Shadowrocket Settings: Global Routing, Rules & On Demand

ROUTING / HOME

Three Global Routing modes

Global Routing determines how traffic is handled overall. This is separate from choosing a specific server: selecting a server does not mean every request will use it.

Check the current mode in Home

In Home, find Global Routing and choose Config, Proxy, or Direct. When you need to handle requests differently by domain or address, Config is usually the right choice. To check whether a problem is caused by rules, temporarily switch to Proxy or Direct for comparison, then restore your original mode.

Before switching, note the current mode, selected server, and active configuration. Proxy still depends on valid server settings and network availability; Direct does not guarantee access to every destination. These modes describe routing behavior, not whether a connection will succeed.

Mode	What it does	When to use it	Keep in mind
Config · Configuration	Handles requests according to the rules and policies in the active configuration.	For everyday rule-based routing, directing requests through a proxy, directly, or blocking them as needed.	After editing a file, make sure it is enabled and check the rule order.
Proxy · Proxy	Routes traffic through a proxy, subject to system and configuration bypass behavior.	Temporarily check whether a server is reachable and help distinguish rule issues from connection issues.	This does not mean every request on the device goes through the proxy. Restore your usual mode after testing.
Direct · Direct	Handles traffic using a direct connection.	Compare the local network, destination service, and proxy route.	This does not disconnect the VPN. To stop the client connection completely, turn off the connection switch.

CONFIG / RULE

Rule types and policies

Rules determine how a request should be handled. Open the active configuration in Config and check its rules and their order. To use rule-based routing, first set Global Routing to Config. Rules are generally checked from top to bottom, and the policy for the first match is applied. Put more specific conditions before broader ones, and place FINAL at the end to handle requests that did not match earlier rules.

Match by domain, address, or request characteristics

DOMAIN matches a specific domain; DOMAIN-SUFFIX matches a domain suffix and its subdomains; DOMAIN-KEYWORD matches a keyword in the domain. IP-CIDR and IP-CIDR6 describe IPv4 and IPv6 address ranges, respectively. GEOIP matches using IP geolocation data. USER-AGENT depends on request information being available, so it does not work for all traffic and should not be treated as a universal way to identify apps.

Keep policies separate from rule types: PROXY routes through a proxy, DIRECT connects directly, and REJECT blocks a request. A reject rule may affect page resources, sign-in, or notifications. After adding a rule, test the affected features instead of checking only whether the home page loads.

[Rule]
DOMAIN-SUFFIX,example.com,PROXY
DOMAIN-KEYWORD,example,DIRECT
IP-CIDR,192.168.0.0/16,DIRECT
FINAL,DIRECT

This is a syntax example, not a complete configuration file. The first rule matches example.com and its subdomains, so those requests will not be evaluated by the DOMAIN-KEYWORD rule below it. FINAL,DIRECT means unmatched requests connect directly; it is not the right default for every use case. Keep a copy of the original file, change one condition at a time, and check connection logs to confirm which rule matched.

Check rule keywords in the quick reference →

HOME / SUBSCRIBE / ADD SERVER

Managing existing subscriptions and servers

A subscription provides a way to maintain server details in bulk, while each individual server entry stores its connection parameters. A successful import only means the app received the information; it does not confirm that the server is reachable.

Subscribe: Manage an existing subscription

In Home, tap the add option and choose Subscribe. Enter a subscription URL you already have and give it a recognizable name. After saving and updating, return to Home and check that the expected server group and entries appear, then select one to connect. If the subscription cannot be parsed, check that the URL is complete and current, and that it returns data in a supported subscription format.

Subscription URLs may contain credentials. Don't post them publicly or include them in full in screenshots shared for help. Updating a subscription may replace entries managed by its source. Back up personal changes you need to keep, and keep them separate from the subscription. Before deleting a subscription group, check whether it contains information you still need.

Add Server: Check an individual entry

In Home, open Add Server, choose the protocol that matches your existing server details, and enter the address, port, authentication, and transport settings. Protocols such as Shadowsocks, VMess, VLESS, Trojan, Hysteria2, and WireGuard use different fields; changing only the address while reusing all the settings from another protocol will not work.

When importing with Scan QR Code, check the detected protocol and server address as well. Use your existing server details for fields such as TLS, SNI, and transport path; don't mask a configuration problem by disabling verification at random. After saving, select the entry and verify a manual connection before setting up rule-based routing or On Demand.

AUTOMATION / ON DEMAND

On Demand connections

On Demand lets the system establish or manage a VPN connection when specified conditions are met; it is not another server configuration. It controls when a connection is triggered, while Global Routing and Config determine how traffic is handled after the connection is established. First verify that the server, DNS, and destination work in manual mode, then look for On Demand in Settings.

Start with a single trigger condition

Set conditions for Wi-Fi, cellular networks, or domains using the options shown in the app. If you need to distinguish networks by Wi-Fi name, check the SSID carefully; networks with similar but different names are not the same condition. Domain-based triggers depend on system DNS resolution and On Demand behavior. They do not guarantee a reconnect every time a page opens and do not monitor arbitrary app activity.

After saving, test the trigger, disconnect, and trigger again on the relevant network. If you have multiple rules, check each condition, action, and displayed order. A broad condition matching first can prevent more specific rules from taking effect. If the connection turns itself back on after you switch it off, check On Demand before repeatedly deleting server entries.

