First identify which layer a term belongs to: the interface provides controls, protocols define how connections work, and rules determine where traffic goes. Similar English terms do not always refer to the same setting.
The interface, connection status, and routing mode each serve a different purpose. Before changing settings, distinguish where to configure something, whether you are connected, and how traffic is handled.
Home is the main screen for viewing the server list, selecting a server, and toggling the connection. A selected indicator shows which server is chosen; it does not mean a connection has been established. Turn on the connection and check the result. After switching servers, verify actual connectivity rather than relying on a name change.
Global Routing controls how traffic is handled overall. The commonly used modes are Config, Proxy, and Direct. Before checking whether rules are working, make sure Config is selected. In Proxy or Direct mode, a line in a rule file alone does not establish where traffic is going.
The three modes are Config, Proxy, and Direct: Config applies the current configuration, Proxy routes traffic through a proxy, and Direct connects without a proxy. Config can also refer to the screen for managing configuration files; use context to tell them apart. Switching modes can help isolate a problem, but restore your intended setting after testing.
On Demand starts a connection when conditions such as network changes are met; it is not a proxy protocol. If a connection starts again after you turn it off manually, check whether an On Demand condition is triggering it. You can temporarily disable the relevant conditions, verify that a manual connection works, then restore them one at a time.
Add Server lets you enter server details manually. Select the protocol first, then fill in the corresponding address, port, and authentication fields. Forms differ by protocol, so entering only an address and port may leave the configuration incomplete. Get the details from your service provider and check spaces, capitalization, and additional transport parameters before saving.
When you connect for the first time, the system may ask permission to add a VPN configuration. This allows the app to use the system network extension; it does not confirm that the remote server authenticated successfully. If access still fails after granting permission, check the server, routing mode, and DNS rather than repeating the authorization step.
The protocol is determined by the configuration of the server you already have; changing its name in the app does not convert it to another protocol. Speed and battery use depend on transport, network conditions, encryption overhead, and server load—not just the protocol name.
Shadowsocks connects to a server using a specified encryption method and shared password. Its configuration typically includes an address, port, password, and encryption method. The method must match the server settings; the correct password with the wrong method can still fail. UDP forwarding also depends on the server configuration and network path.
VMess provides authentication and data protection, with the user ID as a key part of the connection details. The connection may also depend on a transport such as WebSocket and on TLS settings, so the user ID alone is not a complete configuration. If authentication fails, check that the device's system time is accurate.
VLESS separates the proxy protocol from transport security settings, so the protocol name alone does not mean the connection is encrypted. Along with the user ID, check the transport method, security options, and any required name fields against the provided details. If imported settings are missing parameters, complete them rather than trying arbitrary combinations.
Trojan commonly uses TLS and password authentication, with certificate verification as part of the connection process. A reachable address does not guarantee that the certificate name matches. Check the password, port, and server name. For certificate errors, verify the name, device time, and server certificate status.
HTTP and SOCKS5 are different proxy protocols; the same address and port do not make them interchangeable. HTTP can carry a tunnel connection using CONNECT, while SOCKS5 uses a different request and authentication flow. Whether either protocol provides encryption or UDP support depends on the transport configuration and server implementation.
WireGuard creates an encrypted tunnel using UDP and key pairs. Its configuration includes details such as the interface address, peer public key, and routing scope. It does not use ordinary account-and-password credentials, and public and private keys are not interchangeable. Treat the private key as sensitive: remove it from diagnostic materials before sharing, and check that the network allows the required UDP traffic.
Hysteria2 is based on QUIC and relies on UDP connectivity. Authentication and TLS parameters must also match the server. Performance on unstable networks depends on congestion, packet loss, and bandwidth settings; it is not guaranteed to be faster on every network. If other connections work but Hysteria2 does not, check the UDP path and parameters before adjusting performance settings.
Rules are usually evaluated in order, and the first match determines the policy. In the examples below, example.com is used only to illustrate the syntax. To understand an individual rule, also check the rules above it and the current Global Routing mode.
DOMAIN matches an exact domain name. For example, DOMAIN,example.com,DIRECT applies to example.com itself. It does not match a full webpage URL; the path and query parameters are not part of the domain. To include subdomains, understand the scope of DOMAIN-SUFFIX rather than adding a wildcard arbitrarily.
DOMAIN-SUFFIX matches a domain suffix. DOMAIN-SUFFIX,example.com,PROXY can match example.com and its subdomains. This is useful for applying a policy across a domain family, but it does not automatically cover related resources hosted on other domains. After making a change, check which rules match both the main page and its external resources.
