORD | A keyword in a domain name. | Can match more broadly than intended, including unrelated domains. |
IP-CIDR / IP-CIDR6 | An IPv4 / IPv6 address range. | Matching an address range is not the same as matching a domain. |
GEOIP | Classification using an IP geolocation database. | Depends on the database and may not precisely reflect a service's location. |
USER-AGENT | A detectable User-Agent value. | Limited by which request details are visible; it cannot identify every app over encrypted connections. |
FINAL | Traffic that did not match any earlier rule. | Check that the final policy is what you expect. |
Understand rule order with a minimal example
DOMAIN-SUFFIX,example.com,PROXY
GEOIP,CN,DIRECT
FINAL,PROXYThis snippet illustrates syntax only: it matches example.com and its subdomains first and applies PROXY; then it applies DIRECT to addresses matching GEOIP; all remaining traffic goes to FINAL. It is not a complete configuration and includes no usable servers. Where PROXY sends traffic depends on the selected server or the corresponding policy in the configuration. REJECT denies matching requests; it is not another connection mode.
Note: A service may use multiple domains, IP addresses, or connection protocols. If the main page loads but some resources fail, check the actual destinations of the failed requests and add targeted rules. Do not move a broad DOMAIN-KEYWORD rule ahead of all others just to fix one domain, or replace an existing configuration with a complete rule set from an unverified source.
Subscribe and server management
Subscribe imports and updates a group of server details. An individual Add Server entry stores the protocol and connection parameters for one server. Neither is the same as Config: importing a subscription does not mean a particular set of rules is in use, and selecting a Config does not provide server details. When troubleshooting, check separately which server and which configuration are currently active.
Steps: On Home, tap + in the upper-right corner, open Add Server, set Type to Subscribe, paste a link from your service provider, and save. Once the update finishes, return to the SERVER list on Home and select an entry. To add a single server, choose its Type and enter the address, port, and authentication details you already have. If you have a QR code, use Scan QR Code.
Configuration: The protocol must match the details provided by your service provider. Shadowsocks, VMess, VLESS, Trojan, HTTP, SOCKS5, WireGuard, and Hysteria2 use different fields; changing Type does not make the previous protocol's settings valid. Check any existing instructions for transport, TLS, server name, and other details. Do not guess settings based on the port number.
After updating a subscription, first make sure the server list actually refreshed, then run Connectivity Test. An update failure and a server connection failure are different issues: the subscription link may be unreachable or return unexpected content, while a connection failure concerns the server itself. Avoid repeatedly deleting the entire group before saving its details; you could lose the last copy available for reference.
Note: Subscription links, QR codes, and server details may contain authentication information and should not be shared publicly. A subscription refresh may overwrite manual changes to its entries, so first determine whether the subscription or you manage those details. When describing an issue, share only the protocol, error category, and relevant settings; hide links and authentication fields.
On Demand: Connect based on conditions
On Demand lets the system initiate a connection when configured conditions are met. It controls when a connection starts; it does not replace Config routing rules or affect server availability. First establish a stable connection manually, then enable On Demand. Otherwise, automatic reconnects can obscure the cause of a failure and make troubleshooting less clear.
Steps: In the app, open Settings and find the On Demand options. Review the conditions and behavior shown, then enable or adjust them for your use. Options may vary by system and app version; rely on what is available on the current screen rather than assuming another device's options are present on yours.
Configuration: Decide whether you want connections to start automatically for everyday use or only under specific network conditions. After setup, test on both your usual Wi-Fi and cellular networks. Allow time for the connection to establish after switching networks, then check the app's connection status. If it reconnects after you turn it off manually, check whether On Demand is still active instead of repeatedly toggling the connection.
Note: On Demand does not mean all requests go through a proxy; Global Routing and Config still determine how traffic is handled. For a repeatable test, temporarily turn off On Demand and control the connection manually. Restore your original settings when you're done, and check that no other network configuration is affecting the results.
Data: Check traffic, not billing records
Data shows traffic statistics visible to the client. Use it to see whether data was transferred during a test and whether upload or download activity changed. It can help verify connection behavior, but it is not the same as the balance shown in your service provider's account, and total usage alone cannot reveal which rule matched each destination.
Steps: Before connecting, open Data and note the displayed period and figures. Make one specific request, then return to Data and compare the readings. If the page offers a reporting period or reset option, check what it does first. To keep a useful reference, record the readings before resetting them.
How to use it: During a test, minimize background downloads, cloud sync, and activity in other apps; otherwise, new traffic may not come from the destination you're checking. A failed page load can still generate DNS, handshake, or retry traffic. Conversely, a cached page may cause little change in the figures. Assess Data alongside the actual request, connection status, and diagnostic records.
Note: The client and your service provider may use different reporting scopes, update intervals, and measurement methods. Check your provider's records for your balance; do not infer billing from a single Data figure. To determine whether a request used PROXY or DIRECT, check the active mode and relevant request records rather than relying on traffic changes as proof of a rule match.
Settings: Check common options one by one
Settings contains options for different purposes: DNS affects name resolution, Test Method selects how tests run, Today Widget provides a system-level shortcut, and iCloud options sync supported content. They are not a single set of switches for improving connectivity. Note the original value before changing an option, then verify only the result relevant to that option.
