Shadowrocket Global Routing: Config, Proxy, and Direct Explained

At a glance

Already have a provider and subscription but unsure which Global Routing mode to choose? Start by distinguishing rule-based routing from sending traffic through a proxy or directly. This guide covers when to use each mode, includes rule examples, and walks through one-variable-at-a-time troubleshooting. Config is usually the everyday choice when its rules have been checked; Proxy and Direct are useful for temporary switches and comparison tests.

Global Routing and the connection toggle are different

Shadowrocket is a closed-source paid app available exclusively on Apple platforms, primarily for iPhone and iPad, and sold as a one-time purchase through the App Store. Buying the app does not include a service plan. This guide assumes you already have your own provider and subscription; this site does not provide, sell, or recommend nodes, subscriptions, or providers. Check the App Store page for pricing, system requirements, and general purchase availability.

In Home, the connection toggle and Global Routing control different things. The toggle turns the connection on or off; Global Routing determines how traffic handled by Shadowrocket is routed. Selecting Proxy does not establish a connection by itself, and selecting Config does not guarantee that the current rules will produce the expected result.

One label can be confusing: Config in the bottom navigation opens configuration file management, while Config under Global Routing means traffic is handled according to the active configuration's rules. They are related, but they are not the same control. Having a node in Home also does not prove that a configuration with routing rules is selected.

3 options

Compared here: Config / Proxy / Direct

2 locations

Know the difference: Home's Global Routing and Config in the bottom navigation

1 change at a time

Change only one setting while troubleshooting, and keep the comparison conditions consistent

Some interfaces also show Scene, which is related to scene-based routing and is not a fourth fixed proxy route. This guide compares Config, Proxy, and Direct. If you are using Scene, first confirm which settings the active scene applies, then run the comparisons below.

How Config, Proxy, and Direct handle traffic

Here, “all” refers to ordinary connections handled by Shadowrocket; it does not mean every system request on the device must use the same route. Check DNS, exclusions in the configuration, and system network behavior separately. A routing mode does not change a node's protocol, address, or authentication details.

Config: follow the active configuration's rules

Recommended

Rules are checked in order, and the matching rule determines whether traffic uses DIRECT, PROXY, or a policy defined in the configuration. If no earlier rule matches, FINAL determines the outcome. Config therefore does not necessarily mean “some traffic uses a proxy and everything else connects directly.”

Best for: everyday, destination-based routing when you have clear rules in place.

Proxy: route traffic through the proxy

Instead of deciding whether to connect directly or use a proxy for each connection through ordinary routing rules, this mode sends handled connections through the currently selected proxy. It does not fix a failed node connection or replace incorrect authentication details.

Best for: temporarily routing everything through a proxy, or checking whether a routing rule is causing a problem.

Direct: route traffic directly

Handled connections use a direct route instead of being forwarded through the selected proxy node. Direct uses the reachability of your current network and does not guarantee that every destination is accessible. Direct is not the same as turning off the connection toggle.

Best for: checking your local network or direct access to a destination, or temporarily avoiding the proxy route.

Config is recommended only when you have verified where the configuration came from and what its rules are intended to do. If FINAL points to PROXY, many destinations that do not match earlier rules will still use the proxy. If a destination has a DIRECT rule, it will connect directly. The recommendation is to use routing rules you can understand and verify—not to assume a mode is safer or faster based on its name alone.

In Config, rule order and FINAL determine the outcome

In Config in the bottom navigation, check which configuration is selected and review its rules. Rules are usually evaluated in order, and an earlier match can prevent later rules from taking effect. If a domain rule does not seem to work, check that it belongs to the active configuration, that it is not placed after a broader matching rule, and that the connection provides a domain name the rule can match.

[Rule]
DOMAIN-SUFFIX,example.com,PROXY
IP-CIDR,192.168.0.0/16,DIRECT
GEOIP,CN,DIRECT
FINAL,PROXY

This is a reference to explain how rules work, not a complete configuration or a file to overwrite your existing one with. example.com is a sample domain; the actual route used by PROXY depends on your current proxy selection and configuration policies. Before making changes, keep a copy of the original configuration, confirm that the policy name is available, and then decide whether to add the rule.

DOMAIN-SUFFIX: DOMAIN-SUFFIX,example.com,PROXY matches example.com and its subdomains. If the request uses a different domain or connects directly to an IP address, the page URL alone does not guarantee that this rule will match.
IP-CIDR: IP-CIDR,192.168.0.0/16,DIRECT matches the specified IPv4 range. This example covers one private network range, not every local network address; check the range against your actual network.
GEOIP: GEOIP,CN,DIRECT matches according to an IP geolocation database, not the language used by a website. The lookup result and database contents can affect whether the rule matches.
FINAL: FINAL,PROXY assigns a final policy to connections that did not match any earlier rule. Changing it to DIRECT changes where unmatched traffic goes; this is not a cosmetic edit with no impact.

