V2Ray Routing Rules: Use geosite and geoip for Direct Connections in China and Proxy Routing Abroad

1. Check traffic flow and outbounds first

Routing takes place after traffic reaches the core. Rules won't affect an app that doesn't use the system proxy or connections not covered by the active proxy mode. Select a working server, confirm your browser is using the local proxy provided by v2rayN, then adjust the routing rules. The system proxy mainly serves apps that respect the system proxy settings; it does not capture every connection on the device.

In a rule, outboundTag identifies an outbound; it is not a protocol name. In this guide, proxy points to a configured server, direct to a freedom outbound, and block to a blackhole outbound. Tags are case-sensitive and must match the configuration exactly.

2. What geosite and geoip match

geosite:cn represents a domain set and is useful for matching categorized sites in mainland China. geoip:cn represents IP ranges and can handle direct IP connections or add IP-based routing after domain resolution. Both rely on rule data; neither reflects a site's business, actual server location, or current reachability. A domain associated with mainland China may use infrastructure abroad, while an overseas service may resolve to an IP in mainland China.

Putting both domain and ip in one rule does not mean “match either the domain or the IP.” Different condition fields generally all need to match; multiple entries in the same array are alternatives. To avoid ambiguity, use separate rules for domains in mainland China and IPs in mainland China.

• domain:example.com matches the domain and its subdomains; it differs from full:example.com, which matches the exact domain only.
• Private network destinations such as 192.168.1.1 should generally use a direct connection, but the app must still send the connection through the core.
• Make sure the current geo data includes cn, private, and an ad category. Missing categories can prevent the configuration from loading; changing rule order alone won't fix that.

3. How domainStrategy affects IP-based rules for China

domainStrategy belongs inside the routing object, alongside rules. It determines whether domains are resolved to IPs for routing decisions; it does not decide whether an app uses a proxy and is not a complete DNS configuration. Outbound resolution settings with similar names belong to a different scope and are not interchangeable.

4. Order rules: ads, domains in China, private IPs, then IPs in China

Rules are checked from top to bottom; the first match determines the outbound. Put the ad category before the China domain set so domains categorized as both aren't allowed through first. Then handle domains in mainland China, private IPs, and IPs in mainland China; send everything else to the proxy by default. The snippet below shows only the routing section and must be merged into an existing complete configuration.

{
  "routing": {
    "domainStrategy": "IPIfNonMatch",
    "rules": [
      {
        "type": "field",
        "domain": ["geosite:category-ads-all"],
        "outboundTag": "block"
      },
      {
        "type": "field",
        "domain": ["geosite:cn"],
        "outboundTag": "direct"
      },
      {
        "type": "field",
        "ip": ["geoip:private"],
        "outboundTag": "direct"
      },
      {
        "type": "field",
        "ip": ["geoip:cn"],
        "outboundTag": "direct"
      }
    ]
  }
}

These rules require the corresponding outbounds to exist. Keep the existing node's authentication, transport, and security settings, and set its outbound tag to proxy; don't rewrite the node parameters just to match this example. The following two objects only demonstrate direct and block outbounds. Add them to the existing outbounds array after the proxy outbound.

[
  {
    "tag": "direct",
    "protocol": "freedom",
    "settings": {}
  },
  {
    "tag": "block",
    "protocol": "blackhole",
    "settings": {}
  }
]

• To allow a domain that was blocked by mistake, add an exact-match direct exception before the ad rule instead of removing the entire ad category.
• Blocking ad domains won't remove every ad on a page. Same-domain content, built-in app resources, and addresses missing from the data may not be distinguishable.
• An overseas service may resolve to an IP in mainland China, causing the final IP rule for China to send it directly. To force it through the proxy, add a proxy rule for that service's domain before the rules for China.

5. Apply the rules in v2rayN and check the generated configuration

The v2rayN routing editor generates the core configuration, while subscriptions mainly provide node details; they serve different purposes. Menu labels may vary slightly between desktop releases. The steps below assume a UI with a “Settings” → “Routing Settings” menu. If yours differs, check the generated routing and outbounds sections.

1. Back up your current rules

   Go to “Settings” → “Routing Settings.” Save your existing rules or export the current configuration, and note the routing scheme in use so you don't overwrite existing exceptions.

2. Create a separate scheme

   In “Routing Settings,” create or copy a routing scheme. Set the domain strategy to IPIfNonMatch, then add separate rules for ads, domains in mainland China, private IPs, and IPs in mainland China. Don't paste the full core JSON into a single rule's domain field.

3. Check outbound mappings

   Check the proxy, direct, or block outbound assigned to each rule. The UI may show localized labels, but each generated outboundTag must correspond to an actual outbound definition. Also check that the default outbound is the selected server.

4. Enable and reload

   Save the scheme, set it as the active route, then restart the service or core. If you only save the scheme without enabling it, the previous routing rules may remain in effect.

5. Check the proxy entry point

   Go to “Settings” → “Parameter Settings” and check the local listening port. This guide uses 127.0.0.1:10808 as a test entry point; use the port and inbound protocol in your actual configuration. Then check the system proxy status from the tray menu.

6. Use logs to tell rule issues from DNS issues

Change one condition at a time during testing. First visit a domain confirmed to be in the China set, then one outside it, and finally a private network address you need to reach. Temporarily enable access logs; if needed, increase error log verbosity. Check the destination and final outbound tag, then restore your usual log level when you're done.

If an app resolves a domain before sending its IP to the local proxy, geosite can't see the original domain directly. Inbound sniffing may recover recognizable domain information from some HTTP or TLS traffic, but it doesn't support every protocol or encryption method. Check the current core's sniffing settings before enabling it, and don't treat sniffing as a substitute for DNS configuration.

• Core fails to start: Check the JSON syntax, outbound tags, and whether the required geo data categories exist. This isn't a network speed issue.
• Sites in mainland China still use the proxy: Check whether the domain is in the set, whether the inbound preserves the domain, and whether an earlier proxy rule matches first.
• Overseas sites unexpectedly connect directly: Check whether they match geoip:cn. If needed, add a higher-priority proxy exception for the domain.
• No change after editing: Check the active routing scheme, whether the core has reloaded, and the app's proxy entry point. Then check for existing connections and app cache.

DNS needs to be configured separately: DNS queries used for routing decisions aren't necessarily sent through the proxy automatically. If results look wrong, first check which DNS servers the core uses and how it connects to them, then decide whether to keep the IP fallback for mainland China. Before sharing troubleshooting logs, remove subscription URLs, credentials, and personal browsing records.