Shadowrocket Global Routing: Config vs Proxy vs Direct

At a glance

With working connection details and rules in place, Config is the everyday choice in Shadowrocket. If you suspect a rule is sending traffic the wrong way, compare it with Proxy; use Direct to check whether the current network can reach a destination without a proxy. This guide assumes you already have your own provider and subscription. It covers where to choose a routing mode, rule order, and one-variable troubleshooting, and explains how routing modes differ from the connection toggle and On Demand.

1. What Config, Proxy, and Direct change

Global Routing determines how Shadowrocket handles traffic routed through the app. It does not provide a connection or select a protocol. For everyday use, choose Config when the active configuration has rules that match your needs and the referenced policies or policy groups are available. Without those conditions, switching to Config alone will not produce the routing behavior you want.

Config

Recommended

Matches traffic against the active configuration's rules. The result can be PROXY, DIRECT, REJECT, or a policy group defined in the configuration. Traffic that does not match a specific rule is handled by a fallback such as FINAL; it is not necessarily sent DIRECT.

Best for: everyday use when you have working rules for handling different destinations.

Proxy

Sends regular traffic within the app's routing scope through the proxy path instead of deciding each route with Config rules. Access still depends on whether the selected connection works.

Best for: checking the proxy path temporarily or comparing it with Config to diagnose a routing issue.

Direct

Routes regular traffic within the app's scope directly, without forwarding it through a proxy server. Whether a destination opens depends on its reachability from your current network.

Best for: checking whether direct access works or testing local network access temporarily.

Here, “all” describes the routing mode; it does not mean every network packet on the device must take the same path. System traffic, bypass settings in the configuration, and DNS handling may behave differently. To determine how a specific request was routed, check the connection log rather than inferring it from the VPN status indicator alone.

2. Choose a mode from Home and establish a test baseline

On iPhone and iPad, choose Config, Proxy, or Direct from Home → Global Routing. If Scene is also listed, it is a separate mode for scenario-based use, not another name for Config. For the comparisons in this guide, stick to the three modes above so Scene conditions do not affect the results. The interface may vary by app version.

Open Home and confirm that the SERVER list contains your own connection details. For proxy tests, make sure the connection you intend to use is selected.
Open Config and check which configuration is in use. A file being present does not mean it is the active configuration; confirm that it is selected.
Return to Home → Global Routing, select Config, then go back to Home and check the displayed status.
Turn on the connection. The first time, follow the system prompt to allow the VPN configuration to be added. Then confirm that the connection is active—not just that permission was granted.
Choose a complete test URL and record the network, selected connection, and routing mode. Keep these conditions the same for each comparison and change only one setting at a time.

3 modes

Compared here: Config / Proxy / Direct

2 layers

Selection path: Home → Global Routing

1 setting

Change one variable per test

Connectivity Test on Home can help check basic connection reachability, but a successful test does not guarantee that a destination's DNS, TLS, or application requests are working. Open the actual destination to verify it, and do not treat the test latency as a measure of webpage load speed.

3. Why Config requires checking rule order and FINAL

Config does not “automatically identify website categories”; it follows the active configuration. Regular rules are evaluated from top to bottom, and the first match determines the policy. Put precise exceptions before broader rules, and place FINAL last. The example below is for learning purposes only. Its domains are illustrative and do not represent a working connection service; do not use it as a replacement for a complete configuration.

[Rule]
DOMAIN,account.example.com,DIRECT
DOMAIN-SUFFIX,example.com,PROXY
FINAL,DIRECT

account.example.com matches DOMAIN first and uses DIRECT. It will not continue on to the domain-suffix rule below.
www.example.com matches DOMAIN-SUFFIX and uses PROXY. The domain example.com itself is also covered by this suffix rule.
Other destinations outside the first two rules match FINAL,DIRECT and are routed directly.
If you change the fallback to FINAL,PROXY, destinations that match no earlier rule will use the proxy path. So it is not accurate to say that Config always sends “everything else direct.”

DOMAIN and DOMAIN-SUFFIX match domain names, IP-CIDR matches specified IP ranges, and GEOIP matches against IP geolocation data. When combining domain and IP rules, consider whether the request includes a domain name, when resolution happens, and which rule options are enabled. If traffic is routed incorrectly, first identify the matching rule instead of adding duplicate entries blindly.

4. Compare Proxy and Direct

When troubleshooting, first clarify whether one destination or all destinations are failing. Proxy and Direct help remove rule-based routing as a variable; they are not long-term substitutes for a correct configuration. Use the same network and destination for both tests. For the Proxy comparison, keep the selected connection unchanged as well.

