Look up terms by screen and purpose. First distinguish connection modes, server protocols, and rule actions, then adjust the relevant settings. The same English term can mean different things in different parts of the app.
This page explains terminology; it does not replace step-by-step instructions. For first-time setup, see the tutorial. To get the app, visit the download guide.
Interface options use title case; rule action keywords are uppercase. Similar names do not necessarily mean the options work the same way.
Home is the main screen for viewing servers, checking the selected server, and controlling the connection. After importing server details, tap the server you want to use, confirm it is selected, and then turn on the connection. A server appearing in the list does not mean it is selected or connected.
As a screen name, Config is where you manage and select profiles. As a Global Routing option, Config means routing traffic according to profile rules. These are related but distinct: having a profile is not enough—you must also make sure the right profile is enabled and the corresponding mode is selected. If rules are not taking effect, check both.
Global Routing sets the overall routing mode: Config, Proxy, or Direct. To route traffic by domain or IP, check Config rather than only changing servers. Changing this setting affects how intercepted traffic is handled, so restore your intended mode after testing.
Proxy is the Global Routing mode that sends intercepted traffic through the proxy path. It can help determine whether an issue is related to rule-based routing. It is not the same as PROXY at the end of a rule: the former is an overall mode, while the latter is the action for one rule. Proxy mode will not fix incorrect server settings or an unreachable remote service.
Direct is the Global Routing mode that sends intercepted traffic directly. Use it as a comparison to check whether a destination is reachable on your local network; it does not mean the client’s connection toggle is off. To resume rule-based routing, select Config again.
On Demand starts a connection when the configured network conditions are met. It controls when a connection is attempted, not which rule traffic matches. For automatic connections, check that the conditions in Settings match the current network. If the connection starts again after you disconnect manually, check these triggers before deleting the profile.
Connectivity Test checks whether a connection can reach its destination. Run it after selecting the default server and turning on the connection. A successful test means the request completed along that test path; it does not guarantee the same result for every website or app. If it fails, check the local network, server settings, DNS, and current routing mode.
The protocol type must match the server details you have. A protocol name does not provide all the required settings or indicate connection speed on its own.
Shadowsocks is a proxy protocol. Common required settings include the server address, port, encryption method, and password. The client and server must use the same encryption method, so checking only the address and password is not enough. Confirm any additional transport options against the original details.
VMess is an authenticated proxy protocol. The user ID and transport settings together determine whether a connection can be established. After importing, check the server address, port, user ID, and any supplied TLS, Host, or path settings. The protocol name alone does not explain a failed connection; an incorrect system clock is also worth checking.
VLESS is a proxy protocol. Check its identity parameters separately from its transport settings. Selecting VLESS does not automatically configure all encryption and certificate options; protection such as TLS depends on the connection method. Use the server details you have and do not reuse settings from another protocol.
Trojan is commonly used with TLS and requires the correct server address, port, and password. If certificate verification is involved, make sure the server name and related settings match the server. Disabling certificate verification is not a routine fix; first check for a wrong name, an incorrect system clock, or certificate configuration issues.
Hysteria2 is a QUIC-based proxy protocol that depends on suitable UDP network conditions. Even with the correct address and authentication details, local UDP restrictions can prevent a connection. Set bandwidth options according to the actual service capacity; entering a higher value does not guarantee faster speeds.
WireGuard is a key-based tunneling protocol. Its configuration typically includes keys, endpoints, interface addresses, and routing scope. The routing scope determines which destinations enter the tunnel; a server address alone is not enough. A private key is sensitive: remove it before troubleshooting or sharing screenshots, and never share the full configuration publicly.
HTTP as a server type means an HTTP proxy; it is not simply a way to tell whether a destination URL starts with HTTP. This type of proxy may use CONNECT for supported tunnel requests, depending on the server. If authentication is required, enter the correct username and password.
SOCKS5 is a general-purpose proxy protocol. A server may require a username and password or impose other access restrictions. Support for UDP and other traffic depends on the server and client configuration; the protocol name alone does not tell you. SOCKS5 does not encrypt traffic by itself, so distinguish the proxy protocol from encryption provided by the app or service you use.
First check what a rule matches, then check the action at the end. example.com is used only to illustrate the syntax; it is not a service recommendation.
A rule is a configuration entry that selects an action based on a domain, IP address, or other criteria. Rules are usually evaluated from top to bottom, and the action for the first match is applied. Put specific criteria before broader ones to avoid an earlier rule taking precedence. Rule-based routing requires Config in Global Routing and the intended profile to be enabled.
DOMAIN matches the exact domain specified and does not automatically include all subdomains. For example, a rule for example.com does not also cover api.example.com. Use it when you need to target a specific hostname. Enter a domain, not a full URL with a path.
