Shadowrocket Setup and rule configuration

Config  → Apply configuration rules
Proxy   → Route through the selected proxy
Direct  → Connect directly

Global Routing determines how traffic is handled overall. Open it from Home: Config mode routes traffic according to the current configuration's Rule; Proxy mode routes traffic through the selected proxy; Direct mode connects directly. For everyday domain- and network-based routing, prepare a configuration before selecting Config. You can temporarily switch modes to compare results while troubleshooting, but note the original setting and restore it after testing. Switching modes will not fix an incorrect Host, Port or authentication detail, nor will it automatically change servers. Check that the server is valid first, then decide whether the selected mode suits your needs.

Settings
  On Demand

On Demand handles connections according to conditions you set. Find it in Settings. First verify a connection manually, then set the required triggers and test how they behave on Wi-Fi and mobile networks. If a connection returns after you disconnect manually, check On Demand instead of immediately deleting the server. It controls connection triggers; it does not repair subscriptions, choose a better route or rewrite Rule. Record your current settings before changing conditions. Afterward, check both the system VPN status and the connection status in the app, and continue only when the result is as expected.

[Rule]
DOMAIN-SUFFIX,example.com,PROXY
IP-CIDR,192.168.0.0/16,DIRECT
FINAL,DIRECT

Rule connects matching conditions with handling policies. DOMAIN-SUFFIX matches a specified domain and its subdomains, IP-CIDR matches an address range, and FINAL handles traffic not matched earlier. Rules are usually checked in order, so place specific conditions before broader ones. When adding a rule, also check the policy name to avoid a match with no corresponding policy. example.com here is a demonstration domain, not a usable server. After editing the configuration, confirm that Global Routing is set to Config, then verify with an actual connection and diagnostic information. The presence of rule text alone does not mean it is active.

https://example.com/sub?token=xxxx

Subscribe imports and updates an existing server list. Get the link from your service provider. Save the link in Config under Subscribe, run an update, then return to Home and check that the list appears. For multiple subscriptions, use names that make their purpose clear. Before updating, note the selected server so you do not look for it under an old name if the list changes. Fields generated by a subscription may be overwritten by later updates, so distinguish subscription entries from servers added individually. A token in a link is an access credential. When troubleshooting, share only redacted error details, not the full address.

[General]
[Rule]
[Hosts]

Config stores rules and related settings, while the server list stores connection endpoints; they serve different purposes. Keep a usable copy before editing, then adjust General, Rule or Hosts one item at a time. After saving, confirm that the edited file is selected. When using iCloud sync, check the device's account status, whether sync has finished and which configuration is active locally. Synced content arriving does not mean connection states will match. Before using the setup across devices, recheck policy references and server names. Before deleting a configuration, make sure its backup can be opened so you do not mistake a subscription link for a complete configuration backup.

Connectivity Test
Settings → Diagnostics
Data

For connection issues, run Connectivity Test first, then use Diagnostics and Data in Settings to examine what is happening. Data traffic statistics can help show whether data is passing through the client, but do not replace usage records from your service provider. Test method, destination and current network all affect the result, so keep conditions consistent when comparing tests. Shadowsocks, VMess, VLESS, Trojan, HTTP, SOCKS5, WireGuard and Hysteria2 use different fields. Choose Type based on the existing details rather than changing it based on the name alone. Hide addresses, passwords and access credentials before sharing diagnostic results.