Shadowrocket Rules Guide: How DOMAIN, DOMAIN-SUFFIX, GEOIP, IP-CIDR, and FINAL Work

1. Check which routing mode is active

In Home, check Global Routing. This guide covers routing requests according to the rules in the selected Config. Proxy routes traffic through a proxy by default, while Direct routes it directly; in either mode, a webpage loading or failing to load does not show whether a Config rule is active. Scene selects routing for specific scenarios, so check its conditions and the routing settings in use separately.

A rule decides how a connection is handled; it does not determine whether a proxy server can connect. Even if a rule correctly selects PROXY, a request can still fail if the configured server is unavailable. DIRECT selects a direct connection but does not guarantee that the destination is reachable from your current network.

A rule line is easiest to read when split into three parts. The second field below is the match value, and the third is the action. FINAL has no match value, so it has only two fields. Use English commas as field separators, not Chinese commas.

[Rule]
DOMAIN,api.example.com,PROXY
FINAL,DIRECT

• DOMAIN: Match type; the destination domain must match exactly.
• api.example.com: Match value. Do not include the protocol, port, or URL path.
• PROXY: Route through the proxy policy; a working proxy configuration must already be available.
• FINAL,DIRECT: Use a direct connection if none of the preceding rules match.

2. How DOMAIN, DOMAIN-SUFFIX, and DOMAIN-KEYWORD differ

These three keywords all match domains, but their scopes differ. Given a full URL, first identify the hostname. For example, the hostname in https://api.example.com:8443/v1/status is api.example.com; 8443 is the port and /v1/status is the path. Neither belongs in a DOMAIN match value.

Exact host, all subdomains, or keyword

Use DOMAIN when only one API host should go through the proxy. Use DOMAIN-SUFFIX when you need to cover a main site, image hosts, and API hosts under the same domain. Suffix matching follows domain boundaries: example.com does not match notexample.com or example.com.other.test.

DOMAIN-KEYWORD checks whether a domain contains a string. The keyword example can match that text across different suffixes, but may also catch unrelated domains. It does not understand site ownership, brand relationships, or webpage content. If an exact domain expresses what you need, there is no reason to replace it with a broader keyword just to shorten the rule.

3. IP-CIDR and GEOIP match destination IPs

IP-CIDR checks whether the destination IP falls within a specified network range. GEOIP checks the IP's location according to a geolocation database. Neither is based on webpage language, domain suffix, or account region. A domain request may need to be resolved before its IP can be checked; a direct IP request has no hostname for ordinary domain rules to match.

[Rule]
IP-CIDR,192.168.50.0/24,DIRECT,no-resolve
GEOIP,CN,DIRECT
FINAL,PROXY

• 192.168.50.0/24 is an IPv4 network range covering addresses from 192.168.50.0 through 192.168.50.255. It does not mean “port 24.”
• no-resolve means not to actively resolve a domain solely for this IP rule. It does not disable all DNS, and it is not a direct-connection switch.
• GEOIP,CN,DIRECT means use DIRECT when the database classifies the destination IP as CN; it does not mean “direct-connect Chinese-language websites.”
• For IPv6 networks, use the corresponding IP-CIDR6 syntax. Do not enter an IPv6 address as an IPv4 network.

The LAN range above is only a syntax example. Your router may use 192.168.1.0/24 or another range, so use the one for your current network. Do not add an unnecessarily large range to cover a single device, or other addresses may be routed by the same policy.

GEOIP results depend on the database and destination IP. A site using a CDN may resolve to different addresses on different networks, and changing DNS can also affect the location result. So if traffic used DIRECT yesterday and PROXY today, that does not automatically mean the rule file is broken. Check the domain, resolved IP, and matching rule together.

4. Rules are checked top to bottom; put FINAL last

In a standard rule list like the one discussed here, rules are checked from top to bottom, and the first match determines the action. The most specific rule does not automatically win across the whole list. If a broad rule matches first, later, more specific rules cannot override it.

[Rule]
DOMAIN,api.example.com,PROXY
DOMAIN-SUFFIX,example.com,DIRECT
GEOIP,CN,DIRECT
FINAL,PROXY

In the example above, api.example.com matches DOMAIN first and uses PROXY. www.example.com does not match the first line, but matches the second and uses DIRECT. If you swap the first two lines, the API host is caught by DOMAIN-SUFFIX first. That is why exceptions should come before broader rules.

Route only the listed domains through the proxy

If you want only specified sites to use the proxy and everything else to connect directly, start with the minimal snippet below. GEOIP is omitted because this setup does not need an additional location-based check. A short rule list is not incomplete as long as its actions express what you need.

[Rule]
DOMAIN-SUFFIX,example.com,PROXY
FINAL,DIRECT

5. Verify changes in Config with a new connection

Before you begin, you should already have your own provider and a working configuration. Editing rules does not require buying the app again or changing protocols. Protocols such as Shadowsocks, VMess, VLESS, and Trojan handle proxy connections; the keywords in this section decide whether a request is sent through the proxy. These operate at different layers.

1. Keep a copy of your original configuration

   Open Config and keep a copy or export a backup of the current configuration before editing. Note which configuration is in use. A remote configuration update may overwrite local changes, so avoid experimenting on your only copy.

2. Edit the rules section

   In Config, open the editor for the configuration you want to change and find [Rule]. Edit the existing rules section; do not paste the entire example at the end of the file and create multiple sections with the same name.

3. Check field order

   Use English commas. Remove https://, the port, and the path from domain fields. Put exact exceptions before broader rules, leave FINAL at the end, and check that each action name is spelled correctly.

4. Select the updated configuration

   Save and select the configuration you just edited, then go to Home → Global Routing → Config. Also check that Home has a working server selected, so a connection problem is not mistaken for a rule issue.

5. Create a new request

   Re-establish the connection and visit the test destination. In Data, check the new request's destination, action, and matching rule. An existing connection may keep using its original route, so refreshing a page that reuses the same connection is not enough to confirm the change.

Change one condition at a time. For example, test an exact DOMAIN rule first, broaden it to DOMAIN-SUFFIX next, and add IP matching only after that. Recording the expected and actual actions makes issues easier to isolate than adding dozens of rules at once. Example domains illustrate syntax only; use a destination you actually need to access for testing.

6. Troubleshoot rule matching and connectivity separately

First check in Data whether the new request used the expected action, then check whether the destination is reachable. If the wrong action was selected, review the active Config, Global Routing, and preceding rules. If the action is correct but the request times out, check proxy connectivity, DNS, and the destination server. Do not immediately switch to a broader keyword rule.

The following are standard Apple network error identifiers that may appear in detailed system or app error messages. The displayed wording can vary by request entry point. These errors describe connection failures, not Shadowrocket rule syntax errors, and the error code alone cannot tell you whether to use DIRECT or PROXY.

The final check comes down to four things: Global Routing is set to Config, the active configuration contains your changes, the first matching rule is the one you expect, and the corresponding outbound connection can be established. Check them in that order to distinguish issues caused by syntax, rule order, DNS, and network availability.