Look up interface terms, protocols, and rule keywords. First distinguish where a setting is configured from which rule handles the traffic, then check your own configuration.
01 / Interface
Interface labels retain their original English names. When a term appears both as a screen name and a mode option, interpret it in context.
Home is the main screen for viewing the server list, selecting the active server, and controlling the connection. Before connecting, check the selected entry and then review Global Routing. An enabled connection switch only means the connection feature is on; it does not confirm that every destination is reachable.
Config is both the screen for managing configuration files and the English label for the Config mode in Global Routing. On the screen, you can select and edit files; the mode processes traffic according to the active configuration rules. Importing a file alone does not select it or mean that traffic is being routed by it.
Global Routing determines how traffic is handled overall. The three common modes are Config, Proxy, and Direct. Config routes traffic according to rules, Proxy uses the proxy path, and Direct uses the direct path. If rules are not taking effect, first check whether Config is selected.
On Demand triggers connection behavior when configured network conditions are met, making it useful for managing connections based on the network environment. It does not determine which rule handles a domain or fill in server details. To troubleshoot automatic connections, check both the conditions and the current connection status.
Add Server saves server details you already have as a connection entry. The protocol determines which fields are required; the address, port, authentication details, and transport settings should match the server information. Saving only creates the entry—test it and verify the connection separately.
Connectivity Test checks whether a server is reachable on the current network. Results depend on the probe method, network path, and server response, so they are not a ranking of web browsing speeds. Even if the test succeeds, open the destination you actually need and verify resolution, connection, and content loading.
DNS resolves domain names to IP addresses and is an important part of accessing a domain. A resolution failure can stop a connection before it is established, while successful resolution does not guarantee that the destination service is reachable. Before changing DNS, note the original settings and retest the same destination to avoid changing multiple variables at once.
02 / Protocols
A protocol describes how a client and server communicate; it is not a speed tier. The descriptions below assume you already have your own server details.
Shadowsocks establishes a proxy connection using an encryption method, password, and other parameters. Check the server address, port, encryption method, and password together, and follow the server details for any additional settings. Even if the address is reachable, a mismatch in authentication or encryption can cause requests to fail.
VMess uses a user ID or similar parameters for authentication and can work with different transport methods. After importing, check the address and port as well as the user ID, transport path, and related settings such as TLS. Do not copy fields from another protocol wholesale; identically named fields may have different requirements.
VLESS authenticates with a user ID. Its security depends on the transport and encryption settings in use, not just the protocol name. Check the identity parameters, transport method, and related security options against the server details. Whether an additional field is required depends on the specific configuration at both ends.
Trojan typically uses TLS for transport and a password for authentication. Along with the address, port, and password, check that SNI matches the certificate domain. If certificate validation fails, first check the domain, device time, and server certificate; disabling validation should not be a routine workaround.
Hysteria2 is based on QUIC and depends on a working UDP path, along with matching authentication and TLS settings at both ends. When troubleshooting, distinguish incorrect server details from a network that does not support the required communication path. Setting bandwidth-related parameters does not guarantee that speed; actual performance depends on both endpoints and network conditions.
WireGuard creates an encrypted tunnel using public and private keys and peer configuration. Its parameters differ from a simple address-and-password setup and typically include a local key, peer public key, endpoint, and address ranges. A private key is sensitive and should not appear in public screenshots, logs, or support requests.
03 / Rule keywords
The keyword defines what to match; the policy at the end of the line defines what happens after a match. example.com in the examples is for syntax illustration only.
DOMAIN matches an exact, complete domain name—for example, to specify how to handle only example.com. It does not automatically cover subdomains such as www.example.com. To match both the root domain and its subdomains, consider DOMAIN-SUFFIX rather than guessing domain prefixes one by one.
DOMAIN,example.com,PROXY
DOMAIN-SUFFIX matches the specified domain and its subdomains, making it useful for applying one policy across a domain hierarchy. For example, example.com can match www.example.com, but it does not match every domain that happens to contain that string. Its scope differs from a simple substring match.
DOMAIN-SUFFIX,example.com,PROXY
DOMAIN-KEYWORD matches a specified string anywhere in a domain name; the string does not need to form a complete domain level. Its scope is generally broader than DOMAIN or DOMAIN-SUFFIX. Check for unintended matches before using it, and avoid short, common strings when a specific domain would be clearer.
