When traffic targets a bare IP (no domain), or you want coarse routing by "where an IP belongs", IP rules take the stage.

IP-CIDR: match by range

- IP-CIDR,192.168.0.0/16,DIRECT      # private range direct
- IP-CIDR,8.8.8.8/32,PROXY           # single IP uses /32
- IP-CIDR6,2001:4860::/32,PROXY      # IPv6 uses IP-CIDR6

The /N fixes the first N bits: /32 is one address, /24 is 256 (1.2.3.0-1.2.3.255), /16 is 65,536. Forgetting /32 on a single IP is a classic mistake.

GEOIP: match by country

- GEOIP,CN,DIRECT

The core looks up the IP's country code in the bundled MaxMind database (Country.mmdb). GEOIP,CN,DIRECT appears in nearly every mainland-China profile: anything resolving to a domestic IP connects directly. The database occasionally misclassifies - correct such cases with an earlier domain rule.

no-resolve: skip needless DNS

IP rules require knowing the destination IP. For domain-based traffic, the core must resolve first just to test the rule - slower, and in fake-ip mode it can force real resolutions. Adding no-resolve makes domain traffic skip the rule entirely; only connections that already target an IP are tested:

- IP-CIDR,10.0.0.0/8,DIRECT,no-resolve
- GEOIP,CN,DIRECT   # the final GEOIP usually omits it so domains route by country too

Recommended layout

  1. Domain rules (DOMAIN family, domain rule sets);
  2. Private-range IP rules with no-resolve;
  3. GEOIP,CN,DIRECT;
  4. MATCH,proxy-group as fallback.
Tip: write explicit direct rules for LAN ranges (192.168.x.x, 10.x.x.x, …) so printers and NAS boxes never end up in the proxy. Most subscription templates already include them.