Routing Rules
The rules array is the core of traffic routing — rules are matched from top to bottom, and the first match determines the outbound to use, with the rest of the list skipped.
Syntax Overview
rules:
- DOMAIN,ad.com,REJECT
- DOMAIN-SUFFIX,google.com,auto
- DOMAIN-KEYWORD,google,auto
- DOMAIN-WILDCARD,*.google.com,auto
- DOMAIN-REGEX,^abc.*com,PROXY
- GEOSITE,youtube,PROXY
- IP-CIDR,127.0.0.0/8,DIRECT,no-resolve
- IP-CIDR6,2620:0:2d0:200::7/32,auto
- IP-ASN,13335,DIRECT
- GEOIP,CN,DIRECT
- DST-PORT,80,DIRECT
- PROCESS-NAME,curl,PROXY
- NETWORK,udp,DIRECT
- RULE-SET,providername,proxy
- AND,((DOMAIN,baidu.com),(NETWORK,UDP)),DIRECT
- SUB-RULE,(NETWORK,tcp),sub-rule
- MATCH,auto
Rules are matched from top to bottom, so rules listed earlier take priority. If a request is UDP but the matched proxy node doesn't have udp: true enabled, matching continues to the next rule instead of failing outright.
Domain-Based
| Type | Description |
|---|---|
DOMAIN | Matches the exact full domain |
DOMAIN-SUFFIX | Matches a domain suffix — e.g. google.com matches www.google.com/mail.google.com/google.com, but not content-google.com |
DOMAIN-KEYWORD | Matches a keyword within the domain |
DOMAIN-WILDCARD | Wildcard matching, supporting only * (zero or more characters) and ? (one character) — note this is a different syntax from the Clash-style wildcards used elsewhere in the config |
DOMAIN-REGEX | Matches the domain against a regular expression |
GEOSITE | Matches domain categories from the Geosite database, partly sourced from v2fly/domain-list-community |
IP-Based
| Type | Description |
|---|---|
IP-CIDR / IP-CIDR6 | Matches an IP address range — both behave the same, IP-CIDR6 is just an alias |
IP-SUFFIX | Matches an IP suffix range |
IP-ASN | Matches the IP's ASN (Autonomous System Number) |
GEOIP | Matches the IP's country code |
SRC-GEOIP / SRC-IP-ASN / SRC-IP-CIDR / SRC-IP-SUFFIX | The corresponding source IP version — matches the connection's origin instead of its destination |
Port / Inbound / Process / Other
| Type | Description |
|---|---|
DST-PORT / SRC-PORT | Matches a destination/source port range |
IN-PORT / IN-TYPE / IN-USER / IN-NAME | Matches the inbound's port/type/username/name |
REMATCH-NAME | Matches the name written by a Rematch outbound |
PROCESS-PATH / PROCESS-PATH-WILDCARD / PROCESS-PATH-REGEX | Matches by full process path (three formats supported: exact path / wildcard / regex) |
PROCESS-NAME / PROCESS-NAME-WILDCARD / PROCESS-NAME-REGEX | Matches by process name; on Android this can match the package name |
UID | Matches the Linux user ID |
NETWORK | Matches tcp or udp |
DSCP | Matches a DSCP marking, tproxy UDP inbound only |
RULE-SET | References a rule provider — requires rule-providers to be configured |
Logical Rules & Sub-Rules
AND / OR / NOTWritten as LOGIC_TYPE,((payload1),(payload2)),Proxy, where payload is a rule type and its content, e.g. DOMAIN,google.com. Note the parentheses — multiple conditions need to be wrapped in double parentheses.
AND,((DOMAIN,baidu.com),(NETWORK,UDP)),DIRECT
OR,((NETWORK,UDP),(DOMAIN,baidu.com)),REJECT
NOT,((DOMAIN,baidu.com)),PROXYSUB-RULEMatches against a set of sub-rules — see the dedicated Sub-Rules page for details.
MATCHMatches everything unconditionally — usually placed as the last entry in the rule list as a catch-all.
Extra Parameters
no-resolveDestination IP Rules OnlyWhen a domain starts matching against a "destination IP" rule type, mihomo first triggers a DNS lookup to check whether the resolved IP matches that rule; adding no-resolve skips this lookup. If an earlier rule already triggered a resolution, the existing result is still used for matching even with no-resolve set.
srcDestination IP Rules OnlyConverts a "destination IP" match into a "source IP" match.