Shadowrocket Rules: Route Specific Websites Through a Proxy with DOMAIN-SUFFIX and FINAL

At a glance

In Shadowrocket, select Config under Global Routing to route traffic according to the Rule section of the active configuration. This guide is for users who already have a provider and a working configuration and want to proxy only specific websites. Add domain-matching rules, finish with FINAL,DIRECT, then check the request log to confirm which rules matched. Example domains illustrate syntax only; they are not service or routing recommendations.

Check Config and your proxy route first

Rule-based routing requires two things: the active configuration must include the rules you want, and Global Routing on Home must be set to Config. Editing a file in Config alone does not route all traffic through it; make sure that file is selected as the active configuration.

Proxy in Global Routing routes traffic through a proxy overall, while Direct connects directly overall. Neither option tests the setup in this guide, where only selected websites use a proxy and everything else connects directly. Scene selects a scenario and should not be treated as the same as using the current file in Config mode. When troubleshooting, confirm that Config is selected so a scene change does not affect your test.

Config

Selection for this example: Home → Global Routing

Routes used: PROXY and DIRECT

Last line

Use FINAL,DIRECT as the fallback in the Rule section

PROXY is a proxy policy and typically uses the currently selected proxy route; DIRECT connects to the destination without a proxy. If your file uses a custom policy group, check the group name and its selected member. Don’t confuse a group name or server display name with a built-in policy. This example uses only PROXY and DIRECT to avoid adding extra group definitions.

On Home, select an available proxy route you already have, then run Connectivity Test to check basic connectivity.
Go to Config, back up the current configuration, then edit a local copy for this test.
Make sure the edited copy is selected, then go to Home → Global Routing → Config.
After connecting, revisit the target website. Existing connections may continue using the previous route, so they can’t verify the new rules.

The minimal DOMAIN-SUFFIX and FINAL setup

To route example.com and its subdomains through a proxy while connecting other requests directly, you only need two rules. The example below shows a standalone Rule section; it is not a complete configuration to replace your existing file. If the file already contains [Rule], edit that section rather than adding another section with the same name.

[Rule]
DOMAIN-SUFFIX,example.com,PROXY
FINAL,DIRECT

DOMAIN-SUFFIX,example.com,PROXY matches the domain suffix, covering example.com itself and subdomains such as www.example.com and api.example.com. Enter a domain only—not https://, a port, or a path. Don’t enter a full URL or add *. before the domain.

FINAL,DIRECT takes no domain parameter. If a request doesn’t match any preceding rule, this rule sends it through DIRECT. It means “connect directly for all remaining traffic,” not “try a direct connection, then automatically switch to a proxy if it fails.” To add another target website, place its domain rule before FINAL.

When to use DOMAIN-KEYWORD

DOMAIN-KEYWORD matches a string in the domain and usually covers a wider range than DOMAIN-SUFFIX. It doesn’t match page content, URL paths, or search terms. For example, media below matches requests whose domain contains that string—not just one particular website.

[Rule]
DOMAIN,login.example.com,DIRECT
DOMAIN-SUFFIX,example.com,PROXY
DOMAIN-KEYWORD,media,PROXY
FINAL,DIRECT

The first domain rule here is an intentional exception: login.example.com connects directly; other matching requests for example.com use a proxy; and other domains containing media also use a proxy. This example illustrates scope and rule order, not a recommendation for everyone to add the media keyword. If only a few specific websites should use a proxy, prefer DOMAIN or DOMAIN-SUFFIX.

Rule keyword	Example input	Scope
DOMAIN	login.example.com	Matches this exact domain only; does not automatically cover other subdomains.
DOMAIN-SUFFIX	example.com	Matches this domain and its subdomains; useful for routing by website.
DOMAIN-KEYWORD	media	Matches a string in the domain and may include domains you didn’t intend to proxy.
FINAL	No domain parameter required	Handles requests that did not match earlier rules; place it at the end of the Rule section.

Rule order: the first match determines the policy

Rules in the Rule section are checked from top to bottom. Once a request matches a valid rule, that rule’s policy applies; matching does not continue in search of a “more specific” rule. Put precise exceptions before broader matches and FINAL at the end. These are the key constraints when arranging rules.

New requestGet destinationCheck rules in orderFirst matchApply policy

In the example above, if DOMAIN-SUFFIX,example.com,PROXY comes before DOMAIN,login.example.com,DIRECT, login.example.com matches PROXY first, so the later DIRECT exception won’t apply. Similarly, placing FINAL too early prevents subsequent rules from working as intended.

Put exact exceptions first: For example, if a login domain must connect directly, place DOMAIN before the corresponding DOMAIN-SUFFIX rule.
Then define website scope: Use DOMAIN-SUFFIX to cover the main domain and subdomains that should use a proxy.
Use keywords with care: DOMAIN-KEYWORD can match broadly. After adding one, test a control domain that should not match.
Set the fallback last: To connect everything else directly, use FINAL,DIRECT and check for any earlier rules with a broad match scope.

