Official Manual / Glossary
Which English setting should you look up first? Identify whether it refers to an interface action, connection protocol, or rule policy, then read the relevant explanation. This page keeps the original English names, and each glossary card has its own anchor link.
Ready to get started? Follow the first-time setup guide. For complete rule examples, see the rules manual. These explanations do not replace the options currently shown in the app.
01 / Interface
Does a term always refer to the same feature? Not necessarily. Check the screen and context, especially when distinguishing the Config screen, Config mode, and policies in rules.
Where can you check the current connection? Home is the main place to view server entries, the current selection, and the connection toggle. Check the selected entry first, then check the toggle. A connected status indicates the tunnel state only; it does not confirm that a destination website is reachable. If something goes wrong, also check the test results, mode, and rules.
Why does access change after switching modes? Global Routing determines how traffic is handled overall. The interface terms Config, Proxy, and Direct refer to different modes. To route traffic according to your configuration, check Config. For troubleshooting, you can compare other modes temporarily, but restore your intended settings afterward so the test mode does not become your everyday setup.
Is Config a file or a mode? In the configuration management screen, it refers to viewing, editing, and selecting configuration files. In Global Routing, it means handling requests according to the active configuration. After editing a file, confirm that it is the one currently in use. Saving successfully does not by itself mean the rules are active.
Are these modes the same as rule policies? Proxy and Direct are modes in Global Routing for handling traffic through a proxy or connecting directly. PROXY and DIRECT, by contrast, are uppercase policy keywords in rule entries. When troubleshooting, note the mode before reviewing the rules. Avoid repeatedly editing the configuration file while traffic is not being routed according to it.
Why does a network change trigger a connection? On Demand triggers a VPN connection based on conditions such as the network; check the options in the app for the exact conditions. It answers “when to connect,” while rules determine “how to handle requests.” They serve different purposes. After making changes, test behavior on both Wi-Fi and cellular networks.
Where should you enter your existing connection details? Add Server opens the form for adding connection information, while Subscribe is the subscription type. When adding a server manually, choose the protocol that matches your existing parameters. To import a subscription, enter your own subscription URL and check the resulting entries. Do not enter a subscription URL in an individual server’s address field.
What does a successful test tell you? Connectivity Test checks connectivity using the selected method, and its results apply only to the conditions at the time of the test. To compare entries, use the same test method and network, then verify access to the actual destination. One failed test does not prove the parameters are invalid, and one successful test does not guarantee access to every service.
02 / Protocols
Can the protocol name tell you what values to enter? It identifies the parameter type, but not the specific values. Use your existing service details and check authentication, transport, and security settings one by one.
Why can’t you connect even when the address is correct? Shadowsocks also requires matching parameters such as the port, password, and encryption method. Any mismatch can cause the connection to fail. The encryption method is not a preference you can change freely. If your details include additional transport parameters, check those too; copying only the address and password may not be enough.
Is the UUID all you need? VMess uses a UUID and other identity parameters, but a complete connection also depends on the server address, port, transport, and corresponding TLS settings. With WebSocket, check associated fields such as the path and Host. Do not reuse a parameter set from another protocol just because the names look similar.
How should you understand VLESS security settings? VLESS uses a UUID to identify the user, but connection protection depends on the actual transport and security configuration, not the protocol name alone. Check TLS, the server name, and transport fields against your existing details. Even with the same address and UUID, mismatched associated fields can prevent a connection.
Why check both the password and server name? Trojan typically uses TLS and password authentication, but a correct password does not guarantee that certificate verification will pass. Check the port, TLS server name, and any certificate warnings. If you see a certificate error, first check the name and device time. Disabling verification should not be your routine fix.
Can HTTP and SOCKS5 be used interchangeably? They are different proxy protocols. Choose the type that matches the server, then check the port and authentication details, such as the username and password. The protocol name alone does not guarantee encryption in transit; that depends on the full configuration. A webpage URL is not a usable proxy configuration.
Why does WireGuard need several fields? It uses a key pair to establish an encrypted tunnel and also requires details such as the peer endpoint, tunnel address, and routing range. The public and private keys serve different purposes and must not be swapped. A private key is sensitive. If the connection fails, check each value against your existing configuration rather than generating replacements.
Why can network conditions affect Hysteria2 tests? Hysteria2 is based on QUIC, so the connection depends on UDP reachability as well as correct authentication and TLS settings. If the parameters appear correct but the connection fails, first distinguish an authentication issue from a reachability issue. Enter options such as obfuscation only when they are part of your existing service details.
03 / Rules & Policies
What makes up a rule? First identify the matching condition, then the policy to apply. The example domain example.com below is for syntax only; after reviewing it, check the order in your own configuration.
What does a rule do? A Rule maps request-matching conditions to a policy. Rules are usually checked from top to bottom, and the policy for the first match is applied. Place more specific exceptions before broader conditions. When troubleshooting, find the first matching rule rather than checking only the one you added most recently.
How do you match a single exact domain? DOMAIN matches a domain exactly. For example, specifying example.com does not automatically include www.example.com. Enter only the domain in the condition—no https://, port, or webpage path. If you need to cover subdomains, consider whether DOMAIN-SUFFIX is more appropriate.
DOMAIN,example.com,DIRECTHow do you match both a root domain and its subdomains? DOMAIN-SUFFIX matches at the domain suffix boundary. For example, example.com matches the domain itself and subdomains such as www.example.com, but not any domain that merely contains the same string. If a particular subdomain needs a different policy, place its specific rule before this broader one.
