Shadowrocket: Proxy Only Selected Websites with Rules

1. Set Global Routing to Config Before Editing Domain Rules

Global Routing determines which routing mode handles connections. Proxying only a few websites requires routing based on a configuration file, so first go to Home → Global Routing and select Config. Editing rules while leaving Proxy or Direct selected will not produce results you can verify against the rule list in this guide.

Here, PROXY is a policy used in a rule; it does not mean you should set Global Routing to Proxy. The former determines where a request goes when a rule matches; the latter sets the routing mode for all traffic. They operate at different levels.

2. Minimal Rules: Targets First, FINAL,DIRECT Last

This minimal example shows only a rule section and uses reserved example domains; it does not represent a working service. When editing your configuration, replace these domains with the hostnames of the websites you want to proxy. Keep any other required sections in your existing configuration—don't replace the entire file with these lines.

[Rule]
DOMAIN-SUFFIX,example.com,PROXY
DOMAIN,api.example.net,PROXY
FINAL,DIRECT

DOMAIN-SUFFIX,example.com,PROXY matches example.com and its subdomains, such as www.example.com. DOMAIN,api.example.net,PROXY matches only that exact hostname. It does not match www.example.net or any of its subdomains.

Rules are checked from top to bottom, and the matching policy is applied as soon as a rule matches. FINAL,DIRECT has no domain parameter; it sends requests that haven't matched an earlier rule to DIRECT. If you place it before the target-domain rules, those rules won't work as intended.

3. Steps: Edit Config, Then Enable It from Home

Server details and routing rules are separate. Having a working server in Home doesn't mean the domain rules in Config are enabled, and updating an existing subscription doesn't automatically create the routing list described here. Before you begin, save a copy of your current configuration so you can restore it if needed.

1. Back up your configuration

   Open Config and confirm which configuration file is currently in use. Save a copy first. If the configuration is updated remotely, also save an editable local copy so the next update doesn't overwrite your changes.

2. Edit the rules

   In Config, open the editor for the configuration you want to use and check [Rule]. Place the DOMAIN or DOMAIN-SUFFIX rules for sites you want to proxy before the fallback rule, and use FINAL,DIRECT as the last rule. The available text and individual-rule editing options depend on what the app currently displays.

3. Enable the configuration

   After saving, return to Config and confirm that the file you just edited is selected. Don't leave it in the editor or rely on the filename alone. If several files have similar names, reopen the selected file and check its contents.

4. Select the routing mode

   Go to Home → Global Routing → Config, then return to Home and select an available server you already have. The PROXY rules in this guide need a working proxy endpoint. If your configuration has a policy group with the same name, check which option that group is using too.

5. Send new requests

   Turn on the connection and send new requests to both a target website and a non-target website. If needed, disconnect and reconnect before testing. Existing connections aren't suitable for checking whether a rule you just changed is working.

If your existing configuration has additional policy groups or complex rule sets, understand what they do before making changes. For this setup, the goal isn't to add more rules; it's to make sure target domains match PROXY first and all other requests eventually reach DIRECT. Don't change servers, DNS, and multiple rules at the same time, or it will be difficult to identify the cause of any difference.

4. Entering Domains: No Paths or Ports

DOMAIN and DOMAIN-SUFFIX match hostnames, not the full address shown in a browser's address bar. Websites using HTTPS commonly use port 443, but don't add :443 to the domain field. URL paths and query parameters don't belong there either.

A webpage usually makes requests to multiple hostnames. The main document, images, sign-in checks, video, and static assets may each use different domains. A DOMAIN-SUFFIX rule for a root domain covers only its own subdomains, not every third-party domain used by the website. So if the homepage loads but images don't, the rule may still be working—the asset requests may simply be outside your list.

• Add the main website domain you want to proxy first, then use actual request logs to identify any resource domains that also need to be added.
• For a single hostname, prefer DOMAIN to avoid routing unrelated services under the same domain through the proxy.
• Don't use an overly broad suffix such as com, or a large number of unrelated websites will match PROXY.
• IP-CIDR matches IP ranges, and GEOIP matches using an IP geolocation database. Neither is a direct substitute for a precise list of website domains.

If a request goes directly to an IP address, or no usable domain information is available when rules are checked, a domain rule may not match and the request may fall through to FINAL. Don't add an entire address range to PROXY just because the target website shares an IP; that address may also serve other websites.

5. How to Verify: Check Target, Control, and Resource Requests

To verify routing, check where new requests actually go—not just whether a page loads or a connection indicator appears. A page loading only tells you that the visit succeeded. Caching, direct access, and an existing connection can all make incorrect routing look like it's working.

1. Target group: Choose a domain you've added to the rules and send a new request. In the app's request log, check the hostname, matched rule, and policy. The expected policy for a target request is PROXY.
2. Control group: Visit a website that isn't on your target list and is directly reachable on your current network. If no earlier rule matches, the expected policy is FINAL,DIRECT.
3. Resource group: If part of the target page fails to load, find the actual hostname for the failed request. It may differ from the domain in the address bar. Add it separately only after confirming that it needs to use the proxy.
4. Retest: After changing a rule, send new target and control requests. Don't use a long-lived connection established earlier to verify the change.

If a target request matches PROXY but still times out, first check whether the server selected in Home is working and whether its address, port, and authentication details are correct. If the log shows DIRECT, check the rule order, the hostname in the actual request, and the enabled configuration. This helps avoid mistaking a connection issue for a rule syntax problem.

6. Common Issues: Why Is Everything Still Proxied or Direct?

Keep a copy of the configuration that passes both the target and control tests. When adding a website later, add only the domains it actually needs and keep FINAL,DIRECT at the end. When removing a target, retest to confirm that its traffic now goes direct. Maintain the rule list based on actual requests, not the website's display name.