The home page and full tutorial both mention rule-based routing and give a short sample, then stop. This article walks through the common match types, match order, and the mistakes beginners make, with real examples.
After you connect, you can send all traffic through a node. That is simple, and wasteful: local sites, banking, and Apple services are faster DIRECT, and they would burn node quota. The rules file is for one job: decide DIRECT or PROXY by domain or IP, instead of one policy for everything.
A rules file is a plain-text list. Each line is one rule, always in this shape:
TYPE,VALUE,POLICYShadowrocket reads the list top to bottom. The first line that matches a request applies the policy at the end of that line, then stops. Later lines are not checked.
The type decides how that line matches a request. The ones you will use most:
| Type | Matches | Example | Notes |
|---|---|---|---|
| DOMAIN | Exact full hostname | DOMAIN,www.example.com,PROXY | Only that hostname. Subdomains or other prefixes do not match |
| DOMAIN-SUFFIX | Domain suffix | DOMAIN-SUFFIX,netflix.com,PROXY | Matches netflix.com and all subdomains (www.netflix.com, and so on) |
| DOMAIN-KEYWORD | Keyword anywhere in the hostname | DOMAIN-KEYWORD,youtube,PROXY | Hits if the hostname contains the keyword. Broader than suffix matching, easy to over-match — use with care |
| IP-CIDR | IP range | IP-CIDR,192.168.0.0/16,DIRECT | Match by CIDR. Common for LAN addresses and specific server IPs |
| GEOIP | Country / region of the IP | GEOIP,US,DIRECT | Match by the destination server’s geo. US is the United States, often used as a fallback “home-country IP goes DIRECT” |
| FINAL | Default when nothing above matched | FINAL,PROXY | Must be the last line. It is "what to do with everything else" |
The last field after the comma is usually PROXY (via a node), DIRECT (no proxy), or REJECT (block, often used for ad domains).
This is the easiest point to miss, and the most important: rules are compared top to bottom; the first hit applies immediately and nothing below it runs. Order changes the result. A more "precise" rule later never runs if an earlier line already matched.
A complete example you can read as-is:
DOMAIN-SUFFIX,netflix.com,PROXY
DOMAIN-SUFFIX,apple.com,DIRECT
DOMAIN-KEYWORD,youtube,PROXY
IP-CIDR,192.168.0.0/16,DIRECT
GEOIP,US,DIRECT
FINAL,PROXYWith this file, www.netflix.com hits line 1 (suffix netflix.com) and uses PROXY; icloud.apple.com hits line 2 and goes DIRECT; the router page 192.168.1.1 hits line 4 and goes DIRECT; a site whose server IP is in the US falls through to GEOIP on line 5 and goes DIRECT; if nothing matched, FINAL,PROXY is the fallback.
FINAL means "what to do when nothing else matched." If you put it in the middle, every rule below it becomes dead code — the request is already handled and matching stops. FINAL must be the last line.
Keyword matching is wider than it looks. DOMAIN-KEYWORD,ads,PROXY will match ad domains and also any normal site whose name happens to contain "ads". Prefer DOMAIN-SUFFIX for known domains. Use keywords only when you need to cover many similar names and can accept some collateral matches.
Streaming and news sites often put cache nodes in your country. If GEOIP,US,DIRECT sits too high, those CDN IPs look “local” and never reach the catalog you wanted. Put domains that must be proxied first, and keep GEOIP relatively late.
A local rules file usually applies as soon as you save. A subscribed rule set needs a manual update (open that subscription and tap Update). The cached copy will not refresh on its own.
Most providers also ship a matching rule set you can import. This article is so you can read each line and tweak it (for example, add a local bank domain as DIRECT) — not so everyone writes a file from scratch.
Note: Syntax follows the Shadowrocket manual and hands-on tests. Supported rule types can differ by version. Check what your build actually supports.
Further reading: Home: what Shadowrocket is · Advanced rules in the tutorial