Back to Blog
Home/ Blog/ Clash YAML Configuration File Complete Reference

Clash YAML Configuration File Complete Reference

2026-07-26 Advanced 15 min read

Table of Contents

Clash's power lies in its high degree of configurability, and the configuration file is your only means of harnessing that power. A well-crafted YAML configuration gives you precise control over where every byte of traffic flows.

This guide starts from YAML syntax fundamentals and dissects every section of the Clash configuration file with extensive real-world examples, helping you progress from "can read" to "can write your own."

YAML Syntax Fundamentals

Clash uses YAML as its configuration format. Before diving into Clash specifics, ensure you understand YAML's core syntax rules.

1. Indentation Rules

YAML uses indentation to represent hierarchy. Never use Tab characters for indentation; always use spaces. Conventionally, 2 spaces per indent level.

# Correct example
port: 7890
dns:
  enable: true
  listen: 0.0.0.0:1053
  nameserver:
    - 223.5.5.5
    - 119.29.29.29

2. Key-Value Pairs

Keys and values are separated by a colon followed by a space (the space after the colon is mandatory):

# Strings
mode: rule

# Integers
port: 7890

# Booleans
allow-lan: true

3. Arrays (Lists)

Use hyphens - to denote list items:

# Standard list
nameserver:
  - 223.5.5.5
  - 119.29.29.29

# Inline syntax (also valid)
nameserver: [223.5.5.5, 119.29.29.29]

4. String Quoting

Most strings do not require quotes. However, strings containing special characters (colons, hash signs, quotes) must be quoted:

# No quotes needed
name: HK-01

# Quotes required (contains colon)
server: "example.com:443"

# Quotes required (starts with special character)
password: "!@#$%^&*"

# Double quotes support escape sequences
greeting: "Hello\nWorld"

5. Comments

Use # for comments, either on their own line or at the end of a value:

# This is a full-line comment
port: 7890  # This is an inline comment
Common YAML Mistakes
  • Mixing Tab and space indentation -- the most common cause of config loading failures
  • Missing space after colon: port:7890 (wrong) vs port: 7890 (correct)
  • Missing space after list hyphen: -223.5.5.5 (wrong) vs - 223.5.5.5 (correct)
  • Misaligned indentation: elements at the same level must be strictly aligned

Complete Clash Configuration Structure

A complete Clash configuration file contains the following top-level fields:

# Full configuration file skeleton
# ===== Basic Settings =====
port: 7890              # HTTP proxy port
socks-port: 7891        # SOCKS5 proxy port
redir-port: 7892        # Transparent proxy port (Linux only)
mixed-port: 7893        # Mixed proxy port (HTTP+SOCKS5)
allow-lan: false        # Allow LAN connections
bind-address: "*"       # Bind address
mode: rule              # Operating mode (rule/global/direct/script)
log-level: info         # Log verbosity

# ===== External Control =====
external-controller: 127.0.0.1:9090

# ===== Proxy Nodes =====
proxies: []

# ===== Policy Groups =====
proxy-groups: []

# ===== Routing Rules =====
rules: []

# ===== DNS Settings =====
dns: {}

# ===== Traffic Sniffing =====
tun: {}

# ===== Other Advanced =====
profile: {}
hosts: {}
script: {}
pre-processors: {}
Field Scope Overview
  • port/socks-port/mixed-port: Define local proxy listening ports; clients connect to Clash through these ports
  • mode: Determines traffic processing logic; rule=route by rules, global=all through proxy, direct=all direct
  • proxies: Defines all available proxy nodes
  • proxy-groups: Organizes nodes into groups with selection strategies
  • rules: Defines traffic routing rules, matched in order
  • dns: Built-in DNS server configuration affecting domain resolution behavior

Proxies Section: Protocol Field Reference

The proxies section defines all available proxy nodes. Each node is a dictionary containing the protocol type and connection parameters.

