Rule Conditions Reference¶

Policy rules and DNS rules support various match conditions. This document lists all available conditions and their descriptions.

Domain Conditions¶

Condition	sing-box Field	Description	Example
Domain	`domain`	Exact domain match	`www.google.com`
Domain Suffix	`domain_suffix`	Match domain suffix	`.google.com`
Domain Keyword	`domain_keyword`	Domain contains keyword	`google`
Domain Regex	`domain_regex`	Regex match on domain	`^.\.google\..$`

Domain Matching Rules

domain — Exact match. www.google.com only matches this full domain
domain_suffix — Suffix match. .google.com matches www.google.com, mail.google.com, etc.
domain_keyword — Contains match. google matches any domain containing google
domain_regex — Regex match. Most flexible but lowest performance

Network Conditions¶

Condition	sing-box Field	Description	Example
Port	`port`	Destination port	`443`
Port Range	`port_range`	Destination port range	`80-443`
Source Port	`source_port`	Source port	`8080`
Source Port Range	`source_port_range`	Source port range	`1000-2000`
Network Type	`network`	TCP or UDP	`tcp`
Query Type	`query_type`	DNS query type (DNS rules only)	`A`, `AAAA`

IP Conditions¶

Condition	sing-box Field	Description	Example
IP CIDR	`ip_cidr`	Destination IP range	`10.0.0.0/8`
Source IP CIDR	`source_ip_cidr`	Source IP range	`192.168.0.0/16`

IP CIDR Syntax

10.0.0.0/8 — Matches all 10.x.x.x addresses
192.168.0.0/16 — Matches all 192.168.x.x addresses
172.16.0.0/12 — Matches 172.16.x.x through 172.31.x.x
Single IP can use /32, e.g., 1.2.3.4/32

Process Conditions¶

Condition	sing-box Field	Description	Example
Process Name	`process_name`	Name of the connecting process	`chrome.exe`
Process Path	`process_path`	Full process path	`C:\Program Files\...\chrome.exe`
Process Path Regex	`process_path_regex`	Regex match on process path	`.*\\chrome\.exe`
Package Name	`package_name`	App package name (Android)	`com.android.chrome`

Process Matching Limitations

Process name matching only works in TUN mode — not available in system proxy mode
Process names are case-insensitive on Windows
Process path regex uses Go's RE2 syntax

Network Environment Conditions¶

Condition	sing-box Field	Description
Wi-Fi SSID	`wifi_ssid`	Connected Wi-Fi name
Wi-Fi BSSID	`wifi_bssid`	Connected Wi-Fi access point MAC
Network Expensive	`network_is_expensive`	Whether on a metered network (mobile data)
Network Constrained	`network_is_constrained`	Whether on a constrained network
Default Interface Address	`default_interface_address`	Default network interface IP address

Logical Combinations¶

Condition	Description
`and`	All sub-conditions must be satisfied
`or`	Any sub-condition can be satisfied

Example: Match Google domains AND from Chrome process:

{
  "logical": "and",
  "rules": [
    { "domain_suffix": [".google.com"] },
    { "process_name": ["chrome.exe"] }
  ]
}

More Logical Combination Examples

OR combination — Match Google or YouTube domains:

{
  "logical": "or",
  "rules": [
    { "domain_suffix": [".google.com"] },
    { "domain_suffix": [".youtube.com"] }
  ]
}

Nested combination — Google domains from Chrome, OR any Telegram traffic:

{
  "logical": "or",
  "rules": [
    {
      "logical": "and",
      "rules": [
        { "domain_suffix": [".google.com"] },
        { "process_name": ["chrome.exe"] }
      ]
    },
    { "domain_keyword": ["telegram"] }
  ]
}

Other¶

Condition	sing-box Field	Description
Rule Set	`rule_set`	Reference a rule set (GeoIP / GeoSite / custom)
Invert	`invert`	Invert the match result — matched items don't hit

Using Invert

invert is useful for exclusion scenarios. For example, matching "all processes except Chrome":

{
  "process_name": ["chrome.exe"],
  "invert": true
}

This matches all processes except Chrome.

Outbound Modes¶

Available outbound modes when a rule is matched:

Outbound	Description
Direct	Connect directly without proxy
Proxy	Connect through a proxy node
Block	Block the connection