Beginner's Guide to Clash Rule Configuration | Custom Traffic Splitting

What Are Clash Rules?

Clash rules are the decision-making engine of the proxy client. Every time your device makes a network connection, Clash evaluates the connection against a list of rules to decide: should this traffic go through a proxy, go direct, or be blocked entirely?

The default rules from your subscription provider handle most scenarios adequately. But understanding how rules work gives you precise control over your traffic routing. You can optimize performance by routing domestic traffic directly, enforce privacy for specific domains, or block unwanted ads and trackers.

If you have not yet installed Clash on your system, start with our Windows installation guide before diving into rule customization.

Rule Types Explained

Clash supports a rich set of rule types. Each type matches traffic based on a different criterion. Here is a comprehensive breakdown:

The three most commonly used types are DOMAIN-SUFFIX, IP-CIDR, and GEOIP. Let us explore them in depth.

DOMAIN and DOMAIN-SUFFIX

DOMAIN matches an exact hostname. Use it for specific subdomains where the general suffix rule would be too broad.

DOMAIN-SUFFIX matches the domain and all its subdomains. For example, DOMAIN-SUFFIX,google.com,Proxy matches www.google.com, mail.google.com, apis.google.com, and any other subdomain of google.com.

IP-CIDR

Matches IP addresses within a CIDR range. This is evaluated after DNS resolution, so it applies to the resolved IP rather than the domain name. This is critical for the DNS configuration flow, because the IP may be resolved through different DNS servers.

GEOIP and GEOSITE

GEOIP uses a GeoIP database to determine the country associated with an IP address. GEOSITE uses a precompiled domain list. Both are extremely useful for the common pattern of routing domestic traffic directly and foreign traffic through a proxy.

Rule Providers

Maintaining hundreds of domain rules manually is impractical. Rule providers solve this by fetching rule sets from remote sources automatically. The Clash Meta (mihomo) core supports both HTTP and file-based rule providers.

rule-providers:
  reject:
    type: http
    behavior: domain
    url: "https://cdn.jsdelivr.net/gh/Loyalsoldier/clash-rules@release/reject.txt"
    path: ./ruleset/reject.yaml
    interval: 86400

  proxy:
    type: http
    behavior: domain
    url: "https://cdn.jsdelivr.net/gh/Loyalsoldier/clash-rules@release/proxy.txt"
    path: ./ruleset/proxy.yaml
    interval: 86400

  direct:
    type: http
    behavior: domain
    url: "https://cdn.jsdelivr.net/gh/Loyalsoldier/clash-rules@release/direct.txt"
    path: ./ruleset/direct.yaml
    interval: 86400

  private:
    type: http
    behavior: domain
    url: "https://cdn.jsdelivr.net/gh/Loyalsoldier/clash-rules@release/private.txt"
    path: ./ruleset/private.yaml
    interval: 86400

  gfw:
    type: http
    behavior: domain
    url: "https://cdn.jsdelivr.net/gh/Loyalsoldier/clash-rules@release/gfw.txt"
    path: ./ruleset/gfw.yaml
    interval: 86400

  tld-cn:
    type: http
    behavior: domain
    url: "https://cdn.jsdelivr.net/gh/Loyalsoldier/clash-rules@release/tld-cn.txt"
    path: ./ruleset/tld-cn.yaml
    interval: 86400

  tld-not-cn:
    type: http
    behavior: domain
    url: "https://cdn.jsdelivr.net/gh/Loyalsoldier/clash-rules@release/tld-not-cn.txt"
    path: ./ruleset/tld-not-cn.yaml
    interval: 86400

  cncidr:
    type: http
    behavior: ipcidr
    url: "https://cdn.jsdelivr.net/gh/Loyalsoldier/clash-rules@release/cncidr.txt"
    path: ./ruleset/cncidr.yaml
    interval: 86400

The behavior field determines the format: domain for domain-based rules, ipcidr for IP CIDR rules, and classical for mixed rules. The interval is in seconds (86400 = 24 hours).

Proxy Groups and Rule Binding

Every rule ends with a policy name that determines where matching traffic goes. These policies are defined as proxy groups:

proxy-groups:
  - name: "Proxy"
    type: select
    proxies:
      - "Auto"
      - "HK Node 1"
      - "JP Node 1"
      - "US Node 1"
      - DIRECT

  - name: "Auto"
    type: url-test
    proxies:
      - "HK Node 1"
      - "JP Node 1"
      - "US Node 1"
    url: "https://www.gstatic.com/generate_204"
    interval: 300
    tolerance: 50

The select type lets you manually pick which proxy to use. The url-test type automatically selects the fastest node based on periodic latency tests. The special policy DIRECT sends traffic without any proxy, and REJECT blocks the connection entirely.

