Clash Rules & Routing Guide: Direct Connections in Mainland China, Overseas Proxying, and Ad Blocking

How rule mode chooses an outbound connection

Clash rule mode checks the rules list from top to bottom. The first matching rule takes effect immediately, and all following rules are skipped. The left side is the match type, the middle is the match target, and the right side is the policy name. A policy can be DIRECT, REJECT, or an existing proxy group such as PROXY, Auto, or 境外节点.

A request can typically be matched by its destination domain, destination IP, destination port, network type, and process information. The available data depends on the inbound method. With HTTP or SOCKS connections through the system proxy, the domain is usually clear; after TUN mode takes over system traffic, whether the domain is retained also depends on the DNS mode, domain sniffing, and how the application connects. As a result, the same rules may produce different matches under the system proxy and TUN.

Four basic outcomes

DOMAIN-SUFFIX, GEOIP, RULE-SET, and MATCH syntax

DOMAIN-SUFFIX: match by domain suffix

DOMAIN-SUFFIX,example.com,PROXY matches example.com itself and its subdomains, such as www.example.com and api.example.com. It is more practical than listing every full domain individually when multiple subdomains belong to the same service, and it is one of the most commonly used manual rule types.

rules:
  - DOMAIN,router.local,DIRECT
  - DOMAIN-SUFFIX,gov.cn,DIRECT
  - DOMAIN-SUFFIX,cn,DIRECT
  - DOMAIN-SUFFIX,example.com,PROXY

DOMAIN matches one exact domain and does not automatically include subdomains. DOMAIN-KEYWORD matches whenever the specified string appears in a domain, giving it broader coverage but also a higher risk of false positives. Use DOMAIN when you need to allow a precise login or update domain; use DOMAIN-SUFFIX when you need to cover an entire site.

GEOIP: match by the destination IP’s geographic region

GEOIP,CN,DIRECT uses the IP geolocation database loaded by the client to determine whether the destination belongs to mainland China. It is useful for domestic requests that connect directly by IP, have no domain name, or are not covered by domain rules. GEOIP depends on the local database; if it is outdated, newly allocated ranges may be sent to the wrong fallback policy.

rules:
  - IP-CIDR,127.0.0.0/8,DIRECT,no-resolve
  - IP-CIDR,10.0.0.0/8,DIRECT,no-resolve
  - IP-CIDR,172.16.0.0/12,DIRECT,no-resolve
  - IP-CIDR,192.168.0.0/16,DIRECT,no-resolve
  - GEOIP,CN,DIRECT
  - MATCH,PROXY

no-resolve tells the IP rule not to resolve a domain into an IP proactively. LAN CIDR rules only need to inspect an already known destination address, so this option can reduce extra DNS lookups. Do not mechanically append no-resolve to every GEOIP rule; requests that have only a domain and no destination IP yet may then bypass geographic matching.

RULE-SET: split large rule lists into separate files

When ad rules or mainland-China domain rules grow to hundreds or thousands of entries, putting everything in the main configuration hurts readability. rule-providers defines rule files, while RULE-SET calls them from the main rule list. Clash Meta, also known as mihomo, supports behavior types including domain, ipcidr, and classical; each type uses a different payload format.

rule-providers:
  allow:
    type: file
    behavior: domain
    path: ./ruleset/allow.yaml

  ads:
    type: file
    behavior: classical
    path: ./ruleset/ads.yaml

  direct-domain:
    type: file
    behavior: domain
    path: ./ruleset/direct-domain.yaml

rules:
  - RULE-SET,allow,DIRECT
  - RULE-SET,ads,REJECT
  - RULE-SET,direct-domain,DIRECT
  - GEOIP,CN,DIRECT
  - MATCH,PROXY

A behavior: domain file contains domain payloads only, making it suitable for mainland-China domains or allowlists. behavior: classical can store complete typed rules such as DOMAIN-SUFFIX, DOMAIN-KEYWORD, and IP-CIDR. Local files make it easy to inspect content before enabling it; for automatic updates, use type: http and set the rule URL, save path, and update interval.

MATCH: always put it last

MATCH,PROXY does not inspect a domain or IP; it matches every connection that has not matched earlier. If MATCH appears in the middle, rules below it never get a chance to run. A common goal is “direct for mainland China, proxy everything else,” so put allow rules, ad blocking, LAN direct rules, mainland-China domains, and GEOIP first, then pass the remainder to a proxy group with MATCH.