Test automatic connections separately from routing

During testing, first confirm that the system establishes a connection, then check the current Global Routing mode, and finally see whether the request matches the expected rule. Switching between Wi-Fi and cellular may restart an existing connection; a brief failure during the switch does not prove that the server settings are wrong. To troubleshoot in manual mode, pause On Demand and repeat the same test against the same destination.

OBSERVATION / DATA

Data usage statistics

Data shows traffic statistics available to the client, helping you review activity during a connection. Check the summary or details shown in Data, including what is being measured, the time range, and whether there is a reset option, before comparing values. A statistic should not be treated as your provider's bill or remaining allowance.

Use a small, controlled test to check changes

To see whether an action generates traffic, note the current value, perform one specific action, and then check Data again. Background sync, notifications, and other apps may also generate requests, so an increase alone does not prove that a domain used PROXY. Check the current mode, rules, and available connection logs to determine how traffic was routed.

Before clearing statistics, save any information you still need to compare and make sure you are clearing statistics, not a configuration file. Client statistics, system traffic counters, and provider measurements may differ because they use different measurement scopes, account for encapsulation or retransmissions differently, or reset at different times. Usage shown in subscription information may come from its provider and should not be confused with local observations in Data.

PREFERENCES / SETTINGS

Common Settings options

Avoid making several major changes to auxiliary settings at once. Note the current values, check whether a setting is an app-wide preference or belongs to the active Config, and test one change at a time.

DNS: Check which settings take effect

DNS resolves domain names to IP addresses, a separate step from connecting to a server. DNS behavior may be controlled by both Settings options and the active Config, so identify which source is in effect before making changes. In a configuration file, dns-server = system means to use system DNS. This helps explain the configuration field; it is not a universal recommendation for every environment.

If a domain won't load, first determine whether the issue is DNS resolution, the connection, or the destination service's response. Avoid changing the resolver, routing mode, and server all at once, or it will be hard to identify the cause. When entering a custom DNS service, check its address and transport format, and confirm it is reachable on the current network. Successful resolution does not guarantee that the connection will work.

Test Method: Know what is being tested

In Settings, find Test Method and check the selected method and its target before running Connectivity Test. Different methods test different parts of the connection; results may also depend on the test target, network, server load, and DNS. When comparing servers, use the same method and target so you are not comparing results from different conditions.

A successful test only means that the part of the route covered by that test responded. It does not prove that every website, protocol, or app will work. A failed test may also mean the test target is unreachable. Verify with the destination you actually need and consider the error details; don't rely on a single test as a complete diagnosis.

Today Widget: Quick access and controls

Today Widget is an auxiliary system component, and its availability depends on the device's OS and the features currently supported by the app. Check the Today Widget option in Settings, then see whether it is available in the system's widget interface. The information and controls it offers may differ from the main app; check what is actually shown on your device.

If the widget doesn't update promptly, open Shadowrocket to check the actual connection status, then check the system's refresh behavior and widget settings. The widget cannot replace the initial VPN configuration approval or serve as the sole way to verify traffic policies. After changing a server or configuration, return to Home and Config to confirm the final selections.

iCloud: Syncing doesn't restore everything

Check the iCloud sync options in Settings, make sure you are signed in to your own Apple Account, and allow the app to use the relevant iCloud features. Read the on-screen details before enabling sync so you know what will sync and how. Don't assume that all app data, system approvals, and preferences sync in the same way.

When using another device for the first time, keep its existing local configuration and check the cloud contents before taking any action that could overwrite data. After syncing, check the servers, Config, and connection status individually. Redownloading an App Store purchase, syncing iCloud data, and authorizing a VPN configuration are separate processes and cannot replace one another.

TROUBLESHOOTING / DIAGNOSTICS

Diagnostics and settings checklist

Diagnostics helps collect or review information for troubleshooting. Find the Diagnostics options in Settings and check the results provided. It can help narrow down an issue, but it won't fill in missing server details or restore a subscription that its source no longer provides.

Set up a repeatable test

Check the network. Note whether you are on Wi-Fi or cellular, keep the test destination consistent, and first rule out a disconnected network or one that requires an additional sign-in.
Check the server and subscription. Review the selected entry, protocol, and parameters in Home. If a subscription update fails, troubleshoot the import and parsing first.
Check the overall mode. Note the current Global Routing selection. Temporarily switch modes for comparison if needed, changing only one variable at a time.
Check the configuration and DNS. In Config, check the active file, rule order, and FINAL, then distinguish DNS resolution failures from connection failures.
Check for automation. Pause On Demand and repeat the test to see whether automatic triggers or network changes are affecting the results.
Keep relevant details. Record the steps, error messages, and test conditions, then collect only the Diagnostics information directly related to the issue.

Review sensitive information before sharing diagnostics

Diagnostic records, configurations, and screenshots may contain domains you visit, server addresses, subscription credentials, or other personal information. Remove credentials and unrelated details before sharing, and keep only what is needed to reproduce the issue. Don't publish a full subscription URL or share an entire personal configuration just to show one error.

After troubleshooting, restore your usual Global Routing, Config, and On Demand settings, then test your commonly used destinations again. For help with importing and connecting for the first time, read the setup guide. For guidance on buying the genuine app, App Store regions, and restoring purchases, see the purchase guide. App Store is the only place to get Shadowrocket. Check the App Store listing for compatibility and system requirements.