Yo, I feel your pain. Shadowrocket rules can be a headache at first. What I do is use a mix of "DOMAIN" and "IP-CIDR" rules to cover most cases.
For exceptions, I just add them manually under "DIRECT" or "REJECT." It’s not the most efficient, but it works.
For exceptions, I just add them manually under "DIRECT" or "REJECT." It’s not the most efficient, but it works.