V2Ray Routing Rules in Practice: Direct Connections in Mainland China, Proxy Routing Abroad

Define the routing goal and processing order first

V2Ray routing does not split the network into two separate connections. Instead, one inbound accepts application requests, then selects an outbound based on the domain, destination IP, port, and network type. A typical setup includes a freedom outbound named direct and a proxy outbound named proxy. Routing rules only reference these tags; they do not create connections themselves.

The core goal—direct connections in mainland China and proxy routing for everything else—can be reduced to three checks: connect directly to local networks and reserved addresses, connect directly to mainland Chinese domains and IPs, and send requests that match neither rule to the proxy. The final catch-all rule is essential; without it, unmatched traffic falls through to the first outbound in the outbounds array, making behavior depend on configuration order.

Rules run in array order and stop as soon as the first match succeeds. Put specific domain rules before broad rules, private-network addresses before public-address rules, and the final tcp,udp catch-all at the end. If a proxy rule covering every network type comes first, later direct-connection rules will never run.

• Layer 1: geoip:private handles LAN, loopback, and reserved addresses, keeping router and local-device access off the proxy path.
• Layer 2: geosite:cn matches mainland Chinese sites by domain category.
• Layer 3: geoip:cn handles direct IP requests and requests whose resolved addresses fall within mainland Chinese ranges.
• Layer 4: Unmatched TCP and UDP traffic is sent to the proxy outbound.

How geosite, geoip, and domainStrategy work together

geosite contains domain categories, while geoip contains IP address ranges. When a URL includes a domain, V2Ray usually receives the domain first. Whether it then resolves the destination IP and applies IP rules is controlled by domainStrategy. Therefore, adding only geoip:cn does not guarantee that every mainland Chinese domain will connect directly.

AsIs routes using the original domain and does not actively resolve an IP for routing when no domain rule matches. IPIfNonMatch tries domain rules first, then resolves the IP and checks IP rules only if no domain rule matches. IPOnDemand triggers resolution earlier when a rule requires an IP. For direct connections in mainland China, IPIfNonMatch is usually the practical choice because it combines domain categories with IP-range fallback.

A ready-to-use routing configuration

The following is a complete routing object that can be merged into an existing V2Ray or Xray configuration. It assumes that the outbounds already contain tags named direct and proxy. Before pasting it, check whether the original configuration already has a routing field. A JSON object at the same level cannot contain two fields with the same name, so replace or merge the existing one rather than simply appending another.

{
  "routing": {
    "domainStrategy": "IPIfNonMatch",
    "rules": [
      {
        "type": "field",
        "ip": [
          "geoip:private"
        ],
        "outboundTag": "direct"
      },
      {
        "type": "field",
        "domain": [
          "geosite:cn"
        ],
        "outboundTag": "direct"
      },
      {
        "type": "field",
        "ip": [
          "geoip:cn"
        ],
        "outboundTag": "direct"
      },
      {
        "type": "field",
        "network": "tcp,udp",
        "outboundTag": "proxy"
      }
    ]
  }
}

The first rule keeps private targets such as 192.168.0.0/16 and 10.0.0.0/8 on the local path. The second can choose a direct connection by domain category before DNS resolution. The third handles domains not covered by the category data whose resolved addresses belong to mainland Chinese ranges. The fourth specifies no domain or IP, so it catches the remaining TCP and UDP requests.

1. First verify the direct outbound tag in the existing configuration. A common setup uses the freedom protocol with the tag direct.
2. Verify that the proxy outbound tag points to the current node. This example uses proxy, but the actual name may differ.
3. Place the routing object at the configuration root, alongside inbounds, outbounds, and dns.
4. Use an editor with JSON validation to check commas, square brackets, and braces, then restart the core to load the configuration.
5. Open the runtime log, visit a LAN management address, a mainland Chinese site, and a site outside mainland China, and verify the outbound tag actually used.

Set up the corresponding rules in v2rayN

v2rayN can manage routing through its graphical interface. Go to “Settings” → “Routing Settings,” create a rule set, and enable it. The wording may vary slightly between versions, but the fields to verify are the same: domain strategy, rule order, outbound tag, and the final catch-all. After editing, reload the configuration or restart the core; saving the dialog alone may not affect the current connection immediately.

The local proxy ports must also match the application settings. A common setup uses SOCKS port 10808 and HTTP port 10809, but these numbers are not mandatory standards. Go to “Settings” → “Parameter Settings” to check the current local listening ports, then verify that the browser, download tool, or system proxy uses the same ports. If the ports differ, the request never enters V2Ray and the routing rules cannot take effect.

