At a glance

For everyday use, Shadowrocket is usually set to Config, provided you’ve selected and checked the right configuration. Use Proxy to temporarily test the proxy route and Direct to compare against your local network. This guide explains how the three modes route requests for users who already have a server or subscription, and how to troubleshoot without changing several settings at once. “All” means traffic handled by Shadowrocket, not necessarily every connection on your device.

1. Choose a mode: what Config, Proxy, and Direct handle

Choose a mode in Home → Global Routing. This setting determines the routing logic for requests; it does not select a server or start a connection. A mode only affects traffic handled by Shadowrocket. If the connection is off, changing this setting alone won’t establish a proxy connection.

Config: Follow the rules in your configuration

Recommended

Uses the routing rules in the active configuration. Requests may use PROXY, DIRECT, REJECT, or a policy group defined in the configuration. How requests that match no earlier rule are handled depends on fallback settings such as FINAL; they don’t necessarily go direct.

Best for: Everyday rule-based routing with a trusted, verified configuration.

Proxy: Route everything through the proxy

Routes all traffic handled by Shadowrocket through the proxy, rather than relying on standard routing rules to decide where each request goes. A working server is still required. Switching modes won’t fix issues with the protocol, DNS, or the destination service.

Best for: Temporary proxy access or comparing with Config to troubleshoot rules and policies.

Direct: Route everything over the local connection

Sends traffic handled by Shadowrocket directly, without using the selected proxy server. The VPN may still show as connected, so the status bar indicator alone doesn’t prove that a request went through the proxy.

Best for: Checking whether the destination is reachable directly over your local network and establishing a baseline.

You may also see Scene under Global Routing. It applies behavior based on configured scene conditions; it isn’t a fixed fourth network route. If you haven’t checked those conditions, use the three clearly defined modes in this guide for testing, then review the scene configuration separately.

2. Know the difference: routing mode, configuration, and connection

An imported subscription only means server information is available; it doesn’t confirm that your routing rules are correct. A server subscription mainly provides connection parameters, while a configuration file can contain rules and other settings. They may be updated separately, and similar names don’t mean they contain the same active settings.

3 modes
Modes compared in this guide: Config / Proxy / Direct
2 layers
Mode selector: Home → Global Routing
4 rule types
Examples below: DOMAIN-SUFFIX / GEOIP / IP-CIDR / FINAL
  1. Start at Home: Check that the selected server is the one you intend to use and that its connection details are complete. Changing Global Routing won’t correct the server address, port, or authentication details.
  2. Then check Config: Confirm which configuration file is selected. Saving or importing a file doesn’t necessarily enable it; return to the list and verify its selection status.
  3. Finally, check the connection: Make sure the connection is established before testing a new request. Existing long-lived connections aren’t a reliable way to assess a mode you’ve just switched to.

If an existing subscription has been updated, check that the previously selected server is still in the list, then verify the actual connection target. Updating a subscription and changing Global Routing are separate actions. The same mode can produce different results if the selected server has changed.

3. How Config routes traffic: rule order and the FINAL fallback

Config isn’t simply “some traffic goes through the proxy and the rest goes direct”—the actual rules determine the outcome. Standard routing rules are evaluated in order, so an earlier match can prevent later rules from taking effect. The snippets below illustrate the syntax; the example domain is for reference, not a test address, and these lines shouldn’t replace an entire configuration.

[Rule]
DOMAIN-SUFFIX,example.com,PROXY
IP-CIDR,192.168.0.0/16,DIRECT,no-resolve
GEOIP,CN,DIRECT
FINAL,PROXY

Config doesn’t inherently reduce proxy traffic or guarantee that a particular site will go direct. PROXY rules may also depend on the selected server or policy group, so check where the policy points. For more syntax, see the Rules Reference. Don’t delete all your rules to fix a single destination.

4. Choose by use case: everyday routing and temporary troubleshooting

For everyday use, keep your configuration easy to understand; when troubleshooting, change as few variables as possible. Don’t update a subscription, switch servers, change networks, and edit rules all at once. Even if access starts working, you won’t know which change helped. Use the same destination, device, and network as the basis for the comparisons below.

