For users who already have a working connection configured in Shadowrocket and want only selected websites to use a proxy. Add domain rules to the active Config, put FINAL,DIRECT at the end, then set Home → Global Routing to Config. Check request logs for the domain, matched rule, and resulting policy; a page loading successfully alone does not confirm the rules are working.
1. Understand rule-based routing and Global Routing
Routing only selected websites means meeting two conditions: the target domain matches PROXY, and all other requests fall through to DIRECT. Domain rules determine the first; the final FINAL rule determines the second. Both depend on the active connection using the configured rules. If Global Routing is set to Proxy or Direct, editing the rules file alone will not produce the routing described here.
| Global Routing option | What it does | For this guide |
|---|---|---|
| Config | Uses the rules in the current Config to determine the policy. | Select this option to test domain rules. |
| Proxy | Routes traffic through the proxy without applying the domain allowlist described here. | Do not use it to test FINAL,DIRECT. |
| Direct | Routes traffic directly. | Do not mistake a direct connection for a failed domain rule. |
| Scene | Behavior is determined by the configured scene conditions. | When troubleshooting, switch to Config first to rule out scene changes. |
Here, PROXY means the proxy policy and DIRECT means a direct connection to the destination. Before you begin, confirm that the selected proxy connection on Home works. If your Config uses a custom policy group, check that the policy name referenced by the final rule actually exists. Do not copy a group name from another Config without verifying it.
2. Complete rules with DOMAIN-SUFFIX and FINAL,DIRECT
The following is a complete [Rule] section for illustrating the syntax, not a complete configuration file with connection parameters, DNS, and other settings. example.com and example.net are example domains; replace them with the domains you actually want to proxy. These examples are not working services.
[Rule]
DOMAIN-SUFFIX,example.com,PROXY
DOMAIN-SUFFIX,example.net,PROXY
FINAL,DIRECTDOMAIN-SUFFIX,example.com,PROXY matches example.com itself and its subdomains, such as www.example.com and api.example.com. It does not match notexample.com or example.com.other.net as the same domain suffix. This rule matches domain names, not arbitrary text in a web address.
- Do not include
https://, a port, path, or query parameters in the domain field. - For
https://www.example.com:443/account, enter only the domain in the rule; do not include/account. - Put each rule on its own line and separate fields with commas. Keep keywords such as
PROXYandDIRECTunchanged. FINAL,DIRECThas no domain field: it sends requests that did not match an earlier rule directly.
3. Apply rules in order; saving the text is not enough
The steps below use the Home, Config, and Settings interface. The editing workflow may vary by platform, but you must complete all four actions: edit the file, save it, make it the active Config, and run traffic using Config. Whether a subscription provides connection details and whether its rules are enabled are separate things to check.
-
Back up your Config
Open Config and save a copy of the current file or export a backup first. Note which Config is active so you do not edit one file while continuing to use an older one.
-
Organize the rules
Open the file you plan to use and locate
[Rule]. Add the required DOMAIN-SUFFIX rules, review existing rules, and leaveFINAL,DIRECTat the end. -
Activate the file
Save your changes, then confirm in Config that this file is now active. If it comes from a remote update, check whether a later update could overwrite your local edits.
-
Set the routing mode
Go back to Home → Global Routing, select Config, then confirm the selected proxy connection on Home works and enable the connection.
-
Generate new requests
If it is safe to interrupt the connection, reconnect. Close the current page and open it again to generate new network requests, then check the match results in the request log.
Get existing subscription links from your service provider. Do not repeatedly delete a subscription just to change routing rules, and never paste a subscription URL into a DOMAIN-SUFFIX domain field. Settings → On Demand controls automatic connection conditions; it does not determine whether a domain uses PROXY or DIRECT. While troubleshooting, check whether it has triggered a reconnection so you do not mistake automatic behavior for a rule change.
4. Choosing DOMAIN or DOMAIN-SUFFIX and placing exceptions
Rules are evaluated from top to bottom, and the first match determines the policy for a request. To proxy an entire site while sending one subdomain directly, put the more specific exception first. The example below sends status.example.com directly and proxies other domains under example.com.
[Rule]
DOMAIN,status.example.com,DIRECT
DOMAIN-SUFFIX,example.com,PROXY
FINAL,DIRECT| Rule keyword | What it matches | Notes for this use case |
|---|---|---|
| DOMAIN | Matches one exact domain. | Proxy a single host or set an exception for one subdomain. |
| DOMAIN-SUFFIX | Matches the domain itself and its subdomains. | Useful for routing a site's main domain and services under the same suffix together. |
| IP-CIDR | Matches an IPv4 address range. | Use for a specific address range; it cannot match website paths. |
| GEOIP | Matches based on the geographic location associated with the destination IP. | It does not match page content, domain suffixes, or the user's location. |
| FINAL | Catches requests that did not match an earlier rule. | This guide uses DIRECT and adds no rules after it. |
For example, IP-CIDR,192.168.0.0/16,DIRECT,no-resolve matches this private address range and sends it directly. no-resolve avoids triggering a DNS lookup solely to match this IP rule. It is not required on every rule, nor does it solve cases where a website uses additional resource domains that are not covered.
