Shadowrocket Global Routing: Config, Proxy, and Direct Explained

At a glance

Once you’ve imported a provider subscription, Config is usually the best choice for everyday use: the rules in your current configuration determine where traffic goes. Use Proxy to temporarily test the proxy route, and Direct to compare results over your current network without a proxy. This guide covers how the three modes differ, how to switch between them, and how to troubleshoot—especially the difference between an active connection and a request actually routed through a proxy.

How the three modes differ: where traffic goes

Shadowrocket’s Global Routing controls how intercepted traffic is routed. It does not manage subscriptions or configure server protocols. Config is the usual choice for everyday use, provided you’ve selected the right configuration file and verified that its rules suit your needs. It does not automatically mean “local websites go direct, everything else goes through a proxy.”

Config

Recommended

Rules are checked in order in the current configuration. When a rule matches, its assigned policy is applied. If none of the earlier rules match, Shadowrocket checks the remaining rules and then the final fallback policy.

Best for: everyday rule-based routing with a suitable configuration.

Proxy

Routes intercepted traffic through a proxy instead of deciding whether to use a proxy or direct connection rule by rule. It cannot guarantee that every app’s traffic will be intercepted, and it will not fix server connection issues.

Best for: temporarily testing the proxy route and narrowing down rule-related issues.

Direct

Routes intercepted traffic directly, without going through a proxy server. This does not turn off Shadowrocket’s connection or guarantee that the system VPN status disappears immediately.

Best for: comparing results over your current Wi-Fi or cellular connection without a proxy.

Some versions of the interface also show Scene, a separate routing option. The “three modes” covered here are not necessarily the only options in every menu. When troubleshooting, start by testing Config, Proxy, or Direct so you don’t mix Scene-specific settings into the comparison.

Before switching: check the connection, configuration, and server

The server selected in Home determines which server the proxy connection uses. The configuration file selected in Config determines how rules are matched. Global Routing determines whether traffic is routed according to those rules. Each serves a different purpose. Changing the server alone won’t switch Direct to Proxy, and updating a subscription doesn’t necessarily replace the rules in the active configuration file.

Confirm that you have a subscription. Get the subscription link from your provider, then add it and update the server list by following the import steps. If the update fails, troubleshoot access to the subscription first; switching routing modes won’t update it.
Confirm the proxy destination. Check the selected server in Home. If your configuration uses policy groups, also check which member is selected in each relevant group. The highlighted server in the server list alone does not show where every request will go.
Confirm the configuration file. Open Config and make sure the configuration you want to use is selected. Saving a file to the list does not make it the active configuration.
Select a mode and connect. Go to Home → Global Routing, select Config, Proxy, or Direct, then check the connection toggle. The first time you connect, follow the system prompt to authorize VPN configuration.
Make a new request. After switching modes, reopen the page or start a new connection. Existing long-lived connections may keep using the previous route. If needed, disconnect and reconnect, then repeat the test under the same conditions.

3 modes

Modes compared in this guide: Config / Proxy / Direct

4 types

Rule types below: DOMAIN-SUFFIX / IP-CIDR / GEOIP / FINAL

2 checks

Check separately: whether a connection is established and where a request is routed

How Config works: rule order and the FINAL fallback

Config doesn’t mean that turning on rules will automatically produce the right result. What matters is what the active configuration contains, the order of its rules, and where each policy points. Rules are checked in order, and the policy for the first matching rule is applied. Put more specific exceptions before broader rules, and place FINAL at the end of the rule list.

[Rule]
DOMAIN-SUFFIX,example.com,PROXY
IP-CIDR,192.168.0.0/16,DIRECT,no-resolve
GEOIP,CN,DIRECT
FINAL,PROXY

These rule snippets illustrate the syntax; they are not a complete configuration or a recommendation to replace your current file. example.com is for illustration only and does not refer to a real service. In this example, requests that match none of the earlier rules go to PROXY—not “direct for everything else.”

