Shadowrocket Rules Explained: What DOMAIN, GEOIP, IP-CIDR and FINAL Match

The three-part structure of a rule

The Shadowrocket rule list is plain text stored in the configuration file, one rule per line. Each line is split by an ASCII comma into three parts: type (TYPE), value (VALUE) and policy (POLICY). The type decides what is compared, the value decides what it is compared against, and the policy decides what happens once the rule matches.

There are only three policies: PROXY sends the connection through the currently selected server, DIRECT connects directly, and REJECT drops the connection. A whole line starting with # is a comment and is skipped when parsing; blank lines are ignored as well. The commas in a rule must be ASCII commas — a full-width comma invalidates the entire line.

# Format per line: type / value / policy
DOMAIN-SUFFIX,example.com,PROXY
DOMAIN-KEYWORD,analytics,DIRECT
IP-CIDR,192.168.0.0/16,DIRECT,no-resolve
FINAL,DIRECT

Of the three parts, the value is where mistakes happen most: for domain rules the value is a hostname, for IP rules it is a CIDR block or a two-letter country/region code, and for port rules it is a number. A malformed line raises no error — it is silently skipped. So when a rule seems to have no effect, check the commas and the value format on that line first, before suspecting anything else.

Domain rules: DOMAIN, DOMAIN-SUFFIX, DOMAIN-KEYWORD

Domain rules match the hostname in the request. For HTTPS requests the hostname usually comes from the SNI in the TLS handshake, and for HTTP requests from the Host header. Both are available as soon as the connection is established, with no need to wait for DNS resolution, so domain rules are evaluated fastest and are least affected by changes in resolution results. The three common forms get progressively broader:

The broader the match, the higher the chance of catching something you did not intend. DOMAIN-KEYWORD,analytics,DIRECT matches any request whose hostname contains analytics anywhere, including sites you never meant to send direct; DOMAIN-SUFFIX,example.com,PROXY will also push mail.example.com and static.example.com through the proxy. Before writing a broad rule, confirm that no subdomain under that suffix needs to be treated differently.

When choosing a form, work through this order:

• If only a single hostname needs special treatment, use DOMAIN — exact down to the letter;
• If a site and all of its subdomains should be handled together, use DOMAIN-SUFFIX;
• Only for CDNs or analytics services whose prefixes are random and whose domain structure is unpredictable should you consider DOMAIN-KEYWORD;
• If there are so many domains of the same kind that the main list becomes unwieldy, put them in a separate text file and reference it with DOMAIN-SET.

DOMAIN,www.example.com,DIRECT
DOMAIN-SUFFIX,example.com,PROXY
DOMAIN-KEYWORD,adservice,REJECT
DOMAIN-SET,example-domains.txt,DIRECT

IP rules: GEOIP and IP-CIDR compare the resolved address

IP rules ignore the domain name and look only at the IP address of the connection target. Getting that IP requires a DNS lookup first, so IP rules take effect one step later than domain rules — and they lose the domain dimension: when the same domain resolves to different addresses, the result can change with it.

GEOIP summarises where an address belongs with a two-letter country/region code; GEOIP,CN,DIRECT means that if the target IP is in China, connect directly. IP-CIDR takes an exact network block; the usual way to keep local networks direct is IP-CIDR,192.168.0.0/16,DIRECT and IP-CIDR,10.0.0.0/8,DIRECT; for IPv6 targets use IP-CIDR6. Port-based decisions are handled by DST-PORT and SRC-PORT — for example DST-PORT,443,PROXY sends connections whose destination port is 443 through the proxy.

GEOIP,CN,DIRECT
IP-CIDR,192.168.0.0/16,DIRECT,no-resolve
IP-CIDR,10.0.0.0/8,DIRECT,no-resolve
IP-CIDR6,fc00::/7,DIRECT,no-resolve
DST-PORT,443,PROXY

Rules for local network ranges usually need a trailing no-resolve: it tells the app not to trigger a DNS lookup just to obtain an IP when matching this rule. Without it, a request that could have matched immediately is forced through a resolution first, which slows the decision down and may fail if the lookup fails.

Match order: top to bottom, first match wins

Shadowrocket compares the rule list line by line from the top; as soon as a line matches, its policy is applied and the remaining rules are not evaluated. This is what drives the ordering principle: the more specific a rule and the higher its priority, the higher it should sit; the broader the rule, the lower.

FINAL is a catch-all rule that has only a policy and no value to match; it handles every request the rules above did not match: FINAL,DIRECT sends unmatched traffic direct, FINAL,PROXY sends it through the proxy. It must be the last line in the list — rules written after FINAL are never executed.

# 1. Local and reserved addresses go direct first
IP-CIDR,192.168.0.0/16,DIRECT,no-resolve
# 2. Domains you explicitly want to block
DOMAIN-SUFFIX,ads.example.com,REJECT
# 3. Domains you explicitly want proxied
DOMAIN-SUFFIX,example.com,PROXY
# 4. Mainland China addresses go direct
GEOIP,CN,DIRECT
# 5. Catch-all
FINAL,PROXY

When ordering, you can stack five layers from top to bottom:

• Layer 1: local and reserved network ranges, such as IP-CIDR,192.168.0.0/16,DIRECT,no-resolve, at the very top;
• Layer 2: domains you explicitly want dropped — REJECT must come before PROXY for the same domain, or the block never gets a chance to apply;
• Layer 3: domains you explicitly want proxied or sent direct, with DOMAIN above DOMAIN-SUFFIX;
• Layer 4: GEOIP for address origin and DST-PORT for port-based decisions;
• Layer 5: FINAL, the catch-all, kept as the last line.

Making rules take effect: Global Routing and the configuration file

The rule list is only evaluated when Global Routing is set to Config. You switch modes in Settings → Global Routing; the three common options differ as follows:

The other prerequisite is editing the right file. The Config tab can hold several configurations at once, and only the currently selected one (with a checkmark) is used. To edit, go to Config → select the configuration in use → Rules; the list shows one rule per line, the + button in the top right adds a line, and tapping any line lets you change its type, value and policy. The full flow is:

1. Confirm the mode

   In Settings → Global Routing, choose Config; otherwise the rule list is not evaluated.

2. Open Config

   Switch to the Config tab at the bottom and confirm the checkmark is on the configuration file you are actually using.

3. Open Rules

   Tap into the configuration file and find the Rules row — that is the full rule list.

4. Add a new line

   Use the + button in the top right to add a rule, filling in the three parts type, value and policy, with ASCII commas.

5. Reorder

   Move specific rules above broad ones and keep FINAL as the last line.

6. Save and reconnect

   After saving, go back to Home, disconnect and connect again so the new rule list takes effect.

Four common questions

These four questions cover the most common rule-related reports, and the troubleshooting path always works down through mode → configuration file → rule order → rule syntax.