Review each setting—from Global Routing to Settings—by what it does, where to find it, how to configure it, and what to watch for.
Focused on iPhone and iPad. Have your existing subscription or server details ready before choosing how to handle traffic. Feature toggles cannot replace valid connection settings.
The connection toggle controls whether a connection starts. Global Routing determines how requests are handled once it is running. These are separate settings.
In Home, find Global Routing and choose Config, Proxy, or Direct. These options describe how traffic is handled; look for the English labels in the app. Before choosing a mode, confirm that a usable server is selected. For rule-based routing, also check that the intended configuration is active in Config.
| Option | How it handles traffic | When to use it | What to check |
|---|---|---|---|
| Config · Configuration | Handles requests according to the rules and policies in the active configuration. | When different domains or addresses need different policies. | Whether the configuration is active, rule order, policy names, and policy targets. |
| Proxy | Routes requests through a proxy instead of applying Config’s usual rules one by one. | To temporarily check whether the selected server can reach a specific destination. | Server settings, the selected server, the destination, and the underlying network. |
| Direct | Handles requests as direct connections. | To compare access over your local network and narrow down an issue. | Your local network and DNS; this does not turn the system connection on or off. |
If you already have a configuration, select Config and try one destination expected to connect directly and another expected to use a proxy. Then check the corresponding request records. If a test responds but the page will not load, temporarily switch to Proxy and test the same destination again. If Proxy works but Config does not, check the rules, policies, and DNS results first. If neither works, check the server and local network. This comparison can help narrow down the cause, but a single success or failure is not conclusive.
When testing is complete, restore your original Global Routing selection. Direct does not disable the system VPN configuration. To stop the client connection completely, use the connection toggle in Home and check whether On Demand could start it again.
Read about Global Routing in the full handbook →Rules determine which requests match; policies determine what happens to matching requests. Check the match first, then the route.
Rules are usually managed in Config as part of a configuration. Open the active configuration and check its rules and their order. Save a copy before making changes. Rules are generally evaluated in order, so put more specific conditions before broader ones. FINAL usually goes at the end to handle requests that did not match earlier rules. Adding rules will not have the expected effect if that configuration is not active or Global Routing is not set to Config.
DOMAIN matches a specific domain, DOMAIN-SUFFIX matches a domain suffix, and DOMAIN-KEYWORD matches a keyword in the domain. To change routing for one destination, prefer a narrowly defined condition. A broad keyword may affect other destinations.
IP-CIDR and IP-CIDR6 match address ranges; GEOIP matches based on IP geolocation data. Whether USER-AGENT applies depends on whether the relevant request information is available. Do not assume it can identify traffic from every app by name.
DOMAIN-SUFFIX,example.com,PROXY
IP-CIDR,192.168.0.0/16,DIRECT
FINAL,PROXYThis syntax example sends requests matching the example.com suffix to PROXY, requests matching the specified local address range to DIRECT, and all remaining requests to the PROXY specified by FINAL. It illustrates rule structure; it is not a complete configuration for every network. PROXY, DIRECT, and REJECT specify proxy, direct, and reject handling. If a rule refers to a custom policy name, it must exactly match the name defined in the configuration.
After changing a rule, make the request again and check which rule matched and which policy handled it. A matching rule does not prove that its target server is usable; likewise, a usable server does not mean every destination will match as expected. DNS resolution, caching, and existing connections can affect retests. Keep the destination and test conditions consistent where possible.
Server entries store connection settings. Subscribe manages a group of entries, while Config primarily manages rules and related settings. They serve different purposes.
In Home, tap Add Server to add an entry. Choose the protocol that matches your provider’s details, then check the address, port, authentication fields, and transport settings. Shadowsocks, VMess, VLESS, Trojan, Hysteria2, WireGuard, and other protocols use different fields; do not transfer settings from one protocol to another. Check UUID, password, encryption method, TLS, SNI, Host, and path against your existing details rather than guessing from their names.
If you use Scan QR Code, first make sure the code comes from your own existing service details. After importing, open the entry and check the protocol and key fields, then select it for testing. Seeing an entry in the list only means a record was created; it does not confirm that the server is online or that its authentication and transport settings are correct.
Choose Subscribe from the add menu, enter and save your existing subscription URL, then update it. Afterward, check the group, entry names, and any changes in the number of entries, and confirm that the selected server is still available. Updating a subscription refreshes the server details it provides; it does not replace all rules in the active Config. Changes on the service side may alter entry names, addresses, or settings, or remove a previously selected entry.
If an update fails, first check that the URL is complete and the subscription is still valid, then confirm that your current network can reach it. You can test on another network while keeping the original configuration. Repeatedly deleting the entire subscription is not a substitute for troubleshooting. Subscription URLs often contain access credentials; hide the full URL in screenshots, diagnostic files, and public support requests.
Before changing rules or DNS, back up the active configuration and label the copy clearly. After importing another configuration, confirm which file is active and whether its policy references match your current servers or policy groups. Backup files may contain server addresses and authentication details, so store them somewhere you control. Restoring the app alone may not restore all local configuration.
Follow Getting Started for your first import and connection →On Demand controls when to connect; Global Routing controls how requests are handled after connecting. Enabling one does not replace the other.