Decision: A domain allowlist does not need geographic routing rules
If your goal is to proxy only the domains you list, start with any exact-match exceptions, the domain proxy rules, and FINAL,DIRECT. Before adding GEOIP or broad IP proxy rules, identify which requests they are meant to affect; otherwise, earlier matches can change what “all others go direct” means.
5. Verify the rules: check the domain, matched rule, and policy
A page loading successfully does not prove it used the proxy; a page failing to load does not prove the rule failed to match. Even with the correct rule, the proxy connection, destination service, DNS, or TLS can still fail. Check the app's request log or connection details and review the target domain, matched rule, and resulting policy for the same new request. Log locations and displayed fields vary by platform.
| Test request | Expected match | Expected policy |
|---|---|---|
| www.example.com | DOMAIN-SUFFIX,example.com | PROXY |
| status.example.com | DOMAIN,status.example.com | DIRECT |
| www.example.org | FINAL | DIRECT |
The table above illustrates how the rules should behave; it is not the result of live tests against the example sites. For real testing, use domains you are authorized to access and create a new connection for each one. A browser may reuse an existing connection or show cached content. Simply viewing a page that was already open may not generate a request that tests the updated rules.
- Check the routing mode first: Home → Global Routing must be set to Config, and the active file must be the one you just saved.
- Then check the match: If the target domain matches FINAL, check for typos, whether the subdomain belongs to the expected domain, and whether domain information is available.
- Then check the policy: If the specified rule matched but traffic took an unexpected route, check the policy reference and the currently selected connection.
- Finally, check the response: Once the policy is correct, investigate the proxy server port, destination response, and certificate errors.
6. Troubleshoot partial page loads and connection errors
A website may request content from its main domain, a login domain, static asset domains, and video domains. Routing the main domain through a proxy does not mean all resources share its suffix. For example, if the page also requests assets.example.net, DOMAIN-SUFFIX,example.com,PROXY will not cover it. Find the actual domain in the failed request before adding a rule; do not broaden proxy coverage based on guesswork.
Error: connection refused
Cause: The connection to the destination port was refused, either by the proxy server or by the direct destination. Fix: Check the policy and remote address in the request log. If it used PROXY, consult your existing service details to verify the server address and port. Do not route every domain through a proxy just to make the error disappear.
Error: i/o timeout
Cause: The network operation did not complete before the timeout. This message alone cannot tell you whether the issue is with the rules, connection, or destination. Fix: First confirm which rule matched, then test the current proxy connection and a new request to the same destination separately. Change one condition at a time.
Error: no such host
Cause: DNS did not return a usable result, possibly because of a typo or a failed lookup. Fix: Check the actual request domain and current DNS configuration. Resolve the lookup issue first, then check whether the request matches DOMAIN-SUFFIX or FINAL.
These are common snippets from network logs. Full messages may include addresses, ports, and other context, and not every platform displays exactly the same alert. If you share a log for troubleshooting, include the time, target domain, matched rule, and policy. Remove subscription tokens, passwords, and other connection credentials before sharing.
7. FAQ: Path-based routing, overwritten rules, and what DIRECT means
Can I route only a website's /video path through the proxy?
DOMAIN-SUFFIX cannot route traffic by URL path. It matches domain names and does not use /video as a match field. An HTTPS path is not information that a standard domain rule can match directly. Check whether the service uses a separate subdomain; if it does, you can match that subdomain exactly with DOMAIN.
Why are some other websites still using the proxy after I set FINAL,DIRECT?
First confirm that Home → Global Routing is set to Config, then review the rules before FINAL. An earlier matching DOMAIN-SUFFIX, IP-CIDR, GEOIP, or rule set may already determine the policy. FINAL handles only requests that remain; it does not override earlier matches.
The rules worked yesterday. Why did they disappear after a Config update?
Open the active file in Config and look for the domain rules you added. A remote Config update may replace local text. Keep a separate copy of your local Config and compare the rules before and after an update. Refreshing a connection subscription and updating a remote rules file are separate actions.
Does DIRECT for everything else mean no other app traffic uses the proxy?
It means requests handled by the current rules that did not match an earlier rule use DIRECT. It does not guarantee how all traffic on the device is routed. Check the request logs for the apps you are testing, and make sure other system proxy, VPN, or in-app proxy settings are not affecting the results.
Keep a minimal ruleset that you can reproduce: the domains that need a proxy, any necessary exact-match exceptions, and FINAL,DIRECT at the end. Each time you add a site, repeat the same checks: create a new request, see which rule matches, and verify the policy. For more rule types, see the Rules reference; look up terminology in the Terminology guide.