This guide is for users with a working connection who want to proxy only selected websites. First confirm Config mode, then add domain rules in order and use FINAL,DIRECT for unmatched connections. Check request logs for the domains a page depends on; a page loading successfully alone does not confirm that routing is working as intended.
1. Supported platforms and prerequisites
Shadowrocket is available for iPhone, iPad, Mac, Windows, Android, and Linux. There are two ways to get it: the iPhone / iPad app is available on the App Store for a one-time $2.99 purchase; check the App Store listing for system requirements. The Mac (Apple silicon and Intel), Windows, Android, and Linux versions are free. See the download page for platform details. The steps below refer to the Home, Config, and Settings interface labels on iPhone / iPad; on other platforms, use the corresponding configuration and routing controls.
Rules determine which policy handles a connection; they do not provide connection credentials. This guide assumes you already have your own provider and subscription and can connect successfully. This site does not provide, sell, or recommend nodes or subscriptions. The app purchase does not include network service.
- Home: Make sure your own connection details are imported and a working connection is selected. Test its connectivity on its own.
- Config: Confirm which configuration file is active. Save a copy before editing so you can restore it if needed.
- Settings: Check On Demand during testing to ensure automatic connection conditions do not change the connection state and affect your results.
The connection list imported through a subscription and the rules in Config are separate settings. Updating the connection list does not select a configuration file, and updating a remote configuration may overwrite manual edits. Before you begin, identify whether you are changing connection settings, subscription entries, or routing rules.
2. Set Global Routing to Config
Routing selected websites through a proxy requires rules to make the decision. Go to Home → Global Routing and select Config to process connections according to the current configuration. Don’t switch to Proxy indefinitely just because a site won’t load temporarily; that changes the actual routing scope, even if the configuration itself stays the same.
Config: Follow the configuration
RecommendedUses the rules in the active configuration: matching domains go through PROXY, while unmatched connections fall through to FINAL,DIRECT.
Use for: Proxying selected websites and connecting directly to everything else, as in this guide.
Proxy: Proxy all traffic
Sends connections handled by the app through the proxy, without distinguishing sites using the domain list in this guide.
Use for: Temporarily checking whether the proxy connection works. Switch back to Config afterward.
Direct: Connect directly
Handles connections within the app’s scope as direct connections. This mode cannot verify whether domain rules select PROXY.
Use for: Temporarily checking whether your local network can connect directly.
Scene: Apply a scene
Routes traffic according to the configured scene. Check the scene settings when troubleshooting; the Scene label alone does not reveal the final policy.
Use for: Setups with an explicitly configured scene. This is not the starting point for the checks in this guide.
Check the mode first, then edit the rules
Set Global Routing to Config and confirm the name of the active configuration file. If it is still set to Proxy, adding DIRECT rules will not verify the routing behavior described here.
3. Minimal rules: domain list plus FINAL,DIRECT
Start with a narrow scope and add only domains you know need to use the proxy. The reserved example domains below illustrate the syntax; they are not recommendations for any real service or website. If you already have a complete configuration, add the relevant entries to its existing [Rule] section. Don’t create a duplicate section or replace the whole configuration with this example.
[Rule]
DOMAIN-SUFFIX,example.com,PROXY
DOMAIN-SUFFIX,example.net,PROXY
FINAL,DIRECTDOMAIN-SUFFIX,example.com,PROXY matches example.com and subdomains such as www.example.com and api.example.com. It is not a match for any string containing the same text, so similar text in another domain won’t trigger the rule. Don’t include https://, a port, path, or query parameters in the domain field.
Rules are checked in order, and the first match determines the policy. FINAL,DIRECT is a fallback for unmatched connections, not a way to identify domestic websites. It means any connection not matched by an earlier rule will try to connect directly. If a site fails to load directly, that doesn’t mean FINAL is broken; your current network may simply be unable to reach it directly.
PROXY means the proxy policy; DIRECT means a direct connection. These are not protocol names like Shadowsocks, VMess, VLESS, Trojan, Hysteria2, or WireGuard. The protocol is determined by the existing connection settings. With this simple list, also confirm that PROXY points to the intended proxy connection rather than a policy group with the same name that routes to DIRECT.
4. Where DOMAIN-KEYWORD and IP rules apply
Use DOMAIN-KEYWORD to match a string in a domain name. Keyword rules typically cover more domains than suffix rules. If you know the exact domain, prefer DOMAIN-SUFFIX. Use a keyword only when you explicitly need to cover multiple domains containing the same string.
