v2rayN Routing Rules: Configure geosite and geoip Split Tunneling

1. What geosite and geoip Match

v2rayN is the client interface; the selected core handles the connections. Subscriptions mainly provide server addresses, protocols, authentication, and transport settings. Routing determines which outbound handles each connection that reaches the local core. Updating a subscription does not update routing databases or automatically fix the order of custom rules.

geosite matches domains against a domain list, while geoip matches IP addresses against an IP list. Both depend on the corresponding data files; their names do not mean they provide real-time geolocation. In particular, geosite:cn refers to a domain category maintained in the database. It does not mean “every website ending in .cn,” nor does it guarantee where a server is physically located.

Here, example.com is just a syntax example, not a rule you should add. When checking your own site, use the actual hostname shown in your browser or core logs. A single page may load resources from multiple domains, so a direct connection to the homepage does not mean its login API, images, and video will match the same rule.

2. Choosing domainStrategy: Domain First or IP First

routing.domainStrategy determines whether the destination domain is resolved during routing. It is not a DNS server address or the resolution strategy used by the direct outbound. The settings may have similar names, but they apply at different stages: one provides an IP for outbound selection, while the other may resolve the address when establishing a direct connection.

One easy-to-miss case: using IPIfNonMatch while adding network: tcp,udp → proxy as the last rule. That rule can catch the connection on the first pass, so it is never truly “unmatched.” Domain resolution fallback may not run, which means the earlier geoip:cn rule cannot provide an IP-based fallback for that domain connection.

• For the approach in this guide: Do not add a catch-all traffic rule, and make sure the first outbound in the generated configuration is proxy. When no routing rule matches, the core uses the first outbound.
• If you need an explicit final fallback: Consider switching to IPOnDemand, place IP rules before the fallback, then verify DNS behavior and outbound logs.
• For domain-only routing: You can choose AsIs, but do not expect domain connections to fall back automatically to geoip:cn.

3. direct, proxy, block, and Rule Order

The core checks rules from top to bottom, and the first match determines the outbound. direct, proxy, and block are outbound tags, not magic keywords that work just because you type them. The complete configuration must define outbounds with those tags. If a custom configuration uses different tags, update the routing references to match.

Suggested order: single-domain exceptions, ad blocking, direct access to private addresses, direct access to mainland China domains, and direct access to mainland China IPs. Unmatched traffic then uses the default proxy outbound. Exceptions go first so broader categories cannot override them, but they also take priority over ad rules. Add only domains that genuinely need an exception.

4. Create a Separate Routing Profile in v2rayN

The menu steps below refer to the Windows WPF interface in v2rayN 7.x. Button names can vary between desktop editions and minor versions. If you cannot find the exact menu item, check the current interface's settings for routing controls. Do not paste the core JSON below into a node address or subscription URL field. Keep your existing routing profile so you can switch back if needed.

1. Confirm the node works

   Select an available node on the main screen and set it as the active server. First, use your existing routing profile to confirm that websites load. If the node times out, authentication fails, or the TLS handshake fails, follow the Troubleshooting guide first; routing rules cannot fix a remote connection.

2. Open routing settings

   Go to “Settings” → “Routing Settings” and create a routing profile named “Mainland China Direct Test.” If the interface offers an advanced routing toggle, make sure advanced rules are enabled and select the new profile for use.

3. Choose a domain strategy

   Set the profile's domain strategy to IPIfNonMatch. Then check for a final rule that sends all TCP and UDP traffic through the proxy. This guide does not use that rule; instead, it requires proxy to be the default outbound.

4. Add each condition separately

   Add four rules in this order: ad domains, private IPs, mainland China domains, and mainland China IPs. Use geosite: for domain conditions and geoip: for IP conditions. Do not put domain and IP conditions in the same rule to mean “either one.”

5. Save and review

   Save the profile and reload the core configuration. Check the generated rule order, outbound tags, and the order of outbounds. If proxy is not the default outbound, adjust the default outbound setting for your version or use the explicit fallback approach described earlier.

