First identify where a term appears, then interpret its meaning. Interface modes, policies in a configuration and server protocols operate at different levels and are not interchangeable.
The explanations below assume you already have your own subscription or server details. A one-time client purchase is not a service plan. Check app purchases, server services and configuration management separately.
Start with the screen where a setting appears. The same term can refer to different actions when used as an entry label or a routing mode.
Use this screen to view and select connection items such as added servers and subscription groups. A listed entry only means its details are saved; it does not confirm valid authentication or current reachability. Before connecting, check the selected entry and the Global Routing mode.
Sets the overall routing mode. The three options are Config, Proxy and Direct. For rule-based routing, Config is generally the right choice. To troubleshoot, compare modes temporarily, but changing modes will not fix invalid server details.
On the configuration management screen, Config refers to configuration files and related actions. In Global Routing, it means requests are handled according to the active configuration. After importing a configuration, check which file is enabled; seeing it in the list does not mean its rules are active.
The proxy mode in Global Routing generally sends requests handled by the app through the selected proxy route. It can help determine whether an issue is related to rule-based routing, but it is not the uppercase PROXY policy in a configuration. If the selected server is unavailable, switching to Proxy may not restore the connection.
The direct mode in Global Routing sends requests without using the selected proxy server. It can help check basic connectivity on the current network, but results also depend on the local network, DNS and the destination service. Direct mode alone cannot confirm that a server is configured correctly.
A mechanism that starts a VPN connection when configured conditions are met. Its behavior depends on app options and system state. It does not update subscriptions or replace invalid authentication details. If the connection starts again after you turn it off, check this option and the system's VPN settings.
Use this entry to add server details. Select the correct protocol first, then check the address, port and authentication fields against the information you already have. Guessing parameters from the protocol name alone is unlikely to produce a working connection. After saving, verify that the connection works.
A protocol name describes only part of how a connection works. The address, authentication, transport and security settings must match the server.
A proxy protocol. Common settings include the server address, port, encryption method and password. The client and server must use the same encryption method; enter any additional parameters from the source information. Successful import only means the details could be read—it does not confirm authentication or connectivity.
An authenticated proxy protocol, typically configured with a user ID and transport settings. Check the ID, address, port and transport parameters separately when troubleshooting. An incorrect device clock can also affect authentication, so repeatedly changing the server address may not help.
A proxy protocol whose name alone does not specify the transport or security settings. Use the complete parameters provided by the server; do not reuse fields from a different connection just because both use VLESS. For options such as TLS, check the associated name and validation requirements.
A proxy protocol commonly used with TLS. Its settings include a password, server address and the name required for certificate validation. A reachable address does not mean TLS validation or password authentication has succeeded. If the connection fails, keep certificate validation enabled and check the name, certificate status and original parameters.
A QUIC-based proxy protocol. Connecting depends on authentication, TLS settings and whether the current network supports UDP. A working connection with another protocol does not prove this one will work. Comparing results on another network can help distinguish network transport restrictions from server configuration issues.
A key-based tunneling protocol. Its settings typically include keys, an interface address, a peer endpoint and routing ranges. Its fields differ from those of password-based proxies, so check the complete configuration. Private keys are sensitive; remove them before sharing logs or screenshots.
Two distinct proxy protocols that should not be interchanged just because they use the same address or port. Check the server type, authentication method and supported transport. Their names alone do not guarantee encryption; assess security based on the actual connection method.
The keyword on the left describes the matching condition; the policy at the end specifies the action. The first matching rule generally determines which policy is used.
DOMAIN-SUFFIX,example.com,PROXYDOMAIN-SUFFIX is the condition type, example.com is the sample match value and PROXY is the action. This snippet explains the syntax; it is not a complete configuration and contains no server details.
A rule keyword that matches an exact domain. For example, specifying example.com does not automatically include all its subdomains. Use this condition to handle a specific host, and check the full hostname in the logs if a request comes from a different subdomain.
A rule keyword that matches a domain suffix, including the specified domain and its subdomains. Its scope is broader than DOMAIN, but it does not match arbitrary text anywhere in a name. Check the coverage before choosing a policy so that subdomains needing different handling are not grouped together.
