To proxy only selected websites in Shadowrocket, three conditions must be met: Global Routing must be set to Config, the active configuration must include PROXY rules for the target domains, and FINAL,DIRECT must handle all remaining requests. This guide is for users who already have connection details from their provider. Follow the steps to prepare the configuration, add rules, and check match logs. It also explains how to tell an unmatched rule from a failed connection.
1. Select Config and check the active configuration
If correctly written rules have no effect, first check Home → Global Routing. Since this guide routes traffic by domain, select Config. Editing a file in Config while Global Routing is set to Proxy will not test the intended setup: selected websites use a proxy while others connect directly.
The options below cover only the three settings relevant to this task; they are not a complete list of Global Routing options. Config applies the rules in the configuration, while PROXY in a rule sends requests to the proxy policy. The names are similar, but these are separate settings.
Config
RecommendedRequests follow the rules in the active configuration. Target domains can use PROXY, while other requests can connect directly through FINAL,DIRECT.
Best for: Routing only explicitly listed domains through a proxy.
Proxy
Routes intercepted requests through the proxy instead of splitting them according to the domain list in this guide. After using it temporarily, switch back to Config before testing domain-based routing.
Best for: Temporarily checking whether an existing proxy connection can reach a target.
Direct
Routes intercepted requests directly. A PROXY domain rule in the configuration will not automatically override this setting.
Best for: Checking how a target behaves with a direct connection on the current network.
Takeaway: Keep the test conditions consistent
Before making changes, note the configuration file name, selected connection, and Global Routing setting. Change only one rule at a time so you can tell whether a result comes from a configuration switch, a connection change, or the rule itself.
2. Build a minimal rule configuration in four steps
First, confirm that a usable connection is selected in Home, then open Config to work on the configuration. An existing subscription may manage connection details, but that does not mean the domain-routing rules in this guide are enabled. Check connection list updates and configuration rule changes separately.
-
Back up the configuration
Open Config, note the selected file, and use an available share or export option to keep a copy of the original. When editing an existing configuration, preserve its DNS, Host, and policy settings. Avoid replacing the entire file just to add domains.
-
Edit the rules
In Config, open the configuration you plan to use and enter edit mode. Add the example below to the existing
[Rule]section. If the file already has this section, edit it rather than adding a second section with the same name. -
Select the file
After saving, return to Config and make sure the file you just edited is selected, not another configuration with a similar name. Saving a file alone does not mean it has been selected.
-
Set the routing mode
Go to Home → Global Routing → Config. Confirm the intended connection is still selected in Home, then enable or reconnect. Check the results with new requests rather than relying only on pages that were already open.
3. List proxy domains with DOMAIN-SUFFIX
The domains below are syntax examples, not connection server addresses. Replace them with the domains of the websites you need to access. Do not include https://, a port, or a path in a rule. For example, if the target page is https://www.example.com/account, the domain to match is www.example.com.
[Rule]
DOMAIN-SUFFIX,example.com,PROXY
DOMAIN-SUFFIX,example.org,PROXY
FINAL,DIRECTDOMAIN-SUFFIX,example.com,PROXY matches example.com itself and its subdomains, such as www.example.com and api.example.com. It does not match any domain that merely contains the word example, so notexample.com is not considered a subdomain.
To proxy just one hostname without including other hosts under the same domain, use a narrower DOMAIN rule. The example below matches only api.example.com. A request to www.example.com will not match this line and will continue to the next rule.
[Rule]
DOMAIN,api.example.com,PROXY
FINAL,DIRECTDOMAIN and DOMAIN-SUFFIX cannot distinguish between page paths on the same domain. To proxy /video while connecting directly to /news on the same website, adding a path after DOMAIN-SUFFIX will not work. First decide whether you need to route by domain or by page content, then determine whether this method fits.
4. Check rule order and the position of FINAL
Rules are checked in order, and matching a rule usually stops the search. Put more specific exceptions before broader rules. FINAL is the fallback for remaining requests: do not place it before the domain rules you want to match, and do not stack duplicate FINAL rules from multiple configurations in the same rule section.
[Rule]
DOMAIN,account.example.com,DIRECT
DOMAIN-SUFFIX,example.com,PROXY
FINAL,DIRECTIn this example, account.example.com matches DIRECT first. Other hosts under example.com can still match the later PROXY rule. If you swap the first two lines, the broader DOMAIN-SUFFIX rule matches first and the direct-connection exception will not work as intended.
- Check existing proxy rules: If the configuration has other PROXY rules, websites not on your new list may still use a proxy. To proxy only the listed domains, review the entire active rule section—not just the two lines you added.
