First distinguish interface controls, protocol names, and rule policies; then check the specific settings. This page groups common terms into five categories. English terms retain the spelling used in the app and configurations, with explanations of their purpose, scope, and common points of confusion.
This page assumes you already have your own subscription or server details and explains how to use the client. For step-by-step instructions, read the User Guide. For the full context behind configuration settings, read the Configuration Manual.
Whether the connection is on, how traffic is handled, and which server is selected are three separate questions.
Home is the main place to view existing servers, the current selection, and connection status. Seeing a server entry only means its details have been imported; authentication, network access, and the remote service have not necessarily been verified. When troubleshooting, first note the selected entry and connection status. Avoid switching settings while assessing the result.
Global Routing selects the overall mode for handling traffic: Config, Proxy, or Direct. It is not a connection toggle and does not fill in missing server details. Changing this setting can affect how existing rules are applied, so check the current mode before reviewing rules.
The three modes are configuration, proxy, and direct. Config handles traffic according to the current configuration; Proxy primarily routes traffic through the proxy; Direct primarily connects directly. Actual system traffic and exceptions depend on your settings. These capitalized interface labels are not the all-caps policy keywords at the end of rule lines.
On Demand triggers connection behavior based on configured network conditions, such as Wi-Fi or cellular. It does not automatically repair a server when access fails. If the connection comes back after you disconnect manually, check the trigger conditions and system status instead of repeatedly toggling the connection.
Add Server is where you enter details for a server you already have. The protocol, address, port, and authentication fields must come from the same valid set of details; some types also require transport and TLS settings. Saving confirms only that the entry was created. Test connectivity and verify the result through actual access.
Settings is where you view and adjust client settings; do not confuse it with configuration files in Config. When troubleshooting, record the original value first, then change one setting relevant to the issue at a time. Changing multiple settings at once makes results harder to reproduce and identify.
The protocol type should match your existing server details. The name alone does not indicate speed, reliability, or network compatibility.
Shadowsocks is a proxy protocol. Common parameters include the server address, port, encryption method, and password. The encryption method must match the remote configuration; a correct address alone does not make the setup complete. If the connection fails after import, check each field against the original details rather than changing authentication or encryption settings at random.
VMess uses the corresponding identity parameters and can be paired with different transport settings. Matching identity details do not mean the transport path, Host, or TLS settings also match; check these fields together. An incorrect device time can also affect authentication, so confirm that the system time is correct when troubleshooting.
VLESS authentication details must be used with the corresponding transport settings; it is not simply a matter of changing the protocol label. The protocol name alone does not specify the connection's encryption, so check related settings such as TLS. When importing an existing entry, retain its transport parameters and server name.
Trojan is commonly used with TLS. Check the server address, port, password, and server name used for verification. The connection address and the certificate name may serve different purposes, so do not assume they should be identical. If you encounter a certificate error, first check the name, device time, and certificate requirements.
Hysteria2 is a QUIC-based proxy protocol, so connectivity depends in part on UDP availability. A complete set of server parameters may still time out if the current network restricts the required transport. The protocol name does not guarantee throughput; consider network conditions, authentication settings, and actual access results.
WireGuard is a tunneling protocol that authenticates peers using keys. Its configuration includes a local address, keys, and peer details. Public keys, private keys, and preshared keys serve different purposes and cannot be substituted for one another. Hide private keys and other sensitive details when sharing troubleshooting information. Check that the address range and routing settings match your existing configuration.
HTTP and SOCKS5 are distinct proxy protocols; the same address and port do not make them interchangeable. Check the specific configuration to determine whether authentication or additional encryption is required and what types of traffic are supported. Choose the type that matches your existing server details rather than inferring its capabilities from the name.
Keywords answer “what matches”; policies answer “what happens next.” Rule order determines which rule takes effect first.
[Rule] is the rules section of a configuration. Rules are checked from top to bottom, and the policy for the first matching rule is applied. A broad rule placed first can prevent more specific rules below it from taking effect. Before editing, confirm that Global Routing is set to Config and back up the current configuration.
DOMAIN matches an exact domain name; DOMAIN-SUFFIX matches the specified domain and its subdomains. A suffix is not a webpage path or an arbitrary string search. To handle one specific hostname, consider an exact match first to avoid including the entire domain range.
DOMAIN-KEYWORD matches a string contained in a domain name, which may cover more domains than expected. The same string can appear in unrelated domains, so this is not the same as matching a domain suffix. When using a reject rule, check the match records carefully to avoid blocking legitimate requests.
