Shadowrocket Global Routing Explained: When to Use Config, Proxy, or Direct

At a glance

Shadowrocket’s connection toggle controls whether it handles traffic; Global Routing determines how handled requests are routed. This guide is for users with their own server or subscription who need to understand Config, Proxy, and Direct. Compare what each mode affects, test them against the same target, then restore Config for everyday use. Choosing Proxy does not provide a working server, and choosing Direct does not turn off the connection.

1. Global Routing vs. the connection toggle

Open Global Routing in Home to choose how requests are routed. Config applies your configuration, Proxy sends traffic through the proxy, and Direct sends traffic straight out. “All traffic” means traffic within Shadowrocket’s handling scope; it does not guarantee that every kind of system communication on the device is covered. System routes, exclusions, and network conditions can affect whether traffic reaches the app.

The connection toggle and routing mode are separate settings. Selecting Proxy in Global Routing does not send requests through a proxy unless the connection is on. Conversely, with the connection on and Direct selected, the app can remain active while routing handled requests directly. So the VPN icon in the status bar alone does not prove that a particular website is being accessed through a proxy.

3 modes

Compared here: Config / Proxy / Direct

2 settings

The connection toggle controls traffic handling; Global Routing controls the route

4 rule types

Covered below: DOMAIN-SUFFIX / GEOIP / IP-CIDR / FINAL

If Global Routing also shows Scene, treat it as a mode that applies settings by scene—not as a protocol or another name for Config. When testing the three basic modes, select Config, Proxy, or Direct explicitly to avoid introducing scene changes as another variable. You do not need to create a Scene for this guide.

2. Config, Proxy, and Direct: what they do and when to use them

Config

Recommended

Applies the rules in the currently enabled configuration. A request may use DIRECT, a proxy policy, or another defined policy. Requests that do not match earlier rules are usually handled by the final FINAL rule, so they are not necessarily sent directly.

Use for: everyday rule-based routing with a verified configuration, or when different destinations need different routes

Proxy

Routes all requests within Shadowrocket’s handling scope through the proxy, rather than applying Config’s per-destination rules. You still need valid server details, a working proxy route, and a connection that meets the destination’s requirements.

Use for: temporarily routing everything through the proxy, or checking whether Config rules affect access

Direct

Routes all requests within Shadowrocket’s handling scope directly, without forwarding them through the selected proxy server. Whether a destination is reachable depends on your local network. Direct does not turn off the app or remove its VPN configuration.

Use for: comparing against your local network and checking whether an issue occurs only on the proxy route

Config is a good everyday starting point when the configuration meets your needs. Proxy is not a “stronger Config,” and Direct is not a “faster Config.” Each mode changes how routes are selected; none fixes network problems automatically. If a destination is reachable only over a particular route, different results after switching modes are useful for troubleshooting—but they do not prove one mode is always better.

Global Routing modes are not protocols. Shadowsocks, VMess, VLESS, Trojan, Hysteria2, and WireGuard describe connection and transport capabilities; Config, Proxy, and Direct determine how requests are routed. Switching to Proxy does not convert a server entry to another protocol or change its address, port, or authentication details.

3. How Config evaluates rules: check the order, then FINAL

In Config, first confirm which configuration is enabled, then review its rules. Rules are checked in order, and an earlier match can determine whether a request is evaluated against later entries. Domain and IP rules use different matching information, and DNS resolution can affect how IP-based rules are evaluated. A rule appearing in the list does not mean a request necessarily matches it.

[Rule]
DOMAIN-SUFFIX,example.com,DIRECT
IP-CIDR,192.168.0.0/16,DIRECT,no-resolve
GEOIP,CN,DIRECT
FINAL,DIRECT

This rule snippet illustrates syntax; it is not a complete configuration or an everyday routing setup. All routes are set to DIRECT here to avoid referring to an undefined proxy policy. If you want certain destinations to use a proxy, choose a policy that actually exists in your current configuration and confirm its members are available. Do not paste in an unknown policy name.

DOMAIN-SUFFIX: example.com matches the domain and its subdomains, such as www.example.com. It does not match every domain that happens to contain this string.
IP-CIDR: 192.168.0.0/16 represents an IPv4 address range. In this example, no-resolve means not to trigger an extra domain lookup for this IP rule; it does not disable global DNS.
GEOIP: GEOIP,CN,DIRECT matches based on the IP address’s geographic assignment. It does not match based on a website’s language, domain suffix, or the user’s location.
FINAL: handles requests that did not match earlier rules. This example ends with FINAL,DIRECT, so unmatched requests go direct. If a real configuration points FINAL to a proxy policy, unmatched requests will not default to a direct route.

4. Switch modes in Home and run a repeatable test

Before testing, keep your existing configuration, choose a familiar destination you can normally access, and note whether you are on Wi-Fi or cellular. Change only Global Routing and keep other conditions as consistent as possible. Do not update a subscription, change servers, and edit DNS at the same time; if access returns, you will not know which change made the difference.

