Look up interface controls, protocols, and rule policies by name. First distinguish when to connect, what to match, and which route to use; then change the relevant setting. Menu locations vary by platform.
Common iPhone and iPad interface terms help you find the right screen. Check connection status, overall routing, and server selection separately.
On iPhone and iPad, Home is the main screen for checking connection status and the SERVER list. Not Connected means there is no active connection. A server entry only means its details have been saved; it does not confirm successful authentication or access.
To check a connection, first confirm the selected server, then check the status after turning on the switch. A successful subscription update does not mean the connection works.
Global Routing determines how traffic is handled overall. The interface options are Config, Proxy, and Direct. Config applies the current configuration's rules, Proxy uses the proxy route, and Direct connects directly.
If rules are not behaving as expected, first confirm that Config is selected. Switching to Proxy does not prove that a particular rule matched.
On iPhone and iPad, On Demand triggers connections according to configured system network conditions. Check the available options in the app. It determines when a connection starts; Rule determines where traffic goes after it starts. They are separate controls.
If the connection drops after a manual disconnect, check whether the On Demand conditions are still met instead of repeatedly deleting server entries.
Connectivity Test is a diagnostic tool for checking server reachability or response results using a selected test method. A failed test may be caused by the current network, target address, or server parameters; do not assume the rules are at fault.
For a meaningful comparison, use the same network and test method. Test results do not replace a real website access check or measure download bandwidth.
Settings is the central entry point for app preferences. Available options vary by platform and interface. A setting mentioned in a guide does not necessarily need to be changed on every device.
Before troubleshooting, note the original values. Change one option directly related to the issue at a time, then test the same target again to see whether it helped.
Add Server is for manually entering a user's existing server details. Select the correct protocol first, then enter the address, port, and required authentication fields. An address alone is usually not enough; additional parameters such as TLS and transport settings may be required.
Check each field against your own server details. Do not paste an entire subscription link into the server address field.
On every platform, configure the app to match the protocol and parameters of your existing server. A protocol name describes how it communicates; it does not indicate speed or replace the server configuration.
Shadowsocks is an encrypted proxy protocol. Common fields include the server address, port, encryption method, and password. The encryption method is a protocol parameter; do not substitute one just because its name looks similar.
If the connection fails, first check that the encryption method and password exactly match the server. Preserve any additional options included in your server details.
VMess is a proxy protocol that authenticates using a user ID and other details. In addition to the server address and port, it may require a transport method, path, and TLS parameters. The same user ID does not make arbitrary transport settings interchangeable.
After importing, check the protocol and all fields, especially the path and server name.
VLESS is a proxy protocol. The name alone does not indicate that the transport is encrypted; check settings such as TLS to determine its security. The user ID, transport type, and related security parameters must match the server.
Do not just change the protocol name on another entry to VLESS. Create or reimport a complete entry using your existing server details.
Trojan is commonly used with TLS. A connection requires both password authentication and valid server name and certificate verification settings. Certificate errors and password errors occur at different stages and require different fixes.
If a verification warning appears, check the device time, server name, and server certificate first. Disabling verification is not a routine fix.
Hysteria2 is a QUIC-based proxy protocol that requires working UDP connectivity and correct authentication and TLS parameters. Being able to open regular websites on a network does not mean its UDP path is available.
During troubleshooting, compare results on another network, then check the server port and parameters. One timeout is not enough to conclude that the protocol is unsupported.
WireGuard is a key-authenticated tunneling protocol. Its configuration typically includes a private key, peer public key, endpoint, tunnel address, and routing range. Its key-based authentication is different from ordinary password authentication, so the fields are not interchangeable.
Hide private keys when sharing diagnostic details. A successful handshake does not confirm that DNS and destination routing are configured correctly.
With Config selected, rules are checked from top to bottom, and the matching rule's policy is applied. Keywords determine what to match; policies determine how to handle it.
DOMAIN matches an exact, complete domain name. For example, DOMAIN,example.com,DIRECT applies to example.com. It does not automatically include all subdomains, and it does not match URL paths.
Use this keyword to narrow a rule to a specific hostname. After making a change, check whether an earlier rule already matches first.
DOMAIN-SUFFIX matches a domain and its subdomains, such as example.com and www.example.com. It matches domain levels, not arbitrary strings containing the text, and does not include URL paths.
When subdomains need different policies, put the more specific rules first, followed by the suffix rule for the broader domain.
IP-CIDR and IP-CIDR6 match IPv4 and IPv6 address ranges, respectively. For example, IP-CIDR,192.168.0.0/16,DIRECT specifies an IPv4 network range. The prefix length after the slash determines the range; it is not a port number.
Adding IPv4 rules alone does not cover IPv6. Check the actual DNS results and connection records to see which address type the target uses.
GEOIP matches based on the IP geolocation database's location data, not a website's language, domain suffix, or company's registered address. A domain that uses multiple service addresses may produce different match results for different connections.
