This guide is for users who have already imported their own server configuration into Shadowrocket and want only selected sites to use PROXY. Set Global Routing to Config, list the target domains in the active configuration, then use FINAL,DIRECT for remaining requests. Afterward, check request logs to confirm which rules matched rather than relying on the connection icon.
1. Understand the roles of Global Routing and Config
Routing only selected sites through PROXY requires rule-based routing; turning on the connection does not do this automatically. The server selected in Home provides the proxy exit, while the configuration enabled in Config determines which requests use it. This guide assumes you already have your own provider and subscription; it does not cover obtaining connection resources.
In Home, open Global Routing, select Config, then check which configuration is active in Config. Proxy sends traffic that can be handled by that mode through the proxy, while Direct connects directly; neither mode is suitable for testing individual rules in this guide. Scene lets you choose routing behavior by scenario. For initial troubleshooting, select Config to avoid variables caused by switching scenes.
PROXY is a policy name in a rule; Proxy in Global Routing is a routing mode. Do not confuse the two. DIRECT means connecting to the destination directly; it does not mean the request bypasses the system VPN tunnel. A VPN indicator in the status bar only shows that the tunnel is connected—it does not prove that a particular site uses the proxy exit.
- Home: Select a working server and make sure the connection switch is on.
- Home → Global Routing → Config: Apply the rules in the active configuration to routing.
- Config: Make sure the active file is the one you intend to edit, not another configuration with the same name.
- Settings → On Demand: Controls when connections are established on demand; it does not replace domain-based routing rules.
2. Create a minimal rule set: selected domains via PROXY, everything else DIRECT
Back up the current configuration before editing so you can restore it if needed. The example below shows the rule structure. example.com is a placeholder domain for illustration; replace it with a domain you actually want to match. It is not a subscription URL or server address.
[Rule]
DOMAIN-SUFFIX,example.com,PROXY
FINAL,DIRECTSeparate fields with English commas. The first line uses DOMAIN-SUFFIX to match example.com and its subdomains, such as www.example.com and static.example.com, but not notexample.com. The final line, FINAL,DIRECT, skips domain checks and sends requests that did not match earlier rules to DIRECT.
- Open Config, find the active configuration, and save a backup or create a copy first.
- Open the editor for that configuration and find the rules under Rule. If editing the text directly, locate
[Rule]. - Put target-domain rules before any broader rules they need to override, and place
FINAL,DIRECTat the end. - Save and enable this configuration, return to Home, and confirm that Global Routing is set to Config.
- Send a new test request. If it still behaves like an existing connection, close that connection and test again; reconnect the tunnel if necessary.
Do not append the entire block repeatedly to the end of the configuration, creating multiple [Rule] sections or multiple FINAL rules. Also confirm that the exit used by PROXY is working. Rules determine where traffic goes; they cannot fix an unreachable server, incorrect authentication details, or mismatched server-side settings.
3. Choosing between DOMAIN-SUFFIX and DOMAIN-KEYWORD
For a small number of clearly defined sites, start with DOMAIN-SUFFIX. It matches at domain boundaries, making its scope easier to control than a keyword search. To match one host without including its other subdomains, use DOMAIN for an exact match.
Matches at domain boundaries
- Keyword
- DOMAIN-SUFFIX
- Full rule
DOMAIN-SUFFIX,example.com,PROXY- Matching example
- example.com、img.example.com
- Non-matching example
- notexample.com
Best when you know the site's main domain and want to include its subdomains.
Matches the domain string
- Keyword
- DOMAIN-KEYWORD
- Full rule
DOMAIN-KEYWORD,example,PROXY- Matching example
- example.com、notexample.com
- Risk of overmatching
- May include unrelated sites
A keyword does not identify a brand. Check request logs to see what the rule actually matches.
DOMAIN-KEYWORD checks whether a specified string appears in the domain; it does not search the full URL. For example, the path /video and query parameter id=8 in https://www.example.com/video?id=8 are not matched by this rule. Adding https://, a path, or a page title to the domain field will not route traffic by webpage path.
[Rule]
DOMAIN,login.example.com,DIRECT
DOMAIN-SUFFIX,example.com,PROXY
FINAL,DIRECTThese rules deliberately keep one exception: login.example.com connects DIRECT, while other domains under example.com use PROXY. If you also add a broad DOMAIN-KEYWORD rule to the same configuration, check whether it might include sites you intended to keep DIRECT.
