Identify the interface term first, then determine whether it refers to a connection parameter, routing choice, or diagnostic result. This official manual glossary links each entry directly from its heading. English names and configuration keywords remain unchanged.
This section explains where to find key controls and what they do. System permission, overall routing, and connection status are separate layers and should be checked independently.
Home is the main page for connecting and choosing a server. Check the connection status, Global Routing, and SERVER sections to see which settings are selected. Before toggling the connection, make sure the selected server is the one you intend to test. A connected status only means the connection mechanism has started; check actual access and the connection log to confirm the destination is reachable.
Global Routing controls the overall routing mode: Config, Proxy, or Direct. If a rule does not seem to apply, first check that Config is selected before changing the rule itself. Global Routing selects the type of routing logic; the action for an individual rule is a separate setting.
In Global Routing, Config follows the rules in the current configuration, Proxy routes connections through a proxy, and Direct connects to destinations directly. Config here is a routing mode; in a tutorial, check the context to see whether it refers to the configuration management page instead. After changing modes, start a new test connection; existing connections may not reflect the new selection.
On Demand starts a VPN connection when its configured conditions are met. It controls when a connection starts, not which route a domain takes. It does not replace the Rule section or fix incorrect server settings. If the connection starts again after you disconnect manually, check the On Demand conditions before investigating other connection issues.
Add Server is where you enter server details. Choose the protocol first, then enter the address, port, and credentials from the information you already have. Match TLS, transport, and any additional fields individually; a server label alone does not provide these details. For the full sequence, see the setup guide. Keep the original entry for comparison before making changes.
When you connect for the first time, Apple may ask you to allow a VPN configuration and confirm the action using device authentication. This permission lets Shadowrocket establish a system-level connection; it does not confirm that a subscription is valid or that the server has passed a test. Respond to the system prompt while actively using the app, then check the status on Home. Check the App Store page for system requirements.
A protocol defines how two endpoints exchange data and verify identity; it is not a rating of connection quality. Select the protocol used by the server and enter its matching parameters. Protocols with similar names may still require different identity fields.
Shadowsocks uses parameters such as a password and encryption method to establish a proxy connection; the address and port identify the server. Even with the correct password, a mismatched encryption method can prevent the connection. Check each detail against the server information you already have. Do not enter another protocol's UUID in the password field or guess the encryption method from a server label.
VMess includes identity authentication and commonly uses a UUID. It may also require settings for alterId, transport, and TLS. Enter the alterId from the server information you already have; examples in older guides are not universal values. A matching UUID will not prevent connection failures if transport settings differ. An incorrect device clock may also affect identity verification.
VLESS uses a UUID for identity and does not encrypt data by itself; understand transport protection in the context of the actual deployment. TLS, flow, and transport settings must match the server configuration. Do not reuse VMess settings simply because the UUID is the same. For field-by-field differences, see VMess and VLESS field reference.
Trojan typically uses TLS and password-based identity verification. In addition to the address, port, and password, check the server name and the information required for certificate validation. For TLS errors, check the name, device clock, and certificate chain first; disabling certificate validation is not a routine fix.
Hysteria2 is based on QUIC and relies on a UDP network path. Authentication and TLS settings must match the server configuration. A domain can resolve successfully even when a restricted UDP path prevents the connection. If your server details include obfuscation settings, check those too. The protocol name alone does not guarantee lower latency or higher throughput.
WireGuard uses keys to establish an encrypted tunnel and requires a matching local key, tunnel address, and peer details. A public key identifies one endpoint; a private key is sensitive and should not appear in public screenshots or troubleshooting materials. Its settings differ from password- or UUID-based protocols. Use the complete configuration you already have rather than copying only a server address.
The rule keyword on the left determines what matches; the action at the end determines what happens. Check Global Routing first, then check rule order. More specific rules usually belong before broader ones.
A rule combines a match condition and an action in one entry, such as DOMAIN-SUFFIX,example.com,PROXY. The Rule section is usually checked from top to bottom; the first valid matching rule determines how the connection is handled, and later entries do not change that decision. When editing, check both the rule itself and whether an earlier, broader rule already matches the connection.
DOMAIN matches an exact domain. For example, DOMAIN,example.com,DIRECT applies only to that domain. It does not automatically match api.example.com just because the name contains example.com. To cover a domain and its subdomains, use DOMAIN-SUFFIX to specify the intended scope rather than guessing how exact-domain matching works.
DOMAIN-SUFFIX matches at a domain boundary. An entry for example.com covers the domain itself and subdomains such as api.example.com. It is not an arbitrary substring match, so notexample.com is outside that suffix. The example DOMAIN-SUFFIX,example.com,PROXY shows the syntax only; it is not a working server configuration.
DOMAIN-KEYWORD matches when a domain contains the specified keyword, and usually covers a wider range than DOMAIN or DOMAIN-SUFFIX. A short keyword may also match unrelated domains. Use it only when that broader scope is needed, then check the connection log for unintended matches.
GEOIP matches according to categories in an IP geolocation database, not a website's language or the user's location. Results may change when a domain resolves to a different address, and database classifications may be inaccurate. If a connection does not behave as expected, check the actual destination IP and matching rule rather than inferring the result from the website name.
