This guide is for people who have already imported their own connection details into Shadowrocket and want to proxy only selected websites. Follow the steps below to preserve your existing configuration, add domain rules, switch to Config, and test requests. The result is a setup that proxies listed domains and connects directly to everything else. Example domains illustrate rule syntax only; they are not connection services. This site does not provide, sell, or recommend proxy nodes or subscriptions.
Start with the goal: route by domain, not by webpage controls
“Proxy only selected websites” involves two decisions: which requests belong to the target websites, and where unmatched requests should go. Shadowrocket checks configuration rules in order. In this example, domains to proxy come first, followed by FINAL,DIRECT. Requests that do not match an earlier rule then use the direct policy.
A webpage typically connects to more than the domain in the address bar. Images, sign-in, video, and static scripts may come from separate domains. So if a homepage loads but its images do not, the rules may be working while a required domain is missing from your list. Don’t add a broad public domain suffix just to make one page load completely.
Here, PROXY means the proxy policy. It is not a server address and does not create a working connection. Before you begin, confirm that Home has a working server of your own and that the connection you intend to test is selected. Buying the client and obtaining a connection service are separate things.
Minimal rules: DOMAIN-SUFFIX first, FINAL,DIRECT last
The following is an example rule section, not a complete connection configuration. Use it as a reference when editing an existing configuration. Replacing the whole file with these lines could remove DNS settings, general preferences, and other required content. Replace the example domain with the real domain you want to match.
[Rule]
DOMAIN-SUFFIX,example.com,PROXY
DOMAIN-SUFFIX,example.org,PROXY
FINAL,DIRECTDOMAIN-SUFFIX,example.com,PROXY matches example.com and its subdomains, such as www.example.com and media.example.com. It does not match notexample.com. In the domain field, don’t include a scheme, path, port, or wildcard asterisk. https://example.com/video is not a valid value for this field.
| Rule | Matching scope | Use case |
|---|---|---|
DOMAIN,login.example.com,PROXY | This exact hostname only | Proxy only the sign-in host |
DOMAIN-SUFFIX,example.com,PROXY | Root domain and its subdomains | Proxy the entire domain family |
FINAL,DIRECT | Requests not matched by any preceding rule | Send all other requests direct |
Takeaway: start with the narrowest domain scope
For a single hostname, start with DOMAIN. Use DOMAIN-SUFFIX only when you need the root domain and all its subdomains. After confirming the rule works, add any dependent domains. This makes it easier to identify which rule changed the result.
Save the configuration in Config, then select it from Home
Keep a copy of the original configuration before editing so you can restore it if needed. If the existing configuration contains other domain rules, rule sets, or broad proxy rules, simply adding FINAL,DIRECT at the end does not mean “proxy only selected websites.” Requests matched by earlier rules won’t reach the final rule. Review the full rule section, not just its last line.
-
Keep the original configuration
Open Config, find the configuration in use, and save a copy or export a backup first. Make sure you’re editing the file you intend to select later. Avoid editing multiple configurations at once.
-
Edit the rule section
Open the configuration editor and check [Rule]. Place the target DOMAIN or DOMAIN-SUFFIX rules before FINAL. Check the commas, domain, and policy name.
-
Check the fallback
Use FINAL,DIRECT as the last rule, and check whether any earlier rules still send other websites to PROXY. After saving, select this configuration in Config.
-
Switch the routing mode
Go back to Home → Global Routing and select Config. On Home, confirm the selected server and turn on the connection. The first time you connect, follow the system prompt to allow adding a VPN configuration.
-
Send fresh requests
Close existing pages and reopen them, then visit a listed website and an unlisted one. Connections established before you edited the configuration don’t verify the new rules. If needed, disconnect and reconnect first.
The required path is Home → Global Routing → Config—not just seeing the file on the Config screen. The former controls whether traffic is currently routed according to rules; the latter manages configurations. Saving the file, selecting it, and choosing the right mode are three separate checks.
How Global Routing, rule order, and On Demand work together
If every website is being proxied, check the mode first, then the rules. Proxy and Direct under Global Routing set an overall routing behavior; they don’t produce the domain-based split described here. Scene selects behavior by scenario. For initial testing, select Config explicitly to eliminate scene changes as a variable.
| Setting | Main purpose | What to do in this example |
|---|---|---|
| Global Routing → Config | Apply the rules in the current configuration | Select this to test the domain list |
| Global Routing → Proxy | Route traffic through the proxy overall | Not for testing direct connections to unlisted domains |
| Global Routing → Direct | Route traffic directly overall | Not for testing proxy connections to listed domains |
| Global Routing → Scene | Choose routing behavior by scene | Rule out scene changes first |
| Settings → On Demand | Manage conditions for connecting on demand | Check separately from domain matching |
On Demand controls when a connection starts; it does not replace DOMAIN-SUFFIX checks for determining which website a request belongs to. If the connection starts again automatically after you disconnect, check the conditions under Settings → On Demand. If a website uses the wrong policy, check the rules in Config and the current routing mode. Keep these two layers separate when troubleshooting.
