Shadowrocket supports a range of proxy and tunnel protocols. This guide is for users who already have their own provider, server details or subscription. Compare each protocol’s authentication and transport requirements, then check the fields under Home → + → Add Server. Finally, distinguish connection failures from TLS errors and rules that do not match. The protocol must match the server configuration; changing Type alone cannot convert an existing server to another protocol.
Supported protocols and key fields
To add a server manually, select its protocol under Type in Add Server, then fill in the fields shown for that type. Authentication details are not interchangeable: a Shadowsocks Password is not a VMess UUID, and a WireGuard key does not belong in Trojan’s Password field. The table below covers common configuration details, not every supported protocol; available options and field names may vary by interface.
| Protocol | Transport and authentication | Key fields to check |
|---|---|---|
| Shadowsocks | Authenticates with the selected encryption method and password; can use TCP, while UDP requires support at both ends. | Address, Port, Method and Password; plugin settings are also required when a plugin is used. |
| VMess | Identifies users with a UUID; transport and TLS depend on the configuration. | Address, Port, UUID, encryption options, transport and TLS settings. |
| VLESS | Authenticates with a UUID; the protocol itself does not provide the same payload encryption layer as Shadowsocks. | UUID, transport, and any TLS or other security settings required by the server. |
| Trojan | Commonly connects to the server over TLS and authenticates with a password. | Password, TLS server name and certificate verification requirements. |
| HTTP / SOCKS5 | A general-purpose proxy protocol; authentication and encryption depend on the configuration. | Address, Port and authentication details; for HTTP, check whether TLS is used. |
| WireGuard | An encrypted tunnel over UDP that uses a public/private key pair. | Local Private Key, tunnel address, peer Public Key, Endpoint and routing scope. |
| Hysteria2 | Runs over QUIC, which relies on UDP, and uses TLS and the configured authentication details. | Address, Port, authentication password and TLS server name; also check bandwidth and obfuscation settings. |
These fields have no universal default values. Address and Port must match the listening address of the existing server. Set TLS and WebSocket transport exactly as specified in the original configuration. Port numbers shown in this guide illustrate what a field means; they are not substitutes for your server details.
Shadowsocks, VMess and VLESS: key differences
Shadowsocks Method and Password are a matched pair. Even with the right password, a different Method can cause authentication or decryption to fail. UDP support and plugin requirements are separate server settings. A webpage loading does not prove that real-time voice or other UDP traffic will work.
- Shadowsocks: Match the Method exactly and avoid trailing spaces when copying the Password. If the original configuration includes plugin details, keep them along with the address and password.
- VMess: Check the UUID, encryption options and transport settings. Authentication is time-sensitive; if the device clock is significantly off, first check that automatic time setting is enabled in system settings.
- VLESS: Check the UUID and security layer; do not assume the name means no encryption settings are needed. Match the server’s TLS, transport and any additional parameters.
With WebSocket, for example, the server address, HTTP Host, Path and TLS server name each serve a different purpose. Address locates the connection endpoint; Host and Path handle application-layer routing; the TLS server name is used for the handshake and certificate identity check. Some values may be the same, but that does not mean they should all be changed to one value.
Security considerations for Trojan, HTTP and SOCKS5
Typical Trojan configurations use TLS to protect the connection between client and server. A correct Password does not guarantee a successful TLS connection: an expired certificate, a certificate name that does not match the configuration, or an incorrect device clock can interrupt the connection before password authentication. Check the original settings and certificate requirements instead of routinely disabling certificate verification.
Bottom line: the port does not determine the protocol
Even if you have port 443, first confirm the Type, authentication method and TLS settings. Do not assume every entry using port 443 should be configured as Trojan.
An HTTP proxy can use CONNECT to tunnel to an HTTPS destination, but that does not mean the connection from the client to the proxy server necessarily uses TLS. SOCKS5 does not encrypt transport either, and username/password authentication is not a substitute for encryption. The destination’s TLS connection and the security of the proxy connection are separate layers and should be assessed separately.
- HTTP: Check whether the endpoint is a regular HTTP proxy or a proxy that uses TLS, then enter the required authentication details.
- SOCKS5: Check whether the server allows UDP forwarding and whether authentication is required. A successful TCP test does not prove that UDP works.
- Trojan: Keep the correct TLS server name. If Address is an IP, do not change the server name to that IP unless the original configuration specifies it.
