Shadowrocket’s Global Routing setting controls how connections it handles are routed: Config applies the rules in the active configuration, Proxy sends traffic through the proxy route, and Direct uses a direct route. This guide explains where to switch modes, how to read routing rules, and how to compare results using the same destination, assuming you already have a service provider and subscription. Use a reviewed Config for everyday routing, Proxy for a temporary comparison, and Direct to test direct access. After switching, check new connections rather than relying only on the connection toggle.
How the three modes differ: rules, proxy, and direct routing
Global Routing is a routing mode, not a connection-quality setting. It does not change the address, port, or authentication details of existing servers, and switching to Proxy does not increase bandwidth. Choose a mode based on how you want a connection handled.
Config: apply the active configuration
RecommendedRules are evaluated in order to route connections through DIRECT, PROXY, or a policy specified in the configuration. If no earlier rule matches, FINAL determines the route. Config does not mean “direct for everything else.”
Best for: everyday rule-based routing with reviewed rules and a checked FINAL policy.
Proxy: use the proxy route for all traffic
For ordinary connections handled by the app, this mode bypasses Config’s destination-based routing rules and uses the proxy route instead. You still need a working server with the correct settings.
Best for: temporarily routing everything through the proxy and comparing routes with Config.
Direct: use the direct route for all traffic
Ordinary connections handled by the app use a direct route. The connection can remain enabled, so Direct does not turn off Shadowrocket or restore every network setting to its system default.
Best for: checking whether destinations are reachable directly on the current network, or temporarily routing everything directly.
“All” here means connections actually handled by Shadowrocket; it does not mean every connection on the device must use the same route. Check DNS, local network access, existing connections, and other network behavior in the configuration separately.
Where to switch: Home → Global Routing
Open Shadowrocket on your iPhone or iPad, go to Home, tap Global Routing, then choose Config, Proxy, or Direct. Do not confuse the Config tab at the bottom with Config mode here: the tab manages configuration files, while the mode determines whether connections follow the active configuration’s rules.
- Note the current state. Record the current Global Routing mode, active configuration, and selected existing server so you can restore them after troubleshooting.
- Check the prerequisites. If you need a proxy, make sure your existing subscription has been imported and the server settings are complete. Do not update the subscription or switch servers while changing modes.
- Choose a mode. In Home → Global Routing, tap the mode you want. Return to Home to confirm the selection, then check that the connection toggle is in the desired state.
- Start a new connection. Reopen the test page and, if needed, quit and relaunch the relevant app. Existing connections may continue using their previous route.
- Restore your usual settings. Once testing is complete, switch back to your reviewed mode and revisit the same destination to confirm the result.
If Scene is also shown, treat it as an entry point for applying settings based on preset scene conditions—not as a fixed “proxy everything” or “direct everything” route. Check the scene conditions and linked settings first. For a reproducible comparison of the three modes, explicitly select Config, Proxy, or Direct.
How Config routes traffic: match rules in order, then check FINAL
Config’s behavior depends on the active configuration, not on the mode name itself. In the Config tab, confirm which file is active, then review its rules. Standard rules are evaluated from top to bottom. When a rule matches, its specified policy handles the connection; the app does not combine the results of all rules.
The examples below illustrate rule syntax only; they are not recommendations to replace your current configuration. The domain and IP range are documentation examples, not usable service details.
[Rule]
DOMAIN-SUFFIX,example.com,PROXY
IP-CIDR,192.0.2.0/24,DIRECT
GEOIP,CN,DIRECT
FINAL,PROXYDOMAIN-SUFFIX,example.com,PROXY: Matchesexample.comand its subdomains, and sends them through the proxy route. It does not search the full URL for keywords.IP-CIDR,192.0.2.0/24,DIRECT: Matches destinations within the specified IP range. Whether a domain connection matches an IP-based rule also depends on the resolved address and related options.GEOIP,CN,DIRECT: Matches based on the destination IP’s location in the GeoIP database. That location does not necessarily indicate where the website’s operator is based.FINAL,PROXY: Handles connections that did not match an earlier rule. Changing it toFINAL,DIRECTalso changes the default route for unmatched connections.
So if a site still uses the proxy after you switch to Config, that is not necessarily a problem: a domain rule, IP rule, policy group, or FINAL may be routing it there. Check the matching record for the new connection before changing any rules. A broad rule placed too high can also prevent more specific rules below it from taking effect.
Choosing a mode for everyday use and troubleshooting: keep the destination constant
For everyday browsing that includes destinations requiring both direct and proxy access, a reviewed Config makes the routing rules clearer. For troubleshooting, control the variables: keep the network, destination, and server the same, and change only Global Routing so you can compare the results.
Two ways to use the modes: everyday routing and temporary comparison
Everyday use with Config
- Confirm that the expected file is selected in the Config tab.
- Check the destination’s rule and the policy set by FINAL.
