Clash Split Tunneling Rules: Configure Direct Access for China and Proxy Routing for International Services

Before You Start: Rules, Proxy Groups, and Traffic Capture

Split tunneling does not route traffic based on a webpage's language. The Clash core reads connection details, checks rules from top to bottom, and sends each connection to the selected policy. The result depends on whether it can identify the domain, destination IP, or process. A website in China may call overseas APIs, while an international site may use a local CDN. Troubleshoot individual connections rather than relying on the address bar alone.

This configuration is for clients using the mihomo core. Older Clash cores and some mobile clients do not support all the same fields, so check your client's core documentation before importing it. The examples use local rule files to keep remote rule download issues separate from routing problems.

Traffic capture: The system proxy only captures traffic from apps that honor proxy settings. TUN can capture more traffic, but routing and exclusion settings still apply.
Rule mode: The configuration must use mode: rule to process the rules list. Global mode cannot be used to verify the routing order in this guide.
Proxy groups: Proxy groups select the outbound route. Matching a domain to a group does not guarantee that the group is currently using a proxy node.
Rule providers: Rule providers store reusable match conditions. They do not select an outbound route; the RULE-SET rule that references a provider determines the route.

Complete Main Configuration: Define the Outbound Routes First

Example Environment and File Locations

This example assumes a working SOCKS5 upstream is already running locally at 127.0.0.1:1080 with no authentication required. mihomo listens at 127.0.0.1:7890. Do not point either port back to the other, or you will create a proxy loop. A configuration file alone cannot provide proxy access to international services without a working upstream.

Save config.yaml in the core's working directory and create a rules directory. You will also need to create the three rule files shown below. Desktop clients may use a separate working directory for the core; relative paths are resolved from that directory, not necessarily from the subscription file's location.

mixed-port: 7890
allow-lan: false
bind-address: 127.0.0.1
mode: rule
log-level: info
ipv6: false

proxies:
  - name: Local Upstream
    type: socks5
    server: 127.0.0.1
    port: 1080
    udp: false

proxy-groups:
  - name: International Proxy
    type: select
    proxies:
      - Local Upstream
  - name: Direct China
    type: select
    proxies:
      - DIRECT
  - name: Ad Handling
    type: select
    proxies:
      - REJECT
      - DIRECT

rule-providers:
  ad-domains:
    type: file
    behavior: domain
    format: yaml
    path: ./rules/ad-domains.yaml
  cn-domains:
    type: file
    behavior: domain
    format: yaml
    path: ./rules/cn-domains.yaml
  overseas-services:
    type: file
    behavior: classical
    format: yaml
    path: ./rules/overseas-services.yaml

rules:
  - IP-CIDR,127.0.0.0/8,DIRECT,no-resolve
  - IP-CIDR,10.0.0.0/8,DIRECT,no-resolve
  - IP-CIDR,172.16.0.0/12,DIRECT,no-resolve
  - IP-CIDR,192.168.0.0/16,DIRECT,no-resolve
  - DOMAIN-SUFFIX,local,DIRECT
  - RULE-SET,ad-domains,Ad Handling
  - DOMAIN,cloud.tencent.com,Direct China
  - RULE-SET,cn-domains,Direct China
  - RULE-SET,overseas-services,International Proxy
  - MATCH,International Proxy

If your subscription already includes proxy nodes, you can set “International Proxy” to use one of those nodes or groups instead of the example “Local Upstream.” Do not overwrite the entire proxies section in an active subscription. Some clients rewrite the configuration when refreshing a subscription. Use the client's supported override or merge feature to make persistent changes; the exact menu name varies by client version.

IPv6 is disabled in this example to narrow down initial troubleshooting; IPv6 can still be used for split tunneling. The example upstream does not provide UDP forwarding either. Browser TCP requests are sufficient for basic checks, but games, voice calls, and QUIC require separate verification of the upstream protocol and traffic capture settings.

Rule Files: When to Use domain vs. classical

Ad Domain File

Save the following content as rules/ad-domains.yaml. behavior: domain uses domain-set syntax: do not include a policy name or the DOMAIN-SUFFIX, prefix. Here, +. matches both the domain itself and its subdomains.

payload:
  - '+.doubleclick.net'
  - '+.googlesyndication.com'

Keep ad blocking easy to roll back. Some sites host analytics, login, or playback APIs on related domains, so broad blocking can break parts of a page. If you confirm a false positive, temporarily set “Ad Handling” to DIRECT to test, then add an exception for the specific domain. Do not start by deleting all your routing rules.

Direct China Domain File

Save the following content as rules/cn-domains.yaml. This list only covers the specified domain trees and cannot automatically identify every website in China. When adding a domain, check the actual requests in the connections panel rather than assuming the address-bar domain serves every resource on the page.

payload:
  - '+.baidu.com'
  - '+.bilibili.com'
  - '+.bilibili.tv'
  - '+.qq.com'
  - '+.tencent.com'
  - '+.jd.com'
  - '+.taobao.com'

Domain categories express routing preferences; they do not prove where a server is physically located. Different services from the same brand may run in different regions. If you want an international service to use a proxy, add a more specific rule for it before the direct rule that covers the brand's entire domain.

International Services File

Save the following content as rules/overseas-services.yaml. behavior: classical supports entries with rule types, but do not add a policy name at the end of each entry. The main configuration already routes this provider to “International Proxy.”

payload:
  - DOMAIN-SUFFIX,github.com
  - DOMAIN-SUFFIX,githubusercontent.com
  - DOMAIN-SUFFIX,githubassets.com
  - DOMAIN-SUFFIX,wikipedia.org
  - DOMAIN-SUFFIX,wikimedia.org

GitHub pages, raw content, and static asset domains are listed separately so you can change the route for a particular resource type later. Although MATCH would route these connections through the proxy anyway, explicit rules are still useful: the logs show which rule set matched, and changing the fallback later will not affect the routes for these services.

