Rules

In Rule mode, each new connection is checked against the rules: list from top to bottom. The first rule that matches decides the target: a node, a proxy group, or a built-in target (DIRECT, REJECT, …). If no rule matches, the connection goes DIRECT.

rules:
  - DOMAIN-SUFFIX,example.com,Proxy
  - DOMAIN-KEYWORD,tracker,REJECT
  - IP-CIDR,192.0.2.0/24,DIRECT,no-resolve
  - RULE-SET,streaming,Streaming
  - GEOSITE,cn,DIRECT
  - GEOIP,CN,DIRECT
  - MATCH,Proxy

Syntax

TYPE,payload,TARGET[,no-resolve]
MATCH,TARGET

• TYPE is case-insensitive. Spaces around commas are trimmed.
• TARGET must be the name of a node, a group or a built-in target. A rule whose target doesn’t exist is dropped with a warning; the rest of the configuration still loads.
• no-resolve is only meaningful for rules that need the destination IP (see no-resolve).

Supported rule types

Domain rules

These match the connection’s domain name. A connection has a domain when it was looked up through MeowX’s DNS (fake-ip or redir-host), when the domain was sniffed from the first bytes, or when it arrived through the local HTTP / SOCKS5 proxy. Connections without a known domain never match domain rules.

Type	Matches	Example
DOMAIN	Exactly this domain.	DOMAIN,www.example.com,Proxy
DOMAIN-SUFFIX	The domain itself and all its subdomains. example.com matches example.com and a.b.example.com, but not badexample.com.	DOMAIN-SUFFIX,example.com,Proxy
DOMAIN-KEYWORD	Any domain containing the text (case-insensitive).	DOMAIN-KEYWORD,example,Proxy
DOMAIN-REGEX	A regular expression, case-insensitive, searched anywhere in the domain (anchor with ^ / $ for a full match).	DOMAIN-REGEX,^ads?\d*\.example\.com$,REJECT
GEOSITE	Any domain in a GeoSite category. See GeoIP and GeoSite.	GEOSITE,cn,DIRECT

Domains are compared in lowercase, with a trailing dot removed.

IP rules

These match the destination IP address.

Type	Matches	Example
IP-CIDR	Destination inside the range. Accepts IPv4 or IPv6 ranges. A bare address means /32 (IPv4) or /128 (IPv6).	IP-CIDR,192.0.2.0/24,DIRECT,no-resolve
IP-CIDR6	Same as IP-CIDR (both accept either family, as in mihomo).	IP-CIDR6,2001:db8::/32,DIRECT,no-resolve
GEOIP	Destination’s country code from the bundled database.	GEOIP,CN,DIRECT

GEOIP,PRIVATE matches the private and reserved ranges that the bundled database tags as PRIVATE. mihomo’s special GEOIP,LAN is not recognized and never matches; use IP-CIDR rules for local networks instead.

Port, source and network rules

Type	Matches	Example
DST-PORT	Destination port. Single port, range a-b, or several separated by /.	DST-PORT,80/443/8000-8100,Proxy
SRC-PORT	Source port, same syntax.	SRC-PORT,50000-60000,DIRECT
SRC-IP-CIDR	Source address. Inside the tunnel the source is always this device; it is mainly useful for connections reaching the local proxy from other devices on your LAN.	SRC-IP-CIDR,192.168.1.0/24,DIRECT
NETWORK	Transport: tcp or udp.	NETWORK,udp,DIRECT

Rule sets

Type	Matches	Example
RULE-SET	Any entry of the named rule provider. See Rule providers.	RULE-SET,streaming,Streaming

If the provider is defined but hasn’t been downloaded yet (or failed to load), the rule simply never matches until it is available. If the provider isn’t defined at all, the rule is dropped with a warning.

