Interface Terms, Protocols & Rule Keywords
Before changing settings, distinguish where an action takes place, which protocol handles the connection, and which policy a request matches. This page explains terms in five categories. English names are kept as shown in the app; browse by category or jump to a term using its anchor.
Interface terms identify where to perform an action or show an overall status. In particular, Config, Proxy, and Direct under Global Routing are not the same as configuration file names or policies in rules.
Home shows the server list, current selection, and connection status. It is the starting point for routine connection checks. A listed entry only means its details have been saved; it does not mean the server is available or connected. When troubleshooting, check the selected entry and the connection toggle separately.
Global Routing determines the overall routing mode: Config, Proxy, or Direct. To route traffic by rules, first check that Config is selected. If the overall mode is not what you expect, changing a single rule may not produce the intended result.
As a Global Routing option, Config processes requests using rules and related settings in the current configuration file. It does not mean all requests go through a proxy: requests matching DIRECT can connect directly, while those matching REJECT are blocked. Also check which configuration file is active.
Proxy is the proxy mode in Global Routing. It routes traffic through the proxy path overall rather than applying ordinary rules individually. It is a different level from the uppercase PROXY policy in a rule. When checking a connection, make sure the selected server and its authentication and transport settings are correct.
Direct is the direct mode in Global Routing. Connections are not routed through the selected proxy server. Direct does not bypass DNS, system routing, or network conditions. Access to a destination still depends on the device's network and the destination service's status.
Add Server is the entry point for manually adding a server. Choose a type based on the details you have, then enter the address, port, and required authentication fields. Requirements vary by protocol; Password, UUID, and keys are not interchangeable. Once the details are entered, select the entry and test the connection.
A protocol defines how the client and server exchange data. The protocol, authentication, transport, TLS, and other settings must match as a set. The protocol name alone does not indicate speed, latency, or availability.
Shadowsocks is an encrypted proxy protocol. Common settings include the server address, port, encryption method, and password. The encryption method must match the server; a mismatch can prevent communication even when the address and password are correct. Check any additional transport settings against the details you have.
VMess is a proxy protocol that identifies users with parameters such as a UUID. Connections may also use different transport methods and TLS settings. A correct UUID does not guarantee that the other settings are right; check the transport type and any required Host, Path, and certificate settings.
VLESS is a lightweight proxy protocol that commonly uses a UUID for identification. The protocol itself does not encrypt application data. Transport protection depends on mechanisms such as TLS. Do not assume VMess field conventions apply to VLESS; use the settings provided for the server.
Trojan typically carries proxy traffic over a TLS channel and uses Password authentication. The server address and the name used for certificate verification may serve different purposes. If the connection fails, check that Password, SNI, and the certificate match. Disabling certificate verification is not a recommended routine fix.
Hysteria2 is a QUIC-based proxy protocol that uses UDP for communication. Authentication, TLS, and other connection settings must match the server, and the network must allow the required UDP traffic. A successful TCP connection test does not prove this connection will work.
WireGuard is a key-authenticated tunneling protocol. Configuration usually includes a local private key, peer public key, Endpoint, and address or routing settings. Public and private keys serve different purposes and must not be swapped. A private key is sensitive; remove it before sharing a configuration or troubleshooting details.
As a server type, HTTP means an HTTP proxy; it does not mean the destination website can only use HTTP. Accessing an HTTPS destination typically uses CONNECT to establish a tunnel. Whether the proxy connection itself is protected by TLS depends on the selected type and settings; an HTTPS destination address alone does not indicate this.
SOCKS5 is a proxy forwarding protocol that can use a username and password if the server requires them, but it does not encrypt traffic by itself. UDP forwarding requires support from the client settings, server, and network. Working TCP access does not mean UDP requests will work the same way.
Rules are usually checked from top to bottom, and the policy for a matching rule is applied. Keywords such as DOMAIN-SUFFIX specify what to match; PROXY, DIRECT, and REJECT specify what to do. They are not interchangeable.
DOMAIN-SUFFIX,example.com,PROXYDOMAIN-SUFFIX is the type, example.com is the match value, and PROXY is the policy. This example illustrates the syntax; it is not a recommendation to add the rule to your configuration.
DOMAIN matches the exact domain specified, such as example.com. It does not automatically include www.example.com. Use it when you need to handle a single hostname. If a service uses multiple subdomains, list them separately or consider another match type after confirming its scope.