Check the server: In Home, confirm the selected server. Verify that its address, port, and authentication details come from a valid configuration you already have. Do not guess the protocol from the port number.
Check the connection: Turn on the connection toggle. The first time you use Shadowrocket on iPhone or iPad, follow the system prompt to allow it to add a VPN configuration. Then run Connectivity Test in Home and note the actual result, such as success or timeout.
Test Proxy: Go to Home → Global Routing and select Proxy. Start a new connection to the same destination and note whether it loads. Do not rely on an existing connection that is already playing or open.
Test Config: Return to Global Routing and select Config, then revisit the same destination. If Proxy works but Config does not, check the active configuration, rule order, FINAL, and policy selection first.
Test Direct: Select Direct and start another new connection. Note how it behaves on your local network. When finished, restore Config and review any settings you changed.

Existing long-lived connections may keep their previous state. After switching modes, close and reopen the destination; if needed, end the app’s existing connection and try again. Connectivity Test reports connectivity for its specific test target and method; it does not verify every website, protocol, or UDP request.

Two comparisons to isolate local network and rule-related factors

Compare Direct and Proxy

Keep the network and destination the same.
Direct works, Proxy fails: check proxy server connectivity, authentication, and outbound access.
Both fail: check the destination and local network first; do not rush to change rules.

Compare Proxy and Config

Keep the server and test destination the same.
Proxy works, Config fails: check the matching rule and the policy it points to.
Confirm that Config uses the same policy route as the one tested with Proxy.

These comparisons help narrow down the issue but do not prove its cause. Change one setting at a time, then repeat the same test.

5. Common questions: why does switching modes not fix the issue?

Why can’t I access a site even with Proxy selected?

First, return to Home and confirm the connection is on and the correct server is selected, then run Connectivity Test. Proxy selects a route; it does not fix an incorrect password, expired credentials, or an unreachable server address. If the test succeeds but one website still fails, check the destination, DNS, and the transport used by that connection.

If I can still browse with Direct, does that mean the connection isn’t working?

Direct uses your local network, so being able to browse is normal. Go to Home → Global Routing to confirm the current mode, then select Proxy and start a new connection to the same destination for comparison. A webpage loading does not prove that proxy routing is active.

Proxy works but Config doesn’t. Should I delete all the rules?

Do not start by deleting rules. In Config, confirm the enabled file, check the relevant DOMAIN-SUFFIX, IP-CIDR, and GEOIP rules, as well as the final FINAL rule, then verify the matching policy’s members. Keep the original configuration and change only entries you have confirmed are causing the issue, so you can restore and retest.

Why does the connection come back on by itself after I switch to Direct?

Direct does not turn off the connection. Check Settings → On Demand for any enabled connection conditions. To observe manual connection behavior, you can temporarily disable the relevant conditions and test again. Note the original settings and restore them afterward; On Demand controls when the connection starts, while Global Routing controls how traffic is routed.

Will updating a subscription automatically give Config the right rules?

Updating a server subscription and changing rule configuration are separate operations. After updating an existing subscription, return to Home to check the server list and current selection, then confirm the enabled file in Config. A longer server list does not mean DOMAIN-SUFFIX or FINAL rules have changed.

6. Restore everyday settings and get Shadowrocket

Using Config by default means letting verified rules choose routes—not blindly keeping any imported file. After temporarily switching to Proxy or Direct for troubleshooting, restore Config and confirm that the selected server, policy members, and On Demand settings are still as expected. For destinations such as work networks and local services, check which rules they actually match; one successful webpage test does not prove that everything else works.

Home: Check the selected server, connection toggle, and current Global Routing mode, then run Connectivity Test again.
Config: Check the enabled file, key domain rules, and FINAL. Keep a copy of the original so you can restore it.
Settings → On Demand: Review the connection conditions so automatic settings do not interfere with your test.
Test notes: Record the network type, mode, destination, and result. Hide subscription URLs, authentication details, and other sensitive information before sharing.

Shadowrocket is a closed-source commercial app; getting the client and having a network service are separate things. This site does not provide, sell, or recommend servers or subscriptions. The iPhone and iPad app costs $2.99 as a one-time App Store purchase. The Mac (Apple silicon and Intel), Windows, Android, and Linux versions are free. Check the App Store listing for iPhone and iPad system requirements. To verify the app, check the developer name, Shadow Launch Technology Limited, and app ID 932747118.

To install Shadowrocket or switch devices, visit this site’s download guide and choose your platform. On a Mac, check About This Mac to identify whether it has Apple silicon or an Intel processor; on other platforms, choose the installer for your device’s operating system. After installation, follow the connection toggle, Global Routing, and fixed-destination test steps in this guide. Installing the client does not mean you already have a working proxy route.