The symptom is unmistakable: start Clash and the NAS admin page stops loading, the network printer vanishes, and 192.168.1.1 spins forever. Those addresses are being handed to the catch-all rule and sent out through the proxy, and the proxy server obviously cannot find a NAS sitting in your living room.

Three subnet rules

They belong at the very top of the rules list:

rules:
  - IP-CIDR,192.168.0.0/16,DIRECT,no-resolve
  - IP-CIDR,10.0.0.0/8,DIRECT,no-resolve
  - IP-CIDR,172.16.0.0/12,DIRECT,no-resolve
  - IP-CIDR,127.0.0.0/8,DIRECT,no-resolve
  - MATCH,PROXY

Most provider subscriptions already include them - but not all. If your LAN is unreachable, search the config for 192.168 before doing anything else. To avoid editing the subscription itself, inject the rules with Mixin so updates cannot overwrite them.

Sponsored Where does the subscription link come from? Our partner provider gives you 1 GB of high-speed Hong Kong data at signup — import it in one click. Get high-speed nodes

What no-resolve is for

To match an IP rule against a request that only carries a hostname, Clash has to resolve it first. Adding no-resolve says: apply this rule only to requests that already are IP addresses, and do not spend a lookup on it. That saves a round trip and, more importantly, avoids matching against a fake address in fake-ip mode - see Custom DNS: fake-ip and redir-host for that mechanism and IP-CIDR and GEOIP Rules for the full syntax.

LAN addresses that are hostnames

If you reach devices as nas.local, router.lan or an internal corporate name, subnet rules will not help - the request is decided by domain rules long before an IP exists. Add:

  - DOMAIN-SUFFIX,local,DIRECT
  - DOMAIN-SUFFIX,lan,DIRECT
  - DOMAIN-SUFFIX,corp.internal,DIRECT
TUN adds a layer: TUN also takes over DNS, and mDNS names such as .local may stop resolving entirely. Add your internal suffixes to fake-ip-filter in the DNS section, or simply use IP addresses for those devices - usually the faster fix.