Custom Rule Guide

Learn how to write custom traffic routing rules in Safewoo VPN.

Rule Format

Each rule is written on a single line with comma-separated fields:

TYPE,value,ACTION[,no-resolve]

TYPEThe rule type (e.g. DOMAIN-SUFFIX, IP-CIDR)

valueThe match target (e.g. google.com, 192.168.0.0/16)

ACTIONWhat to do when the rule matches

no-resolve(Optional) Skip DNS resolution — only for IP-based rules

Lines starting with # are treated as comments and ignored.

Actions

DIRECTConnect directly without going through the proxy

PROXYRoute traffic through the VPN/proxy

REJECTBlock the connection entirely

Rule Types

Domain Rules

DOMAIN

Exact domain match

DOMAIN,example.com,PROXY

DOMAIN-SUFFIX

Matches google.com and all subdomains (*.google.com)

DOMAIN-SUFFIX,google.com,PROXY

DOMAIN-KEYWORD

Matches if domain contains the keyword

DOMAIN-KEYWORD,youtube,PROXY

DOMAIN-WILDCARD

Wildcard pattern matching (* and ?)

DOMAIN-WILDCARD,*.google.*,PROXY

DOMAIN-REGEX

Regular expression match on the domain

DOMAIN-REGEX,^ad\.,REJECT

GEOSITE

Match against the GeoSite database category

GEOSITE,category-ads,REJECT

IP Rules

IP rules support the optional no-resolve parameter to skip DNS resolution.

IP-CIDR

Match IPv4 address range

IP-CIDR,192.168.0.0/16,DIRECT,no-resolve

IP-CIDR6

Match IPv6 address range

IP-CIDR6,fd00::/8,DIRECT,no-resolve

GEOIP

Match country code from the GeoIP database

GEOIP,CN,DIRECT

IP-ASN

Match Autonomous System Number

IP-ASN,13335,PROXY

IP-SUFFIX

Match IP suffix range

IP-SUFFIX,8.8.8.8/24,DIRECT

SRC-IP-CIDR

Match source IP range

SRC-IP-CIDR,192.168.1.0/24,DIRECT

SRC-GEOIP

Match source IP by country code

SRC-GEOIP,CN,DIRECT

Port & Protocol Rules

DST-PORT

Match destination port (single or range like 8000-9000)

DST-PORT,443,PROXY

SRC-PORT

Match source port

SRC-PORT,7777,DIRECT

NETWORK

Match protocol (tcp or udp)

NETWORK,udp,DIRECT

Process Rules

Process rules may not be available on all platforms.

PROCESS-NAME

Match by process name

PROCESS-NAME,telegram,PROXY

PROCESS-PATH

Match by full process path

PROCESS-PATH,/usr/bin/curl,PROXY

Examples

Here are some common use cases:

Route a website through the proxy

Route all traffic to openai.com and its subdomains through the proxy.

DOMAIN-SUFFIX,openai.com,PROXY

Block ads from a domain

Block all connections to ads.example.com.

DOMAIN-SUFFIX,ads.example.com,REJECT

Direct connection to a local service

Connect directly to addresses in the 10.x.x.x range without DNS resolution.

IP-CIDR,10.0.0.0/8,DIRECT,no-resolve

Route a specific app through proxy

Route all Telegram traffic through the proxy (desktop only).

PROCESS-NAME,telegram,PROXY

Block connections to a keyword

Block all domains containing "tracker".

DOMAIN-KEYWORD,tracker,REJECT

Multiple rules together

Combine multiple rules with comments for clarity.

# Route streaming through proxy
DOMAIN-SUFFIX,netflix.com,PROXY
DOMAIN-SUFFIX,youtube.com,PROXY

# Block ads
DOMAIN-KEYWORD,adserver,REJECT
DOMAIN-SUFFIX,doubleclick.net,REJECT

# Local network direct
IP-CIDR,192.168.0.0/16,DIRECT,no-resolve

Important Notes

•Rules are evaluated in order from top to bottom. The first matching rule wins.
•A catch-all rule (MATCH,PROXY) is automatically added at the end — you do not need to add it.
•Custom rules are stored locally on your device only and will not sync across devices.
•After saving, the proxy engine will restart briefly to apply the changes.
•Lines starting with # are comments and will be ignored.