For everyday use, Config is usually the best choice in Shadowrocket, provided you have selected and reviewed a suitable configuration. Use Proxy to route all traffic through the proxy temporarily or compare behavior while troubleshooting; use Direct as a direct-connection baseline. This guide assumes you already have your own provider and subscription. It covers how to switch modes, rule order, how to read connection logs, and the difference between Global Routing and On Demand.
Choose a routing mode, then check the active policy
Global Routing determines how connections handled by Shadowrocket are routed. It is not a protocol selector and does not update subscriptions. Choosing a node in Home, selecting a configuration in Config, and choosing a mode in Global Routing are related but separate actions. Changing just one may not produce the result you expect.
Config
RecommendedRoutes traffic according to the rules in the active configuration. A matching rule can select DIRECT, PROXY, REJECT, or a policy group defined in the configuration. If no earlier rule matches, the final behavior depends on FINAL.
Best for: everyday use when you have reviewed your configuration and want different destinations handled according to rules.
Proxy
Routes all connections within its scope through the proxy, rather than choosing between direct and proxy paths according to Config's usual rules. Whether a connection succeeds still depends on the active proxy, the destination service, and network conditions.
Best for: temporarily routing everything through the proxy or comparing results with Config while troubleshooting rules.
Direct
Routes connections within its scope directly, without forwarding them through the selected proxy node. This does not turn off Shadowrocket's connection switch or restore every related network setting.
Best for: checking whether your current network can reach a destination or briefly comparing direct connectivity.
These are three commonly used modes, not the only Global Routing options. Scene applies routing choices based on conditions. For initial troubleshooting, stick to Config, Proxy, or Direct to avoid confusing results when scene conditions change.
Switch modes: check from Home, then reconnect
Before switching, note the current mode, selected node, and active configuration. Get subscriptions and nodes from your own provider; buying the app does not provide a working connection. If no usable node appears in Home, first import and update your existing subscription instead of repeatedly changing Global Routing.
-
Check the node
Go to Home and confirm that the selected node comes from your own subscription. Check that the server address, port, and authentication details are complete. A connectivity test reflects only its specific test conditions; it does not guarantee access to a particular website.
-
Check the configuration
Go to Config and confirm which configuration is active, paying particular attention to rules for the destination domain and to FINAL. Importing a subscription does not automatically select a suitable rule-based configuration for everyday use.
-
Choose a mode
Go to Home → Global Routing → Config to route traffic by rules. For a temporary comparison, select Proxy or Direct in the same place. Don't change the node and configuration at the same time.
-
Test again
Return to the target app and send a new request. Existing connections may retain their previous state, so close and reopen the target app if needed. If the result is still unclear, disconnect and reconnect Shadowrocket, then test again.
-
Return to everyday settings
Record the results and connection logs for each mode. After troubleshooting, go back to Home → Global Routing → Config and confirm that the active configuration and policy group are still set as intended.
If no new requests appear after switching, first check whether the target app actually sent a network request. A cached page, buffered video, or reused long-lived connection can make the screen look unchanged; that alone does not mean Global Routing failed to take effect.
How Config works: rules are matched in order; it doesn't detect everything automatically
Config's behavior depends on its rules. Rules are generally checked in order, and the first match determines how traffic is handled. Put specific exceptions before broader rules, and place FINAL at the end. Config does not inherently mean “direct in one region, proxy everywhere else,” nor does it guarantee that every uncategorized destination uses the proxy.
[Rule]
DOMAIN-SUFFIX,example.com,PROXY
IP-CIDR,192.168.0.0/16,DIRECT,no-resolve
GEOIP,CN,DIRECT
FINAL,PROXYThis is an instructional rule snippet, not a complete configuration or subscription URL. The domain in the first line is an example; check the active proxy selection and policy in your configuration to determine the actual PROXY route. Don't replace your working configuration with this snippet.
| Keyword | What it matches | Meaning in this example |
|---|---|---|
DOMAIN-SUFFIX | Domain suffix | Use PROXY for example.com and its subdomains. This does not match the full URL path. |
IP-CIDR | IPv4 range | Use DIRECT when the destination is in 192.168.0.0/16; no-resolve means the rule won't trigger an additional domain lookup for matching. |
GEOIP | IP geolocation category | Use DIRECT for destination IPs categorized as CN. The result depends on the data source being used. |
FINAL | Connections not matched by earlier rules | This example uses PROXY as the final action. If set to DIRECT, unmatched traffic would connect directly. |
So if you chose Config but a destination still connects directly, check the matching rule and FINAL first rather than assuming the node is faulty. If the connection log shows that an earlier, broad rule matched, adjust the rule order or narrow its match. If the connection was routed to a policy group, also check which route that group currently selects.
