IP-Based vs. Domain-Based Rules

Relevant source files

The following files were used as context for generating this wiki page:

• Clash/Providers/ProxyGFWlist.yaml
• Clash/Providers/Ruleset/NetflixIP.yaml
• update_sing_box.py
• update_providers.py
• Clash/GeneralClashConfig.yml
• Clash/Providers/ProxyLite.yaml
• Clash/Providers/Ruleset/AI.yaml

The Self-Rule project utilizes a sophisticated system of IP-based and domain-based rules to manage and direct network traffic. These rules are primarily defined in .list files, which are then processed by Python scripts to generate configuration files for proxy clients like Clash (in YAML format) and sing-box (in JSON format). This system allows for granular control over how connections are handled, enabling policies to direct traffic through a proxy, connect directly, or be blocked based on either the destination domain name or IP address.

The core of this feature is the distinction between matching traffic based on its requested domain (e.g., google.com) versus its destination IP address (e.g., 8.8.8.8). Domain-based rules are generally more readable and stable, as IP addresses for a given service can change frequently. However, IP-based rules are essential for services that are not accessed by a domain name or for capturing all traffic to a specific service provider's network ranges, regardless of the domain used. The repository contains extensive lists for both types, such as ProxyGFWlist.yaml for domains and NetflixIP.yaml for IP addresses.

Rule Types and Syntax

The project defines several types of rules within its .list and .yaml provider files. These rules form the basis for all traffic routing decisions.

Rule Definitions

The primary rule types can be categorized into domain-based and IP-based matching.

Rule Type	Example	Description	Source File
DOMAIN-SUFFIX	DOMAIN-SUFFIX,google.com	Matches google.com and all its subdomains (e.g., www.google.com, mail.google.com).	Clash/Providers/ProxyLite.yaml:122
DOMAIN-KEYWORD	DOMAIN-KEYWORD,google	Matches any domain containing the keyword "google".	Clash/Providers/ProxyLite.yaml:40
DOMAIN	DOMAIN,ai.google.dev	Matches the exact domain ai.google.dev only.	Clash/Providers/Ruleset/AI.yaml:8
IP-CIDR	IP-CIDR,74.125.0.0/16,no-resolve	Matches any IPv4 address within the specified CIDR block. The no-resolve flag indicates that domain names resolving to this range will not match this rule.	Clash/Providers/ProxyLite.yaml:342
IP-CIDR6	IP-CIDR6,2001:67c:4e8::/48,no-resolve	Matches any IPv6 address within the specified CIDR block.	Clash/Providers/ProxyLite.yaml:521

Domain-Based Rules

Domain-based rules are the most common type in the repository. They are used to identify traffic to specific websites and services.

• DOMAIN-SUFFIX: This is the most frequently used rule type. It provides a broad but targeted way to match a service and all its related subdomains. For example, DOMAIN-SUFFIX,openai.com ensures that requests to chat.openai.com, api.openai.com, and the base domain itself are all handled by the same policy.
  Sources: Clash/Providers/Ruleset/AI.yaml:36
• DOMAIN-KEYWORD: This rule is used for matching domains that may not share a common suffix but contain a specific identifying word. For instance, DOMAIN-KEYWORD,github will match github.com, github.io, and githubusercontent.com.
  Sources: Clash/Providers/ProxyLite.yaml:40
• DOMAIN: This rule offers the most specific matching, targeting a single, exact domain name. It is useful for rules that should not accidentally apply to subdomains. An example is DOMAIN,sydney.bing.com to match only that specific endpoint.
  Sources: Clash/Providers/Ruleset/AI.yaml:17

IP-Based Rules

IP-based rules are critical for services that are distributed across a known set of IP ranges or for applications that make direct IP connections.

• IP-CIDR / IP-CIDR6: These rules match traffic based on the destination IP address. They are fundamental for services like Netflix, which uses a vast and changing array of IP addresses for its content delivery network. The Clash/Providers/Ruleset/NetflixIP.yaml file consists entirely of IP-CIDR rules to capture all Netflix traffic.
• The no-resolve Option: Many IP-CIDR rules include the no-resolve parameter. This is an optimization that tells the proxy client not to perform a reverse DNS lookup for IP-based connections to see if they match a domain rule. It ensures that IP-based rules only apply to connections made directly to an IP address, preventing them from matching domain-based traffic that happens to resolve to an IP in that range.
  Sources: Clash/Providers/Ruleset/NetflixIP.yaml, Clash/Providers/ProxyGFWlist.yaml:2910

Rule Generation and Conversion

The repository includes Python scripts to automate the conversion of simplified .list files into formats understood by different proxy clients.

