Clash Split Routing Rules: Route Domestic and International Traffic Separately

2026-07-26 12 min read

What Is Split Routing?
Why You Need Split Routing
How Clash Rule Matching Works
Common Rule Types Explained
Practical Configuration: Domestic Direct + Proxy
Using Rule Providers
Real-World Split Routing Scenarios
Rule Debugging Techniques
Recommended Rule Set Projects

Split routing rules are one of Clash's most powerful features. The idea is simple: route different types of traffic through different channels. Domestic websites connect directly, international websites go through a proxy, and ad domains get blocked outright. Proper split routing affects speed, stability, and security. This guide covers everything from basic principles to advanced scenarios, helping you build the optimal routing setup.

What Is Split Routing?

Split Routing refers to directing different types of network traffic to different outbound channels based on predefined rules. In the context of Clash, split routing typically means:

Domestic traffic goes direct: When visiting domestic websites (e.g., Google, YouTube, or local sites depending on your country), traffic connects directly to the target server without going through a proxy
International traffic goes through proxy: When visiting foreign websites (e.g., services blocked in your region), traffic is routed through a proxy server
Specific traffic gets targeted handling: Such as blocking ad domains, routing specific app traffic to designated nodes, etc.

Core Logic of Split Routing

Clash's split routing is essentially a decision process: when each network request arrives at Clash, it goes through the rules list in the configuration file from top to bottom. The first matching rule determines the traffic's final destination. If no rules match, the final MATCH catch-all rule decides.

Why You Need Split Routing

1. Speed Optimization

If domestic websites are routed through an overseas proxy server, latency increases dramatically. A request that normally takes 10ms could become 300ms+ through a proxy. Split routing keeps domestic traffic direct, maintaining millisecond response times.

2. Stability Assurance

Proxy server connections can be unstable, with potential disconnections or packet loss. If domestic traffic also goes through the proxy, any proxy failure would make domestic websites inaccessible too. Split routing isolates the risk: even when the proxy is down, domestic sites remain accessible.

3. Compliance Considerations

Some services restrict or apply additional scrutiny to access from foreign IP addresses. Using a domestic IP for direct connections avoids triggering these risk controls and keeps your accounts safe.

4. Bandwidth Conservation

Proxy servers typically have limited bandwidth. If all traffic goes through the proxy, including high-bandwidth domestic video streaming and downloads, it quickly exhausts the proxy bandwidth. Split routing keeps high-bandwidth domestic operations on direct connections, preserving proxy bandwidth for what actually needs it.

Consequences of No Split Routing

If you use global proxy mode, all traffic (including domestic websites) goes through the proxy. This results in: slower domestic websites, proxy bandwidth quickly consumed, and total disconnection when the proxy fails. Split routing is the core solution to all these problems.

How Clash Rule Matching Works

Understanding the rule matching mechanism is fundamental to configuring split routing correctly. Here's how Clash's rule engine works:

Matching Process

Top-to-Bottom Sequential Matching

Clash reads the rules list in the configuration file, starting from the first entry, and checks each rule against the current request. Once a rule matches, matching stops immediately, and the traffic is directed to the policy group specified by that rule. Subsequent rules are not checked.

This means rule order is critical. More specific rules should come first, and more general rules should come later.

Matching Example

rules:
  # Rule 1: Exact domain match for bilibili.com -> Direct
  - DOMAIN,bilibili.com,DIRECT
  
  # Rule 2: Domain suffix match for google.com -> Proxy
  - DOMAIN-SUFFIX,google.com,Proxy
  
  # Rule 3: All domestic IPs -> Direct
  - GEOIP,CN,DIRECT
  
  # Rule 4: Catch-all -> Proxy
  - MATCH,Proxy

When visiting bilibili.com:

Check Rule 1: DOMAIN,bilibili.com -> exact match -> goes DIRECT
Subsequent rules are not checked

When visiting google.com:

Check Rule 1: no match (not bilibili.com)
Check Rule 2: DOMAIN-SUFFIX,google.com -> matches google.com and all subdomains -> goes Proxy

Wrong Order Example

If you put MATCH,Proxy at the very beginning of your rules list, all traffic will go through the proxy, and subsequent rules will never be evaluated. This is one of the most common configuration mistakes. Always remember: the MATCH rule must come last.

