Custom Clash Rules in Practice: Writing a Rules Config from Scratch

Why the Rules in Your Subscription Aren't Enough

Most subscriptions ship with a set of routing rules covering the common cases — domestic direct connections, overseas proxying, ad blocking — which is enough for everyday use. But the moment your needs get even slightly specific — a domestic app that actually needs to go through the proxy, a game client that must connect directly, an ad domain you want to add yourself — you usually can't edit the subscription's built-in rules (they get overwritten on every update). That's when you need to add your own rules section to the config.

Understand Match Order Before You Start Writing Rules

rules is an array, and Clash compares each entry from top to bottom, using the outbound of the first rule it matches — every rule after that is never even checked. This means rule order is easier to get wrong than the content itself — put a broad rule near the top and a more precise rule below it will never get a chance to fire.

rules:
  # Matched top to bottom; stops at the first hit
  - DOMAIN-SUFFIX,ad.com,REJECT
  - DOMAIN-SUFFIX,google.com,Proxy
  - GEOIP,CN,DIRECT
  - MATCH,Proxy          # Fallback, must be the last entry

Common Rule Types in Practice

There are dozens of rule types, but the ones you'll actually need day to day are just the following, sorted by how often they're used:

• Domain-based: DOMAIN-SUFFIX / DOMAIN-KEYWORD / DOMAINDOMAIN-SUFFIX,google.com matches google.com and all its subdomains — this is the most common form; DOMAIN-KEYWORD matches domains that contain a given keyword, useful for "block/proxy anything that even touches this word," but watch out for false positives; DOMAIN only matches an exact domain, the most precise and least commonly used.
• GEOSITE: pre-packaged domain categoriesGEOSITE,youtube,Proxy instantly matches the entire batch of YouTube-related domains without writing them one by one. The rule-set community has already curated domain categories for almost every major site/app, which is far less effort than hand-writing DOMAIN-SUFFIX entries.
• GEOIP: match by the IP's country/regionGEOIP,CN,DIRECT is one of the standard fallback rules in almost every config file — any request that resolves to a domestic IP goes straight through direct connection, saving your proxy bandwidth.
• IP-CIDR: exact matching by IP rangeGood for local network ranges (like 192.168.0.0/16), fixed CDN IP ranges, and similar cases. Pairing it with the no-resolve parameter skips an unnecessary DNS lookup and speeds up matching.

rules:
  # Local network addresses go direct, no-resolve skips DNS lookup
  - IP-CIDR,192.168.0.0/16,DIRECT,no-resolve
  - IP-CIDR,127.0.0.0/8,DIRECT,no-resolve
  # Hit an entire domain category at once
  - GEOSITE,category-ads-all,REJECT
  - GEOSITE,netflix,Proxy
  # Fallback: domestic IPs go direct, everything else through the proxy
  - GEOIP,CN,DIRECT
  - MATCH,Proxy

Too Many Rules? Use RULE-SET to Pull in a Rule Set

If you need to block a few hundred ad domains, writing them all directly into the rules array makes your config file bloated and unreusable. This is where rule-providers (rule sets) come in — a large batch of rules lives in a separate file or subscription URL, and your config just needs one RULE-SET line to reference it.

rule-providers:
  reject:
    type: http
    behavior: domain
    url: "https://example.com/reject-list.txt"
    path: ./rule_providers/reject.yaml
    interval: 86400

rules:
  - RULE-SET,reject,REJECT
  - GEOIP,CN,DIRECT
  - MATCH,Proxy

• behavior determines the content format of the rule-set file: domain (domain list), ipcidr (IP range list), or classical (full rules, supporting almost every rule type) — each has its own format.
• interval makes the rule set auto-update periodically like a subscription, so you never have to manually edit your config when the ad-domain list gets updated.
• Community-maintained rule sets (like ad-blocking lists or common streaming-domain lists) are usually ready to use as-is — no need to curate one from scratch.

In Practice: Building an "Ad Block + Domestic Direct + Specific App Proxy" Config

Combine the rule types covered above and you get a config skeleton that covers most people's everyday needs:

rules:
  # 1. LAN / local network addresses, direct, skip resolution
  - IP-CIDR,192.168.0.0/16,DIRECT,no-resolve
  - IP-CIDR,10.0.0.0/8,DIRECT,no-resolve

  # 2. Ad blocking via rule set, highest priority
  - RULE-SET,reject,REJECT

  # 3. Specific apps/sites that must go through the proxy (before the domestic rules!)
  - PROCESS-NAME,SomeApp.exe,Proxy
  - GEOSITE,netflix,Proxy
  - GEOSITE,youtube,Proxy

  # 4. Domestic domains/IPs, direct
  - GEOSITE,cn,DIRECT
  - GEOIP,CN,DIRECT

  # 5. Fallback: everything else through the proxy
  - MATCH,Proxy

FAQ