For users with a working connection configuration who want only selected websites to use a proxy. Set Home → Global Routing to Config, list the target domains in the current configuration’s [Rule] section, then use FINAL,DIRECT for all other requests. This guide covers a minimal rule set, match order, step-by-step verification, and troubleshooting. Example domains illustrate the syntax and should be replaced with the domains you actually visit.
1. Check Global Routing and the active configuration
Shadowrocket’s connection toggle and routing rules have separate roles: the toggle enables the connection, while Global Routing determines how traffic is routed. To send selected websites through a proxy and everything else direct, choose Config. Adding rules to a file while Global Routing is set to Proxy or Direct won’t test those rules.
This guide assumes you already have connection details and a working configuration for a service you’re authorized to use. Purchasing the client and obtaining a connection service are separate. Shadowrocket is a closed-source, paid app available as a one-time purchase through the App Store on Apple platforms, primarily iPhone and iPad. Check the App Store listing for system requirements and purchase availability.
| Setting | Purpose | How this guide uses it |
|---|---|---|
| Proxy | Routes all traffic through a proxy, without applying this guide’s domain rules | Use only to test the proxy route separately |
| Direct | Routes all traffic direct | Cannot be used to verify that selected domains use a proxy |
| Config | Applies policies according to the rules in the current configuration | Used in this guide |
| Scene | Applies routing settings according to the configured Scene conditions | Set it to Config first to reduce variables when switching environments |
- On Home, confirm that the selected server configuration is one you’re authorized to use and can connect to.
- Open Config and confirm the active configuration is the one you intend to edit. Save a copy first so you can restore the original if needed.
- Go to Home → Global Routing and select Config. Verify the settings before turning on the connection.
Server details on Home and rule files in Config are separate settings. Updating a subscription typically refreshes connection entries; it does not necessarily activate the rule file you just edited. Check the active configuration before each test.
2. Minimal rules with DOMAIN-SUFFIX
For a website and its subdomains, DOMAIN-SUFFIX is usually the best choice. The example below sends domains ending in example.com and example.net through PROXY and all other requests through DIRECT. These domains illustrate the syntax and are not service recommendations.
[Rule]
DOMAIN-SUFFIX,example.com,PROXY
DOMAIN-SUFFIX,example.net,PROXY
FINAL,DIRECTIf your current configuration already contains [Rule], edit that section instead of adding a duplicate or replacing the entire configuration with these four lines. Keep and review existing DNS settings, policy groups, and other options separately. If you keep existing rules, check whether they broaden the scope of traffic sent through a proxy.
DOMAIN-SUFFIX,example.com,PROXY: Matchesexample.comand subdomains such aswww.example.comandapi.example.com.DOMAIN,login.example.org,PROXY: Matches only this exact domain; it does not automatically include its subdomains.FINAL,DIRECT: Routes requests that did not match an earlier rule directly. Put it at the end of the rule section.
Domains in rules should not include https://, paths, query parameters, or ports. Even if the address is https://www.example.com:443/account, enter example.com. DOMAIN-SUFFIX does not match URL paths.
3. Combining DOMAIN-KEYWORD with rule order
DOMAIN-KEYWORD matches keywords within a domain and usually has a broader scope than DOMAIN-SUFFIX. For example, DOMAIN-KEYWORD,example,PROXY may match not only example.com, but also myexample.net. If you only need to route a few known websites, listing their domain suffixes is usually easier to review.
Rules are checked from top to bottom, and the first match determines the policy. Put exceptions before broader rules and FINAL last. This example sends the login subdomain direct, routes the main site’s other subdomains through a proxy, and shows where a keyword rule belongs:
[Rule]
DOMAIN,login.example.com,DIRECT
DOMAIN-SUFFIX,example.com,PROXY
DOMAIN-KEYWORD,examplemedia,PROXY
FINAL,DIRECT| Requested domain | First matching rule | Policy |
|---|---|---|
login.example.com | Exact DOMAIN match | DIRECT |
img.example.com | DOMAIN-SUFFIX | PROXY |
cdn.examplemedia.net | DOMAIN-KEYWORD | PROXY |
example.org | FINAL | DIRECT |
Takeaway: List individual domains for a small number of sites
Start with DOMAIN and DOMAIN-SUFFIX only. Once you’ve confirmed all target sites work, consider whether DOMAIN-KEYWORD is necessary. For every keyword rule you add, test it against a domain you expect not to match.
If everything else should go direct, review existing GEOIP and IP-CIDR rules as well. For example, an old GEOIP,US,PROXY rule may still proxy other requests whose IP addresses are classified as belonging to the US, even with FINAL,DIRECT at the end. IP-CIDR matches address ranges; it cannot replace a domain list for websites whose IP addresses change.
