Advanced Config 14-minute read

Practical Clash Rule Routing: Rules and Proxy Group Design for Direct Connections in Mainland China and Proxies Abroad

Learn Clash rule matching with DOMAIN-SUFFIX, GEOIP, and RULE-SET, including practical routing for mainland China, overseas proxies, ad blocking, and troubleshooting.

Understand the rule-routing execution model first

Clash and Clash Meta (mihomo) evaluate rules from top to bottom in list order. Once a connection matches the first applicable rule, subsequent rules are skipped. The result therefore depends not only on which rules you write, but also on where each rule appears.

A typical setup for direct connections in mainland China and proxies abroad can follow the order “specific exceptions first, broad rules later”: handle the LAN and domains that must bypass the proxy first, then rejection rules and explicitly proxied domains, followed by mainland-China domains and IP addresses, and finally use MATCH to catch anything unmatched.

rules:
  - DOMAIN,router.asus.com,DIRECT
  - DOMAIN-SUFFIX,qq.com,DIRECT
  - DOMAIN-SUFFIX,bilibili.com,DIRECT
  - DOMAIN-SUFFIX,github.com,Proxy Abroad
  - GEOIP,CN,DIRECT
  - MATCH,Proxy Abroad

A request to www.qq.com matches DOMAIN-SUFFIX,qq.com,DIRECT; a request to GitHub goes to the “Proxy Abroad” group; other connections resolving to mainland China IP addresses are handled by GEOIP,CN,DIRECT; all remaining traffic ultimately goes to “Proxy Abroad.”

What the three action types mean

  • DIRECT: The connection is sent from the local machine or current gateway without passing through a proxy node.
  • REJECT: The core blocks the connection. Use it for confirmed ad domains, tracking domains, or destinations that should not be accessed.
  • Proxy group name: Send the connection to a designated group, such as “Proxy Abroad,” “Auto Select,” or “Failover.” The group then chooses the specific node.

The third field of a rule must exactly match the proxy group name, including Chinese characters, spaces, and capitalization. If a rule uses Proxy Abroad while the actual name in proxy-groups is Overseas Nodes, the core will typically report that the proxy group does not exist.

Choosing between DOMAIN, DOMAIN-SUFFIX, and DOMAIN-KEYWORD

Domain rules are usually easier to understand than IP rules and are better suited to site-level routing. Choose clearly bounded match types whenever possible, and avoid letting a short keyword affect large numbers of unrelated domains.

Rule type Match scope Best use
DOMAIN Match an exact domain only Handle a single API, download host, or internal host
DOMAIN-SUFFIX Match the main domain and its subdomains Handle most services under one site
DOMAIN-KEYWORD Match a specified string anywhere in the domain A few cases with a clear naming pattern that cannot be summarized by a suffix 
rules:
  - DOMAIN,api.example.net,Proxy Abroad
  - DOMAIN-SUFFIX,example.org,Proxy Abroad
  - DOMAIN-KEYWORD,cdnvideo,Proxy Abroad

DOMAIN,api.example.net matches only this exact hostname; it does not automatically match www.example.net. DOMAIN-SUFFIX,example.org matches example.org, www.example.org, and static.example.org. By contrast, the coverage of DOMAIN-KEYWORD is harder to predict, so use it sparingly.

Put specific exceptions before broad suffix rules

If most requests for a site should use a proxy but its download server should connect directly, put the exact-domain exception first, followed by the domain suffix:

rules:
  - DOMAIN,download.example.org,DIRECT
  - DOMAIN-SUFFIX,example.org,Proxy Abroad
  - MATCH,Proxy Abroad

If these two rules are reversed, download.example.org will match the suffix rule first, so the direct-connection exception will never take effect. This is a common reason a rule appears in the configuration but does not actually run after rules are changed.

Use proxy groups for manual selection, latency testing, and failover

rules determine which policy receives the traffic, while proxy-groups determine which node that policy uses. Writing node names directly into many rules can work, but node updates or renames then require changes one rule at a time. A more maintainable approach is to point rules to proxy groups and let those groups manage the nodes.

proxy-groups:
  - name: Proxy Abroad
    type: select
    proxies:
      - Auto Select
      - Failover
      - Hong Kong Node A
      - Singapore Node A
      - DIRECT

  - name: Auto Select
    type: url-test
    proxies:
      - Hong Kong Node A
      - Singapore Node A
      - Japan Node A
    url: https://www.gstatic.com/generate_204
    interval: 300
    tolerance: 50

  - name: Failover
    type: fallback
    proxies:
      - Hong Kong Node A
      - Singapore Node A
      - Japan Node A
    url: https://www.gstatic.com/generate_204
    interval: 300

The difference between select, url-test, and fallback

  • select: The user manually chooses an item in the group. It works well as the main entry point referenced by rules.
  • url-test: Periodically tests the nodes in a group and selects an available option with lower latency. This example tests every 300 seconds; tolerance: 50 reduces unnecessary switching when the latency difference is under 50 milliseconds.
  • fallback: Uses the first available node in list order. It emphasizes a fixed priority order rather than simply pursuing the lowest latency.

