V2Ray Routing Rules: geosite and geoip Split Tunneling

At a glance

This guide is for users who can already connect to a server and want to fine-tune routing. It explains the difference between domain and IP lists, how to choose a domain resolution strategy, and how to combine ad blocking, direct connections for mainland China, and a proxy fallback. The examples use native V2Ray/Xray routing fields and show how to integrate them into an existing client configuration and verify the selected outbound in the logs—rather than relying on whether a webpage loads.

1. geosite and geoip: What They Match

Routing happens after a connection reaches the core. The core gets the destination domain or IP, checks routing.rules in order, and hands the connection to the corresponding outboundTag as soon as a rule matches. It does not combine all matching rules or keep searching for a “more specific” one. Both the rule contents and their order matter.

Syntax	Matches	Dependencies and limitations
`geosite:cn`	Domain category	Uses the cn category in geosite.dat; it does not include every domain ending in .cn.
`geoip:cn`	IP ranges assigned to mainland China	Uses geoip.dat and matches by IP address allocation, not by a website’s language or operator.
`geoip:private`	Private and special-purpose IP ranges	Commonly used for direct connections to local networks; check the current data file for the exact range of entries.
`domain:example.com`	A specified domain and its subdomains	Does not rely on domain categories, making it useful for custom exceptions.
`full:example.com`	Exact domain	Matches only the specified name, not its subdomains.

geosite is a collection of category data, not a live lookup service. The same category can contain different entries depending on the data source and update date. If startup reports that category-ads-all is missing, first check whether the data file includes that category; changing the proxy protocol will not help. Common Xray and V2Fly data files may provide these labels, but the contents of the files on your system are the source of truth.

2. domainStrategy: When to Resolve Domains for Routing

routing.domainStrategy controls how domain resolution is used during routing decisions. It is not a global DNS switch and is not the same as the setting with the same name on a direct outbound. If an app sends the core a destination IP, domain rules generally cannot recover the website’s name. If it sends a domain, the strategy below determines whether the core also looks up its IP.

IPIfNonMatch

Recommended

Try matching with the available information, including the domain. If no rule matches, resolve the destination domain and try IP rules. This is a useful starting point for split tunneling, but an all-traffic rule at the end will match on the first pass, so make sure your fallback is configured appropriately.

Best for: prioritizing domains while still checking IPs for uncategorized domains

AsIs

Does not resolve domains for routing decisions. Domains can match geosite or explicit domain rules, while an IP sent directly by the app can still match geoip. Its behavior is predictable, but geoip:cn cannot classify domains missing from the domain lists.

Best for: minimizing routing lookups and relying mainly on domain categories

IPOnDemand

Resolve the destination domain when a rule requiring an IP is reached. Put explicit domain rules before IP rules, then add a proxy fallback. This prioritizes domain matches while allowing IP rules to catch uncategorized domains.

Best for: adding IP-based matching with an explicit fallback rule

This guide uses IPOnDemand because the examples end with an explicit proxy fallback using network: "tcp,udp". With IPIfNonMatch, that fallback matches on the first pass, so uncategorized domains won’t trigger resolution after a failed match. Alternatively, remove the catch-all fallback and make the proxy the first outbound in the configuration. If you do, verify the outbound order generated by the client; changing only the strategy name is not enough.

The domain matched an ad-blocking rule and goes straight to the blocking outbound; no IP lookup is needed.
The domain matched a rule for mainland China and goes straight to the direct outbound, without being affected by later IP categories.
The domain did not match an earlier rule. The IP rule triggers resolution if needed; addresses in mainland China go direct, and all other connections reach the proxy fallback.

3. Before You Configure: Outbound Tags, Ports, and Data Files

The configuration below uses three outbound tags: proxy for an available proxy server, direct for a Freedom direct connection, and block for a Blackhole outbound. These are case-sensitive string references, not names shown in the interface. Whether a server uses VMess or VLESS does not change how routing references its tag; the existing outbound still handles its transport and security settings.

Outbound tags used in the examples

5 rules

Ordered rules in the combined example

10808

Local SOCKS port used for the tests below

Port 10808 is used only by the test commands in this guide; it is not the default in every installation. Before running a command, check the client’s local listening settings and replace the port number if needed. Keep the listening address at 127.0.0.1; there is no need to expose it to other devices on your local network for routing tests.

