This guide is for users who have already set up a connection from their own provider in Shadowrocket and want to proxy only a few websites. The key steps are to keep a restorable copy of your configuration, create a domain allowlist, put FINAL,DIRECT at the end of the rules, and switch Global Routing to Config. When finished, check new connection records for a target website and a site outside the list. Verify the matched rule and actual policy rather than relying on whether a page loads.
1. Define the default-direct scope
“Proxy only specific websites” is a default-direct setup: domains on your list match proxy rules, and all other connections are handled by FINAL,DIRECT. Traffic follows the configured rules, not an automatic classification of page content or your location. Login, image, and API domains that are not listed are handled according to their own matches.
This guide assumes you already have a provider and subscription. Buying the app does not include a proxy service plan; rules select a connection route but do not provide server addresses, credentials, or a connection service. Before you begin, confirm that Home has a working connection and know which connection the selected proxy policy will use.
2. Select Config under Global Routing
Home → Global Routing determines how the current connection uses the configuration. Editing domain rules but leaving the routing mode on Proxy or Direct is a common reason results do not match expectations. For this setup, select Config so connections are handled by the rules in the active configuration.
Config
RecommendedUse the current configuration’s rules to determine the policy. Put domain proxy rules first and FINAL,DIRECT last to create the default-direct setup described here.
Use when: You want only websites on your list to use a proxy.
Proxy
Routes intercepted connections through a proxy instead of applying the domain rules in this guide. You can use it briefly to compare proxy connectivity, but it does not prove that rule-based routing is working.
Use when: You want to briefly check whether a target is reachable through a proxy.
Direct
Routes intercepted connections directly. Even if the Config file contains domain proxy rules, they will not perform the routing described here in this mode.
Use when: You want to compare direct connectivity on your current network.
Scene
Routing is determined by configured scene conditions. This is not another name for per-website routing; if you use it, check the scene definitions and which one is actually selected.
Use when: Your configuration has a specific need for scene switching.
Settings → On Demand handles conditions for connecting on demand; it does not define which policy a website uses. To avoid changing multiple variables while troubleshooting, leave the current On Demand settings as they are. Verify Config rules with the connection enabled, then check separately whether on-demand behavior meets your everyday needs.
3. Write minimal domain rules
The reserved example domains below demonstrate the syntax; they are not real targets for testing a proxy service. Replace them with the domains you actually want to proxy, then add them to the [Rule] section of the active configuration. If that section already exists, edit its rules rather than adding another section with the same name.
[Rule]
DOMAIN-SUFFIX,example.com,PROXY
DOMAIN,login.example.net,PROXY
FINAL,DIRECTPROXY specifies the proxy policy. Before using it, check how the current configuration handles this policy and which connection is selected in Home. If your configuration uses a custom policy group, use the exact name of an existing group that actually selects a proxy route; entering an arbitrary name will not create one. If the group is currently set to DIRECT, a matching domain rule may still connect directly.
| Rule | Match scope | What to check |
|---|---|---|
DOMAIN-SUFFIX,example.com,PROXY | example.com and its subdomains | Includes www.example.com, but not otherexample.com |
DOMAIN,login.example.net,PROXY | login.example.net only | Does not cover example.net or other subdomains |
FINAL,DIRECT | Connections that have not matched any earlier rule | Put it last to keep direct as the default |
Do not include https://, paths, query parameters, or ports in the domain field. For example, /account in a website URL is not part of a DOMAIN-SUFFIX match. Using TCP 443 does not limit a domain rule to HTTPS either. These rules select a route by hostname; they cannot proxy just one page on a domain.
- Rules are generally checked from top to bottom, and the first match takes precedence. If an earlier DIRECT rule matches a target domain, a later proxy rule will not handle that match.
- Do not put FINAL before your domain rules. It is a fallback rule, not a declaration to place at the start of the section.
- Existing GEOIP, IP-CIDR, or rule-set entries may also change where traffic outside your list goes. If you need a strict default-direct setup, review those rules too; do not just append three lines to the end of the file.
4. Save the configuration and apply it
The file you edit in Config must be the same one that is active. Back up the original configuration first, then test with a local configuration clearly labeled for its purpose. If the original configuration is maintained remotely, check whether a later update will overwrite your local changes. This prevents a successful test from being undone by the next update.
