01 / RULES
Rule-based routing
Rule-based routing determines which policy handles each type of request. Shadowrocket checks the rules in Config from top to bottom, and the first match takes effect immediately. Place specific domain rules before broader rules; FINAL usually belongs at the end. Common keywords include DOMAIN, DOMAIN-SUFFIX, DOMAIN-KEYWORD, GEOIP, IP-CIDR, and IP-CIDR6. After setup, use connection logs to see which rule actually matched instead of judging correctness only by whether a webpage opens.
Before writing rules, define the goal: which requests should use PROXY, which should use DIRECT, and which should use REJECT. The fewer the rules, the easier troubleshooting becomes. When something goes wrong, start at the top and check whether an earlier broad rule captured the request.
DOMAIN-SUFFIX
GEOIP
IP-CIDR
FINAL
02 / ROUTING
Three Global Routing modes
Global Routing controls how overall traffic is handled. Config evaluates requests against the rules in the current configuration file and suits setups that distinguish domains and address ranges. Proxy sends all traffic through the currently selected server. Direct connects without using the server. When troubleshooting, switch modes briefly for comparison: if Proxy works but Config fails, focus on the rules, DNS, and FINAL; if every mode fails, check the server details and local network first.
Config is usually the everyday choice, provided the configuration source, rule order, and policy names have been verified. After switching modes, revisit the test page to avoid letting old connections or cached results affect the diagnosis.
Config
Proxy
Direct
03 / PROTOCOLS
Multi-protocol configuration
Shadowrocket can store server details for Shadowsocks, VMess, VLESS, Trojan, HTTP, SOCKS5, WireGuard, Hysteria2, and other protocols. The same protocol name does not mean its parameters are interchangeable: the address, port, authentication fields, transport, TLS, SNI, path, and other values must match the server details already provided to you. When adding a server manually, verify each field in Add Server. After importing through Subscribe, check the protocol type and key parameters as well.
When a connection fails, do not change several parameters at once. Keep the original details, compare them field by field with the server-side settings, then use Connectivity Test or the connection log to determine whether the failure occurs during resolution, the handshake, or authentication.
VMess
VLESS
Trojan
WireGuard
04 / SUBSCRIBE
Importing and updating an existing subscription
If you already have your own subscription link, add and update it in Subscribe. Before importing, confirm that the link comes from the provider you use, and remember that it may contain personal credentials and should not be posted publicly. An update usually rereads the server list. If existing entries are replaced, check that the selected server still exists and that policy names referenced in Config have not changed.
If a subscription update fails, first confirm under a normal network connection that the link is still valid, then check that it was copied completely. Do not repeatedly create the same subscription; near-duplicate entries make later selection and troubleshooting harder.
Subscribe
SERVER
Update
05 / ON DEMAND
Connect conditionally with On Demand
On Demand decides whether to establish a system connection based on the network environment and preset conditions. It suits users who want a configuration applied automatically on specific Wi-Fi or cellular networks, but manual connectivity should be stable first. Otherwise, the server, rules, and trigger conditions all affect the result and make diagnosis harder. After enabling it, test both the target and excluded networks to confirm that the trigger behaves as expected.
If connections start repeatedly or fail to start as expected, disable On Demand first. Then check whether the conditions are too broad, the network name is accurate, and the system VPN configuration is still valid.
On Demand
Wi-Fi
Cellular
06 / DATA
Data usage statistics and connection monitoring
The Data page shows traffic usage recorded by the app. Connection logs help confirm whether a request entered Shadowrocket, which rule matched, and which policy was used. These figures are useful for relative comparisons, such as checking whether a test generated traffic, but they do not replace an ISP bill or server-side measurement. Different measurement methods, connection reuse, and caching can all produce different values.
During troubleshooting, remove unrelated test conditions, access one clearly defined target, and inspect its corresponding log entry. If no new entry appears, check the system connection status first. If an entry exists but the policy is wrong, return to Config and review the rule order.
Data
Connections
Rule Match
07 / ICLOUD
iCloud sync and moving to a new device
iCloud sync can preserve some app data between devices signed in to the same Apple ID, but important Config files, subscription sources, and manually entered server details should still be organized before moving to a new device. After restoring, verify each item: Shadowrocket was restored from the App Store purchase history, the subscription can update, the intended server is selected, Global Routing has the expected mode, and system VPN authorization has been completed again.
A completed sync does not mean every external item has been restored. Subscription links and server credentials remain the user's responsibility. Before sharing or exporting a configuration containing sensitive fields, confirm where it will go and why it is being shared.
iCloud
Import from Cloud JSON
Config