Shadowsocks (SS)

proxies:
  - name: "ss-hk"
    type: ss
    server: hk.example.com
    port: 8388
    cipher: aes-256-gcm      # Encryption method
    password: "your_password"
    udp: true                 # Enable UDP forwarding
    plugin: obfs              # Obfuscation plugin (optional)
    plugin-opts:
      mode: tls               # Obfuscation mode: http/tls
      host: www.microsoft.com  # Obfuscation target domain

ShadowsocksR (SSR)

proxies:
  - name: "ssr-jp"
    type: ssr
    server: jp.example.com
    port: 443
    cipher: aes-256-cfb
    password: "your_password"
    obfs: tls1.2_ticket_auth
    obfs-param: "your_param"
    protocol: auth_aes128_md5
    protocol-param: "your_param"

VMess

proxies:
  - name: "vmess-us"
    type: vmess
    server: us.example.com
    port: 443
    uuid: a3f8e1c4-d2b4-4a5e-9c6d-7e8f0a1b2c3d
    alterId: 0               # Recommend setting to 0 (AEAD encryption)
    cipher: auto             # auto/aes-128-gcm/chacha20-poly1305/none
    udp: true
    tls: true                # Enable TLS
    skip-cert-verify: false  # Skip certificate verification
    servername: us.example.com  # SNI
    network: ws              # Transport: tcp/ws/grpc/h2
    ws-opts:
      path: /vmess
      headers:
        Host: us.example.com
    # Or use gRPC
    # network: grpc
    # grpc-opts:
    #   grpc-service-name: vmess

Vless (Meta Core)

proxies:
  - name: "vless-sg"
    type: vless
    server: sg.example.com
    port: 443
    uuid: a3f8e1c4-d2b4-4a5e-9c6d-7e8f0a1b2c3d
    network: ws
    tls: true
    udp: true
    flow: xtls-rprx-vision   # Optional: XTLS flow control
    client-fingerprint: chrome  # TLS fingerprint spoofing
    ws-opts:
      path: /vless
      headers:
        Host: sg.example.com

Trojan

proxies:
  - name: "trojan-de"
    type: trojan
    server: de.example.com
    port: 443
    password: "your_password"
    sni: de.example.com
    skip-cert-verify: false
    udp: true
    # Optional: masquerade
    # network: grpc
    # grpc-opts:
    #   grpc-service-name: trojan

Hysteria2 (Meta Core)

proxies:
  - name: "hysteria2-us"
    type: hysteria2
    server: us.example.com
    port: 443
    password: "your_password"
    sni: us.example.com
    skip-cert-verify: false
    # Optional: bandwidth limits (to resolve throttling)
    # obfs: salamander
    # obfs-password: "obfs_pass"

TUIC (Meta Core)

proxies:
  - name: "tuic-jp"
    type: tuic
    server: jp.example.com
    port: 443
    uuid: a3f8e1c4-d2b4-4a5e-9c6d-7e8f0a1b2c3d
    password: "your_password"
    alpn:
      - h3
    sni: jp.example.com
    skip-cert-verify: false
    udp-relay-mode: native    # native/quic
    congestion-controller: bbr

Direct

proxies:
  - name: "direct"
    type: direct

Reject

proxies:
  - name: "reject"
    type: reject
Protocol Selection Guide
  • Performance-focused: TUIC, Hysteria2 (QUIC-based, low latency)
  • Stability-focused: Vless+Reality, Trojan (strong camouflage capabilities)
  • Universal compatibility: VMess+WebSocket+TLS (works in nearly all environments)
  • Simple and efficient: Shadowsocks (easy configuration, good performance)

Proxy Groups Section: Policy Group Types

The proxy-groups section organizes multiple nodes into policy groups, defining node selection logic. Clash supports several policy group types.

Select (Manual Selector)

proxy-groups:
  - name: "Proxy"
    type: select
    proxies:
      - HK-01
      - US-01
      - JP-01
      - SG-01
      - "Auto Best"    # Can reference other policy groups
      - DIRECT

Manually select one node. The simplest and most commonly used policy group type.

