Identify the screen first, then consider what each term means. Interface terms, protocol names and rule keywords remain in English; the explanations clarify their roles in connections, routing and configuration.
INTERFACE / ROUTING
First determine whether a term refers to a screen, an overall mode or connection status. An enabled toggle alone does not prove a destination website is reachable; also check the selected server, current mode and rules.
The main screen for viewing existing servers, choosing a connection and controlling the connection toggle. Add Server and Scan QR Code are common ways to enter details. After importing, check the entry before connecting. A name shown in Home is only a label for identification, not a guarantee of server status or quality.
A mode selector that determines how requests are handled overall: Config, Proxy or Direct. It is not the same as selecting a server. The mode determines how requests are handled; the server selection determines which remote endpoint a proxy connection uses. When troubleshooting unexpected routing, first check whether Config is selected.
In Global Routing, Config means requests are handled according to the rules in the current configuration. Requests may use PROXY, DIRECT or REJECT, so selecting Config does not send every request through a proxy. Config is also the name of the bottom tab for managing configuration files; use the screen context to tell which meaning applies.
Proxy mode in Global Routing routes typical connection requests through the selected proxy instead of choosing a policy rule by rule. Actual behavior may still depend on system traffic scope and related exclusions. This differs from the uppercase PROXY at the end of a rule, which describes the action taken when that rule matches.
Direct mode in Global Routing means typical requests are not routed through a proxy server. Switching to Direct does not turn off the client's connection toggle, nor does it mean DNS and other settings have reverted to their original system state. To compare network behavior, record the mode and toggle status separately before and after switching.
Traffic information for viewing client statistics, such as upload and download readings in the available views. Client statistics may differ from the system's cellular data statistics in what they count, the reporting period and reset time. To estimate traffic from an action, compare readings in the same view before and after; do not mix cumulative totals measured on different bases.
SETTINGS / DIAGNOSIS
These descriptions explain what each setting does; no single value is right for every network. Save the original value and change one setting at a time. For detailed steps, see Settings Guide.
DNS resolves domain names to IP addresses and is an important step before many network connections can be made. A resolution failure can make a website unavailable even when the proxy server itself is reachable. DNS behavior may also affect IP-based rule matching. Check the relevant configuration file settings and the active mode rather than simply switching to another DNS address.
On Demand triggers connection behavior based on preset network conditions. It controls when to connect, not which rule matches a particular website. Global Routing and the current configuration still determine how website requests are routed. Before enabling it, verify that manual connections work, then set the conditions available in the app and observe what happens when the network changes.
A tool for checking connectivity to an existing server. Results depend on the selected test method, target and current network. Latency reflects the response time for a particular test; it is not download bandwidth and does not guarantee that every website is reachable. For meaningful comparisons, use the same test method and check actual requests and Log when results look unusual.
Logs record runtime, connection or request information and can help diagnose resolution failures, authentication errors and rule behavior. Check the time period for a reproducible action rather than relying on an isolated line. Logs may contain domains, addresses and personal configuration details; remove authentication information and subscription credentials before sharing them.
The app can sync data through iCloud under certain conditions. Check the in-app settings for the exact scope and behavior. This is different from restoring an App Store purchase: being able to download the app again does not mean all local configurations have been restored. Before changing devices, keep a recoverable copy, then check each configuration and server entry on the new device.
This usually means the port used by the local proxy listener, not the remote server port entered under Add Server. The port must match the connection settings that use this local proxy. Access from other devices also depends on the listening address and network access scope. Unless there is a clear need, do not broaden the listening scope just to troubleshoot a website.
PROTOCOLS / PARAMETERS
Protocols define how the client and server communicate; they are not a performance ranking. The descriptions below explain technical terms only. When entering details, use the actual settings for your existing server; changing a protocol name alone cannot convert an entry.
A proxy protocol that requires matching encryption and authentication settings on the client and server. A mismatch in the address, port, password or encryption method can prevent a connection. Check each value against the details you already have; the same protocol name does not mean fields can be reused between different entries.
A proxy protocol with user authentication, typically configured with a user ID and transport parameters. Check the underlying transport, path and TLS settings separately; verifying the server address alone is not enough. Preserve the meaning of the original parameters after importing, and do not mistake a display name for authentication information.
A proxy protocol that configures authentication and transport security separately. The VLESS name alone does not tell you what protection a connection uses. The user ID, transport method and related security parameters must match the server. When troubleshooting, distinguish authentication issues from transport handshake failures instead of repeatedly changing the same address field.
A proxy protocol commonly used with TLS. Check the password and related settings, including the server name and certificate. The server address and the name used for TLS verification may serve different purposes, so enter the original configuration as provided. If a certificate error occurs, check the name, device time and certificate status first; disabling verification is not a routine fix.
A QUIC-based proxy protocol that requires UDP connectivity and correctly configured authentication and TLS parameters. A connection failure on a particular network may be caused by how that network handles UDP, not necessarily by an incorrect password. The number in the protocol name is part of the name and is not a basis for comparing speed or quality with other protocols.
