Check Global Routing first, then review rules, servers, and network conditions. Working in this order separates traffic routing from connection triggers and makes it easier to identify the cause when something goes wrong.
Global Routing determines how Shadowrocket handles traffic entering its network tunnel; it does not indicate whether the connection succeeded. Find it in Home, check whether Config, Proxy, or Direct is selected, then assess the resulting behavior.
Mode and interface label
How it works
When to use it
What to check
Config · Config
Applies the policies defined by the active configuration's rules.
Route traffic by domain, address, or other criteria during everyday use.
Make sure the intended configuration is selected, then check rule order and the final policy.
Proxy · Proxy
Routes traffic entering the tunnel through the proxy, unless excluded by the system or configuration.
Temporarily check whether a traffic rule is causing the problem.
Confirm the current server is available. This mode does not route all system traffic.
Direct · Direct
Routes traffic handled by the client directly.
Compare it with the proxy route to check whether the local network is working.
Direct does not turn off the connection or remove the system VPN configuration.
In Home, select Global Routing and choose the mode you need. When using Config, go to Config and confirm which file is active; seeing a file in the list is not enough. An imported file, an edited file, and an active file are three different states.
If the same target works in Proxy but not in Config, check which rule matched and what policy it applies. If both modes fail, check the server, DNS, and current network. After comparing modes, restore the original setting so temporary troubleshooting changes do not affect later use.
02 · Matching and policies
Traffic rules and Config
Rules define what matches; policies define what happens next. Review the active file's rules in Config. To route traffic according to rules, set Global Routing to Config.
Check the rule type, then its order
DOMAIN matches a specific domain, DOMAIN-SUFFIX matches a domain and its subdomains, and DOMAIN-KEYWORD matches a keyword in the domain. The latter two cover more domains; a short keyword may also match unrelated requests.
IP-CIDR and IP-CIDR6 match address ranges, while GEOIP classifies IP addresses using a geolocation database. DNS results, database contents, and related settings can affect how address-based rules match, so a website's name alone does not tell you which rule will apply.
Rules are generally evaluated in order, and the first effective match determines how traffic is handled. Put specific rules before broader ones, and check FINAL at the end. It handles traffic that did not match any preceding rule; it is not a regular domain condition.
Make sure the policy matches the intended route
DIRECT means a direct connection, REJECT denies the request, and PROXY routes it through a proxy. A configuration may also refer to custom policy groups. If you see a group name, check which server is actually selected in that group instead of relying on the policy name at the end of the rule.
These snippets explain matching behavior; they are not complete files you can use to replace an existing configuration. Save a copy of the original before making changes, then retest with a known domain. If a request matches REJECT, changing servers usually will not change the rule's rejection result.
03 · Connection details
Managing subscriptions and servers
A subscription provides a group of server entries, while each server entry stores connection parameters. Config holds rules and other settings. These are related, but importing one does not mean the others are set up.
Home, Add Server, and Subscribe
These steps assume you already have your own subscription or server details. In Home, open Add Server and choose the appropriate Type. To use a subscription link, select Subscribe, enter the complete link, and save it. Return to Home, check that the expected group appears, then select the server you want to use.
When adding a server manually, make sure Type matches the server requirements. Shadowsocks, VMess, VLESS, Trojan, HTTP, SOCKS5, WireGuard, and Hysteria2 use different fields; changing Type while keeping old parameters may not work. Enter the address, port, authentication details, and transport fields using the information you already have. For field descriptions, see the protocol reference.
After updating, check the selected server
Use the action menu on an existing subscription entry to update it, then check whether the servers in its group changed as expected. Updating a subscription refreshes the server information it manages; it does not replace the active Config. Names or entry counts may change, so make sure the selected server is still available.
If an update fails, check that the link is complete, the current network can retrieve its contents, and the subscription is still valid. Do not share a complete link containing access credentials in public screenshots or diagnostic records. Before deleting a subscription or entry, check which group it belongs to so you do not confuse manually managed entries with subscription entries.
04 · Connection triggers
On Demand connections
On Demand asks the system to establish or adjust a connection based on specified conditions. It answers “when to connect”; Global Routing answers “how to handle traffic once connected.” They control different things.
Connect manually first, then add conditions
Look for On Demand settings in Settings. If your current interface opens them from the connection options, use that entry instead. Before enabling On Demand, connect manually and test access to confirm the server and configuration work. Then add conditions for Wi-Fi, Cellular, or domains.
For Wi-Fi conditions, check that the network name matches exactly. For Cellular conditions, switch to a cellular network and observe what happens; changing the setting while on Wi-Fi will not verify cellular triggers. Domain conditions depend on how the system evaluates domain requests; they are not triggered by launching an app.
Avoid conflicting conditions
Add one condition at a time. After saving, switch to the corresponding network, wait for the system to respond, then check the connection status and access results. If you use multiple conditions, review their order, matching scope, and actions. Do not configure the same network with conflicting connect and disconnect conditions.