URL-Test (Automatic Speed Test Selection)

proxy-groups:
  - name: "Auto Best"
    type: url-test
    proxies:
      - HK-01
      - HK-02
      - HK-03
    url: "http://cp.cloudflare.com/generate_204"
    interval: 300        # Test interval (seconds)
    tolerance: 50        # Tolerance (ms), switch only if new node is 50ms+ faster
    lazy: true           # Lazy loading, no testing when not in use

Automatically selects the node with the lowest latency. Ideal for latency-sensitive scenarios.

Fallback

proxy-groups:
  - name: "Fallback"
    type: fallback
    proxies:
      - HK-01       # Primary node
      - US-01       # Backup 1
      - JP-01       # Backup 2
    url: "http://cp.cloudflare.com/generate_204"
    interval: 60

Tests node availability in order and uses the first available node. Automatically switches to backup when the primary becomes unavailable.

Load-Balance

proxy-groups:
  - name: "LoadBalance"
    type: load-balance
    proxies:
      - HK-01
      - HK-02
      - US-01
      - US-02
    strategy: consistent-hashing  # round-robin / consistent-hashing
    url: "http://cp.cloudflare.com/generate_204"
    interval: 300

Distributes traffic across multiple nodes. round-robin distributes by rotation; consistent-hashing distributes by consistent hashing (same domain always uses the same node).

Relay Chain

proxy-groups:
  - name: "Relay"
    type: relay
    proxies:
      - HK-01      # First hop
      - US-01      # Second hop
      - FINAL      # Final exit

Traffic passes through multiple nodes in sequence. Enables multi-hop proxying but increases latency.

Policy Group Nesting Rules
  • Policy groups can reference other policy groups (but circular references are forbidden)
  • Policy groups can reference DIRECT and REJECT
  • The use field can reference proxy sets defined in proxy-providers
  • Recommended: Use select groups as top-level, containing url-test and fallback sub-groups

Complete Policy Group Design Example

proxy-groups:
  # Top-level selector
  - name: "Proxy"
    type: select
    proxies:
      - "Auto Best"
      - "HK Nodes"
      - "US Nodes"
      - "JP Nodes"
      - DIRECT

  # Asia automatic selection
  - name: "Auto Best"
    type: url-test
    proxies:
      - "HK Nodes"
      - "JP Nodes"
      - "SG Nodes"
    url: "http://cp.cloudflare.com/generate_204"
    interval: 300
    tolerance: 50

  # Hong Kong node group
  - name: "HK Nodes"
    type: url-test
    proxies:
      - HK-01
      - HK-02
      - HK-03
    url: "http://cp.cloudflare.com/generate_204"
    interval: 300

  # United States node group
  - name: "US Nodes"
    type: url-test
    proxies:
      - US-01
      - US-02
    url: "http://cp.cloudflare.com/generate_204"
    interval: 300

  # Japan node group
  - name: "JP Nodes"
    type: url-test
    proxies:
      - JP-01
      - JP-02
    url: "http://cp.cloudflare.com/generate_204"
    interval: 300

  # Singapore node group
  - name: "SG Nodes"
    type: url-test
    proxies:
      - SG-01
    url: "http://cp.cloudflare.com/generate_204"
    interval: 300

Rules Section: Complete Rule Type Reference

The rules section defines traffic routing logic. Clash matches rules sequentially from top to bottom and stops at the first match.

