Shadowrocket evaluates rules in order and applies the policy of the first match. This guide is for users with a working configuration who want to adjust routing. Examples use the Home and Config screens on iPhone and iPad; the rule concepts also apply to the Mac, Windows, Android and Linux versions, though the editing steps vary by platform. By the end, you’ll be able to distinguish domain and IP matching, write a minimal Rule section, and verify matches in the connection log.
1. Make sure Global Routing is set to Config
Rules in a configuration do not necessarily mean current connections are being routed by them. Check Global Routing on Home: select Config to apply the current configuration’s Rule section. Proxy applies the proxy policy globally, while Direct connects directly. Scene selects a scenario; it is not another rule type. For troubleshooting, start with Config selected to avoid confusing results caused by switching scenes.
- Open Config, back up the current configuration, and make sure you’re editing the selected configuration file—not a different copy with the same name.
- Return to Home, set Global Routing to Config, and confirm that your existing proxy connection works.
- Save the configuration after editing the rules. If needed, reconnect and send a new test request.
- Check the connection log for the destination domain or IP, the matched rule, and the resulting policy. Don’t rely solely on whether a webpage loads.
Settings → On Demand controls when a connection is established automatically; it does not decide whether a domain uses PROXY or DIRECT. If you need to disconnect during rule testing, check whether On Demand will reconnect automatically so you don’t mistake an automatic connection for a change caused by saving the rules.
2. The three parts of a rule: type, match value and policy
Most basic rules have three comma-separated fields: rule type, match value and policy. For example, DOMAIN,example.com,DIRECT means connect directly when the exact destination domain is example.com. FINAL has no match value, so write it as FINAL,PROXY—don’t add an empty field to make it fit the three-field format.
| Policy | What it does | When to use it |
|---|---|---|
PROXY | Routes the connection through the proxy policy. | Requires an existing, working proxy and its settings. A rule does not create a proxy service. |
DIRECT | Connects directly to the destination. | This does not bypass the system tunnel or guarantee that the destination is reachable on your current network. |
REJECT | Blocks the matching connection. | A failed request is expected after a match. Use this only for destinations you explicitly want to block. |
A rule’s policy field may also refer to a policy group already defined in the configuration. If you’re new to rules, stick to the basic policies above rather than entering a group name that doesn’t exist. PROXY is a policy identifier; Proxy in Global Routing is a connection mode. They appear in different places and serve different purposes, so don’t use one in place of the other.
3. DOMAIN vs. DOMAIN-SUFFIX vs. DOMAIN-KEYWORD
All three rule types match domains, but they cover different ranges. DOMAIN matches an exact domain. DOMAIN-SUFFIX matches the specified domain and its subdomains. DOMAIN-KEYWORD checks whether a domain contains a given string. None of them checks webpage content or distinguishes pages on the same site by URL path.
| Example rule | Matches | Doesn’t match |
|---|---|---|
DOMAIN,example.com,DIRECT | example.com | www.example.com |
DOMAIN-SUFFIX,example.com,DIRECT | example.com、img.example.com | notexample.com |
DOMAIN-KEYWORD,example,PROXY | example.com、myexample.net | sample.net |
- Omit the protocol: Use
example.comas the match value, nothttps://example.com. - Omit the page path:
/login, query parameters and URL fragments are not match values for these three rule types. - No wildcards: To cover a domain and all its subdomains, use
DOMAIN-SUFFIX,example.com,DIRECT. There’s no need to add*.. - Use short keywords with care:
DOMAIN-KEYWORD,ad,REJECTmay also block legitimate domains containing those two letters. It is not the same as an exact list of ad domains.
To proxy only api.example.com while connecting directly to other destinations under the same domain, put the exact DOMAIN rule before the broader DOMAIN-SUFFIX rule. As long as the connection provides domain information, rule order can express this exception. If the app connects directly to an IP, use an IP rule instead.
4. GEOIP and IP-CIDR match destination IPs
GEOIP,CN,DIRECT checks the destination address against the region assigned in the IP geolocation database. It does not look at the domain suffix or the service provider’s headquarters. A domain request may need to be resolved to an IP before an IP-based rule can match. Results also depend on DNS responses and database data, so different endpoints for the same service may not match the same GEOIP rule.
GEOIP,CN,DIRECT
IP-CIDR,192.168.0.0/16,DIRECT
IP-CIDR,192.0.2.0/24,REJECTIP-CIDR uses a network address and prefix length. 192.168.0.0/16 covers addresses from 192.168.0.0 through 192.168.255.255; for IPv4, /32 matches a single address. The 192.0.2.0/24 range above is reserved for documentation, not a real service address, and cannot be used to verify whether a real website is reachable.
192.168.0.0/16alone does not cover every private IPv4 address. Configure other private ranges separately if your network uses them.- For IPv6 ranges, use the corresponding
IP-CIDR6type. Don’t expect an IPv6 address entered in an IPv4 example to match. - The optional
no-resolveparameter prevents an IP rule from triggering an additional domain lookup. For example:IP-CIDR,192.168.0.0/16,DIRECT,no-resolve. It does not disable DNS globally. - If you want a domain request to match an IP range after resolution, understand how resolution works before deciding whether to use
no-resolve. It isn’t a suffix that every rule needs.
