Rule-based routing

Rules decide whether each request goes DIRECT (no node) or PROXY (the current node). You can write them, or import a rule subscription. Beginners can stay on rule mode plus a ready-made list. You do not have to type from line one.

Why split traffic

If everything is proxied, messaging, banking, and video apps that should stay local also take the long hop: slower, more captchas. Rules keep “no proxy needed” on direct, and send only the hostnames that need it to a node.

That is the main difference from a one-tap global VPN. Product positioning: About. The switch and latency tests: Tutorial.

How matching works

Rules are read top to bottom. The first hit wins. Put more specific lines first, and the fallback last.

Three common policies: DIRECT skips the node; PROXY goes to the selected server; REJECT drops the request. Do not sprinkle REJECT on everyday domains or it looks like “it will not open,” which is not a node problem.

Common keywords

TypeMeaningExample
DOMAIN Exact hostname match DOMAIN,www.example.com,PROXY
DOMAIN-SUFFIX Suffix match, including subdomains DOMAIN-SUFFIX,google.com,PROXY
DOMAIN-KEYWORD The hostname contains this string DOMAIN-KEYWORD,github,PROXY
IP-CIDR By IP range IP-CIDR,172.16.0.0/12,DIRECT
GEOIP By geo database. CN is a common example (Chinese IPs stay direct); use another country code if you want a different local split GEOIP,CN,DIRECT
FINAL Fallback when nothing above matched FINAL,PROXY

Some versions can also split by app: always direct or always proxy for a given app. The rule file lives on the device, like nodes.

Example

This is not a default config. It only shows matching order. In this sample, Apple and Chinese IPs stay direct, Google / GitHub go to the proxy, and everything else is proxied too. If that is not how you browse, change the country code and FINAL.

DOMAIN-SUFFIX,apple.com,DIRECT
DOMAIN-SUFFIX,icloud.com,DIRECT
DOMAIN-SUFFIX,google.com,PROXY
DOMAIN-KEYWORD,github,PROXY
GEOIP,CN,DIRECT
FINAL,PROXY

Put GEOIP,CN,DIRECT before FINAL so Chinese IPs are not swallowed by the fallback proxy. If a site outside China is misclassified as direct, put a more specific DOMAIN-SUFFIX above GEOIP. Swap CN for another country if you want that country’s IPs to stay local.

You can also import a rule subscription and let someone else maintain the list. Vet the source yourself. A rule subscription is not a node subscription. Do not paste it in the wrong field.

Versus global mode

The home screen usually has Config / rules, Proxy / global, Direct. Use rules day to day. For troubleshooting, turn global on: if global loads and rules do not, the rule misclassified the site. Come back and edit the lines on this page. Do not change nodes first.

If global also fails, follow troubleshooting for the node, the clock, and VPN permission.