Official guide · English terminology
Look up interface terms and rule policies. First check where a term appears, then determine whether it describes a control, a connection method, or how a request is handled.
01 / INTERFACE
Interface controls and routing modes are different concepts. When you see an English term, check which screen or setting it belongs to. Its exact location may vary in the current app interface.
Interface controls
Home is the main place to view server entries, choose a connection, and control the connection switch. An entry in the list means its details were imported; it does not mean authentication or a connection test has succeeded. For first-time setup, check the selected entry, review Global Routing, and then turn on the connection.
Manual setup
Add Server lets you enter details for a server you already have. Select the protocol first, then enter the address, port, and authentication settings. Password fields can mean different things across protocols, so don’t assume they’re interchangeable just because they look alike. Reopen the saved entry to check your details and catch omissions early.
Overall routing behavior
Global Routing sets the overall routing mode: Config, Proxy, or Direct. Config handles requests according to the active configuration’s rules; Proxy uses the proxy route; Direct connects directly. When troubleshooting routing, check this setting first—a rule change may have no visible effect if the mode is different from what you expect.
Meaning depends on context
In configuration management, Config refers to viewing, importing, and selecting configuration files. In Global Routing, it means routing traffic according to the configuration’s rules. Importing a file does not automatically select it for use. If rules aren’t taking effect, check both the active file and Global Routing—not just whether the file appears in the list.
Routing modes
Proxy and Direct are routing modes in Global Routing that change how traffic is handled overall. They’re related to the uppercase PROXY and DIRECT keywords in rule text, but operate at a different level. Temporarily switching modes can help isolate a problem. After testing, restore the intended setting so you don’t mistake a test mode for your everyday configuration.
Connect based on conditions
On Demand triggers system VPN connection behavior based on conditions such as the network—for example, different settings for Wi-Fi and cellular. It controls when a connection is established or disconnected; routing rules determine how requests are handled after connection. When testing, change one network condition at a time and check the actual connection state to keep these two layers separate.
Settings and activity
Settings is for viewing and adjusting options; Data shows traffic information. What’s available depends on the current interface. Changing traffic figures indicate data activity, but don’t by themselves prove that a website or service was reached successfully. When troubleshooting, compare statistics, connection logs, and actual access results over the same time period.
02 / PROTOCOLS
The protocol type is determined by the server details you already have; it isn’t a speed setting. Select the matching type, then check authentication, transport, and TLS settings one by one. For more detail, see the protocol reference.
Proxy protocols
Shadowsocks establishes a proxy connection using details such as the server address, port, password, and encryption method. The encryption method must match the server; don’t change it at random to try to connect. If your server details specify a plugin or additional transport requirements, make sure the corresponding client settings also match.
Proxy protocols
VMess uses an identifier and other parameters for authentication, and may also require transport and TLS settings. A matching server address doesn’t mean other fields can be omitted; the path and server name may also affect the connection. If the handshake fails, compare each field with the original details rather than changing only the address or port.
Proxy protocols
VLESS centers on authentication and connection forwarding. Transport security also depends on the transport layer and TLS settings in use. After entering the identifier, check the transport type, server name, and any other required fields. VLESS and VMess are different protocols; similar-looking authentication fields don’t make them interchangeable.
Proxy protocols
Trojan is commonly used with TLS. A connection requires valid authentication details as well as the correct server name and certificate validation. A correct password doesn’t guarantee a successful TLS handshake; an incorrect domain or device clock can also cause problems. For certificate errors, check the name, time, and server configuration rather than routinely disabling validation.
Proxy protocols
HTTP and SOCKS5 are distinct proxy protocols. Check authentication, address resolution, and UDP support against the server’s capabilities. An HTTP proxy does not automatically encrypt traffic between the client and proxy server; check the connection settings separately. When importing, select the matching type—an address and port alone don’t make a complete configuration.
Tunneling protocols
WireGuard uses key pairs to identify both ends of a connection. Configuration typically includes an interface address, peer public key, endpoint, and routing range. The private key and peer public key serve different roles; don’t swap them or expose them in public records. Communication with the peer is only part of the check—also verify that the routing range and DNS cover the destinations you need to reach.
QUIC-based protocol
Hysteria2 is based on QUIC. Connection performance depends on UDP reachability, packet loss, and server configuration on the current network. Authentication details, TLS settings, and any additional parameters must match. Don’t assume a protocol will be faster on a particular network based on its name; compare real-world access and sustained transfer under the same conditions.
03 / RULES & POLICIES
A rule usually contains a match type, match value, and policy. The keyword specifies what to match; the policy specifies what to do. Don’t treat them as the same field.
Domain matching
DOMAIN matches the specified exact domain, while DOMAIN-SUFFIX matches that domain and its subdomains. For example, DOMAIN-SUFFIX for example.com also covers www.example.com, but not every domain that happens to contain those characters. To match a single hostname only, check whether the more precise DOMAIN rule is appropriate.
Text matching
DOMAIN-KEYWORD checks whether a domain contains the specified text; the text doesn’t have to appear at the end. A short keyword can match many domains you didn’t intend to include. If you see unexpected matches, first check whether the keyword is too broad, then consider using DOMAIN or DOMAIN-SUFFIX instead.