Complete Rule Type List

Rule Types Overview
  • DOMAIN: Exact domain match
  • DOMAIN-SUFFIX: Domain suffix match
  • DOMAIN-KEYWORD: Domain keyword match
  • DOMAIN-REGEX: Domain regex match (Meta)
  • IP-CIDR: IPv4 CIDR range match
  • IP-CIDR6: IPv6 CIDR range match
  • SRC-IP-CIDR: Source IPv4 address match
  • SRC-IP-CIDR6: Source IPv6 address match
  • GEOIP: IP-based geolocation match
  • GEOSITE: Domain-based geolocation match (Meta)
  • SRC-PORT: Source port match
  • DST-PORT: Destination port match
  • PROCESS-NAME: Process name match
  • PROCESS-PATH: Process path match (Meta)
  • PROCESS-NAME-REGEX: Process name regex match (Meta)
  • PROCESS-PATH-REGEX: Process path regex match (Meta)
  • MATCH: Catch-all rule, matches all remaining traffic

Rule Examples by Type

rules:
  # === Exact domain ===
  - DOMAIN,www.google.com,Proxy
  - DOMAIN,scholar.google.com,Proxy

  # === Domain suffix ===
  - DOMAIN-SUFFIX,google.com,Proxy
  - DOMAIN-SUFFIX,youtube.com,Proxy
  - DOMAIN-SUFFIX,github.com,Proxy
  - DOMAIN-SUFFIX,baidu.com,DIRECT
  - DOMAIN-SUFFIX,taobao.com,DIRECT

  # === Domain keyword ===
  - DOMAIN-KEYWORD,google,Proxy
  - DOMAIN-KEYWORD,facebook,Proxy
  - DOMAIN-KEYWORD,twitter,Proxy

  # === IP-CIDR ===
  - IP-CIDR,192.168.0.0/16,DIRECT
  - IP-CIDR,10.0.0.0/8,DIRECT
  - IP-CIDR,127.0.0.0/8,DIRECT
  - IP-CIDR,172.16.0.0/12,DIRECT
  - IP-CIDR,104.16.0.0/13,Proxy,no-resolve

  # === GEOIP ===
  - GEOIP,CN,DIRECT
  - GEOIP,US,Proxy

  # === GEOSITE (Meta core) ===
  - GEOSITE,private,DIRECT
  - GEOSITE,cn,DIRECT
  - GEOSITE,geolocation-!cn,Proxy

  # === Port rules ===
  - DST-PORT,80,Proxy
  - DST-PORT,443,Proxy
  - SRC-PORT,53,DIRECT

  # === Process rules ===
  - PROCESS-NAME,chrome.exe,Proxy
  - PROCESS-NAME,Telegram.exe,Proxy
  - PROCESS-NAME,WeChat.exe,DIRECT

  # === Catch-all rule (must be last) ===
  - MATCH,DIRECT
Rule Ordering Matters

Clash matches rules from top to bottom. Place specific rules before general ones. A common mistake is placing GEOSITE,cn before DOMAIN-SUFFIX,google.com, which causes google.com to be incorrectly matched to DIRECT if it falls within the CN geolocation scope.

Rule Modifier Parameters

# no-resolve: Skip DNS resolution (for IP-CIDR rules)
- IP-CIDR,104.16.0.0/13,Proxy,no-resolve

# Meaning: If the matched traffic is still in domain form,
# skip resolving to IP before matching and try domain matching directly

DNS Section: Configuration and Optimization

DNS configuration is one of the most critical parts of Clash. Incorrect DNS settings can cause domain resolution failures, DNS leaks, and degraded access speeds.

Basic DNS Configuration

dns:
  enable: true               # Enable built-in DNS
  listen: 0.0.0.0:1053       # DNS listen address
  ipv6: false                # Resolve IPv6 addresses
  enhanced-mode: fake-ip     # DNS enhancement mode
  fake-ip-range: 198.18.0.1/16  # Fake-IP address pool
  fake-ip-filter:            # Fake-IP exception list
    - "*.lan"
    - "*.localdomain"
    - "*.example"
    - "*.invalid"
    - "*.local"
    - "dns.msftncsi.com"
    - "www.msftncsi.com"
    - "www.msftconnecttest.com"

DNS Enhancement Modes Compared

Three DNS Modes Compared
  • redir-host: Clash returns real IPs to applications. Pros: good compatibility. Cons: requires internal resolution each time, IPs may still be polluted.
  • fake-ip: Clash first returns a fake IP (198.18.x.x), then resolves the real IP upon actual connection. Pros: fast, anti-pollution. Cons: some apps may be incompatible.
  • normal: Standard DNS mode, does not intercept DNS requests (generally not recommended).
Recommended Mode

Use fake-ip mode for most scenarios. It offers the strongest resistance to DNS pollution and the fastest response times. If specific apps are incompatible (certain games, for example), add exceptions in fake-ip-filter.

