FEATURES & SETTINGS
Shadowrocket Features and Settings: Global Routing, Rules and Common Options
This page walks through Shadowrocket's common features in the order they appear in the app: what each of the three Global Routing modes is for, how to read the keywords and policies in a rule set, how to manage servers and subscriptions, and what On Demand, Data usage statistics and common Settings items each control. Every item covers what it is, where to find it, how to set it and what to watch out for.
- iOS / iPadOS
- App Store Exclusive
- One-Time Purchase
- Universal on iPhone and iPad
Sections
GLOBAL ROUTING
The Three Global Routing Modes: Config, Proxy and Direct
Global Routing lives on the Home screen and decides who handles each connection. The three modes are mutually exclusive, so only one is active at a time, and switching does not change the servers or configurations you have already imported.
What It Is
Global Routing is a set of global mode options on the Home screen. It applies to the device's connections as a whole rather than to any single rule. It does not change the servers or configuration files you have imported; it only changes how those connections are handled.
What Each Mode Does
Config: evaluates the rule set in the currently selected configuration, entry by entry. Connections that match PROXY go through a server, those that match DIRECT connect directly, and those that match REJECT are rejected. This is the mode to use day to day.
Proxy: every connection is handed to the currently selected server, and the rule set is not consulted. Useful for temporary situations where everything needs to go over one route.
Direct: every connection goes out directly, without passing through any server. Useful for telling whether a problem is caused by your route or by the local network.
How to Switch
In Home → Global Routing, tap Config, Proxy or Direct. After switching, later connections follow the new mode; your configurations, rules and server list stay as they are, and switching back to Config restores rule-based routing.
What to Watch Out For
In Direct mode the rule set is still there, it is simply not consulted, so don't assume the rules were deleted. Proxy mode pushes all traffic onto a single server, and the readings on the Data page will be concentrated on that one server too; check the current mode before investigating traffic.
| Mode | Label in the App | How Traffic Flows | Typical Use |
|---|---|---|---|
| Config | Config | Evaluated entry by entry against the rule set in the current configuration | Everyday use, with routing and direct connections side by side |
| Proxy | Proxy | Everything goes through the currently selected server | When everything needs to go over one route |
| Direct | Direct | Everything goes out directly, without a server | Telling whether the problem is the route or the local network |
RULES
Rules and Routing: Keywords, Policies and Match Order
The rule set decides which path each connection takes. It comes from the configuration you imported, and the client compares entries from top to bottom; the first rule that matches takes effect and the rest are not consulted.
Where Rules Come From
Rules live in the configuration file. Whichever configuration you add and select on the Config page is the rule set the client evaluates. The client itself does not ship with a rule set for any particular service; the rule content is determined by whoever provides the configuration.
What a Rule Is Made Of
Three parts: a match keyword, a match value and a policy. There are only three policies — PROXY (send through a server), DIRECT (connect directly) and REJECT (block). The keyword decides what is compared, and the policy decides what happens on a match.
Match Order
Entries are compared from top to bottom, and the first match decides where that connection goes. FINAL is usually placed last as a catch-all: it applies when none of the earlier rules match. Put narrow rules first and broad rules later so the result matches expectations.
What to Watch Out For
REJECT only takes effect on connections that match it, and the blocking result depends on how the requester handles the failure; no ad-blocking outcome is promised for any scenario. After editing rules, save the configuration and then re-select it for the changes to take effect.
For what each rule keyword matches, see the dedicated article: What DOMAIN, GEOIP, IP-CIDR and FINAL Each Match.
| Keyword | Matches | Example |
|---|---|---|
DOMAIN | A full domain, exact match | DOMAIN,example.com,PROXY |
DOMAIN-SUFFIX | A domain suffix; matches the domain and its subdomains | DOMAIN-SUFFIX,example.com,PROXY |
DOMAIN-KEYWORD | A keyword appearing anywhere in the domain | DOMAIN-KEYWORD,static,DIRECT |
IP-CIDR | A destination IPv4 address range | IP-CIDR,203.0.113.0/24,DIRECT |
IP-CIDR6 | A destination IPv6 address range | IP-CIDR6,2001:db8::/32,DIRECT |
GEOIP | IP geolocation country code | GEOIP,CN,DIRECT |
USER-AGENT | The User-Agent carried by the request | USER-AGENT,Example*,DIRECT |
FINAL | Catch-all; applies when no earlier rule matches | FINAL,PROXY |
SERVERS & SUBSCRIBE
Servers and Subscriptions: How to Use Add Server and Subscribe
There are two ways to get a server into the client: add a record manually, or import a subscription link from your provider. Both end up in the same server list.
