Routing Rules Basics: DOMAIN, GEOIP and RULE-SET Explained

Routing rules are the brain of a mihomo setup: they look at every connection and decide whether it goes direct, through a proxy group, or nowhere at all. A good rule list means local sites stay fast, blocked services flow through the proxy, and ads can be dropped — all without you thinking about it.

The system is simpler than the long rule lists suggest. There is one matching principle, a handful of rule types that cover domains and IPs, and a mechanism called RULE-SET that outsources the heavy lifting to auto-updating lists. This article walks through each piece with examples you can paste into your own config.

How rule matching works

mihomo evaluates the rules list top to bottom and stops at the first match. Nothing below a matching rule is ever consulted for that connection. Three consequences follow:

• Specific rules must sit above broad ones, or they never fire.
• The last rule should be MATCH — the catch-all that handles everything nothing else claimed.
• Rule order is a debugging tool: moving a rule up or down changes behavior.

Every rule follows the pattern TYPE,VALUE,POLICY, where the policy is a proxy group or one of the built-ins DIRECT and REJECT.

Domain rules: DOMAIN, DOMAIN-SUFFIX, DOMAIN-KEYWORD

rules:
  - DOMAIN,www.example.com,DIRECT        # exactly this host
  - DOMAIN-SUFFIX,example.com,Proxy      # the domain and all subdomains
  - DOMAIN-KEYWORD,google,Proxy          # any domain containing "google"

• DOMAIN matches one exact hostname and nothing else.
• DOMAIN-SUFFIX is the everyday choice: example.com also catches cdn.example.com.
• DOMAIN-KEYWORD is the bluntest tool — a substring match that can over-catch (a keyword like go would match far more than you intend). Use it sparingly.

IP rules: IP-CIDR, GEOIP and no-resolve

  - IP-CIDR,192.168.0.0/16,DIRECT,no-resolve
  - GEOIP,CN,DIRECT

IP-CIDR matches an address range in CIDR notation — the classic use is keeping LAN traffic direct. GEOIP matches the destination country using a bundled geolocation database, which is how one line can send all domestic traffic direct.

The no-resolve flag matters more than it looks. When a connection arrives with a domain rather than an IP, an IP rule would normally force a DNS resolution just to test the match. no-resolve tells mihomo to skip this rule for unresolved domains instead — avoiding premature DNS lookups that can be slow or leak queries. The usual advice: add no-resolve to IP rules that sit above your domain rules, and let GEOIP near the bottom resolve when it must.

RULE-SET and rule-providers

Maintaining thousands of domains by hand is hopeless, so mihomo lets you reference external lists that update themselves:

rule-providers:
  ads:
    type: http
    behavior: domain
    url: "https://example.com/ads-list.yaml"
    path: ./rules/ads.yaml
    interval: 86400

rules:
  - RULE-SET,ads,REJECT

The provider block declares where the list lives, its behavior (domain, ipcidr or classical — the format of entries inside), and how often to refresh in seconds. The single RULE-SET,ads,REJECT line then applies the entire list. Subscription providers rely on this heavily, which is why imported configs can be short yet route thousands of sites correctly.

A complete example block

rules:
  - RULE-SET,ads,REJECT
  - DOMAIN-SUFFIX,openai.com,AI
  - IP-CIDR,192.168.0.0/16,DIRECT,no-resolve
  - IP-CIDR,10.0.0.0/8,DIRECT,no-resolve
  - GEOIP,CN,DIRECT
  - MATCH,Proxy

Read it top to bottom: ads are dropped, one service is pinned to a dedicated group, LAN ranges stay local, domestic destinations go direct, and everything else exits through the Proxy group.

Debugging: see which rule fired

When traffic goes the wrong way, do not guess — look. Every GUI client has a connections panel showing, for each live connection, the destination, the matched rule and the chosen policy. Find the misbehaving connection there, and the fix is usually obvious: a keyword rule over-matching, or a broad rule sitting above a specific one. The core log at info level records the same decisions if you prefer text. Keep in mind that matching quality also depends on name resolution — the DNS and fake-ip guide explains that half of the story, and the config basics article covers validating your edits before restarting.