Upstream DNS Server Configuration

dns:
  enable: true
  enhanced-mode: fake-ip
  fake-ip-range: 198.18.0.1/16

  # Default DNS (used to resolve other DNS servers' domains)
  # Must be plain IP addresses, not domain names
  default-nameserver:
    - 223.5.5.5
    - 119.29.29.29

  # Primary DNS (for resolving domestic domains)
  nameserver:
    - "tls://dns.alidns.com:853"
    - "https://dns.alidns.com/dns-query"
    - 223.5.5.5

  # Fallback DNS (for resolving foreign domains)
  fallback:
    - "tls://1.1.1.1:853"
    - "https://cloudflare-dns.com/dns-query"
    - "tls://dns.google:853"
    - "https://dns.cloudflare.com/dns-query"

  # Fallback filter conditions
  fallback-filter:
    geoip: true              # If primary DNS resolves to foreign IP, use fallback
    geoip-code: CN
    ipcidr:                  # If primary DNS result is in these ranges, consider polluted
      - 240.0.0.0/4

  # Per-domain DNS server assignment
  nameserver-policy:
    "+.google.com": "tls://8.8.8.8:853"
    "+.youtube.com": "tls://8.8.8.8:853"
    "+.github.com": "tls://1.1.1.1:853"
    "+.baidu.com": "tls://dns.alidns.com:853"
    "+.taobao.com": "tls://dns.alidns.com:853"

DNS over TLS / HTTPS

Strongly recommended to use encrypted DNS to prevent man-in-the-middle attacks and DNS pollution:

# DoT (DNS over TLS)
- "tls://8.8.8.8:853"
- "tls://1.1.1.1:853"
- "tls://dns.alidns.com:853"

# DoH (DNS over HTTPS)
- "https://dns.google/dns-query"
- "https://cloudflare-dns.com/dns-query"
- "https://dns.alidns.com/dns-query"

# Format reference:
# tls://IP:port     -- DoT
# https://domain/path -- DoH

DNS Caching and Optimization

dns:
  enable: true
  enhanced-mode: fake-ip
  # ...

  # DNS cache
  cache-all-dns: true        # Cache all DNS results
  respect-rules: true        # DNS resolution follows rules (important)

  # Listen port
  listen: 0.0.0.0:1053

Advanced Configuration: script, profile, tun, etc.

TUN Mode Configuration

tun:
  enable: true
  stack: system           # system/gvisor/mixed
  # Stack explanation:
  # system: Uses system TUN device, best performance but variable compatibility
  # gvisor: Uses userspace network stack, good compatibility with some overhead
  # mixed: Auto-selects best stack

  dns-hijack:
    - any:53              # Hijack all DNS requests on port 53
    - tcp://8.8.8.8:53    # Hijack specific DNS
    - tcp://1.1.1.1:53

  auto-route: true        # Auto-configure routing table
  auto-detect-interface: true  # Auto-detect outbound interface

  # Exclude specific IP ranges (avoid routing loops)
  # route-exclude-address:
  #   - 172.16.0.0/12
  #   - 192.168.0.0/16

  # Strict route (required on macOS)
  # strict-route: true

Profile Configuration

profile:
  store-selected: true     # Remember policy group selections
  store-fake-ip: true      # Preserve fake-ip mappings across restarts
  # When enabled, restarting Clash won't reset your manually selected nodes

Script (Experimental)

# Clash Premium supports JavaScript-based routing logic
script:
  code: |
    function main(ctx) {
      // ctx.type: "socks" | "http" | "redir" | "tun"
      // ctx.metadata: { host, port, name, type, ... }

      const host = ctx.metadata.host;

