Shadowrocket Config File Explained: General, Rule, Host, and URL Rewrite

First, distinguish .conf files, subscriptions, and the active connection

.conf is a text-based configuration file. Section headers in square brackets mark where each section begins, and the lines below belong to that section. [General] primarily uses key-value pairs, while [Rule] uses comma-separated rules; the same syntax does not apply to every section. A standalone line beginning with # can be used as a comment. Keep notes on separate lines to avoid mixing them into parameter values.

Home is where you connect, choose a server, and check Global Routing. Config is where you manage and select configuration files; Settings contains app preferences. A subscription typically maintains the server list, so an updated server entry does not mean the active rule file was also replaced. A configuration file may also reference remote resources, so check where those resources come from and how they update.

Before editing in Config, save a copy of the original file and note the server selected in Home and the current Global Routing setting. Saving a file does not make it active, and selecting a config does not guarantee all traffic will follow its routing rules. When troubleshooting, check the file contents, the active config, and the routing mode separately.

[General]: Global settings use key-value pairs

[General] sets parameters that affect the configuration as a whole. This example shows the key = value format for using system DNS, disabling IPv6, and bypassing system traffic. It demonstrates syntax only; these settings are not suitable for every network.

[General]
# Use the DNS provided by the system
dns-server = system

# Enable or disable IPv6
ipv6 = false

# Allow system-related traffic to bypass the proxy
bypass-system = true

• dns-server = system: Uses the DNS provided by the system. The available DNS environment may change when you switch Wi-Fi networks, so the results are not necessarily the same on both networks.
• ipv6 = false: Controls IPv6 behavior for this configuration; it does not disable IPv6 on your router or the entire device. If your connection relies on IPv6, check the server address and current network before changing this setting.
• bypass-system = true: Controls how system traffic is bypassed. It is not a rule that sets a particular website to DIRECT; check [Rule] for website routing.

Don’t define the same key more than once with conflicting values. When combining two configs, compare existing keys and decide which value to keep instead of appending the whole section. For DNS issues, distinguish between a server hostname that won’t resolve and a destination website hostname that won’t resolve; these affect different parts of the connection.

[Rule]: Match rules in order, with specific conditions first

[Rule] determines which policy a request matches. A common format is rule type,match value,policy; FINAL has no match value, so write the target policy directly after it. Rules are checked in order. Once a request matches an earlier rule, a broader rule later in the list won’t reassign it.

[Rule]
# Match example.com and its subdomains
DOMAIN-SUFFIX,example.com,PROXY

# Documentation-only example range, not a real service address
IP-CIDR,192.0.2.0/24,DIRECT,no-resolve

# Match based on the destination IP's geolocation database result
GEOIP,CN,DIRECT

# Used when no earlier rule matches
FINAL,PROXY

PROXY means the proxy policy and still requires a working proxy endpoint; DIRECT means a direct connection. If you use a custom policy group, the rule must refer to an existing name. Check spelling, spaces, and capitalization. Adding a nonexistent group name to a rule does not create an endpoint.

To test this section, go to Home → Global Routing, select Config, and confirm Config is using the file you just edited. Proxy applies proxy routing globally; Direct applies direct routing globally. Scene follows its configured behavior and is not simply another name for Config. To test individual rules, first rule out interference from a global mode or scene switch.

[Host]: Change hostname mappings, not the connection route

[Host] maps a hostname to an address. This example maps a fully qualified hostname to a documentation-only address, using the format hostname = IP address. No website is hosted at this address, so a failed request after copying the example is expected. It says nothing about whether a real server is available.

[Host]
# Format example only
portal.example.com = 192.0.2.10
api.example.com = 198.51.100.20

A Host mapping is neither an HTTP redirect nor a DOMAIN-SUFFIX rule. The browser’s address bar can still show the original domain, and the HTTPS certificate must still match the requested hostname. If you point a domain to a server without a certificate for that domain, the connection may succeed but still fail with a certificate error. Don’t hide a mapping problem by ignoring certificate errors.

To verify the mapping, make a new request using the full hostname. An existing connection may keep using its old connection, so don’t rely only on whether the page is still open. If removing the mapping restores normal behavior, check the destination address, server listener, and certificate instead of adding broader DIRECT rules. Whether a remote proxy resolves the hostname again depends on the connection method; a local mapping does not necessarily control all remote DNS resolution.

[URL Rewrite]: Match a URL and apply a rewrite action

[URL Rewrite] handles URL matching and actions; it does not use the comma-separated format of [Rule]. This example temporarily redirects an HTTP URL to HTTPS. The 302 in the action is a redirect status code, not a server port.

[URL Rewrite]
^http://example\.com/(.*)$ url 302 https://example.com/$1

1. ^ matches from the start of the URL, preventing the pattern from unexpectedly matching partway through the address.
2. In example\.com, the backslash makes the dot a literal character rather than a wildcard in the regular expression.
3. (.*) captures everything after the domain, and $1 in the destination refers to that captured text.
4. url 302 specifies a URL redirect action. The resulting request still needs to resolve, route, and connect normally.

A rewrite cannot add capabilities the server doesn’t have. The destination site must support HTTPS, and its certificate must be valid. If the destination redirects back to the original URL, it may create a redirect loop. Start testing with a rule for one exact domain; don’t apply a broad regular expression to every HTTP URL from the outset.

How to verify changes and troubleshoot common issues

All four sections can coexist in one file, but they do not work as a simple four-step pipeline. General affects overall behavior, Rule matches policies, Host maps hostnames, and URL Rewrite handles visible request URLs. Troubleshoot based on what is actually happening; don’t assume the last section overrides every setting above it.

1. Save a copy in Config, select that file, and make sure you haven’t selected a different config with the same name.
2. Return to Home, confirm the server is available, then set Global Routing to Config to test rule-based routing.
3. Make a new request to the target. Note the destination hostname, expected policy, actual connection result, and any error message. Check the relevant request logs if needed.
4. Undo the single change you just made and test again. Continue combining settings only after the change and rollback consistently produce different results.

Keep only settings that have a clear purpose and a verifiable result. Before combining remote rules, check what they match, which policy they use, and whether updates will overwrite local content. For more syntax details, see the rule reference; for first-time connection steps, see the setup guide.