7. Routing, Rules, and Policies#

The routing system decides "which outbound a connection ultimately uses." Link1 evaluates rules in order and returns the result from the first matching rule.

Minimal Rule#

rules:
  - MATCH,DIRECT

Meaning: all connections go direct.

Common proxy configuration:

rules:
  - DOMAIN-SUFFIX,google.com,PROXY
  - GEOIP,CN,DIRECT
  - MATCH,PROXY

Meaning:

1. *.google.com uses PROXY.

1. If the destination IP belongs to CN, use DIRECT.

1. All other connections use PROXY.

Rule Format#

Regular rules:

TYPE,ARGUMENT,ACTION[,OPTIONS]

MATCH:

MATCH,ACTION

Logical rules:

AND,((rule1),(rule2)),ACTION
OR,((rule1),(rule2)),ACTION
NOT,((rule1)),ACTION

Sub-rule jump:

SUB-RULE,(condition expression),sub-rule name

Commas and Quotes#

Rule lines use commas to separate fields. In general, node names, policy group names, RULE-SET names, and SUB-RULE names should not contain commas. If they do contain commas, wrap the corresponding field in double quotes:

rules:
  - DOMAIN-SUFFIX,corp.example,"Corp, VPN"
  - RULE-SET,"$Corp, VPN","Corp, VPN"
  - MATCH,"Fallback, Group"

Inside double quotes, use a backslash to escape " and \. Single quotes can also wrap fields; inside single quotes, use two single quotes to represent one literal single quote. Quotes only affect comma splitting and removal of the surrounding quotes; they do not change field semantics. The action must still match an actual node name or policy group name.

What Is an Action?#

An action is the target that handles a rule match. It can be:

• DIRECT: connect directly.

• REJECT: reject the connection.

• A static node name.

• A node name generated by a provider.

• A policy group name.

If the action does not exist, configuration compilation fails.

Complete Rule Type List#

Domain Rules#

Practical impact: these rules require Link1 to know the domain name. Explicit proxies can usually obtain the domain; TUN/transparent proxying depends on DNS/Fake-IP/Sniffer.

IP, GeoIP, and ASN Rules#

Effect of no-resolve:

• When written after an IP-related rule, it means do not actively resolve the domain for this rule.

• Suitable for rules that do not need DNS, such as reserved addresses and private network addresses.

• If the destination only has a domain and the rule requires an IP, it will not match without resolution.

Port, Inbound, and Network Rules#

Common port range formats: 80, 443, 10000-20000. In TUN selectors, port ranges use start:end; in rules, use the range format supported by the rule parser.

Process and UID Rules#

Practical impact:

• Process rules depend on platform capabilities and find-process-mode.

• Process information may be unavailable on routers, in containers, or under limited system permissions.

• UID rules are only supported on Linux/Android.

Rule Sets and Logical Rules#

MATCH and SUB-RULE cannot be used as inner matchers in logical rules.

Sub-rules#

Sub-rules let you extract part of the rule flow:

sub-rules:
  tls-flow:
    - DOMAIN-SUFFIX,openai.com,AI
    - DOMAIN-SUFFIX,github.com,PROXY
    - MATCH,DIRECT

rules:
  - SUB-RULE,(DST-PORT,443),tls-flow
  - MATCH,DIRECT

Practical impact:

• After the main rule matches the SUB-RULE condition, matching continues in the specified sub-rule list.

• The sub-rule name must exist.

• Avoid circular references.

rule-providers#

Rule providers load large numbers of rules from HTTP, files, or inline payloads.

rule-providers:
  private:
    type: http
    behavior: domain
    format: text
    url: https://example.com/private.txt
    path: ./rules/private.txt
    interval: 86400
    proxy: DIRECT
    size-limit: 1048576

rules:
  - RULE-SET,private,DIRECT

Field effects:

Choosing behavior#

rule-sets#

rule-sets are parsed/inline rule set configurations, usually used for runtime or advanced configuration. Users should generally prefer rule-providers.

Recommended Rule Order#

Recommended order: from specific to general.

rules:
  # 1. Localhost, LAN, and management plane
  - IP-CIDR,127.0.0.0/8,DIRECT,no-resolve
  - IP-CIDR,192.168.0.0/16,DIRECT,no-resolve
  - DOMAIN-SUFFIX,lan,DIRECT

  # 2. Explicit business domains
  - DOMAIN-SUFFIX,openai.com,AI
  - DOMAIN-SUFFIX,github.com,PROXY

  # 3. Large rule sets
  - RULE-SET,reject,REJECT
  - RULE-SET,private,DIRECT
  - RULE-SET,china,DIRECT
  - RULE-SET,global,PROXY

  # 4. IP geo rules
  - GEOIP,CN,DIRECT

  # 5. Final fallback
  - MATCH,PROXY

Testing Rules with Link1 App#

The rule testing feature in Link1 App can construct a "virtual connection." It does not actually access the network; it only checks how rules would match. Common inputs include:

Focus on three things in the test result:

• Which rule was matched.

• Whether the final action is a node, policy group, DIRECT, or REJECT.

• Whether it fell through to the fallback MATCH due to a missing domain, missing source information, or rule order.

If the rule test is correct but the real connection is not, the real connection metadata differs from the test input. The most common reason is that under transparent proxying/TUN, the real connection only has an IP and no domain.