DOMAIN-KEYWORD matches a string found in a domain name, usually more broadly than DOMAIN or DOMAIN-SUFFIX. The same string may appear in unrelated domains, causing matches beyond what you intended. If you know the exact domain, consider a more precise match first.
IP-CIDR and IP-CIDR6 match IPv4 and IPv6 address ranges, respectively. For example, IP-CIDR,192.168.0.0/16,DIRECT. The number after the slash is the network prefix length, not a port number. When the destination is a domain name, address matching may also involve DNS resolution, so a domain rule alone does not determine the final result.
GEOIP matches regional classifications in an IP address database; it does not identify a webpage's language, a visitor's location, or who operates a website. Content delivery and changes to IP addresses can make classifications differ from expectations. To handle a specific site precisely, check its actual destination address alongside its domain rules.
FINAL is the fallback used when no preceding rule matches and should be placed at the end of the rule list. For example, FINAL,DIRECT sends all remaining traffic to DIRECT. If FINAL appears before specific rules that need to be evaluated, those later rules cannot work as intended.
These uppercase keywords are rule policies: PROXY routes traffic through a proxy, DIRECT connects directly, and REJECT blocks the request. They are not the same layer as the Proxy and Direct modes in Global Routing. When troubleshooting, check the overall mode first, then the policy of the matched rule; changing only one may not resolve the issue.
Server details answer “where to connect”; a configuration file determines “how to handle traffic.” Importing, updating, enabling, and selecting are separate actions. Completing one does not mean the others are done.
A subscription retrieves and updates a set of server or configuration details. Get the subscription link from your service provider. It may contain personal credentials, so do not publish it or show it in full in a support screenshot. A successful update means the details were retrieved; it does not confirm that every server record can connect.
A server record stores the endpoint address, protocol, port, and authentication details used by the app to connect. Its display name is just a label; it does not determine the server's actual location, bandwidth, or availability. If a connection fails, check the record and whether it is still valid rather than relying on its name or a single test result.
A configuration file groups settings such as General and Rule to control behavior such as DNS resolution and rule handling. Importing a file does not necessarily enable it, and rule handling also depends on Config mode in Global Routing. Replacing the whole file can change multiple settings, so keep a recoverable copy before editing.
Scan QR Code reads connection details from a QR code. The code is an encoded form of text, not a separate protocol. After scanning, check that the detected type, address, and authentication fields are complete. A QR code may contain a password or subscription credentials; treat it as sensitive and do not post it in public forums.
Purchased Items in the App Store lets you find purchase history and redownload apps. Check that you are signed in with the Apple Account used to make the purchase. Shadowrocket is a closed-source commercial app and is available exclusively from the App Store. Refer to the App Store listing for system requirements and whether Universal Purchase is supported. A one-time app purchase is not a connection service subscription, and redownloading the app does not restore your server details.
“The switch is on,” “the server test succeeded,” and “the destination website is accessible” are different results at different layers. Troubleshoot in this order: server, mode, DNS, then rules. Change one setting at a time to identify the cause.
DNS resolves domain names to IP addresses. If resolution fails, there may be no destination address for the next connection step. The DNS route is related to, but separate from, the route used for the webpage connection. First distinguish “no DNS result” from “an address was resolved but the connection failed”; do not replace all DNS and rule settings at once.
Connectivity Test checks whether the selected server is reachable under specified test conditions, making it useful when connecting for the first time or after switching servers. A successful test means the test path received the expected response; it does not confirm that every website, UDP traffic, or all rules are working. After the test, try the actual destination and check how its requests are handled.
Latency is the time taken to receive a response under specific test conditions. It is not file download speed and does not equal connection stability. Results from different test targets, methods, or times are not directly comparable. When choosing among servers, test under the same conditions more than once and consider real-world access, packet loss, and sustained transfer performance.
TLS protects data in transit and verifies certificates. SNI specifies the requested server name during the handshake. The connection address may differ from the certificate verification name, so enter each field exactly as provided rather than replacing them all with the same IP address. For certificate errors, check the name match, system time, and certificate validity.
A rule match occurs when a request is evaluated, matches a rule, and uses that rule's policy. A page may request resources from multiple domains, so a correct match for the main page does not mean its images, APIs, and videos use the same policy. In diagnostic logs, check the destination, matched rule, and final policy together. Remove personal details before sharing logs.