Make sense of proxy and routing

01 · Traffic entry and exit

System proxy settings direct participating applications to the local core; they do not force every app to use it. Once traffic arrives, routing selects direct, proxy, block or another outbound.

Automatic system proxy can coexist with rules that bypass selected destinations. Routing changes cannot affect an application that never sends its traffic to the core.

1. App
2. System / manual proxy / TUN
3. Core routing
4. Direct / proxy / block

02 · Four system proxy modes

These modes control system settings when the service starts or restarts. Check whether another application also manages those settings.

03 · An everyday workflow

Import and activate a working profile, check core startup, enable automatic system proxy and select an appropriate existing routing preset. Make a browser request and inspect the target/outbound in logs.

For a single app with manual proxy settings, use HTTP or SOCKS5 at 127.0.0.1 and the client’s actual mixed listening port. This is not the remote server port.

Local port reference

04 · PAC versus automatic mode

Automatic mode sends app requests to the core for routing. PAC runs an application-side script first: DIRECT bypasses the core, while proxied requests still pass through core routing.

On Windows, pac.txt in storage contains JavaScript such as FindProxyForURL. Back it up before editing and keep valid syntax. Reapply settings after changes because apps may cache the script. PAC only affects applications that support it.

05 · Presets and custom routing

Start with the generated routing presets. Rules are evaluated in order; specific domain/IP rules belong before a catch-all. Add a rule for your target and activate the edited rule set.

A global routing preset controls traffic already inside the core; it cannot force applications that ignore system proxy to use the core.

Write routing rules

06 · Exit and restore networking

Choose Clear system proxy before quitting when you no longer need it. Shutdown, forced termination or a crash may leave settings behind.

If the client is stopped and browsing fails, check for a proxy still pointing at 127.0.0.1. Reopen the client to clear it, or remove the stale setting through the OS network settings, then test ordinary connectivity.

07 · Rules are an ordered JSON array

Each object is a rule. enabled toggles it, remarks labels it and outboundTag selects an existing outbound. The client editor schema is not identical to a native core configuration; export client rules as a starting point.

After saving, activate the rule set and reapply the profile. Evaluation stops at the first matching rule.

08 · Common matching fields

Multiple values within a condition generally provide alternatives; different conditions constrain one another. v2rayN splits domain, IP and process fields when combined, so use one of these per rule.

09 · Start with a precise rule

This example sends example.com and its subdomains directly and everything else through proxy. The catch-all belongs last. In an existing rule set, add the specific rule before its existing catch-all.

JSON · client routing rulesCopy

[
  {
    "remarks": "Example domain direct",
    "domain": [
      "domain:example.com"
    ],
    "outboundTag": "direct",
    "enabled": true
  },
  {
    "remarks": "Fallback proxy",
    "port": "0-65535",
    "outboundTag": "proxy",
    "enabled": true
  }
]

10 · Common rule combinations

Use direct rules for private IP ranges and private domains to keep local resources reachable, with matching GEO data installed. A rule with network=udp, port=443 and outboundTag=block blocks UDP 443 and can affect QUIC/HTTP/3; it is not a universal connection fix.

Domain rules need domain information. An app connecting directly to an IP may not match them. Sniffing, DNS mode and application-managed encrypted DNS affect what the core can see.

11 · Domain resolution strategy

Xray AsIs keeps the domain during routing; IPIfNonMatch resolves after domain matching fails; IPOnDemand resolves when an IP-based rule needs it. This routing policy is separate from actual outbound DNS resolution.

Place domain rules deliberately and avoid broad IP rules taking precedence unintentionally.

DNS settings

12 · Import, validate and revert

Import rules from a file, clipboard or subscription URL. Keep the old set, use valid JSON without comments/trailing commas, verify outbound tags and data categories, and avoid an overly broad first rule.

Test a specific destination with a new connection and inspect the selected outbound. Existing long-lived connections may retain their old path; restart the target app if needed. Revert to the previous rule set on failure.