Shadowrocket: Proxy Only Selected Websites with Rules

At a glance

To proxy only selected websites in Shadowrocket, set Global Routing to Config, place PROXY rules for the target domains first, and end with FINAL,DIRECT. This guide covers domain lists, applying the config, checking connections, and troubleshooting missed matches. The result is a ruleset that sends traffic direct by default and proxies only the domains you specify.

1. Define the routing goal and scope

This setup proxies explicitly listed domains and sends all other requests direct by default. It works best when the target list is short and easy to maintain. If you want unknown requests to use a proxy by default, this fallback is not appropriate: FINAL,DIRECT does the opposite, sending requests that do not match earlier rules direct.

You’ll need two things: a working connection entry in Home and an editable, enabled config in Config. Importing a subscription provides connection entries; it does not automatically add routing rules for the websites you want to reach. Buying the app, arranging a connection service, and configuring rules are separate matters; a one-time app purchase does not include a connection plan.

Connection check: In Home → Connectivity Test, check that your existing entries are reachable, then select the one you want to use. A successful test does not guarantee that a particular website will work.
Rules check: Make sure you can back up and edit the current config so you don’t overwrite rules that are still in use.
Scope: This guide covers requests handled by Shadowrocket rules. Check system traffic, excluded routes, and DNS settings separately.
App availability: Shadowrocket is a closed-source commercial app for Apple platforms, available exclusively on the App Store. It is primarily used on iPhone and iPad; check the App Store page for system requirements.

2. Set Global Routing to Config

In Home → Global Routing, select Config to route traffic according to the rules in the currently enabled config. Proxy and Direct are useful for temporary comparisons, but they do not replace rules for proxying selected domains. If you use Scene, also check which routing setting it applies. For the checks in this guide, keep Global Routing set to Config to avoid changing variables.

Config

Recommended

Matches against the enabled config. Use PROXY rules for the target domains and finish with FINAL,DIRECT to proxy only those domains while sending other requests direct.

Best for: Everyday routing of a short, clearly defined domain list.

Proxy

Routes all traffic within its scope through the proxy instead of applying the domain rules in this guide. If a website works after switching to this mode, that only helps determine whether the issue is related to routing.

Best for: Temporarily checking whether to investigate the proxy connection or rule matching.

Direct

Routes all traffic within its scope direct. Even if the config contains PROXY rules, this mode will not produce the routing behavior described here.

Best for: Temporarily comparing direct access on your current network.

Set the routing mode before editing rules

Before each test, confirm Home → Global Routing → Config and check which config is enabled. Don’t change the routing mode, connection entry, and domain rules at the same time; otherwise, you won’t know which change affected the result.

3. List domains and write the minimal rules

Domain rules match hostnames, not full web addresses. For https://www.example.com/account, use www.example.com. Don’t include https://, the /account path, or query parameters in a DOMAIN rule. The reserved example domains below demonstrate syntax only; they are not suggested connection test targets.

2 types

This guide uses two domain match types: DOMAIN and DOMAIN-SUFFIX

3 fields

Write each domain rule as type, match value, and policy, separated by commas

1 rule

Put FINAL,DIRECT at the end as the catch-all

[Rule]
DOMAIN-SUFFIX,example.com,PROXY
DOMAIN,login.example.net,PROXY
FINAL,DIRECT

This [Rule] snippet illustrates the syntax; it is not a replacement for your entire config. The first rule matches both example.com and its subdomains, such as www.example.com and static.example.com. It does not match notexample.com. The second rule matches only login.example.net; it does not also proxy www.example.net.

Request hostname	Match	Expected policy
`example.com`	First rule: DOMAIN-SUFFIX	`PROXY`
`img.example.com`	First rule: DOMAIN-SUFFIX	`PROXY`
`login.example.net`	Second rule: DOMAIN	`PROXY`
`www.example.net`	Final rule: FINAL	`DIRECT`

PROXY routes traffic through the selected proxy. The actual connection depends on your current proxy selection and policy settings in the config; PROXY is not a server address to enter. If your existing config uses a custom policy group, check its name and selections rather than mechanically replacing it with PROXY. This example shows a minimal config that uses the PROXY policy directly.

4. Edit and enable the config

Rules are generally evaluated from top to bottom, and the first match determines the policy. Adding new rules after an existing FINAL rule will not work; a broad rule above them may match first and prevent them from being reached. To proxy only selected domains, review the entire rules section, not just the two or three lines you add.

Keep a copy

Open Config and save a copy of the current config or export a backup first. Note the name of the currently enabled config. If it is maintained remotely, save a local copy before editing so a later update doesn’t overwrite your changes.
Organize the rules

In Config, open the editor for the config you want to change and locate [Rule]. If editing the text, change only the relevant section. If using the rule editor, check the type, domain, and policy. Don’t add a second, duplicate [Rule] section.
Set the fallback

Place PROXY rules for the target domains before any broad rules that could match them, and keep FINAL,DIRECT at the end. Check for other existing PROXY rules and rule sets. If you keep them, the config will no longer proxy only the domains listed in this guide.
Enable the config

After saving, return to Config, select the config you just edited, and confirm that it is marked as enabled. Saving a file alone does not make it the active config. Then go to Home → Global Routing → Config.
Test again

Make sure the selected proxy entry in Home is working, reconnect, and send a new request. Don’t rely on refreshing a page that already has an open connection. If needed, close the old page and reopen it to reduce the effect of connection reuse.

