Rules

We covered the basics of rule-based matching in Clash in Quick Start. This chapter describes every rule type available in the latest version of Clash.

# 类型,参数,策略(,no-resolve)
TYPE,ARGUMENT,POLICY(,no-resolve)

no-resolve is optional and lets a rule skip DNS resolution. Use it when you want to apply GEOIP, IP-CIDR, IP-CIDR6, or SCRIPT rules without immediately resolving the domain name to an IP address.

Policy

There are currently four policy types:

• DIRECT: connect to the destination directly through interface-name (without consulting the system routing table)
• REJECT: drops the packet
• Proxy: routes the packet to the specified proxy server
• Proxy Group: routes the packet to the specified policy group

Rule types

The following sections explain each rule type and how to use it:

DOMAIN

DOMAIN,www.google.com,policy routes www.google.com to policy.

DOMAIN-SUFFIX

DOMAIN-SUFFIX,youtube.com,policy routes any domain ending in youtube.com to policy.

In this case, both www.youtube.com and foo.bar.youtube.com are routed to policy.

DOMAIN-KEYWORD

DOMAIN-KEYWORD,google,policy routes any domain containing the keyword google to policy.

In this case, either www.google.com or googleapis.com is routed to policy.

GEOIP IP geolocation (country code)

GEOIP rules route packets according to the country code of the destination IP address. Clash uses the MaxMind GeoLite2 database for this purpose.

GEOIP,CN,policy routes any packet whose destination IP address is in China to policy.

IP-CIDR IPv4 range

IP-CIDR rules route packets according to their destination IPv4 address.

IP-CIDR,127.0.0.0/8,DIRECT routes any packet with the destination IP address 127.0.0.0/8 to DIRECT.

IP-CIDR6 IPv6 range

IP-CIDR6 rules route packets according to their destination IPv6 address.

IP-CIDR6,2620:0:2d0:200::7/32,policy routes any packet with the destination IP address 2620:0:2d0:200::7/32 to policy.

SRC-IP-CIDR source IP range

SRC-IP-CIDR rules route packets according to their source IPv4 address.

SRC-IP-CIDR,192.168.1.201/32,DIRECT routes any packet with the source IP address 192.168.1.201/32 to DIRECT.

SRC-PORT source port

SRC-PORT rules route packets according to their source port.

SRC-PORT,80,policy routes any packet with the source port 80 to policy.

DST-PORT destination port

DST-PORT rules route packets according to their destination port.

DST-PORT,80,policy routes any packet with the destination port 80 to policy.

PROCESS-NAME source process name

A PROCESS-NAME rule routes packets according to the name of the process sending them.

PROCESS-NAME,nc,DIRECT routes any packet from the process nc to DIRECT.

PROCESS-PATH source process path

A PROCESS-PATH rule routes packets according to the path of the process sending them.

PROCESS-PATH,/usr/local/bin/nc,DIRECT routes any packet from a process at /usr/local/bin/nc to DIRECT.

IPSET IP set

IPSET rules match and route packets using IP sets. According to official IPSET website:

An IP set is a framework in the Linux kernel managed with the ipset utility. Depending on its type, an IP set can store IP addresses, networks, (TCP/UDP) port numbers, MAC addresses, interface names, or combinations of them, enabling extremely fast entry matching.

This feature therefore works only on Linux and requires ipset to be installed.

IPSET,chnroute,policy routes any packet whose destination IP address belongs to the IP set chnroute to policy.

RULE-SET

RULE-SET rules route packets according to the result from Rule Providers rule set. When Clash uses this rule, it loads rules from the specified Rule Providers, then matches the packet against them. If any rule matches, it routes the packet to the specified policy; otherwise, it skips this rule.

RULE-SET,my-rule-provider,DIRECT loads all rules from my-rule-provider

SCRIPT

A SCRIPT rule routes packets according to a script's result. When Clash uses this rule, it executes the specified script and routes the packet to the script output.

SCRIPT,script-path,DIRECT routes the packet to the output of script script-path.

MATCH

The MATCH rule routes all remaining packets. It is required and is usually used as the final rule.

MATCH,policy routes the remaining packets to policy.