If your existing configuration includes RULE-SET, GEOIP, or IP-CIDR, check those rules too—not just the two you added. If one of them appears earlier and matches first, the request will still use its existing policy. Adding new rules at the very end of the file, especially after FINAL, does not guarantee they will take effect.

How IP-CIDR, GEOIP, and domain-based routing differ

DOMAIN-SUFFIX matches domains, IP-CIDR matches destination IP ranges, and GEOIP matches based on an IP’s geographic location. These rules use different criteria. For routing only a few websites through a proxy, starting with domain rules is usually easier to verify: a website’s IP can change, and multiple websites may share an IP address.

IP-CIDR,192.0.2.0/24,DIRECT,no-resolve
GEOIP,CN,DIRECT
FINAL,DIRECT

The 192.0.2.0/24 range shown here is for documentation and is not an actual website address to copy. no-resolve avoids performing a DNS lookup solely to match this IP rule; it does not disable all DNS. GEOIP,CN,DIRECT means that destinations whose IP is classified as CN connect directly. It does not replace an explicit requirement to proxy a particular domain.

If an app connects directly to an IP and the request has no usable domain information, domain rules may not match.
If a website uses multiple content delivery domains, listing only its main domain may not cover all resources.
Port 443 is commonly used for HTTPS, but the domain rules in this guide don’t match on port 443 and aren’t limited to browsers.
Check DNS resolution and the connection route separately. Matching PROXY doesn’t mean every DNS request follows the same route.

Save the configuration, then verify using the request log

A result in Connectivity Test only shows that the route has some connectivity under the test conditions. It doesn’t prove that a particular website matched the intended rule. Compare requests to three types of domains—a target website, a regular website, and an exception—then check the destination, matched rule, and policy in the request log.

Save the configuration and make sure the file you just edited is selected under Config.
Confirm that Home → Global Routing is still set to Config. If you’ve configured Settings → On Demand, also check whether automatic activation changed the connection state.
Close existing connections to the target page. If needed, reconnect Shadowrocket, then load a new page to generate a fresh request.
Check the corresponding request log entry. The target domain should match DOMAIN-SUFFIX or another explicit rule, with PROXY as its policy. Domains outside the listed scope should fall through to FINAL and use DIRECT.
If a resource fails, note the actual resource domain. Don’t judge by the main domain in the browser’s address bar alone.

The following generic error messages may appear in network errors or logs. Their exact presentation varies by request source and system. They indicate a connection failure but do not, on their own, prove that the rule syntax is wrong. Check the matched policy first, then determine whether the issue is with the proxy route, direct connection, or destination service.

Error: Connection refused

Cause: The destination address or proxy port refused the connection. Fix: First check whether the request matched PROXY or DIRECT, then verify that the corresponding address and port are correct. Proxy route details should match the configuration provided by your existing service provider.

Error: Operation timed out

Cause: The connection or response did not complete within the time limit. The issue may involve your current network, route, or destination website. Fix: Run Connectivity Test, then compare it with the request log for the same website. If it matched FINAL,DIRECT but should use a proxy, adjust the rule scope first.

Common questions about routing specific websites

I added rules, but why are all websites still using a proxy?

Go to Home → Global Routing and make sure Config is selected, not Proxy. Then check whether the active Config has a broad PROXY rule that matches earlier, and whether FINAL is still set to PROXY. Change one condition at a time and verify with a new request so you can compare results.

The webpage loads, but images and login fail. Which rule should I add?

Find the actual domain of the failed resource in the request log. If it’s a separate domain, add a DOMAIN or DOMAIN-SUFFIX rule for it before FINAL. Don’t broaden the match to a common keyword just because part of the page failed; that could include unrelated websites.

Why did my custom rules disappear after I updated an existing subscription?

A server subscription and a remote Config are separate objects. Updating the server list does not change the Rule section, but fetching a remote configuration again may overwrite local edits in that file. Keep custom rules in a local copy you control. After updating, check which Config is selected and compare its Rule section.

Do I need to rewrite DOMAIN-SUFFIX rules when switching protocols?

Usually not. Domain rules determine which policy handles a request; the proxy protocol determines how the route connects. After switching to another existing route, make sure PROXY points to an available selection, then check that the same target still matches the original rule. Don’t use domain rule changes to mask a connection problem with the route.

Keep a minimal, easy-to-understand rule set: explicitly listed websites use PROXY, necessary exceptions come first, and FINAL,DIRECT handles everything else. Whenever you add a domain, test both a request that should use a proxy and one that should connect directly. This verifies the configuration more reliably than simply checking whether the connection is on.