DNS: Separate name resolution from connectivity
What it does: DNS resolves domain names to IP addresses. Successful name resolution does not guarantee a connection to the destination, and a working connection by IP does not mean the domain's resolution path is correct. Where to check: First look for DNS options in Settings, then check whether the active Config contains DNS settings. Actual behavior also depends on the current configuration and connection mode.
Configuration: Keep settings known to work unless you have a specific DNS resolution error. If using DNS parameters from an existing configuration, check the address format and reachability; do not combine options from multiple configurations indiscriminately. Note: Differences between a domain request and direct access by IP are only clues. HTTPS certificates, server names, and content delivery can also affect the result, so the difference alone does not prove a DNS problem.
Test Method: Keep test results comparable
What it does: Test Method selects how Connectivity Test runs. Where to check: Find Test Method in Settings and note the current selection, then return to Home and run Connectivity Test. Different methods may test different stages of a connection, so their results are not directly comparable.
Configuration: Run repeated tests on the same network, server, and Test Method before trying a real request. If you change a test setting, note the conditions before and after. Note: A passing test confirms only that its specific test conditions were met; it does not guarantee every site or app will work. Interpret failures in light of the selected method, and do not delete a server based on a single result.
Today Widget: Verify results in the app
What it does: Today Widget provides a system-level shortcut for viewing or controlling the app, depending on what the system and app support. Where to check: Review the related options in Settings, then check the system's widget editor for the corresponding entry. If it is not listed, check which widgets your device supports rather than looking for one based on another system's screenshot.
Configuration: Add a supported widget using your device's interface. After using it for the first time, open the app to verify the connection status and selected server. Note: Widgets may refresh with a delay and are not a substitute for checking everything in Home. A shortcut that starts a connection does not automatically set Global Routing or Config to the values you expect.
iCloud: Check sync scope separately from device settings
What it does: iCloud features sync or save content provided by the app on supported devices. Where to check: First check the Apple Account currently signed in on the device and its iCloud app permissions. Then review the sync options available in Shadowrocket's Settings. Refer to the in-app description for what is synced.
Configuration: Save your current configuration before syncing. Decide which device's content should be the source, then check what actually appears on the other device. Note: Do not assume that every setting, authentication detail, or connection status will sync. iCloud content sync is separate from restoring an App Store purchase, and does not mean the same data will automatically appear on Windows, Android, or Linux.
Diagnostics: Troubleshoot one layer at a time
Diagnostics helps collect and review troubleshooting information; it is not a switch that automatically fixes every connection problem. In Settings, find Diagnostics or the relevant diagnostic option. First identify the behavior you want to reproduce, then generate a new test record. Diagnostic options may vary by system; read the current screen's instructions before saving any data.
- Record the network and status. Note whether you're using Wi-Fi or cellular, whether the connection toggle is on, whether Global Routing is set to Config, Proxy, or Direct, and the selected server's protocol. Do not record or share authentication details.
- Run a minimal test. Run Connectivity Test once, then try one specific destination. Note the time and any error message. Avoid opening several apps at once, which can fill the record with unrelated background requests.
- Change one condition at a time. For example, compare Config with Proxy first; if the difference is clear, check the rules. If the server itself cannot connect, check its settings and your local network. Do not change DNS, protocol, and transport settings all at once.
- Use the records to narrow it down. Identify whether the error occurred during DNS resolution, connection, TLS, or request handling. Keep the exact error message when one is shown. If a request times out, determine whether the test destination was unreachable or the server connection never came up.
- Restore your usual settings. When troubleshooting is complete, restore the Config and On Demand settings you need, turn off any extra logging enabled for diagnosis, and make sure you have not left the app in a temporary comparison mode.
Protect your privacy: Diagnostic data may include domains you visited, server addresses, or subscription details. Before sharing it, hide authentication parameters, full subscription links, and unrelated browsing records. Do not publish a complete export. Reproducible steps, setting names, and the exact error message are usually more useful for narrowing down a problem than simply saying “unable to connect.”
Common settings questions
Why isn't traffic routed as expected when Config is selected?
First confirm which file is active on the Config screen, then check the rule for the destination and its order. Once an earlier rule matches, later rules may not be evaluated. Also check which server is selected by PROXY or a custom policy. Retry the request before checking the result; an existing connection may not reflect the new configuration.
Where should I look if the connection turns back on after I switch it off?
First check On Demand and related system connection settings. Temporarily turn off On Demand, then manually toggle the connection once to test. Direct is a traffic-handling mode, not a way to turn the connection off; do not confuse the two.
Why does a page still fail when Connectivity Test succeeds?
A passing test applies only to the conditions used by the selected Test Method. Check the destination's DNS resolution, matching rules, TLS settings, and service status. Comparing Config and Proxy with the same server can help distinguish a routing-rule issue from a server connection issue.
Does updating a subscription also change Config?
Do not treat them as the same data. Subscribe mainly manages server details, while Config manages settings and rules. After updating a subscription, check the SERVER list and active Config separately to see what actually changed. Use the displayed and currently active content as your reference.