Shadowrocket supports several protocols, but the protocol type must match your existing server configuration. Changing Type cannot convert one proxy into another. This guide is for users who already have their own provider and subscription. It explains the difference between protocols, transports, and routing, then covers eight common types, their settings, and a practical order for importing, testing, and troubleshooting connections.
1. Supported protocols and settings at a glance
In Shadowrocket, choose a protocol from Home → tap “+” in the top-right corner → Type. The table below covers eight types discussed in this guide; it is not a complete list of every option in the app. Refer to the current add-server screen for the fields available. Choose a protocol based on your existing connection details, not on assumptions about its speed.
| Protocol | Transport | Settings to check first |
|---|---|---|
| Shadowsocks | Uses a specified encryption method to protect proxy traffic; can support TCP and UDP forwarding | Server address, port, encryption method, and password; check the plugin settings too if one is used |
| VMess | Authenticates with credentials such as a UUID and can use different transport methods | Server address, port, UUID, encryption options, transport, and TLS |
| VLESS | Authentication is separate from the outer transport; the protocol itself does not encrypt data | Server address, port, UUID, transport, and the related security settings |
| Trojan | Commonly deployed with TLS and password authentication | Server address, port, password, SNI, and certificate verification |
| HTTP | Uses an HTTP proxy; HTTPS destinations typically establish a tunnel with CONNECT | Server address, port, optional username and password, and TLS settings for the proxy connection |
| SOCKS5 | A general-purpose proxy protocol that can support TCP and UDP if both ends allow it | Server address, port, optional username and password, and UDP support |
| Hysteria2 | Based on QUIC and runs over UDP | Server address, port, authentication details, SNI, certificate settings, and optional obfuscation parameters |
| WireGuard | An encrypted tunnel over UDP that identifies peers with keys | Private key, peer public key, endpoint, tunnel addresses, and optional preshared key |
Bottom line: choose Type to match your server details
First confirm the protocol specified in your existing connection details, then enter each setting. A server address and port alone are not enough to recreate a connection. If authentication, transport, or security settings are missing, get the original details rather than cycling through Type options.
2. Protocol, transport, TLS, and routing are different layers
The protocol defines how the client and server authenticate and handle data. TCP, UDP, and WebSocket describe transport methods or how traffic is carried. TLS provides encryption and identity verification for the relevant connection. Global Routing determines how requests are routed. These can all appear in one configuration, but changing one layer will not automatically fix another.
- Protocol layer: VMess and VLESS are different protocols. Even if both entries use a UUID, their Type settings are not interchangeable.
- Transport layer: With WebSocket, settings such as the path and Host must match the server. Path capitalization and slashes can affect whether it matches.
- Security layer: SNI is the server name sent during the TLS handshake. The connection can use an IP address, while the certificate is usually verified against a specified domain name.
- Routing layer: Proxy, Direct, Config, and Scene in Global Routing are routing options, not protocol names. When troubleshooting a connection, first confirm that the request is actually using that entry.
Home is for managing connections and records, Config is for configuration files, and Settings is for app settings. With Config routing, check the rules in the active configuration to see where traffic goes. With Scene, check the selected scene. Settings → On Demand controls condition-based connection triggers; it does not convert protocols or configure proxy authentication.
[Rule]
DOMAIN-SUFFIX,example.com,PROXY
IP-CIDR,192.0.2.0/24,DIRECT,no-resolve
GEOIP,CN,DIRECT
FINAL,PROXYThe rules above are syntax examples, not a usable server configuration. DOMAIN-SUFFIX matches domain suffixes, IP-CIDR matches address ranges, GEOIP uses IP geolocation data, and FINAL handles traffic that did not match earlier rules. Rules are generally evaluated from top to bottom. These keywords cannot replace a proxy password, UUID, or key.
3. Shadowsocks, VMess, VLESS, and Trojan: key differences
Shadowsocks: check the encryption method and password together
A correct Shadowsocks password does not mean the connection settings are complete; the encryption method must also match the server. Do not substitute a method just because its name looks similar to one in your settings. If your existing details specify a plugin, check whether the app provides the corresponding options and verify the plugin’s mode, Host, or path. Plugin settings are not a general-purpose TLS switch.
VMess and VLESS: the same UUID does not make them interchangeable
Both protocols may use a UUID, but their authentication and data handling differ. For VMess, check the UUID, encryption options, and transport settings required by the server. If authentication fails, also check the device’s date and time. VLESS does not encrypt data by itself; connection security depends on the outer security and transport settings. A UUID is not an encryption setting.
Trojan: check TLS as well as the password
A typical Trojan configuration includes a server address, port, password, and SNI. Port 443 is a common choice, not a requirement. If the certificate name differs from the connection address, check the SNI specified by the server rather than disabling certificate verification. A wrong password and a certificate verification failure occur at different stages.