Address range matching
IP-CIDR describes an IPv4 address range; IP-CIDR6 describes an IPv6 address range. The prefix length after the slash determines the range. For example, 10.0.0.0/8 represents a range, not a single host. Whether a domain request matches an address rule also depends on its resolved address and the configuration’s DNS behavior.
IP geolocation matching
GEOIP matches a destination based on IP geolocation data, not the language of a webpage or text in a domain name. Results depend on the database, the resolved destination address, and how the service is hosted. If routing differs from what you expect, check the actual destination IP instead of guessing from the website name.
Fallback rule
FINAL sets the policy used when none of the preceding rules match and is usually placed at the end of the rule list. It does not mean “highest priority”; placing it too early can prevent later rules from being checked. To find out why a request follows the default route, first check whether any earlier rule matched, then review the policy after FINAL.
Policies
PROXY routes a request through a proxy, DIRECT connects directly, and REJECT denies the request. These are keywords in rule text, not protocol types or server names. After confirming a request matches a rule, check that its policy specifies the intended handling and that the connection used by the proxy route is available.
How matching works
Rules are evaluated in order, and the first match determines the policy for a request. Put precise exceptions before broader rules. Adding a rule after FINAL usually won’t produce the expected result. Before changing the order, keep a copy of the original file, then change one thing at a time so you can trace the effect.
04 / SUBSCRIPTION & CONFIGURATION
This guide assumes you already have your own subscription or server details. Server lists, rule files, and purchase records serve different purposes; importing one does not fill in the others automatically.
Importing a subscription
Subscribe is the type or field used to import and update a subscription you already have; the exact location depends on the current interface. Subscriptions often provide server entries, but their contents depend on the subscription format—don’t assume they include a complete set of rules. Subscription URLs may contain access credentials, so don’t share the full URL in public screenshots or troubleshooting logs.
A single connection entry
Server refers to a single server connection entry, usually containing a protocol, address, port, and authentication details. The list may also show the SERVER label. A name is just a label for identification; it doesn’t confirm the server’s location or availability. Before editing an entry generated by a subscription, keep the original details in case a later update overwrites your changes.
Configuration files
.conf is a common configuration file extension. A file may organize global settings, routing rules, local mappings, and rewrites. It is not the same as a subscription that only provides server entries, and the extension alone doesn’t tell you whether the file is complete. After importing, review its sections, select the file you want to use, and confirm that Global Routing is set to Config.
Configuration section names
[General] contains global settings, [Rule] contains ordered routing rules, and [Host] is used for local address mappings. The section name determines how the following lines are interpreted, so a line in the wrong section may not work as intended. Before editing, check where each section begins and ends, then verify the field syntax. Don’t put server authentication details in a rule section.
Request handling
URL Rewrite applies actions such as rewriting URLs based on match conditions and is configured in the [URL Rewrite] section. It changes request handling; it does not assign requests to PROXY or DIRECT. Handling encrypted requests may also be subject to additional conditions. Before enabling an existing rule, check that it’s necessary, review its match scope, and consider the privacy implications.
Importing details
Scan QR Code reads connection details from a QR code. A successful scan only means the contents were recognized; it doesn’t confirm that the parameters will work. After importing, check the protocol, address, and authentication fields against the original details. QR codes may contain sensitive credentials, so obscure the code itself when sharing screenshots—not just the text next to it.
05 / CONNECTION & DIAGNOSTICS
When troubleshooting, check system connectivity, server authentication, DNS, and actual service access separately. One working step does not replace checks of the others. For troubleshooting help, see Troubleshooting.
Address resolution
DNS resolves domain names to addresses and other records, making it a key step before a request reaches its destination. Successful resolution does not guarantee that authentication, connection, or page loading will succeed. Caching can also delay the visible effect of a change. First distinguish between “no address resolved” and “an address resolved, but the connection failed,” then check the relevant settings without changing several parameters at once.
Connectivity check
Connectivity Test checks whether a connection to the test target is reachable using the current test method. Interpret the result in light of the settings in use. A successful test doesn’t mean every domain or transport type will work. To compare server entries, use the same test method and network conditions, then try accessing the service you actually need.
Test metrics
Latency usually measures round-trip time under specific test conditions; it is not the same as bandwidth, sustained throughput, or webpage loading speed. A low-latency connection may still be affected by packet loss, congestion, or the destination service’s response time. Compare results over multiple tests on the same network and using the same method at similar times, rather than judging by a single reading.
Transport and handshake
TLS protects data in transit; SNI indicates the target server name during the handshake. They’re related but are not the same setting. The connection address and server name can serve different purposes, so use the details you were given—don’t remove the name just because the address is an IP. If the handshake fails, first check the name, certificate, and device clock, then review other transport settings.
System authorization
VPN configuration authorization lets Apple’s system allow a client to establish a VPN connection. The first time you connect, the system may ask you to approve it. Granting authorization doesn’t confirm that the server password is correct or that all requests are using the intended policy. If the connection fails, check system authorization, the selected server, and the results of actual requests separately.