Official Manual · Glossary
Look up the English term, then use its location to determine its meaning. This page covers 32 terms in five categories. In particular, distinguish the interface option Proxy from the rule policy PROXY.
01 / INTERFACE
The same term may appear as a tab label, routing option, or rule entry. Check where it appears before deciding what it controls.
Interface & Toggles
Use this view to check saved connection entries and the connection toggle before connecting. An entry in the list only means its information has been saved; it does not confirm successful authentication or an established network tunnel. Also check which entry is selected and the current connection status.
Interface & Toggles
Controls the overall routing mode. Common options are Config, Proxy, and Direct, for configuration-based routing, proxying, and direct connections. If custom rules do not behave as expected, first check whether Config is selected instead of repeatedly rewriting the rules.
Interface & Toggles
As a page name, this refers to configuration file management. As a Global Routing option, it means traffic is handled according to the active configuration. Saving a configuration and enabling it are separate actions. Check the file contents, selected configuration, and overall routing mode when troubleshooting.
Interface & Toggles
In Global Routing, this selects proxy mode so requests are handled through the corresponding proxy route. It is not the same setting as the uppercase PROXY rule policy. Selecting this option will not fix an incorrect server address, password, or certificate setting.
Interface & Toggles
In Global Routing, this selects direct mode, connecting requests directly to their destinations. It can help compare access on the current network, but direct connections still depend on the local network, DNS, and destination service. It does not guarantee that every destination is reachable.
Interface & Toggles
Triggers connection actions when specified conditions are met. Common conditions include network type, a specific Wi-Fi network, and domain criteria. If the app connects or disconnects automatically, check whether a condition was met. Looking only at the manual toggle can make on-demand behavior look like a connection problem.
Interface & Toggles
View traffic and connection activity recorded in the app to help determine whether requests occurred. Check the scope and recording period in the current interface. These statistics are not a usage bill from your service provider and should not be used to estimate remaining data.
Interface & Toggles
The central location for app settings, separate from the editor for an individual server entry. Note the original values, change one setting at a time, and retest with the same destination. Changing several settings at once makes it harder to identify the cause or undo the changes.
02 / PROTOCOLS
Protocol names describe how communication works, not the quality of a service. The definitions below explain the technical terms only; parameters must match the requirements of your own server. Renaming an entry does not change its protocol.
Protocol Names
A proxy protocol that typically requires a server address, port, password, and encryption method. The encryption method is part of the protocol parameters and should not be replaced just because another name looks similar. If the address resolves but the connection fails, check the port, authentication, and server status.
Protocol Names
An authenticated proxy protocol. Connections may also involve different transport options and TLS settings. After importing, check the identity, transport type, path, server name, and other corresponding fields. Selecting VMess alone does not confirm that all parameters are complete.
Protocol Names
A proxy protocol. Enter the identity, transport, and security parameters required by the server. It is not interchangeable with VMess; if the same address offers different connection methods, use the complete parameter set for the selected method.
Protocol Names
A proxy protocol commonly used with TLS. Check the password, port, and server name. The IP address used for the connection and the name used for TLS validation may serve different purposes. If you see a certificate error, check the name and certificate validity rather than bypassing validation.
Protocol Names
A QUIC-based proxy protocol whose connection performance depends on UDP availability on the current network. In addition to the address and authentication, check TLS parameters against the server requirements. A failure on one network alone does not prove that the server details are no longer valid.
Protocol Names
A key-pair-based tunneling protocol. Keys, endpoint addresses, tunnel addresses, and routing ranges each serve a different purpose. A private key is sensitive; do not paste it into public troubleshooting posts. After importing, check each field against your existing configuration rather than swapping the public and private keys.
03 / RULES
Rules first check matching conditions, then apply the policy for a match. They are usually evaluated from top to bottom, and evaluation stops at the first match. Put specific conditions before broader ones.
DOMAIN,example.com,DIRECT
DOMAIN-SUFFIX,example.com,PROXY
DOMAIN-KEYWORD,ads,REJECT
IP-CIDR,192.168.0.0/16,DIRECT
FINAL,PROXYRule Keywords & Policies
Matches an exact domain name, for example DOMAIN,example.com,DIRECT. It does not automatically include subdomains such as www.example.com. To cover a domain and its subdomains, first define the scope you need, then consider a suffix match.
Rule Keywords & Policies
Matches a specified domain and its subdomains, for example DOMAIN-SUFFIX,example.com,PROXY. This matches a domain suffix at a domain boundary, not an arbitrary substring. Placing it before a more specific DOMAIN rule may prevent that rule from being reached.