Everyday use and troubleshooting: change one variable at a time
A practical approach: use rules day to day, compare one variable at a time when something goes wrong
Use Config day to day
- Keep the configuration you've reviewed, and confirm how FINAL handles traffic.
- Destinations that need a proxy should match a proxy policy; destinations that need local access should match DIRECT.
- After updating a subscription, check whether node name changes affect policy group references.
Compare modes when something goes wrong
- Keep the network, node, and destination the same; change only the routing mode.
- Compare Config with Proxy first, then try Direct if needed.
- Start a new connection after each change and record the error and the policy actually used.
If Proxy works but Config doesn't, that narrows the investigation to rules, policy groups, and configuration differences; it does not identify a single cause on its own.
For example, if a new connection to the same destination succeeds with Proxy but fails with Config, and the log shows Config chose DIRECT, first check whether a rule for the destination domain is missing or an earlier rule matched. If both modes use the same proxy route and both fail, investigate the server settings, network reachability, and destination service status.
Direct can serve as a direct-connection baseline, but it still operates within Shadowrocket. To see how the network behaves with the connection switch off, run a separate test with the switch disabled and check whether On Demand turns the connection back on. Keep the conditions for these two tests separate in your notes.
On Demand and Scene: connection conditions are not routing rules
Use Settings → On Demand to review conditions for establishing a connection. Global Routing determines how traffic is handled once connected. One answers “when should it connect?”; the other answers “which route should it use?” Enabling On Demand won't add missing DOMAIN-SUFFIX rules or automatically fix node settings in a subscription.
- Connection turns back on automatically: Check whether Settings → On Demand is enabled and review its conditions to make sure they match your test.
- Results change after switching networks: Check whether Scene is in use and which routing choice that scene applies under the current network conditions.
- Keep the mode fixed while troubleshooting: Explicitly select Config, Proxy, or Direct in Home → Global Routing. Temporarily avoid letting scene conditions determine the result.
- Restore settings when you're done: If you changed On Demand or Scene for testing, note and restore the conditions you need. Don't restore only the node selection.
On Demand cannot make an unavailable network work. Switching between Wi-Fi and cellular can change the exit IP address, DNS results, and network restrictions on transport protocols. To isolate the effect of a routing mode, compare results on the same network first, then repeat the tests on another network.
Troubleshooting notes: distinguish routing, ports, and protocols
Global Routing does not change a node's protocol. Shadowsocks, VMess, VLESS, Trojan, Hysteria2, and WireGuard have different authentication and transport requirements; use the details supplied by your provider. Switching Config to Proxy cannot fill in missing authentication details or convert one protocol to another.
The destination port and the proxy server port are two different things. When visiting an HTTPS website, the destination port is usually 443, but the node's server port must match your provider's settings. Don't change the node port just because a website uses 443. Check DNS separately, too: if domain resolution fails, the destination connection hasn't been established yet, so switching routing modes may not help.
| What you observe | What to check first | What to do next |
|---|---|---|
| Proxy works; Config fails | Matched rule, policy group selection, FINAL | Check whether the failed connection actually used a different route or DIRECT. |
| Direct works; Proxy fails | Current proxy settings, reachability, and destination restrictions on the exit route | Check the current node without changing rules, and confirm its settings with your provider. |
| All three modes fail | Local network, DNS, destination service status | First check whether the same network can reach other destinations, then review the specific error in the connection log. |
| Only an old page still appears to work | Cached content or an existing connection | Send a new request before recording the result; don't treat cached content as proof that a connection succeeded. |
These observations are troubleshooting clues, not guarantees of speed or connectivity. At a minimum, record the network type, destination domain, Global Routing mode, matched rule, and selected route. Don't share full subscription URLs, authentication details, or logs containing private browsing activity.
Common questions: when is Config the right choice?
Should I choose Config without checking the configuration first?
Check the active configuration first. Config is a mode that applies rules; incomplete rules, an unsuitable order, or an unexpected FINAL action can all affect the result. Config is recommended for everyday use when you know which configuration is active and understand how it separates proxy and direct traffic.
Is Proxy always faster than Config?
You can't tell just from the mode. If both ultimately use the same proxy route, their main traffic path may be the same. If Config uses DIRECT for the destination, the paths differ. Speed also depends on the network, server load, and destination service. Compare the actual routes rather than the mode names alone.
Will updating a subscription automatically fix all routing rules?
No. Updating a node subscription and maintaining rules in Config are separate tasks. After an update, check that the nodes are still usable, that policy group references match, and that the intended configuration is active. Get new subscription or node details from your provider.
Does Direct mean I don't need to check the connection switch?
No. Direct is a routing choice; the connection switch is a separate setting. To compare network behavior with the connection enabled and disabled, record the Direct result and the result with the connection off separately. Also check Settings → On Demand so automatic connection doesn't change the test conditions.