Skip to content

Route Rule

Structure

{
  "route": {
    "rules": [
      {
        "inbound": [
          "mixed-in"
        ],
        "ip_version": 6,
        "network": [
          "tcp"
        ],
        "auth_user": [
          "usera",
          "userb"
        ],
        "protocol": [
          "tls",
          "http",
          "quic"
        ],
        "domain": [
          "test.com"
        ],
        "domain_suffix": [
          ".cn"
        ],
        "domain_keyword": [
          "test"
        ],
        "domain_regex": [
          "^stun\\..+"
        ],
        "geosite": [
          "cn"
        ],
        "source_geoip": [
          "private"
        ],
        "geoip": [
          "cn"
        ],
        "source_ip_cidr": [
          "10.0.0.0/24",
          "192.168.0.1"
        ],
        "source_ip_is_private": false,
        "ip_cidr": [
          "10.0.0.0/24",
          "192.168.0.1"
        ],
        "ip_is_private": false,
        "source_port": [
          12345
        ],
        "source_port_range": [
          "1000:2000",
          ":3000",
          "4000:"
        ],
        "port": [
          80,
          443
        ],
        "port_range": [
          "1000:2000",
          ":3000",
          "4000:"
        ],
        "process_name": [
          "curl"
        ],
        "process_path": [
          "/usr/bin/curl"
        ],
        "package_name": [
          "com.termux"
        ],
        "user": [
          "sekai"
        ],
        "user_id": [
          1000
        ],
        "clash_mode": "direct",
        "wifi_ssid": [
          "My WIFI"
        ],
        "wifi_bssid": [
          "00:00:00:00:00:00"
        ],
        "rule_set": [
          "geoip-cn",
          "geosite-cn"
        ],
        "rule_set_ipcidr_match_source": false,
        "invert": false,
        "outbound": "direct"
      },
      {
        "type": "logical",
        "mode": "and",
        "rules": [],
        "invert": false,
        "outbound": "direct"
      }
    ]
  }
}

You can ignore the JSON Array [] tag when the content is only one item

Default Fields

The default rule uses the following matching logic:
(domain || domain_suffix || domain_keyword || domain_regex || geosite || geoip || ip_cidr || ip_is_private) &&
(port || port_range) &&
(source_geoip || source_ip_cidr || source_ip_is_private) &&
(source_port || source_port_range) &&
other fields

Additionally, included rule sets can be considered merged rather than as a single rule sub-item.

inbound

Tags of Inbound.

ip_version

4 or 6.

Not limited if empty.

auth_user

Username, see each inbound for details.

protocol

Sniffed protocol, see Sniff for details.

network

tcp or udp.

domain

Match full domain.

domain_suffix

Match domain suffix.

domain_keyword

Match domain using keyword.

domain_regex

Match domain using regular expression.

geosite

Deprecated in sing-box 1.8.0

Geosite is deprecated and may be removed in the future, check Migration.

Match geosite.

source_geoip

Deprecated in sing-box 1.8.0

GeoIP is deprecated and may be removed in the future, check Migration.

Match source geoip.

geoip

Deprecated in sing-box 1.8.0

GeoIP is deprecated and may be removed in the future, check Migration.

Match geoip.

source_ip_cidr

Match source IP CIDR.

ip_is_private

Since sing-box 1.8.0

Match non-public IP.

ip_cidr

Match IP CIDR.

source_ip_is_private

Since sing-box 1.8.0

Match non-public source IP.

source_port

Match source port.

source_port_range

Match source port range.

port

Match port.

port_range

Match port range.

process_name

Only supported on Linux, Windows, and macOS.

Match process name.

process_path

Only supported on Linux, Windows, and macOS.

Match process path.

package_name

Match android package name.

user

Only supported on Linux.

Match user name.

user_id

Only supported on Linux.

Match user id.

clash_mode

Match Clash mode.

wifi_ssid

Only supported in graphical clients on Android and Apple platforms.

Match WiFi SSID.

wifi_bssid

Only supported in graphical clients on Android and Apple platforms.

Match WiFi BSSID.

rule_set

Since sing-box 1.8.0

Match Rule Set.

rule_set_ipcidr_match_source

Since sing-box 1.8.0

Make ipcidr in rule sets match the source IP.

invert

Invert match result.

outbound

Required

Tag of the target outbound.

Logical Fields

type

logical

mode

Required

and or or

rules

Required

Included rules.