Common Rule Types Explained

Clash supports multiple rule types, each suited for different matching scenarios:

DOMAIN: Exact Domain Match

Matches only the exact domain, not subdomains.

# Only matches www.google.com, not mail.google.com
- DOMAIN,www.google.com,Proxy

DOMAIN-SUFFIX: Domain Suffix Match

Matches the domain and all its subdomains. This is the most commonly used domain matching type.

# Matches google.com, www.google.com, mail.google.com, a.b.google.com...
- DOMAIN-SUFFIX,google.com,Proxy

DOMAIN-KEYWORD: Domain Keyword Match

Matches all requests where the domain contains a specific keyword.

# Matches any domain containing "google"
- DOMAIN-KEYWORD,google,Proxy

IP-CIDR / IP-CIDR6: IP Range Match

Matches whether the target IP falls within a specified CIDR range. Commonly used for LAN and specific IP range routing.

# Match all IPs in 192.168.0.0/16 range (LAN)
- IP-CIDR,192.168.0.0/16,DIRECT

# Match all IPs in 10.0.0.0/8 range
- IP-CIDR,10.0.0.0/8,DIRECT

# IPv6 example
- IP-CIDR6,fd00::/8,DIRECT

GEOIP: Geolocation Match

Determines the country/region of the target IP based on a geolocation database. Most commonly used to distinguish between domestic and international IPs.

# China mainland IPs go direct
- GEOIP,CN,DIRECT

# US IPs go through proxy
- GEOIP,US,Proxy

GEOIP Notes

GEOIP relies on geolocation databases from providers like MaxMind. These databases are not 100% accurate and occasional misidentifications occur. If accuracy is critical, combine GEOIP with DOMAIN rules for a double layer of assurance.

MATCH: Catch-All Rule

Matches all traffic not matched by any previous rule. Must be the last rule in the list.

# All other traffic goes through proxy
- MATCH,Proxy

# Or: all other traffic goes direct
- MATCH,DIRECT

DST-PORT / SRC-PORT: Port Matching

# Destination port 80 and 443 traffic goes through proxy
- DST-PORT,80,Proxy
- DST-PORT,443,Proxy

# Source port 53 (DNS) traffic goes direct
- SRC-PORT,53,DIRECT

PROCESS-NAME / PROCESS-PATH (Meta Exclusive)

# Chrome browser goes through proxy
- PROCESS-NAME,chrome.exe,Proxy

# WeChat goes direct
- PROCESS-NAME,WeChat.exe,DIRECT

# Match by path (Linux/macOS)
- PROCESS-PATH,/usr/bin/wget,DIRECT

Practical Configuration: Domestic Direct + Proxy

Here's a battle-tested split routing configuration suitable for most users:

# Policy groups
proxy-groups:
  - name: Proxy
    type: select
    proxies:
      - Auto
      - HK Node
      - JP Node
      - US Node

  - name: Auto
    type: url-test
    proxies:
      - HK Node
      - JP Node
      - US Node
    url: https://www.gstatic.com/generate_204
    interval: 300

# Rules
rules:
  # === Layer 1: Exact domain rules (highest priority) ===
  
  # Block ad domains
  - DOMAIN-SUFFIX,ad.com,REJECT
  - DOMAIN-KEYWORD,admarvel,REJECT
  - DOMAIN-KEYWORD,admaster,REJECT
  - DOMAIN-KEYWORD,adsage,REJECT
  - DOMAIN-KEYWORD,adwords,REJECT
  - DOMAIN-KEYWORD,analytics,REJECT
  
