Look up terms by purpose, keeping their original English labels.
First distinguish interface options, protocol settings, and rule policies, then compare them with the screen you’re using. Each term has its own anchor so you can bookmark or share a specific entry.
First identify the screen you’re on. The screen name, overall routing mode, and connection switch each have a different role; one status alone cannot tell you the full connection result.
The main screen for viewing saved server entries, choosing a connection, and controlling the connection switch. Selecting an entry sets the connection target; it does not establish a connection. Check the switch and test an actual request as well. If the list is empty, first add details from your own subscription or server.
The option that determines how requests are handled overall: Config, Proxy, and Direct correspond to Config, Proxy, and Direct. To route requests according to rules, select Config and check which configuration is active. Changing this option does not modify server addresses, authentication details, or configuration file contents.
In the configuration management area, Config refers to viewing, selecting, and managing configuration files. In Global Routing, it means handling requests according to the active configuration. Always check the screen: opening the Config screen does not mean rule-based routing is enabled. After making changes, confirm the file is selected and test the relevant request.
These are the two overall choices in Global Routing: proxy or direct connection. Proxy handles requests through the selected proxy; Direct connects directly. Neither is a rule for a single domain. If you expect requests to be handled differently by domain but one overall mode is always active, check Global Routing before rewriting rules.
Triggers the system VPN connection under configured conditions. Its behavior depends on the relevant app settings and system state. It does not fix server settings or update subscriptions on a schedule. If the connection turns on again, check both On Demand and the system VPN status rather than only whether you manually switched it off.
View traffic and other statistics recorded by the app to help track data use over time. App statistics, carrier bills, and service-provider usage measurements may cover different periods and data, so their figures may not match exactly. Check the measurement period and scope before comparing them; a total alone cannot tell you which rule was applied.
The entry point for checking connection behavior and other app options; available items depend on what the app currently shows. When troubleshooting, note the original values and change only one variable at a time. The app’s Settings screen is separate from the system Settings app. Switch to the system settings when instructions refer to system permissions or battery records.
Check whether a server is reachable on the current network; use the result as a troubleshooting clue. A successful test does not replace testing an actual request, and its time is not a measure of available bandwidth or every website’s response speed. If it fails, check the local network first, then verify the server details. For a full sequence, see the connection failure troubleshooting guide.
A protocol determines how the client communicates with the remote server; it is not a speed tier. Type must match the protocol used by your existing server. Switching protocols at random will not fix a connection.
A proxy protocol that typically requires the server address, port, password, and encryption method to match. Encryption is part of the connection settings; do not substitute a method just because its name looks similar. If an imported entry will not connect, check each detail against the original, especially for spaces or missing characters in the password.
A proxy protocol that uses parameters such as an identity; the address and port are only part of the configuration. The transport method and related TLS, path, and hostname settings must also match the server. Some fields apply only to a particular transport method. Check the original configuration rather than copying extra settings from another entry.
A proxy protocol that requires its identity, transport method, and security settings to match. It is a different Type from VMess and cannot be substituted just because the address or identity looks similar. After importing, check that all additional settings are present; an address and port alone are not enough.
A proxy protocol commonly used with TLS. The authentication password and TLS details serve different purposes. A reachable server address does not guarantee that the server name or certificate validation is correct. For certificate errors, check the server name, certificate, and device time; disabling validation is not a general fix.
A QUIC-based proxy protocol that relies on UDP connectivity on the current network. In addition to the address and port, check the authentication and TLS settings. A successful test with another protocol does not prove this one will work. If results differ across networks, check network conditions and configuration settings separately rather than blaming the protocol name alone.
A key-based tunneling protocol in which keys, addresses, and peer details each serve a different purpose. The private key is sensitive and should not be shared in screenshots, logs, or support messages. Make sure local and peer settings correspond. Importing a public key alone does not create a complete, usable configuration.
Rules answer two questions: what to match and how to handle it. Read match keywords separately from policy keywords, and check the rule order and current Global Routing mode.
Matches an exact domain name. A DOMAIN rule for example.com does not automatically include subdomains such as api.example.com. If you want to cover the domain and its subdomains, first check whether DOMAIN-SUFFIX better fits your needs.
