Check the English term first, then identify whether it refers to an interface, a match condition, or an action.
This page groups common terms by purpose. Each entry has its own anchor for bookmarking or quick reference. Interface terms, protocol names, and rule keywords remain in English; the explanations clarify what each one controls without renaming items in the app. For step-by-step instructions, see the first connection guide. To understand how settings work together, read the complete manual.
Navigation organizes app functions; the connection toggle and traffic mode answer different questions.
Home is the main screen for viewing server entries, selecting a default server, and controlling the connection. A server appearing in the list means its connection details are saved; it does not mean the server is selected or connected. Before connecting for the first time, check the selection, connection toggle, and system authorization.
NavigationGlobal Routing controls how traffic is handled overall. The common options are Config, Proxy, and Direct. It is separate from the connection toggle: the toggle controls whether a connection is established, while the mode determines how traffic is handled once connected. If rules do not behave as expected, first check the current mode here.
Traffic modesThe three modes are Config, Proxy, and Direct. Config applies the rules in the current configuration; Proxy routes traffic through a proxy, while Direct connects without one. Other settings can also affect how traffic is handled. Config is a mode name here, distinct from the section for managing configuration files.
Global Routing modesOn Demand starts a connection when configured network or domain conditions are met, such as joining a specified network. It does not provide a server or guarantee that an existing server is available. If the connection starts again after you turn it off manually, check whether an On Demand condition matches the current environment.
On-demand connectionData shows traffic statistics recorded by the client, helping you track data usage over time. Client statistics may use different billing methods or reporting periods from your provider, so they should not be treated as your remaining allowance or bill. To check whether a service is available, also verify the status of your existing service.
Traffic usageSettings is where you adjust common app behavior; not every connection issue requires a change here. During troubleshooting, note the original value, change one setting at a time, and test before deciding whether to keep the change. If you are unsure what a setting does, read its documentation first.
SettingsA protocol name describes how a connection works; it does not indicate server location, availability, or actual speed. Use settings that match the server information you already have.
Shadowsocks is a proxy protocol. Common parameters include the server address, port, encryption method, and password. The encryption method and authentication details in the client must match the server; similarly named options are not interchangeable. Check any additional transport parameters in your existing details as well.
ProtocolsVMess uses credentials such as a user ID for authentication; connection details commonly include a UUID. An address, port, and UUID alone may not be enough to reproduce the full connection. Transport and TLS settings may also be required. Troubleshoot by checking each field against your existing configuration rather than inferring settings from the protocol name.
ProtocolsVLESS configures authentication separately from transport protection, so the protocol name alone does not tell you how the connection is secured. The user ID, transport type, and related security settings must match the server. Do not reuse VMess settings without checking; use the connection details provided for VLESS.
ProtocolsTrojan is commonly used with TLS and password authentication. In addition to the address and port, check the server name and certificate settings. A TLS verification failure and an incorrect password are different issues and should be checked separately. For certificate problems, first verify the name and device time; disabling verification is not a general fix.
ProtocolsHysteria2 is a QUIC-based proxy protocol that requires the current network to support the relevant UDP traffic. Authentication details, port, and TLS settings must still match the server; the protocol name does not replace these parameters. If a test fails on a particular network, check the network conditions as well as the authentication fields.
ProtocolsWireGuard is a tunneling protocol that uses public-key and private-key authentication. Configuration usually includes a local address, peer public key, and endpoint. Public and private keys serve different purposes and are not interchangeable; never share a private key in screenshots or public messages. Even with correct authentication details, mismatched address or routing settings can disrupt communication.
ProtocolsHTTP and SOCKS5 are different proxy protocols, not interchangeable labels. Use the address, port, authentication method, and connection security options from your existing details. A reachable port only confirms that the port can be reached; it does not confirm that the selected proxy protocol is correct.
ProtocolsMatch the target first, then apply an action. The syntax below belongs in configuration text, not in server connection details.
DOMAIN matches an exact domain; DOMAIN-SUFFIX matches the specified domain and its subdomains. For example, DOMAIN-SUFFIX,example.com,PROXY can match example.com and its subdomains, but not every domain containing the string example.com. Choose the keyword that fits the intended match scope.
DOMAIN-KEYWORD checks whether a domain contains a specified string, for example, DOMAIN-KEYWORD,example,DIRECT. It matches the domain, not the full webpage URL or page content. A short string can broaden the match and cause unrelated domains to hit the same rule.
IP-CIDR is for IPv4 ranges; IP-CIDR6 is for IPv6 ranges. The number after the slash is the network prefix length. For example, IP-CIDR,10.0.0.0/8,DIRECT describes a range of addresses, not a single server. Check the actual target address and DNS results to determine whether the rule matches.
