Rule

Chute can forward requests to another proxy server or connect to the host directly, depending on customized rules.

Priority

Rules are matched from the first one to the last one, in the order they appear in the config file. In other words, rules at the top of the list have higher priority than latter ones.

Composition

Each rule consists of 3 parts: rule type, a traffic matcher (except for FINAL rule), and a proxy policy: TYPE, VALUE, POLICY. Example: DOMAIN-SUFFIX,apple.com, DIRECT IP-CIDR, 192.168.0.0/16,ProxyA

Proxy policy must be named under one of a policy names, including a proxy, a policy group, DIRECT, or REJECT. Rules should end with a FINAL rule to define the default behavior. If the configuration contains no FINAL rule, Chute behaves as if FINAL,DIRECT were appended.

Example:

[Rule]
DOMAIN-SUFFIX,company.com,ProxyA
DOMAIN-KEYWORD,google,DIRECT
GEOIP,US,DIRECT
IP-CIDR,192.168.0.0/16,DIRECT
FINAL,ProxyB

Rule Types

Domain-based Rules

IP-based Rules

HTTP-level Rules

Process Rules (Mac Only)

Port & Source Rules

Advanced Matching Rules

Notice: Advanced matching rules are accepted by the configuration parser, but the current Chute releases do not yet populate the session attributes they match against, so these rules will not match any traffic at runtime. They are reserved for future releases.

Logical Combination Rules

Special Rules

Options

no-resolve

For a request whose hostname is a domain, Chute evaluates the rule list in two passes. On the first pass, IP-based rules (GEOIP, IP-CIDR, IP-ASN) are skipped. If no other rule matches, Chute resolves the domain with DNS and evaluates the rules again with the resolved IP address. Add the no-resolve option to keep an IP-based rule skipped on the second pass as well, so it only ever matches requests that already carry an IP address.

GEOIP,US,DIRECT,no-resolve
IP-CIDR,172.16.0.0/12,DIRECT,no-resolve

Notice: Because of the two-pass evaluation, for a request with a domain hostname a later non-IP rule can match before an earlier IP-based rule. If DNS resolution fails, IP-based rules simply never match and the FINAL rule applies; rule evaluation is not aborted.

force-remote-dns

Force DNS resolution through remote proxy server instead of local DNS.

DOMAIN-SUFFIX,google.com,Proxy,force-remote-dns

Notice: This option is currently parsed for compatibility only and has no effect in the current releases.

extended-matching

Extend domain-based rule matching to also inspect the HTTP Host header in addition to the connection hostname. This is useful when the SNI or CONNECT target differs from the Host header.

DOMAIN-SUFFIX,example.com,Proxy,extended-matching

requires-resolve

For SCRIPT rules, this option is accepted by the parser but does not delay script evaluation. $request.dnsResult is only available in the script when the session has already been resolved (for example, requests made directly to an IP address, or the second matching pass after DNS resolution).

SCRIPT,MyRuleScript,PROXY,requires-resolve

pre-matching

Only valid on rules whose policy is REJECT. The rule is evaluated in a separate pass before the normal rule list and before the rule result cache, so the reject applies even before protocol sniffing or DNS resolution.

DOMAIN-SUFFIX,tracker.example.com,REJECT,pre-matching

Aliases

• DOMAIN-MATCH is accepted as an alias of DOMAIN-KEYWORD.
• NETWORK is accepted as an alias of PROTOCOL.

Domain Set

Chute supports loading domain sets from an external URL with the DOMAIN-SET rule type. The first field after the type must be an http(s) URL. The optional update-interval parameter re-downloads the file every N seconds.

DOMAIN-SET,https://example.com/domains.txt,DIRECT
DOMAIN-SET,https://example.com/domains.txt,DIRECT,update-interval=86400

The domain set file contains bare domains, one per line: example.com matches the exact domain; .example.com or +.example.com matches the domain and all of its subdomains. Lines starting with # or // are comments.