Clash Rule-Based Traffic Splitting: Domestic/Overseas Auto-Routing Setup

1. What Problem Does Traffic Splitting Solve

Without any traffic differentiation, Clash only offers two blunt operating modes. Global proxy (global) routes every connection through a node: local sites take a detour through overseas servers, latency jumps noticeably, video and music services block overseas IPs due to regional licensing, and banking or government sites flag overseas logins as suspicious. Global direct (direct) is the opposite—overseas services become completely unreachable.

Rule-based routing (rule) is the third option: the core checks each new connection's destination against the rules list in order—domestic domains and IPs go direct, overseas services get routed through a proxy node, and known ad/tracking domains are blocked outright. Once set up, it keeps working indefinitely, with no need to manually switch modes day to day. This guide walks through building this exact setup using a config you can apply directly.

2. How Rule Matching Works

rules is an ordered list. Each new connection is checked against the rules from top to bottom, and matching stops at the first rule that applies—the connection is then handled according to that rule's outbound target. If nothing matches, the MATCH rule at the bottom of the list catches everything else. Two takeaways follow from this:

• Order equals priority. The most specific, highest-priority rules go first; broad-coverage rules (like GEOIP,CN) go further down; MATCH always goes last.
• Domain rules are checked before IP rules. When a connection carries a domain name, the core first checks it against DOMAIN, DOMAIN-SUFFIX, RULE-SET, and similar rules; only if none match does it resolve the IP and move on to IP-CIDR and GEOIP checks. Adding the no-resolve parameter to IP-based rules lets the core skip that rule entirely before resolution, avoiding an unnecessary DNS lookup just to evaluate the rule.

Common rule types are listed below:

3. Setting Up Proxy Groups

In a routing setup, every connection has only three possible destinations: direct (DIRECT), block (REJECT), or hand-off to a proxy node. The proxy side is typically organized into three groups:

• Node Select (select type): lists all available nodes for manual outbound selection, and serves as the default outbound for most rules.
• Auto Select (url-test type): periodically tests latency across the group and automatically switches to the fastest node; add it as a candidate inside Node Select for one-click switching when needed.
• Ad Block (select type): only REJECT and DIRECT as candidates. Defaults to REJECT; if a site seems to be blocked by mistake, temporarily switch to DIRECT to verify.

proxy-groups:
  - name: Node Select
    type: select
    proxies:
      - Auto Select
      - Hong Kong Node
      - Japan Node
      - DIRECT

  - name: Auto Select
    type: url-test
    proxies:
      - Hong Kong Node
      - Japan Node
    url: http://www.gstatic.com/generate_204
    interval: 300

  - name: Ad Block
    type: select
    proxies:
      - REJECT
      - DIRECT

Proxy group names appear verbatim in rules, so if you rename one, update both places—otherwise a rule will point to an outbound that no longer exists.

4. Bringing In Rule Sets

With tens of thousands of domains to cover, hand-writing rules isn't realistic. Community-maintained rule sets organize domains by purpose—ad domains, domestic sites, common overseas services, domestic IP ranges—which the core downloads on a schedule and caches locally. Declare them by adding rule-providers at the top level of your config:

rule-providers:
  reject:
    type: http
    behavior: classical
    url: "https://raw.githubusercontent.com/Loyalsoldier/clash-rules/release/reject.txt"
    path: ./ruleset/reject.yaml
    interval: 86400

Field descriptions:

• type: http downloads from a remote URL; file reads from a local file.
• behavior: classical means the list is made up of classic rules (DOMAIN, DOMAIN-SUFFIX, etc.); domain means a plain domain list; ipcidr means a plain IP range list. This must match whatever format the source actually uses, or the rule set will fail to load.
• path: local cache path.
• interval: update interval in seconds; 86400 means once a day.

Once declared, reference it in rules with RULE-SET,<name>,<outbound>. mihomo users have another option: the core ships with built-in GEOSITE and GEOIP databases, so syntax like GEOSITE,cn, GEOSITE,category-ads-all, and GEOIP,CN works without any rule-providers—at the cost of letting the database maintainer decide the categorization granularity.

This guide uses release files from the Loyalsoldier/clash-rules project. Its purpose-split lists—reject (ads), direct (domestic), proxy (overseas), cncidr (domestic IP ranges)—are updated frequently and widely used; feel free to swap in any trusted source instead, the syntax stays the same.

