Shadowrocket's real power is that it's not a simple on/off switch — it's a programmable traffic engine. Configured well, it auto-decides: domestic traffic direct, overseas traffic through your proxy, ad traffic blocked — all seamlessly.
1. Subscribe to ready-made smart rule sets (easiest)
Don't hand-write thousands of domains. Mature open-source rule sets handle smart routing plus ad-blocking:
- 神机 (lhie1) — fine-grained routing and ad-blocking.
- 墨鱼 (blackmatrix7) — maintained per app (WeChat, Bilibili, Netflix).
How: copy the rule set's .conf link → Shadowrocket → bottom "Config" → top-right "+" → paste and download → tap the config → "Use Config".
2. Write custom [Rule] smart routing
Shadowrocket matches top-down and stops on the first hit, so put ad-blocking and exact domains at the top. Syntax: REJECT (block), DIRECT (direct), PROXY (via proxy).
[Rule]
# block ads (suffix match, includes subdomains)
DOMAIN-SUFFIX,doubleclick.net,REJECT
# block ads (keyword match)
DOMAIN-KEYWORD,adservice,REJECT
# route overseas services through proxy
DOMAIN-SUFFIX,netflix.com,PROXY
DOMAIN-SUFFIX,github.com,PROXY
# LAN direct
IP-CIDR,192.168.0.0/16,DIRECT
# China IPs direct (GeoIP, highly recommended)
GEOIP,CN,DIRECT
# fallback: everything else via proxy
FINAL,PROXYTip: use REJECT-DROP instead of REJECT to save battery and data.
3. Advanced ad-blocking with Modules
Plain domain REJECT blocks whole hosts and can leave pages broken. For smart cleanup — skipping app splash ads (Zhihu, Weibo, Xiaohongshu), trimming YouTube ads — use MitM (decryption) + URL rewrite via modules.
How: search GitHub for "Shadowrocket module adblock" to find a .sgmodule link → Shadowrocket → bottom "Modules" → "+" → paste the link → enable. You must turn on MitM and install/trust Shadowrocket's CA certificate, otherwise it cannot decrypt HTTPS ads.
4. System settings
- Global Routing: set to Config (choosing Proxy routes everything through the proxy; Direct routes nothing — either way your rules won't apply).
- Enable GeoIP auto-update so the China-IP database stays current and domestic sites aren't routed through the proxy.
- Enable DNS override / local DNS mapping to prevent DNS pollution from breaking your rules.
5. The prerequisite: a stable subscription
All of the above assumes Shadowrocket has a working subscription (nodes). The client only decides "how to route"; the subscription is what carries the traffic. No stable subscription means even the finest rules run on nothing.
If you don't have a reliable subscription yet, SSRocket provides a mainland-reachable subscription link plus one-tap import: after payment your config is emailed automatically — one tap imports it into Shadowrocket / Clash, and with the rules above you're ready out of the box, with no manual node hunting.
FAQ
- Global Routing — Config or Proxy? Config, otherwise routing and ad-blocking won't apply.
- Pages blank after ad-blocking? Plain REJECT blocked the whole host — use a MitM module for precise cleanup.
- Domestic sites routed through the proxy? Enable GeoIP auto-update and make sure
GEOIP,CN,DIRECTis in your rules.