Add Server: Add One Manually
Add Server adds a single server record. You fill in a name, type, address, port and whatever credential fields that type requires. Common types include Shadowsocks, VMess, VLESS, Trojan, Hysteria2, WireGuard, HTTP and SOCKS5; the fields differ by protocol, so follow what the form actually shows.
Subscribe: Import a Subscription
Subscription links come from your provider. After you add a subscription address on the Config page, the client fetches and parses the servers and rules it contains. When the link updates, what it contains and when it expires are all decided by the provider; the client only imports and refreshes.
Other Import Methods
Scan QR Code scans a QR code from your provider; Import from Cloud JSON imports a JSON configuration stored in cloud storage. Every address, domain and link in this article is an obvious placeholder such as example.com — never post your real subscription link in public.
Management and Cautions
The server list supports latency tests, sorting, copying and deleting. A subscription link works like a credential: anyone who has it can use the same routes, so it is not something to share publicly. One distinction worth keeping clear: the client is a one-time purchase on the App Store, and what you buy is the app itself; routes and plans come from your provider, and the two are separate matters.
After adding a subscription you can refresh it manually, or let the client refresh it automatically when it opens; if a refresh fails, read the message first and then work through the items one by one. There is a dedicated article on this: Subscription Updates: Manual Refresh, Auto-Refresh on Open and Why They Fail.
The client purchase is not the same as a route plan. The one-time purchase on the App Store buys you the Shadowrocket app; servers, subscriptions and routes come from your provider, and this site neither provides nor recommends any server service.
ON DEMAND
On Demand: Three Types of Trigger Conditions
On Demand lets the client handle connections automatically based on conditions: when you join a particular network or reach a particular domain, a preset action runs, so you don't have to toggle anything by hand each time.
TRIGGER 01
Wi-Fi
Triggered by the name of the Wi-Fi network you are connected to. Useful for needs such as handling things one way on your home network and another way elsewhere.
TRIGGER 02
Cellular
Triggered by whether cellular data is in use. Useful for needs such as switching to a certain handling automatically once you leave Wi-Fi. The condition itself does not include carrier details.
TRIGGER 03
Domain
Triggered by the destination domain being reached. When a domain matches, the configured action runs — handy for pulling a few individual domains out and handling them in a specific way.
How to Set It Up
In Settings → On Demand, add a rule: choose the condition type (Wi-Fi / Cellular / Domain), fill in the condition parameters, then choose the action to run on a match. You can add several rules; when more than one condition is satisfied, the actual match result decides what happens.
What to Watch Out For
The broader the condition, the more likely it fires when you don't want it to. If something won't connect on a given network, first check On Demand to see whether that network matches an action, then go back to the Global Routing mode and the rule set — investigate the two sources separately.
For what the parameters of the three trigger types mean and the common misconfigurations, see the dedicated article: On Demand Triggers: How to Set Up Wi-Fi, Cellular and Domain Conditions.
DATA
Data Usage: Readings by Server and by App
The Data page splits traffic into two sets of readings: one by server and one by app. The two measure different things, and you need both to pin down a problem.
By Server
Shows the total upload and download traffic each server has handled. Use it to confirm which route the traffic is concentrated on, and whether a given route is being used heavily.
By App
Shows how much traffic each app has sent through the client. Use it to find out which app keeps using data, then go back to the by-server readings to confirm which route it took.
Why the Numbers Don't Match System Statistics
Traffic statistics in system settings cover all network activity on the device, while the Data page only records connections handled by the client. The scope and the starting point differ, so mismatched numbers are normal and do not mean the statistics are wrong.