4. Rule order: handle exceptions first, then broader conditions
Rules are checked in order. When a request matches, the corresponding policy applies; a more specific rule later in the list does not override it. For easier maintenance, put exact exceptions first, broader rules after them, and FINAL last.
| Rule order | Request domain | Expected result |
|---|---|---|
| Exact DOMAIN exception before DOMAIN-SUFFIX | login.example.com |
Exception matches first; DIRECT |
| DOMAIN-SUFFIX before exact exception | login.example.com |
Suffix rule matches first; PROXY |
| FINAL before target-domain rule | www.example.com |
FINAL handles the request first; later rules cannot match |
| Only the target suffix rule and FINAL,DIRECT at the end | www.example.net |
Does not match the target suffix; DIRECT as the final policy |
How to check: test the domain against the rules from the top
When you find the first matching condition, note its policy. If it already determines the result, adjust that rule's position or scope instead of adding another patch at the end of the list.
GEOIP and IP-CIDR use different conditions from domain rules. GEOIP matches based on the destination IP's result in a geolocation database, while IP-CIDR matches an address range. Neither precisely identifies a particular website or brand. A site may use addresses in multiple regions, and one address may host multiple sites.
GEOIP,CN,DIRECT: Matches destination IPs classified as CN in the database. With a minimal configuration that already ends in FINAL,DIRECT, you usually do not need to add this just to send everything else DIRECT.IP-CIDR,192.0.2.0/24,DIRECT,no-resolve: Syntax example; the address range is for documentation only.no-resolvemeans this IP rule will not trigger a DNS lookup.- If a broad IP condition comes before domain exceptions, consider how its resolution and matching behavior could cause it to handle a request first.
5. Verify the rules after saving—not just whether a page opens
A page opening successfully only shows that the request had a working route; it does not prove the exit was correct. Start by comparing one target domain with one non-target domain, then test subdomains and exception domains. These are verification criteria, not speed-test results for any particular network.
- In Home, confirm that a working server is selected, Global Routing is set to Config, and the connection is established.
- Open the current request log or connection details, clear any filters, and revisit the target page so you do not mistake old entries for new results.
- Find the target hostname and check the matched rule and exit policy. The target domain should match the specified DOMAIN or DOMAIN-SUFFIX rule and use PROXY.
- Visit a domain that is not listed in the rules and confirm that FINAL,DIRECT handles it. If another rule matches, return to Config and check the earlier entries.
- Test the exception domain and target subdomains, then load the full page and check whether image, login, and video requests behave as expected.
One page does not mean one domain. Page content, static assets, login APIs, and media may come from different hosts. If the homepage loads but images do not, find the failed resource's actual domain in the request log before deciding whether to add a rule. Do not immediately add a short, broad keyword to the configuration.
6. Common issues: rules still do not behave as expected
Why do so many sites still use PROXY after I added FINAL,DIRECT?
First, go to Home → Global Routing and confirm that Config is selected, then check the first rule matched by a request. If earlier DOMAIN-KEYWORD rules, rule sets, or IP conditions still point to PROXY, adjust those entries. FINAL only handles requests that earlier rules have not handled.
How can I proxy just one subdomain without including the entire site?
Use DOMAIN,video.example.com,PROXY and keep FINAL,DIRECT at the end. Also check for and remove broad suffix or keyword rules that conflict with the target, then test video.example.com and www.example.com separately.
Why did the exit or configuration behavior change after I updated my subscription?
First, distinguish between a server subscription update and a remote configuration update. The former may change the available servers; the latter may change Rule entries. Return to Home to check the selected server, then open Config to verify the active file and its rules. Keep local changes in a separate copy and compare before and after updating.
Do I have to turn off On Demand for rule-based routing to work?
No. Settings → On Demand determines when a connection is established based on conditions; Rule in Config determines how traffic is routed after the connection is established. For troubleshooting, you can connect manually to keep test conditions consistent. Once the rules are verified, restore the On Demand settings that suit your network.
Change one variable at a time during maintenance: confirm the exit works, then check the routing mode, active file, match conditions, and rule order. Record why each domain rule was added and keep a fixed set of test targets. If something goes wrong, you can revert the latest change instead of rewriting the entire configuration.
- Minimal setup: selected domains use PROXY; FINAL,DIRECT goes at the end.
- Choose the scope: use DOMAIN or DOMAIN-SUFFIX for specific domains; use DOMAIN-KEYWORD with care.
- Verification: the destination, matched rule, and actual exit in the request log should agree.