This diagram illustrates the automated workflow for generating proxy configuration files from source lists.

Clash Provider Generation (update_providers.py)

The update_providers.py script reads .list files from the Clash/ directory (excluding Clash/config and Clash/Providers) and converts them into YAML provider files suitable for Clash.

The script performs the following actions:

1. Reads each line from a .list file.
2. Writes a payload: header to the output .yaml file.
3. Prefixes each rule line with -.
4. Comments out unsupported rule types like USER-AGENT and PROCESS-NAME.

# Source: update_providers.py:15-32
with open(os.path.join(root, file), encoding="utf-8") as f_in:
    lines = f_in.readlines()
    write_path = os.path.join(*path_l[:1], "Providers", *path_l[1:])
    write_path = os.path.splitext(write_path)[0] + ".yaml"
    # if dir not exists, create it (recursively)
    if not os.path.exists(os.path.dirname(write_path)):
        os.makedirs(os.path.dirname(write_path))
    with open(write_path, "w", encoding="utf-8") as f_out:
        f_out.write("payload:\n")
        line_count = 0
        for line in lines:
            # ... (logic to handle comments and unsupported lines)
            else:
                f_out.write(f"  - {line.strip()}")
            if line_count < len(lines):
                f_out.write("\n")

Sources: update_providers.py:15-32

Sing-box Rule Set Generation (update_sing_box.py)

The update_sing_box.py script is more complex. It converts .list files into a structured JSON format required by sing-box. It defines HeadlessRule and Rule data classes to construct the JSON object.

The script maps the rule prefixes from the .list files to specific keys in the JSON output.

.list Prefix	sing-box JSON Key
DOMAIN	domain
DOMAIN-SUFFIX	domain_suffix
DOMAIN-KEYWORD	domain_keyword
DOMAIN-REGEX	domain_regex
IP-CIDR	ip_cidr
IP-CIDR6	ip_cidr

Sources: update_sing_box.py:65-75

The following diagram shows the structure of the HeadlessRule class used to build the JSON output.

After generating the JSON file, the script uses the sing-box command-line tool to compile it into a binary .srs format and then deletes the intermediate JSON file.

# Source: update_sing_box.py:99-101
# compile `sing-box rule-set compile [--output <file-name>.srs] <file-name>.json` and delete json
os.system(f"sing-box rule-set compile {write_path}")
os.remove(write_path)

Sources: update_sing_box.py:99-101

Usage in Configuration

The generated rule sets are referenced in main configuration files. In Clash/GeneralClashConfig.yml, domain-based rules are used extensively in the cfw-bypass section. This list specifies domains and IP ranges that should bypass the system proxy, ensuring that local and domestic services are not routed incorrectly.

The list includes:

• Specific domains like qq.com.
• Wildcard domains like *.music.126.net.
• Private IP ranges like 192.168.*.

# Source: Clash/GeneralClashConfig.yml:211-228
# System proxy will ignore these domains(or ipnet)
# 系统代理跳过列表-备份的，不起作用，
# 使用时可以将cfw-bypass-bak与cfw-bypass内容互换
cfw-bypass-bak:
  # 原有字段不用删除
  - qq.com
  - 'music.163.com' # 网易云域名1
  - '*.music.126.net' # 网易云域名2
  - localhost
  - 127.*
  - 10.*
  - 172.16.*
  # ... (and many more)
  - 192.168.*
  - <local>
# 系统代理跳过列表 起作用的
cfw-bypass:
  # 直连列表
  # MyList
  - "*.13th.tech"
  # ... (extensive list of domains)

Sources: Clash/GeneralClashConfig.yml:211-228

Conclusion

The Self-Rule repository demonstrates a powerful and flexible approach to network traffic management by combining IP-based and domain-based rules. Domain rules offer readability and convenience for targeting web services, while IP-based rules provide the necessary coverage for applications and services distributed across specific network blocks. The automation scripts (update_providers.py, update_sing_box.py) are key to this system, allowing for easy maintenance of master rule lists and seamless generation of configurations for multiple proxy clients, ensuring both consistency and adaptability.