Find terms by screen location and configuration purpose. First distinguish whether the client is connected, where it connects, and how requests are routed; then check the specific fields. Interface labels, protocol names, and rule keywords remain in English.
This page assumes you already have your own subscription or server details. These definitions help you understand settings but do not replace the actual parameters. For first-time setup, start with Quick Start; see Configuration Fields for the full rule syntax.
Different screens and controls handle different tasks. Global Routing controls the overall routing mode, while On Demand controls when a connection is triggered. They are not the same setting.
The main screen for viewing servers, subscription groups, and connection status, and the place to start checking the currently selected server. A server in the list means its details have been imported, not that a connection is active. When troubleshooting, check the selected server, the connection toggle, and Global Routing separately.
Controls the overall routing mode. The three common options are Config, Proxy, and Direct. Config routes traffic according to the current configuration rules; Proxy uses proxy mode; Direct uses direct mode. These modes are different from the PROXY and DIRECT policies at the end of individual rules. Before testing rules, make sure Global Routing is set to Config.
Starts a connection when preset network conditions are met, reducing the need to toggle the connection manually. It determines when to try connecting, not whether a domain should use PROXY or DIRECT. If the connection starts again after you disconnect manually, check the On Demand conditions and related system connection settings.
A screen for manually entering the details of a single server, for use when you already have complete server information. Select the protocol, then enter the address, port, and authentication details. The transport method and TLS parameters must also match the information from your provider. Getting the address and port right does not guarantee that all required fields are complete.
A diagnostic tool for checking server reachability. The result reflects the test method and network conditions at the time. A successful test does not mean that DNS, rule matching, and app requests work for every website; a failed test also needs to be considered in light of the method used. Record the test result alongside what happens when you actually connect, rather than comparing a latency number alone.
A settings screen for app preferences and related behavior. It is separate from the subscription list and the configuration file currently in use. When troubleshooting, note the original values, change one symptom-related option at a time, and repeat the same test. The available options may vary by platform; use the English labels shown on your device to find the relevant settings.
A protocol defines how the client and server communicate. The protocol name does not replace connection parameters or guarantee a particular speed or reliability. After importing a server, check its transport and authentication details.
A proxy protocol with common parameters such as server address, port, encryption method, and password. The encryption method is part of the protocol configuration and should not be swapped based on a similar-sounding name. Check any additional transport parameters provided by the source as well; matching only the address and password may still leave other fields incorrect and prevent a connection.
A proxy protocol that authenticates using a user ID and related parameters, often including a UUID. VMess is only the protocol layer; the connection may also use different transport methods and TLS settings. Check the complete server configuration after importing rather than looking at the UUID alone. An incorrect device clock can also affect authentication.
A proxy protocol whose name alone does not mean that encrypted transport is enabled. The server may require a particular transport layer, security parameters, or other related fields; check them together. Do not treat a VMess configuration as VLESS by simply changing the protocol name. Use the parameters supplied for your existing server.
A protocol that typically carries proxy traffic over TLS. The password is used for authentication, while TLS parameters establish and verify a secure connection. The server address and SNI may be the same or may be different values specified by your provider; do not fill them in based on guesswork. If certificate verification fails, first check the domain, device time, and provided parameters. Disabling verification should not be treated as a routine fix.
A QUIC-based proxy protocol that relies on UDP, so the current network's support for UDP traffic can affect connectivity. Authentication details, server name, and TLS settings must also match. If it works on one network but not another, check the network conditions too instead of repeatedly changing the password.
A protocol that establishes an encrypted tunnel using keys. Common parameters include the client private key, peer public key, endpoint, and tunnel addresses. Each field has a different purpose: the private and public keys are not interchangeable, and the endpoint is not the address inside the tunnel. A private key is sensitive; hide it before sharing screenshots or troubleshooting, and make sure the imported details come from your own configuration source.
Two different proxy protocols. Choose the one supported by the server; matching addresses and ports do not make them interchangeable. Some servers require a username and password, depending on their configuration. The protocol name alone also does not prove that traffic between the client and proxy server is encrypted; assess security based on the actual connection method.
Keywords describe match conditions; the policy at the end of a rule describes what happens after a match. The domains and address ranges below are syntax examples, not real server details.
Matches an exact domain. For example, DOMAIN,example.com,PROXY applies only to that domain. It does not automatically include subdomains such as www.example.com, so it is useful when you want to limit a rule to one hostname. Do not include a scheme, port, or URL path in the rule domain; those are not part of the domain name.
Matches a domain suffix. For example, DOMAIN-SUFFIX,example.com,PROXY covers example.com and its subdomains. Use it for a single domain family, but note that it will not automatically cover related resources on other domains. To handle a subdomain as an exception, put a more specific DOMAIN rule first.
