Shadowrocket Global Routing: How to Use Config, Proxy, and Direct

At a Glance

Shadowrocket’s Global Routing setting determines how traffic is routed; it does not provide a connection service. If you already have a server and rules configured, use this guide to distinguish Config, Proxy, and Direct, then follow the steps to verify that your rules are working. For everyday rule-based routing, use a verified Config. Proxy and Direct are useful for temporarily choosing a specific route and for troubleshooting. “All traffic” here means traffic handled by the app; it does not mean every type of communication on your device necessarily uses the same route.

1. Understand the Connection Toggle, Server, and Global Routing

In Home, the connection toggle starts or stops the connection, the selected server provides the proxy route, and Global Routing determines whether requests handled by the app connect directly or go through the proxy. These settings are related, but they are not interchangeable. Turning on the toggle only means the connection process has started. It does not confirm that a website is reachable or that a request is using the proxy.

For example, if a server is selected in Home while Global Routing is set to Direct, ordinary connections still use the direct route. Conversely, selecting Proxy does not fix an incorrect server address, port, or authentication details. If a service is unreachable, changing Config to Proxy only changes route selection; it does not create a working route.

3 items

Check separately: connection toggle, selected server, and Global Routing

4 types

Rule examples in this guide: DOMAIN-SUFFIX / IP-CIDR / GEOIP / FINAL

2 steps

After switching modes: establish a new connection, then check the request log

This guide focuses on three basic routing modes. Scene in Global Routing is a context-based option, not another name for Config. For troubleshooting, explicitly select Config, Proxy, or Direct to avoid adding scene settings as another variable.

2. How to Choose Between Config, Proxy, and Direct

The difference is whether rules determine the route for ordinary connections—not the level of encryption or speed. Config does not mean “proxy everything,” and Direct does not mean “stop the app.” Actual speeds depend on the destination, your network, the proxy server, and the route selected; the mode name alone does not indicate performance.

Config: Choose a route based on the active rules

Recommended

Uses the currently enabled configuration to select DIRECT, PROXY, or a defined policy based on rule matches. Requests that do not match earlier rules are handled by fallback settings such as FINAL; they do not necessarily connect directly.

Best for: Everyday use when you have reliable rules and need to access both direct and proxy destinations.

Proxy: Use the proxy route for all traffic

Ordinary connections no longer select a route rule by rule in Config; they are all sent through the proxy route. This is useful for testing the proxy connection, but does not guarantee the destination is reachable or replace checking your server settings.

Best for: Temporarily routing everything through the proxy, or checking whether Config rules are affecting access.

Direct: Use the direct route for all traffic

Ordinary connections access destinations over your current network without being forwarded through a proxy server. The app may still be running, and settings such as DNS need to be checked separately; Direct does not fully exit the app.

Best for: Checking your local network or direct destinations, or comparing against the proxy route when troubleshooting.

Choosing a day-to-day mode depends on whether the rules meet your needs. If you have verified the rules and access works as expected, use Config. If you have not checked the rules yet, review Config first instead of enabling it just because it is recommended.

3. Switch Modes from Home and Verify the Result

Before you begin, make sure you already have a connection service. Get your subscription from your service provider; buying the app is not the same as purchasing a service plan. Importing a server list and enabling a rules file are separate steps. Seeing servers in the list does not mean Config already has rules suited to your needs.

Check the server. Open Home and make sure the server you want to use is selected. Confirm that its address, port, protocol, and authentication details match the information from your service provider. Do not assume that the common web port 443 is used by every server.
Check the rules file. Open Config and confirm that the expected configuration is enabled. Viewing a file without enabling it does not make it part of routing.
Select a mode. Go back to Home → Global Routing and select Config. Return to Home and check the displayed mode again to confirm the selection took effect.
Start the connection. Turn on the connection toggle. The first time you connect, follow the system prompt to allow adding a VPN configuration. Then run Connectivity Test as an initial check that the server is reachable.
Test each destination. Choose one destination expected to connect directly and another expected to use the proxy. Send a new request to each, then check the destination, matched rule, and actual policy in the app’s request log.

4. Rule Order in Config and the FINAL Fallback

Config works by matching rules in order. Specific rules generally go before broader rules, with FINAL at the end as a fallback. The snippets below illustrate the syntax; they are not complete configurations ready to replace your own. example.com is an example domain, and 192.0.2.0/24 is a documentation-only address range. Adjust them to your actual needs before use.

