HTTP Rule

There are 4 HTTP-level rule types. USER-AGENT and URL-REGEX require an HTTP request header, so they only match HTTP requests (or HTTPS requests with MitM decryption). PROTOCOL only matches TUN inbound sessions, where protocol sniffing runs. SCRIPT is evaluated for any connection.

USER-AGENT

USER-AGENT,Instagram*,DIRECT

Rule matches if the user agent of the request matches. Wildcard characters * and ? are supported.

URL-REGEX

URL-REGEX,^http://google\.com.*,DIRECT

Rule matches if the URL matches the regular expression. The regular expression must match the complete URL, not just a substring: ^http://google\.com alone would only match exactly http://google.com.

PROTOCOL

PROTOCOL,TLS,Proxy

Rule matches if the detected protocol of the connection matches. Use in combination with sniffing-enabled for best results. NETWORK is accepted as an alias of PROTOCOL.

Accepted protocol values: HTTP, HTTPS, TLS, TCP, UDP, QUIC, STUN, DNS, DOH, DOQ.

Notice: The detected protocol is only populated for TUN inbound sessions: sniffing produces HTTP and TLS (any TLS connection, including HTTPS) for TCP, and QUIC for UDP. Connections arriving via the HTTP or SOCKS5 proxy inbounds never match PROTOCOL rules. The other accepted values are reserved — no detector produces them yet, so rules using them will not match. In particular, use PROTOCOL,TLS rather than PROTOCOL,HTTPS to match HTTPS traffic.

SCRIPT

SCRIPT,MyRuleScript,DIRECT

Rule evaluates a JavaScript script for custom matching logic. The script name must match a script defined in the [Script] section with type=rule.

[Rule]
SCRIPT,CheckInternal,PROXY

[Script]
CheckInternal = type=rule, script-path=internal-check.js

The rule script receives $request and must call $done({matched: true}) or $done({matched: false}). Note that $request.dnsResult is only available when the session has already been resolved (for example, requests made directly to an IP address, or the second matching pass after DNS resolution).