Shadowrocket supports a range of proxy and tunnel protocols, but it cannot change a server from one protocol to another at will. This guide is for users who already have their own service and configuration and want to add a server manually or check an imported profile. First identify the protocol and transport, then verify the address, port, authentication, and TLS settings. Finally, test with Connectivity Test and an actual web request.
1. Supported protocols: understand protocols, transport, and routing
This guide covers Shadowsocks, VMess, VLESS, Trojan, HTTP, SOCKS5, WireGuard, and Hysteria2. They do not all serve the same purpose: some are proxy protocols, while others are encrypted tunnels. A proxy protocol may also use different transport methods. When adding a server, choose Type based on your existing configuration—not its name, port, or expected speed.
Protocol Type and Global Routing are separate settings. Type determines how the client connects to a server; Global Routing determines which requests use the proxy and which connect directly. Even with the correct protocol, requests set to Direct will not go through the selected server. And correct rules cannot establish a proxy connection if server authentication fails.
| Protocol | Transport and security | Details to have before adding a server |
|---|---|---|
| Shadowsocks | Uses the encryption method specified in the configuration; TCP and UDP support must be compatible at both ends. | Server address, port, Password, Method, and any additional parameters required by the existing configuration. |
| VMess | Authentication and transport are configured separately; options may include WebSocket and TLS. | Address, port, UUID, encryption options, and transport settings. |
| VLESS | The protocol itself does not encrypt data; security depends on the security layer used in the configuration. | Address, port, UUID, and any TLS, transport, and Flow settings required by the server. |
| Trojan | Proxy traffic is usually carried over a TLS connection; authentication uses a password. | Address, port, Password, TLS server name, and related transport settings. |
| HTTP / SOCKS5 | A basic proxy protocol; its name alone does not mean the connection is encrypted. | Address, port, and any username, password, and secure connection options required by the server. |
| WireGuard | An encrypted IP tunnel over UDP that uses keys rather than standard username-based authentication. | Local private key, tunnel address, peer public key, Endpoint, and routing parameters. |
| Hysteria2 | Based on QUIC, runs over UDP, and involves TLS verification. | Address, port, authentication details, SNI, and any obfuscation settings required by the configuration. |
In short: verify all parameters, then test connectivity
Having an address and port does not mean you have a complete configuration. Check the Type, authentication method, and transport with the source of your existing configuration. If a UUID, key, or TLS server name is missing, do not substitute another field.
2. Field differences: Shadowsocks, VMess, VLESS, and Trojan
These four types often appear in imported profiles, but their authentication fields are not interchangeable. A Shadowsocks Password is not a VMess or VLESS UUID, and a Trojan Password is not a server domain. When editing an existing entry, keep the original settings and change one item at a time. Otherwise, if the connection fails, it will be harder to identify why.
- Shadowsocks: Method must match the server. For example, if the existing configuration specifies
aes-128-gcm, do not switch to another algorithm just to “improve security.” Check any plugin or obfuscation options in the original configuration as well; correct basic authentication cannot compensate for a mismatched transport. - VMess: The UUID is the authentication ID. With WebSocket transport, Host and Path must also match. If TLS is enabled, check the server name too. If the interface shows Alter ID, use the value from your configuration source rather than relying on an old guide.
- VLESS: After checking the UUID, verify the security layer, transport method, and Flow. Fill in these options only when the configuration specifies them. Since VLESS itself does not provide encryption, do not disable TLS in an existing configuration.
- Trojan: Check the Password first, then verify the TLS server name and certificate validation. If the connection address is an IP but the certificate was issued for a domain, you may still need to set the specified domain as SNI. Do not use the IP as the certificate name.
Some additional fields vary depending on Type, transport options, and platform interface. Fill in only fields specified by your existing configuration. If a field is not shown, check the required preceding options rather than pasting its value into Notes or Password. For certificate validation errors, check the device time, server name, and certificate chain; disabling validation should not be a routine fix.
3. How to identify HTTP, SOCKS5, WireGuard, and Hysteria2
Use HTTP and SOCKS5 according to the capabilities of your existing proxy endpoint. An HTTP proxy can establish a tunnel with CONNECT, but that does not mean the connection between the client and proxy server is encrypted. SOCKS5 UDP support requires both the client and server to support it; selecting SOCKS5 as the Type alone does not guarantee that all UDP requests will work.
WireGuard and Hysteria2 both rely on UDP reachability, but they differ in purpose and authentication. WireGuard is an IP tunnel, while Hysteria2 carries proxy traffic over QUIC. A network that allows TCP does not necessarily allow UDP, so the fact that other protocols connect does not rule out network restrictions affecting either of these.
| What to check | Specific checks | Common mix-ups |
|---|---|---|
| HTTP / SOCKS5 | Check whether the server requires a Username and Password, and whether connecting to the proxy endpoint also requires TLS. | A website using HTTPS does not mean the proxy endpoint itself uses TLS. Do not swap the username and password. |
| WireGuard keys | Private Key belongs to your device; Peer Public Key belongs to the peer. If a Preshared Key is provided, it must match too. | Do not enter your own public key as your private key, or substitute a regular password for a key. |
| WireGuard addresses and routing | Check the tunnel Address, Endpoint, and Allowed IPs. 0.0.0.0/0 represents the entire IPv4 address range. | Address is the address inside the tunnel, not the server's public address. Allowed IPs is not a list of website domains. |
| Hysteria2 | Check the authentication details, UDP port, SNI, certificate validation, and whether the original configuration requires obfuscation. | You cannot switch between Hysteria and Hysteria2 just by changing Type. An obfuscation password may also differ from the authentication password. |
WireGuard's Allowed IPs is a tunnel-level setting, not the domain-based routing rules used in Shadowrocket's Config. Hysteria2 performance also depends on UDP reachability, packet loss, server load, and configuration. Do not infer speed from the protocol name or enter an unusually high bandwidth value without measuring it.