[Rule]
DOMAIN-SUFFIX,example.com,PROXY
IP-CIDR,192.0.2.0/24,DIRECT,no-resolve
GEOIP,CN,DIRECT
FINAL,PROXY

DOMAIN-SUFFIX,example.com,PROXY: Matches example.com and its subdomains, and sends the connection through PROXY. It does not match every domain that happens to contain the string example.com.
IP-CIDR,192.0.2.0/24,DIRECT,no-resolve: Matches the destination IPv4 range and connects directly. no-resolve means this rule will not trigger an additional domain lookup; a connection with a destination IP already resolved may still match.
GEOIP,CN,DIRECT: Uses geographic data for the destination IP to decide whether to connect directly. It does not match domain suffixes or identify the visitor’s location, and the data may not reflect the actual deployment location.
FINAL,PROXY: Uses PROXY when none of the earlier rules match. If you change it to FINAL,DIRECT, unmatched destinations will connect directly instead.

The final rule must reference a valid policy. If your configuration uses a custom policy group, verify the group name and the option currently selected within it. A policy name at the end of a rule is not enough to confirm that traffic is taking the intended route. If a destination works in Proxy but fails in Config, first check which rule matched, then check its policy—do not delete all the rules.

5. Troubleshoot by Changing One Variable at a Time with Proxy and Direct

Keep the server, network, and destination the same, and change only Global Routing for each test. After every switch, start a new connection and note the specific result, such as success, timeout, or DNS resolution failure. If you also change servers, DNS, or subscriptions, it becomes harder to tell which change affected the result.

Compare two routes to the same destination

Config fails, Proxy works

Confirm that the correct file is enabled in Config.
Check whether the destination matched DIRECT or another policy earlier in the rules.
Check FINAL and the policy group’s current selection.
After correcting the rules, switch back to Config, establish a new connection, and test again.

Proxy fails, Direct works

Run Connectivity Test first to check whether the proxy server is reachable.
Check the server address, port, authentication, and transport settings.
Determine whether the issue is a connection timeout, DNS resolution failure, or an error returned by the destination.
Check whether the rules should route this destination directly.

Comparing results helps narrow down the issue, but it is not a definitive diagnosis. If both routes fail, continue checking your network, DNS, and the destination’s status.

A successful Connectivity Test does not mean every website and protocol will work. For example, a successful web request does not prove that UDP traffic is available, and some destinations may restrict certain routes. Recording the destination and request type that actually failed is more useful for troubleshooting than repeatedly switching modes.

6. Four Common Questions About Everyday Use

Why does some traffic still use the proxy in Config?

Config allows proxy and direct connections to coexist. In Config, check which file is enabled, the rules matching the destination (such as DOMAIN-SUFFIX), and the final rule, FINAL. If FINAL points to PROXY, connections not matched by earlier rules will use the proxy. Check the actual rule match rather than assuming Config defaults to direct connections.

Why is the connection toggle still on when Direct is selected?

Direct selects a route; it does not stop the connection. To stop the app connection, go to Home and turn off the connection toggle. If it reconnects automatically, check whether Settings → On Demand has conditions enabled for on-demand connections. On Demand controls when a connection starts; Global Routing controls where traffic goes. Check them separately.

Why does routing look the same after updating a subscription?

First check whether you updated a server subscription or a rules configuration. Updating a server subscription typically changes the server list and its settings; it does not necessarily change the currently enabled rules file. Go back to Home and check the selected server, then open Config and check which file is enabled. Once both are confirmed, make a new connection to the same destination and inspect the rule match.

If I use Proxy all the time, can I ignore the rules?

In Proxy, ordinary connections do not use Config rules to select a route, but server availability, DNS, and destination restrictions still matter. If you also need to access local resources or other destinations that should connect directly, update the relevant rules in Config and switch back to verify them. Do not use Proxy indefinitely to avoid checking rules that have not been verified.

7. Checklist Before Returning to Your Usual Mode

After troubleshooting, undo temporary changes so the app does not remain in a test mode the next time you open it. If you need to keep your changes, save a copy of the original configuration and note which rule you changed. Before sharing request logs or configurations, remove server authentication details, personal credentials in subscription URLs, and other sensitive information.

In Home, select the intended server and return Global Routing to the verified Config.
In Config, enable the correct file and make sure FINAL points to a valid policy that meets your needs.
Test a direct destination and a proxy destination with new connections; confirm that the results match the rules.
If you temporarily changed Settings → On Demand or DNS, check each setting you want to keep.

Shadowrocket is a closed-source commercial app for Apple platforms, primarily used on iPhone and iPad. It is available exclusively through the App Store and is a one-time purchase. Check the App Store listing for compatibility with Mac, Apple TV, and Apple Vision, as well as system requirements and whether the purchase is universal.

Verify the official App Store listing

Before purchasing, verify the developer, Shadow Launch Technology Limited, and app ID 932747118. If you have already purchased the app, continue with the guides and check your server, connection permissions, and routing settings in order.

View the official App Store listing View the guides