DOMAIN-SUFFIX,example.com,PROXYHow do you match a domain containing a particular string? DOMAIN-KEYWORD checks whether a domain contains the specified string, which may match across different domain suffixes. It is broader than an exact domain or suffix condition and may match destinations you did not intend to include. Before using it, list examples of expected and unexpected matches.
Does GEOIP determine a website’s language? No. It matches a destination using the location associated with its IP address in a geolocation database, not the webpage language or the visitor’s location. The database may differ from actual network deployment, and changes to the destination address can affect results. When troubleshooting, check the actual resolved address and which rule matched.
GEOIP,CN,DIRECTHow do you specify a range of destination addresses? IP-CIDR matches IPv4 ranges, while IP-CIDR6 matches IPv6 ranges. The prefix length after the slash determines the range. A prefix that is too broad will include more addresses; a similar-looking address prefix alone does not prove the match is correct. If the destination has both address types, also check which address family is actually in use.
IP-CIDR,192.0.2.0/24,DIRECT
IP-CIDR6,2001:db8::/32,DIRECTCan USER-AGENT identify every app? It matches readable HTTP User-Agent information; it does not identify requests by app identity. The relevant information in encrypted requests is usually not directly readable, so matching depends on what is visible in the request. Before writing a rule, confirm that the request contains the field you need. Do not treat USER-AGENT as a universal way to route traffic by app.
What happens if none of the earlier rules match? FINAL specifies the final policy and is usually placed at the end of the rule list. If you put it before specific rules, later conditions may not get the expected chance to match. Choose DIRECT or PROXY based on your own configuration goals rather than treating an example as a one-size-fits-all answer.
FINAL,DIRECTWhat happens after a rule matches? PROXY sends the request through a proxy, DIRECT connects directly, and REJECT denies the request. The proxy endpoint used also depends on the current selection and configuration. These are handling outcomes, not matching conditions. Using REJECT incorrectly can block access, so confirm the matching scope first.
04 / Subscription & Configuration
Why check the configuration after a successful import? A connection entry describes “where to connect,” while a configuration file describes “how to handle requests.” They are not interchangeable.
What does a subscription URL contain? It provides information for importing or updating connection entries. The format and update results depend on your existing service, and it may not include a complete set of routing rules. A URL may contain personal access credentials, so do not include it in public screenshots, logs, or shared text. After updating, check the entries and run a connectivity test.
Does an entry’s name tell you whether it works? No. A server entry records parameters such as the address, port, protocol, and authentication details; its display name is just a label for identification. Multiple entries may point to the same endpoint. Before making changes, record the existing parameters. Afterward, check which entry is selected so you do not test a different one by mistake.
How is a configuration file different from a subscription? A configuration file organizes general settings, rules, and other processing logic; common section names include General, Rule, Host, and URL Rewrite. A connection subscription is mainly for managing connection details. Saving a file and selecting it for use are separate actions. Keep a recoverable copy before making changes, then verify the effect of each change.
Are URL Rewrite and DOMAIN rules the same thing? No. URL Rewrite applies rewrites and other actions based on URL conditions, while ordinary routing rules determine the connection policy. The path, query parameters, and scheme in a URL may affect matching, and encrypted requests may limit what can be processed. If you only need to choose between a direct or proxied connection, first check whether an ordinary rule is enough.
05 / DNS & Network
Are resolution, connection, and authentication part of the same step? No, they are separate stages. First identify where the problem occurs, then change the relevant setting. Avoid changing several things at once, or it will be harder to tell what fixed the issue.
Does a domain failing to load always mean there’s a DNS problem? No. DNS resolves a domain name to an IP address, but the connection can still fail during the connection, authentication, or rule-handling stage. First check whether the expected address was returned, then investigate the connection. After changing DNS, account for caching and keep the test destination consistent. One refresh is not enough to draw a conclusion.
Is the Host section the same as Host in transport settings? No. The Host section in a configuration file is for static domain mappings, while HTTP Host in transport parameters is a request field. They serve different purposes. A static mapping affects resolution and may need updating if the destination address changes. When troubleshooting, first identify which type of setting you are looking at.
Does a lower number always mean faster access? No. Latency is response time under specific test conditions; it is not throughput and does not represent the experience with every website. Compare using the same test method and network, then verify actual access. A brief fluctuation or single timeout does not indicate long-term performance. Interpret the result alongside the conditions under which it was measured.
Why might the server address and SNI differ? TLS protects the connection, while SNI sends the server name during the handshake. The connection endpoint can be an address, while the name used for verification must match the service configuration and certificate. Use the values from your existing settings; do not swap them arbitrarily. If you see a certificate error, check the name, device time, and certificate status before deciding what to do next.
First describe the problem in one sentence: did adding the details fail, can the connection not be established, or are you connected but having trouble accessing a destination? Note the relevant interface term, protocol, Global Routing mode, and matching rule, then change one condition at a time. Remove sensitive information such as subscription URLs, passwords, and private keys from your notes.
For step-by-step instructions, read the tutorial. To check rule order, see the rules manual. For questions about purchasing, restoring purchases, or opening the app for the first time, see Troubleshooting. Check the App Store page for system requirements and device compatibility.
Back to glossary categories ↑