Clash rule type reference — DOMAIN, IP-CIDR, GEOIP, PROCESS-NAME and the rest

Rules decide where every connection goes. This is a reference table with the practical use of each type.

The basic shape of a rule

rules:
  - TYPE,what to match,policy[,extra parameter]

For example:

- DOMAIN-SUFFIX,google.com,🚀 Select
- IP-CIDR,192.168.0.0/16,DIRECT,no-resolve
- MATCH,🐟 Fallthrough

Matched top to bottom; the first hit wins and nothing below is checked. That single fact underpins every rule behaviour.

The complete type table

Choosing between the three domain rules

What no-resolve really means

This is the parameter people get wrong most often on IP rules.

When a connection arrives with a domain as its destination, the core has to resolve that domain to an IP before it can compare it against an IP-CIDR rule. Adding no-resolve says: if the destination is still a domain (not yet resolved), skip this rule rather than performing a DNS lookup just for it.

When to add it: to every private-range IP rule at the top of your rule list, without exception.

- IP-CIDR,127.0.0.0/8,DIRECT,no-resolve
- IP-CIDR,192.168.0.0/16,DIRECT,no-resolve
- IP-CIDR,10.0.0.0/8,DIRECT,no-resolve
- IP-CIDR,172.16.0.0/12,DIRECT,no-resolve
- IP-CIDR6,fc00::/7,DIRECT,no-resolve

When not to: do not add no-resolve to a trailing catch-all such as GEOIP,CN,DIRECT, or domain traffic will never reach it at all.

Three iron laws of rule order

Law one: MATCH must be last. It matches everything, so anything below it is dead.

Law two: GEOIP,CN goes after specific domain rules. Plenty of overseas services have in-region CDN nodes that resolve to local addresses. GEOIP placed too early sends all of them direct.

Law three: more specific rules go earlier. DOMAIN first, then DOMAIN-SUFFIX, then DOMAIN-KEYWORD.

Logical combinations (Mihomo)

When you need several conditions at once:

# only proxy this IP range when the Telegram process is the one asking
- AND,((PROCESS-NAME,Telegram.exe),(IP-CIDR,91.108.4.0/22)),PROXY

# destination port 22, and not in-region
- AND,((DST-PORT,22),(NOT,((GEOIP,CN)))),PROXY

# either one is enough
- OR,((DOMAIN-SUFFIX,openai.com),(DOMAIN-SUFFIX,anthropic.com)),🤖 AI services

Mind the bracket nesting — it is easy to leave one out. If a simple rule expresses the same thing, use that instead: it reads better and runs faster.

Performance: which rules are expensive

Practical advice:

• Put frequently hit rules earlier, to reduce the average number of comparisons
• Use RULE-SET instead of hundreds of hand-written domain rules
• Use PROCESS-NAME only where genuinely needed, and place it late
• Avoid large numbers of DOMAIN-REGEX entries

Finding out which rule a connection matched

Open the Connections page in Clash Verge; the "Rule" column names the rule that matched.

This is the fastest way to diagnose a routing problem:

A correction example — a domain got sent direct by GEOIP,CN and you want it proxied:

# in the global extended config
prepend-rules:
  - DOMAIN-SUFFIX,example.com,🚀 Select

prepend-rules inserts at the very top of the rule list, taking priority over everything, and survives subscription updates.

Useful rule snippets

Private ranges direct (essential)

- IP-CIDR,127.0.0.0/8,DIRECT,no-resolve
- IP-CIDR,192.168.0.0/16,DIRECT,no-resolve
- IP-CIDR,10.0.0.0/8,DIRECT,no-resolve
- IP-CIDR,172.16.0.0/12,DIRECT,no-resolve
- IP-CIDR,100.64.0.0/10,DIRECT,no-resolve
- IP-CIDR6,::1/128,DIRECT,no-resolve
- IP-CIDR6,fc00::/7,DIRECT,no-resolve
- DOMAIN-SUFFIX,local,DIRECT
- DOMAIN-SUFFIX,lan,DIRECT

Avoiding QUIC problems (UDP 443 behaves badly on some networks)

- AND,((NETWORK,UDP),(DST-PORT,443)),REJECT

Force one LAN device to go direct

- SRC-IP-CIDR,192.168.1.50/32,DIRECT

Keep BitTorrent traffic off the proxy (many providers forbid it in their terms)

- DST-PORT,6881-6889,DIRECT
- PROCESS-NAME,qbittorrent.exe,DIRECT
- PROCESS-NAME,transmission-daemon,DIRECT

In short

• DOMAIN-SUFFIX carries the load; use KEYWORD sparingly
• Always add no-resolve to leading IP rules, and under fake-ip it is mandatory
• Order: private → blocking → domains → rule sets → GEOIP → MATCH
• Diagnose with the Rule column on the connections page, correct with prepend-rules

Next, how to host rules externally: remote rule sets with rule-providers.

Related docs

Rules & Routing Remote rule sets with rule-providers — behavior, format and update strategy

Replacing hundreds of hand-written rules with external lists. The difference between the domain, ipcidr and classical behaviors, text versus yaml, how to set the update interval, and what to check when a rule set does nothing.

2026-07-211265 words3 min read

Rules & Routing Split tunnelling in practice — corporate intranet, local direct and overseas proxy together

A complete configuration that serves a corporate VPN intranet, direct local access and proxied overseas services at the same time, covering domains and IP ranges, DNS routing, and the conflicts that come up.

2026-07-171275 words3 min read

Rules & Routing Routing individual programs with PROCESS-NAME rules

The complete picture for per-process routing: enabling find-process-mode, finding the process name, PROCESS-NAME versus PROCESS-PATH, the performance cost, and why a rule you wrote does nothing.

2026-06-221224 words3 min read