When a Shadowrocket exception does nothing, look at the first rule that matched, not at a different pop. DOMAIN-SUFFIX exceptions belong above GEOIP and FINAL; under FINAL,PROXY they do not exist. GEOIP,CN will not Direct your 10/8 file server. PROCESS-NAME barely fires on iOS. Confirm the hit in the connection log, then change that one line.
Toggling Proxy / Direct / global is already in rules and groups. This page is “this class of traffic picked the wrong egress.” Import: subscribe. App channel: download.
First match wins; there is no union of every line you typed
Shadowrocket walks the file from the top and stops. People put GEOIP,CN,DIRECT first, then append DOMAIN-SUFFIX,office.com,PROXY, and wonder why Outlook never leaves the country. If the A record is GEOIP-classified first, the exception never runs. Order: exact hosts → suffixes → RFC1918 CIDRs → GEOIP → FINAL.
Remote RULE-SET blobs insert their own order, which you cannot see. A provider refresh can steal your host with a fatter DOMAIN-KEYWORD. Keep local exceptions above every RULE-SET. A failed set refresh is subscription update, not this article—do not mix the two edits.
| You expected | What actually hit | Fix |
|---|---|---|
| A suffix at the bottom | GEOIP or KEYWORD above | Move the exception up |
| GEOIP,CN for OA | Private IP, not CN | IP-CIDR Direct |
| PROCESS-NAME,Slack | No process on iOS | Suffix instead |
| DOMAIN,google.com | www / accounts | SUFFIX or extra hosts |
GEOIP, CDNs, streaming exceptions without burning the domestic list
Streaming unlocks die when the CDN host is GEOIP,CN,DIRECT. Do not delete the whole China list. Lift that platform’s playback, API, and license hosts to PROXY above GEOIP. Platform-specific traps: streaming. This page only insists the exception is earlier than GEOIP.
The inverse: you PROXY a bank and pinning dies in the tunnel. Banks, tax portals, and corporate IdP hosts want DOMAIN-SUFFIX,DIRECT, also above the wide rules. FINAL,PROXY is not a personality.
Fake-IP DNS makes GEOIP look at synthetic addresses, so country math goes feral. See DoH and Fake-IP. While you debug exceptions, switch to real-IP briefly, then switch back—one variable at a time.
Desktop ports of the same file: PROCESS-NAME and DST-PORT
PROCESS-NAME starts to matter when you carry the profile to Android or Windows. On iPhone it is a silent no-op, so you believe “WeChat is Direct” until you look at the log. Field mapping: cross-platform. Directing Telegram.exe while the browser stays Proxy is a desktop luxury; on iPhone you go back to domains.
DST-PORT,22,DIRECT keeps Git SSH off the pop and also lets you forget 443 is still Proxied. FINAL,PROXY still catches every port you did not mention.
Prove one hostname, then stop stacking KEYWORD lines
Clear the request log, fail once, read the rule name and the group name. If you also poke URL Test, you will not know which lever worked. Latency probes: URL Test.
Five KEYWORD lines later and the log still says FINAL: stop. Export the profile and diff it—backup—instead of scrolling a thousand lines on a phone. Download / region: download. Questions: FAQ, guides. HTTPS decryption is not a daily way to “see” rules; the boundary is decrypt risk.
When the exception works, copy rule name + host + policy into a note. Next provider RULE-SET push, check that your local lines are still on top before you blame an expired plan.