Checks whether a domain contains a specified string. For example, DOMAIN-KEYWORD,ads,REJECT matches requests with that string in the domain. It does not search webpage content or the full URL, and the match may be broader than expected. Before using it to block traffic, check which domains it actually matches. Prefer a narrower condition when an exact domain will do.
Matches a destination based on its region in an IP geolocation database, for example, GEOIP,CN,DIRECT. It checks the IP address's assigned region, not the website's language, company location, or page content. Results depend on the destination IP and database data, so the same website may match different conditions on different networks or with different DNS results.
Matches IPv4 and IPv6 address ranges; the prefix length after the range determines which addresses are included. The example IP-CIDR,192.0.2.0/24,DIRECT uses a documentation-only range to illustrate the syntax and should not be copied as a real traffic rule. When checking these rules, account for both IPv4 and IPv6; covering only one address family may miss actual requests.
Matches identifiable User-Agent information in a request, for traffic with the relevant request characteristics. This is not a general way to route traffic by app name, and not all encrypted requests expose information that can be matched. If a rule does not match, first check whether the client can access the relevant information instead of changing the match string alone.
Handles requests that have not matched any earlier rules, serving as the fallback for the entire rule list. FINAL,PROXY sends remaining requests to PROXY, while FINAL,DIRECT sends them to DIRECT. FINAL usually belongs at the end of the list. Placing it before specific rules prevents those later rules from handling the requests.
PROXY, DIRECT, and REJECT answer the question: what happens after a match? Policy names are not protocol names or server parameters. Check the capitalization and context against the original configuration.
Sends matching requests through the proxy path specified in the configuration. The server used depends on the current selection and configuration. PROXY is not a server address and does not fill in missing authentication details. If a request matches PROXY but still cannot connect, check the server connection, protocol fields, and destination service, not just the rule syntax.
Connects directly to the destination without using a proxy server, but traffic may still be processed by the client's rules. A DIRECT policy on one rule does not mean the connection toggle is off, nor does it mean Global Routing is set to Direct. If a direct connection fails, check whether the current network can reach the destination and whether DNS is working.
Rejects matching requests and is useful for targets or request characteristics that should clearly be blocked. Overly broad conditions may also block sign-ins, images, or other required resources, so check the match scope before adding a rule. If a page only loads partially, check whether REJECT matched instead of immediately routing all traffic through PROXY.
Rules are generally checked from top to bottom. The first match determines how a request is handled; later, more specific conditions do not cause the client to reconsider the match. Put exceptions such as a single domain before broader conditions, and place FINAL last. After changing rules, make a new request and check the match in the available connection logs; an existing connection can affect the result.
A subscription typically provides a server list, while a configuration file provides rules and related behavior. Importing one does not mean the other is set up, and neither guarantees that a connection has been established.
Fetches and updates a server list using an existing subscription link. Get the link from your own provider. Whether the subscription includes groups or other details depends on the source format; it is not the same as a complete rule configuration. Subscription links may contain access credentials, so hide the full URL and sensitive parameters when reporting an issue or sharing a screenshot.
The address, port, protocol, authentication, and other parameters needed to connect, often referred to as server details. The display name in a list is for identification and is not a reliable guide to the protocol or actual location. Whether entering details manually or importing a subscription, use information from your own provider; example domains in a guide are not usable servers.
Config is both the screen for managing configuration files and the name of a Global Routing mode that applies configuration rules to traffic. Use context to tell which meaning applies. A file saved in Config is not necessarily active, and selecting a file does not guarantee that the overall routing mode is correct. To verify the setup, check the current file, its Rule section, and Global Routing in that order.
These names identify different sections of a configuration file: General contains common settings, Rule contains traffic-routing rules, Host defines hostname mappings, and URL Rewrite handles URL rewriting. URL rewriting is not ordinary domain-based routing; whether it applies depends on the request and related conditions. Keep a copy of the original configuration before editing, and do not put rule lines in the wrong section.
The process of resolving a domain name to an IP address. It is an important step before connecting to a destination and can affect rules that depend on destination IPs. If a server connection test succeeds but a webpage will not load, DNS may still be the problem. When changing DNS settings, note the original values and distinguish server hostname resolution from resolution of the destination website's domain.
Fetches a server list again from its subscription source. If the source returns different content, server names, counts, and parameters may also change. A successful update does not guarantee that every server is reachable, and a failed update is not a reason to immediately delete the existing list. First check the link, current network, and source status. Keep any usable details before deciding whether to import again.
Once you understand the terms, choose the guide that matches your current task. Avoid changing server details, configuration, and system settings all at once.