Save a backup

Back up your current configuration and custom routes. First use your current server to confirm that a known working website loads, then start adjusting the routing rules.
Check where to configure routing

In v2rayN, the usual path is Settings → Routing Settings. Note which rule sets are currently enabled. Menu locations may differ between interface versions, so use the page actually labeled Routing Settings. Don’t paste native configuration into a subscription URL field.
Check the outbound

Inspect the exported runtime configuration and confirm the proxy outbound’s actual tag. If it isn’t proxy, replace the corresponding references below. Keep the existing server, authentication, and transport settings intact.
Check the data files

Make sure the core can read geosite.dat and geoip.dat and that they include the categories used here, such as cn, private, and category-ads-all. If a category is missing, fix the data files or remove the corresponding rule before testing.
Apply and restart

Save the rules and restart the proxy service, then check the startup logs. Fix JSON parsing errors, missing tags, and data-loading errors before testing websites.

4. Configuration: Direct Connections, Ad Blocking, and Proxy Fallback

The following is a routing object to merge into the top level of a native configuration, not a complete client configuration with server credentials. The rules run in this order: block ad domains, send domains in mainland China direct, send private addresses direct, send IPs in mainland China direct, and route all remaining TCP/UDP traffic through the proxy. Add the three outbound tags described above to use these rules in your existing configuration.

{
  "routing": {
    "domainStrategy": "IPOnDemand",
    "rules": [
      {
        "type": "field",
        "domain": [
          "geosite:category-ads-all"
        ],
        "outboundTag": "block"
      },
      {
        "type": "field",
        "domain": [
          "geosite:cn"
        ],
        "outboundTag": "direct"
      },
      {
        "type": "field",
        "ip": [
          "geoip:private"
        ],
        "outboundTag": "direct"
      },
      {
        "type": "field",
        "ip": [
          "geoip:cn"
        ],
        "outboundTag": "direct"
      },
      {
        "type": "field",
        "network": "tcp,udp",
        "outboundTag": "proxy"
      }
    ]
  }
}

If your configuration already has a routing object, replace or reorganize its strategy and rules arrays rather than adding a second key with the same name at the same level. The outbound objects below provide direct and blocking connections; add the ones you need to your existing outbounds array. If a tag already exists, keep only one copy. Don’t replace your existing proxy server with this array.

[
  {
    "tag": "direct",
    "protocol": "freedom",
    "settings": {}
  },
  {
    "tag": "block",
    "protocol": "blackhole",
    "settings": {}
  }
]

Two ways to set it up: Keep your server and change only the routing

Manage rules in the graphical interface

Create or copy a custom rule set in Routing Settings.
Enter the domain, IP, and network conditions in the order shown.
Map the tags to the client’s proxy, direct, and block outbound options.
Enable the rule set and inspect the generated runtime configuration.

Native JSON configuration

Merge the routing object at the top level.
Keep the verified, working proxy outbound.
Add the direct and block outbound objects.
Have the client load the managed custom configuration and check the startup logs.

The graphical interface may rewrite tags or change outbound order. The core’s loaded configuration—not the rule set’s display name—is the final source of truth.

Here, “route traffic outside mainland China through the proxy” means “send traffic not blocked or routed direct by an earlier rule through the proxy.” It does not mean that every overseas website is listed individually. A fallback can cover newly appearing domains, but geoip:cn may still send a mainland China CDN address for an overseas service direct. To force a specific site through the proxy, put an explicit rule for its domain before the IP rules.

5. Rule Order and Exceptions: Specific Rules First

Putting ad-blocking rules before rules for domains in mainland China means that domains in the ad category will be blocked even if they are based in mainland China. If an essential login or static asset domain is blocked by mistake, add a specific exception before the ad rule. Keep exceptions as narrow as possible; don’t send an entire large domain category direct just to fix one asset.

{
  "type": "field",
  "domain": [
    "full:static.example.com"
  ],
  "outboundTag": "direct"
}

static.example.com is a sample domain for illustrating match syntax, not a real resource that needs to be allowed. Replace it with the exact destination name shown in your logs, then place this rule before the ad-blocking rule. Use domain: only when you need to include all subdomains; for a single hostname, prefer full:.