[Rule]
DOMAIN-SUFFIX,example.com,PROXY
DOMAIN-KEYWORD,example,PROXY
FINAL,DIRECTIn this example, the second rule matches connections whose domains contain example, so domains beyond those matched by the first rule may also use PROXY. This is not equivalent to matching only example.com. In a real configuration, keep only the rule that fits your needs; avoid short keywords that broaden the proxy scope just to save time.
| Rule type | What it matches | How to use it in this guide |
|---|---|---|
DOMAIN-SUFFIX | A domain and its subdomains | For a specific list of website domains |
DOMAIN-KEYWORD | A string in the domain name | Add only after confirming the broader match is intentional |
IP-CIDR | An IPv4 address range | Use only when you know the target range |
GEOIP | An IP address’s geographic region in the database | Does not identify a website’s language, organization, or domain region |
FINAL | Connections not matched by earlier rules | Put at the end and set to DIRECT |
For example, IP-CIDR,192.0.2.0/24,PROXY,no-resolve uses a documentation-only address range and should not be added to a real rule list as-is. no-resolve means the rule won’t actively resolve a domain for matching; it does not disable all DNS. A connection made directly to an IP address may not have a hostname for domain rules to match, and websites sharing an IP address may belong to different services. Don’t casually route an entire IP range through PROXY based on a single DNS lookup for a website.
5. Save the configuration and verify each rule
Test both a site that should use the proxy and one that should connect directly; don’t rely on a single homepage. Browser cache, reused connections, and third-party page resources can all hide changes to the configuration. After each set of rule changes, save, create a fresh test connection, and check the actual matches in the request log.
-
Back up the configuration
Open Config and save a copy of the current configuration. If the original file comes from a remote URL, first check whether a later update will overwrite local changes.
-
Edit the rules
In Config, open the editor for the target configuration and find
[Rule]. Put the selected domain rules before FINAL, and check for any broader rules above them. -
Enable the configuration
Save and select the configuration, then go to Home → Global Routing → Config. Make sure an existing proxy connection works; disconnect and reconnect if needed.
-
Check connection conditions
Go to Settings → On Demand and review the connection conditions. During testing, avoid automatic connections or disconnections that could change the state. Then return to Home and confirm the connection switch is on.
-
Check requests
Visit a site on your list again, then visit one that isn’t. In the request log, check the destination host, matched rule, and actual policy; the results should correspond to PROXY and DIRECT, respectively.
If the homepage text loads but images or sign-in fail, check the actual hostnames used by the failing resources. A page may request content from separate domains for the main site, static assets, APIs, and authentication. Add only the domains confirmed to be part of that workflow and to require the proxy, placing each before FINAL, then test again. Don’t use an overly broad keyword that covers an entire public resource platform.
6. Common issues and fixes
Work through these checks in order: mode → active configuration → rule order → actual request hostname. Change one thing at a time and record the matches before and after saving. This helps distinguish routing-rule issues from problems with the proxy connection, DNS, or the destination website.
I added FINAL,DIRECT. Why are many sites still going through the proxy?
First check that Home → Global Routing is set to Config. Then check above FINAL in the active configuration for broad DOMAIN-KEYWORD rules, IP rules, or external rule sets. The first matching rule determines the policy; the final fallback won’t override it. Also check which option the referenced policy group actually selects.
A selected site still connects directly. Are domain rules not working?
First confirm that you edited the same file selected in Config, then check the actual request hostname. If visiting example.com redirects to another domain, add a separate rule for the destination host. If the log shows only an IP address, you can’t assume DOMAIN-SUFFIX will match just from the URL in the address bar.
The main site loads, but sign-in or video fails. What should I add?
Repeat the action that fails and look for authentication, media, or API requests in the request log. Add rules only for dependency domains confirmed to require the proxy, and place them before FINAL. If the log already shows PROXY, check whether the existing connection works instead of broadening the domain matches again.
Rules changed after a subscription update. How can I avoid editing them repeatedly?
First distinguish between updating a connection subscription in Home and updating a remote configuration in Config. A connection subscription primarily refreshes the connection list; a remote configuration update may replace the file contents. Keep a copy of your rules. After each update, verify the active configuration, rule order, and FINAL policy, then test one site on your list and one off it.
The result should be a short rule list where every match is easy to explain: specific domains use PROXY, and FINAL,DIRECT handles everything else. When adding sites later, follow the same process: check the actual domain, add the narrowest matching rule, and verify the policy instead of piling on keywords. For a broader overview of configuration concepts, read the protocol guide and quick reference.