At a glance

This guide is for users who already have their own provider’s connection details or subscription and want to check protocol settings in Shadowrocket. Start with the protocol table to confirm Type, then review Address, Port, authentication, and transport settings. Finally, distinguish connection failures from routing issues. The protocol must match the server; changing Type alone cannot convert an existing server to another protocol.

Supported Protocols and Add Server Fields

Shadowrocket supports the protocols listed below. Home is where you manage servers and connections, Config is for configuration files and rules, and Settings is for app preferences. Check protocol parameters under Add Server in Home. The form fields vary by Type, and additional transport options may also differ. The table lists details to verify; not every protocol uses the same form.

Protocol Features and Manual Setup Checklist
Protocol Transport and authentication Fields to check in Add Server Common omissions
Shadowsocks Uses an encryption method and password to protect proxy traffic and can carry TCP and UDP. UDP availability also depends on the server and its settings. Type, Address, Port, Method, and Password; check plugin settings too if a plugin is used. Method does not match the server, or plugin settings are treated as ordinary notes.
VMess Uses a UUID for authentication and supports different transport options. TLS is a separate transport security setting to verify. Address, Port, UUID, and encryption options; check Transport, TLS, and any additional fields against the supplied settings. The UUID is correct, but the WebSocket Host or Path does not match.
VLESS Uses a UUID for authentication but does not provide data encryption on its own; security depends on the configured security layer. Address, Port, and UUID; verify Transport, TLS, Flow, or other security parameters as required by the server. The UUID is copied, but server-required security parameters are missing.
Trojan Uses Password authentication and typically connects over TLS. The certificate name may differ from the connection address. Address, Port, Password, TLS, and Server Name; match any additional transport settings as well. The IP address is entered, but the original Server Name is not preserved.
HTTP / SOCKS5 A proxy protocol whose basic form does not automatically encrypt the connection. HTTP proxies can use CONNECT, and SOCKS5 can support UDP forwarding. Type, Address, and Port; enter Username and Password if authentication is required. Set secure connection options according to the service. Entering an HTTP proxy address as a webpage URL, or assuming every SOCKS5 service supports UDP.
WireGuard Creates an encrypted tunnel over UDP and uses keys for authentication, not a UUID or regular login password. Endpoint, Private Key, Peer Public Key, and local tunnel address; check Allowed IPs, MTU, and other settings against the configuration. The local Private Key and Peer Public Key are entered in the wrong fields, or the tunnel address is missing.
Hysteria2 Based on QUIC and uses UDP underneath. Requires authentication and TLS settings; obfuscation may be available depending on the server configuration. Address, Port, authentication details, and Server Name; if Obfs is enabled, also match its type and password. The current network restricts UDP, or Obfs settings are missing.

Bottom line: choose Type to match the supplied settings

Check the protocol name provided by your service first, then verify authentication and transport settings. An existing VMess server cannot be used as VLESS simply by changing Type. If the connection fails, restore and verify the supplied settings rather than cycling through different Types.

Entering Address, Port, and authentication details

Address is the server’s hostname or IP, not a subscription URL. When entering it manually, use just the hostname, such as server.example.com. Do not include https://, a subscription path, or query parameters in Address. Use the actual Port supplied for the service: 443 is a common example, not a default for every Trojan, VLESS, or Hysteria2 server.

Authentication fields are not interchangeable. For Shadowsocks, Password must match Method. Keep the full UUID for VMess and VLESS. For Trojan, use the Password supplied by the server. WireGuard requires keys with distinct local and peer roles. Check for leading or trailing spaces when copying values. When sharing screenshots, hide passwords, UUIDs, keys, and subscription tokens.

  1. Open the form

    Go to Home → tap “+” in the upper-right corner to open Add Server. To edit an existing entry, open it from Home. Keep the original settings before making changes so you can restore them if needed.

  2. Confirm the type

    Open Type and choose the protocol specified in the original details. WireGuard uses different key and address fields from standard proxy entries; do not follow the VMess setup steps for it.

  3. Enter the address

    Enter Address and Port. If the supplied details use a hostname, keep it as a hostname. Use an IP address only when one is explicitly provided, and do not replace the port with 443.

  4. Check authentication

    Enter the Password, UUID, or keys required for the selected Type, then expand the applicable TLS, Transport, and other options. Check Host, Path, and Server Name individually; do not assume they should match just because their names look similar.

  5. Save and test

    After saving, return to Home, select the server, and turn on the connection switch. On the first connection, follow the system prompt to allow adding a VPN configuration. Then run Connectivity Test and check whether the target webpage actually loads.

What to check for TLS, Transport, and UDP

A protocol name describes only part of a configuration. VMess and VLESS entries may also specify a Transport such as WebSocket. TLS protects the relevant connection, while Host and Path may be used for server-side routing. Even when Address, Port, and UUID are correct, mismatched additional fields can still cause a handshake failure. Check each value against the original settings; protocol support does not mean every transport combination is detected automatically.