  # Domestic sites go direct
  - DOMAIN-SUFFIX,cn,DIRECT
  - DOMAIN-SUFFIX,baidu.com,DIRECT
  - DOMAIN-SUFFIX,taobao.com,DIRECT
  - DOMAIN-SUFFIX,tmall.com,DIRECT
  - DOMAIN-SUFFIX,jd.com,DIRECT
  - DOMAIN-SUFFIX,alipay.com,DIRECT
  - DOMAIN-SUFFIX,163.com,DIRECT
  - DOMAIN-SUFFIX,126.net,DIRECT
  - DOMAIN-SUFFIX,bilibili.com,DIRECT
  - DOMAIN-SUFFIX,bilivideo.com,DIRECT
  - DOMAIN-SUFFIX,zhihu.com,DIRECT
  - DOMAIN-SUFFIX,douyin.com,DIRECT
  - DOMAIN-SUFFIX,bytedance.com,DIRECT
  - DOMAIN-SUFFIX,weibo.com,DIRECT
  - DOMAIN-SUFFIX,qq.com,DIRECT
  - DOMAIN-SUFFIX,wechat.com,DIRECT
  - DOMAIN-SUFFIX,microsoft.com,DIRECT
  
  # === Layer 2: Domains that need proxy ===
  
  # Google suite
  - DOMAIN-SUFFIX,google.com,Proxy
  - DOMAIN-SUFFIX,googleapis.com,Proxy
  - DOMAIN-SUFFIX,googlevideo.com,Proxy
  - DOMAIN-SUFFIX,gstatic.com,Proxy
  - DOMAIN-SUFFIX,ggpht.com,Proxy
  
  # Social media
  - DOMAIN-SUFFIX,twitter.com,Proxy
  - DOMAIN-SUFFIX,x.com,Proxy
  - DOMAIN-SUFFIX,facebook.com,Proxy
  - DOMAIN-SUFFIX,instagram.com,Proxy
  - DOMAIN-SUFFIX,telegram.org,Proxy
  - DOMAIN-SUFFIX,t.me,Proxy
  
  # Developer tools
  - DOMAIN-SUFFIX,github.com,Proxy
  - DOMAIN-SUFFIX,githubusercontent.com,Proxy
  - DOMAIN-SUFFIX,stackoverflow.com,Proxy
  - DOMAIN-SUFFIX,npmjs.org,Proxy
  - DOMAIN-SUFFIX,pypi.org,Proxy
  
  # Streaming
  - DOMAIN-SUFFIX,youtube.com,Proxy
  - DOMAIN-SUFFIX,ytimg.com,Proxy
  - DOMAIN-SUFFIX,netflix.com,Proxy
  - DOMAIN-SUFFIX,nflxvideo.net,Proxy
  - DOMAIN-SUFFIX,spotify.com,Proxy
  - DOMAIN-SUFFIX,twitch.tv,Proxy
  
  # AI services
  - DOMAIN-SUFFIX,openai.com,Proxy
  - DOMAIN-SUFFIX,chatgpt.com,Proxy
  - DOMAIN-SUFFIX,anthropic.com,Proxy
  - DOMAIN-SUFFIX,claude.ai,Proxy
  
  # === Layer 3: LAN and private addresses go direct ===
  - DOMAIN-SUFFIX,local,DIRECT
  - IP-CIDR,127.0.0.0/8,DIRECT
  - IP-CIDR,172.16.0.0/12,DIRECT
  - IP-CIDR,192.168.0.0/16,DIRECT
  - IP-CIDR,10.0.0.0/8,DIRECT
  - IP-CIDR,224.0.0.0/4,DIRECT
  
  # === Layer 4: Geolocation-based IP routing ===
  - GEOIP,CN,DIRECT
  
  # === Layer 5: Catch-all rule ===
  - MATCH,Proxy

Rule Ordering Principle

Remember this priority order: Ad blocking > Exact domains > Common domain suffixes > LAN > GeoIP > Catch-all. More specific rules first, more general rules last.

Using Rule Providers

Maintaining hundreds of rules manually is painful. Rule Providers let you reference community-maintained rule files that automatically stay updated.

What Are Rule Providers?

Rule Providers are a mechanism provided by Clash (especially Meta) that allows you to define rules in external files and reference them via URL or local file path. Your main configuration only needs to reference the rule sets rather than containing all the individual rule entries.