IP-CIDR and IP-CIDR6 match IPv4 and IPv6 address ranges, respectively; the number after the slash indicates the prefix length. They match address ranges, not domain text. A service may use multiple address ranges, so do not assume every request will match based on a single DNS lookup.
GEOIP matches against an IP geolocation database; it does not indicate the actual location of the device or user. Database location and service operating location may differ, and distributed services can use addresses in multiple regions. To understand a routing result, check the destination address, database information, and rule order.
FINAL sets a fallback policy for traffic that did not match any earlier rule and is usually placed at the end of the rules section. It does not mean “try connecting one more time” or automatically select a route based on speed. Changing it affects all traffic not covered by earlier rules, so decide on the fallback destination before editing.
These three all-caps terms are rule policies: PROXY sends traffic through a proxy, DIRECT connects directly, and REJECT blocks matching traffic. They are not server protocol names and do not provide authentication details. Read each policy together with its rule condition to understand why a request is handled that way.
[Rule]
DOMAIN-SUFFIX,example.com,PROXY
IP-CIDR,192.168.0.0/16,DIRECT
FINAL,PROXYThe server list, routing configuration, and App Store purchase history store different information and are not interchangeable.
A subscription is typically an address used to retrieve or update a set of server entries, assuming you already have a valid subscription of your own. It may not include complete routing rules; importing a subscription and enabling Config are separate actions. Subscription URLs may contain access credentials, so do not show them in full in public screenshots, logs, or support requests.
A server entry stores details such as the remote address, protocol, port, and authentication. Entries in the list are also often called nodes. The display name is just a label; it does not confirm the server's location, speed, or status. Check the actual settings, connectivity, and service conditions rather than relying on the name.
Configuration files hold settings such as general options and rules and are managed separately from the server list. Config in the interface refers to file management, while Config in Global Routing means handling traffic according to the configuration. After importing a file, check which configuration is active.
[General] is the general settings section of a configuration. It may include DNS, system traffic handling, and addresses that bypass the proxy. It serves a different purpose from [Rule]; do not put rule lines in this section. When copying an excerpt, check its section, field syntax, and effect on existing settings.
Scan QR Code reads configuration data from a QR code; the code itself is only a data carrier. The result may be a server entry or an address that needs further handling, so first check what type of content it contains. After importing, verify the protocol and settings. Treat QR codes containing authentication details as sensitive information.
Purchased Items in the App Store is where you can find your original purchase. When changing or restoring a device, first check the account used for the purchase. Purchase history is not a backup of client settings, and getting the app again does not automatically restore servers or rules. Check the App Store listing for purchase eligibility on iPhone and iPad.
First determine whether the issue is with DNS resolution, connectivity, authentication, or rules. A single test result cannot verify the entire connection path.
DNS resolves domain names to addresses and is one step in the connection path. Successful resolution does not confirm server authentication, and a resolution failure does not necessarily mean the proxy server is offline. If only some domains have issues, check DNS settings, returned addresses, cache, and relevant rules separately instead of changing every server entry.
Connectivity Test checks connectivity using the current test method. Results depend on the test target, network, and server status at the time. A passing test does not guarantee that every website or request type will work; if a test fails, check the logs for context. Keep the test method and network conditions consistent when comparing entries.
Latency is the time a test request takes to receive a response under specific conditions; it is not the same as bandwidth. A lower value does not guarantee better large-file transfers or long-lived connections. Packet loss, congestion, and remote server load also affect performance. When choosing among existing servers, consider repeated tests and actual access rather than ranking them by a single result.
Data shows traffic records and related information, helping you check destinations, rules, and connection behavior. What is counted depends on the view; the numbers should not be treated as the service's billing totals. When troubleshooting, compare records from the same operation. Hide destination addresses, authentication details, and other sensitive information before sharing.
TLS secures a transport connection. The server name, certificate trust requirements, and device time all affect verification. A connection address responding does not mean certificate verification will succeed. If an error appears, check the name and certificate requirements in the original configuration; do not make bypassing verification your default troubleshooting step.
VPN configuration permission allows Apple’s operating system to let a client establish a network tunnel; a system confirmation may appear the first time you connect. Granting permission only means the system allows that configuration to be created; it does not prove an existing server can connect. Even when the system shows a connected status, check DNS, routing policies, and actual access.
If an imported entry does not work, narrow down the cause in this order: server settings → VPN configuration permission → Global Routing → DNS → specific rules. Change one condition at a time and keep a restorable copy of the original configuration so you can link each result to a specific change.
Available fields may vary depending on the device and the app’s current state; follow what the app displays. This page explains terminology and does not replace the settings provided for your existing service. Check the App Store listing for system requirements and purchase eligibility.