• When using the system proxy, first confirm that v2rayN's system-proxy mode is set as required.
• When configuring a proxy for an individual application, enter 127.0.0.1 and the actual SOCKS or HTTP port in that application.
• When using TUN mode, confirm that TUN is running and check that the LAN bypass settings match the targets covered by geoip:private.
• After enabling the new rules, close existing connections and connect again; established long-lived connections may continue using the previous outbound.

DNS determines whether geoip rules can take over

When domainStrategy is set to IPIfNonMatch, DNS must return an address after domain rules fail before geoip:cn can run. If DNS queries fail, are encrypted independently by the application, or the browser does not send the domain through the proxy, DNS and routing may see different targets. A typical symptom is that the same site connects directly sometimes and through the proxy at other times, or that the log shows only an IP and no domain.

The most maintainable approach is to use directly reachable DNS for mainland Chinese domains and handle other queries through a controlled path, while preventing system DNS, the browser's independent DNS, and the core's DNS from overriding one another. V2Ray's dns field resolves names, while routing selects the connection path; they are related but serve different purposes.

If an application sends an IP directly, V2Ray cannot recover the original domain from the connection itself, so only IP, port, and network-type rules can run. Conversely, when a request includes a domain and geosite:cn matches, V2Ray will not resolve the IP for a second routing decision. This is why rule order and domainStrategy must be understood together.

Trace routing results layer by layer in the log

Do not begin troubleshooting by making large-scale rule changes. Start with three fixed targets: one LAN address, one domain confirmed to belong to a mainland Chinese category, and one domain that requires proxy access. Change only one variable at a time, reconnect, and record the target, matched rule, and outbound tag in the log. This separates entry, categorization, DNS, and node problems.

1. Confirm the entry point: The test request must appear in the log. If it does not, check the system proxy, application proxy, or TUN takeover status.
2. Confirm the target: Check whether the log records a domain or an IP. When only an IP is present, geosite cannot participate in this match.
3. Confirm the order: Check whether a broader rule matched first, especially a global proxy rule near the top.
4. Confirm the data: Verify that geosite.dat and geoip.dat exist where the core can read them, then restart the core after updating them.
5. Confirm the tags: The routing outboundTag must exactly match an outbound tag.
6. Confirm DNS: With IPIfNonMatch, the domain must resolve successfully after a domain-rule miss, or IP categorization cannot continue.
7. Confirm connection rebuilding: Close the test page or application connection and send the request again to avoid interference from connection reuse.

When using v2rayNG or v2flyNG on Android, the client usually generates the runtime configuration from the subscription. To verify whether a node works, keep the default routing first. For long-term custom routing, confirm whether the client is using a subscription-generated configuration or an imported complete configuration. v2rayNG uses the Xray core, while v2flyNG uses the v2fly core; in both cases, follow the actual runtime log and the data formats supported by the core.

Test 1: 192.168.1.1
Expected result: matches geoip:private → direct

Test 2: mainland Chinese site domain
Expected result: matches geosite:cn → direct

Test 3: domain not covered by the mainland Chinese category
Expected result: continue checking the resolved IP, then use proxy or geoip:cn

Test 4: UDP application request
Expected result: if no direct rule matches, the tcp,udp catch-all sends it to proxy

The standard for a completed configuration is not that every site opens, but that each type of request reaches the expected outbound. If a mainland Chinese site fails to open after matching direct, check the local network and DNS. If a site outside mainland China matches proxy but the connection fails, check the node, transport parameters, and remote reachability. Separating routing decisions from connection quality prevents repeated edits to rules that are already correct.

Where should exception rules go?

In practice, a mainland Chinese domain may need the proxy, or an uncategorized domain may need a direct connection. Add the narrowest possible exception and place it before the general category rules. Use full: for an exact domain match and domain: for a domain and its subdomains; do not broaden a rule to an entire top-level domain for one site.

{
  "type": "field",
  "domain": [
    "full:service.example.net"
  ],
  "outboundTag": "proxy"
}

The structure above demonstrates where and how to place an exact-domain rule; in a real configuration, replace it with the actual domain to handle. If the exception comes after geosite:cn and the target has already matched the mainland Chinese category, the exception will never run. The same applies to domains that must be forced direct: place them before the final proxy catch-all.

• Exact domain rules take priority over category domains.
• Narrow IP ranges take priority over country or regional address sets.
• When blocking, direct, and proxy rules conflict, the first matching rule wins.
• For every exception added, document the reason and keep one log-based verification result.
• Keep the final catch-all even as the rule count grows, so behavior does not depend on outbound order.

Do not turn a temporary DNS outage, unavailable node, or site-side failure into a permanent routing rule. First use logs to confirm that the request selected the wrong outbound, then add an exception. This validation keeps the configuration shorter and makes it easier to identify removable manual rules after updating geosite and geoip data.