GEOIP matches a target address according to its classification in an IP geolocation database. The result depends on the database records; it does not detect the device’s location or guarantee the service’s actual operating location. If a classification differs from expectations, check the target IP first, then consider a more specific domain or address rule.
IP geolocation matchingFINAL is the fallback rule used when no earlier rule matches, and is usually placed at the end of the list. FINAL,PROXY applies the PROXY action to remaining traffic; it does not override rules that have already matched. Changing FINAL affects targets not covered by other rules, so define the intended scope before testing.
These three uppercase terms are rule actions: proxy, direct connection, and rejection. They do not specify which target to match. They operate at a different level from Proxy and Direct in Global Routing, and their uppercase spelling matters. PROXY still requires a valid server to be selected; it does not create connection details.
Rule actionsRules are generally evaluated one by one from top to bottom, and the action for the first matching rule is applied. A broad rule near the top can therefore prevent more specific rules below it from matching. When editing rules, check how specific and broad conditions interact, rather than just confirming that a particular line exists. Even a valid rule file may not produce the expected result if Global Routing is not set to Config.
Matching logicServer entries store connection details, subscriptions fetch multiple entries, and configuration files organize rules and general settings.
Subscribe imports or updates server entries using a subscription link you already have. Get the link from your own service provider. A subscription is not a service included with the Shadowrocket purchase, nor is it the same as a configuration file. Subscription links may contain credentials, so do not share them in public screenshots or support requests.
Importing a subscriptionA server entry stores an address, port, protocol, and authentication details. It is sometimes called a node in Chinese-language discussions. The display name is only a label for identification; it does not confirm the server’s location or availability. You need the relevant connection details before adding one, and should check which server is selected as the default before connecting.
Connection detailsAdd Server is the option for entering server details manually, for cases where you already have the complete parameters. First choose the protocol that matches your information, then fill in the corresponding fields. Do not guess the protocol from the address alone. Saving creates an entry; you still need to select the server and test the connection.
Add manuallyScan QR Code reads connection details from a QR code, saving you from entering each field by hand. It does not verify that the source is trustworthy or that the parameters are still valid. After scanning, check the protocol, server address, and authentication fields before saving. Treat QR codes containing connection credentials as sensitive information; do not share them publicly.
Import from QR codeA configuration file organizes general settings, rules, and other content in text format. Common sections include [General] and [Rule]. Importing a file, selecting it for use, and choosing Config in Global Routing are separate steps to check. Before switching files, keep a working configuration so you can compare or restore it.
Updating a subscription fetches its latest data. Entry names, counts, and parameters may change based on the returned content. A successful update means the data was retrieved and processed; it does not mean every server can connect or that the service period has changed. After updating, check the default server selection and verify the result with a connection test.
Routine maintenanceSuccessful resolution, an accessible port, completed authentication, and working access are different outcomes at different stages.
DNS resolves a domain name to an IP address so the app can connect to the destination. Successful DNS resolution does not mean proxy authentication succeeded; conversely, a failed lookup can prevent access even after the proxy connection is established. When troubleshooting, identify whether the failure occurred during DNS resolution or a later connection stage.
DNS resolutiondns-server is a configuration key for DNS settings. For example, dns-server = system means to use the system DNS settings. It is not a proxy server address field or a place to enter a subscription link. After changing it, test the same target on the same network to avoid mistaking a network change for the effect of the setting.
DNS over HTTPS sends DNS queries over HTTPS and is commonly abbreviated as DoH. It changes how DNS requests are transmitted; it does not replace a proxy server or directly determine which routing rule matches a domain. Check that the DNS service is reachable and that its connection path fits the current configuration.
DNS transportConnectivity Test helps check connectivity. Results depend on the selected target, current network, and related settings. A single successful test does not prove that every website is reachable, and one failed test does not necessarily mean all server settings are wrong. Compare the result with actual browser access, server selection, and other diagnostic information.
Connection testLatency is the time a request takes to receive a response under specific test conditions, usually shown in milliseconds. A lower number does not mean higher download bandwidth or indicate how stable a connection will be over time. When comparing servers you already have, test them on the same network using the same method, then consider actual performance for your use case.
Test resultsIf you already have your own subscription or server details, follow the guide to import them, choose Global Routing, turn on the connection, and test it. If something goes wrong, first identify whether the issue involves parameters, mode, rules, or DNS, then adjust the relevant setting. Avoid changing several things at once, so you can identify the cause.