Shadowrocket supports multiple server protocols, but the Type must match the server. Changing the name alone does not switch protocols. This guide assumes you already have a service provider and subscription. It explains what seven protocol types are used for, which fields to check when adding a server, and how to distinguish protocol, transport and routing issues. Get subscription links and connection details from your service provider.
1. Supported protocols and choosing a Type in Add Server
First confirm which protocol the server uses, then go to Home → + in the top-right corner → Add Server → Type and select the matching option. This guide covers Shadowsocks, VMess, VLESS, Trojan, Hysteria2, WireGuard, HTTP and SOCKS5. Available options and fields may vary; refer to the app interface on your device.
The protocol determines how the client and server establish a connection, authenticate and transfer data. The server address and port are only connection details; they do not identify the protocol. For example, port 443 can carry different services. Seeing 443 does not mean you should select Trojan or that TLS is enabled.
| Server protocol | Matching Type | Key details to check |
|---|---|---|
| Shadowsocks | Shadowsocks | Address, port, encryption method and password |
| VMess | VMess | UUID, encryption settings, transport and TLS |
| VLESS | VLESS | UUID, transport, TLS or the relevant security settings |
| Trojan | Trojan | Password, port, TLS and server name |
| HTTP / HTTPS | HTTP / HTTPS option | Proxy endpoint, authentication method and whether TLS is used |
| SOCKS5 | Socks5 option | Address, port, username and password, and UDP support |
| WireGuard | WireGuard | Local private key, peer public key, endpoint and tunnel address |
| Hysteria2 | Hysteria2 | Authentication details, UDP port, TLS and optional obfuscation settings |
In short: choose the Type that matches the server parameters
Import an existing subscription first and check the server types it contains. Fill in the fields individually only when adding a server manually. Support for a protocol does not mean every transport combination or extra parameter is interchangeable.
2. Shadowsocks, VMess and VLESS compared
Shadowsocks: match the password and encryption method
Shadowsocks establishes a proxy connection using a pre-shared password and encryption method. After selecting Shadowsocks in Add Server, make sure the encryption method matches the server, along with the address and port. A correct password will not help if the method is wrong. Don’t swap encryption methods just because their names look similar.
If the server configuration includes extra plugins or obfuscation settings, confirm that the app supports them and preserve their values. Copying only the address, port and password may not reproduce the full configuration. After importing a subscription, use the actual fields on the server edit screen as your reference.
VMess: check the transport layer as well as the UUID
VMess uses a UUID and other identity information for authentication, along with its own data security settings. If the server specifies WebSocket or another transport, the client must use the same one. When TLS is enabled, check settings such as the server name too. A correct UUID is necessary, but it does not replace the transport configuration.
VLESS: understand authentication and connection security separately
VLESS does not encrypt data on its own; connection security depends on the security layer and the complete configuration in use. Changing a VMess Type to VLESS and reusing all the same fields will not work. For TLS, REALITY or transport-specific settings, follow the server configuration and check that the corresponding options are available in the current app.
- Identity fields: For Shadowsocks, check the password and encryption method. For VMess and VLESS, check the UUID and the security settings for each protocol.
- Transport fields: A WebSocket path and Host are not the server address, and they do not necessarily match the TLS server name.
- Time requirements: VMess authentication depends on the time. If your device clock is significantly off, check that automatic date and time are enabled in system settings.
- Troubleshooting order: Check the Type and credentials first, then the transport, path and TLS settings. Change one thing at a time so you can compare results.
3. Trojan and Hysteria2: similar use of TLS, different transports
Trojan configurations commonly use TLS to protect the connection and a password for authentication. After selecting Trojan, check the server port, password and TLS server name. The server address can be an IP address, while the certificate is usually issued for a domain, so treat the address and certificate name as separate values. Don’t work around certificate errors by leaving certificate verification disabled.
Hysteria2 is based on QUIC, uses UDP as its underlying transport, and combines TLS with authentication. After selecting Hysteria2, check the UDP port, server name and whether the server uses obfuscation, along with the address and authentication details. Hysteria and Hysteria2 are different protocol versions; a shared name prefix does not mean they are compatible.
| Check | Typical Trojan setup | Hysteria2 |
|---|---|---|
| Underlying transport | Usually establishes a TLS connection over TCP | Establishes a QUIC connection over UDP |
| Authentication | Check the password | Check the authentication details and server requirements |
| Port example | If the server specifies TCP 443, enter 443 | If the server specifies UDP 443, enter 443 |
| Impact of network restrictions | Check the TCP port and TLS handshake | Check whether the current network can reach the destination UDP port |
The 443 examples show that the same port number can be used with different transports; 443 is not a universal setting. Hysteria2 performance depends on UDP reachability, packet loss, bandwidth and server configuration, so the protocol name alone does not guarantee higher speeds. If the same configuration works on Wi-Fi but times out on cellular, leave the settings unchanged and compare the network conditions first.
4. What HTTP, SOCKS5 and WireGuard are used for
HTTP and SOCKS5 are general-purpose proxy protocols. An HTTP proxy can establish a connection to a destination using CONNECT. An HTTPS proxy adds TLS between the client and proxy server; that is different from using an HTTP proxy to visit an HTTPS website. Choose a Type based on whether the proxy endpoint itself uses TLS, not on the website you want to visit.
