To route only selected websites through a proxy in Shadowrocket, three conditions must be met: choose Config under Home → Global Routing, add proxy rules for the target domains in the active configuration, and use FINAL,DIRECT for all remaining requests. This guide is for users who already have a working server configuration. It covers a minimal rule snippet, matching behavior, and verification steps. The example domain is for illustrating syntax only and does not represent a working route.
1. Choose Config mode and confirm the policy name
Routing only selected websites is a rule-based routing task; turning on the connection does not do this automatically. Global Routing on Home determines how traffic is routed for the current connection. The Config page manages configuration files. Although the names are similar, their roles differ: the former determines whether rules are applied, while the latter determines which rules are used.
| Option | Purpose | How to use it for this guide |
|---|---|---|
Config | Applies policies according to the rules in the current configuration | Select this option to test the specified domains |
Proxy | Routes traffic through a proxy | Not suitable for testing whether other websites connect directly |
Direct | Routes traffic directly | Does not verify whether domain proxy rules are working |
Scene | Uses Scene settings to determine routing behavior | For this test, switch to Config to reduce interference from Scene conditions |
The third field in a rule is the policy, not the protocol name. DIRECT means a direct connection; this guide uses PROXY to refer to an existing, working proxy policy. Before editing, confirm that the current configuration recognizes this name and that it points to the intended server. If you use a custom policy group, replace PROXY in the example with its exact name. Do not copy a name that does not exist.
2. Minimal DOMAIN-SUFFIX configuration and matching boundaries
To route example.com and its subdomains through a proxy while sending all other requests directly, add these two rules to the configuration's [Rule] section. This is a rule snippet, not a complete configuration with servers, policy groups, and other settings. Do not replace your entire existing file with it or create duplicate rule sections.
[Rule]
DOMAIN-SUFFIX,example.com,PROXY
FINAL,DIRECTDOMAIN-SUFFIX matches on domain suffix boundaries. Enter the domain itself: do not include https://, a path, or :443, and do not write it as *.example.com. It matches the root domain and its subdomains, but not unrelated domains that happen to contain the same letters.
| Request domain | Match? | Result with the minimal rules above |
|---|---|---|
example.com | Yes | PROXY |
www.example.com | Yes | PROXY |
api.example.com | Yes | PROXY |
notexample.com | No | DIRECT |
example.net | No | DIRECT |
If only www.example.com should use the proxy while api.example.com must connect directly, use the exact-domain rule DOMAIN,www.example.com,PROXY instead of matching the entire root domain. Write rules for the actual hostname in the request, not the website's brand name or page title.
3. When to use DOMAIN-KEYWORD and how to order rules
DOMAIN-KEYWORD checks whether a domain contains a specified string, so it matches more broadly than a suffix rule. For example, DOMAIN-KEYWORD,example,PROXY may match both example.com and notexample.com. When you want to list a few specific websites precisely, prefer DOMAIN or DOMAIN-SUFFIX. Avoid broadening the match just to write fewer lines.
Rules are generally evaluated from top to bottom, and the first matching rule determines the policy. Put more specific exceptions before broader rules. In the example below, static.example.com connects directly, other domains under example.com use the proxy, and all remaining requests connect directly.
[Rule]
DOMAIN,static.example.com,DIRECT
DOMAIN-SUFFIX,example.com,PROXY
FINAL,DIRECTIn short: add exceptions first, then broader matches, and the fallback last
Before saving, review the rules from top to bottom: does the exact exception match first, is the suffix scope too broad, and is FINAL at the end? This sequence makes conflicts easier to spot than repeatedly adding duplicate domain rules.
If the existing configuration also contains GEOIP, IP-CIDR, or external rule sets, FINAL,DIRECT does not override decisions those rules have already made. For strict proxying of selected websites only, also check whether earlier rules send other traffic through a proxy. Changing only the last line does not turn an existing configuration into an allowlist.
4. Apply and verify the rules in Home and Config
For the steps below, change only the rules and routing mode; do not also change DNS, server protocols, or On Demand. This makes it easier to tell whether any change in results came from the rule edits. If Settings → On Demand is already set to start connections automatically, note its current state first so an automatic reconnection is not mistaken for an unsaved configuration.
