Rules Explained

Rules (rules) are the routing core of a Clash config: every connection is matched top-down, stops at the first hit, and falls back to the final catch-all if nothing matches. Proxy groups are covered in Proxy Groups.

Syntax

Each rule follows this format:

TYPE,ARGUMENT,POLICY(,no-resolve)

• TYPE: the rule type
• ARGUMENT: what to match (domain, IP range, etc.)
• POLICY: where matched traffic goes—a proxy group, a node, DIRECT, or REJECT
• no-resolve (optional): for IP-based rules, skip DNS resolution to avoid unnecessary lookups

Common Rule Types

Type	Meaning	Example
DOMAIN	Exact domain match	DOMAIN,www.google.com,Proxy
DOMAIN-SUFFIX	Matches the suffix (including subdomains)	DOMAIN-SUFFIX,github.com,Proxy
DOMAIN-KEYWORD	Hits if the domain contains the keyword	DOMAIN-KEYWORD,google,Proxy
IP-CIDR / IP-CIDR6	Matches the destination IP range	IP-CIDR,192.168.0.0/16,DIRECT
GEOIP	Matches by IP geolocation	GEOIP,CN,DIRECT
DST-PORT	Matches the destination port	DST-PORT,80,DIRECT
PROCESS-NAME	Matches the originating process name (mode-dependent)	PROCESS-NAME,ssh.exe,Proxy
MATCH	Catch-all; must be the last line	MATCH,Proxy

A Healthy Rule Order

A typical config looks like this (top to bottom):

rules:
  # 1. LAN goes direct
  - IP-CIDR,192.168.0.0/16,DIRECT,no-resolve
  - DOMAIN-SUFFIX,local,DIRECT
  # 2. Reject ad domains
  - DOMAIN-KEYWORD,doubleclick,REJECT
  # 3. Domains that need the proxy
  - DOMAIN-SUFFIX,google.com,Proxy
  - DOMAIN-SUFFIX,github.com,Proxy
  # 4. Domestic domains and IPs go direct
  - DOMAIN-SUFFIX,cn,DIRECT
  - GEOIP,CN,DIRECT
  # 5. Catch-all: everything else proxied
  - MATCH,Proxy

Key points: exact domains first, GEOIP direct fallback near the end, and MATCH always last.

Adding Custom Rules

Subscription updates overwrite the whole config file, so custom rules cannot be written directly into the rules section (they get wiped). The right approaches:

1. Insert before the subscription rules: use config preprocessing (Settings → Profile Mixin in Clash for Windows) to prepend your entries—top of the list means highest priority
2. Use a separate override: the mihomo kernel supports override or rule-providers referencing local rule sets, which survive subscription updates

Common examples—force a site to go direct:

- DOMAIN-SUFFIX,example.com,DIRECT

Force a domain through the proxy (must come before GEOIP,CN to take effect):

- DOMAIN-SUFFIX,example.org,Proxy

Reload the profile on the Profiles page after editing. If changes don't take effect, check the update logic following the subscription import troubleshooting steps.