HTTP Rule

There are 4 HTTP-level rule types. USER-AGENT and URL-REGEX require an HTTP request header, so they only match HTTP requests (or HTTPS requests with MitM decryption). PROTOCOL and SCRIPT are evaluated for any connection.

USER-AGENT

USER-AGENT,Instagram*,DIRECT

Rule matches if the user agent of the request matches. Wildcard characters * and ? are supported.

URL-REGEX

URL-REGEX,^http://google\.com,DIRECT

Rule matches if the URL matches the regular expression.

PROTOCOL

PROTOCOL,TLS,Proxy

Rule matches if the detected protocol of the connection matches. Use in combination with sniffing-enabled for best results. NETWORK is accepted as an alias of PROTOCOL.

Accepted protocol values: HTTP, HTTPS, TLS, TCP, UDP, QUIC, STUN, DNS, DOH, DOQ.

Notice: Protocol sniffing currently produces only HTTP, TLS (any TLS connection, including HTTPS), and QUIC (TUN inbound). The other accepted values are reserved — no detector produces them yet, so rules using them will not match. In particular, use PROTOCOL,TLS rather than PROTOCOL,HTTPS to match HTTPS traffic.

SCRIPT

SCRIPT,MyRuleScript,DIRECT

Rule evaluates a JavaScript script for custom matching logic. The script name must match a script defined in the [Script] section with type=rule.

[Rule]
SCRIPT,CheckInternal,PROXY

[Script]
CheckInternal = type=rule, script-path=internal-check.js

The rule script receives $request and must call $done({matched: true}) or $done({matched: false}). Note that $request.dnsResult is only available when the session has already been resolved (for example, requests made directly to an IP address, or the second matching pass after DNS resolution).