OFFICIAL MANUAL · Feature Reference
First choose how traffic should be handled, then check your servers and configuration, and finally adjust automatic connections, DNS, and testing options. Change one setting at a time and retest the same destination to see whether the change took effect.
01 · GLOBAL ROUTING
Global Routing mode and server selection are separate choices. Selecting a server does not mean every request will use it.
What it is and where to find it: Global Routing is the routing control on Home, with three modes: Config, Proxy, and Direct. Config follows the rules in the current configuration; Proxy sends intercepted requests through the proxy policy; Direct connects intercepted requests directly to their destinations. These modes determine how requests are handled, not whether a server is available.
| Mode | How It Works | When to Use It | Check First |
|---|---|---|---|
Config · Configuration | Routes traffic according to the active configuration’s rules and policies. | When some destinations should use a proxy and others should connect directly. | The active configuration, rule order, and policy references. |
Proxy · Proxy | Sends intercepted requests through the proxy. | To test a proxy connection temporarily or route all intercepted requests through the proxy. | The selected server, protocol settings, and destination reachability. |
Direct · Direct | Connects intercepted requests directly to their destinations. | When you need a direct connection or want to compare it with the proxy route. | Whether the current network can reach the destination directly. |
How to set it: Open Global Routing on Home, choose a mode, then check the selected server. Use Config for everyday routing when you have rules in place. To troubleshoot a destination, note the current mode, temporarily switch to Proxy or Direct, and compare results using the same destination. Restore the original mode when you finish so a temporary troubleshooting setting does not become your default.
Keep in mind: Direct does not disconnect the client, and Proxy does not guarantee that a destination is reachable. Even with a server selected, a rule may route a request to DIRECT or REJECT. If switching modes changes the result, check your rules and DNS before assuming the protocol is at fault. For first-time connection steps, see the Global Routing guide.
02 · RULES & POLICIES
Rules determine which requests match; policies determine what happens after a match. Check both.
DOMAIN matches an exact domain. DOMAIN-SUFFIX matches the domain and its subdomains, while DOMAIN-KEYWORD matches a keyword in the domain. IP-CIDR and IP-CIDR6 match address ranges; GEOIP matches against an IP geolocation database. USER-AGENT depends on information available in the request and should not be treated as a general-purpose way to identify apps.
DOMAIN,www.example.com,PROXY
DOMAIN-SUFFIX,example.com,PROXY
FINAL,DIRECTPROXY sends requests through the proxy, DIRECT connects directly, and REJECT blocks requests. FINAL is the fallback rule when no earlier rule matches, not a fourth policy. A configuration may also reference named policy groups; check the selection within each group rather than assuming a matching rule alone determines the route.
Where to find it and how to set it: In Config, confirm which configuration is active, then open its editor and find the Rule section. Save a restorable copy before adding clearly scoped rules. Place specific rules that should take priority before broader ones, and put FINAL last. After saving, test in Config mode and check the matching rule and resulting policy in the available connection logs.
Keep in mind: Rules are usually evaluated in order. Once an earlier rule matches, a more specific rule later in the list may never run. example.com is only a syntax example, not a connection service. IP-based rules may depend on domain resolution, so check the resolution result when domain and IP rules behave differently. For the full configuration structure, see the configuration file reference.
03 · SERVER MANAGEMENT
A subscription maintains a list of server details; a configuration file maintains rules and other settings. Importing one does not mean the other is set up.
What it is and where to find it: Home shows available servers and subscription groups. Add Server lets you enter connection details, Subscribe is for subscription links, and Scan QR Code reads a QR code containing existing details. These are different ways to enter information; in every case, the result needs complete connection settings that match the server.
How to set it up: If you already have a subscription, choose the appropriate type in Add Server, enter your own subscription URL, verify it, then save and update. If you have details for an individual server, enter its address, port, and authentication settings for the relevant protocol. Return to Home, expand the relevant group, and select an entry. Run Connectivity Test, then try an actual destination; a server name alone does not confirm that the connection works.
When updating: Updating a subscription retrieves the server list from its source; it does not fix problems with the server itself. Before updating, make sure the subscription URL is still valid. Afterward, check your selection again, since entry names, settings, or the list may have changed. Entries managed by a subscription may be overwritten during the next update, so check their source before making lasting changes.
Keep in mind: Subscription URLs may contain credentials. Remove the full URL and any sensitive parameters before taking screenshots, syncing, or sharing diagnostic materials. Do not mix fields from different protocols or use a server address as a subscription URL. For the full subscription import workflow, see the subscription guide. To enable an existing configuration, see the configuration file section.
04 · PROTOCOL PARAMETERS
Matching protocol names are only the starting point. Authentication, transport, and TLS settings must also match your server details.
What it is and where to find it: WireGuard is a key-based tunneling protocol that can be configured under the corresponding server type. Its keys, addresses, and peer details each serve a specific purpose; they cannot be replaced with a username and password from another protocol.
How to set it up: Use your existing WireGuard configuration to check the local Private Key and address, the peer’s Public Key, and details such as Endpoint. Match any other parameters in the original configuration as well. After importing, check the address and routing-related fields; confirming that Endpoint is filled in is not enough.
Keep in mind: Private Key is sensitive information. If the handshake or access fails, first check the key pair, Endpoint, UDP reachability on your network, and address settings. Do not share your full configuration publicly to troubleshoot. Check Global Routing and app rules separately.