A configuration template for mainland-China direct connections, overseas proxying, and ad blocking

The template below can be merged into an existing subscription configuration. It assumes the subscription already contains a policy group named PROXY. If the client displays the group as “Node Selection” or “Proxy,” replace the trailing PROXY in the rules with the actual name. Policy names are character-sensitive; spaces and Chinese characters must match exactly.

mixed-port: 7890
allow-lan: false
mode: rule
log-level: info
ipv6: false

profile:
  store-selected: true

rule-providers:
  allow:
    type: file
    behavior: domain
    path: ./ruleset/allow.yaml

  ads:
    type: file
    behavior: classical
    path: ./ruleset/ads.yaml

  direct-domain:
    type: file
    behavior: domain
    path: ./ruleset/direct-domain.yaml

rules:
  - RULE-SET,allow,DIRECT
  - RULE-SET,ads,REJECT

  - DOMAIN,localhost,DIRECT
  - DOMAIN-SUFFIX,local,DIRECT
  - DOMAIN-SUFFIX,lan,DIRECT

  - IP-CIDR,127.0.0.0/8,DIRECT,no-resolve
  - IP-CIDR,10.0.0.0/8,DIRECT,no-resolve
  - IP-CIDR,172.16.0.0/12,DIRECT,no-resolve
  - IP-CIDR,192.168.0.0/16,DIRECT,no-resolve
  - IP-CIDR,169.254.0.0/16,DIRECT,no-resolve

  - RULE-SET,direct-domain,DIRECT
  - DOMAIN-SUFFIX,gov.cn,DIRECT
  - DOMAIN-SUFFIX,cn,DIRECT
  - GEOIP,CN,DIRECT

  - MATCH,PROXY

mixed-port: 7890 accepts HTTP and SOCKS5 connections on one port, which suits desktop clients that point the system proxy to 127.0.0.1:7890. allow-lan: false means this example does not expose the proxy port to the LAN. If a TV, phone, or game console really needs to connect through this computer, configure the listen address and firewall separately; changing the rule list alone is not enough.

Three local rule files

allow.yaml is used to override false positives from the ad list. Because it appears before the ad rules, the same domain is allowed first. A domain-behavior payload can use the following format:

payload:
  - 'login.example.net'
  - '+.account.example.net'

ads.yaml uses classical behavior, with a complete rule type in each entry. Ad lists should favor exact domains and suffixes, while broad keywords should be used sparingly:

payload:
  - DOMAIN,ads.example.net
  - DOMAIN-SUFFIX,tracking.example.net
  - DOMAIN-KEYWORD,telemetry-example

direct-domain.yaml uses domain behavior to store suffixes for mainland-China services that should connect directly:

payload:
  - '+.gov.cn'
  - '+.edu.cn'
  - '+.example.cn'

Evaluation order: allow, block, direct, then fallback

Rule order is more than organization; it changes the final outbound path. The recommended order is: exact allowlist, ad rejection, LAN addresses, mainland-China domains, mainland-China IPs, dedicated service policies, and MATCH last. Putting the allowlist before the ad list helps prevent login endpoints, verification codes, and payment pages from being blocked by third-party rules.

1. Exact allowlist: handle domains that must connect directly and must not be blocked by ad rules.
2. Ad rejection: return a rejection for confirmed advertising and tracking domains.
3. LAN direct: keep routers, NAS devices, printers, and local development services out of the proxy.
4. Mainland-China domains direct: route primarily by domain rules to avoid unnecessary IP lookups.
5. Mainland-China IPs direct: catch direct IP connections and requests not covered by domain rules.
6. Overseas service groups: place streaming, code hosting, and other services with dedicated policies before MATCH.
7. MATCH fallback: send all remaining connections to the default proxy group.

Why GEOIP should not come before ad rules

An ad domain may resolve to an IP address in mainland China. If GEOIP,CN,DIRECT comes before the ad rule, the request is classified as direct by IP and RULE-SET,ads,REJECT never gets a chance to run. Put ad-domain rules before GEOIP so the request is rejected by domain first.

Why relying only on DOMAIN-SUFFIX,cn is not recommended

DOMAIN-SUFFIX,cn,DIRECT covers many sites ending in .cn, but mainland-China services may also use .com, .net, or cloud-service domains; overseas services may use Chinese domains for some endpoints. A safer approach is to let a maintained mainland-China domain ruleset handle most decisions, then use .cn and GEOIP,CN as a safety net.