- Test one destination expected to use a direct route and another expected to use the proxy.
- After changing rules, establish a new connection and check which rule matched.
Use Proxy or Direct temporarily
- First, note the specific failure under Config.
- Keep the server unchanged, switch to Proxy, and try the same destination.
- Then use Direct to check whether the current network can reach it directly.
- Record the results and restore the original mode. Do not treat one successful test as a lasting conclusion.
If Config fails but Proxy works, first check the rule’s route and policy selection. Treat this as a troubleshooting clue, and confirm the cause using DNS and connection records.
For example, if the same page times out under Config, loads under Proxy, and also times out under Direct, check whether Config routes it to DIRECT or to another unavailable policy. Conversely, if Direct works but Proxy times out, check the proxy server and route first. These examples show how to interpret comparisons; they are not guaranteed test results.
Still can’t connect after switching? Check routing, DNS, and connections separately
Global Routing controls the routing mode; it cannot replace server authentication, domain resolution, or protocol transport requirements. A typical connection involves resolving a domain, connecting to its destination address, and establishing an encrypted session. A failure at any step can leave a page loading indefinitely.
| What you observe | Check first | Next step |
|---|---|---|
| Config fails; Proxy works | Rule match, FINAL, and policy group selection | In Data, find the new connection to the same destination and check the policy actually used. The details shown depend on the current interface. |
| Proxy fails; Direct works | Existing server address, port, authentication, and transport settings | Check the settings in your existing subscription. Make sure you have not changed the port or credentials by mistake, then test the server on its own. |
| All three modes fail | Current network, DNS, and destination availability | First check whether other destinations are reachable, then investigate resolution errors. Avoid changing multiple settings at once. |
| No change after switching | Connection reuse, cache, and background connections | Close the original page and visit it again. If needed, relaunch the app, then check the new connection record. |
For a typical HTTPS connection, the destination port is usually 443. Traditional DNS queries usually use 53, while DNS over HTTPS usually uses 443. These ports belong to different parts of the connection; they are not instructions to change the port of an existing proxy server. The server port must match your existing configuration.
Shadowsocks, VMess, VLESS, Trojan, Hysteria2, and WireGuard are protocols or tunnel types, not alternatives to Global Routing. Switching to Proxy does not convert one protocol into another or fix incorrect credentials. Check DNS separately against the active configuration: Direct does not guarantee that resolution will revert to the system default.
Frequently asked questions: connection toggle, subscriptions, and automatic connection
Why doesn’t Proxy work after I select it?
Go to Home and check the selected existing server and connection toggle, then verify the address, port, and authentication settings. Proxy routes handled connections through the proxy path; it cannot establish a working connection if that path is unavailable. Test the same destination and avoid changing the network and server at the same time.
Why does the system still show a VPN status after I switch to Direct?
Direct is a routing mode while the connection is enabled, not a button to stop the network extension. To stop Shadowrocket from handling connections, turn off the connection on Home and check whether Settings → On Demand has any automatic trigger conditions configured. Confirm the actual connection status.
Does updating an existing subscription also update Config rules?
Do not assume that it does. Updating a server subscription and updating a routing configuration file are separate operations; the changes depend on what was imported. After an update, check the server on Home and the active file in Config separately. A change in the number of servers does not prove that rules or FINAL changed.
Do I still need to choose Global Routing with On Demand enabled?
Check them separately. Settings → On Demand controls when a connection is triggered under specified conditions; Global Routing determines how connections are handled once established. Automatic connection does not mean the correct rule configuration is selected. If you also use Scene, check whether the scene applies other settings.
Should I add a rule for every site that works in Proxy?
First check which rule matches the new connection under Config, then decide whether to make a change. If the wrong server is selected in an existing policy group, correct that selection first. If you do need a domain rule, choose an appropriate DOMAIN-SUFFIX scope, place it above any broader rule that would match first, and test again.
Before resuming everyday use, check these four things
After troubleshooting, restore a clear, explainable configuration rather than simply keeping whichever mode last loaded a page. In particular, after temporarily using Proxy, check whether every handled connection still needs the proxy route. After testing with Direct, also check destinations that normally need a proxy.
- Mode: Home → Global Routing shows the expected selection, with no temporary test mode left in place.
- Configuration: The active file in Config, rule order, and FINAL policy match your needs.
- Server: The proxy route uses a server you already have with complete settings; do not treat latency alone as proof that it works.
- Verification: Establish new connections, check destinations expected to use direct and proxy routes, and review the trigger conditions in Settings → On Demand.
Shadowrocket is a paid client for Apple platforms, primarily iPhone and iPad, and is available exclusively through the App Store. It is a closed-source commercial app; purchasing the client does not include a service plan. This site does not provide, sell, or recommend servers or subscriptions. Refer to the App Store listing for system requirements, device compatibility, and general purchase information.