Shadowrocket Rule Types Explained: How to Write DOMAIN-SUFFIX, GEOIP, IP-CIDR and FINAL

Check that rules can take effect

Check Global Routing on Home before editing Config. With Config selected, requests are routed according to the active configuration file. Proxy and Direct are global routing modes; they can’t be used to verify whether custom Rule entries are working. Scene applies the configured scene and doesn’t necessarily use a fixed Config. During troubleshooting, select Config to avoid confusion caused by changing scenes.

1. On Home, make sure you have a working connection configured and turn it on. When creating a system VPN configuration for the first time, approve the system prompt.
2. Open Config and check which file is active. Keep a copy before editing so remote updates don’t get mixed up with your local changes.
3. Return to Home and set Global Routing to Config. After saving your changes, reload the configuration or reconnect as prompted by the app.
4. Close any existing connection from the app you’re testing, then make a new request. An established long-lived connection usually won’t switch routes immediately just because you changed a rule.

Home handles connections and service entries, Config contains configuration files, and Settings holds global options. Settings → On Demand controls when connections are established based on conditions; it doesn’t assign a domain to a Rule. If the connection keeps restarting after disconnecting, check this setting instead of repeatedly changing FINAL.

Match first, then apply the policy

A typical rule consists of a type, a matching value and a policy, separated by English commas. For example, DOMAIN,api.example.com,DIRECT means use DIRECT when the domain is exactly api.example.com. FINAL has no matching-value field, so write it as FINAL,PROXY—don’t add a third field.

Once a request matches an earlier rule, Shadowrocket won’t continue looking for a later, “more specific” rule. For example, if DOMAIN-SUFFIX,example.com,PROXY comes before DOMAIN,api.example.com,DIRECT, the second rule won’t create an exception for that domain. Put exception rules before broader rules.

Three domain rule types

Domain rules match hostnames, not full URLs. Don’t include https://, a path such as /login, query parameters or a port such as :443 in the matching field. The example domain example.com below is for illustration only and doesn’t refer to a service you need to configure.

Use DOMAIN to change the route for a single API. Use DOMAIN-SUFFIX to cover subdomains under the same root domain. Choose DOMAIN-KEYWORD only when you specifically need substring matching. Keyword rules don’t understand which site a domain belongs to, so short terms can affect unrelated domains and make problems harder to isolate.

[Rule]
DOMAIN,api.example.com,DIRECT
DOMAIN-SUFFIX,example.com,PROXY
DOMAIN-KEYWORD,media-sample,PROXY
FINAL,DIRECT

In this example, api.example.com matches DIRECT first, img.example.com matches the suffix rule, and requests that match neither condition use FINAL with DIRECT. If you move the first line below the suffix rule, the API exception is overridden. Changing the order alone can change the result; there’s no need to change DNS or connection settings at the same time.

GEOIP and IP-CIDR

GEOIP matches based on the location assigned to the destination IP in the local geolocation database. GEOIP,CN,DIRECT means use DIRECT for destination IPs assigned to CN. The match isn’t based on webpage language, domain suffix or the service provider’s place of registration. A domain can resolve to IP addresses in different locations, so results depend on both the resolved address and the database.

IP-CIDR matches IPv4 network ranges directly. 192.168.0.0/16 covers 192.168.0.0 through 192.168.255.255; 10.20.30.40/32 represents a single IPv4 address. The mask defines an address range—not a port range or a host-count setting.

IP-CIDR,192.168.0.0/16,DIRECT,no-resolve
IP-CIDR,10.20.30.40/32,DIRECT,no-resolve
GEOIP,CN,DIRECT
FINAL,PROXY

• Connecting directly to an IP: When accessing 192.168.1.20, the destination address is known, so a network rule can match it. Whether the connection uses port 80 or 443 doesn’t change the range covered by that rule.
• Connecting by domain: IP rules may require domain resolution. no-resolve means the rule won’t trigger domain resolution for its own matching; it doesn’t block all DNS or prevent a match when the IP is already known.
• IPv6 requests: An IPv4 IP-CIDR rule can’t cover an IPv6 address. When troubleshooting, record the actual address family; a correct IPv4 range doesn’t mean every request will match.
• Local network exceptions: If global proxying affects access to local devices, put specific local network rules before broader policies. Include only the ranges your network actually needs.

Don’t assume GEOIP will match just because a website is associated with a particular region. A content delivery network may return different destination IPs for the same domain, and apps may use cached addresses. Check the destination IP for a new request before deciding whether the geolocation rule is working as expected.

FINAL and rule order

FINAL is the fallback when no earlier rule matches; it isn’t a retry switch for failed connections. If an earlier rule selects PROXY and that outbound connection times out, the request won’t automatically skip it and use DIRECT via FINAL. Fix the selected outbound connection or rule instead of adding another rule at the end.

[Rule]
DOMAIN,api.example.com,DIRECT
DOMAIN-SUFFIX,example.com,PROXY
DOMAIN-KEYWORD,media-sample,PROXY
IP-CIDR,192.168.0.0/16,DIRECT,no-resolve
GEOIP,CN,DIRECT
FINAL,PROXY

1. Put specific exceptions first. Place a single-domain API rule before a suffix rule for the same site so the exception can match.
2. Then add domain ranges. Decide how known sites should be routed before handling IP ranges. This can prevent changes in geolocation results from affecting explicitly configured sites.
3. Order address rules carefully. Local network ranges and GEOIP rules also depend on order. If their ranges overlap, put the condition you want to take precedence first.
4. Keep the fallback last. Put FINAL at the end. Choose DIRECT or PROXY based on how you want to handle uncategorized requests, not simply by copying someone else’s setup.

Troubleshoot routing by symptom

Change one thing at a time and make a new request to the same destination. When connection records or logs are available, note the destination domain, actual IP, matched rule and final policy. If the logs show only some of these details, use what’s available to narrow down the cause. Don’t assume a page failing to load means the rule is wrong.

The English messages above describe network errors; their exact wording depends on the log source. If there’s no error but traffic takes a different route than expected, first check whether Global Routing is still set to Proxy or Direct. Then confirm that you edited the active Config, and review the Rule entries from the top to find an earlier match.

Review each item before saving

A reliable routing setup should answer three questions: What does each rule match? Why is it in this position? Which policy applies when it matches? Start with a small set of clear rules and expand gradually; it’s easier to troubleshoot than a large batch of unexplained keywords. This site covers client configuration only and does not provide, sell or recommend nodes or subscription services.

• Use the correct English syntax for rule types, commas and policy names. Domain fields must not include a protocol, path or port.
• Put DOMAIN exceptions before any DOMAIN-SUFFIX or DOMAIN-KEYWORD rule that would cover them.
• Check the address family and range in IP-CIDR. Understand that no-resolve does not replace DNS configuration.
• Put FINAL last, and decide whether uncategorized requests should use DIRECT or PROXY.
• Make sure the edited Config is active, Global Routing is set to Config, and the result has been checked with a new connection.