Rules are the heart of a Clash config: every new connection walks the rule list from the first line down, stopping at the first match. Get the rules right and routing mostly takes care of itself.

Syntax

rules:
  - TYPE,match-content,outbound
  # for example:
  - DOMAIN-SUFFIX,youtube.com,Select
  - GEOIP,CN,DIRECT
  - MATCH,Select

The outbound can be a proxy group name, DIRECT (no proxy) or REJECT (block).

Common rule types

TypeMatchesExample
DOMAINExact domainDOMAIN,www.google.com,PROXY
DOMAIN-SUFFIXDomain and all subdomainsDOMAIN-SUFFIX,google.com,PROXY
DOMAIN-KEYWORDDomain containing keywordDOMAIN-KEYWORD,google,PROXY
IP-CIDRDestination IPv4 rangeIP-CIDR,8.8.8.8/32,PROXY
GEOIPIP's countryGEOIP,CN,DIRECT
PROCESS-NAMEOriginating processPROCESS-NAME,Telegram.exe,PROXY
RULE-SETExternal rule setRULE-SET,ads,REJECT
MATCHEverything (fallback)MATCH,PROXY

Why order matters

Consider these two rules:

- DOMAIN-SUFFIX,cn.example.com,DIRECT
- DOMAIN-SUFFIX,example.com,PROXY

As written, cn.example.com goes direct and everything else on example.com is proxied. Swap them and the broader rule swallows everything first - the second line never fires. Principle: specific rules first, broad rules later.

The MATCH fallback

The list should end with exactly one MATCH rule handling whatever nothing else matched (without it, unmatched traffic goes direct). Pointing MATCH at a proxy group ("unknown → proxy") versus DIRECT ("unknown → direct") is the difference between a whitelist and a blacklist strategy.

Debugging: unsure which rule a site hit? The Rule column of the Connections page tells you instantly - far faster than reading the config.