Configuration Example

# Define rule providers
rule-providers:
  # Ad blocking rule set
  reject:
    type: http              # Download from HTTP
    behavior: domain        # Behavior type: domain/ipclassical
    url: "https://cdn.jsdelivr.net/gh/MetaCubeX/meta-rules-dat@release/lite/reject.yaml"
    path: ./ruleset/reject.yaml
    interval: 86400         # Update interval (seconds), once per day

  # Domains that need proxy
  proxy:
    type: http
    behavior: domain
    url: "https://cdn.jsdelivr.net/gh/MetaCubeX/meta-rules-dat@release/lite/proxy.yaml"
    path: ./ruleset/proxy.yaml
    interval: 86400

  # Domestic direct domains
  direct:
    type: http
    behavior: domain
    url: "https://cdn.jsdelivr.net/gh/MetaCubeX/meta-rules-dat@release/lite/direct.yaml"
    path: ./ruleset/direct.yaml
    interval: 86400

  # Domestic IP ranges
  cn-ip:
    type: http
    behavior: ip
    url: "https://cdn.jsdelivr.net/gh/MetaCubeX/meta-rules-dat@release/lite/cn.yaml"
    path: ./ruleset/cn.yaml
    interval: 86400

  # LAN IP ranges
  lancidr:
    type: http
    behavior: ipcidr
    url: "https://cdn.jsdelivr.net/gh/MetaCubeX/meta-rules-dat@release/lite/lancidr.yaml"
    path: ./ruleset/lancidr.yaml
    interval: 86400

# Reference rule sets in rules
rules:
  # Apply ad blocking rule set first
  - RULE-SET,reject,REJECT
  # Then apply domains that need proxy
  - RULE-SET,proxy,Proxy
  # LAN IPs go direct
  - RULE-SET,lancidr,DIRECT
  # Domestic domains go direct
  - RULE-SET,direct,DIRECT
  # Domestic IPs go direct
  - RULE-SET,cn-ip,DIRECT
  # Catch-all goes through proxy
  - MATCH,Proxy

Behavior Types Explained

Three Behavior Types
domain: Domain rule sets containing DOMAIN and DOMAIN-SUFFIX rules
ipcidr: IP CIDR rule sets containing IP-CIDR and IP-CIDR6 rules
classical: Classical rule sets containing all rule types (DOMAIN, IP-CIDR, DST-PORT, etc.)

Rule Provider Best Practices

When using type: http, Clash automatically downloads the latest rule set from the URL at the interval specified by interval. Set it to 86400 (24 hours) for daily updates. Rule sets are cached at the local path specified by path, so even if the network is temporarily unavailable, cached rules can still be used.

Real-World Split Routing Scenarios

Scenario 1: Streaming Service Routing

Different streaming services may require nodes from specific regions to unlock content.

proxy-groups:
  - name: Netflix
    type: select
    proxies:
      - US Node
      - JP Node
      - HK Node
      - Proxy
    filter: "US|United States"   # Only select US nodes

  - name: DisneyPlus
    type: select
    proxies:
      - US Node
      - JP Node
      - Proxy

  - name: Spotify
    type: select
    proxies:
      - US Node
      - Proxy

rules:
  # Netflix routes to dedicated policy group
  - DOMAIN-SUFFIX,netflix.com,Netflix
  - DOMAIN-SUFFIX,nflxvideo.net,Netflix
  - DOMAIN-SUFFIX,nflximg.net,Netflix
  - DOMAIN-SUFFIX,nflxso.net,Netflix
  - DOMAIN-SUFFIX,nflxext.com,Netflix
  
  # Disney+ routing
  - DOMAIN-SUFFIX,disneyplus.com,DisneyPlus
  - DOMAIN-SUFFIX,bamgrid.com,DisneyPlus
  - DOMAIN-SUFFIX,disney-plus.net,DisneyPlus
  
  # Spotify routing
  - DOMAIN-SUFFIX,spotify.com,Spotify
  - DOMAIN-SUFFIX,scdn.co,Spotify
  
  # Other streaming goes through default proxy
  - DOMAIN-SUFFIX,youtube.com,Proxy
  - DOMAIN-SUFFIX,twitch.tv,Proxy
  - DOMAIN-SUFFIX,hbomax.com,Proxy