DOMAIN-SUFFIX matches the specified domain and its subdomains, such as example.com and api.example.com. It recognizes domain boundaries rather than searching for arbitrary text. Use it to apply one policy to a domain and its subdomains, but check whether an earlier rule already matches the request.
DOMAIN-KEYWORD matches domains that contain a specified keyword, so its scope is usually broader than a suffix match. A short keyword may match unrelated domains. Check the impact before adding one, and avoid using a short fragment in place of a clearly defined domain.
GEOIP matches a destination IP based on the country or region recorded in an IP geolocation database; it does not identify the user's location or a website's language. Database results may not match the region associated with a website's brand, and a CDN may return different addresses. Check the actual resolution results to understand a match.
IP-CIDR matches an IPv4 address range using CIDR notation, such as 192.0.2.0/24. The number after the slash is the network prefix length, not a port. A longer prefix usually covers a smaller range; before changing it, confirm that the target address belongs to that range.
IP-CIDR6 matches an IPv6 address range, such as 2001:db8::/32. IPv6 ranges are handled separately from IPv4 ranges. A domain may resolve to both types of address; adding only an IPv4 rule does not give IPv6 connections the same policy. Check the address used by the connection.
FINAL sets the final policy for requests that did not match earlier rules and is usually placed at the end of the rule list. It takes no domain or address match value, for example, FINAL,DIRECT. Placing it before specific rules may prevent those rules from matching as intended.
PROXYPROXY is a rule policy that sends matching requests through the proxy path. It is not a server address or protocol name. The actual egress route depends on the current selection and configuration; entering PROXY does not create server details.
DIRECTDIRECT is a rule policy that sends matching connections without routing them through a proxy server. It does not disable all network handling or guarantee that a destination is reachable. DNS resolution, system network status, and the destination service can still affect the result.
REJECTREJECT blocks matching connections; it does not precisely remove an element from a page. If a domain hosts different types of content, rejecting the domain may also affect normal features. After applying the policy, check actual requests. Rejecting connections is not the same as filtering content.
Confirm what imported content is for before choosing where to import it. Server entries provide connection details; configuration files organize rules and settings. Updating a subscription does not mean the active configuration has changed.
Subscribe is used to import or update existing subscription content. What it contains depends on the subscription format and the data returned. Get the subscription URL from your provider and keep it confidential; it may contain sensitive information. If an update fails, check the URL, network, and response format. Do not share the full URL when asking for help.
A Server is a set of server details, usually including the protocol, address, port, and authentication information. It is also commonly called a node. The display name is only a label and is not used for authentication. Two entries with the same name may have different addresses, protocols, or certificate settings.
Config can also refer to the configuration file and related interface for managing rules, DNS, and other settings. Distinguish this meaning from the Config mode in Global Routing by context. After saving or importing a file, check which item is active. Updating a subscription that primarily contains server details does not also update the rule file.
Settings can affect resolution paths, connection triggers, or data sync. When troubleshooting, change one category of settings at a time and record the original values. The available options and their names are as shown in the app.
DNS resolves domain names to IP addresses, a prerequisite for many network connections. Changing DNS settings can affect returned addresses and subsequent rule matching, but it does not change server authentication details. When troubleshooting, distinguish resolution failures from connection failures and certificate verification failures.
View DNS settings →On Demand is a connection mechanism that lets the system start a connection when specified conditions are met, reducing the need to toggle the connection manually. It does not mean the server is always available. If connections keep starting automatically, check the trigger conditions and current network, not just the toggle state.
View On Demand settings →Connectivity Test checks whether a connection is available. Results depend on the test method, target, and current network conditions. Latency is not download speed, and a successful probe does not prove that every destination or UDP request is reachable. For meaningful comparisons, use the same test method.
View Connectivity Test and Ping →URL Rewrite changes request URLs based on matching conditions, such as modifying a request address or applying a related rewrite. It is different from routing rules that determine the connection's egress path. Its scope depends on request visibility and configuration; adding a domain rule alone does not mean encrypted request content can be rewritten.
iCloud is a system service for syncing app data. Confirm which items are synced in the app; syncing depends on your account, system permissions, and sync status. iCloud serves a different purpose from App Store purchase records. Before switching devices, check that syncing is complete; enabling sync does not guarantee all data has been backed up.
View iCloud sync information →