Shadowrocket 2.2.92 Mac

Shadowrocket requires a Mac running macOS 10.15 Catalina or newer. It runs natively on both Intel and Apple Silicon machines.

What does Shadowrocket do?

It is a proxy client that intercepts HTTP, HTTPS, and TCP traffic from your applications and forwards it to a proxy server. Instead of configuring each app individually, you set the routing rules once and the program handles the rest.

Juggling proxies for specific sites and apps

People who need fine-grained control over which traffic goes through a proxy and which stays direct. That includes developers testing geo-specific services, users on restricted networks, and anyone juggling multiple proxy connections for different sites or apps.

How does the rule system work?

Rules match traffic by domain name, domain suffix, domain keyword, CIDR IP range, or GeoIP country lookups. You can import rule files from a URL or iCloud Drive, and script filters are supported for more complex logic. URL rewriting and local DNS mapping are available as well.

What proxy types are supported?

Shadowsocks, V2Ray, and SOCKS5 are all supported, with full IPv6 compatibility. The app also measures traffic usage and network speed on both direct Wi‑Fi and proxy connections.

Throughput stats hidden in the menu bar icon

The menu bar icon is more useful than it first appears. A long press or a right‑click on it shows current throughput numbers — upload and download speeds updated in real time — without opening the main window. If you prefer a cleaner desktop, the app respects macOS Hide and Show behaviour when you press Command‑Tab away from it, and the Dock icon can be turned off entirely from preferences so it lives only in the menu bar.

Double‑clicking a server entry in the table opens the configuration pane, but Option‑clicking the same row copies its JSON payload to the clipboard. That is the fastest way to share a server config with a colleague or paste it into a text file for backup. The server table also supports multi‑selection now; you can select several rows, right‑click, and toggle them all on or off at once — a fix that arrived in version 2.2.92.

Another overlooked shortcut: pressing Command‑K while the main window is focused opens the proxy‑switching popover. You can type the first few letters of a server name, hit Return, and the connection switches without your hands leaving the keyboard.

Import rules from a URL to stay current

Start with one rule file imported from a URL, not from iCloud Drive. The URL method keeps the rule set fresh because the app can re‑fetch it when you click Update Rules. If you import a static file from iCloud, you will need to remember to replace it manually when upstream rules change, and a stale domain list breaks ad blocking and geo‑specific routing faster than you would expect.

Enable the logging pane early. It records every HTTP, HTTPS, and DNS request the machine makes, grouped by application. Watching it for ten minutes shows you which background processes — updaters, analytics scripts, telemetry endpoints — are talking to the network. You can then build a small deny‑list of domains and user‑agent strings right inside the app, long before you write any complex rule set. The user‑agent blocking catches tracking scripts that domain rules sometimes miss.

If you use a multi‑level proxy setup — an entry node that feeds into a second hop — configure both servers first and then assign the chain from the server details panel. New users often try to stack them by switching connections quickly, which causes a brief traffic leak between the switch. A configured chain avoids that gap entirely.

For DNS, decide on a single strategy before you mix methods. The app can do local DNS mapping, DNS over HTTPS, DNS over TLS, and DNS over QUIC all at the same time, but that overlap makes troubleshooting slow. Pick one encrypted DNS provider, set it globally, and only add local mapping entries for specific internal hostnames if you have a homelab or dev cluster.

Untrusted Wi‑Fi, one click to your safe proxy

You arrive at a co‑working space with a MacBook. The Wi‑Fi is open but you do not trust it. You click the Shadowrocket menu bar icon — the Dock icon has been hidden since day one — and select your usual Shadowsocks server. The menu bar indicator turns blue and a tiny speed‑test bar appears briefly.

You open a browser and visit a site that is geo‑blocked in the country you are physically in. The rule you wrote weeks ago — a domain‑suffix match for that site’s top‑level domain — routes the traffic through the proxy automatically. You did not think about it; the rule just worked. You check the log panel out of curiosity: the HTTPS request shows a clean tunnel to the proxy server, no direct DNS leak.

Meanwhile, a Slack message arrives. Slack’s domains are set to go directly over the local Wi‑Fi because you do not want the latency of a proxy hop for real‑time chat. You can see that in the log too: the slack.com entries show a direct connection with a green label, while the geo‑blocked site entries show a proxy label with the server name.

Later you need to test how an internal staging server resolves for a colleague in Seoul. You open the local DNS mapping section, add a temporary entry for the staging hostname pointing to a Korean IP, and enable the override. The browser picks it up immediately after a cache flush. The mapping sits separate from the main rule set, so you remove it in three clicks when the test is done.

Before packing up, you glance at the traffic‑usage tab. It shows the session totals for both the direct interface and the proxy interface, broken down by upload and download. You make a mental note that the proxy‑side download is a few hundred megabytes lower than expected — probably because you turned on domain‑based ad blocking last week and a chunk of media requests were dropped before they reached the tunnel.

Turning on decryption makes you the middleman

The most common mistake is turning on HTTPS decryption without understanding what it does. Decrypting traffic lets the app inspect the contents of encrypted requests, but it installs a local certificate on your Mac and effectively man‑in‑the‑middles your own connection. Many internal services and banking sites break when they detect this. Leave it off unless you have a specific debugging need and a test device you can reset afterward.

Another frequent error: assigning a single rule file and assuming it handles everything. A rule file that blocks ads by domain will not block tracker‑laden user agents, and a GeoIP rule that routes traffic through a proxy will not stop DNS queries from leaking to the local resolver. The app gives you separate tools for domain blocking, user‑agent blocking, and DNS encryption; they work best when layered together, not treated as one‑size‑fits‑all.

Beginners also import a large rule set from a public URL and then forget to set an update interval. Rules that are correct today can be six months out of date by summer, leaving new tracking domains unblocked and old proxy routes pointing at dead servers. The app can fetch updated rules in the background, but it needs a schedule to do so.

Finally, many new users assume the proxy tunnel covers all traffic by default. It does not. Until you attach a rule to a domain or IP range, that traffic goes direct. A quick check of the log pane after installation shows exactly which connections are bypassing the proxy, and that list often surprises people.

Version 2.2.92 patches interface bugs in the server tables, the menu bar, and the Dock icon on macOS.

• macOS 10.15 or later
• Intel or Apple Silicon Mac