Shadowrocket Global Routing: How Config, Proxy, and Direct Work

At a glance

If you already have your own service and subscription and want to understand the difference between rule-based routing and full proxy routing, remember this: Config follows the current configuration, Proxy sends covered connections through the proxy route, and Direct sends them directly. For everyday use, start with a verified Config. When troubleshooting, keep the server and test destination unchanged, change only Global Routing, then check how new connections are handled.

First, distinguish Global Routing from servers and the connection toggle

Global Routing determines how traffic is handled. It is not a server address or a connection toggle. Choosing Proxy does not establish a working connection, and choosing Config does not mean the app has loaded rules suited to your current network. Check the configuration, server, and system connection status separately to avoid conflating different issues.

In Shadowrocket, Home shows server and connection status and provides access to Global Routing. Config is where you manage configuration files. There are two uses of the name Config: the configuration-file management screen and the Global Routing mode that handles traffic according to a configuration. Changing modes does not write rules for you or fix invalid server details.

3 modes

Compared here: Config / Proxy / Direct

2 places

Check the routing mode in Home; manage configuration files in Config

1 change

Change one variable per troubleshooting round, then start a new connection

If Scene also appears in the Global Routing list, treat it as an entry point for organizing routing choices by scenario, not as another protocol. When using scene settings, verify which scene and routing choice are actually active. This article covers the basic behavior of manually choosing Config, Proxy, or Direct, not Scene conditions.

When to use Config, Proxy, or Direct

Config: Follow the current configuration

Recommended

Connections are routed according to the rules and policies in the current configuration. Rules can specify DIRECT, PROXY, or a policy defined in the configuration. If no earlier rule matches, FINAL determines what happens next.

Best for: Everyday use with a verified configuration and destination-based routing

Proxy: Use the proxy route

Ordinary connections handled by Shadowrocket are sent through the proxy route instead of being assigned an exit by the usual routing rules. You still need to verify which server is in use. System traffic, exclusions, and special network behavior cannot simply be summed up as “all data on the device.”

Best for: Temporarily testing the proxy route or checking how rules affect traffic

Direct: Use the direct route

Ordinary connections handled by Shadowrocket go direct and do not use a proxy server as their exit. Check the app's connection status and settings such as DNS separately; Direct does not mean the app's connection is off.

Best for: Creating a direct-connection baseline and checking whether the current local network can reach a destination

Choosing Config assumes you understand the current configuration. Config does not simply mean “some sites use a proxy and everything else goes direct.” If the configuration ends with FINAL,PROXY, connections that do not match earlier rules still go through the proxy. Proxy is not a faster setting, either; speed depends on your local network, the route to the server, the destination service, and connection load.

How Config evaluates rules: order and FINAL

Rules are generally evaluated in order: earlier, more specific rules are considered first, and FINAL handles connections that match no preceding rule. When troubleshooting a domain, find the rule it actually matches instead of checking only the last line of the configuration. A broad rule near the top can prevent more specific rules below it from taking effect.

[Rule]
DOMAIN-SUFFIX,example.com,DIRECT
IP-CIDR,192.168.0.0/16,DIRECT,no-resolve
GEOIP,CN,DIRECT
FINAL,PROXY

The rules below are illustrative and are not a complete file that can replace your current configuration. example.com is used only to demonstrate domain matching. PROXY in the example represents a proxy policy. If your configuration uses a custom policy name, verify its definition and current selection. Do not paste the illustrative text over a configuration in use.

DOMAIN-SUFFIX,example.com,DIRECT: Matches the domain and its subdomains, then uses DIRECT.
IP-CIDR,192.168.0.0/16,DIRECT,no-resolve: Matches the specified IPv4 range. no-resolve means this rule does not trigger an additional domain lookup; it does not disable DNS globally.
GEOIP,CN,DIRECT: Matches according to the geographic database result for the destination IP, not the webpage language, site name, or device region.
FINAL,PROXY: Sends connections that match no preceding rule to PROXY. It does not automatically determine whether the visitor wants a direct or proxied connection.

Domain and IP rules rely on different inputs. If the destination is already an IP address, a domain-suffix rule cannot infer the domain. IP-based matching also depends on the resolved address. If the same site sometimes takes different routes, review the request log, destination address, and matching rule for that specific connection; the rule text alone is not enough to determine what happened.

Switch and verify routing modes on iPhone

These steps assume you have already imported your own server or subscription. Keep the selected server identifiable, and avoid updating a subscription, switching servers, and changing routing at the same time. For the full import process, see the Getting Started guide. For server and subscription management, see Server Management.