- Check the protocol name first, then verify the password or UUID. Do not mix authentication details from different protocols.
- An IP address for the server and a domain name for SNI can be a valid configuration. These fields serve different purposes and do not need to match.
- WebSocket Host and TLS SNI are also separate fields. Even if the server requires the same value for both, check each one individually.
- Get transport, security, and additional settings from the original connection details. Do not guess missing values.
4. Hysteria2, WireGuard, HTTP, and SOCKS5: what to check
Hysteria2 and WireGuard both rely on UDP, but they are different protocols. Hysteria2 is based on QUIC; check its authentication, TLS, and any optional obfuscation settings. WireGuard uses public and private keys and tunnel addresses, so you need the complete peer configuration. UDP connectivity alone does not confirm that authentication, tunnel routing, or DNS is configured correctly.
| Type | Settings to distinguish | First checks when the connection fails |
|---|---|---|
| Hysteria2 | Authentication details and the obfuscation password may serve different purposes | Check whether the current network allows UDP traffic to the specified port, then verify authentication and the certificate name |
| WireGuard | Do not swap the local private key and peer public key; the tunnel address is not the server endpoint | Check that the endpoint, key pair, tunnel addresses, and allowed routes are all complete |
| HTTP | Visiting an HTTPS website does not automatically enable TLS between the client and proxy | Check TLS requirements for the proxy connection, the username and password, and whether the server allows CONNECT |
| SOCKS5 | The protocol itself does not encrypt transport; TCP support does not guarantee UDP support | Check the authentication method, server-side UDP support, and network reachability |
Do not assume a protocol name tells you how fast a connection will be. Throughput and latency also depend on the network path, packet loss, server load, and bandwidth limits. When comparing existing connections, keep the test network, destination, and time as consistent as possible, and record success rates and specific errors. A single latency reading cannot show that one protocol is better on every network.
5. Add and test a connection from an existing subscription or configuration
A subscription is a way to retrieve multiple connection entries; it is not a ninth transport protocol. One subscription can include several protocols, and its entries may change when updated. This guide assumes you already have your own provider and subscription. Keep the original connection details before making changes, and treat subscription URLs and authentication details in share links as sensitive information.
-
Check the original connection details
Confirm whether you have a subscription URL or details for a single proxy. A subscription URL may look like
https://example.com/sub?token=xxxx; this is a dummy example and cannot be used to connect. Do not enter it as the proxy server address. -
Choose how to add it
To import an existing subscription, go to Home → tap “+” in the top-right corner → Type → Subscribe, then enter and save your complete subscription URL. To add a proxy manually, choose the protocol specified in your connection details under Type—not Subscribe.
-
Check the imported settings
After saving and updating the subscription, return to Home and check the imported entries. Open the one you want to use and verify its Type, address, and port. If it has TLS or extra transport settings, compare each field with the original details; do not check only the display name.
-
Check the test routing
Select the entry to test in Home, then check Global Routing. To rule out the effect of rules, you can temporarily select Proxy for a regular web request, then restore the original routing. Avoid changing the protocol, DNS, and multiple rules at the same time.
-
Verify the connection
Connect and allow the VPN configuration if prompted by the system, then check whether you can reach your destination. To check automatic connection behavior, go to Settings → On Demand afterward. Troubleshoot manual connection issues separately from automatic trigger issues.
Updating a subscription fetches the remote entries again; it does not update the app, and it may not preserve manual changes to individual entries. If the protocol, port, or name changes after an update, compare the old and new details first. If the list is empty, check the subscription response and make sure the URL is complete before concluding that the app does not support a particular protocol.
6. Protocol and connection troubleshooting: FAQs
I only have a server address and port. Can I choose Trojan?
That is not enough to identify the protocol. Trojan also requires a password and the correct TLS settings; other types may require a UUID or keys. Check your existing connection details for the protocol name and all required fields, then choose the matching type under Home → “+” → Type.
Why won’t it connect after I change VLESS to VMess?
Type is not just a display label; it determines which protocol is used. Changing the type to VMess does not make a remote VLESS server accept VMess. Restore the original Type, then check the UUID, transport, and security settings.
Why does Hysteria2 work on one network but fail on another?
Keep the connection settings unchanged and check whether UDP is reachable on both networks. Some networks may restrict UDP. If you see a TLS or authentication error, check SNI, the device’s date and time, and the authentication fields. A timeout alone does not mean the password is wrong.
It says connected. Why won’t websites load?
A VPN connection status does not mean the remote proxy request succeeded. First check the selected entry in Home, then see whether Global Routing is set to Direct. With Config, check the matching rules and final policy. Troubleshoot domain resolution separately from proxy authentication.
Can one subscription include different protocols?
Yes, as long as its response uses a format the app can parse and includes the settings each entry requires. Check the Type for each entry after importing. If an entry is missing, check the subscription response and that entry’s format; do not change the Type of another entry to compensate.