Typical Routing Scenarios¶

This document provides common routing configuration examples you can reference directly.

Scenario 1: Proxy Foreign + Direct Rest¶

The most basic setup for daily use.

Policy Rules:
  1. rule_set: [ProxyGFWlist] → Proxy
  2. rule_set: [geosite-cn] → Direct
  3. rule_set: [geoip-cn] → Direct
  final → Direct

DNS Rules:
  1. rule_set: [geosite-cn] → dns_direct_out (223.5.5.5)
  2. rule_set: [geosite-geolocation-!cn] → dns_proxy_out (8.8.8.8 via proxy)
  final → dns_direct_out

Features

Only GFW-listed domains go through proxy — domestic access speed is unaffected
DNS resolution is split between domestic and foreign, preventing DNS leaks
Can be imported directly via the "Proxy Foreign + Direct Rest" preset template

Scenario 2: Direct Domestic + Proxy Rest¶

Full proxy coverage with stronger privacy protection.

Policy Rules:
  1. rule_set: [geosite-cn] → Direct
  2. rule_set: [geoip-cn] → Direct
  3. rule_set: [LocalAreaNetwork] → Direct
  final → Proxy

DNS Rules:
  1. rule_set: [geosite-cn] → dns_direct_out (223.5.5.5)
  2. domain_suffix: [".google.com", ".youtube.com"] → dns_proxy_out
  final → dns_proxy_out (8.8.8.8 via proxy)

Features

Unmatched traffic defaults to proxy — ideal for comprehensive coverage
Domestic traffic goes direct for speed
Can be imported directly via the "Direct Domestic + Proxy Rest" preset template

Scenario 3: Using Rover DNS Concurrent Resolution¶

Leverage Rover DNS's multi-upstream concurrency for faster and more reliable DNS resolution.

DNS Configuration:
  servers:
    - tag: rover_dns
      address: https://127.0.0.1:5353/dns-query
      address_resolver: dns_direct_out
      detour: direct
  rules:
    - rule_set: [geosite-cn], server: rover_dns
    - rule_set: [geosite-proxy], server: rover_dns
  final: rover_dns

Rover DNS Upstreams:
  - tls://dns.google (via proxy)
  - https://cloudflare-dns.com/dns-query (via proxy)
  - 223.5.5.5 (direct)
  Bootstrap: 223.5.5.5

Features

Multiple upstreams queried concurrently — fastest response wins
Even if one upstream is unavailable, others still work
Requires RoverService to be installed first

Scenario 4: Process-Based Routing¶

Direct specific application traffic to different outbounds.

Policy Rules:
  1. process_name: [chrome.exe] → Proxy
  2. process_name: [steam.exe] → Gaming Proxy Group
  3. process_name: [WeChat.exe] → Direct
  final → Direct

Requires TUN Mode

Process name matching only works in TUN mode. System proxy mode cannot obtain process information.

More Process Routing Examples

# Developer Routing
1. process_name: [Code.exe, cmd.exe, python.exe] → Direct
2. process_name: [chrome.exe, firefox.exe] → Proxy
3. final → Direct

# Game Acceleration
1. process_name: [steam.exe] → HK Node
2. process_name: [Telegram.exe] → Proxy
3. rule_set: [geosite-cn] → Direct
4. final → Direct

Scenario 5: DNS Leak Prevention¶

Ensure sensitive domains always use proxy DNS resolution.

DNS Rules:
  1. domain_suffix: [".google.com", ".youtube.com", ".twitter.com"] → dns_proxy_out
  2. process_name: [chrome.exe] → dns_proxy_out
  final → dns_direct_out

Why This Matters

DNS leaks mean your ISP can see which domains you're visiting, even in proxy mode. Configuring dedicated DNS rules for sensitive domains is essential.

How to detect: Visit dnsleaktest.com — if the DNS servers shown belong to your ISP, you have a DNS leak.

Scenario 6: Ad Blocking¶

Use rule sets to block ad domains.

Policy Rules:
  1. rule_set: [BanAD] → Block
  2. rule_set: [BanProgramAD] → Block
  3. rule_set: [ProxyGFWlist] → Proxy
  4. rule_set: [geosite-cn] → Direct
  final → Direct

Features

Blocking rules are placed at the top to ensure ad domains match first
May accidentally block some content — you can disable individual rules at any time