- Check rule set references: External rule sets or other policies may also affect requests. To isolate the issue, keep a backup and test with a separate minimal configuration, then restore the original rules one at a time.
- Distinguish domains from IP addresses: GEOIP matches against an IP geolocation database, while IP-CIDR matches an IP range. Neither is equivalent to a list of website domains.
- Check for shared addresses: Multiple websites may share an address. Do not add a broad IP-CIDR proxy rule just because an IP appears in a connection to the target website.
5. Verify routing in the connection logs
A page loading successfully only shows that the request worked; it does not prove that the intended policy was used. Check the target hostname, matched rule, and actual policy together. To reduce interference from existing connections and cached pages, generate fresh requests to both the target website and a website not on the list.
- Confirm Home → Global Routing is still set to Config, the edited file is still selected in Config, and the connection is enabled.
- Open the target website again, then find its hostname in the in-app connection logs. Check whether the expected DOMAIN or DOMAIN-SUFFIX rule matched and whether the request was sent to PROXY.
- Visit a website that is not on the proxy list and check that its request is handled by FINAL and sent to DIRECT. Do not use another subdomain of the same website as your comparison.
- If the page redirects, requires sign-in, or fails to load images, check the hostnames in the new requests separately. Record the main page domain and its resource domains separately; do not rely only on the address bar.
| Observed result | Check first | Next step |
|---|---|---|
| Target request matches FINAL,DIRECT | Domain scope and active configuration | Check the actual hostname in the log and confirm it falls under one of the configured domain suffixes. |
| Target matches PROXY, but the request times out | Selected connection and server reachability | Leave the rules unchanged and check the existing connection details and connection test results. |
| Unlisted websites also use PROXY | Global Routing and other proxy rules | Make sure Global Routing is not set to Proxy, then check earlier rules and rule set references. |
| Page text loads, but images or sign-in fail | Resource and authentication domains | Find the hostnames of failed requests and add narrowly scoped rules if needed. |
These are expected patterns for interpreting connection logs, not speed test results for every network. If the logs show that PROXY matched correctly, adding the same domain again will not help. Check the connection settings, server status, or access restrictions on the target instead.
6. Check resource domains, DNS, and automatic connection behavior
A webpage may request content from the main site, a sign-in API, image domains, and a separate content delivery domain. Adding a DOMAIN-SUFFIX rule for the main site does not mean all its dependencies share that suffix. Check the failed request logs to identify each domain’s purpose before adding a rule. Avoid proxying an overly broad range of public domains to fix a single resource.
- Check DNS separately from routing: If domain resolution fails, the request may not reach the expected connection stage. First confirm that the domain resolves. Do not attribute every failure to FINAL, or change DNS and rules in the same test.
- Check requests made directly to an IP separately: If the log shows only a target IP and no domain that can be matched, do not assume DOMAIN-SUFFIX will apply. Find out where the request came from before deciding whether an IP-CIDR rule is actually needed.
- On Demand affects connection state: Check automatic connection settings under Settings → On Demand. These settings control when a connection is established; they do not replace DOMAIN-SUFFIX or FINAL. If you disconnect manually for comparison, check whether the connection starts again automatically.
- New requests are more reliable than old pages: Existing long-lived connections or in-app caches may continue to show old results. After saving the rules and reconnecting, make a new request to the target and check its log entry.
If you temporarily change On Demand while troubleshooting, restore the settings you need afterward. Do not use an always-on connection switch as a substitute for checking the actual policy. Connection status shows whether traffic interception is active; the rule log shows where each request was routed.
7. Keep a rule list you can roll back
After verifying the setup, keep a working copy of the configuration and note why each domain was added. If a feature later fails, check whether it introduced new request domains before making a small, targeted change. Keep the rules aligned with actual needs instead of continually expanding the proxy scope.
- Back up the configuration before each change. Add or adjust only one related group of domains at a time.
- After each save, check the selected file in Config and confirm Home → Global Routing → Config.
- For each test, check one request that should use PROXY and one that should use DIRECT.
- After updating connection details, confirm the selected connection still works. Correct domain rules do not guarantee that connection details remain valid.
Shadowrocket is a closed-source commercial app. Buying the app is separate from purchasing a connection plan. This guide assumes you already have a provider and connection details. The app is primarily for iPhone and iPad; check the App Store listing for compatibility with Mac, Apple TV, and Apple Vision. System requirements and purchase eligibility are as listed on the App Store page. The App Store is the only place to get the app.