-
Check the server
On Home, confirm that the selected server or policy group is working. If you already have a service provider and subscription, make sure the existing configuration works normally before testing rules.
-
Save the original configuration
Open Config, confirm which file is active, and keep a copy of its original contents. Edit the [Rule] section, then check the proxy policy name, English commas, and the position of FINAL.
-
Select rule-based routing
Save and select the edited configuration, then return to Home → Global Routing → Config. If needed, disconnect and reconnect so the following tests use a new connection.
-
Test two domains
Visit one domain you added to the rules, then another that is not listed. Check the hostname, matched rule, and policy in the request log rather than relying only on whether the page loads.
-
Check related requests
If the page loads but images or sign-in fail, check the actual domain of the failed request. Add a rule only after confirming that the resource needs to use a proxy, then test again.
Browsers may reuse existing connections, so simply refreshing a page may not create a new connection. After changing rules, end the old request and start a new test. Do not use an ongoing long-lived connection to judge the new rules. example.com is a reserved example domain used to illustrate syntax; for real tests, substitute a domain you need to access and are authorized to use.
5. Why results may be unexpected even with FINAL set to DIRECT
First distinguish between an unexpected policy and a request that fails despite using the expected policy. If a request matches PROXY but cannot connect, the issue may be with the server or its connection to the destination. If it matches DIRECT but does not load, the local network may be unable to reach the destination directly. Adding more domain rules cannot fix every connection error.
Error: The request timed out.
Cause and fix: The request timed out. This message alone does not tell you whether the rules are wrong. Check the policy used by the failed request first. If it matched the expected PROXY policy, test it against a server you already know works before changing FINAL.
Error: A server with the specified hostname could not be found.
Cause and fix: The hostname could not be resolved. Check the address spelling and the hostname in the request, then review the DNS settings in the current configuration. Do not mistake a resolution failure for a DOMAIN-SUFFIX rule failing to cover subdomains.
The messages above are English errors that a system network request may return. Their exact wording varies by caller and system language. When diagnosing an issue, record the original message, failed domain, and actual policy—not just that the site would not open.
- All requests use the proxy: Check whether Home → Global Routing is still set to Proxy, then look for broader proxy rules before FINAL.
- The target website still connects directly: Check whether a different Config is selected or an earlier DIRECT rule matches the domain. Then confirm which subdomain the request actually uses.
- Only part of the page loads: The page may request resources from another domain. A suffix rule covers only the specified domain and its subdomains; it does not automatically include every external resource referenced by the page.
- Entering an IP address directly does not work as expected: Domain rules do not match arbitrary IP addresses. Consider a separate IP-CIDR rule only if you genuinely need a fixed address, and account for address changes and shared IPs.
6. FAQ: routing selected websites through a proxy
If I enter only example.com, will www also use the proxy?
With DOMAIN-SUFFIX,example.com,PROXY, the rule also matches www.example.com. With DOMAIN,example.com,PROXY, it matches only the root domain. Add exact-domain rules as needed, or use a suffix rule.
Can I proxy only one path on a website?
You cannot put example.com/account in DOMAIN-SUFFIX. Domain-based routing does not distinguish URL paths, so different paths on the same hostname cannot use different policies under this rule. First check whether the resource can be identified by a separate subdomain.
Do I need to rewrite the rules after updating a subscription?
First check whether you updated a server subscription on Home or a remote configuration in Config. The former primarily updates server details; the latter may replace local edits. After an update, open the active configuration and check the rules, keeping a copy of your own changes.
Does FINAL,DIRECT turn off the connection?
No. It sets the policy for requests that did not match earlier rules; it does not turn off the connection on Home. Keep the connection active and use Config to continue routing specified domains according to the proxy rules.
For a complete check, confirm all three: the target domain matches the expected proxy policy, a test domain not listed in the rules matches DIRECT, and the results remain consistent after saving and reconnecting. When adding websites later, add one set of domains at a time and repeat the checks. Keep clear change records to prevent the allowlist from gradually becoming a set of overly broad, hard-to-explain matches.