Rule Order: The First Match Determines the Route

Rules are not automatically sorted with “more specific” rules first. An exact DOMAIN rule only overrides a broader rule if it appears before it. Rule providers do not automatically resolve conflicts either: if the same domain appears in both the ad and direct lists, the first matching rule determines the result.

Order	Match	Why it is handled this way
1	Loopback and private IPv4 addresses	Route local services and common LAN destinations directly first
2	Ad domain set	Block confirmed ad requests first
3	Exact service exceptions	Override broader domain categories that follow
4	China domain set	Route explicitly listed services in China directly
5	International services set	Explicitly route services that need a proxy
6	MATCH	Catch connections that did not match any earlier rule

Place exceptions before the rules they override

The cloud.tencent.com entry in the main configuration is an example of an exact service rule. It already matches +.tencent.com, so it does not change the current route. If a particular service needs to use a proxy, change the policy on this exact rule to “International Proxy” rather than moving the entire Tencent domain set to the proxy group.

To allow a domain through an ad rule, place its exception before the rule set. Conversely, if you put MATCH,DIRECT first, none of the later ad, China, or international rules will be checked. The fallback rule must come last.

Updating Rules and Adding GEOIP: Avoiding False Positives

Switching from Local Files to HTTP Rule Sources

Local type: file rule sets are not downloaded on a schedule. For automatic updates, use type: http with an accessible HTTPS rule URL, a cache path, and an interval. For example, interval: 86400 checks every 86,400 seconds, or 24 hours; it does not mean the rules update at midnight each day.

Check the format before choosing a remote rule source. behavior: domain is for domain sets, while behavior: classical is for entries with rule types. format: yaml is for YAML files containing payload. A webpage preview, a full subscription configuration, and a binary rule file are not interchangeable YAML rule sources. A download can succeed and still fail to load if the content is in the wrong format.

Rule sources provide match conditions only; do not replace your current subscription with an unfamiliar full configuration.
On first deployment, update rules manually and check the logs before relying on scheduled updates. Do not assume a cache already exists.
After expanding a remote list, check for overlaps between ad rules, service exceptions, and direct-China rules.

Use GEOIP CN as a Supplement

If the GeoIP data required by your core is available, add GEOIP,CN,Direct China before MATCH to classify connections with China IP addresses that did not match a domain rule. This depends on the destination IP and the GeoIP database; it cannot replace service-specific domain rules. An international service using a China-based CDN may be routed directly, while a China-based service using an overseas IP may still go through the proxy.

With no-resolve, for example GEOIP,CN,Direct China,no-resolve, the rule will not actively resolve a domain just to make a match. If the connection does not have an actual destination IP available at that point, the rule may be skipped. This can prevent some rules from triggering DNS lookups, but it is not a switch for “more accurate China detection.” The main configuration does not depend on GeoIP, making it easier to verify the basic routing first.

Testing and Troubleshooting: Check Rule Matches Before Connection Results

Check the Configuration in Four Steps

Check the syntax and files. With the mihomo command line, run mihomo -t -d . -f config.yaml from the example directory. In a desktop client, use its configuration check and confirm that all three local rule files have loaded.
Confirm traffic capture. Enable the system proxy, or use the command below to specify a proxy explicitly. If the command works but the browser's connections panel shows no traffic, check the browser's proxy settings before changing any rules.
Check the active policies. Confirm that the mode is set to rule mode, “International Proxy” is using a working upstream, and “Ad Handling” is set to REJECT.
Start a new connection. After changing rules, close existing connections before testing again. Browsers may reuse old connections, and changing a policy does not guarantee that established sessions will immediately switch routes.

curl -I --proxy http://127.0.0.1:7890 https://www.baidu.com
curl -I --proxy http://127.0.0.1:7890 https://github.com
curl -I --proxy http://127.0.0.1:7890 https://www.wikipedia.org

On Windows, if the terminal maps curl to another command, use curl.exe instead. These commands test requests through port 7890; they do not test TUN capture, and an HTTP status code alone does not prove that every resource on a website is available.

Use Match Logs to Find the Problem

Test target	Expected rule	Expected policy
www.baidu.com	cn-domains	Direct China → DIRECT
github.com	overseas-services	International Proxy → Local Upstream
www.wikipedia.org	overseas-services	International Proxy → Local Upstream
ad.doubleclick.net	ad-domains	Ad Handling → REJECT

The table shows expected results for the example configuration, not measured speed or guaranteed availability. For ad domains, check which rule handles the connection; you should not expect the ad service to return a page. If the rule and policy match expectations but access still fails, check the upstream connection, destination service, and DNS instead of repeatedly changing rule order.

Common DNS and TUN Issues

Domain rules require the core to identify the domain. Domain matching can be affected when an app connects directly to an IP, a browser uses its own encrypted DNS, or DNS traffic is not properly captured in a TUN setup. fake-ip can help restore the link between virtual IPs and domains, but check it alongside the client's DNS settings, TUN DNS hijacking, and bypass rules. Changing one field alone does not ensure that every request will match by domain.

Only temporarily set log-level to debug if the logs are not enough to locate the issue, then restore it to info when you're done. Before sharing logs, remove subscription URLs, authentication details, and personal browsing records. Verify three things separately: the connection reaches the core, it matches the expected rule, and the selected route works. All three must be true for a reliable split-tunneling setup between China and international services.