Sets & Routing Rules
[domain-sets]
Domain sets select an output through [routing]; they are separate from HTTP capture domains and exact DNS host records.
This section defines named sets of domains for use in routing rules. The key is the set name.
Example:
[domain-sets]
social-media=twitter.com,facebook.com,instagram.com
[cidr-sets]
This section defines named sets of IP ranges (CIDRs) for use in routing rules. The key is the set name.
Example:
[cidr-sets]
private-ips=10.0.0.0/8,192.168.0.0/16
[routing]
Rules use fixed priority levels, not one global top-to-bottom list. Domain sets use the most specific suffix; only keywords use saved order. IP ranges use longest-prefix matching. See the routing engine for DNS precedence, packet routing, and examples.
Rule Format: TYPE,VALUE,ACTION,TARGET for match rules, or TYPE,ACTION,TARGET for reserved/default rules such as DNS-FALLBACK, VPN-DNS-SERVER-DOMAINS, and DEFAULT.
| Type | Value | Action | Target | Description |
|---|---|---|---|---|
DOMAIN-SET | Name of a domain set | L3VPN, L4PROXY, DIRECT, DROP, REJECT | Name of an l3vpn/l4proxy | Route based on a domain set. |
DOMAIN-KEYWORD | Keyword | L3VPN, L4PROXY, DIRECT, DROP, REJECT | L3VPN/L4PROXY | Literal substring of the canonical DNS name; first matching keyword in saved order. Domain sets always take precedence. A forwarding match bypasses the ad filter. |
CIDR-SET | Name of a CIDR set | L3VPN, L4PROXY, DIRECT, DROP, REJECT | Name of an l3vpn/l4proxy | Route based on a CIDR set. |
CIDR | A single CIDR | L3VPN, L4PROXY, DIRECT, DROP, REJECT | Name of an l3vpn/l4proxy | Route based on a single IP range. |
DNS-FALLBACK | (Not used) | DIRECT, L3VPN, L4PROXY, etc. | Name of an l3vpn/l4proxy | Default DNS behavior for domains not in any set. |
VPN-DNS-SERVER-DOMAINS | (Not used) | L3VPN, L4PROXY | Name of an l3vpn/l4proxy | (New in 1.9.0) route encrypted VPN DNS server domain bootstrap traffic through a selected VPN/proxy. Required when vpn-dns uses DoT/DoH upstreams with domain names. |
DEFAULT | (Not used) | DIRECT, L3VPN, L4PROXY, etc. | Name of an l3vpn/l4proxy | The final catch-all rule for all traffic. |
Example:
[routing]
DOMAIN-SET,social-media,L4PROXY,my-shadowsocks
CIDR-SET,private-ips,DIRECT
VPN-DNS-SERVER-DOMAINS,L4PROXY,my-shadowsocks
DEFAULT,L3VPN,my-wireguard