Recommended approach: Keep Config for everyday use; switch modes briefly to troubleshoot

Everyday use
  • Check the active configuration under Config, then set Home → Global Routing to Config.
  • Test one destination expected to go direct and another expected to use the proxy.
  • If a destination isn’t working, note its domain and the time before making changes. Don’t immediately replace the entire configuration.
Temporary troubleshooting
  • Keep the server and network unchanged. Switch from Config to Proxy, then make a new request.
  • To compare against your local network, switch to Direct and retry the same destination.
  • Record the mode and result for each test. When you’re done, restore Config and verify the active policy.

Change one variable at a time. A site loading in one mode is a troubleshooting clue, not enough on its own to identify the root cause.

Consider automatic reconnection separately. Settings → On Demand manages conditions for on-demand connections; it doesn’t determine whether a domain uses PROXY or DIRECT. If a connection is re-established automatically, check On Demand before assessing the connection switch. Don’t confuse automatic connection with automatic routing.

5. Troubleshoot connection failures in a reproducible order

First check that your local network works, then check the server, and finally review the rules. Connectivity Test checks the connection, but interpret its result in light of the test method selected in the app. A successful test doesn’t verify every website, rule, or protocol.

  1. Record a baseline: Note the current network, destination domain, selected server, Global Routing mode, and whether a connection is established. Don’t record or share sensitive information such as passwords or full subscription URLs.
  2. Check the local network: Use Direct to access a destination that normally works without a proxy. If that fails too, check your Wi-Fi connection, cellular network, and the destination before changing routing rules.
  3. Check the proxy route: Keep the same server, use Proxy to make a new request, and run Connectivity Test from Home. If it fails, verify the connection details you already have, including the address, actual port, and authentication fields.
  4. Compare with Config: If Proxy works but Config doesn’t, check rule order, the matched policy group, FINAL, and DNS-related settings. These are troubleshooting leads, not proof that the server or DNS is working perfectly.
  5. Retest and restore: After changing one setting, retry the same destination. If needed, disconnect and reconnect to rule out an existing connection. Record the result, then restore your everyday mode instead of leaving temporary diagnostic settings in place.

For example, if the same destination works in Proxy but times out in both Direct and Config, check whether Config routes it to DIRECT or selects a different policy. This is a reproducible way to investigate, not a claim about a measured result. Use the actual request records and results on your device.

Using Shadowsocks, VMess, VLESS, Trojan, Hysteria2, or WireGuard doesn’t change the basic roles of these three modes. Protocol settings affect whether the corresponding connection can be established; Global Routing determines which route is used. Use the actual port specified in your existing service configuration, not a generic port for every protocol.

6. Global Routing FAQ

Does switching to Proxy guarantee that every website will load?

No. First check the selected server in Home, then turn on the connection and run Connectivity Test. Proxy routes traffic through the proxy, but an unreachable server, incorrect authentication, a destination that refuses access, or a DNS issue still needs to be addressed separately.

Why is the VPN icon still in the status bar when I’ve selected Direct?

Direct describes where requests go; it doesn’t end the VPN session. Check the connection switch in Home. To stop the session, turn off the connection and check whether Settings → On Demand has automatic connection conditions enabled.

What should I change if a local device won’t load in Config?

First note the device’s actual address, then check whether the active configuration includes an IP-CIDR rule covering that subnet and whether an earlier rule matches first. The 192.168.0.0/16 example above covers only one address range, not every local network. Check your actual subnet rather than copying the example as-is.

I changed a rule, but the same webpage still looks the same. Why?

First confirm that you edited the currently selected configuration, then reconnect and make a new request. Browser cache and existing long-lived connections can make things appear unchanged. Retest the same destination and verify which policy the request actually uses; don’t rely only on what the page displays.

Do I need to switch Config to Proxy after updating an existing subscription?

Not as a rule. After an update, check the server list and current selection, then test the connection with Connectivity Test. You can continue using your everyday routing rules in Config. Switch to Proxy briefly only when you need to distinguish a proxy-route issue from a rules issue.

The choice comes down to three steps: use Config for rule-based routing once you’ve checked the configuration; use Proxy to temporarily test the proxy route; and use Direct to compare against your local network. For first-time connection steps, see Getting Started. For mode settings, see Routing Modes.