Rule

:material-plus: [source_mac_address](#source_mac_address)  
:material-plus: [source_hostname](#source_hostname)  
:material-plus: [package_name_regex](#package_name_regex)

:material-plus: [interface_address](#interface_address)  
:material-plus: [network_interface_address](#network_interface_address)  
:material-plus: [default_interface_address](#default_interface_address)  
:material-plus: [preferred_by](#preferred_by)  
:material-alert: [network](#network)

:material-plus: [action](#action)  
:material-alert: [outbound](#outbound)  
:material-plus: [network_type](#network_type)  
:material-plus: [network_is_expensive](#network_is_expensive)  
:material-plus: [network_is_constrained](#network_is_constrained)

:material-plus: [client](#client)  
:material-delete-clock: [rule_set_ipcidr_match_source](#rule_set_ipcidr_match_source)  
:material-plus: [rule_set_ip_cidr_match_source](#rule_set_ip_cidr_match_source)  
:material-plus: [process_path_regex](#process_path_regex)

:material-plus: [rule_set](#rule_set)  
:material-plus: [rule_set_ipcidr_match_source](#rule_set_ipcidr_match_source)  
:material-plus: [source_ip_is_private](#source_ip_is_private)  
:material-plus: [ip_is_private](#ip_is_private)  
:material-delete-clock: [source_geoip](#source_geoip)  
:material-delete-clock: [geoip](#geoip)  
:material-delete-clock: [geosite](#geosite)

{
  "route": {
    "rules": [
      {
        "inbound": [
          "mixed-in"
        ],
        "ip_version": 6,
        "network": [
          "tcp"
        ],
        "auth_user": [
          "usera",
          "userb"
        ],
        "protocol": [
          "tls",
          "http",
          "quic"
        ],
        "client": [
          "chromium",
          "safari",
          "firefox",
          "quic-go"
        ],
        "domain": [
          "test.com"
        ],
        "domain_suffix": [
          ".cn"
        ],
        "domain_keyword": [
          "test"
        ],
        "domain_regex": [
          "^stun\\..+"
        ],
        "geosite": [
          "cn"
        ],
        "source_geoip": [
          "private"
        ],
        "geoip": [
          "cn"
        ],
        "source_ip_cidr": [
          "10.0.0.0/24",
          "192.168.0.1"
        ],
        "source_ip_is_private": false,
        "ip_cidr": [
          "10.0.0.0/24",
          "192.168.0.1"
        ],
        "ip_is_private": false,
        "source_port": [
          12345
        ],
        "source_port_range": [
          "1000:2000",
          ":3000",
          "4000:"
        ],
        "port": [
          80,
          443
        ],
        "port_range": [
          "1000:2000",
          ":3000",
          "4000:"
        ],
        "process_name": [
          "curl"
        ],
        "process_path": [
          "/usr/bin/curl"
        ],
        "process_path_regex": [
          "^/usr/bin/.+"
        ],
        "package_name": [
          "com.termux"
        ],
        "package_name_regex": [
          "^com\\.termux.*"
        ],
        "user": [
          "sekai"
        ],
        "user_id": [
          1000
        ],
        "clash_mode": "direct",
        "network_type": [
          "wifi"
        ],
        "network_is_expensive": false,
        "network_is_constrained": false,
        "interface_address": {
          "en0": [
            "2000::/3"
          ]
        },
        "network_interface_address": {
          "wifi": [
            "2000::/3"
          ]
        },
        "default_interface_address": [
          "2000::/3"
        ],
        "wifi_ssid": [
          "My WIFI"
        ],
        "wifi_bssid": [
          "00:00:00:00:00:00"
        ],
        "preferred_by": [
          "tailscale",
          "wireguard"
        ],
        "source_mac_address": [
          "00:11:22:33:44:55"
        ],
        "source_hostname": [
          "my-device"
        ],
        "rule_set": [
          "geoip-cn",
          "geosite-cn"
        ],
        // deprecated
        "rule_set_ipcidr_match_source": false,
        "rule_set_ip_cidr_match_source": false,
        "invert": false,
        "action": "route",
        "outbound": "direct"
      },
      {
        "type": "logical",
        "mode": "and",
        "rules": [],
        "invert": false,
        "action": "route",
        "outbound": "direct"
      }
    ]
  }
}

You can ignore the JSON Array [] tag when the content is only one item

The default rule uses the following matching logic:  
(`domain` || `domain_suffix` || `domain_keyword` || `domain_regex` || `geosite` || `geoip` || `ip_cidr` || `ip_is_private`) &&  
(`port` || `port_range`) &&  
(`source_geoip` || `source_ip_cidr` || `source_ip_is_private`) &&  
(`source_port` || `source_port_range`) &&  
`other fields`

When a rule-set contains only a single default rule without `invert`, its fields are considered merged into the outer rule per the logic above; otherwise, it is matched as an `other field`; different rule-sets always keep OR semantics.

Since sing-box 1.13.0, you can match ICMP echo (ping) requests via the new `icmp` network.

Such traffic originates from `TUN`, `WireGuard`, and `Tailscale` inbounds and can be routed to `Direct`, `WireGuard`, and `Tailscale` outbounds.

Geosite is deprecated and will be removed in sing-box 1.12.0, check [Migration](/migration/#migrate-geosite-to-rule-sets).

GeoIP is deprecated and will be removed in sing-box 1.12.0, check [Migration](/migration/#migrate-geoip-to-rule-sets).

GeoIP is deprecated and will be removed in sing-box 1.12.0, check [Migration](/migration/#migrate-geoip-to-rule-sets).

Only supported on Linux, Windows, and macOS.

Only supported on Linux, Windows, and macOS.

Only supported on Linux, Windows, and macOS.

Only supported on Linux.

Only supported on Linux.

Only supported in graphical clients on Android and Apple platforms.

Only supported in graphical clients on Android and Apple platforms.

Only supported in graphical clients on Apple platforms.

Only supported on Linux, Windows, and macOS.

Only supported in graphical clients on Android and Apple platforms.

Only supported on Linux, Windows, and macOS.

Only supported on Linux, macOS, or in graphical clients on Android and macOS. See [Neighbor Resolution](/configuration/shared/neighbor/) for setup.

Only supported on Linux, macOS, or in graphical clients on Android and macOS. See [Neighbor Resolution](/configuration/shared/neighbor/) for setup.

`rule_set_ipcidr_match_source` is renamed to `rule_set_ip_cidr_match_source` and will be remove in sing-box 1.11.0.

Moved to [Rule Action](../rule_action#route).