A protocol that uses public-key cryptography to establish an encrypted tunnel. Configuration includes the local key, peer public key, tunnel address and remote endpoint. Treat private keys as sensitive credentials; never include them in public screenshots or logs. A successful handshake does not mean a specific destination is reachable. Check routing scope and DNS settings as well.
As a proxy type, HTTP means requests are forwarded through an HTTP proxy; it is not just the protocol label at the start of a webpage address. Whether the connection to the proxy is protected by TLS depends on the connection method and settings. Do not infer this from the destination website using HTTPS. Enter authentication details and the port as specified for your existing server.
A proxy protocol for forwarding network connections. It may support username and password authentication, but authentication alone does not encrypt traffic. UDP availability depends on the server, client settings and network conditions. Check the proxy type when reviewing an entry; the same address and port do not make it an HTTP proxy.
RULES / MATCHING
A rule specifies a matching condition followed by a handling policy. The examples below use reserved example domains or documentation address ranges for illustration only. Put rules in the [Rule] section of the active configuration and pay attention to their order.
Matches an exact domain and does not automatically include all its subdomains. For example, the rule below applies to example.com; it will not also match www.example.com just because it is a subdomain. To include both the root domain and its subdomains, consider DOMAIN-SUFFIX and check for earlier matching rules.
DOMAIN,example.com,PROXYMatches a domain and its subdomains, making it useful for applying a policy to a domain range. Both example.com and www.example.com fall within the scope of the example below. Matching follows domain boundaries, not any occurrence of the same string. Distinguish this from the broader string matching of DOMAIN-KEYWORD.
DOMAIN-SUFFIX,example.com,PROXYMatches when a domain contains a specified string. This can cover a wider range than an exact-domain or domain-suffix rule. In the example, example may occur in different domain names, not just example.com. Define the intended scope before using it; when a rule matches unexpectedly, check these broader conditions first.
DOMAIN-KEYWORD,example,PROXYMatches based on the IP geolocation database's classification of an address, not the language of a website or the user's location. Database results may differ from the source of a site's content and can change when CDN addresses change. How a domain resolves and how the database classifies the address both affect the result.
GEOIP,CN,DIRECTMatches an IPv4 address range; the prefix length after the slash determines its size. The example below uses a documentation address range, not a real service. For domain requests, check whether matching involves DNS resolution. This does not replace domain-based rules; the two use different criteria.
IP-CIDR,192.0.2.0/24,DIRECTMatches an IPv6 address range. The concept is similar to IP-CIDR, but it applies to a different address type. An IPv4 rule alone does not mean the same condition covers IPv6 connections. If connections to the same domain behave differently, check the resolution results to see which address type is in use.
IP-CIDR6,2001:db8::/32,DIRECTA fallback rule for requests that match none of the preceding rules, usually placed at the end of the rule list. FINAL,DIRECT sends all remaining requests directly; changing DIRECT to PROXY sends them through the proxy policy instead. This affects all requests not covered by other rules, not just a particular website.
FINAL,DIRECTThese are policy names applied when a rule matches, not protocol names. PROXY routes the request through a proxy, DIRECT connects directly, and REJECT blocks the request. The proxy endpoint used by PROXY still depends on the current selection and configuration. Preserve the uppercase spelling in rules; do not mix it up with the interface modes Proxy and Direct.
DOMAIN,example.com,REJECTSUBSCRIBE / CONFIGURATION
First distinguish where servers are imported from, where rules are stored and how an app purchase is restored. These are related but not interchangeable; downloading the app again does not necessarily restore your existing connection details.
A link can be used to import and update a user's existing server list; obtain the link from your own service provider. This is separate from purchasing the app on the App Store and may not include a complete rule configuration. A subscription URL may contain access credentials, so treat it as private information and do not share it publicly, paste it into public documents or include it in screenshots.
A remote connection defined by its address, port, protocol and authentication parameters, often called a proxy server. The displayed name is just for identification; it does not determine the actual address or protocol. When entering details manually under Add Server, use the information you already have. If the connection fails, check each field rather than assuming the configuration is correct based on its name.
A file that organizes runtime settings and rules, often in sections such as [General] and [Rule], and can be managed in Config. Importing a file does not mean it is selected or active, nor does it mean a connectable server is available. Keep a copy before editing. After use, confirm the selected file and verify rule behavior with Config selected in Global Routing.
A condition that checks a request and assigns a policy. In Config mode, rules are generally evaluated in list order, and the first match determines how the request is handled. More specific conditions are often placed before broader ones; FINAL provides a fallback at the end. Rules determine the route but cannot fix an incorrect server password, a certificate error or an unreachable network.
The place to find existing App Store purchases. When changing devices or downloading the app again, check the Apple Account used for the purchase and its purchase history. App purchase eligibility, iCloud Sync and restoring local configurations are three separate matters. Shadowrocket is available only through the App Store. Check the App Store listing for compatibility, system requirements and purchase terms.