5. Full Configuration Example

Putting all the pieces together gives a complete domestic/overseas routing config:

# Basic settings
mixed-port: 7890
allow-lan: false
mode: rule
log-level: info

# Built-in DNS: resolution result feeds GEOIP checks when domain rules don't match
dns:
  enable: true
  ipv6: false
  default-nameserver:
    - 223.5.5.5
    - 119.29.29.29
  nameserver:
    - https://doh.pub/dns-query
    - https://dns.alidns.com/dns-query

# Proxy groups (see section 3)
proxy-groups:
  - name: Node Select
    type: select
    proxies:
      - Auto Select
      - Hong Kong Node
      - Japan Node
      - DIRECT
  - name: Auto Select
    type: url-test
    proxies:
      - Hong Kong Node
      - Japan Node
    url: http://www.gstatic.com/generate_204
    interval: 300
  - name: Ad Block
    type: select
    proxies:
      - REJECT
      - DIRECT

# Remote rule sets (see section 4)
rule-providers:
  reject:
    type: http
    behavior: classical
    url: "https://raw.githubusercontent.com/Loyalsoldier/clash-rules/release/reject.txt"
    path: ./ruleset/reject.yaml
    interval: 86400
  direct:
    type: http
    behavior: classical
    url: "https://raw.githubusercontent.com/Loyalsoldier/clash-rules/release/direct.txt"
    path: ./ruleset/direct.yaml
    interval: 86400
  proxy:
    type: http
    behavior: classical
    url: "https://raw.githubusercontent.com/Loyalsoldier/clash-rules/release/proxy.txt"
    path: ./ruleset/proxy.yaml
    interval: 86400

# Routing rules: top to bottom, stop on first match
rules:
  - IP-CIDR,127.0.0.0/8,DIRECT,no-resolve
  - IP-CIDR,192.168.0.0/16,DIRECT,no-resolve
  - RULE-SET,reject,Ad Block
  - RULE-SET,direct,DIRECT
  - RULE-SET,proxy,Node Select
  - GEOIP,CN,DIRECT
  - MATCH,Node Select

Here's the logic behind the rule ordering:

1. Local and LAN addresses go direct, with no-resolve added to skip unnecessary DNS lookups.
2. Ad and tracking domains get routed to the Ad Block group, which defaults to REJECT. Placing this first ensures later rules don't accidentally let them through.
3. Domestic domains go direct.
4. Common overseas services go through Node Select.
5. For connections that don't match any domain rule, the IP is resolved and checked against GEOIP; if it's domestic, it goes direct.
6. MATCH catches everything else and routes it through the proxy. It's better to have a few obscure domestic sites take the long way than to leak overseas traffic through direct.

Note: the proxies section (your node list) must include nodes literally named "Hong Kong Node" and "Japan Node", or the proxy group references will fail to resolve and the config won't load; swap in the actual node names from your own subscription.

6. Verifying and Common Mistakes

Verifying Traffic Splitting Works

1. Open the client's connections panel (or an external dashboard like metacubexd or zashboard)—every connection is tagged with the rule it matched and its outbound chain, e.g. RULE-SET(direct) → DIRECT.
2. Visit a domestic site, an overseas site, and a known ad domain, then check the panel to confirm each one landed where it should.
3. When visiting an overseas site, check your exit IP—it should show the proxy node's location, not your actual broadband IP.

Common Mistakes

• Rules in the wrong order. Putting GEOIP,CN too early can intercept overseas subdomains that should have gone through the proxy; putting MATCH in the middle means every rule after it never fires.
• Rule set failed to download. If a rule-providers URL goes dead, the corresponding RULE-SET rule effectively does nothing—check the logs for errors, then switch to a mirror URL or fall back to a local file-type rule set.
• Missing DNS configuration. When no domain rule matches, the core relies on the resolved IP for GEOIP checks; if system DNS is being tampered with, overseas domains may resolve to the wrong IP and get misrouted as direct. Enabling the core's built-in DNS (as in the example) avoids this.
• Inconsistent node names. Node names referenced in proxy-groups must match the name field in proxies exactly, including spacing and full-width/half-width character differences.