Clash checks rules from top to bottom. Once an earlier rule matches, later rules are not evaluated. Find the actual match in the connection record, then adjust the order of the relevant rule and MATCH. Move exact DOMAIN or DOMAIN-SUFFIX rules ahead of broad rules, reload, and verify with the same request instead of changing the entire rule table at once.
Which rule does the connection detail show as matched?
Record the domain, destination IP, matched rule, and final policy from the connection detail, then find any broader match above that rule in the configuration.
- Which matched rule appears in the connection list?
- Does the domain rule come after an IP rule?
- Did PROCESS-NAME, DOMAIN-SUFFIX, or GEOIP match first?
- Does the final MATCH point to the expected policy?
Place exact-domain rules before broad rules
- Find the destination domain and matched rule in the connection list
- Place the more specific DOMAIN or DOMAIN-SUFFIX before broad rules
- Reload the configuration after adjusting rules
- For a CDN or multi-domain service, handle both the primary domain and resource domains
An incorrect rule match does not necessarily mean the node is broken
IP-CIDR rules depend on resolution results and are affected by DNS configuration(See DNS FAQ)
More rules require greater care with order and naming(See Rule configuration)