The latency-test URL should return a small, stable response. A single test only measures the round-trip time to that endpoint; it does not directly represent video throughput or connection quality across all websites. When choosing a node, also observe connection failure rates, time to first byte, and download speed over 5 to 10 minutes.

Complete rule order for direct connections in mainland China and overseas proxies

Using only GEOIP,CN,DIRECT does not cover every service in mainland China. GEOIP uses the target IP’s region, so it only applies once the connection reaches IP matching. Some sites use cross-border CDNs, global Anycast, or addresses outside mainland China; even when their services target users in mainland China, those addresses may not belong to the CN database. Common mainland-China domain rules should therefore usually appear before GEOIP.

rules:
  # Local network and reserved addresses
  - IP-CIDR,127.0.0.0/8,DIRECT,no-resolve
  - IP-CIDR,10.0.0.0/8,DIRECT,no-resolve
  - IP-CIDR,172.16.0.0/12,DIRECT,no-resolve
  - IP-CIDR,192.168.0.0/16,DIRECT,no-resolve

  # Explicit domain actions
  - DOMAIN-SUFFIX,qq.com,DIRECT
  - DOMAIN-SUFFIX,weixin.qq.com,DIRECT
  - DOMAIN-SUFFIX,bilibili.com,DIRECT
  - DOMAIN-SUFFIX,github.com,Proxy Abroad
  - DOMAIN-SUFFIX,githubusercontent.com,Proxy Abroad

  # IP regions and final fallback
  - GEOIP,CN,DIRECT
  - MATCH,Proxy Abroad

no-resolve tells the core not to trigger an extra domain lookup solely to evaluate this IP rule. It suits connections that already have a destination IP and LAN subnet rules, but it does not replace normal DNS configuration. Requests that depend on domain matching still require the Clash DNS module to return results reliably.

Why LAN rules should come first

Printers, NAS devices, router admin pages, and LAN development services commonly use 10.0.0.0/8, 172.16.0.0/12, or 192.168.0.0/16. If these addresses are sent to a remote proxy by a catch-all rule, connections often time out. TUN mode captures a broader range of system traffic, making explicit DIRECT rules for private addresses even more important.

If a corporate network uses custom subnets, add the actual ranges as well. For example, if office services are on 100.64.20.0/24, add IP-CIDR,100.64.20.0/24,DIRECT,no-resolve. Note that 100.64.0.0/10 is also commonly used for carrier-grade NAT, so do not expand the direct-connection range without understanding the network structure.

RULE-SET: split large rule collections into separate files

When a domain list grows to hundreds or thousands of entries, maintaining it in the main configuration becomes difficult. mihomo can load rule collections through rule-providers, then reference them from rules with RULE-SET. This lets you manage ad blocking, mainland-China domains, proxied domains, and private networks separately.

rule-providers:
  reject-domain:
    type: file
    behavior: domain
    format: yaml
    path: ./ruleset/reject-domain.yaml

  domestic-domain:
    type: file
    behavior: domain
    format: yaml
    path: ./ruleset/domestic-domain.yaml

rules:
  - RULE-SET,reject-domain,REJECT
  - RULE-SET,domestic-domain,DIRECT
  - GEOIP,CN,DIRECT
  - MATCH,Proxy Abroad

A domain-type rule file can use a payload list. The following content illustrates the format; in production, replace it with a reviewed collection of domains:

payload:
  - '+.ads.example.test'
  - '+.tracker.example.test'
  - 'metrics.example.test'

behavior: domain is suitable for domain collections; behavior: ipcidr is for IPv4 and IPv6 ranges; behavior: classical can contain traditional entries with rule types. behavior must match the contents of the rule file. Putting IP ranges in a domain collection can cause loading to fail or prevent matching.

Update strategy for remote rule sets

An HTTP provider generally needs a url, a local cache path, and an update interval interval. For example, interval: 86400 checks for updates every 86,400 seconds. If the rule source is temporarily unavailable, the core will usually continue using the cached file; on first launch, however, loading may fail if no local cache exists.

