Configure Shadowrocket Rules for Split Routing and Domain Blocking (2026)
Shadowrocket uses its selected routing mode and configuration to determine which requests are proxied, direct, or rejected. This guide imports lazy_group.conf for split routing and policy groups. The checked file does not enable advertising-blocking rules; separate upstream variants provide that feature.
Rules can reduce unnecessary detours and inconsistent exit locations. They do not guarantee that a social-media account will never be restricted, that every ad will disappear, or that a streaming platform will accept the chosen IP.
Prerequisites
First install and configure at least one working node with the Shadowrocket beginner guide.
The shared U.S. Apple ID page and Asspp guide explain two ways to access apps in another App Store region, with their security limitations.
What split-routing rules do
In Config routing mode, the active configuration assigns requests to policies. Proxy mode uses the selected node for supported traffic, while Direct mode does not use a proxy node. Not importing an additional file alone does not establish a traffic leak or explain an account restriction.
A rule configuration can assign:
- matched local traffic → direct connection;
- matched external services → a proxy or policy group;
- matched blocking rules → rejection, only when such rules are actually included.
Direct routing may reduce detours and proxy data use. Results depend on the network and matched policy, and routing rules do not guarantee account safety.
Matching behavior
Rule order and type affect the result: specific rules select a policy, and FINAL handles requests that match no earlier rule. Modules and domain/IP rules have additional precedence rules; inspect the matched-rule log when troubleshooting.
The checked lazy profile includes common service lists and GEOIP,CN,DIRECT, then ends with FINAL,PROXY. Unmatched requests therefore default to the proxy, not the direct-by-default blacklist behavior. Policy-group selections also affect the actual route.
On 2026-10-09, we reviewed the upstream configuration snapshot and all 34 enabled remote rule sets. None contained advertising-blocking rejection rules. This was a source review, not an iPhone performance, ad-blocking, or account-risk test. Remote files can change after publication.
Rule source used in this guide
Shadowrocket-ADBlock-Rules-Forever, maintained by Johnshall, publishes several profiles with different purposes. Features of one file do not apply to every variant.
| Feature | Description |
|---|---|
| Several profiles | Separate blacklist, whitelist, ad-blocking, and lazy configurations |
| Regular builds | The README describes daily publication at 8 a.m. Beijing time; verify successful updates |
| Lazy profile with policy groups | Routes common services and defaults unmatched requests to the proxy |
| Separate ad-blocking variants | The checked lazy_group.conf does not enable ad blocking; use an explicitly labeled variant if needed |
Repository: https://github.com/Johnshall/Shadowrocket-ADBlock-Rules-Forever
The reviewed README also warns that filtering cannot remove every ad, particularly video ads.
Import the rules in three steps
Before importing
Confirm that Shadowrocket is installed and at least one node works. Use the Shadowrocket guide or the proxy-service guide if needed.
Step 1: copy the configuration URL
For common-service routing and policy groups, this guide uses the “lazy” configuration. Export or copy your current configuration before changing it so you can switch back:
https://johnshall.github.io/Shadowrocket-ADBlock-Rules-Forever/lazy_group.confReview the upstream file and repository before importing it because a remote configuration can change after this article is published.
Step 2: import it into Shadowrocket
- Open Shadowrocket and select Config in the second bottom tab.
- Select + in the upper-right corner.
- Paste the URL.
- Select Download and wait for the file to appear.
Step 3: activate the configuration
Select Use Configuration for the downloaded file and confirm its check mark. On the home screen set Global Routing → Config, check that the policy groups have usable nodes selected, then disconnect and reconnect.
Test a local service and an external service, and inspect the matched rules and policies in the logs. A check mark alone is not verification. Switch back to the saved configuration if the new one behaves unexpectedly.
The project also publishes a QR-code import page:
https://johnshall.github.io/Shadowrocket-ADBlock-Rules-Forever/
Update configurations separately from node subscriptions
The configuration file, its remote rule sets, and the provider’s node subscription are different update targets. An upstream rebuild does not prove that your phone has refreshed its copy.
The configuration maintainer’s update guide distinguishes Config automatic background updates from Subscription updates for server nodes. Find the configuration update options in your installed app version; enabling node-subscription updates alone does not establish that the rule configuration is current.
Background updates depend on iOS background refresh and the app’s running state, so exact timing is not guaranteed. Back up local changes first: updating a remote configuration can overwrite them. Update Configuration replaces the file from its remote source; Use Configuration / Compile Configuration can refresh referenced rule sets without replacing the configuration itself. Check update results and matched-rule logs afterward.
What may change after configuration
There is no fixed speed gain or data-saving percentage for every user:
| Item | Possible effect | How to verify |
|---|---|---|
| Local sites | Direct routing may reduce detours | Compare under the same network and check the matched policy |
| Provider data | Direct traffic does not consume proxy data | Compare app and provider usage records |
| In-app ads | The checked lazy profile has no enabled advertising-blocking rules | If using a separate ad-blocking variant, check each app and watch for false positives |
Blocking depends on the actual rules and how apps deliver ads. Rejection is not necessarily DNS-stage blocking and cannot guarantee that launch, feed, or video ads disappear.
Blacklist, whitelist, or lazy profile?
| Variant | Default behavior | Typical use |
|---|---|---|
| Blacklist | Direct by default; listed restricted sites use the proxy | Mostly local browsing with occasional external access |
| Whitelist | Proxy by default; listed local sites connect directly | Mostly external services |
| Lazy profile with policy groups | Common-service routing with FINAL,PROXY; no enabled ad-blocking rules in the checked file | Per-service node selection |
| Explicit ad-blocking variants | Add filtering to the selected routing scheme; inspect the actual file | Ad filtering with checks for false positives |
Choose the default route first, then decide whether you need a separate ad-blocking variant. Advanced users can add specific rules when a service is not handled correctly, keeping a backup before remote updates.
Four additional practices
1. Check the global routing mode
Under Global Routing, Proxy mode can send local services through the selected node, which may add a detour. Use Config for this guide's split routing. If you temporarily change modes to troubleshoot, check that you have restored the intended mode afterward.
2. Avoid unnecessary node changes
Changing among several countries in a short period gives remote services a rapidly changing IP location. Choose a stable, suitable node and switch only when necessary. Node stability still depends on the provider; see the 2026 proxy-service guide.
3. Confirm that updates still work
Periodically inspect configuration and rule-set update results. If they are stale, check the remote URL and download status. Back up local changes before replacing a remote configuration; a manual refresh does not solve every routing problem.
4. Use new accounts normally
New social accounts can be subject to additional platform review. Rapid posting or bulk-following can trigger limits regardless of the proxy configuration. Routing rules are not a way to bypass a platform's usage policies.
Five-action quick version
- Copy the configuration URL.
- Open Shadowrocket and paste it under Config.
- Select Download.
- Activate the new configuration and set Global Routing to Config.
- Disconnect and reconnect.
Summary
Connecting a node is only the first step. A suitable Shadowrocket configuration determines which traffic is proxied, direct, or rejected.
Use the steps above as a starting point, then inspect the actual matched rule whenever a site behaves incorrectly. Treat third-party lists as changeable dependencies rather than permanent guarantees.