Shadowrocket Global Routing: Config, Proxy, and Direct Explained

Bottom line: Choose Config for rule-based routing

Global Routing determines how Shadowrocket routes connections it handles. Config applies policies according to the active configuration’s rules. Proxy uses a proxy for all handled connections rather than selecting an outbound policy rule by rule. Direct connects to destinations without using a proxy as the outbound route. “All” means connections handled by the app, not necessarily every type of system traffic on the device.

Config is recommended only when the configuration matches your needs. If FINAL points to a proxy, connections that match no earlier rule will still use a proxy. They go direct only if FINAL points to DIRECT. The mode name alone does not tell you which outbound route a website will use.

Steps: Select and verify the active configuration in Home

First, distinguish Home, Config, and Settings. Home is where you manage the connection and view Global Routing; Config is for managing rule configurations; Settings contains app options, including On Demand. Connection entries in an existing subscription and configuration files containing routing rules are separate items to check.

1. Open Home and confirm that a usable connection entry is available. If you use your own subscription, import it first. Use the address, port, and authentication details provided by your existing service provider.
2. Open Config and confirm that the configuration you want to use for routing is selected. Importing a file alone is not enough; make sure it is the active configuration.
3. Return to Home → Global Routing and select Config. To troubleshoot routing differences, you can temporarily choose Proxy or Direct.
4. Return to Home, verify the selected proxy, then turn on the connection toggle. The first time you connect, follow Apple’s system prompts to authorize the VPN configuration.
5. Visit one destination expected to use a proxy and another expected to connect directly. Check the matching result for each new connection rather than just checking whether the connection toggle is on.

If you also see Scene in the list, don’t treat it as another name for Config. Scene provides context-based selections and requires its conditions and associated settings to be checked separately. This comparison uses Config, Proxy, and Direct to avoid adding scene switching as another variable.

How Config works: Rule order and FINAL determine the outcome

Config is not a switch that automatically decides which websites need a proxy. It applies the matching logic in the active configuration: it checks each rule’s match criteria, then uses the policy specified by the matching rule. DOMAIN-SUFFIX matches domain suffixes, IP-CIDR matches address ranges, GEOIP classifies by IP geolocation database, and FINAL provides a fallback when no earlier rule matches.

The following illustrates rule syntax; it is not connection information that can replace a complete configuration. Suppose the active configuration defines a valid proxy policy named PROXY, and only the example domain and its subdomains should use it while all other traffic connects directly. You could use:

[Rule]
DOMAIN-SUFFIX,example.com,PROXY
FINAL,DIRECT

In this example, both example.com and www.example.com match the first rule. notexample.com does not match just because it contains similar characters. PROXY must resolve to a valid policy in the active configuration; adding the word to a rule without a corresponding outbound route is not enough. For more on rule structure, see Configuration File Guide.

Putting FINAL,DIRECT before specific domain rules breaks the intended matching order. Another common misconception is to change FINAL to PROXY and still assume that “Config sends everything else direct.” The mode stays the same, but the fallback policy changes, so unmatched traffic takes a different route.

• DOMAIN-SUFFIX is useful for rules based on domain suffixes, but it may not cover other domains referenced by a page.
• IP-CIDR applies to address ranges; it is not a substitute for a domain-suffix rule. Whether DNS resolution is required depends on the request type and rule options.
• GEOIP depends on the destination IP and its database classification. Don’t infer whether a rule matches from page content or the appearance of a domain.
• REJECT is a policy that blocks traffic. If a destination is blocked, check whether a relevant rule matched instead of simply switching proxies.

Troubleshooting: Proxy works, but Config doesn’t

When this happens, keep the network, proxy, and destination the same, and change only Global Routing. That isolates the routing choice instead of changing several variables at once. The comparison below is a reproducible troubleshooting method, not a guarantee that any particular website will be reachable.

After switching modes, check new connections. Browsers and other apps may reuse existing connections, and cached content may still appear on an open page; a single refresh may not reflect the new mode. Close the page and reopen it, then check the connection details in the app. If a page loads resources from multiple domains, distinguish a successful main document from failed requests such as images or sign-in endpoints.

1. Check the selected proxy first. Don’t switch to a different connection entry while changing modes, or the comparison won’t be meaningful.
2. Next, check what matched. The actual request may use a different subdomain or a separate domain that the existing DOMAIN-SUFFIX rule does not cover.
3. Finally, check the outbound route. If the correct rule matched but the request still fails, make sure its policy selects the intended proxy.

If Proxy also fails to connect, check the address, port, authentication details, and any protocol-specific settings for the existing connection. For example, if the configuration requires port 443, it must match the port on which the remote service is listening. The port number alone does not prove that TLS is configured correctly or that the service is reachable. Don’t try random ports to mask an issue with the original settings.

FAQ: Direct, subscription updates, and On Demand

Protocols and routing are separate concepts. Shadowsocks, VMess, VLESS, Trojan, Hysteria2, and WireGuard are protocol options for connection settings; Config, Proxy, and Direct are routing modes. Selecting Proxy does not change one protocol into another, and editing rules cannot fix incorrect authentication details. Check specific settings against the configuration for your existing service.

Everyday checklist

After completing a reproducible test, keep the mode that fits your needs. Use Config for rule-based routing. Keep Proxy selected only when you explicitly want all handled connections to use a proxy. When using Direct, remember that traffic won’t use a proxy as the outbound route—and that the app connection itself remains active.

• Home: The selected proxy is the intended entry, and the connection status has been checked.
• Home → Global Routing: The selected mode matches your needs, and no temporary troubleshooting setting was left in place.
• Config: The correct configuration is active, specific rules appear before FINAL, and each policy name has a corresponding definition.
• Settings → On Demand: Automatic connection conditions match your needs and are not confused with manual testing.
• Verification: Check at least one request expected to use a proxy and one expected to connect directly, and confirm the route for each new connection.

Shadowrocket is a paid client for Apple platforms, primarily used on iPhone and iPad. The App Store is the only way to get it; check the App Store listing for system requirements. The one-time app purchase is separate from any service plan. This guide assumes you already have your own provider and subscription. For setup, see the Global Routing Guide. For connection issues, see Connection Troubleshooting.