Ad-blocking rules should come before the mainland-China direct-connection collection; otherwise, a domain present in both collections will match DIRECT first. For login, payment, CAPTCHA, and media playback requests, do not reject solely because the domain contains strings such as ad or track. If page components are missing, first identify the host rejected by REJECT in the connection log, then add a precise allow rule.

rules:
  - DOMAIN,login.example.test,DIRECT
  - RULE-SET,reject-domain,REJECT
  - RULE-SET,domestic-domain,DIRECT
  - GEOIP,CN,DIRECT
  - MATCH,Proxy Abroad

How DNS, TUN mode, and rule results relate

System proxy mode mainly captures applications that follow HTTP or SOCKS proxy settings; TUN mode uses a virtual network interface to capture more TCP and UDP traffic. Both modes can ultimately use the same rules, but their DNS paths and traffic coverage differ.

Is it normal to see reserved addresses in fake-ip mode?

With enhanced-mode: fake-ip enabled, the client may first return a mapped address from the 198.18.0.0/15 range to the application, then have the core apply rules based on the original domain. This does not mean the destination website is actually located in that range. During troubleshooting, inspect the Host, Rule, and Rule Payload in the connection details instead of judging only by the destination IP shown by the application.

dns:
  enable: true
  listen: 0.0.0.0:1053
  enhanced-mode: fake-ip
  fake-ip-range: 198.18.0.1/16
  nameserver:
    - 223.5.5.5
    - 119.29.29.29
  fallback:
    - tls://1.1.1.1:853
    - tls://8.8.8.8:853

The example listens for Clash DNS on port 1053 to avoid directly conflicting with an existing service on local port 53. Specific clients usually manage the listening address and DNS hijacking automatically. Do not modify both the graphical interface and the original subscription file without understanding how the client applies overrides.

LAN access stops working after enabling TUN

First confirm that DIRECT rules for private subnets appear before MATCH, then check TUN route exclusions, strict routing, and DNS hijacking. A common DNS hijacking entry in mihomo is any:53, which sends port-53 queries entering TUN to the core. If AdGuard Home, systemd-resolved, or a corporate VPN DNS is also running locally, avoid having multiple services compete for the same port.

Configuration validation, match checks, and common errors

After making changes, validate the syntax first, then reload the configuration. mihomo 1.19.x can run a configuration test from the command line using the configuration directory; the binary name and directory may vary by installation method:

mihomo -t -d /etc/mihomo

After the test passes, choose “Configuration” → “Reload” in the client, or run the corresponding restart command on the server. Some desktop clients place the configuration directory under “Settings” → “Configuration Directory.” When a subscription configuration is updated, manually edited files may be overwritten. Keep long-term custom rules in the client’s supported override, merge configuration, or separately maintained provider file.

Troubleshooting order when a rule does not match

  1. Find the target domain on the Connections page and record the Rule and policy group that actually matched.
  2. Check whether the target domain goes through a CNAME redirect; the host actually used for the connection may differ from the address shown in the browser’s address bar.
  3. Check whether a broader DOMAIN-SUFFIX, RULE-SET, or GEOIP rule already appears above it in rules.
  4. Confirm that the proxy group name referenced by the rule exactly matches proxy-groups.
  5. Reload the configuration and confirm that the modified configuration file is currently active.
  6. Clear the application’s DNS cache or close existing connections, then make a new request.

A mainland-China website still uses the proxy

First check whether it matched a proxy rule set before GEOIP. If there is no domain rule, check whether the destination IP is identified as CN. Sites using global CDNs may resolve to addresses outside mainland China; add DOMAIN-SUFFIX direct-connection rules for their primary service domains instead of broadening GEOIP or IP-CIDR ranges.

An overseas website sometimes connects directly

Check for an overly broad mainland-China domain collection, keyword rule, or custom direct-connection IP range. Also check whether the browser has its own Secure DNS enabled. When different software handles DNS resolution and connections, the logs may lack the expected domain information. During troubleshooting, temporarily let Clash DNS handle everything, then restore other DNS settings one at a time.

The proxy group has nodes but shows them as unavailable

Test the nodes themselves and the health-check endpoint separately. If every node fails at the same time, the test endpoint may be restricted by the current network rather than all nodes being down. Switch to a stable endpoint with a small response and keep the test interval between 300 and 600 seconds to avoid creating excessive probe connections.

What a maintainable routing configuration should provide

A stable rule configuration is not measured by its number of entries. It maintains a clear priority: private networks and exact exceptions first, rejection collections and service domains next, mainland-China domains and GEOIP for broad classification, and MATCH as the final fallback. Proxy nodes are managed centrally through groups such as select, url-test, and fallback, so rules do not depend directly on frequently changing node names.

For each adjustment, change only one layer and verify the result through the connection log. Changing the DNS mode, enabling TUN, replacing rule sets, and modifying proxy groups all at once makes the source of a problem difficult to isolate. Test in this order—syntax validation, reload, create a new connection, inspect the matched rule—and you can usually determine within minutes whether the issue is rule order, DNS, the node, or the scope of system traffic capture.

Download Clash Client