How to preserve custom rules when updating a subscription

Direct edits to a subscription-generated YAML file are usually overwritten at the next update. If the desktop client offers “Global Extension,” “Override,” “Merge,” or “Script,” put the custom rule-providers and rule-insertion logic in the override layer. Menu names vary by client; common paths include “Subscription” → “Edit” → “Override Configuration” or “Settings” → “Configuration” → “Global Extension.”

During a merge, first confirm whether the client appends or replaces content. If rules is simply appended to the end of the subscription rules and the original configuration already contains MATCH, the new rules still will not match. The correct result is to insert custom rules before the existing MATCH or explicitly replace the entire rules section.

Compatibility boundaries between original Clash and mihomo

Basic DOMAIN, DOMAIN-SUFFIX, DOMAIN-KEYWORD, IP-CIDR, GEOIP, RULE-SET, and MATCH rules are widely supported in common Clash configurations. mihomo also provides GEOSITE, compound logic rules, binary rule-set formats, and more complete process matching. When sharing a configuration across cores, keep the basic syntax first, then add extensions supported by the specific client.

How TUN, DNS, and rule matching interact

TUN mode takes over more than browser traffic: it also handles applications that ignore the system proxy, some command-line tools, and UDP connections. The client must then recover the destination domain from network packets, DNS mappings, or sniffing results. If it can see only the destination IP, DOMAIN-SUFFIX and domain-type RULE-SET entries cannot participate, so the connection falls through to IP-CIDR, GEOIP, or MATCH.

fake-ip mode

mihomo’s commonly used fake-ip DNS mode returns reserved addresses for domains and stores a “virtual IP → original domain” mapping in the core. When an application connects to the virtual address, the core can still recover the domain and apply domain rules. For LAN discovery, corporate intranets, or applications that require real DNS answers, add the relevant domains to the fake-IP filter list instead of changing the entire DNS mode.

redir-host mode

redir-host returns the real DNS result and then routes by domain or IP. It can be more intuitive for some LAN and special applications, but the DNS lookup path must stay consistent with the actual connection path; otherwise, a domain may resolve in mainland China while the connection is sent through an overseas proxy. During troubleshooting, inspect both DNS and connection logs rather than looking only at node latency results.

Recommended testing workflow

1. Temporarily set the log level to Info on the client’s “Logs” page, then visit the target site again.
2. Inspect the Host, Destination IP, Rule, and Chain fields in the connection record.
3. Confirm that the ad domain matches RULE-SET,ads and the result is REJECT.
4. Confirm that the LAN address matches IP-CIDR and the result is DIRECT.
5. Confirm that a mainland-China site matches direct-domain or GEOIP,CN.
6. Confirm that an uncategorized overseas site ultimately matches MATCH and enters the expected proxy group.

Change only one condition at a time during testing. After adjusting rules, use “Configuration” → “Reload,” close existing connections, and start a new request. Browser keep-alive connections, HTTP/2 sessions, and application connection pools may continue using the previous outbound path, so refreshing the page alone may not trigger the new rules.

Common issues and troubleshooting

The configuration loads, but all traffic uses the proxy

First check that the mode is still Rule, then see whether MATCH or an overly broad proxy rule appears near the top of the rule list. If mainland-China domain rules use RULE-SET, confirm that the provider contains entries and that the local path resolves relative to the configuration file’s directory.

Login or payment pages stop working after enabling ad rules

Find the exact REJECTED domain in the connection records, add the required domain to the allow ruleset, and ensure RULE-SET,allow,DIRECT appears before the ad rules. Do not disable the entire ad list or allow an overly broad top-level domain; add the full login endpoint or the smallest workable suffix instead.

A mainland-China website matches MATCH

Check whether the connection record retained the Host. If a domain is present but did not match, the mainland-China domain ruleset usually lacks that entry; if only a destination IP is visible, inspect the GEOIP database and DNS configuration. Also confirm that the policy name used by the rule actually exists, since some clients reject the entire configuration when a policy is invalid.

YAML parsing fails after editing

YAML uses spaces for indentation, not tabs. rules and rule-providers must be at the correct nesting level, and list items need a hyphen. Domain payloads containing colons, hash signs, or other special characters can be wrapped in single quotes. When the error reports a line number, also inspect the preceding line for a missing colon, because the actual problem is often reported on the next line.

Latency tests pass, but the webpage still will not open

A latency test only verifies that a test address can connect through a particular proxy group; it does not mean the target webpage matched the same policy. Open the connection page and check the actual Rule and Chain. If the request was caught early by DIRECT, REJECT, or another dedicated group, change the rule order instead of repeatedly switching test nodes.