4. Add and verify a server in Add Server: four steps
The steps below refer to the Home, Config, and Settings screens. Before adding a server manually, have all required parameters ready. If you already have a subscription or complete configuration, keep the original imported settings and verify them in the editor. This guide explains how to use your existing configuration; it does not provide or recommend connection services.
-
Choose a type
Go to Home → tap “+” in the top-right corner to open Add Server, then select the Type that matches the original configuration. Do not choose a Type just because two entries use port 443.
-
Enter authentication details
Enter the server address and port, then add the Password, UUID, or key required for that type. Use the port number specified in the original configuration, without a protocol prefix. After copying authentication details, check for leading or trailing spaces and line breaks.
-
Check the transport
Set TLS, SNI, WebSocket Host and Path, and other options according to the original configuration. For WireGuard, check the tunnel and peer settings. After saving, return to Home and select the server as the default; make sure the selection indicator is on the intended entry.
-
Test the connection
In Home → Global Routing, temporarily select Proxy, turn on the connection, and run Connectivity Test. Then visit a known-working HTTPS page of your own. When testing is complete, restore the Config or Scene you normally use and check an actual request again.
Connectivity Test checks the connection to its test target; it does not prove that all apps and all protocol traffic are working. If the test passes but an app fails, check whether it uses TCP or UDP, whether its request matches the expected policy, and whether DNS returns a usable result.
5. What subscriptions, configurations, and protocol entries do
Subscriptions are mainly used to import and update existing server details. Configuration files in Config mainly contain routing rules and related settings. Updating a subscription may change an entry's address, authentication, or transport parameters, so do not treat a subscription-managed entry as a permanent manual copy. Save the original details before testing edits, so you can compare them if a later update overwrites your changes.
- Import an existing subscription: Home → “+” → Type → Subscribe, enter your own subscription URL, and save. Return to Home and update the subscription. A subscription URL is sensitive information; do not include it in public screenshots or logs.
- Check the update: Confirm that the expected entries were added, then open an entry to verify its Type and transport settings. A successful subscription download does not mean every server in it can connect from your current network.
- Restore your usual routing: In Global Routing, Proxy sends traffic through the proxy for troubleshooting, Direct connects directly, Config uses the selected configuration, and Scene applies the selected scene. Restore your usual setup when troubleshooting is complete.
- Check the rules: In Config mode, check rules such as DOMAIN-SUFFIX, GEOIP, and IP-CIDR in order, along with the final FINAL rule. Rules select a policy; they do not change VLESS into Trojan or modify a WireGuard key.
The rule snippet below illustrates ordering. It is not a complete configuration and contains no server details. PROXY requires a usable proxy policy in the corresponding configuration. IP-CIDR uses a documentation-only example subnet and should not be used directly for real-world routing.
[Rule]
DOMAIN-SUFFIX,example.com,PROXY
IP-CIDR,192.0.2.0/24,DIRECT,no-resolve
GEOIP,CN,DIRECT
FINAL,PROXYRules are generally matched from top to bottom. If a destination domain matches DIRECT earlier in the list, the later FINAL rule will not send that request through the proxy. Conversely, if a temporary Proxy test works but the connection fails after restoring Config, check which rule matched and which policy was selected before changing server authentication.
6. Common issues: narrow down the cause by where the connection fails
The address and password are the same. Why does changing Type make the connection fail?
Type determines the handshake and authentication format. The same address and port do not mean the server supports multiple protocols. Go to Home, edit the server, restore the Type from the original configuration, and check the Password or UUID. Changing Type is not a way to improve speed.
VMess or VLESS times out. What should I check first?
First check Address, Port, and UUID in Home, then verify the transport. For WebSocket, check Host and Path; for TLS, check SNI and the device time. Change one group of settings at a time and rerun Connectivity Test to distinguish a timeout from a specific authentication or certificate error.
Hysteria2 fails on Wi-Fi but works on mobile data. What should I do?
Keep the server and settings unchanged, switch networks, and repeat the test. If the difference is consistent, check whether the failing network blocks the UDP port and where the connection times out in the log. Do not change the password first. Comparing with another working entry you already have can help, but does not by itself prove that the UDP path is working.
The test passed. Why won't the webpage load?
First make sure Home has the server you just tested selected, then check whether Global Routing is set to Direct. Test again temporarily using Proxy. If access works, check the Config rules and policies. If it still fails, check DNS, TLS errors, and whether the destination website is reachable. One successful test does not mean every request will work.
Keep at least the protocol type, network type, symptoms, and exact error message in your troubleshooting notes. Before sharing, remove subscription URLs, passwords, UUIDs, and private keys; use field names only when describing their relationships. This helps identify whether the issue is with transport, authentication, or routing and avoids rebuilding the same configuration repeatedly.