IP-CIDR is used for IPv4 ranges, and IP-CIDR6 for IPv6 ranges. The prefix length after the slash defines the range. For example, IP-CIDR,192.0.2.0/24,DIRECT demonstrates an IPv4 range entry using a documentation address. An incorrect prefix length can widen the scope, so check the address family, network address, and action.
USER-AGENT matches User-Agent information in HTTP requests; it is not a universal way to identify every app on a device. Whether request details are visible depends on the protocol, encryption, and related settings. If the rule does not match, first check whether the connection log shows this information rather than simply adding more keywords.
FINAL is a fallback rule for connections not matched by earlier entries and is usually placed at the end of the Rule section. For example, FINAL,PROXY sends all remaining connections to the PROXY action. Changing FINAL affects every remaining connection, not just one website. First check that specific rules cover any destinations that need an exception.
PROXY uses the proxy action, DIRECT connects to the destination directly, and REJECT blocks the connection. These uppercase keywords are rule actions that apply to matching connections; they are not the Proxy and Direct options in Global Routing. If a destination matches REJECT, check whether the rule is intended before attributing the result to a server failure.
Server entries provide the parameters needed to connect. Subscriptions retrieve or update entries, while configuration files organize routing and related settings. After importing, check the content type and whether it is currently enabled.
In everyday use, a node usually means a set of server parameters for establishing a connection, including the protocol, address, port, credentials, and transport options. Its displayed label is only a name; changing it does not change the server's actual location or connection method. Check the parameters when troubleshooting, and hide passwords, UUIDs, and other authentication details before sharing materials.
A subscription typically retrieves a server list from an address and syncs its entries when updated; Subscribe is the interface term for subscription-related actions. Use a subscription you already have. A successful update means the content was retrieved and parsed, not that every server can connect. Subscription addresses may contain access credentials, so do not share them publicly. For import options, see subscription import entry points.
A share link encodes server parameters as text. Common prefixes include ss://, vmess://, vless://, and trojan://. A share link for one server serves a different purpose from a subscription address that updates a server list, so identify the content type before importing. Encoding is not encryption; keep any credentials in the link private. For format differences, see share links and subscription addresses.
A configuration file organizes routing and related settings in text sections. Common section names include [General], [Rule], [Host], and [URL Rewrite]. It is not the same as a server subscription: having a rules file does not mean you have the server details needed to connect. After importing, check that the intended configuration is selected, then review its DNS settings, fallback actions, and rewrite rules.
The Host section maps specific domain names to addresses. For example, example.com = 192.0.2.1 is a documentation example. It determines which address a domain resolves to; it does not specify whether a connection uses PROXY or DIRECT. If the destination address changes, an outdated mapping may keep connections pointed at the old address. Check Host mappings separately from ordinary DNS results.
URL Rewrite processes URLs, such as by rewriting them based on match conditions. Its purpose differs from the Rule section, which determines connection routing. Whether a rewrite takes effect also depends on request visibility, the matching expression, and related settings; adding any URL does not guarantee a match. Before importing a configuration with rewrite rules, understand their scope and effect to keep content-processing issues separate from routing issues.
Check destination resolution, connection setup, identity verification, and rule matching as separate steps. Change one type of setting at a time and record the results before and after to identify where the failure occurs.
Connectivity Test checks server reachability using the selected test method. Its result covers only the path and destination involved in that test. A successful test does not mean every website, protocol, or rule path will work. Check access to the actual destination, the current Global Routing mode, and the connection log; a single test is not proof that every connection works.
Latency measures how long a request and response take under specific test conditions; it is not the same as bandwidth or download speed. Results from different test methods, destinations, or network conditions are not directly comparable, and a timeout does not necessarily mean the server is unavailable in all conditions. For a useful comparison, keep the test method and network conditions consistent, and consider repeated results alongside actual access.
DNS resolves domain names into addresses and other records. A destination address is usually needed before a connection can be made. A resolution failure is different from a connection failure after an address is returned; changing the server password will not fix the former. First check whether the lookup returns a result, then whether the address is IPv4 or IPv6, and which routing rule the connection matches.
TLS provides transport encryption and certificate-based identity verification; SNI specifies the requested server name during the handshake. The connection address and the domain used for name verification may differ, so enter them according to the server information you already have. If the handshake fails, check the name, device clock, certificate chain, and server settings. Keep certificate verification enabled while investigating the cause.
The connection log shows the destination domain or address, matching rule, action taken, and possible error details, bringing you closer to the cause than the connection toggle alone. When reproducing an issue, note the time and destination first, then find the matching entry and determine whether the connection was rejected by a rule, failed during resolution, or timed out. Before sharing logs, hide subscription addresses, credentials, and any access details that do not need to be public.
To add server details you already have, follow the setup guide to import them, choose Global Routing, and verify the connection. If the connection works but traffic is routed unexpectedly, see the rule order and actions in the rule reference. For subscription updates or failed connections to a destination, troubleshoot each item in the FAQ.
Purchases, restoring previous purchases, and device compatibility are App Store matters; do not infer them from protocol settings. See the purchase verification guide to confirm the developer, Shadow Launch Technology Limited, and app ID 932747118. Check the App Store page for system requirements and device compatibility.