DOMAIN-SUFFIX matches the specified domain and its subdomains, making it useful for applying the same action to a group of services under one domain. For example, example.com can match api.example.com, but not every domain containing the word example. To handle a subdomain differently, place its more specific rule first.
DOMAIN-KEYWORD matches domains that contain the specified keyword, usually covering more than DOMAIN-SUFFIX. A short keyword can catch unrelated domains, so avoid adding broad matches based on guesswork. If traffic is routed incorrectly, first check whether a broad keyword rule appears earlier in the list.
GEOIP matches according to a region classification in an IP database. It does not identify a domain’s language or give an exact physical location. Content delivery networks and changes to the database can cause the same domain to produce different results over time. When troubleshooting, check the resolved IP and rule match rather than relying on the website name alone.
IP-CIDR matches IPv4 address ranges. The prefix length after the address defines the network range; for example, 192.168.0.0/16 describes a private address range, not a single device. Whether a domain request is resolved first depends on configuration options, so an address-range rule cannot replace all domain-based checks.
IP-CIDR6 matches IPv6 address ranges. Its prefix notation corresponds to IP-CIDR for IPv4, but the address format is different. IPv4 rules alone do not necessarily cover IPv6 connections to the same service. On dual-stack networks, check DNS results and the actions for both address types.
FINAL is the fallback used when none of the preceding rules match, and is usually placed at the end of the rule list. It determines how destinations without an explicit match are handled; it does not run another complete matching pass. Changing FINAL can affect many uncategorized requests, so first check whether a specific rule is missing before changing the fallback action.
PROXY sends traffic through a proxy, DIRECT connects directly, and REJECT denies the request. These keywords specify what happens after a match. They are not server protocols and should not be confused with the Proxy and Direct options in Global Routing. This site uses blue, green, and orange status dots to distinguish the three actions; configurations still require the English keywords.
Server entries determine where to connect; profiles determine how traffic is handled. Importing one does not mean the other is set up.
Subscribe is the entry point for adding or managing subscriptions you already have, which provide and update server entries. Use a valid link obtained from your own service provider, then check that the entries appear correctly after updating. A subscription update should not be assumed to replace all rules and DNS settings; confirm what the imported content actually contains.
Add Server is the entry point for adding server details. First choose the type that matches the information you have, then enter the address, port, and authentication settings. Available fields may differ by protocol; ask the source of the details about anything missing. After saving, return to Home and select the server. Saving an entry alone does not verify the connection.
A subscription is a data source that a client can read to retrieve and update a server list; it is not proof of app purchase. Subscription links may contain personal access credentials, so do not publish them or include them in full in troubleshooting screenshots. If an update fails, first check the link, network connection, and response instead of repeatedly changing server settings.
A profile organizes rules, DNS, and other connection options. It serves a different purpose from a subscription that only updates the server list. After importing a profile, confirm that it is enabled and that Global Routing is set to Config. Keep the original working profile before replacing it, so you can compare results without changing servers, rules, and DNS all at once.
Connection reachability, domain resolution, page loading, and download speed are different things. Test each separately.
DNS resolves domain names to IP addresses and is a prerequisite for accessing most network services. The result affects the destination IP and may also affect IP-based rule matches. If a domain will not open but a known address is reachable, check the resolution path first. Keep in mind that caching may temporarily preserve old results after settings change.
DNS over HTTPS (DoH) sends DNS queries over HTTPS. It changes how queries are transported; it does not automatically route all app traffic through a proxy or fix server issues on its own. Before setting it up, confirm that the resolver address is reachable, then compare it with the existing DNS setup by changing one variable at a time.
Latency is the response time measured for a particular test method and destination; it is not the same as download speed. A lower test result does not guarantee higher throughput for large downloads, and a timeout should be assessed against the reachability of the test destination. For a meaningful comparison, keep the local network, test method, and destination consistent so changes in conditions are not mistaken for server changes.
URL Rewrite processes matching URLs according to expressions. It is different from routing rules that select an outbound path. Whether a rule takes effect depends on its match scope and whether the request can be processed; a matching domain alone is not enough. For HTTPS content, understand the effects of certificate and trust settings separately, and do not enable a whole set of rules without knowing what they do.
If you imported details but cannot connect, check Home, Add Server, and Connectivity Test in that order. If traffic to a destination takes the wrong path, check Global Routing first, then the specific rules and FINAL. Change one relevant setting at a time and note what happens before and after.
For iPhone and iPad, see the App Store page for current system requirements. Interface items may move as the app or device changes; when looking up a term, check the screen and field context as well.