      // Custom logic
      if (host.endsWith(".google.com")) {
        return "Proxy";
      }
      if (host.endsWith(".baidu.com")) {
        return "DIRECT";
      }

      return "MATCH";
    }

Hosts Configuration

# Built-in hosts mapping (higher priority than DNS resolution)
hosts:
  # Exact match
  "localhost": 127.0.0.1
  # Domain wildcard
  "*.example.com": 1.2.3.4
  # Specific domain
  "api.example.com": 5.6.7.8

External Controller

# RESTful API configuration
external-controller: 127.0.0.1:9090

# API secret (for authentication during remote access)
secret: "your-secret-key"

# External UI (for use with Dashboard)
external-ui: /path/to/dashboard
external-ui-url: "https://yacd.haishan.me"

Pre-processors (Meta Core)

# Supports configuration pre-processing for config snippet reuse
pre-processors:
  - type: replace
    find: "PROXY_GROUP"
    replace: "Proxy"

# Or use include to import external config snippets
# pre-processors:
#   - type: include
#     path: ./common-rules.yaml

Configuration Inheritance and Overrides

Clash Meta supports configuration composition and overrides, letting you layer custom rules on top of subscription configurations.

Configuration Merging

Clients like Clash Verge Rev support "Merge"-type override configurations:

# merge.yaml - Merged into the main configuration
# Add custom rules
rules:
  - DOMAIN-SUFFIX,my-custom-site.com,Proxy
  - PROCESS-NAME,my-app.exe,Proxy

# Override DNS configuration
dns:
  enable: true
  enhanced-mode: fake-ip

# Add additional proxy nodes
proxies:
  - name: "my-local-proxy"
    type: direct

Pre-processor Directives

# Use pre-processor directives at the top of config files
# Define variables
# &pre-processor:
#   PROXY_NAME: "MyProxy"
#   DNS_SERVER: "tls://1.1.1.1:853"

# Use variables
# proxies:
#   - name: [[ PROXY_NAME ]]

Using External Proxy Providers

# Use proxy-providers to load external node lists
proxy-providers:
  my-sub:
    type: http
    url: "https://sub.example.com/api/v1/xxx"
    interval: 3600
    path: ./providers/my-sub.yaml
    health-check:
      enable: true
      interval: 600
      url: "http://cp.cloudflare.com/generate_204"

# Reference in policy groups
proxy-groups:
  - name: "Provider Nodes"
    type: select
    use:
      - my-sub

Common Configuration Error Troubleshooting

Error 1: YAML Parse Failure

# Error messages
"yaml: line XX: found character that cannot start any token"
"yaml: unmarshal errors"

Cause: Usually Tab indentation, missing space after colon, or unquoted special characters.

Solution: Use an online YAML validator (e.g., yaml-online-parser) to check configuration syntax.

Error 2: Proxy Node Cannot Connect

# Error message
"initial proxy provider error: ..."

Troubleshooting steps:

  1. Verify server address and port are correct
  2. Check that password/UUID was copied completely (watch for leading/trailing spaces)
  3. Verify cipher/encryption method matches
  4. Check TLS configuration (is sni/servername correct?)
  5. Try ping/telnet to the server address to confirm network reachability

Error 3: Rules Not Taking Effect

Common causes:

Error 4: DNS Configuration Ineffective

Key checks:

Error 5: TUN Mode Fails to Start

Common causes:

Configuration Validation Tool

Before starting Clash, validate your configuration from the command line:

# Validate configuration file syntax
clash -f config.yaml -t

# If valid, outputs "configuration file config.yaml test is successful"
# If errors exist, shows specific error messages and line numbers

Recommended Configuration Templates

Below is an optimized universal configuration template suitable for most use cases:

# ===================================
# Clash Universal Configuration Template
# For Clash Premium / Meta
# ===================================