Matches a domain suffix and can cover the specified domain and its subdomains, such as example.com and www.example.com. It does not search for an arbitrary string in a full URL, and the URL path is not what this rule matches. After changing it, check what actually matches and whether an earlier rule already handles the request.
Matches a keyword contained in a domain name, usually across a wider range than an exact domain or suffix match. A short keyword may also match domains you did not intend to include. Use this only when you need a broad match, and check the results against actual requests. It is not another way to write DOMAIN-SUFFIX.
Matches based on the destination IP’s geographic lookup in a database, for example GEOIP,CN,DIRECT. It does not classify traffic by brand ownership or domain suffix, and results may depend on IP changes and database contents. If domain rules and GEOIP rules both apply, consider the resolved IP and rule order to understand the final outcome.
Matches IPv4 and IPv6 address ranges. The network address and prefix length together determine the range, and changing the prefix can change the number of targets covered. Confirm the address type and intended range before adding a rule. An IPv4 rule does not automatically cover the corresponding IPv6 requests.
Handles requests that did not match earlier rules and is usually placed at the end as a fallback. FINAL,DIRECT and FINAL,PROXY handle requests differently, so choose based on your configuration goals. Changing FINAL does not affect requests already matched by earlier rules; do not check only the last line when troubleshooting.
These are rule policy keywords meaning proxy, direct connection, and reject; they are not protocol names. PROXY does not fill in server settings for you, and DIRECT does not bypass all system network conditions. When comparing them with the interface options Proxy and Direct, check capitalization and context so you don’t confuse an overall mode with a single rule.
A subscription determines where server entries come from; a configuration determines how requests are handled. Confirm what you’re importing before choosing where to add it, and don’t enter a subscription URL in an unrelated field.
In Add Server, this Type is used to import an existing subscription link. Use the complete link provided by your own service provider. A subscription can supply and update server entries, but it is not a complete routing configuration. Links may contain access credentials; hide sensitive details when asking for help and never share the real URL publicly.
The entry point for adding a server or subscription; Type determines which fields you need to fill in. To use an existing subscription link, select Subscribe. To enter a single server manually, select its actual protocol and check each setting. Saving only adds the entry; you still need to select it, connect, and verify the request.
The remote service the client connects to, often also referring to a saved connection configuration in the app. A usable entry requires a matching address, port, protocol, and authentication details; the display name is not used for authentication. You can edit the label for easier identification, but that does not change the remote service or connection capability.
A section marker for routing rules in a configuration file. Rules below it are evaluated in order, so a broad rule near the top may prevent a later, more specific rule from taking effect. Save a copy of the original configuration before editing. Afterward, confirm that this file is active and check the results in Config routing mode.
Resolves a domain name to an IP address as one step in the connection process. Successful resolution does not guarantee that the subsequent connection, TLS validation, or rule handling will work; likewise, a failed connection is not necessarily a DNS problem. First distinguish resolution errors from connection errors, then check the relevant configuration settings.
Shadowrocket is a paid, closed-source app for Apple platforms. The App Store is the only place to get it. Check app purchase history, device configurations, and access to remote services separately.
The App Store is the only place to buy and install Shadowrocket. To verify the genuine app, check the developer, Shadow Launch Technology Limited, the official icon, and app ID 932747118. Shadowrocket is primarily used on iPhone and iPad; compatibility and system requirements for Mac, Apple TV, and Apple Vision are as listed on the App Store page. Before buying, see how to verify the genuine app.
Paying once for the client app. The US store price is around $2.99; check the App Store page for the current price. Prices are shown in local currency by storefront. A one-time app purchase is not a service plan and does not automatically provide server details. You’ll still need your own subscription or server information to import.
The App Store section for viewing account purchase history and redownloading apps; the exact label may vary with the system interface. When changing devices or reinstalling, first check which account was used for the purchase, then search for Shadowrocket. Restoring the app purchase does not restore server entries; check your subscriptions and configurations separately. See the restore guide.
The country or region set on an Apple Account for App Store transactions. It affects app availability, displayed currency, and payment methods. It is separate from the device language and cannot be determined from your current location alone. If you can’t find the app, first check the account’s store region and whether the product page is available there. Before changing the region, review the relevant guidance in Troubleshooting.
Import, connect, and verify in order. If something goes wrong, identify which layer the issue is in before changing the relevant settings.