Scenario 2: Gaming Routing

Games are extremely latency-sensitive and typically need the physically closest node.

proxy-groups:
  - name: GameProxy
    type: url-test
    proxies:
      - HK Node
      - JP Node
      - KR Node
    tolerance: 50
    url: https://www.gstatic.com/generate_204
    interval: 60

rules:
  # Steam store and downloads
  - DOMAIN-SUFFIX,steampowered.com,GameProxy
  - DOMAIN-SUFFIX,steamstatic.com,GameProxy
  - DOMAIN-SUFFIX,steamcontent.com,DIRECT  # Downloads via CDN direct
  
  # Epic Games
  - DOMAIN-SUFFIX,epicgames.com,GameProxy
  
  # Riot Games (League of Legends, etc.)
  - DOMAIN-SUFFIX,riotgames.com,GameProxy
  
  # Blizzard
  - DOMAIN-SUFFIX,blizzard.com,GameProxy
  - DOMAIN-SUFFIX,battle.net,GameProxy
  
  # Nintendo
  - DOMAIN-SUFFIX,nintendo.com,GameProxy
  - DOMAIN-SUFFIX,nintendo.net,GameProxy

Scenario 3: Work Tools Routing

Route work-related services (email, collaboration tools, etc.) separately to ensure they're not affected by proxy fluctuations.

proxy-groups:
  - name: WorkTools
    type: select
    proxies:
      - DIRECT
      - Proxy
      - JP Node

rules:
  # Domestic work tools go direct
  - DOMAIN-SUFFIX,dingtalk.com,DIRECT
  - DOMAIN-SUFFIX,feishu.cn,DIRECT
  - DOMAIN-SUFFIX,work.weixin.qq.com,DIRECT
  - DOMAIN-SUFFIX,yuque.com,DIRECT
  
  # International work tools go through proxy
  - DOMAIN-SUFFIX,slack.com,WorkTools
  - DOMAIN-SUFFIX,notion.so,WorkTools
  - DOMAIN-SUFFIX,notion.site,WorkTools
  - DOMAIN-SUFFIX,google.com,WorkTools
  - DOMAIN-SUFFIX,googleapis.com,WorkTools
  - DOMAIN-SUFFIX,drive.google.com,WorkTools
  - DOMAIN-SUFFIX,zoom.us,WorkTools

Scenario 4: Per-Process Routing (Meta Exclusive)

The Meta core supports routing by process name, giving you precise control over which applications use the proxy:

rules:
  # Browsers go through proxy (for international websites)
  - PROCESS-NAME,chrome.exe,Proxy
  - PROCESS-NAME,firefox.exe,Proxy
  - PROCESS-NAME,msedge.exe,Proxy
  
  # Chat apps go direct
  - PROCESS-NAME,WeChat.exe,DIRECT
  - PROCESS-NAME,DingTalk.exe,DIRECT
  
  # Download tools go through proxy
  - PROCESS-NAME,qbittorrent.exe,Proxy

Rule Debugging Techniques

After configuring split routing rules, how do you verify they work as expected? Here are practical debugging methods:

1. Check the Logs

Clash's logging is the most important debugging tool. Enable debug-level logging to see the rule matching process for every request:

# Set log level in configuration file
log-level: debug

Example log output:

DEBU [Rule] match google.com DOMAIN-SUFFIX google.com -> Proxy
DEBU [Rule] match bilibili.com DOMAIN-SUFFIX bilibili.com -> DIRECT
DEBU [DNS] resolve www.google.com -> 142.250.80.4
DEBU [Rule] match 142.250.80.4 GEOIP US -> Proxy

Each log entry shows:

The matched rule type (e.g., DOMAIN-SUFFIX)
The specific matched value (e.g., google.com)
The final policy group (e.g., Proxy or DIRECT)

2. Use the API to Query Match Results

Clash's RESTful API provides real-time query capabilities:

# Query all current connections and matching rules
curl -s http://127.0.0.1:9090/connections | jq '.connections[] | {host: .metadata.host, rule: .rule, chains: .chains}'

