Shadowrocket .conf File Structure: [General], [Rule], [Host] and [URL Rewrite] Explained

In this guide

For users who have already set up their own connection service in Shadowrocket and want to read or edit a .conf file. Identify the purpose of each section, then review its settings, rule order, domain mappings and URL rewrites. Finally, select the file in Config and verify the results. The example.com domain and test addresses illustrate syntax only; they are not connection services.

1. Understand .conf files, connection details and routing modes

.conf is a plain-text configuration file. Names in square brackets are section headers, not folders. A section starts at its header and ends at the next one; blank lines are mainly for readability. Even correctly spelled English terms may not be parsed as intended if placed in the wrong section.

Home manages your existing connection entries, Config manages configuration files, and Settings manages app preferences. Connection details imported from a subscription are not the same as the currently selected .conf file: updating the connection list does not switch configuration files, and saving a configuration file does not change Global Routing to Config.

4 sections

This guide covers General, Rule, Host and URL Rewrite

2 checks

The current file in Config and Home → Global Routing

1 match

Rule uses the first matching rule in order

In Global Routing, Config applies routing from the current configuration; Proxy and Direct change the overall routing behavior, while Scene lets you choose a setup for a particular scenario. When testing the Rule examples in this guide, select Config first so a routing-mode difference isn't mistaken for an unsaved file.

2. [General]: Use key-value syntax for global settings

[General] typically uses key = value, unlike the comma-separated syntax in Rule. These settings control global behavior, such as DNS servers. Don't replace the section with a generic list of network tweaks: your network, existing DNS settings and rules' resolution requirements can all affect the outcome.

[General]
dns-server = system

This snippet demonstrates system DNS syntax only; it isn't suitable for every network. DNS resolution and a successful connection are separate stages: after the destination address is resolved, routing, connection setup and application-layer communication still need to work. If a webpage won't load, changing DNS without checking the later stages can obscure the real issue.

How to read General

Section header: [General]
Setting key: dns-server
Example value: system

Check what the setting does before changing the value to the right of the equals sign.

How to read Rule

Section header: [Rule]
Match condition: DOMAIN,example.com
Policy: PROXY

Each rule lists the type, match value and policy in order, with no equals sign.

Check punctuation as you review the text: section headers use straight square brackets, settings use a straight equals sign, and rules use straight commas. Chinese commas, full-width spaces or quotation marks copied from rich text may look similar but produce different characters.

3. [Rule]: Put specific matches first and FINAL last

[Rule] determines which policy applies to traffic. Rules are checked from top to bottom; the first match takes effect, and later, more “specific” rules are not considered. Order is part of the configuration. If FINAL appears too early, rules below it won't get a chance to match before the fallback.

[Rule]
DOMAIN,api.example.com,DIRECT
DOMAIN-SUFFIX,example.com,PROXY
IP-CIDR,192.0.2.0/24,DIRECT,no-resolve
GEOIP,CN,DIRECT
FINAL,DIRECT

Keyword	What this example matches	Result and notes
`DOMAIN`	`api.example.com` exact domain	DIRECT matches first, so the next PROXY rule is not used.
`DOMAIN-SUFFIX`	`example.com` and its subdomains	Other matching domains use PROXY.
`IP-CIDR`	`192.0.2.0/24` IP range	Uses DIRECT; this address range is reserved for documentation examples.
`GEOIP`	Destination IPs classified as CN by the IP database	Classification is based on IP, not webpage language or domain suffix.
`FINAL`	Traffic not matched by any earlier rule	This example uses DIRECT as the fallback.

no-resolve means this IP rule won't actively resolve a domain to check for a match; it does not disable DNS for the entire app. If a request already has a destination IP, it can still be checked against the address range. GEOIP in this example has no such option. Don't treat an option on one rule as a setting for the entire Rule section.

PROXY is a policy; it does not create server details. It requires an available connection entry you've already set up. DIRECT means a direct connection, but doesn't guarantee that the destination is reachable on your current network. When testing, check both the matched policy and the actual connection result.

4. [Host]: Set an address for a domain, not a proxy policy

[Host] maps local domain names to addresses. It answers “which address does this name resolve to?”—not “which route should this request use?” The example below maps a sample domain to a documentation test address. That address is not a public web server, so a failed connection doesn't tell you whether the syntax is valid.