Open Home and confirm the current server. Open Config, check which configuration file is enabled, and note its name and the policy used by FINAL.
Go back to Home → Global Routing, select Config, then return to Home and check the connection status. When connecting for the first time, follow the system prompts to authorize the connection.
Visit one destination that should match a domain rule, then another that should fall through to FINAL. Check the request routing in the Data connection log; the exact location of the log may vary by interface version.
Keep the server unchanged, set Home → Global Routing to Proxy, and start a new connection to the same destination. Do not draw conclusions by simply refreshing a page with an existing long-lived connection.
Switch to Direct and test again. Note whether the domain resolves, a connection is established, and all page resources load. When finished, restore the Config you intended to use.

For example, if a new request succeeds with Proxy but fails with Config, and the log shows Config matched DIRECT, first check that rule and the direct route. This illustrates how to interpret results; it is not a real-world test of any particular site. If all three modes fail, check the local network, DNS, and destination service before repeatedly replacing rule files.

Two use cases: everyday routing and temporary diagnostics

Choose a setup: keep everyday use separate from troubleshooting

Use Config day to day

Check which file is enabled in Config and confirm where FINAL sends traffic.
Test one destination that should go direct and one that should use a proxy.
After updating a subscription, recheck the selected server and policy references.

Use Proxy / Direct temporarily

Keep the server, test destination, and local network unchanged.
Change only Global Routing each time, then start a new connection.
Record the result, then restore the original mode so a diagnostic setting is not left in place.

In short: Config handles verifiable everyday routing; Proxy and Direct provide two clear comparison paths for troubleshooting.

If your device is configured to connect automatically, also check Settings → On Demand. On Demand controls when a connection is established under specified conditions; it does not replace rules such as DOMAIN-SUFFIX or FINAL. If the connection status changes on its own during troubleshooting, check this setting before deciding whether Global Routing is behaving as expected.

Keep subscriptions and configurations distinct, too. Updating a subscription mainly retrieves server details from a service you already use; it does not mean the current rules have been corrected. Protocol names are not routing modes. Whether a server uses Shadowsocks, VMess, VLESS, Trojan, Hysteria2, or WireGuard does not change the basic roles of Config, Proxy, and Direct described here.

FAQ: Why do results change after switching modes?

Why does everything still seem to use the proxy when I choose Config?

First, check FINAL in the active file under Config, then look for broad proxy rules that appear earlier. If you use a policy group, check its selection as well. Start new requests to two different destinations and verify the actual entries in Data. Do not infer how every connection is routed from the result for a single webpage.

Proxy works but Config does not. Is there a subscription problem?

Keep the same server and check which rule and policy the destination matches under Config. If Config sends it DIRECT, check whether the direct route is reachable. If it selects a different server, check the corresponding policy. Only if the proxy server itself fails to connect should you continue by checking its settings or the latest results of an existing subscription update.

Direct works but Proxy does not. What should I change?

This shows that the destination is reachable over the current direct route; it does not confirm that the proxy route works. Go back to Home and check the selected server and connection status. Then verify that the server address, port, and authentication details match the information you already have. Do not change FINAL to hide a server connection problem.

Why can none of the three modes open a webpage even though a latency value appears?

A latency result covers only its specific test; it does not confirm that DNS resolution, the webpage connection, and all resources loaded successfully. First check the local network, then verify that DNS returns a valid result. Distinguish a resolution failure from a connection timeout. Switching to Proxy will not automatically fix an incorrect DNS address or an issue with the destination service.

Why does the system still show a connection when I choose Direct?

Direct is a traffic-handling mode, not a disconnect button. To stop the connection, return to Home and use the connection toggle. If it reconnects, check the conditions under Settings → On Demand. A system connection indicator does not prove that a proxy route is active.

Post-troubleshooting checklist

The goal is to leave behind a set of settings you can explain, not a temporary state that “works, so it must be fine.” For everyday use, knowing which configuration is active and where its proxy policies and FINAL send traffic matters more than staying in a mode without understanding the route. After switching between Wi-Fi and cellular, repeat a quick check using the same method.

Home → Global Routing is back on the intended mode, and the selected server is clear.
The correct file is enabled in Config, and the domain rule order and FINAL have been checked.
New connection logs have been checked for at least one direct destination and one proxied destination.
The automatic connection conditions in Settings → On Demand match your needs.
Temporary diagnostic changes have been reverted, and any relevant error messages have been kept for follow-up.

Shadowrocket is a paid client for Apple platforms, used primarily on iPhone and iPad, and is available exclusively through the App Store. Check the App Store listing for system requirements, compatibility, and purchase availability. The one-time app purchase does not include a service plan; you will need your own service details to use server and subscription features.