What it is and where to find it: VMess is one of the available server types. In addition to the address and port, connection details include a UUID and corresponding transport settings. The required fields depend on your server configuration.
How to set it up: In Add Server, select VMess, enter the details you already have, and verify the UUID. If you use WebSocket or TLS, check the relevant Host, Path, and Server Name fields individually. These values may differ; enter them exactly as specified by your server configuration.
Keep in mind: An incorrect system time can affect authentication, and mismatched settings can cause connection timeouts. When an error occurs, check the original details and device time first. Do not disable certificate verification just to clear an error. A successful import only means the details were read; it does not confirm the connection.
For Shadowsocks, VLESS, Trojan, HTTP, SOCKS5, Hysteria2, and other types, follow the same check order: confirm the protocol, verify the address and port, then check authentication, transport, and TLS fields. Protocols do not all use the same settings, and not every entry applies to every type. Use the fields shown in the current app and your own server documentation; do not guess missing details.
05 · ON DEMAND
Verify the manual connection first, then enable automatic connection conditions. Automation cannot compensate for incorrect server or rule settings.
What it is and where to find it: On Demand triggers the system’s VPN connection behavior based on configured conditions. Check the available options under On Demand in Settings. The available conditions, such as network type or SSID, and how they are organized depend on what the current app displays. On Demand controls when to connect; Global Routing controls how requests are handled after connection.
How to set it up: First disable automatic triggers, connect manually, and confirm that your server and Config work. Then open On Demand and start with one clearly defined condition. After saving, switch to a network that meets the condition, observe the system connection status, and check whether the destination and policy behave as expected. Add and test any additional conditions one at a time.
Keep in mind: Conditions may overlap, and their order or configured actions can affect the result. If the connection returns after you disconnect manually, check whether On Demand is still triggering before adding system configurations again. During troubleshooting, note the current network, conditions, and expected action. Temporarily disabling On Demand and testing again can help distinguish automatic connection behavior from other connection problems.
06 · DATA
Traffic statistics help you understand connection activity, but they do not replace the measurements used by a provider or the system.
What it is and where to find it: Data shows traffic recorded by the client. Open Data and check the scope and units of the current view. Distinguish uploads from downloads, and note any time or connection breakdowns shown. These figures reflect activity recorded by the client and should not be treated as the remaining allowance on a subscription.
How to use it: To check the effect of an action, note the figures before testing, visit a specific destination, then return and check for changes. If the current interface offers a reset option, understand its effect first and record when you reset it. Compare the results with connection logs and Global Routing to determine whether the activity behaved as expected.
Keep in mind: Background sync, webpage resources, and system requests can all change traffic figures. An increase alone does not prove that a destination used the expected policy or that its content was returned successfully. Measurement scope, connection overhead, and other tools may differ. When troubleshooting, focus on the specific request and its match rather than comparing total traffic alone.
07 · SETTINGS
Use the feature names below to find each setting. Some settings may also be controlled by the active Config, so check which source takes effect before making changes.
What it is and where to find it: DNS resolves domain names to addresses needed for connections. Check the DNS-related options in Settings, and also review related settings such as General and Host in the current Config. This helps avoid changing one place while overlooking a definition in the configuration.
How to set it up: Note the original value and confirm that the selected resolver is reachable on your current network before changing the setting. Retest the same domain and consider the resolution result, matched rule, and destination connection together. If the current configuration specifies DNS, first determine which requests it applies to.
Keep in mind: If an IP address works but the domain does not, DNS may be involved, but check factors such as TLS too. Do not mask rule errors by repeatedly changing DNS. Existing mappings in Host may also affect the result.
What it is and where to find it: Test Method in Settings selects how connection tests are performed. It affects how Connectivity Test checks a server; it does not change protocol settings or Global Routing for you.
How to set it up: Choose an option available in the current interface. If the method includes additional settings such as a test destination, check that the destination is reachable. When comparing entries, keep the method and network the same; repeat tests if needed to reduce the effect of temporary fluctuations.
Keep in mind: A successful test does not mean every website is reachable, and interpret a failed test in light of the method used. Handshake reachability, webpage responses, and actual transfer speeds are different measures. For more troubleshooting, read the connection troubleshooting guide.
What it is and where to find it: Today Widget is an entry point for a system widget. Check Settings to see the content and options it provides. Whether the system offers a way to add it depends on the widget interface available on your device.
How to set it up: First select a server and test a manual connection in the app. Then follow the system’s widget editing steps to add an available widget and check what it displays. After using a widget control, return to Home if needed to confirm the actual connection status.
Keep in mind: Widgets may refresh periodically, so a change on screen is not a real-time diagnostic result. If an action from the widget does not produce the expected status, return to the app and check permissions, server selection, and On Demand conditions.
What it is and where to find it: iCloud-related features in Settings sync or back up data within the scope provided by the app. Syncing does not copy every system permission. Check the prompt in that section to see exactly what is included.
How to set it up: Make sure the device is signed in to your own iCloud account and that the required access is allowed in system settings. Keep a copy of your existing configuration before enabling sync for the first time. Check the sync result on another device before deciding whether to replace its existing content.
Keep in mind: Restoring an App Store purchase and syncing data through iCloud are separate processes. After reinstalling the app, check your servers, configuration, and connection permissions again. Synced data may include subscription URLs or authentication details, so protect your account and device access.
When you finish, return to Home to check the server and Global Routing, then test the actual destination. For the full workflow from import onward, read the complete user guide. To change rule syntax, see the rules manual.