# Basic settings
mixed-port: 7890
allow-lan: false
mode: rule
log-level: info
ipv6: false
unified-delay: true
tcp-concurrent: true

# External control
external-controller: 127.0.0.1:9090
profile:
  store-selected: true
  store-fake-ip: true

# TUN mode
tun:
  enable: true
  stack: mixed
  dns-hijack:
    - any:53
  auto-route: true
  auto-detect-interface: true

# DNS configuration
dns:
  enable: true
  listen: 0.0.0.0:1053
  ipv6: false
  enhanced-mode: fake-ip
  fake-ip-range: 198.18.0.1/16
  fake-ip-filter:
    - "*.lan"
    - "*.localdomain"
    - "*.example"
    - "*.invalid"
    - "*.local"
    - "dns.msftncsi.com"
    - "www.msftncsi.com"
    - "www.msftconnecttest.com"
  default-nameserver:
    - 223.5.5.5
    - 119.29.29.29
  nameserver:
    - "tls://dns.alidns.com:853"
    - "https://dns.alidns.com/dns-query"
  fallback:
    - "tls://1.1.1.1:853"
    - "https://cloudflare-dns.com/dns-query"
  fallback-filter:
    geoip: true
    geoip-code: CN
    ipcidr:
      - 240.0.0.0/4

# Proxy nodes (replace with your actual nodes)
proxies:
  - name: "HK-01"
    type: trojan
    server: hk.example.com
    port: 443
    password: "your_password"
    sni: hk.example.com
    udp: true
  - name: "US-01"
    type: vless
    server: us.example.com
    port: 443
    uuid: your-uuid-here
    network: ws
    tls: true
    udp: true
    ws-opts:
      path: /vless
      headers:
        Host: us.example.com

# Policy groups
proxy-groups:
  - name: "Proxy"
    type: select
    proxies:
      - "Auto Best"
      - "HK-01"
      - "US-01"
      - DIRECT

  - name: "Auto Best"
    type: url-test
    proxies:
      - "HK-01"
      - "US-01"
    url: "http://cp.cloudflare.com/generate_204"
    interval: 300
    tolerance: 50

  - name: "Streaming"
    type: select
    proxies:
      - "US-01"
      - "HK-01"
      - "Proxy"

# Routing rules
rules:
  # Private network direct
  - DOMAIN-SUFFIX,local,DIRECT
  - DOMAIN-SUFFIX,localhost,DIRECT
  - IP-CIDR,127.0.0.0/8,DIRECT
  - IP-CIDR,172.16.0.0/12,DIRECT
  - IP-CIDR,192.168.0.0/16,DIRECT
  - IP-CIDR,10.0.0.0/8,DIRECT

  # Streaming via dedicated policy group
  - DOMAIN-SUFFIX,youtube.com,Streaming
  - DOMAIN-SUFFIX,netflix.com,Streaming
  - DOMAIN-SUFFIX,disneyplus.com,Streaming

  # Common proxies
  - DOMAIN-SUFFIX,google.com,Proxy
  - DOMAIN-SUFFIX,github.com,Proxy
  - DOMAIN-SUFFIX,telegram.org,Proxy
  - DOMAIN-KEYWORD,google,Proxy

  # Domestic direct
  - DOMAIN-SUFFIX,baidu.com,DIRECT
  - DOMAIN-SUFFIX,taobao.com,DIRECT
  - DOMAIN-SUFFIX,jd.com,DIRECT
  - DOMAIN-SUFFIX,qq.com,DIRECT
  - DOMAIN-SUFFIX,weixin.qq.com,DIRECT

  # GEOIP fallback
  - GEOIP,CN,DIRECT

  # Final rule
  - MATCH,Proxy
Template Usage Tips
  • Replace node information with your own subscription nodes
  • Adjust rules as needed, adding or removing domains
  • Streaming policy groups can direct different platforms to different regional nodes
  • Update configurations regularly to keep rules and node lists current
  • Consider maintaining multiple configurations for different use cases with quick switching

Related Articles