For consistent handling of a specific domain, consider a more specific domain rule instead of relying only on geolocation.
FINAL is a catch-all rule placed at the end to handle traffic that has not matched an earlier rule, for example, FINAL,PROXY. It does not raise the priority of preceding rules; it specifies what happens to the remaining connections.
Place it at the end of the rules. If it appears too early, later specific rules cannot handle traffic already caught by it.
PROXY is a rule policy that sends matching traffic through the proxy route. The connection still depends on the selected server and related settings. It differs in capitalization and scope from Proxy mode under Global Routing.
A rule specifying PROXY does not guarantee a successful connection. Authentication, server reachability, and DNS still need to be checked separately.
DIRECT means matching connections bypass the selected proxy server and reach the destination through the current network. It does not bypass DNS or guarantee that the destination is reachable.
DIRECT in a rule applies only to matching connections. Direct under Global Routing controls overall routing; distinguish the two when troubleshooting.
REJECT actively rejects matching connections; it is not a proxy server timeout. If a page loads but some features are missing, check whether the relevant requests matched this policy.
When making changes, identify the specific domain and rule position, then narrow the match scope. Do not delete an entire configuration section before identifying the cause.
On every platform, use your existing subscription or server details. The server list contains connection details; the configuration file contains rules and related settings. They are not interchangeable.
A subscription uses a link to retrieve and update a server list; Subscribe is the name of the related interface entry. A successful update means the list was retrieved and parsed, not that every server in it is reachable.
Authentication parameters in a link are sensitive. Hide them before sharing screenshots or logs. Before updating, also check whether manually edited entries may be overwritten.
A server entry describes the remote service the client connects to, usually including its address, port, protocol, and authentication parameters. SERVER is the label for the list in the interface. A display name only identifies an entry; it does not indicate its protocol or performance.
Two entries with the same name may use different addresses. Compare the actual fields when troubleshooting, not just the names or groups.
A configuration file organizes general options, rules, and other feature sections. Common sections include [General], [Rule], [Host], and [URL Rewrite]. Config may refer to a configuration entry or to the routing mode that applies configuration rules.
After downloading or saving a file, confirm that it is the active configuration. Having the file does not mean it is enabled.
DNS resolves domain names to IP addresses as part of the connection process. A DNS resolution failure, an unreachable proxy server, and a destination service refusing access are different problems; changing DNS is not a fix for all of them.
When troubleshooting, note the failing domain, current network, and actual DNS result, then check the DNS settings in the configuration. Avoid changing routing and DNS at the same time.
URL Rewrite rewrites or redirects request URLs according to conditions. It is not the same as selecting a connection policy in Rule. A changed URL may reach a different destination, but it does not switch the overall routing mode.
HTTPS handling is also subject to encryption and certificate requirements. A rewrite rule cannot directly read all encrypted requests.
Latency is the response time observed under specific test conditions, reflecting that test path rather than sustained download bandwidth. A low value does not guarantee that authentication, DNS resolution, or real webpage loading will work.
For comparisons, use the same device, network, and test method, and consider actual access results. One-off readings from different networks are not directly comparable.
For iPhone and iPad, check the App Store listing for system requirements. For Mac, Windows, Android, and Linux, see the app download page for installation steps. System installation permissions and in-app connection authorization are separate.
The first time you connect on iPhone or iPad, the system may ask to add a VPN configuration. This permission lets the client establish a network tunnel. You still need valid server details; granting permission does not create a subscription or remote service.
If permission is denied, use the system prompt or Settings to review it. A VPN indicator in the system status does not, by itself, confirm that every destination is reachable.
On iPhone and iPad, Purchased Items lets you find app purchases made with your original account. When switching devices or reinstalling, first check which account was used for the purchase. Redownloading the app is separate from restoring server lists, subscriptions, and configuration files; restore those from your own backups.
The iPhone and iPad version costs $2.99 as a one-time App Store purchase. The Mac, Windows, Android, and Linux versions are free. The amount shown may vary by storefront; check the store listing.
The Apple Silicon and Intel Mac versions target different processor architectures. Check the chip or processor in About This Mac, then choose the matching DMG. These packages do not represent different feature modes, and you cannot identify the right one from the computer's appearance or name.
If you see a warning that the developer cannot be verified when opening the app for the first time, first confirm that the file came from this site. Then go to Privacy & Security in System Settings and select “Open Anyway.” See the installation approval guide for the full steps.
Windows SmartScreen, macOS launch warnings, and Android's “Allow unknown apps” setting are operating system controls on downloaded files, not subscription or protocol errors. After confirming that the file came from this site, Windows users can select “More info → Run anyway.” On Android, grant the relevant permission only to the browser that downloaded the file.
The Linux AppImage also needs execute permission. Follow the prompt for your platform; do not disable system-wide protections for a single installation. See the installation approval guide for detailed steps.