DOMAIN-KEYWORD,example,PROXY
GEOIP matches a destination based on its regional assignment in an IP geolocation database—not the domain suffix or user's location. Content delivery and changes in IP geolocation can affect results. For a specific domain that needs consistent handling, check more specific domain rules first.
GEOIP,CN,DIRECT
IP-CIDR matches IPv4 address ranges using CIDR notation. The number after the slash is the network prefix length, not a port. The example applies DIRECT to the 192.168.0.0/16 range. Confirm the actual network plan before adding a range so you do not unintentionally cover addresses that need a different policy.
IP-CIDR,192.168.0.0/16,DIRECT
IP-CIDR6 matches IPv6 address ranges and cannot be replaced with an IPv4 IP-CIDR rule. On a dual-stack network, the same domain may return both address types. If an address rule does not match, check whether the connection is using IPv4 or IPv6, then review the corresponding range.
IP-CIDR6,fc00::/7,DIRECT
USER-AGENT matches requests using a readable HTTP User-Agent field; it does not route traffic based on the name of an app on the device. Fields in encrypted requests are generally not directly readable, so this keyword does not apply to every connection. Check the protocol and processing conditions first; do not change certificate settings blindly just to match this rule.
FINAL is the fallback policy used when none of the preceding rules match and is usually placed at the end of the Rule section. It has no domain or address condition; specify the final policy directly at the end of the line. If FINAL appears too early, later specific rules cannot serve as intended before the fallback.
FINAL,DIRECT
04 / Policies and order
PROXY, DIRECT, and REJECT are rule outcomes. They operate at a different level from Proxy and Direct in Global Routing.
Rules in the Rule section are checked from top to bottom. The first matching rule determines the outcome; more specific rules do not automatically take priority. Put exceptions that need priority before broader conditions, and place FINAL at the end. When verifying, also confirm that the intended configuration file is active.
DOMAIN,example.com,DIRECT
DOMAIN-KEYWORD,example,PROXY
FINAL,DIRECT
PROXY is the proxy policy in a rule, sending matching traffic through the proxy path. It does not include a server address, password, or subscription details, nor does it guarantee that the selected server is reachable. If a matching PROXY rule still cannot connect, check the selected server, authentication parameters, and current network.
DIRECT sends matching traffic over the current network's direct path, without using a proxy server. DNS, the destination service, and local network conditions can still affect the result, so DIRECT does not mean the request is guaranteed to succeed. In Config mode, DIRECT applies only to traffic matched by that rule.
REJECT blocks a matching request from establishing a connection; it is an explicit rejection, not a server failure. If a page is missing resources or some features fail, check for an overly broad reject rule. When testing a change, narrow the match conditions first instead of deleting all rules.
05 / Subscription and configuration
Server details determine where to connect; a configuration file determines how traffic is handled. Importing, updating, selecting, and connecting are separate actions.
Subscribe retrieves and updates server details using a subscription URL you already have; the contents are determined by the URL's provider. Updating a subscription does not connect to a server or update rules in Config. Subscription URLs may contain access credentials, so remove all sensitive information before sharing them for support.
SERVER is a connection entry built from server details, typically including an address, port, protocol, and authentication parameters. It is also commonly called a node in Chinese-language documentation. The entry name is only a label for identification and does not verify the actual location or connection quality. Check the parameters, run a test, and make a real request to determine whether it works.
.conf is a text file for organizing configuration content, with sections such as General, Rule, Host, and URL Rewrite. It serves a different purpose from a server subscription; the file's presence alone does not mean traffic is being routed by its rules. Keep a copy of the original before editing. After saving, confirm the selected file in Config and then check Global Routing.
URL Rewrite rewrites or redirects processable request URLs based on matching expressions; it does not replace routing policies in Rule. The example redirects a matching HTTP URL to HTTPS, with 302 as the redirect status code. Check that the request meets the processing conditions and that the destination URL is correct.
^http://example\.com https://example.com 302
Latency is the time from a probe request to its response in a particular test. It is not the same as bandwidth, download speed, or full page load time. Results are easier to compare when the probe method and network conditions are similar. Consider repeated tests and real use of the destination instead of choosing a server based on a single measurement.