Matches an IPv4 range. The number after the slash indicates the prefix length; for example, 192.168.0.0/16 specifies an address range. This matches addresses, not domain text. IPv6 addresses require the corresponding IP-CIDR6 keyword and cannot use an IPv4 range rule.
Matches the location assigned by an IP geolocation database, as in GEOIP,CN,DIRECT. Database location does not indicate the user's location, the text displayed on a page or where its operator is based. If the result is unexpected, check the destination IP and database information rather than relying on page content.
The fallback policy used when none of the preceding rules match. It is usually placed at the end of the rule list. FINAL,PROXY sends remaining requests through PROXY. If an earlier rule matches, changing FINAL will not affect those requests.
A proxy policy in a rule that sends matching requests through a proxy route. It is not a protocol name and is not inherently tied to a particular server entry. To see where a request actually went, check the selected server, the policies in the configuration and the connection logs.
A direct policy in a rule that sends matching requests without using the selected proxy server. The uppercase DIRECT action in a rule is at a different level from the Direct mode in Global Routing. Direct requests can still be affected by DNS and current network conditions.
A reject policy in a rule that blocks matching requests. If its match scope is too broad, it can interfere with sign-in, image loading or other features. When troubleshooting, check the specific blocked request and matching rule, then narrow the condition instead of removing all rules.
A system that resolves domain names to IP addresses, forming one step in accessing a domain. Successful resolution does not guarantee a connection, and a timeout is not necessarily caused by DNS. When troubleshooting, distinguish lookup errors from address connection failures, TLS validation failures and application-level response errors.
Subscriptions manage server details; configurations define how traffic is handled. Importing one does not mean the other is already set up.
A way to retrieve and update a group of server details using a link obtained from your own service provider. A subscription link may contain access credentials, so protect it like a password. A successful update only means the content was retrieved; it does not guarantee that every server in the group works.
A remote endpoint the client connects to. An entry usually includes a protocol, address, port and authentication details; it is also often called a node. A subscription can organize multiple server entries, but their names are only labels. Check the fields and test access rather than relying on a name.
An interface label for importing subscriptions. Paste a complete link you already have and confirm that it uses a supported format. An update usually affects entries in the corresponding group; it does not update the app. Compare the group before and after updating, then check which entry is selected.
A configuration entry that combines a matching condition with a policy. Rules are generally checked from top to bottom, and the action for the matching rule is applied. More specific conditions usually belong before broader ones. Rules also depend on Config being selected and the relevant configuration file being enabled.
A configuration feature that rewrites or redirects URL requests according to conditions. It is different from routing rules that select a proxy route. What can be handled depends on the request type and configuration; not all encrypted requests can be rewritten directly. Check the source and match scope before using it.
System authorization, purchase eligibility and in-app configuration are separate things. Restoring one does not automatically restore the others.
An Apple system configuration for managing an app's network tunnel. On the first connection, you may see a prompt to authorize adding the configuration. Authorization allows the app to create the network tunnel; it does not verify that a server works. If you deny or remove it, follow the app's prompts to reconnect and check system settings.
The account associated with App Store purchases. To restore an app, check the account used for Media & Purchases. It may differ from the account currently signed in to iCloud. If a purchase is missing, first check the original purchasing account and the store status; purchase authentication is separate from subscription authentication.
The App Store section for finding purchase history and redownloading apps; its name may vary by system version. Redownloading an app does not restore all server details. Device compatibility, system requirements and purchase availability are as stated on the App Store page.
Syncs app-supported data across devices through iCloud. What syncs depends on the app's options and system settings. It is not a complete backup of all configurations and credentials. Before switching devices, check what is synced; after restoring the app, confirm the configuration, selected server and system authorization again.
Glossary entries explain terminology; actual steps still need to be verified in order. When troubleshooting a connection, note the screen, selected mode and exact message—this is more useful than simply saying it does not work.
Shadowrocket is a closed-source commercial app for Apple platforms, available exclusively on the App Store. This site is the Shadowrocket website and official manual. Check app purchases separately from any subscription or server details you already have.