DOMAIN-SUFFIX,example.com,PROXY: Matches the domain and its subdomains, then routes them through the PROXY policy. Whether a domain rule matches also depends on whether usable domain information is available in the request.
IP-CIDR,192.168.0.0/16,DIRECT,no-resolve: Matches the IPv4 range and routes it directly. no-resolve prevents a DNS lookup solely for this IP rule; it does not disable DNS for the entire app.
GEOIP,CN,DIRECT: Matches based on an IP geolocation database, then routes traffic directly. The match depends on the destination IP’s geolocation record, so webpage content alone can’t tell you whether the rule should match.
FINAL,PROXY: Routes traffic through the proxy if none of the earlier rules match. Changing this to FINAL,DIRECT also changes where unmatched traffic goes.

Everyday use and troubleshooting: change one variable at a time

First note your network, selected server, configuration file, and target domain. Then make a new connection to the same target. Don’t change the server, switch networks, update the subscription, and edit rules all in one test. If the result changes, you won’t know which change made the difference.

Suggested approach: keep your everyday setup and briefly compare routes

Everyday use

Use Config and verify the active configuration and policy group selections.
When something goes wrong, note the target domain and the error first.
Change only the rule relevant to the target, and keep a copy of the original.

Troubleshooting

Keep the same network and proxy destination, switch to Proxy, and try again.
Then switch to Direct and compare the result over your current network.
Establish a new connection for each test, then switch back to Config when you’re done.

Base your conclusion on new requests made under the same conditions. A single cached page, latency reading, or VPN icon is not enough to confirm the actual route.

If Config fails but Proxy works, first check the rule matching the target, the relevant policy group, FINAL, and related DNS settings. If both Config and Proxy fail but Direct works, check whether the selected server is reachable and its authentication settings are correct before investigating the proxy route. If all three modes fail, check your local network, the target service, and domain resolution before repeatedly changing FINAL.

A successful direct connection doesn’t mean every request should be switched to DIRECT. Keep rules for services that require a particular network route. Your test confirms only how one target behaves on one network; don’t generalize the result to all traffic.

How Global Routing relates to On Demand, protocols, and subscriptions

Settings → On Demand controls when a connection starts based on specified conditions. Global Routing controls how traffic is routed while connected. One answers “when to connect?” and the other “how should intercepted requests be handled?” If the connection remains active after switching to Direct, first determine whether that’s due to the routing mode or an automatic connection condition.

Troubleshoot automatic connections: Go to Settings → On Demand and check which conditions are enabled. If you need to disconnect manually for comparison, first make sure those conditions won’t immediately reconnect. Restore your original settings after testing.
Troubleshoot protocol settings: Shadowsocks, VMess, VLESS, Trojan, Hysteria2, and WireGuard are protocol choices. Switching to Proxy won’t fill in the server address, port, authentication details, or TLS settings for you.
Troubleshoot subscription updates: Subscriptions are mainly used to retrieve and maintain server entries provided by your service provider. A successful server list update doesn’t prove that the rules in Config suit your needs. Likewise, correct rules don’t guarantee that the subscription URL is reachable.
Troubleshoot DNS: Domain resolution is an important step before routing. A DNS resolution failure is different from a proxy handshake failure. Check the specific error and request logs; don’t switch modes based only on “the page won’t load.”

If you already have a subscription, use the exact settings provided by your service provider. Don’t guess port numbers or reuse authentication fields from one protocol for another. If your subscription link contains access credentials, hide the full URL, tokens, and authentication details before sharing troubleshooting screenshots.

FAQ: Why the result may differ after connecting

Why is the request still going direct when the VPN icon is showing?

Go to Home → Global Routing and check whether Direct is selected. If you’re using Config, check whether the policy for the matching rule is DIRECT. The system connection status confirms the tunnel state, not that every request goes through a proxy server.

Access works again after switching to Proxy. Can I leave it that way?

You can choose a mode that suits your needs, but Proxy doesn’t provide the same rule-based routing behavior. Requests that should go direct may also use the proxy route. For everyday split routing, switch back to Config and check the specific rules and policy groups instead of treating a temporary test as a permanent solution.

Why didn’t changing a rule affect the page I already have open?

In Config, first make sure you edited the currently selected file. Then check that Global Routing is set to Config. Close the target page’s existing connection and visit it again; if needed, reconnect Shadowrocket. Don’t judge whether a rule took effect by refreshing a page that may be cached.

Is Direct the same as turning off the connection?

No. Direct routes traffic directly within an active connection; turning off the connection stops it. To make a clear comparison without a tunnel, check the trigger conditions in Settings → On Demand, disconnect manually, and confirm the actual connection status in system settings.