Route Rule
Changes in sing-box 1.8.0
rule_set
rule_set_ipcidr_match_source
source_ip_is_private
ip_is_private
source_geoip
geoip
geosite
Structure
{
"route": {
"rules": [
{
"inbound": [
"mixed-in"
],
"ip_version": 6,
"network": [
"tcp"
],
"auth_user": [
"usera",
"userb"
],
"protocol": [
"tls",
"http",
"quic"
],
"domain": [
"test.com"
],
"domain_suffix": [
".cn"
],
"domain_keyword": [
"test"
],
"domain_regex": [
"^stun\\..+"
],
"geosite": [
"cn"
],
"source_geoip": [
"private"
],
"geoip": [
"cn"
],
"source_ip_cidr": [
"10.0.0.0/24",
"192.168.0.1"
],
"source_ip_is_private": false,
"ip_cidr": [
"10.0.0.0/24",
"192.168.0.1"
],
"ip_is_private": false,
"source_port": [
12345
],
"source_port_range": [
"1000:2000",
":3000",
"4000:"
],
"port": [
80,
443
],
"port_range": [
"1000:2000",
":3000",
"4000:"
],
"process_name": [
"curl"
],
"process_path": [
"/usr/bin/curl"
],
"package_name": [
"com.termux"
],
"user": [
"sekai"
],
"user_id": [
1000
],
"clash_mode": "direct",
"wifi_ssid": [
"My WIFI"
],
"wifi_bssid": [
"00:00:00:00:00:00"
],
"rule_set": [
"geoip-cn",
"geosite-cn"
],
"rule_set_ipcidr_match_source": false,
"invert": false,
"outbound": "direct"
},
{
"type": "logical",
"mode": "and",
"rules": [],
"invert": false,
"outbound": "direct"
}
]
}
}
You can ignore the JSON Array [] tag when the content is only one item
Default Fields
The default rule uses the following matching logic:
(domain
|| domain_suffix
|| domain_keyword
|| domain_regex
|| geosite
|| geoip
|| ip_cidr
|| ip_is_private
) &&
(port
|| port_range
) &&
(source_geoip
|| source_ip_cidr
|| source_ip_is_private
) &&
(source_port
|| source_port_range
) &&
other fields
Additionally, included rule sets can be considered merged rather than as a single rule sub-item.
inbound
Tags of Inbound.
ip_version
4 or 6.
Not limited if empty.
auth_user
Username, see each inbound for details.
protocol
Sniffed protocol, see Sniff for details.
network
tcp
or udp
.
domain
Match full domain.
domain_suffix
Match domain suffix.
domain_keyword
Match domain using keyword.
domain_regex
Match domain using regular expression.
geosite
Deprecated in sing-box 1.8.0
Geosite is deprecated and may be removed in the future, check Migration.
Match geosite.
source_geoip
Deprecated in sing-box 1.8.0
GeoIP is deprecated and may be removed in the future, check Migration.
Match source geoip.
geoip
Deprecated in sing-box 1.8.0
GeoIP is deprecated and may be removed in the future, check Migration.
Match geoip.
source_ip_cidr
Match source IP CIDR.
ip_is_private
Since sing-box 1.8.0
Match non-public IP.
ip_cidr
Match IP CIDR.
source_ip_is_private
Since sing-box 1.8.0
Match non-public source IP.
source_port
Match source port.
source_port_range
Match source port range.
port
Match port.
port_range
Match port range.
process_name
Only supported on Linux, Windows, and macOS.
Match process name.
process_path
Only supported on Linux, Windows, and macOS.
Match process path.
package_name
Match android package name.
user
Only supported on Linux.
Match user name.
user_id
Only supported on Linux.
Match user id.
clash_mode
Match Clash mode.
wifi_ssid
Only supported in graphical clients on Android and Apple platforms.
Match WiFi SSID.
wifi_bssid
Only supported in graphical clients on Android and Apple platforms.
Match WiFi BSSID.
rule_set
Since sing-box 1.8.0
Match Rule Set.
rule_set_ipcidr_match_source
Since sing-box 1.8.0
Make ipcidr
in rule sets match the source IP.
invert
Invert match result.
outbound
Required
Tag of the target outbound.
Logical Fields
type
logical
mode
Required
and
or or
rules
Required
Included rules.