Comparison setup: keep the network and destination fixed; change only the routing mode

Compare Config and Proxy

Reproduce the issue in Config and note the destination domain.
Switch to Proxy and send the same request again.
If Proxy works but Config fails, check the matching rule, policy group selection, and FINAL.
If both fail, check the connection details, DNS, destination status, and current network.

Compare Config and Direct

Choose a destination you expect to reach directly and record the result in Config first.
Switch to Direct and send the same request again.
If Direct works but Config fails, check whether the destination is incorrectly routed to PROXY or REJECT.
If Direct also fails, first confirm whether the current network can reach the destination directly.

These comparisons can narrow down the cause, but cannot prove it on their own. When you are done, switch back to Config and confirm that the destination is handled by the expected rule.

For example, if Config fails but Proxy works, a domain rule may be missing, or the policy group used by Config may have selected a different connection. To tell these issues apart, match the rule result to the route actually used. Do not change the network, connection, and DNS settings in the same test; otherwise, you will not know which change made a difference.

5. Keep the connection toggle, On Demand, and subscription updates separate

Global Routing determines how traffic is handled once connected; the Home toggle controls whether the connection is active. Direct is a routing mode, not a way to turn off the VPN. Likewise, selecting Proxy does not mean the connection is on. Check these two states separately.

On Demand: Check the conditional connection settings in Settings → On Demand. They control when the connection is triggered; they do not replace domain and IP rules in Config. For controlled tests, watch for connection state changes triggered by switching networks.
Subscribe: Updating a subscription you already have refreshes the associated connection details. Rule configurations have their own sources and active status. A successful connection details update does not mean the active rules file has also changed.
Protocols: Shadowsocks, VMess, VLESS, Trojan, Hysteria2, and WireGuard describe connection methods; Config, Proxy, and Direct describe routing modes. Changing the routing mode will not fix an incorrect address, port, or authentication detail in a protocol configuration.
Network: After switching from Wi-Fi to cellular, check the connection status and destination reachability again. Results from the previous network do not necessarily apply to the new one.

If something goes wrong after a subscription update, first check that the selected connection is still available and its details have refreshed. Then check the policy groups referenced by your rules. Do not leave Global Routing on Proxy to hide a broken configuration reference; that could send requests that should go direct through the proxy instead.

6. FAQ: What if the destination still won't open?

I selected Config. Why does it look like every site is going through the proxy?

In Config, check which file is active. Start by checking whether the final rule is FINAL,PROXY, then look for broad rules above it and check the current options in the relevant policy groups. Config means the app follows the configuration; it does not guarantee a particular share of traffic will use the proxy.

Proxy works, but Config doesn't. Does that mean the connection is fine?

It shows that this request succeeded over the path used by Proxy, but it does not rule out problems with other connections. Return to Config and check the policy matched by the destination. If the policy group uses a different connection, use the same route for both tests before comparing; otherwise, a policy group difference may look like a rule syntax error.

The VPN indicator is still visible after switching to Direct. How do I turn it off?

Direct changes how traffic is handled. To stop the connection, return to Home and turn off the connection toggle. Also check whether Settings → On Demand might turn it back on under certain conditions. The VPN indicator can help confirm connection status, but it does not show that a specific request went through a proxy server.

The webpage looks the same after switching modes. Should I keep reconnecting?

First, send the request again. If needed, quit and reopen the test app to avoid reusing an existing connection or cached page. If nothing changes, confirm that your choice is still selected in Home → Global Routing and check the actual request log. Recording the result of each test makes issues easier to isolate than toggling several settings repeatedly.

7. Check settings before everyday use

When troubleshooting is complete, switch back to the Config mode you plan to use. Check the rules and policy groups, then test one destination expected to go direct and one expected to use a proxy. Opening a webpage is only the first check; also confirm that the route matches the intent of your rules. If the issue persists, continue with the troubleshooting guide to distinguish connection, DNS, and rule issues.

Home → Global Routing: Confirm Config is selected, not a leftover Proxy or Direct setting.
Config: Check the active configuration and the FINAL fallback, and decide whether to keep any temporary rules you added.
Home: Confirm the selected connection and policy groups are as expected, then check the connection status.
Settings → On Demand: Make sure the automatic connection conditions fit your everyday network, then test an actual request again.

Shadowrocket is a closed-source commercial app for Apple platforms, primarily used on iPhone and iPad. The App Store is the only place to get it. The developer is Shadow Launch Technology Limited, and the app ID is 932747118. Check the App Store listing for system requirements, compatibility, and universal purchase details. The app is a one-time purchase; it does not include a connection plan. Manage connection details and rule configurations according to their separate purposes.