SOCKS5 can negotiate username and password authentication, but the protocol does not encrypt traffic by itself. UDP support also depends on the server, app settings and the network in between. Selecting Socks5 does not guarantee that every UDP request will work. Port 1080 is a common example, not a requirement; use the port provided by the server.
WireGuard is a key-based tunneling protocol, not a proxy that uses only a password. A typical configuration includes a local private key, peer public key, tunnel address and remote endpoint. If a preshared key is enabled, it must match on both sides. WireGuard endpoints use UDP; 51820 is a common example port, not a fixed requirement.
- For an existing HTTP or SOCKS5 endpoint, first check the authentication method and whether the endpoint uses TLS.
- For existing WireGuard settings, import every value into its corresponding field. Don’t use the password field pattern for a regular proxy.
- Any protocol must be tested with an actual connection. A latency figure alone does not confirm that authentication, DNS and access to the destination are all working.
5. From subscription import to the first connection test
A subscription is a way to deliver server configurations, not a traffic transport protocol. One subscription can include servers with different Types; updating a subscription does not upgrade a protocol. Start with the complete subscription from your service provider to avoid missing TLS, transport paths or authentication settings when copying values manually.
-
Confirm the source
Prepare an existing subscription or complete connection details. If you haven’t obtained the app yet, visit the App Store verification page to confirm the App Store listing. Get service connection details separately from your service provider.
-
Import a subscription
Go to Home → + in the top-right corner → Add Server → Type → Subscribe, enter the subscription link and save. Return to Home and use the subscription’s update option to load the server list.
-
Check the Type
Open the imported server’s edit screen and check its Type, address, port and TLS fields. To add a server manually, go to Add Server → Type, choose the matching protocol and enter the original parameters.
-
Select and connect
Return to Home, select the server you want to use and confirm the selection indicator. Then turn on the connection switch at the top. On the first connection, follow the system prompt to allow adding a VPN configuration.
-
Test access
Run Connectivity Test from Home, then try the actual destination. If the test passes but the destination does not load, check Global Routing, the current configuration and DNS instead of immediately changing the Type.
An update may overwrite server fields you changed manually. If behavior changes after an update, compare the Type, port, transport and TLS fields first. If you need to ask your service provider, share the symptoms and network conditions after removing credentials.
6. Type and Global Routing are different settings
Type determines how the app connects to a server; Global Routing determines how requests are routed. Even with a correct protocol configuration, a routing mode or matched rule may prevent traffic from using the expected server. The guidance below is for everyday use with an existing, reliable rules configuration; it does not recommend any particular protocol or service.
Config
RecommendedRoutes requests according to the currently selected configuration. Rules are evaluated in order, and the matched policy determines the result. Config should not be reduced to a fixed rule that sends certain websites direct.
Use when: You have a correct rules configuration and need to route traffic by destination.
Proxy
Uses the proxy as the global routing mode, making it useful for comparing the effect of rules under Config. It does not change the server Type or fix password, certificate or transport errors.
Use when: Temporarily checking whether a failure is caused by rule-based routing.
Direct
Uses the direct routing mode and does not test protocol availability through the selected proxy server. A webpage loading in this mode does not prove that the server you just imported works.
Use when: Comparing with direct access on the current network.
Scene
Applies routing behavior according to the configured scene conditions. When troubleshooting, check the active scene and its settings too; noting only the word Scene on screen is not enough.
Use when: You have configured different routing behavior for specific network conditions.
In Config, DOMAIN-SUFFIX matches domain suffixes, GEOIP matches against geographic database information for the destination IP, IP-CIDR matches IP ranges, and FINAL acts as the last-resort rule. These are rule keywords, not protocol options in Add Server. Settings → On Demand is for checking on-demand connection conditions, not for choosing a protocol.
7. Protocol selection and connection troubleshooting FAQs
Can I switch from VMess to VLESS to make the connection faster?
Not by changing the Type alone. Go back to the server edit screen in Home and restore the protocol provided by the server. If the server provides a separate VLESS configuration, import it as a separate server with all its settings. Authentication, transport and security parameters must match as a set.
Hysteria2 keeps timing out, but other connections work. What should I check?
First confirm that the Type is Hysteria2, then check authentication, the UDP port and the TLS server name. Keep the server settings unchanged and test over both Wi-Fi and cellular. If it fails on only one network, note the network conditions and check whether the destination UDP port is reachable.
Why won’t a webpage load even though I see a latency result?
First confirm the selected server in Home, then run Connectivity Test. Next, check that Global Routing is set as expected. Under Config, also verify the active configuration and matched rules. A latency result only reflects the specific test method; it does not replace testing access to the actual destination.
I’m getting a certificate error. Can I just turn verification off?
Check the system date and time first, then compare the TLS server name in the server edit screen with the server’s certificate requirements. Expired certificates, name mismatches and trust chain issues require different fixes. Keep the error details and check with your service provider rather than routinely disabling verification.
The protocol changed after a subscription update. Should I change it back?
Check the server’s Type and connection fields after the update, then compare them with the change notes from your service provider. Don’t overwrite new parameters based on an old server name. If the configuration appears incomplete, keep a description of the issue with credentials removed, ask your service provider to confirm, then update the subscription again and test.
Check in this order: does the protocol match, are all connection parameters present, does the current network allow the required transport, and is routing set as expected? Change one condition at a time and record the results. This makes issues easier to isolate than repeatedly switching between Types.