3. Use Testing Websites to Verify

Visit these websites to verify split routing works correctly:

ip.sb: Check your exit IP. With proper routing, domestic sites show domestic IP, proxy shows proxy IP
browserleaks.com: Detect DNS leaks
ipleak.net: Check for IP and DNS leaks

4. Common Problem Troubleshooting

Common Debugging Issues

Domestic sites going through proxy: Check rule order; ensure domestic domain rules come before GEOIP and MATCH
International sites connecting directly: Check if proxy domains are correctly included, or if GEOIP database misidentifies the target IP as domestic
Rule sets not taking effect: Verify the rule-providers URL is accessible and the path is correct
Some apps not using proxy: Check if the app respects system proxy settings; you may need TUN mode to capture all traffic

Recommended Rule Set Projects

Here are well-maintained, frequently updated rule set projects from the community that you can use directly:

Recommended Rule Set Projects
MetaCubeX/meta-rules-dat: Officially maintained by the Meta team, available in lite (streamlined) and full versions. Highest quality, most frequently updated. Strongly recommended.
Loyalsoldier/clash-rules: A classic Clash rule set covering ad blocking, proxy, direct, and more. Widely recognized in the community.
blackmatrix7/ios_rule_script: Despite the iOS name in the title, the rules are universal. Extremely granular categorization including individual rules for major streaming, social, and shopping platforms.
ACL4SSR/ACL4SSR: ACL rule sets designed specifically for SSR/Clash, optimized for mainland China network environments.

Quick Setup with MetaCubeX Official Rule Sets

rule-providers:
  reject:
    type: http
    behavior: domain
    url: "https://cdn.jsdelivr.net/gh/MetaCubeX/meta-rules-dat@release/lite/reject.yaml"
    path: ./ruleset/reject.yaml
    interval: 86400

  proxy:
    type: http
    behavior: domain
    url: "https://cdn.jsdelivr.net/gh/MetaCubeX/meta-rules-dat@release/lite/proxy.yaml"
    path: ./ruleset/proxy.yaml
    interval: 86400

  direct:
    type: http
    behavior: domain
    url: "https://cdn.jsdelivr.net/gh/MetaCubeX/meta-rules-dat@release/lite/direct.yaml"
    path: ./ruleset/direct.yaml
    interval: 86400

  cn-ip:
    type: http
    behavior: ip
    url: "https://cdn.jsdelivr.net/gh/MetaCubeX/meta-rules-dat@release/lite/cn.yaml"
    path: ./ruleset/cn.yaml
    interval: 86400

  lancidr:
    type: http
    behavior: ipcidr
    url: "https://cdn.jsdelivr.net/gh/MetaCubeX/meta-rules-dat@release/lite/lancidr.yaml"
    path: ./ruleset/lancidr.yaml
    interval: 86400

  gfw:
    type: http
    behavior: domain
    url: "https://cdn.jsdelivr.net/gh/MetaCubeX/meta-rules-dat@release/lite/gfw.yaml"
    path: ./ruleset/gfw.yaml
    interval: 86400

  telegramcidr:
    type: http
    behavior: ipcidr
    url: "https://cdn.jsdelivr.net/gh/MetaCubeX/meta-rules-dat@release/lite/telegramcidr.yaml"
    path: ./ruleset/telegramcidr.yaml
    interval: 86400

rules:
  # Ad blocking
  - RULE-SET,reject,REJECT
  # Telegram IP ranges via proxy
  - RULE-SET,telegramcidr,Proxy
  # Domains that need proxy
  - RULE-SET,gfw,Proxy
  - RULE-SET,proxy,Proxy
  # LAN direct
  - RULE-SET,lancidr,DIRECT
  # Domestic domains direct
  - RULE-SET,direct,DIRECT
  # Domestic IPs direct
  - RULE-SET,cn-ip,DIRECT
  # Catch-all proxy
  - MATCH,Proxy

Rule Set Usage Tips

We recommend using MetaCubeX's official rule sets first, as they're specifically optimized for Clash Meta. If using the original Clash, Loyalsoldier or ACL4SSR rule sets offer better compatibility. More rule sets isn't necessarily better. Choose one well-maintained set and add custom rules as needed for your specific situation.