[Host]
lab.example.com = 192.0.2.10

Map a domain name to an address; don't put an entire URL to the left of the equals sign. Don't include https:// or a path.
Host does not translate ports. When you visit https://lab.example.com/, the default port for standard HTTPS is still 443; standard HTTP defaults to 80.
HTTPS still requires certificate validation. Pointing a domain to a different server does not make that server's certificate valid for the original domain.
After adding a mapping, check Rule to determine the route. To use DIRECT for this domain, add DOMAIN,lab.example.com,DIRECT to Rule, ahead of any broader rules that could match it first.

The app's DNS cache, reused connections or an app's own encrypted DNS can prevent a test from reflecting the expected change. After editing, close the old page and send a new request; reconnect Shadowrocket if needed. Don't keep adding Host entries to work around a cache issue you haven't identified.

5. [URL Rewrite]: Change request URLs, not routing policies

[URL Rewrite] uses regular expressions to match URLs, then applies an action. The example below redirects HTTP requests for a sample domain to HTTPS. The trailing 302 is an HTTP redirect status code, not a port number or proxy policy.

[URL Rewrite]
^http://example\.com/(.*) https://example.com/$1 302

^ anchors the match to the start of the URL; \. matches a literal dot in the domain, rather than any character.
(.*) captures everything after the slash. $1 in the destination URL refers to the first captured group.
With this expression, http://example.com/docs redirects to https://example.com/docs.
The new request created by a redirect is still handled according to the routing configuration. Changing the URL to HTTPS does not change the policy to PROXY.

A browser may use HTTPS directly because of HSTS or a cached redirect, leaving the example HTTP rule nothing to match. When testing, distinguish “the client didn't send an HTTP request” from “the rewrite expression is wrong.” The fact that the address bar ends up showing HTTPS does not prove the rule ran.

6. Save, select and verify a file in Config

Editing isn't finished when you leave the editor. Confirm which file you saved, which file is selected, and whether the connection has reloaded. These steps start with an existing local configuration. Change one section at a time and test it before moving on.

Keep a copy of the original file

Open Config and export or copy the file you plan to edit. Note its filename so you don't confuse a local copy with a remote configuration that has the same name.
Edit the text

In Config, tap the file you want to change and open Edit Plain Text. Edit the relevant section, check for straight punctuation and save your changes.
Select the configuration

Return to Config, tap the file and choose Use Config. Confirm that the selected-file indicator points to the edited file; don't stop at the editing screen.
Confirm the routing mode

Go to Home → Global Routing → Config. Check which connection entry is selected in Home. If automatic connections affect the test, check the trigger settings under Settings → On Demand.
Test again

If needed, disconnect and reconnect, send the target request again and check the request log. Compare against a destination that already works for you; don't treat a single Connectivity Test result as a complete test of all rules.

Test routing matches and content handling separately

Check Rule

Keep Global Routing set to Config.
Test an exact domain and another domain with the same suffix separately.
Check the destination, matched rule and policy in the request log.

Check Host and URL rewriting

Confirm that the request used the expected resolution method.
Check the destination address, protocol and redirect response.
Rule out the effects of existing connections, caches and HSTS.

First confirm the file is loaded, then check that the request was handled as expected. Change one variable at a time.

7. Common questions about editing configuration files

Why does all traffic still use the same policy after I save the file?

First check that Home → Global Routing is set to Config, then confirm the current file in Config. Next, check whether a broad rule appears near the top of Rule or FINAL appears too early. Saving text, selecting a file and choosing a routing mode are three separate actions.

Why do I get an HTTPS error after changing the Host address?

Check whether the new server listens on port 443 and whether its certificate covers the original domain. Host changes the resolved address, not the hostname in the URL, and does not bypass certificate validation. Restore the original mapping and test again to see whether the address change caused the issue.

Does updating a subscription automatically update Rule?

You can't assume that. Check Home connection subscription updates and remote Config file updates separately. The former mainly updates connection entries; only the latter affects configuration text. If you're using a local copy, make sure it is still the selected file.

Do I need to edit all four sections to route a few websites through PROXY?

Usually, add PROXY rules for the target domains in Rule and use FINAL,DIRECT as a fallback if needed. You don't need to add General, Host or URL Rewrite just to fill out the structure. This assumes you already have an available connection entry and have selected Config under Home → Global Routing.

Use this order when checking a configuration file: confirm section headers and syntax, review rule order, then check the routing mode and actual requests. To investigate connection issues, see Troubleshooting; to check a keyword's meaning, consult the Glossary. This helps distinguish text errors, routing choices and network reachability.