Port rules catch what domain rules cannot: connections that only ever have an IP address, and protocols you want to block wholesale.

Syntax

rules:
  - DST-PORT,25,DIRECT
  - DST-PORT,5353,REJECT
  - SRC-PORT,7891,PROXY
  - MATCH,PROXY

DST-PORT matches the destination port; SRC-PORT matches the local source port the connection came from. You will use the first one most of the time - the second only matters when you have given a program its own listening port. Ports are single numbers, not ranges; if you need several, write several lines.

Sponsored Where does the subscription link come from? Our partner provider gives you 1 GB of high-speed Hong Kong data at signup — import it in one click. Get high-speed nodes

Order decides everything

Rules are evaluated top to bottom and stop at the first match, and port rules are no exception. Put DST-PORT,443 at the top and every HTTPS domain rule beneath it becomes dead weight - by far the most common way to break a config. Keep domain rules first, port rules after them, and MATCH last. The full matching model is in Rule Basics: Types and Match Order.

Three practical cases

  • Killing QUIC. A bare DST-PORT,443,REJECT takes HTTPS down with it. If your core supports the NETWORK rule type, qualify it with NETWORK,udp; if it does not, just disable QUIC in the browser instead.
  • Mail clients direct. DST-PORT,993,DIRECT and DST-PORT,465,DIRECT save a hop when the mail server is near you, and IMAP tends to be steadier that way.
  • Internal services. Port 5000 on a NAS, port 80 on a router - pair these with private-range rules, see Keeping LAN Devices Direct.

Process-based routing is the other half of this toolkit and the two are often combined - see PROCESS-NAME Rules.

Verify it: open the Connections page and read the rule column for that connection. It shows the rule that actually matched. If it is not the one you wrote, something above it won first.