Common Configuration Patterns

Pattern 1: Domestic Direct, Foreign Proxy

This is the most popular configuration. Domestic (Chinese) sites go direct for speed; everything else goes through a proxy:

rules:
  # Reject ads first
  - RULE-SET,reject,REJECT
  
  # Private network traffic (LAN) goes direct
  - RULE-SET,private,DIRECT
  
  # Known foreign domains go through proxy
  - RULE-SET,proxy,Proxy
  
  # Known domestic domains go direct
  - RULE-SET,direct,DIRECT
  
  # TLD-level rules for Chinese domains
  - RULE-SET,tld-cn,DIRECT
  
  # Chinese IP ranges go direct
  - RULE-SET,cncidr,DIRECT
  
  # GeoIP fallback for Chinese IPs
  - GEOIP,CN,DIRECT
  
  # Everything else goes through proxy
  - MATCH,Proxy

The order of rules matters. Clash evaluates rules top to bottom and uses the first match. Place more specific rules at the top and more general rules at the bottom.

Pattern 2: Application-Based Splitting

Route traffic based on which application is making the connection:

rules:
  # Telegram always through proxy
  - PROCESS-NAME,Telegram.exe,Proxy
  - PROCESS-NAME,telegram-desktop,Proxy
  
  # Development tools go direct
  - PROCESS-NAME,git.exe,DIRECT
  - PROCESS-NAME,node.exe,DIRECT
  
  # Browsers follow proxy
  - PROCESS-NAME,chrome.exe,Proxy
  - PROCESS-NAME,firefox.exe,Proxy
  
  # Fallback
  - MATCH,Proxy

Note that PROCESS-NAME rules require TUN mode to work reliably. See our TUN mode guide for details.

Writing Your Own Custom Rules

Your subscription profile provides a base rule set, but you can add custom rules using the profile override feature in Clash Verge Rev. This lets you add rules on top of the subscription without modifying the original file.

# In Clash Verge Rev, create an Override profile with:
prepend-rules:
  # Your custom rules at the top (highest priority)
  - DOMAIN,custom-domain.example.com,Proxy
  - DOMAIN-SUFFIX,mycompany.com,DIRECT
  - IP-CIDR,10.0.0.0/8,DIRECT
  - DOMAIN-SUFFIX,adtracker.example.com,REJECT

append-rules:
  # Custom rules at the bottom (lowest priority, before MATCH)
  - PROCESS-NAME,myapp.exe,Proxy

The prepend-rules entries are injected before the subscription rules, giving them the highest priority. The append-rules entries are added after the subscription rules but before the final MATCH rule.

Complex Rule Combinations

For advanced scenarios, you can combine rules with logical operators:

# AND: Match only if ALL conditions are true
- AND,((DOMAIN-SUFFIX,example.com),(DST-PORT,443)),Proxy

# OR: Match if ANY condition is true
- OR,((DOMAIN-SUFFIX,blocked.com),(DOMAIN-SUFFIX,restricted.com)),Proxy

# NOT: Negate a condition
- NOT,((GEOIP,CN)),Proxy

Testing and Debugging Rules

After modifying rules, you need to verify they work as expected:

Using the Clash Dashboard

The built-in dashboard (Yacd or Meta Cube X) shows real-time connection logs. Each connection entry displays which rule matched and which policy was applied. Use this to verify that specific domains are hitting the correct rules.

Connection Log Analysis

In Clash Verge Rev, open the Logs panel and filter for INFO level messages. You will see entries like:

[INFO] [TCP] www.google.com:443 match DOMAIN-SUFFIX(google.com) using Proxy
[INFO] [TCP] baidu.com:443 match GEOIP(CN) using DIRECT

These log entries confirm which rule matched and which proxy group handled the traffic.

Testing DNS Resolution

If domain-based rules are not matching, the issue may be in your DNS configuration. Ensure that the dns.enable flag is set to true and that the fake-ip-filter does not exclude the domains you are testing. See our DNS anti-pollution guide for a complete DNS setup walkthrough.

Best Practices

• Order matters: Place the most specific rules first. A DOMAIN rule is more specific than DOMAIN-SUFFIX, which is more specific than GEOIP, and MATCH should always be last.
• Use rule providers: Instead of writing hundreds of individual domain rules, use community-maintained rule sets that are updated regularly.
• Test incrementally: After adding new rules, test a few known domains to confirm they route correctly before moving on.
• Keep backups: Export your custom override configurations so you can restore them after updates or reinstallation.
• Avoid redundancy: Do not add a DOMAIN rule for a domain that is already covered by a DOMAIN-SUFFIX rule pointing to the same policy.
• Monitor rule hits: Periodically check connection logs to identify domains that fall through to MATCH and should have explicit rules.