In Settings, find On Demand and check conditions such as Wi-Fi or Cellular against your needs. Available options depend on the app interface and your device’s network capabilities. First connect manually from Home and verify access to a destination. Once you know the selected server and configuration work, enable the desired conditions. This helps avoid mistaking incorrect server settings for a trigger issue.
Start with one network condition for automatic connection. Save it, switch to that network, and check the connection status and actual access. If you enable several conditions at once, it is harder to tell which one triggered the connection. On iPad, troubleshoot according to the device’s actual network capabilities; do not test cellular scenarios on a Wi-Fi-only device.
If the connection starts again after you turn it off manually, check the On Demand conditions before repeatedly removing the system VPN configuration. For a direct-connection comparison, temporarily disable On Demand, then turn off the connection toggle in Home. Restore your original settings when testing is finished. On Demand cannot guarantee that a server is always available; network changes, authentication failures, and system state can all affect the connection. Verify access to your destination.
Read about On Demand in the full handbook →Data shows traffic recorded by the client. It does not prove that a connection succeeded or necessarily match your service provider’s billing records.
Open Data and first check the current statistics view, reporting period, and whether the data has been cleared. Then review the upload and download readings. If the interface offers views by server or app-related categories, check the current grouping first. Views may categorize traffic differently; a reading in one view may not represent all network activity from an app. Records without an identifiable source are not a reliable basis for precise conclusions.
Keep the same server and Global Routing settings. Note the readings, make one specific request, then return to Data and check for a change. This can help determine whether traffic was generated, but background syncing, retries, and activity from other apps may also be counted. If the readings do not change noticeably, check the connection status, whether the request was actually made, and whether the current view includes that traffic.
Client statistics and your service provider’s records may differ because of reporting periods, upload and download accounting, protocol overhead, billing methods, and use across multiple devices. Do not assume a discrepancy means something is wrong, and do not treat the Data total as your remaining subscription allowance. When troubleshooting, note the readings and test conditions for the same time period. To check your service allowance, consult the account records for your existing service.
Read how Data traffic statistics are measured →Settings and the active configuration can both affect results. Note the current value before changing one setting at a time. Menu locations and available options depend on the current app interface.
What it is and where to find it: DNS resolves domain names to network addresses. Check DNS-related options in Settings and the active Config. The configuration may also contain DNS settings, so do not rely on the value shown in just one place.
How to configure it and what to watch for: Check the current resolution method and DNS entries in the configuration to understand which settings are active, then make changes as needed. Afterward, request the same domain again and review the records. If a server test responds but a webpage will not load, distinguish a DNS failure from a connection failure or a failure to receive a response from the destination. Avoid adding several sets of DNS options at once; it will be harder to identify which took effect and to revert the change.
What it is and where to find it: Find Test Method in Settings to choose how availability is tested. Connectivity Test results depend on the test method, destination, and current network; they are not a fixed measure of server performance.
How to configure it and what to watch for: Choose a method suited to your troubleshooting goal, then retest the same entry on the same network. Confirm that the test conditions match before comparing results. A response from one method only confirms a response along that test path; it does not prove that all websites, transfer types, or sustained throughput will work normally. A failure should also be checked against real access rather than used on its own as a reason to delete an entry.
What it is and where to find it: Check Today Widget options in Settings, then add the relevant entry in a system-supported widget location. What appears and how it is supported depend on the system version and the app’s current features. Check the actual interface on your device.
How to configure it and what to watch for: First select a server in the app and complete the initial VPN configuration authorization, then check whether the widget action produces the expected result. If its status differs from the main interface, open the app and check the connection and refresh its status. A quick-access widget simplifies operation; it does not replace server settings, Config selection, or system authorization. Do not rely on the widget icon alone to determine which rule handled a request.
What it is and where to find it: Check iCloud-related options in Settings, along with your system account and iCloud permissions. Sync can store or transfer configuration data where supported. Refer to the app’s current information for details; do not assume that connection status and all local records are synced.
How to configure it and what to watch for: Save a copy of your current configuration before enabling sync, then check that files and contents are complete on another device. If configurations conflict, decide which copy to keep before proceeding; do not overwrite them repeatedly on both devices. App Store purchase history and iCloud data sync are separate. After restoring the app, check your configuration, server details, and connection permissions separately.
What it is and where to find it: Look for Diagnostics in Settings to collect or review information for troubleshooting. Use diagnostic data alongside steps to reproduce the issue; a log by itself usually cannot show every setting that was active when the problem occurred.
How to configure it and what to watch for: Note your network type, selected server, Global Routing mode, and the destination where the issue occurs. Reproduce it once, then review the relevant records. Before sharing, remove subscription URLs, authentication details, personal addresses, and other sensitive information. Include only relevant excerpts and note what you have already tried. After troubleshooting, restore any temporary logging options to your usual settings.
What it is and where to find it: The system prompts you to allow VPN configuration when connecting for the first time. This permission lets the client establish the relevant network connection. The connection toggle in the app is associated with the system’s saved VPN configuration, but neither is a Config rules file.
How to configure it and what to watch for: Read the system prompt and allow access if needed, then return to Home and check the connection status. If you previously denied permission or removed the system configuration, initiate a connection again and check the prompt rather than repeatedly changing rules in Config. Even when the system shows a connection, verify access to your destination. Authorization allows the connection to be established; it does not fix incorrect subscription or server settings.
Check four layers in order—connection details, routing mode, rules and DNS, then automatic triggers—to avoid changing several variables at once.