UDP requirements for Hysteria2 and WireGuard
Both Hysteria2 and WireGuard rely on UDP, but they are different types of tunnel. Hysteria2 is based on QUIC, while WireGuard uses its own encrypted tunneling mechanism. If the current network blocks the relevant UDP port, either protocol may fail to establish a working connection. Checking only whether a TCP port is open cannot verify these services.
| Setting | Hysteria2 | WireGuard |
|---|---|---|
| Authentication details | The authentication details specified by the server, commonly a password. | Local private key and peer public key; a pre-shared key may also be required by the configuration. |
| Security layer | Check the TLS name, certificate and any optional obfuscation settings. | Check the key pair, tunnel address and peer configuration. |
| Network requirements | The endpoint’s UDP port must be reachable. | The UDP port for the Endpoint must be reachable. |
| Additional settings | Enter bandwidth values, port ranges and other settings as specified in the existing configuration. | Set Allowed IPs, DNS, MTU and other values according to the tunnel plan. |
A WireGuard tunnel address is not the server’s public address, and the Private Key is not the peer’s Public Key. Allowed IPs define destination ranges inside the tunnel; they are not the same as Shadowrocket’s Global Routing. Do not change the tunnel address arbitrarily after import: even if the endpoint is reachable, traffic may not return.
Hysteria2 bandwidth settings are not speed-test results, and higher values are not automatically better. If the configuration requires them, use the values it specifies. If the same configuration works over Wi-Fi but times out on cellular, note what changes when you switch networks and check UDP reachability. A single failure is not enough to judge a protocol’s speed or reliability.
Add a server and test the connection in Add Server
These steps assume you already have the complete server details. If an existing subscription includes a complete entry, importing it as provided is usually preferable and reduces the chance of missing a field. Before adding a server manually, note the original settings. Change one field at a time during testing so you can identify the cause of an error.
-
Open the Add Server screen
Go to Home → + in the top-right corner to open Add Server. Under Type, choose the protocol used by the existing server; do not guess based on a similar name.
-
Enter the server address
Enter Address and Port. Use the provided domain or IP for Address. Do not add a webpage path or protocol prefix unless the field explicitly requires a full URL.
-
Check authentication
Enter the Password, UUID or key details required for the selected type. Check Method, TLS name, transport, Host and Path one by one. Do not guess at additional settings that were not provided.
-
Save and select the server
After saving, return to Home and select the server. Confirm that a selection indicator appears on the left. Turn on the connection switch and, when prompted the first time, allow the system to add a VPN configuration.
-
Test connectivity
Run Connectivity Test from Home, then visit the destination you need to check. Note whether the test timed out, returned a TLS error, or only a specific destination failed to load; do not record only that it is “connected.”
Connectivity Test provides clues about connectivity; it does not prove that every app, destination or UDP flow works. If you change Global Routing for troubleshooting, restore its previous setting afterward so temporary diagnostic changes do not remain in place.
Check connection status and routing separately
The server protocol determines how the connection is established; Global Routing determines how requests are routed. Proxy sends traffic through a proxy, Direct connects without a proxy, Config applies the current configuration rules, and Scene depends on its configured conditions. Correct server details do not mean every request will use that server.
- Proxy: Use this to check whether a destination is taking the proxy route, but confirm which server is selected and review the relevant policy settings.
- Direct: Requests connect directly to the destination. A webpage loading in this mode does not show that the proxy server is working.
- Config: Check the rule order and policies in the current Config. A specific destination may match DIRECT rather than a proxy.
- Scene: Check the conditions and actions in the existing scene. Scene is not another server protocol.
In Config, DOMAIN-SUFFIX matches domain suffixes, IP-CIDR matches IP ranges, GEOIP matches by IP geolocation, and FINAL sets the policy when no earlier rule matches. These rules change where traffic goes; they do not fix an incorrect Password, UUID or TLS name. Settings → On Demand controls when a connection is established based on conditions; it does not change protocol authentication details.
Protocol selection and common connection errors
Which protocol is fastest? Can I just choose that one?
Start with a protocol the server actually supports, then compare under the same network conditions, at roughly the same time and against the same destination. Latency, packet loss, server load and transport settings all affect results. Changing Type to Hysteria2 or WireGuard does not add support for either protocol to an existing server.
Why can’t I connect even though the imported entry appears?
An entry appearing only means its contents were parsed; it does not mean authentication will succeed. First select it on Home and run Connectivity Test, then check Address, Port and the protocol’s authentication details. If it came from an existing subscription, update it from that subscription and check again to avoid using outdated settings.
Should I disable verification when I get a TLS error?
First check the device clock, TLS server name, certificate requirements and connection endpoint. If certificate identity verification fails, correct the configuration or certificate. Do not routinely disable verification, and do not try to fix a certificate name mismatch by changing the password.
Why does a webpage load when voice calls still fail?
Web browsing typically uses TCP, while voice traffic may rely on UDP. Check whether the current protocol, server and network support the required UDP forwarding, then check the route in Config. A successful webpage test through an HTTP proxy does not prove that real-time traffic will work.
Will a subscription update change settings I edited manually?
Subscription entries may be rebuilt or overwritten from the remote content when updated. Keep the original settings before making changes, then recheck the selected entry and any additional fields after an update. Record any changes you need to keep; a manual edit does not mean the subscription configuration has changed.