First distinguish interface controls, protocol types, and rule policies, then look up the relevant settings. English names match the app; each explanation describes what a term does and what it does not tell you.
The mode determines how a route is selected, the on-demand mechanism determines when to connect, and the test tool checks the result.
Global Routing selects the overall routing mode. Common modes are Config, Proxy, and Direct. If rules are not taking effect, first check whether Config is selected here; editing rules in a configuration does not select the mode for you.
Selecting Config in Global Routing applies the policies defined by the active configuration. The result depends on the selected configuration, rule order, and final policy. The configuration management section with the same name is for managing files, so check both separately.
Proxy is the Global Routing mode that uses a proxy as the primary routing choice. It can help you compare results with Config mode, but it does not guarantee that the selected server is available. It is also distinct from the PROXY keyword at the end of a rule; a connection still depends on correct server settings and network conditions.
Direct connects to the destination without routing the connection through a proxy server. This is different from stopping the VPN connection and does not automatically remove the system VPN configuration. When testing, check both the selected mode and connection status.
On Demand starts a VPN connection when configured network conditions are met, reducing the need to connect manually each time. It does not decide which policy to use for each domain; routing rules are determined by the routing mode and configuration. After making changes, test on the networks you actually use.
DNS resolves domain names to IP addresses and is a necessary step for many connections. The resolution result and path can affect reachability and IP-based rule matching. If a domain fails to load but its IP address works, check DNS as a separate layer.
Connectivity Test checks whether a test destination can be reached under current conditions. Results depend on the test method and destination response. A successful test does not mean every website is reachable, and the test time is not a measure of sustained transfer speed. Test the actual destination as well.
Choose a protocol based on the server details you already have. Protocol names are not speed rankings, and switching protocols cannot replace matching support on the server.
Shadowsocks communicates with the server using a specified encryption method. Typical settings include the address, port, password, and encryption method. The encryption method must match the server; do not substitute one based only on a similar name. Actual speed depends on the route, server, device processing, and other conditions.
VMess authenticates using a user ID and related information, and can work with different transport methods. Check the transport type, path, and TLS settings as well as the user ID. One correct field does not mean the full set of parameters matches; system time can also affect authentication.
VLESS uses a lightweight protocol structure for authentication and requests, with a user ID as a commonly required field. Security also depends on the transport and security layer in use; the protocol name alone does not tell you whether traffic is encrypted. Use the complete set of parameters provided for the server.
Trojan typically establishes connections over TLS and uses password authentication. The address, port, password, SNI, and certificate validation settings must match. SNI indicates the server name during the TLS handshake; do not disable certificate validation just to clear an error.
An HTTP proxy handles requests from the client to the proxy server. For HTTPS destinations, it typically uses CONNECT to establish a tunnel. An HTTPS destination does not mean the client-to-proxy connection also uses TLS; check the proxy connection's security settings separately.
SOCKS5 negotiates the destination address and connection method between the client and proxy server, and can support username and password authentication. Authentication is not the same as encryption. UDP support also depends on the client, server, and network conditions; it cannot be inferred from the protocol name alone.
WireGuard uses key pairs to identify both ends of a connection. Configuration typically includes a local address, private key, peer public key, endpoint, and routing scope. Treat the private key as sensitive and keep it out of help screenshots. Check routing scope and DNS settings as well as the endpoint.
Hysteria2 is based on QUIC, so UDP reachability directly affects connectivity. Authentication, TLS, and server-specific settings must match. A connection failure on one network does not by itself indicate a client issue, nor does it predict performance on every network.
Specify the match condition first, then the policy. Rules are generally evaluated in order, so place more specific conditions before broader ones.
DOMAIN matches the exact domain specified, such as example.com, but does not automatically include all its subdomains. If the destination actually uses www.example.com or another service domain, add a rule or choose a suitable suffix rule. Do not rely only on the main domain shown in the browser.
DOMAIN-SUFFIX matches a domain suffix; example.com includes the root domain and its subdomains. It does not match arbitrary strings that happen to contain the text. When applying a policy to related domains, check the boundaries to avoid assuming unrelated destinations are covered.
DOMAIN-KEYWORD matches when the domain contains a specified string, usually covering more domains than an exact-domain rule. The keyword may appear in unexpected domains, so use this only when you understand the match scope. For precise control, check DOMAIN or DOMAIN-SUFFIX first.
GEOIP classifies the destination address using an IP geolocation database. For example, GEOIP,CN,DIRECT connects directly when the specified condition matches. It matches the destination IP's location data, not the domain suffix. Database contents, DNS results, and changes to the destination IP can all affect matching.
IP-CIDR describes an IPv4 network using an address and prefix length; IP-CIDR6 is for IPv6 ranges. The prefix length determines the range, so do not confuse a single address with an entire subnet. For dual-stack destinations, check the routing results for both address types.
FINAL sets the policy for connections that match none of the preceding rules and is usually placed at the end of the rule list. FINAL,DIRECT and FINAL,PROXY have different default behavior. Before adding a rule for a specific site, decide how the remaining traffic should be routed.
PROXY uses a proxy policy, DIRECT connects directly, and REJECT denies the connection. These keywords answer what happens after a match. They are not Global Routing mode buttons, and they do not mean a server connection has been verified.
The explanations below assume you already have your own subscription or server details. Server lists, configuration files, and test results serve different purposes and are not interchangeable.
Subscribe imports and updates subscription details you already have. Get the link from your service provider. It may contain access credentials, so treat it as sensitive information. A successful update only confirms that the content was retrieved; it does not mean every connection in it is usable.
SERVER identifies a group of server entries, and Add Server opens the form for manually adding connection details. An entry typically includes a protocol, address, port, and authentication parameters. A name is only for identification; it does not affect authentication or replace checking the actual settings.
Configuration files organize rules, DNS, and other connection settings; they do more than a list that stores server details. Before importing one, understand where it came from and what it changes. After saving, check whether it is selected. A successful import does not mean its rules are currently being used for routing.
Latency generally describes the time a test request takes to make a round trip. It depends on the test destination, method, route, and server response. A lower value does not necessarily mean faster large-file transfers, and a timeout does not necessarily mean every service is unavailable. Keep test conditions consistent when comparing results.
Purchase history belongs to the store account, while servers and rules are part of your personal configuration. When restoring the client, check these two separately.
Shadowrocket is sold only on the App Store and is primarily for iPhone and iPad; see the App Store listing for system requirements. Verify the product by checking the developer, Shadow Launch Technology Limited, the official icon, and app ID 932747118 in the product page URL.
Use your Apple ID to check App Store purchase history. When redownloading the app, make sure the account currently used for store purchases is the one used to buy it. Your iCloud account and App Store purchase account may differ, so being signed in on the device does not confirm that the purchase is associated with that account.
Purchased is the App Store section for finding apps you previously bought and checking purchase history when changing or restoring a device. Redownloading the client does not restore all server and configuration details. Eligibility for purchases across devices or Family Sharing is subject to the App Store listing.
A one-time purchase covers the right to use the client; check the current App Store listing for the price. A one-time client purchase is not a service plan. Using connection features requires your own subscription or server details; this site does not provide, sell, or recommend nodes or subscriptions.
Need to check the purchase route, developer, or steps for restoring a purchase? Read the Shadowrocket App Store purchase guide. Need step-by-step instructions? See the official getting-started guide.