In short: use domain rules when the domain scope is clear
Start with DOMAIN or DOMAIN-SUFFIX to express the specific behavior you want, and reserve GEOIP and IP-CIDR for region- and network-range policies. This reduces ambiguity when resolved addresses change and makes it easier to understand a match in the connection log.
5. Put FINAL last: from specific exceptions to the default policy
Shadowrocket checks rules in order. The first match determines the policy; a later rule won’t take over just because it is “more specific.” FINAL catches connections that did not match any earlier rule, so it belongs at the end of the Rule section. If it appears first, rules for specific domains below it will never take effect.
[Rule]
DOMAIN,api.example.com,PROXY
DOMAIN-SUFFIX,example.com,DIRECT
DOMAIN-KEYWORD,blocked-demo,REJECT
IP-CIDR,192.168.0.0/16,DIRECT,no-resolve
GEOIP,CN,DIRECT
FINAL,PROXYThis is a sample Rule section for learning, not a complete configuration with proxy settings, DNS and other content. If your configuration already has a [Rule] section, edit its entries rather than adding another section with the same name. The example domains illustrate matching behavior; replace them with the actual destinations you want to handle.
- For a request to
api.example.com, the first DOMAIN rule matches and applies PROXY. The later domain-suffix rules are not checked. - For a request to
img.example.com, the first rule doesn’t match, so the second DOMAIN-SUFFIX rule applies DIRECT. - A domain containing
blocked-demomatches REJECT if neither of the first two rules matches. Don’t test this rule with a different domain. - Other connections are checked against the specified IP ranges and GEOIP rules. Only when none of these match does FINAL route them through PROXY.
To make direct access the default, change the last rule to FINAL,DIRECT. This affects every unmatched connection, not just the website you’re testing. Before changing it, identify the domains that must use a proxy and put their rules before FINAL.
6. Rules not working? Separate match problems from connection problems
A webpage failing to load does not by itself mean a rule is wrong. Start with the connection log: check whether the destination is as expected, which rule matched and which policy was applied. If the match or policy is unexpected, first check the selected configuration, rule scope and order. If the match is correct but the connection fails, investigate the network and your existing proxy settings.
Connection timed out
Cause: The connection did not complete before the timeout. This can happen when connecting directly to a destination or when connecting through a proxy; it is not a specific rule syntax error.
Fix: Check the log to see whether DIRECT or PROXY was applied, then test the relevant destination or existing proxy on your current network. Don’t try to hide the problem by moving FINAL.
Connection refused
Cause: The destination refused the connection. This often means no service is listening on the target port or the remote host actively refused the connection.
Fix: Check the destination address and port in the log. If a PROXY connection fails, also check the address, port and status of your existing proxy.
Port 443 is commonly used for HTTPS, but a DOMAIN rule does not match only port 443. Don’t assume your proxy server uses port 443; use the actual settings for your existing service. If PROXY matches correctly but the connection still fails, check the settings for the protocol in use instead of changing the domain rule type.
- FINAL always matches: Check that the match value doesn’t include a protocol or path, and confirm that the connection log actually shows domain information.
- An exception rule is ignored: Check for a broader DOMAIN-SUFFIX or DOMAIN-KEYWORD rule above it, or a FINAL rule that appears too early.
- Old behavior persists after editing: Make sure you saved the currently selected configuration, then establish a new connection. A browser may reuse an existing connection and continue using its previous route.
- Rules revert after a while: Check whether the configuration is updated remotely. Proxy lists in a subscription and rules in Config are separate content; updating the proxy list does not necessarily update the rules.
7. FAQ: domains, protocols and subscriptions
Why don’t my DOMAIN rules also match subdomains?
DOMAIN matches an exact domain only. To cover both the root domain and all its subdomains, use DOMAIN-SUFFIX. If you need an exception for just one subdomain, place its DOMAIN rule before the suffix rule.
Why doesn’t GEOIP,CN,DIRECT send every Chinese-language website direct?
GEOIP checks the IP region, not the page language. Check the destination’s resolved IP and the match in the connection log. If you want a particular site to connect directly, use DOMAIN-SUFFIX with its actual domain and place the rule before GEOIP.
Can changing FINAL to PROXY fix incorrect protocol settings?
No. Shadowsocks, VMess, VLESS, Trojan, Hysteria2 and WireGuard are proxy protocols, not rule types. FINAL only sets the policy for unmatched connections; it cannot fix passwords, credentials, TLS or transport settings.
Will my manual rules remain after I update my subscription?
First check whether you’re updating the proxy subscription on Home or a remote configuration in Config. A remote configuration update may replace file contents. Back up your configuration in Config before editing and check the Rule section after an update. Don’t assume every update method merges changes the same way.
For routine maintenance, follow this order: back up, change one rule, send a new request, then check the match. Changing one variable at a time makes it easier to find the cause than changing DNS, Global Routing and several rules at once. This guide assumes you already have your own service and subscription. The site does not provide, sell or recommend nodes or subscriptions; getting the app and obtaining a network service are separate matters.