Official Manual · Term Index
Browse interface labels, protocol parameters, and rule keywords by purpose.
English terms match the labels in the app or the original text in configuration files; the explanations describe their purpose and limits. First identify whether you are changing an overall mode, a server entry, or a rule to avoid mixing settings from different levels.
Interface & Toggles
First locate the relevant screen, then determine whether the setting affects connection status or how traffic is handled. Labels below match those shown in the app.
Main screen
The main screen for checking connection status, Global Routing, Connectivity Test, and the SERVER list. Not Connected means no connection is currently established; it does not explain why. The first time you connect, follow the system prompt to allow a VPN configuration. See Quick Start for the steps.
Overall routing settings
Controls the overall routing mode: Config, Proxy, or Direct. These correspond to the interface labels Config, Proxy, and Direct. This is neither a rule for an individual website nor a server protocol. If traffic is not routed as expected, check this setting first, then review the active configuration file and rule order.
Three routing modes
Config handles requests according to rules in the active configuration; Proxy sends applicable traffic through the selected proxy; Direct uses a direct connection. System exceptions and other network settings may still affect the actual route, so these modes do not guarantee how all system traffic will be handled. See the proxy modes guide for details.
Automatic connection triggers
Control when a VPN connection starts based on conditions such as network type, Wi-Fi, or domain. These settings determine when to connect; they do not replace Rule settings that determine how each request is routed. If a connection starts again after you turn it off manually, check which triggers are enabled and whether the current network meets their conditions.
Add a server entry
The entry point for manually adding a connection using server details you already have. Select the correct protocol first, then check the address, port, authentication, and transport parameters one by one. Having every field filled in does not mean the values are correct. If you already have a subscription, follow the import steps rather than entering its URL as a server address.
Diagnostics
Checks server connectivity using the selected test method; different methods may test different parts of the network path. A response means only that the relevant test succeeded. It does not guarantee that DNS, rules, or every destination website is working. If the test succeeds but a webpage will not load, check the DNS result and the route used for the request.
Proxy Protocols
A protocol name describes a communication method, not connection quality. Use the server details you already have when entering parameters; the protocol name alone is not enough to determine a complete configuration.
Proxy Protocols
A protocol for proxy connections using an agreed encryption method and credentials. The client address, port, password, and encryption method must match the server. Preserve any additional transport parameters included in the configuration. Changing the encryption method is not a general fix; arbitrary changes can make the client and server settings incompatible.
Proxy Protocols
A proxy protocol that requires authentication and supports different transport settings. In addition to the address and port, check the UUID, transport method, and any fields required when secure transport is enabled. Authentication may be affected by the device clock, so check the system date and time when troubleshooting—but do not assume a timeout is caused by the clock.
Proxy Protocols
A proxy protocol that separates identity authentication from transport security; the name alone does not mean that traffic is encrypted. Check fields such as the UUID, transport method, and security settings. Its configuration cannot be reused with VMess by simply changing the protocol name; verify each parameter against the details you have.
Proxy Protocols
A proxy protocol that typically uses TLS and password authentication. The connection address, authentication password, and hostname used for TLS verification serve different purposes and cannot be substituted for one another. If you see a certificate or handshake error, check the hostname, certificate validity, and system time. Do not disable verification to hide a configuration problem.
Proxy Protocols
A QUIC-based proxy protocol that relies on UDP. If a connection fails, check the address, port, and authentication details, confirm that the current network allows the required UDP traffic, and verify the TLS parameters. Choosing this protocol does not guarantee faster speeds; actual performance depends on the route, congestion, and server resources.
Tunneling protocol
A tunneling protocol that identifies the peer by public key. Configuration includes the local private key, peer public key, addresses, and endpoint details. Keys are not ordinary display names; never include a private key in troubleshooting screenshots or public records. Tunneling and DNS resolution are separate steps, so check DNS and routing after establishing the tunnel.
Proxy Protocols
Two different proxy protocols. Sharing address and port fields does not make them interchangeable. Authentication requirements, support for specific traffic, and transport encryption depend on the protocol and server configuration. The names HTTP and SOCKS5 alone do not guarantee encrypted transport.
Rule Keywords
When reading a rule, check what it matches first, then what happens when it matches. Rules are usually evaluated from top to bottom, so place more specific conditions before broader ones.
Rule section
The [Rule] section in a configuration file defines routing rules, commonly with a rule type, match value, and policy. The first matching rule usually determines how a request is handled, so a broad rule near the top can prevent a more specific rule below it from matching. After making changes, confirm that Global Routing is set to Config and that the intended file is active.
Exact domain match
Matches a specific full domain, for cases where you want to handle one exact hostname. For example, DOMAIN,example.com,DIRECT does not automatically cover all subdomains. Enter the domain itself as the match value; do not include the scheme, path, or query parameters from a full webpage URL.