Logic rules

AND, OR and NOT combine other rules. Each sub-rule is written in parentheses without a target:

rules:
  - AND,((NETWORK,udp),(DST-PORT,443)),REJECT
  - OR,((DOMAIN-SUFFIX,example.com),(DOMAIN-SUFFIX,example.net)),Proxy
  - NOT,((GEOIP,CN)),Proxy
  - AND,((DOMAIN-KEYWORD,video),(NOT,((DOMAIN-SUFFIX,example.org)))),Streaming

• NOT takes exactly one sub-rule.
• Logic rules can be nested.
• A sub-rule may carry its own no-resolve: AND,((RULE-SET,cn_ip,no-resolve),(NETWORK,tcp)),DIRECT.

MATCH

MATCH,TARGET matches everything. Put it last. Without it, unmatched traffic goes DIRECT.

no-resolve

IP-CIDR, IP-CIDR6, GEOIP, and RULE-SET with an ipcidr (or IP-based classical) provider need the destination IP. Whether one is available depends on the connection:

• Real destination IP known (redir-host mode, apps connecting to an IP directly): the rule matches against that IP. no-resolve makes no difference.
• Only a domain known (fake-ip mode, or a request through the local proxy): without no-resolve, MeowX resolves the domain through its DNS settings the first time such a rule is reached (at most once per connection) and matches the result. With no-resolve, the rule is skipped for this connection.

Adding no-resolve to IP rules avoids an extra DNS lookup for domains that aren’t matched earlier, which is why most subscriptions use it on their IP rules.

UDP traffic

For UDP, a matching rule is only used if its target can carry UDP. If the target is a node (or a group whose current member is a node) that doesn’t support UDP, the rule is skipped and matching continues with the next rule — usually ending at MATCH or DIRECT. REJECT always counts as UDP-capable, so UDP block rules work as written. This follows mihomo.

Matching order

Everything below happens before the connection’s target is chosen. The first step that decides wins.

1. Bypass list (app setting): matching domains and IP ranges go DIRECT. In every mode.
2. APNs direct (app setting, on by default): Apple push notification traffic goes DIRECT. In every mode.
3. Your provider’s dashboard (when signed in to an account in the app): the dashboard’s domain and its subscription domains go DIRECT, so refreshing your subscription never depends on a node that might be unreachable. In every mode.
4. Outbound mode: in Direct mode everything goes DIRECT; in Global mode everything goes to the GLOBAL group, or the first group (see Outbound mode). Rule mode continues:
5. Custom rules you added in the app, in their list order.
6. Rules from enabled modules (their [Rule] sections). These apply whether or not HTTPS decryption is turned on.
7. The subscription’s rules:, top to bottom.
8. No match: DIRECT.

Steps 1–3, 5 and 6 are stored in the app, not in the configuration file, so a subscription refresh doesn’t touch them.

Note

Before rules run, MeowX works out the connection’s domain: from the fake-ip address, by sniffing TLS SNI / HTTP Host, or from earlier DNS answers (redir-host). The domain found this way is what domain rules match against.

Unsupported rule types

Type	Status
IP-ASN	Accepted, never matches (no ASN database is bundled).
PROCESS-NAME, PROCESS-PATH	Accepted, never matches — on iPhone, iPad and Mac.
DSCP	Accepted, never matches.
SUB-RULE, DOMAIN-WILDCARD, IP-SUFFIX, SRC-GEOIP, SRC-IP-ASN, SRC-IP-SUFFIX, IN-PORT, IN-TYPE, IN-USER, IN-NAME, PROCESS-NAME-REGEX, PROCESS-PATH-REGEX, UID, and any other type not listed on this page	Unknown type: the whole configuration fails to load. Remove these lines.

A rule of a supported type whose payload is invalid (a malformed CIDR, a bad port range, an invalid regular expression, NETWORK other than tcp / udp) is skipped; the rest of the rules still work.

Caution

GEOSITE categories with an attribute, such as GEOSITE,category-games@cn, never match. Use the plain category name. See GeoIP and GeoSite.