PROCESS-NAME Rules: Routing by Program

Sometimes you want to route by which program is talking rather than which site it talks to: Telegram always proxied, the torrent client always direct. That is what PROCESS-NAME rules do.

Syntax

rules:
  - PROCESS-NAME,Telegram.exe,Select
  - PROCESS-NAME,qbittorrent.exe,DIRECT
  - PROCESS-NAME,steam.exe,DIRECT
  - PROCESS-NAME,WeChat.exe,DIRECT

Use the full executable name including .exe; case-insensitive. Find it in Task Manager → Details, or read the Process column on the Connections page while in TUN mode.

The precondition: traffic must carry process identity

Clash associates connections with processes by querying the system connection table, and reliability differs by capture method:

• TUN mode: reliable. Traffic is captured at the network layer and the owning process resolves consistently. If you want process rules, run TUN.
• System proxy: mostly works, not guaranteed. Connections arrive via loopback; multi-process apps and service processes sometimes fail to resolve, in which case the rule is skipped and traffic falls to later rules.

Practical recipes

1. Keep BitTorrent direct: P2P through a proxy violates most providers' terms and wastes traffic: PROCESS-NAME,qbittorrent.exe,DIRECT.
2. Pin a program to a region: with a dedicated group, e.g. PROCESS-NAME,game.exe,Japan.
3. Local-network app bundle direct: saves traffic and avoids risk-control triggers.

Caveats

• Place process rules above domain rules if they should win.
• A browser is one process - process rules cannot split "different sites inside the browser"; that remains domain-rule territory.
• UWP apps may report a generic host process name, making them poor targets.