Rule Keywords & Policies
Matches keywords contained in a domain name, typically covering more than an exact-domain rule. For example, the keyword ads may appear in domains serving many different purposes, so it does not identify a request's purpose on its own. Check what actually matched before using a reject policy.
Rule Keywords & Policies
Matches an IPv4 address range in CIDR notation, for example 192.168.0.0/16. The number after the slash is the network prefix length, not a port. Check whether the destination IP falls within the range, and distinguish IP conditions from domain conditions that may have matched earlier.
Rule Keywords & Policies
Matches an IPv6 address range in CIDR notation, for example the documentation range 2001:db8::/32. IPv4 and IPv6 use different address-range rules. If a domain returns both address types, do not assume an existing IPv4 rule also covers IPv6 requests.
Rule Keywords & Policies
Matches based on classifications in an IP geolocation database, not on text in the domain name. Results depend on the destination IP and database records, and cannot confirm a user's precise location. If a rule matches unexpectedly, first check the actual destination IP.
Rule Keywords & Policies
A fallback rule at the end of the ruleset determines how to handle traffic when none of the preceding rules match, for example FINAL,PROXY. It does not override an earlier match, and using a proxy is not required. Check the order of preceding rules when reviewing fallback behavior.
Rule Keywords & Policies
Rule policy keywords: PROXY means proxy the request, DIRECT means connect directly, and REJECT means reject the request. A matching condition answers “which requests”; a policy answers “how to handle them.” Check the current selection and the policies in the configuration to determine the proxy route actually used.
04 / IMPORT
Connection entries, subscription sources, and rule configurations are different things. Your existing service details determine connection parameters; the active configuration determines how the relevant traffic is handled.
Subscriptions & Configuration Files
These interface terms relate to importing and updating subscriptions and assume you already have your own subscription URL. Updating reloads data from the source; it does not fix every connection problem. If an update fails, check the URL, current network, and whether the returned content uses a format supported by the app.
Subscriptions & Configuration Files
A set of parameters describing a connection endpoint, usually including its address, port, protocol, and authentication details, and sometimes transport and TLS settings. To enter details manually, open Add Server. A server name or address alone is not enough to connect; ask your own service provider for the required fields.
Subscriptions & Configuration Files
Organizes rules and related handling settings, unlike a subscription, which primarily provides connection entries. After importing a new file, check which one is active and whether your existing custom rules are still present. Keep a copy of the original file before making changes so you can compare or restore it.
Subscriptions & Configuration Files
An import option that reads QR code contents. A QR code may contain a single connection entry or other supported information. Successful scanning only confirms that the contents were read; check the protocol and required fields. Treat QR codes containing authentication details as sensitive and do not post them publicly when asking for help.
Subscriptions & Configuration Files
An import option for reading JSON data. Availability depends on the source and whether its data structure is supported by the app. This is a different process from scanning a QR code or entering a single server, and should not be confused with iCloud Sync. After importing, check the entries and fields that were added.
05 / SYSTEM
System authorization, DNS, connectivity tests, and purchase records address different issues. Refer to the App Store listing for system requirements; do not infer compatibility from terminology.
System & Permissions
Resolves domain names to records such as IP addresses and is an important part of accessing a domain. Both the server's hostname and the destination hostname may require resolution. When access fails, distinguish a DNS lookup failure, an unexpected address, and a failure to connect after resolution rather than treating every issue as the same timeout.
System & Permissions
The configuration Apple requires to manage an app's network tunnel. The system may ask for permission to add it on the first connection. Granting permission does not confirm successful remote authentication or mean all requests are routed through a proxy; the route is determined by Global Routing and the active configuration.
System & Permissions
A diagnostic option for testing connectivity to a specific target. Interpret the result in light of the test method: one successful test does not mean every website is reachable, and test duration is not the same as sustained transfer speed. For meaningful comparisons, keep the network, target, and test conditions the same.
System & Permissions
A mechanism for syncing data between devices through iCloud. Check the options currently available in the app to see what is included. It is not a full device backup or a way to restore App Store purchases. After switching devices, check your configuration, connection entries, and system VPN permission separately.
System & Permissions
An App Store option for viewing purchases associated with the current account and checking purchase history or downloading the app again. Recovering the app and restoring user configuration are separate steps. Check the App Store listing for device compatibility, whether the purchase is universal, and Family Sharing availability.