Domain suffix match
Matches a domain and its subdomains. For example, DOMAIN-SUFFIX,example.com,PROXY covers example.com and its subdomains. Its scope is broader than DOMAIN, but it does not match arbitrary text substrings. If the same domain has exceptions, place more specific rules above this one.
Domain keyword match
Checks whether a domain contains a specified keyword, which may match multiple unrelated domains. It matches the domain, not webpage content or arbitrary URL paths. If you only want to cover one website and its subdomains, consider DOMAIN-SUFFIX first to reduce unintended matches.
IP geolocation match
Matches according to the target IP's location in a geolocation database, not the website's language or domain text. Database records, DNS results, and content delivery networks can all affect the match. This does not indicate where the target service is registered, nor does it guarantee that every request to a website will match the same location.
Address range match
Use CIDR notation to match IPv4 and IPv6 address ranges, for example IP-CIDR,192.0.2.0/24,DIRECT. The prefix length after the slash sets the subnet size; it is not a port number. This is a documentation example. Write actual rules for the destination addresses you need to match, and account for the differences between the two address families.
Fallback rule
Handles requests that did not match any earlier rules and is usually placed last in the list. FINAL,DIRECT means unmatched requests connect directly; it does not force all requests to connect directly. If FINAL appears earlier in the list, later rules may never get a chance to match. Check the order before reviewing individual conditions.
Rule actions
PROXY sends a request to a proxy policy, DIRECT connects to the destination directly, and REJECT denies the request. These uppercase keywords are rule actions, not alternate names for the three Global Routing modes. A matching PROXY rule still requires a usable proxy entry to complete the connection.
Subscriptions & Configuration Files
Server entries determine where to connect; configuration files determine how requests are handled. Updating a subscription and switching configurations are different operations and cannot replace one another.
Import existing details
Use a subscription URL you already have to fetch or update server entries. See Importing subscriptions and servers for the steps. Subscription contents may change after an update, and a successful update does not mean every entry is usable. URLs may contain access credentials, so do not share the full link when troubleshooting. A subscription is not necessarily a complete routing configuration file.
Server list
The section on Home that lists server entries. Each entry stores connection parameters such as the protocol, address, port, and authentication details. An entry name is only a label; it does not tell you the protocol, actual location, or availability. Manually added entries and subscription entries may be managed differently, so check whether an edit will be overwritten before updating.
Configuration screen and files
Config may refer to the screen for managing configuration files; .conf is a common configuration file extension. Files may include sections such as General, Rule, Host, and URL Rewrite. Their effects depend on the fields and whether they are currently enabled. Saving a file does not activate it; check which configuration is selected and review Global Routing.
General configuration section
[General] defines basic network behavior and shared parameters, such as DNS settings. It serves a different purpose from the Rule section, which matches requests individually. Whether a parameter applies depends on the active configuration and network environment. Before making changes, record the original value and adjust only one setting related to the issue at a time so you can compare results and revert if needed.
URL processing section
[URL Rewrite] matches URLs using expressions and performs actions such as rewriting or redirecting them. It does not replace proxy routing rules. An overly broad match may alter unrelated requests, so understand the expression and destination before editing. The information visible in HTTPS requests and what can be changed depend on the connection conditions; do not assume that all request content can be modified directly.
DNS & Networking
Domain resolution, establishing a connection, and transferring content are separate steps. Interpret test results in light of the test method; one number cannot describe the entire network state.
Domain name resolution
The process of resolving a domain name to an IP address or other records, usually an important step before accessing a domain. A successful connection to a proxy server does not mean the destination domain will resolve correctly. If a webpage will not load but Connectivity Test responds, distinguish between a resolution failure, an unsuitable DNS result, an incorrect routing path, and a problem with the destination service.
General setting
A setting in General for specifying DNS resolvers. dns-server = system means to use the system's DNS resolver settings. Other DNS configuration and the network environment can also affect the resolution path. Record the original value before changing it, then test the same domain again. Avoid changing multiple unrelated parameters at once.
Static host mapping
[Host] sets a static address mapping for a hostname, for example localhost = 127.0.0.1. A static mapping does not automatically track changes to a remote service's address; an incorrect or outdated entry can cause persistent access failures. This is a different configuration level from the Host field in transport settings, so do not infer their purpose from the shared name alone.
What test results mean
The response time measured by a particular test method. It is not the same as bandwidth, download speed, or sustained transfer stability. Results from different test targets, network types, and methods should not be compared directly. Keep test conditions consistent while troubleshooting, then consider actual webpage access and connection logs. A single timeout is not enough to pinpoint a fault.
Transport security and hostnames
TLS protects data in transit and verifies the identity of the peer. SNI indicates the intended hostname during the handshake, helping the server select the appropriate configuration and certificate. The connection address can differ from the name used for verification, but both must match the server details you have. If the handshake fails, check the hostname, certificate, and system time; do not treat skipping verification as a routine fix.