If the connection returns automatically after you disconnect, check whether On Demand is still enabled. To troubleshoot a regular connection issue, you can temporarily turn it off so automatic triggers do not interfere with testing; turn it back on after confirming the manual connection works. On Demand relies on the system to act on conditions; it is not a scheduled task that runs continuously.
05 · Usage and monitoring
Data usage statistics
Data shows traffic recorded by the client. Use it to help check whether requests are passing through the current connection or whether data was transferred during a given period. It should not be the sole source for service billing or remaining allowances.
Check the reporting range first
In Data, first check the time range, upload and download directions, and available categories in the current view. Different views may show the current connection or accumulated records; compare figures only when their ranges match. Before clearing records, save anything you need and check which range will be reset.
To verify traffic, note the current value, visit a known destination, then return to Data to check for a change. An increase shows that data was transferred; by itself, it does not prove the page loaded fully or that the expected rule matched. Also check the access result and connection records.
Client and server-side statistics may differ because of protocol overhead, reporting intervals, or counting methods. If Data does not show the expected change, check the connection toggle, current mode, and whether the request was excluded. Do not assume the server is unavailable based on this alone. Keep only the records needed for troubleshooting to avoid retaining destination information longer than necessary.
06 · Common options
Settings checklist
Settings options may vary with the device and system capabilities. If an option is missing, check the current app interface first. Do not change a similar but different setting just to match a guide's wording.
DNS: separate name resolution from connectivity
DNS resolves domain names to addresses. Check DNS-related options in Settings and global parameters in Config. Configuration files may also affect the final behavior, so changing one setting does not guarantee that every request uses the new value.
Keep the current working value before changing it to meet a specific need. If the configuration uses dns-server = system, it uses the system's DNS resolver; that does not mean the proxy server is working. After making a change, retest the same domain. If it resolves but the connection fails, check routing and the server rather than repeatedly changing DNS.
Test Method: know what the test measures
Test Method controls how connectivity tests are performed. Find it in Settings, check the method and any related test target, then return to Home and run Connectivity Test. To compare servers, keep the method, target, and network the same.
Test results depend on the handshake, target response, and network conditions. They do not represent actual download speed or guarantee that every site will work. If a test times out, first check whether the target responds, then review the server settings. Do not delete an existing entry based on a single test.
Today Widget: quick status and controls
Today Widget provides a shortcut or status display where supported by the system. Find the related option in Settings, then configure it in a system-supported widget area. Availability and controls depend on the current device, system, and app interface.
First confirm the connection works in the app, then check the widget's display or the result of using its controls. Widget status may refresh with a delay, so it does not replace checking in the app. If the widget and app disagree, open Home to check the actual connection instead of repeatedly toggling it.
iCloud sync: check what syncs and where
iCloud options save or sync app data where supported. In Settings, check the sync toggle and make sure the system allows the app to use iCloud. Before turning it on, read the current prompt to see whether it applies to configurations, server information, or other data.
Sync is not a complete device backup, and it may not finish immediately. When moving to another device, keep the working configuration on the original device, then check the synced content on the other one. Review the direction before accepting overwrite, merge, or restore prompts. Handle subscription links and authentication details with care as well.
Diagnostics helps investigate connection issues and collect diagnostic information. After finding the relevant option in Settings, enable the necessary logging as described on screen, then reproduce the issue once. Note the network type, Global Routing mode, destination domain, and error observed at the time.
Diagnostic records may include domains visited, server addresses, or configuration details. Before sharing, remove credentials and personal information, especially from complete subscription links. Stop additional logging once you have the information you need. Longer logs are not necessarily more useful; a single reproducible sample is often clearer.
07 · Retest after changes
Verify settings in the same order
The connection icon, test results, and page access each reflect a different stage. Check “connection established,” “expected route used,” and “destination works” separately to tell whether the settings achieved their purpose.
Keep a baseline and troubleshoot one setting at a time
Record the current state. In Home, note the selected server, Global Routing mode, and Config file. Keep the working values before making changes, and temporarily pause any On Demand conditions that could trigger automatically.
Check basic connectivity. Run Connectivity Test on the same network, then try to access a fixed destination. If the test fails, check the parameters and network first. If the test succeeds but the destination does not load, review the rules and DNS.
Compare routing results. If needed, temporarily switch between Proxy and Config, then retest the same destination. If only Config fails, check rule order, policy groups, and FINAL. Do not change the protocol at the same time.
Restore your everyday settings. Once you have confirmed the result, restore the intended mode and On Demand settings, stop temporary diagnostic logging, and test again on the Wi-Fi or cellular network you normally use.
If the initial import is not complete, follow the tutorial to establish a testable connection. For interface terms, see the glossary. If you can reproduce the issue reliably, use the FAQ to check possible causes. Change one variable at a time so you can connect each result to a specific setting.