4. Verify routing after saving
A page loading does not prove that the expected rule matched, and a page failing to load does not prove that the rule is wrong. Check which policy the rule selected separately from whether that route can establish a connection. The steps below describe what to check, not the app interface.
- Confirm the file is active: After saving, return to Config and check which file is enabled. On Home → Global Routing, confirm the setting is still Config.
- Start a fresh connection: Close and reopen the test page. If needed, disconnect and reconnect Shadowrocket to reduce the impact of reused connections.
- Test a matching domain: Visit a target site and check the connection records or logs in the app for the Host, matching rule, and policy. Available fields may vary; use what the current interface provides.
- Test a non-matching domain: Visit a site not listed in your rules and confirm its request uses DIRECT. Don’t check just one target site.
- Check dependent requests: If the page text loads but images, video, or sign-in fail, check the domains those resources actually request and decide whether to add separate rules.
A page may request content from the main site, a sign-in API, image hosts, and separate CDN domains. DOMAIN-SUFFIX only covers domains with the specified suffix; it won’t automatically route a resource through the proxy just because it appears on the page. Use connection records to identify any necessary domains instead of continually broadening keyword rules.
Also distinguish DNS resolution from connection routing: FINAL,DIRECT selects the route for connections that don’t match earlier rules; it does not force all DNS queries to go direct. DNS resolution paths are controlled by their own settings. If records show only an IP address and no usable domain information, domain rules may not match as expected. Check the app’s actual records and DNS settings first.
5. Troubleshoot timeouts, refused connections, and rule misses
Check the policy shown in the request records before investigating the error. Connection logs may show low-level errors like the ones below, sometimes alongside an address or other context. These errors do not necessarily indicate a syntax problem and are not, by themselves, a reason to add more domain rules.
Error: Connection timed out
Cause and next steps: The connection did not complete in time. The selected proxy, destination address, or network route may be involved. First check whether the request used PROXY or DIRECT. If it used PROXY, test the selected connection against another known-working destination before broadening your rules.
Error: Connection refused
Cause and next steps: The destination port refused the connection, often because the port is incorrect or no service is listening. Check the address, port, and service status in your existing configuration. For example, if the service specifies port 443, don’t change it to 80—or assume from this error alone that every service should use 443.
- Target still shows DIRECT: First check that Global Routing is set to Config, then verify the active file and domain spelling. Finally, check whether an earlier DIRECT rule matched.
- Unrelated sites also show PROXY: Check for broad DOMAIN-KEYWORD, IP-CIDR, or GEOIP rules, and confirm the final rule is still FINAL,PROXY.
- Routing changes only after switching networks: Check whether Scene is in use. Also go to Settings → On Demand and review the on-demand connection conditions. On Demand controls when the connection is enabled; it does not replace DOMAIN-SUFFIX rules for selecting a request policy.
- Connection fails after a subscription update: Check the selected connection on Home and the active rules in Config separately. Changes to connection entries and domain rule matches are separate issues and should be troubleshot independently.
Takeaway: Change one variable at a time
Use the same test site, network, and proxy route for each round. First change the rules and check which one matches. If the match is correct but the request still fails, check the connection details. Avoid changing the route, DNS, and rules at the same time, or it will be hard to tell what caused the result.
6. Common questions about routing selected websites
Can I proxy just one page and send other pages direct using domain rules?
DOMAIN and DOMAIN-SUFFIX do not distinguish URL paths on the same domain. If two pages use the same Host, these rules route both with the same policy. Don’t enter a full URL with a path in DOMAIN-SUFFIX.
Do I need to add www.example.com after adding example.com?
Usually not when using DOMAIN-SUFFIX; the rule for example.com already covers www.example.com. If the site redirects to a different domain, add that domain based on connection records. Confirm which domain is actually requested before editing Config.
A site opens with Proxy but not with Config. What should I check first?
With Global Routing set to Config, make a fresh request and check whether the failed request matched PROXY. If it used DIRECT, check for a missing domain or an earlier rule. If it matched PROXY, investigate the actual route and the specific connection failure rather than adding duplicate rules.
Does FINAL,DIRECT disconnect Shadowrocket?
No. It routes requests that did not match an earlier rule through DIRECT; it does not turn off the connection. Keep Config selected and the connection enabled so domains that match earlier rules can still use PROXY.
Keep a verified copy of your configuration and note why you add each domain. For more details on settings, see the Settings Manual. If you’re unsure what a rule keyword means, check the Quick Reference, then return to the minimal rules and test one at a time.