Docs Config Sub-Rules

Sub-Rules

Routes traffic matching a specific condition into a separate list of sub-rules; if nothing in the sub-rules matches, it automatically falls back to the main rules to keep matching — a good fit for giving a particular type of connection its own dedicated routing logic.

Basic Syntax

config.yaml YAML

rules:
  - SUB-RULE,(NETWORK,tcp),rule1
  - SUB-RULE,(NETWORK,udp),sub-rule2
  - MATCH,DIRECT

sub-rules:
  rule1:
    - DOMAIN-SUFFIX,google.com,ss1
    - DOMAIN-SUFFIX,baidu.com,DIRECT
  sub-rule2:
    - IP-CIDR,1.1.1.1/32,REJECT
    - IP-CIDR,8.8.8.8/32,ss1
    - DOMAIN,dns.alidns.com,REJECT

When the main rules match a SUB-RULE,(condition),sub-rule-name entry, traffic is sent into the corresponding sub-rules list to keep matching; if nothing in that sub-rule list matches, it falls back to the main rules and continues from the line right after that SUB-RULE entry.

Walking Through the Example

Using the config above as an example:

A TCP request to google.comMatches the first entry SUB-RULE,(NETWORK,tcp),rule1, enters rule1, matches DOMAIN-SUFFIX,google.com,ss1, and goes out through ss1
A UDP (QUIC) request to youtube.comMatches the second entry SUB-RULE,(NETWORK,udp),sub-rule2, enters sub-rule2, but sub-rule2 has no rule that matches youtube.com, so it falls back to the main rules and lands on MATCH,DIRECT

Using It With Inbounds

Every listener can set its own rule field, sending that inbound's traffic straight into a specific sub-rule by default instead of starting from the top of the main rules:

config.yaml YAML

listeners:
  - name: socks5-in-1
    type: socks
    port: 10808
    rule: rule1 # Falls back to rules directly if this sub-rule isn't found