When traffic targets a bare IP (no domain), or you want coarse routing by "where an IP belongs", IP rules take the stage.
IP-CIDR: match by range
- IP-CIDR,192.168.0.0/16,DIRECT # private range direct
- IP-CIDR,8.8.8.8/32,PROXY # single IP uses /32
- IP-CIDR6,2001:4860::/32,PROXY # IPv6 uses IP-CIDR6
The /N fixes the first N bits: /32 is one address, /24 is 256 (1.2.3.0-1.2.3.255), /16 is 65,536. Forgetting /32 on a single IP is a classic mistake.
GEOIP: match by country
- GEOIP,CN,DIRECT
The core looks up the IP's country code in the bundled MaxMind database (Country.mmdb). GEOIP,CN,DIRECT appears in nearly every mainland-China profile: anything resolving to a domestic IP connects directly. The database occasionally misclassifies - correct such cases with an earlier domain rule.
no-resolve: skip needless DNS
IP rules require knowing the destination IP. For domain-based traffic, the core must resolve first just to test the rule - slower, and in fake-ip mode it can force real resolutions. Adding no-resolve makes domain traffic skip the rule entirely; only connections that already target an IP are tested:
- IP-CIDR,10.0.0.0/8,DIRECT,no-resolve
- GEOIP,CN,DIRECT # the final GEOIP usually omits it so domains route by country too
Recommended layout
- Domain rules (DOMAIN family, domain rule sets);
- Private-range IP rules with
no-resolve; GEOIP,CN,DIRECT;MATCH,proxy-groupas fallback.