Everyday use and troubleshooting: choose a mode for your goal

If you need to access both local resources and remote destinations in everyday use, start with a Config whose rules you have checked. Switch to Proxy for a specific reason, such as testing whether a destination becomes reachable through the proxy. Use Direct to see how that same destination behaves on your current network without the proxy. Do not assume that sending every destination through the same route is the right choice.

Two situations: everyday routing and troubleshooting

Everyday use: Config

In Config, check which configuration is active and where FINAL points.
In Home, confirm the proxy node or policy you want to use.
Go to Home → Global Routing and select Config.
Test one destination expected to connect directly and one expected to use a proxy.

Temporary troubleshooting: Proxy / Direct

Keep the network, destination, and proxy selection the same.
Note what happens with Config, then switch to Proxy and try again.
To compare direct access, select Direct and establish a new connection.
Record the differences, then restore the original mode.

In short: use mode changes to narrow down the cause, then fix the relevant rule. Temporary access does not prove that you have found the root cause.

If your Wi-Fi requires you to sign in before going online, confirm that the network connection works first, then compare the three modes. Routing cannot replace network login. To access devices on your local network, also check their addresses, network isolation, and the app's local network permission; switching to Direct alone cannot identify every problem.

Can't open a website? Compare modes under the same conditions

To avoid conflating cached results, node changes, and rule changes, change only Global Routing in each test. Choose one specific destination and note whether you are on Wi-Fi or cellular, along with the failure type: a DNS resolution error, connection timeout, or page error. Do not lump these different symptoms together as “can't connect.”

Establish a baseline. In Home, check the connection status and selected proxy. In Config, check which file is active. Keep your DNS settings unchanged, test the destination with Config, and record the result.
Switch to Proxy. Go to Home → Global Routing → Proxy, then try the destination again. Your browser or app may reuse an existing connection. If needed, close the relevant page or reopen the app to establish a new connection.
Compare with Direct. On the same network, select Direct and establish a new connection. If only Direct works, check the proxy route first. If only Proxy works, investigate the routing outcome in Config rather than immediately replacing the entire configuration.
Check the records. In Data, review the available connection records and compare the destination domain or IP, policy, and error details. The interface may show different details in different places. If there is no record, you cannot conclude that a particular rule took effect.
Restore and retest. Return to Config and change only the rule related to the destination, then test the same destination again. If you change the node, DNS, and rules all at once, you will not know which change made access work.

If Config fails but Proxy works, that only shows that the two routing paths differ in a way worth investigating; it does not prove that the “rule file is corrupted.” For example, Config may route the destination to DIRECT or use a policy that differs from the currently selected node. Compare the connection records with the rule order to find out.

If Proxy also fails, check the existing node's address, port, authentication details, and reachability on your current network. Global Routing cannot make an unsupported transport work. If Direct fails too, check the destination service and DNS separately; switching modes is not a substitute for DNS settings.

FAQ: On Demand, protocols, and routing modes

Global Routing determines where traffic goes; On Demand determines when a connection starts based on conditions. They are not interchangeable. Protocols describe how a node establishes a proxy connection. Checking these three layers separately can help avoid the mistaken conclusion that switching modes had no effect.

Why does the connection still fail when Proxy is selected?

First, confirm in Home that the connection is enabled and the intended node is selected. Then check the node's address, port, and authentication details. Proxy changes the routing behavior; it does not guarantee that a node is online or repair expired information in an existing subscription. Do not change DNS and rules at the same time.

Does switching to Direct turn off the connection?

No. Direct means traffic is handled through a direct route; the connection toggle is separate. To stop the connection, use the toggle in Home. If it reconnects automatically later, check the enabled conditions under Settings → On Demand instead of repeatedly switching Global Routing.

Does Config automatically route every local website directly?

No. The label “local website” does not determine the route automatically. In Config, check the actual DOMAIN-SUFFIX, GEOIP, and IP-CIDR rules, along with FINAL. The website domain, resolved IP address, and rule order can all affect the outcome. Add an explicit rule for any destination that needs a direct route.

Can I keep using Config after switching to Shadowsocks or Trojan?

Yes. You can continue using Config with the active configuration. Shadowsocks, VMess, VLESS, Trojan, Hysteria2, and WireGuard are connection protocols; Global Routing handles traffic routing. After changing protocols, check the node parameters and connectivity, then verify which route the rules actually use. Changing the protocol alone is not a reason to switch to Proxy.

After troubleshooting, record the active configuration, Global Routing mode, and test results, then restore your everyday settings. If your setup uses explicit rules for routing, return to Config. Keep Proxy or Direct selected only when you have a specific need to route everything through a proxy or directly. Base your decision on where the destination's connection actually goes, not on which option seems more “comprehensive.”