Server Name
This setting specifies the server name used for a TLS connection. Address can be an IP while Server Name remains the domain associated with the certificate. They serve different purposes and should not be copied as the same value by default.
Host / Path
With WebSocket, Host is the hostname in the request header, and Path is the request path. The example path /ws shows the format only; use the value from the existing configuration, preserving the leading slash and letter case.
UDP
Hysteria2’s QUIC and WireGuard tunnels rely on UDP. For other proxy protocols, check separately that the client option, server, and current network support the required UDP traffic.
MTU
A WireGuard tunnel parameter that affects packet size. Change it only when the configuration or troubleshooting evidence points to a packet-size issue; do not treat an arbitrary fixed value as a universal optimization.

To check for network restrictions, test the same existing configuration over Wi-Fi and cellular, and note which network connects and which times out. If Hysteria2 fails on only one network, that can help direct your UDP reachability checks, but it does not by itself prove the protocol is at fault. This guide does not rank protocols by speed: throughput also depends on server load, the route, packet loss, and the configuration.

Why check settings after importing a subscription?

A subscription is a way to retrieve multiple server entries, not a connection protocol. One subscription can contain multiple Types, and each entry connects using its own protocol. If you already have a subscription, go to Home → “+” → Type → Subscribe, enter your own subscription URL, save it, and update the subscription. Config files in Config mainly manage rules and policies; the two serve different purposes.

If an entry stops working after an update, compare its Type, port, and transport settings before and after the update, then check whether the provider changed the authentication details. Do not change every entry at once. Test one entry and leave the others untouched to reduce variables. A subscription URL can grant access to your account, so do not post it in full in a public support request.

After confirming the protocol, check Global Routing

The protocol determines how to connect to a server; Global Routing determines how requests are routed. These are separate layers. After selecting a server in Home, check Global Routing: if it is still set to Direct, ordinary proxy requests will not be sent through the selected server as expected. If it is set to Config, check which policy the active rules match.

Config

Recommended

Choose a policy based on the rules in the current configuration. Requests matching DIRECT connect directly; those matching PROXY use the proxy policy. Requests not explicitly covered do not necessarily connect directly by default.

Best for: everyday use when you have checked your rules and need routing by domain or IP range.

Proxy

Routes requests that would normally use a proxy through the proxy, making it easier to test without rule selection getting in the way. System traffic and bypass settings can still affect the actual route, so this is not an absolute guarantee for every packet.

Best for: temporarily testing a server connection and separating protocol failures from rule issues.

Direct

Uses a direct connection; the selected server does not handle ordinary proxy requests. If a webpage opens after switching to Direct, that does not confirm the server’s authentication or transport settings are correct.

Best for: establishing a direct-connection baseline and checking whether the issue is with the local network.

Scene in Global Routing lets you set routing behavior for different scenarios; it is not a fourth server protocol. When testing a new entry, start with a clearly defined routing mode to reduce variables, then switch back to your usual setup. The rules below illustrate matching order. Review them in Config, not in Add Server.

[Rule]
DOMAIN-SUFFIX,example.com,PROXY
IP-CIDR,192.168.0.0/16,DIRECT,no-resolve
GEOIP,CN,DIRECT
FINAL,PROXY

Rules are checked from top to bottom, and the first match determines the policy. DOMAIN-SUFFIX matches a domain and its subdomains; IP-CIDR matches an IP range; GEOIP checks the region associated with an IP; FINAL handles requests that did not match earlier rules. Here, FINAL,PROXY explicitly sends the remaining requests through the proxy. Before using it, check that the policy is available and adjust it to suit your network needs.

Common Protocol Connection Issues

Why won’t a VMess server connect after changing it to VLESS with the same UUID?

A UUID is only part of the authentication details, and the two protocols communicate differently. Return to the entry’s edit screen in Home, restore the Type specified by your provider, and check Transport and security settings again. Create a new entry with VLESS only if the server has explicitly provided VLESS settings.

What should I do if Trojan reports a TLS error when I use an IP address?

Open the entry and check Address and Server Name separately. If the server requires an IP connection but uses a domain certificate, keep the supplied certificate domain as Server Name. Also check that the device time is correct. If it still fails, note the full error type and check the server certificate status; do not skip certificate verification as a first step.

Hysteria2 keeps timing out, even though the password is correct. What next?

Check Port, Server Name, and Obfs settings, then test the same entry on another currently available network. Hysteria2 relies on UDP, so checking the password alone cannot rule out network restrictions. Change one setting at a time and note whether the connection succeeds; changing the port and obfuscation settings together makes the result harder to interpret.

Connectivity Test succeeds, but webpages still won’t load. Why?

First check Home → Global Routing, temporarily select Proxy, and retry the same webpage. If it loads, return to Config and check the rules and policy for that domain. If it still fails, check DNS, TLS, and the destination service. A successful Connectivity Test confirms only that the specific test passed; it does not mean every destination or traffic type is working.