-
Record the original configuration
Open Config, confirm which configuration is active, and keep a backup of the original file. Note the current Global Routing selection so you can restore it after testing.
-
Edit the rules
In Config, open the local configuration you plan to use and edit its [Rule] section with the actual domains. Check for conflicting rules earlier in the list, then put FINAL,DIRECT after all the rules you need to check.
-
Save and select the configuration
Save the file, return to Config, and confirm that the configuration you just edited is selected—not a remote file with the same name or another backup. If you see a parsing error, check the rule fields and policy names first.
-
Set the routing mode
Go to Home → Global Routing → Config. Check the actual route used by the current proxy connection or policy group, then enable the connection. If the system asks to add a VPN configuration, follow its prompts to authorize it.
-
Create a new connection
After saving, make a new request to the target. To avoid reusing an existing connection, stop and restart the connection, then reopen the target page. Check the new connection records to confirm which rules matched.
Updating Subscribe in Home refreshes connection details from your existing provider; it does not switch the rule file in Config. If a server address has changed, confirm that the proxy policy still selects a working connection. If routing behavior has changed, check the active configuration and rule order first. These are separate issues and should be diagnosed separately.
5. Verify routing in connection records
Test at least one domain on your list and one outside it. Choose websites you can actually access and have a clear purpose; example.com in this guide is only a syntax example. For each test, inspect the new connection records and check the domain, matched rule, final policy, and—if needed—the policy group’s exit route.
| Test target | Expected match | How to confirm |
|---|---|---|
| Listed parent domain | Matching DOMAIN-SUFFIX or DOMAIN rule | The record shows a proxy policy and an active proxy route is selected |
| Listed subdomain | Matching DOMAIN-SUFFIX rule | Confirm the suffix matched, rather than the request falling through to FINAL |
| Domain outside the list | FINAL | Final policy is DIRECT |
| Login or static-resource domain | Handled by the rule for that domain | Add rules as needed and test again |
A page loading only shows that a usable route completed the request; it does not prove the request used a proxy. Likewise, a page failing to load may be caused by DNS, an unreachable server, login state, or restrictions on the remote end—not necessarily a malformed DOMAIN-SUFFIX rule. First confirm that the expected rule matched, then check that the policy route works, and finally inspect the domains the page depends on. This helps avoid unrelated changes.
6. Common issues and troubleshooting order
Change only one variable at a time while troubleshooting, and keep records from before and after each change. Check in this order: routing mode → active configuration → rule order → policy route → website dependencies. Do not switch the default policy to proxy just to fix one login request; that changes the allowlist setup.
The rules are in place, so why is every website using a proxy?
First check that Home → Global Routing is set to Config, then confirm that FINAL,DIRECT is at the end of the active file. If both are correct, look for an earlier proxy rule or rule set with broader coverage. Use a new connection to a domain outside your list to confirm which rule actually matched.
The main site loads, so why are login or images still failing?
Repeat the failed action and inspect the new connections for login, API, or resource domains. If they are not covered by the suffixes you listed, add a DOMAIN or DOMAIN-SUFFIX rule as needed. Do not broaden the rule to an unrelated suffix just because a domain name looks similar.
The proxy rule matched, so why does the record still show a direct connection?
Check the policy group referenced by the rule and its current selection. The group may point to DIRECT, or the record you are viewing may be from a connection kept open before the change. Confirm the route, create a new connection, then check that the rule, policy group, and final route all agree.
Can I proxy websites in just one app?
These rules match target domains, not the app that made the request. The same rule may also match requests to that domain from other apps. If you only need to proxy a page within one app, first check whether it uses a distinct domain; a URL path cannot substitute for a domain rule.
Routing stopped working after an update. Should I import the subscription again?
First open Config and check whether the active file and its [Rule] section were replaced, then check Global Routing. Update Subscribe only if the connection details in Home have actually expired or stopped working. Overwritten rules and changed connection credentials are different issues.
For a complete check, confirm all three: the target domain matches the specified proxy rule, domains outside the list match FINAL,DIRECT, and the proxy policy uses the intended route. When adding websites later, include only the necessary domain scope and repeat these checks in both directions. This preserves the default-direct boundary instead of gradually turning the configuration into an unclear mix of rules.