Goal	Where to insert the rule	What to check
Allow a domain blocked by mistake	Before the ad-blocking rule	Allow only essential domains confirmed in the logs.
Force a specific site through the proxy	Before the rules for direct connections to mainland China domains and IPs	Include the site’s separate asset domains if needed.
Send a specific local network address direct	Before the proxy fallback	Check whether the app is actually sending the request to the core.
Change the default outbound	At the end of the rules array	Don’t let a catch-all rule match before later rules can run.

Blocking ad domains does not filter page elements. If ads and page content share a hostname, routing cannot remove only the ad content. Blocking by domain may also disrupt video playback, sign-in, or analytics callbacks. If something breaks, first identify the matched domain and outbound, then narrow the block list.

6. Test Routing: Check Outbound Logs, Not Just the Page

Keep the proxy mode and server unchanged while testing, and change only one rule at a time. Temporarily enable a log level that records connection routing, then check the destination and outbound tag for the same request. Restore your usual log level when done. Logs may contain the destinations you visit, so remove subscription URLs, server credentials, and personal browsing history before sharing screenshots.

Domains in mainland China: Choose a site confirmed to be included in the current geosite:cn category. Check that its connection goes through direct instead of judging by page load speed.
Proxy fallback: Choose a destination confirmed not to match an earlier rule and check that its outbound is proxy. An exit IP check can help verify that request, but it is not conclusive on its own.
Ad rule match: Find a domain confirmed as part of the ad category in your local data or access logs, and check that it goes to block. There’s no need to visit an unfamiliar site.
Private address: Access a local network service you manage and check that it goes through direct. If your browser bypasses the proxy according to system settings, the request may never appear in the core’s logs.

Command-line tests can reduce interference from browser caching and extensions. These commands require a local SOCKS listener at 127.0.0.1:10808 and use socks5h to resolve the destination domain through the proxy. On Windows, use curl.exe to avoid command alias differences; on other systems, use curl.

curl --proxy socks5h://127.0.0.1:10808 --connect-timeout 10 --max-time 20 -I https://www.baidu.com
curl --proxy socks5h://127.0.0.1:10808 --connect-timeout 10 --max-time 20 -I https://example.com

These two addresses generate requests that you can observe; their final category is not guaranteed across data versions or network environments. Receiving an HTTP status code means the request got a response, not that it used a particular outbound, so check the logs as well. If the first command returns a redirect, check the actual destination of each connection rather than assuming the new domain follows the same match result.

7. Common Issues: DNS, Mode Overrides, and Missing Categories

Why is a mainland China website still going through the proxy after I added geoip:cn?

First, check whether the active configuration uses IPIfNonMatch and has a catch-all rule at the end. This combination may send a domain to the proxy fallback before resolving it. As in this guide, use IPOnDemand and put the IP rules before the fallback. Then check whether the resolved address belongs to the current geoip:cn category.

Why don’t the logs change after I save the rules?

Make sure the rule set is enabled and the service has been restarted after saving. Check whether global proxy or global direct mode is overriding your custom routing, then confirm that the app is actually using the local proxy. System proxy settings affect only apps that honor them; they do not take over every network connection.

What should I do if startup says a geosite category is missing?

First, note the exact missing label in the error, then check the location and contents of the data file actually loaded by the core. Temporarily remove the rule to see whether the rest of the configuration starts, then install a compatible data file with the missing category. Updating the subscription’s server list usually won’t fix missing category data.

Can I copy desktop routing settings directly to Android?

v2rayNG uses the Xray core, while v2flyNG uses the V2Fly core. The basic fields in this guide are widely supported by their respective cores, but the client interfaces, custom configuration options, and data management differ. Check the outbound tags and data categories, then import the rules using a method supported by your client. Don’t use the entire desktop configuration file as a subscription URL.

If I use geosite, do I still need to check DNS?

Yes. IP-based checks for uncategorized domains depend on DNS results, and direct connections also need a usable destination address. routing.domainStrategy does not ensure that DNS requests from every app are intercepted, nor does it provide a complete DNS privacy solution. First check whether the app sends a domain or an IP, then inspect the resolution path and actual outbound.

Use this troubleshooting order: can the configuration load; does the request reach the core; is the destination a domain or an IP; which rule matches first; and can the outbound establish a connection? Check these five points before adding categories or changing DNS. This separates a rule that didn’t match from a correctly matched rule whose server connection failed, reducing the disruption caused by repeated configuration changes.