Using It to Investigate Unusual Traffic
A suggested order: start with the by-app readings and find the entries with noticeably large numbers; then look at the by-server readings to confirm which server that traffic went through; finally go back to Global Routing and check whether the current mode is Config, ruling out the case where global proxying concentrates all traffic on one server.
What to Watch Out For
The readings are recorded on this device and do not carry over to another device or a reinstall; when judging whether something is unusual lately, note the current reading first and then watch for changes. Units are converted automatically between KB / MB / GB; what you actually see in the app is the reference.
For what each set of readings means, see the dedicated article: Reading the Data Page: What the by-Server and by-App Numbers Mean.
SETTINGS
Common Settings: DNS, Test Method, Today Widget and Diagnostics
The Settings page has quite a few items, but only a handful need attention day to day. They are grouped below as connection and resolution / entry points and sync / diagnostics and logs; the grouping is only for readability, and the actual entries are whatever your app's Settings page shows.
- DNS Who resolves domain names
- Test Method Which probe the latency test uses
- Connectivity Test Reachability check before and after connecting
DNS decides who resolves domain names: you can point to a specific resolver or leave it to the system default. The effect depends on your route and network environment, so keep the default if you are unsure. Test Method decides which probe the latency test uses; different methods produce numbers on different scales, so don't compare results from two methods. Connectivity Test confirms whether the current network is reachable before and after connecting, separating a network that is down from a route that is down.
- Today Widget Puts an entry point in the system widget area
- iCloud Sync Syncs configurations and server entries with your account
With Today Widget enabled, the client's entry point appears in the system Today view or widget area, where you can check status or handle connections; what actually shows up depends on which widget you added. iCloud Sync keeps configurations and server entries in sync with your iCloud account, so another device signed in with the same Apple ID can read them back; what syncs is the configuration data inside the client, not the routes on your provider's side. The sync scope and behavior are whatever the app actually shows.
- Diagnostics Summary of runtime status and connection logs
- Data Entry point for traffic and connection records
Diagnostics summarizes runtime status and the record of connection attempts; when troubleshooting, check here first for obvious errors, then decide whether to change the configuration or contact your provider. Data is the entry point for traffic and connection records and corresponds to the two sets of readings in the previous section; when judging whether the client is responsible, go by the records here rather than system statistics alone.
NOTES
A Few Prerequisites for Using This Page
The features and settings here rest on two prerequisites: the app itself comes from the App Store, and routes and subscriptions come from your provider.
The client purchase is not the same as a route plan. Shadowrocket is a one-time purchase on the App Store (priced at US$2.99 in the US store; each storefront shows its local currency, so the store page is the reference), and what you buy is the app itself; servers, subscriptions and routes come from your provider, and this site does not provide, sell or recommend any server service.
About Where to Get It
Shadowrocket is sold only on the App Store. The developer is Shadow Launch Technology Limited and the app ID is 932747118. iPhone and iPad are the main platforms; Mac, Apple TV and Apple Vision also appear in the compatibility section of the same store page, and system requirements are as stated on the App Store page.
About Interface Differences
On different system versions, the names and locations of items in Settings may differ slightly; this article describes the common layout. Where something doesn't line up, whatever your device's app actually shows is the reference.
About Example Values
Every address, domain and rule snippet in this article is an obvious placeholder such as example.com or 203.0.113.0/24 and does not correspond to any real service.
If I switch Global Routing to Direct, will my rules be deleted?
No. Direct only keeps connections from going through a server; the configuration and rule set are still there, and switching back to Config restores rule-based routing.
Can I share a subscription link with someone else?
It is not advisable. A subscription link works like a credential, and anyone who has it can use the same routes; whether the link updates or expires is decided by your provider.
Why don't I see a change right after editing something in Settings?
Some settings only take effect on the next connection. Disconnect and reconnect, or switch the Global Routing mode once, then watch the readings on the Data page.
Are these settings available on Mac and Apple TV too?
The same app does not have an identical layout on every device, so item names are whatever the app on that device actually shows; system requirements are always as stated on the App Store page.