5. Test both target and non-target domains

Verify which rule handled each request, not just whether the page opened. A working site may have connected direct or through a proxy. A failed site could be affected by DNS, the destination service, the proxy connection, or a missing dependency domain. Connectivity Test checks connection entries; it does not replace checking the rules for individual requests.

Target request: Choose a hostname you actually want to proxy and send a new request. In the connection log, check the requested domain, matched rule, and outbound policy. The expected result is the corresponding domain rule and PROXY.
Comparison request: Choose a hostname that is not on your list and can be reached directly on your current network. It should match FINAL and use DIRECT. Both results must match expectations to confirm that the default policy and exceptions are working.
Dependency requests: Test the homepage, sign-in, image loading, and the features you actually use. A page may request multiple domains; loading the homepage successfully does not guarantee that sign-in or other resources will work.
Record your setup: Note whether you’re using Wi-Fi or cellular, the name of the enabled config, and the hostname that failed. Change one thing at a time and repeat the same test to compare results.

If text appears but images are blank, check the actual hostname used for image requests. For example, the page may come from www.example.com, while its images come from img.example.net; the first suffix rule won’t match the latter. Only if you confirm that this hostname also needs a proxy, add DOMAIN,img.example.net,PROXY before FINAL.

[Rule]
DOMAIN-SUFFIX,example.com,PROXY
DOMAIN,login.example.net,PROXY
DOMAIN,img.example.net,PROXY
FINAL,DIRECT

Don’t broaden the rules to DOMAIN-KEYWORD or a large IP range after a single resource fails to load. Domains and addresses on shared infrastructure may serve multiple websites. The broader the match, the harder it is to maintain the boundary of proxying only selected websites.

6. Common questions and what to check

Why does the selected website still connect direct after I add a rule?

First, check that Home → Global Routing is set to Config, then confirm which file is enabled in Config. Next, check the rule order: an earlier DIRECT rule, rule set, or FINAL may match first. Finally, check the actual hostname in the connection log and make sure it matches the domain you entered, rather than a different domain after a redirect.

Why are other websites also using the proxy?

First, make sure Global Routing isn’t set to Proxy. If it’s set to Config, check whether the original config still contains other PROXY rules, broad DOMAIN-KEYWORD rules, or referenced rule sets. Confirm that the final rule isn’t FINAL,PROXY. A suffix rule covers all matching subdomains; use DOMAIN to narrow the scope.

Can I proxy just one page based on its URL path?

The DOMAIN and DOMAIN-SUFFIX rules in this guide can’t distinguish between /video and /account on the same hostname, and different ports don’t automatically create different domain rules. HTTPS commonly uses port 443, but adding :443 to a rule value is not a substitute for the correct hostname. If you want to distinguish sub-sites, first check whether they use different hostnames.

Why doesn’t a request to an IP address match a domain rule?

Don’t assume a request made directly to an IP address will match a domain rule. If you need to proxy a specific IPv4 address, you can use a rule such as IP-CIDR,192.0.2.10/32,PROXY,no-resolve before FINAL. This is a documentation-only example address. Don’t proxy an entire address range just because a website temporarily resolves to it; shared addresses and DNS changes can widen the impact.

Do the rules change when I update a subscription?

Updating a connection subscription and changing rules in Config are separate actions. After an update, check that your current proxy selection still works, then confirm that the enabled config hasn’t changed. If you update a remote config separately, check whether it overwrote your local edits. A successful refresh of the connection list alone does not mean the rules are still correct.

7. Maintenance checklist and restoring the original config

For ongoing maintenance, track the actual hostname used by each request. When a feature fails, record the hostname and decide whether it belongs on your proxy list. There’s no need to add analytics, resource, or other domains that don’t need a proxy just to make the logs look consistent. More precise rules make each routing decision easier to understand.

Add a website: Decide whether you need to match one hostname or the whole domain and its subdomains, then choose DOMAIN or DOMAIN-SUFFIX.
Remove a website: Check its separate resource and sign-in domains too. Remove rules you no longer need and keep FINAL,DIRECT at the end.
Connection issue: Check the selected connection entry and Connectivity Test first, then inspect the matched rule. Don’t mistake an unavailable connection for a domain syntax error.
Revert changes: In Config, re-enable the config you saved earlier. Confirm Home → Global Routing → Config, then reconnect and test again. If the connection starts automatically, check Settings → On Demand for its trigger conditions so you don’t confuse connection behavior with rule routing.

There are just two acceptance criteria: real requests for listed domains match the expected PROXY rules, and comparison requests for unlisted domains match FINAL,DIRECT. Keeping a copy of the config, test records, and a clearly defined domain list makes long-term maintenance easier than repeatedly changing the global routing mode.