GEOIPmatches based on the geographic location of the destination IP. It does not identify a website’s owner or the language of its pages. You don’t need it to route the explicit domain list in this guide.IP-CIDRmatches an IP address range. Addresses on shared servers or content delivery networks may serve multiple websites, so routing by IP range can affect far more than routing by domain.FINALis the fallback rule. If it appears before the target domain rules, later rules can’t process requests it has already matched.
Check the results: distinguish rule matches, DNS, and server availability
A webpage loading doesn’t prove it went through the proxy, and a page failing to load doesn’t prove the rule failed to match. For testing, keep the network, server, and configuration the same; change one setting at a time. Use connection records to check the destination host, matched rule, and policy. The fields shown depend on the current interface. Don’t assume DNS queries use the same route as webpage connections.
- Test a listed domain: Reopen the target website and check whether the request host matches the suffix you entered and whether its policy is PROXY. Check the hostname after any redirects, too.
- Test an unlisted domain: Choose an ordinary website not included in your rules and confirm its new requests use DIRECT. If they still use the proxy, check the earlier rules.
- Test the connection: On Home, use Connectivity Test to help check whether the selected server is reachable. A successful test doesn’t mean every website and resource will be accessible.
- Test dependent domains: If text loads but images or sign-in fail, check the actual hostnames used by those resources. Add a rule only if needed; don’t guess domains based on how the page looks.
The following are original system errors that may appear for network requests. They are not syntax hints from the rule editor, and Shadowrocket may not display them in exactly the same way every time. When one appears, first identify the failed request and the policy it used, then adjust the configuration.
Error: The request timed out.
Cause and fix: The request did not complete in time. The issue may involve the network, the destination website, or the proxy connection. First check whether the request matched the expected policy, then use Home → Connectivity Test to check the selected server. Don’t expand the proxy list as a first step.
Error: A server with the specified hostname could not be found.
Cause and fix: The hostname could not be resolved, or the domain may be misspelled. Check the address you visited and the domain in the configuration, then review the DNS settings in the active configuration. DOMAIN-SUFFIX cannot fix a DNS resolution failure.
If an app connects directly to an IP address, reuses an existing connection, or sends a request to a different host than expected, the domain rule may not get the matching information you expect. Use connection records to investigate; don’t add a broad IP-CIDR range just to “force a match.” For more on DNS, see the DNS section in the technical reference.
FAQ: subdomains, subscription updates, and restoring your setup
How do I proxy just one subdomain?
For example, to route only login.example.com, use DOMAIN,login.example.com,PROXY and keep FINAL,DIRECT as the last rule. With DOMAIN-SUFFIX,example.com,PROXY, the root domain and its other subdomains will also use the proxy.
Why does every website still use the proxy after I add the rules?
Go to Home → Global Routing and make sure Config—not Proxy—is selected. Then open Config and confirm that you selected the file you edited. Finally, check from top to bottom for any broader proxy rules or rule sets that match earlier.
Will refreshing a subscription change these rules?
Treat connection subscriptions and configuration files separately. Updating a server subscription doesn’t edit [Rule]. If you update a remote configuration, its new contents may overwrite local changes. Keep a copy of your configuration and recheck the rules and selected file after each remote update.
Does DIRECT for unlisted domains mean the VPN is off?
No. DIRECT is a routing policy used while the connection is active; it doesn’t disable the system VPN configuration. To stop the current connection, turn it off on Home and check Settings → On Demand for automatic connection conditions.
How do I restore things if the configuration stops working?
Go to Config and select the configuration you saved earlier, then reconnect using your previous Global Routing setting. Once restored, verify that your original setup works before adding target domains one at a time. Change one thing at a time to identify which rule caused the difference.
For a final check, confirm four things: the correct file is active, Global Routing is set to Config, target domain rules come before the fallback, and FINAL,DIRECT is last. Then check each website’s dependent domains. This keeps the scope of your list clear and helps you avoid mistaking a page-loading issue for a failure of the entire routing setup.