Official Manual / Glossary
First identify which settings layer you're looking at, then check the parameters and rules. Interface terms, protocol names, and rule keywords remain in English; the explanations clarify what they control and what you cannot infer from them.
For step-by-step instructions, see the Getting Started Guide. To get the app for your device, visit the all-platform download page. This site does not provide, sell, or recommend nodes or subscriptions.
01 / Interface & Toggles
Lists, toggles, and routing modes each serve a different purpose. An entry being listed, selected, and connected are three different states.
Home shows saved server entries and connection-related status, and is usually where you start checking the selected entry. An entry in the list only means its information has been saved; it does not mean the server is reachable. When troubleshooting, also check the current selection, connection toggle, and actual request results.
Global Routing determines how traffic is handled overall: Config follows the current configuration rules, while Proxy and Direct use their respective modes. These are not the same level as the PROXY and DIRECT actions at the end of individual rules. Check this setting first when troubleshooting routing.
On Demand asks the system to establish a connection when existing conditions are met. It does not continuously monitor and fix every connection problem, nor can it correct an incorrect server password, port, or transport parameter. Before changing it, confirm that a manual connection works, then check the conditions and system permissions.
Add Server is the entry point for adding a server manually, using server information you already have. Select the correct protocol type first, then check the address, port, authentication, and transport parameters. Do not assume fields are interchangeable just because their names are similar.
Connectivity Test checks connectivity to the current test target using the selected test method. Results depend on the local network, server response, and target status. The reported time is not file download speed, and a successful test does not mean every app request will succeed; check the specific destination that failed.
DNS resolves domain names to IP addresses. Resolution results affect subsequent connections and some address-based rules. A domain may fail to open during resolution or during connection; identify which stage is failing before changing DNS, so you can tell what made a difference.
02 / Protocols
A protocol name describes only part of the connection mechanism. Check all parameters against the server information you already have; do not infer speed or availability from the protocol name.
Shadowsocks is a proxy protocol. Its basic settings include the server address, port, encryption method, and password. Client settings must match the server; even with the same address and port, a different encryption method may prevent communication. An entry name alone cannot confirm that the configuration is correct.
VMess uses an identifier and related authentication parameters; the connection may also use different transport methods and TLS settings. Check the identifier, transport path, and server name separately. A significantly incorrect system time may also affect authentication, so repeatedly changing the port is unlikely to help.
VLESS handles authentication separately from transport-layer settings, so check both the identifier and its associated transport parameters. The protocol name alone does not mean that content is encrypted; actual protection depends on the security mechanism used alongside it. After importing a configuration, do not change security options to values that merely look similar.
Trojan is commonly used with TLS. The authentication password, port, and server name can all affect the connection. If certificate verification fails, check the device time and whether the server name matches the certificate rather than routinely disabling verification. Use the server information you already have as the source for these parameters.
Hysteria2 is based on QUIC and requires suitable UDP connectivity, along with authentication and TLS settings. Being able to open ordinary webpages does not mean the same network allows the required UDP traffic. Check the local network, server listener, and configuration separately; do not predict performance from the protocol name.
WireGuard is a tunnel protocol that identifies peers using public and private keys. The keys, peer address, tunnel address, and routing range must correspond. A successful handshake and reachability of the destination address are separate checks. Private keys are sensitive; remove them from public troubleshooting materials and never publish the full configuration.
When HTTP is selected as the server type, it means an HTTP proxy; do not enter the destination website's address in the server address field. Whether a username, password, or TLS is required depends on the proxy's settings. A destination website using HTTPS does not mean the connection from the client to the proxy necessarily uses TLS.
SOCKS5 is a general-purpose proxy protocol that can use username and password authentication, depending on the server configuration, but it does not encrypt content itself. UDP availability depends on both ends and network conditions. A working TCP request does not prove that requests relying on UDP will also work.
03 / Rule Keywords
Rules are checked from top to bottom, and the first match determines the action. Examples use reserved domains and documentation addresses to illustrate the format.
DOMAIN matches a specified domain exactly, for example DOMAIN,example.com,DIRECT. This rule does not automatically include www.example.com. To include subdomains, check whether DOMAIN-SUFFIX is a better fit instead of guessing the matching scope character by character.
DOMAIN-SUFFIX matches a specified domain and its subdomains. For example, DOMAIN-SUFFIX,example.com,PROXY covers both the domain and its subdomains. It matches on domain boundaries, not merely because another domain contains a similar string, making it useful for applying the same action across a domain family.
DOMAIN-KEYWORD checks whether a domain contains a specified string, for example DOMAIN-KEYWORD,ads,REJECT. It does not require an exact domain or suffix match, so short keywords may block legitimate requests. Before adding one, check the full domain in the connection logs.
GEOIP matches a destination address using an IP geolocation database, for example GEOIP,CN,DIRECT. The database result does not identify a website's language, operator, or the user's location. A website using multiple addresses may receive different classifications, so check the actual destination address.
IP-CIDR matches IPv4 subnets, while IP-CIDR6 is used for IPv6. The prefix length after the slash determines the range. IP-CIDR,192.0.2.0/24,DIRECT is a documentation-address example. The rule matches destination addresses, not website names; changing the prefix length changes its scope.
FINAL handles connections that matched none of the preceding rules; for example, FINAL,PROXY specifies a fallback action. It usually belongs at the end of the rule list. If it appears earlier, later rules may never handle the connection. When checking rule order, look at both the rule contents and their positions.
04 / Actions
A filled dot, an open circle, and a slashed circle mark three different actions. These symbols are reading aids used on this site, not status indicators in the app.
PROXY is the proxy action in a rule. When matched, the connection uses the currently selected proxy. It does not provide a server automatically or guarantee that the selected server is reachable. If a rule matches but the request fails, also check the existing server entry, authentication parameters, and connection status.
DIRECT means the matched connection bypasses the proxy server and accesses the destination over the local network. Direct connections can still fail because of DNS, routing, or the destination service; success is not guaranteed. This action in an individual rule is distinct from the Direct mode in Global Routing.
REJECT blocks matched connections. Common checks include whether the matching condition is too broad and whether it appears before a more specific rule. If page content is missing or some app features fail, first check the logs to see whether this action matched, then adjust the relevant condition rather than disabling all rules at once.
05 / Subscriptions & Configuration
Subscriptions update entries, configuration organizes traffic rules, and purchase history helps you restore the app. These serve different purposes and cannot replace one another.
Subscribe retrieves or updates server entries using a subscription URL you already have, obtained from your own service provider. An update may change the entries or their number, and can overwrite manual edits. Subscription URLs may contain access credentials; do not include them in public screenshots, logs, or shared documents.
SERVER refers to a server-related entry or information, usually including an address, port, protocol, and authentication parameters. A server entry mainly answers how to connect; it is not a complete configuration with DNS, rules, and other settings. Importing server information does not mean that routing rules have also been set up.
Config can refer to the configuration file manager or to the Config mode in Global Routing; use its location to determine the meaning. Importing a file and selecting it to take effect are separate actions. Back up the current file before making changes, then check which settings are active to avoid mistaking a successful import for a completed switch.
iCloud Sync keeps related data in sync on supported devices with the required settings. The actual scope depends on the options available in the app and system. Sync is not a standalone backup, and deletions or changes may sync to other devices. Before migrating, check what will be transferred and keep a separate export of any configuration you need.
Purchased is the App Store section for finding apps previously acquired with the same purchase account; restoring the app does not automatically restore its configuration. The iPhone / iPad version costs a one-time $2.99 through the App Store; the Mac / Windows / Android / Linux versions are free. Getting the app again and restoring server services are separate matters.