6. Test each case

   Keep the node, browser, and proxy connection method unchanged while testing a mainland China domain, an overseas domain, and a private network IP. Start a new connection after each change so the browser does not reuse an existing one. The rules are working as intended only when the outbound shown in the logs matches your expectations.

Within a single field rule, conditions of different types usually all need to match; multiple values in the same condition array match any one of those values. Combining domain and ip in one rule does not replace two separate direct-connection rules. This is an easy mistake to make when editing either a hand-written configuration or a graphical interface.

5. Core Routing Snippet: Domains First, IP Fallback

The snippet below shows only the routing object. It does not include inbounds, node credentials, DNS, or outbound definitions, so it is not a complete configuration or an import format for a v2rayN routing profile. Use it to enter rules one at a time in the interface. If using a custom core configuration, merge it into the existing structure and confirm that all three outbound tags exist.

{
  "routing": {
    "domainStrategy": "IPIfNonMatch",
    "rules": [
      {
        "type": "field",
        "domain": [
          "geosite:category-ads-all"
        ],
        "outboundTag": "block"
      },
      {
        "type": "field",
        "ip": [
          "geoip:private"
        ],
        "outboundTag": "direct"
      },
      {
        "type": "field",
        "domain": [
          "geosite:cn"
        ],
        "outboundTag": "direct"
      },
      {
        "type": "field",
        "ip": [
          "geoip:cn"
        ],
        "outboundTag": "direct"
      }
    ]
  }
}

• Default proxy requirement: In the complete configuration, outbounds[0].tag must be proxy. The routing snippet above alone cannot ensure that unmatched connections use the proxy.
• Category requirement: The current data files must include cn, private, and category-ads-all. After replacing the database, confirm that these categories can still be loaded.
• IP-only connections: When accessing 192.168.1.1, the IP condition can match directly without waiting for domain resolution. If your device uses a different address, test with its actual IP.
• Domain connections: First, the ad and mainland China domain categories are checked. If neither matches, the domain is resolved according to the selected strategy and IP conditions are tried. A failed lookup cannot produce a usable destination IP.

If a site in a mainland China category needs to always use the proxy, add a separate domain exception before the ad rule and point it to proxy. If only one subdomain is causing trouble, prefer an exact full: match instead of immediately broadening the rule to the entire domain and all its subdomains.

6. Verify Split Tunneling: Check Traffic Capture, DNS, and Outbound

A website loading only proves that one path works; it does not prove that the expected outbound was used. For testing, keep one node selected and confirm the local proxy port used by the app. A common local listening port in v2rayN is 10808, but an existing installation may use a different port. Check the current settings and core startup logs rather than assuming this port is fixed.

To test while keeping the domain intact for a SOCKS proxy, use the command below. The h in socks5h means the proxy resolves the destination domain, avoiding a local lookup that would send only an IP to the core. The local port must provide a SOCKS service, and curl must be installed on your system.

curl --proxy socks5h://127.0.0.1:10808 --connect-timeout 10 --max-time 20 https://www.baidu.com/ --output /dev/null

The command above is intended for Linux and macOS terminals. In Windows Command Prompt, replace /dev/null with NUL and use curl.exe if needed. The 10-second connection timeout and 20-second total timeout are test limits, not measured latency or a speed guarantee. Whether this domain should connect directly depends on your data files and logs.

• No connection logs: First check whether the app is bypassing the proxy, whether the listening port is correct, and whether the core has started. Do not start by changing geosite.
• The domain appears, but the outbound is wrong: Check rule order, category contents, the active routing profile, and whether a catch-all rule matched first.
• The logs show only an IP: The app may have resolved the domain locally. Domain rules cannot directly match an IP-only destination. Sniffing may provide domain information for supported protocols, but it cannot recover every domain for every connection.
• Resolution fails or returns an unexpected address: Check the current DNS settings and resolution path. Routing decisions and the outbound path for DNS queries are related but separate issues; do not assume all DNS requests should go direct.

7. Common Issues: Rules Not Matching and Ads Blocked by Mistake

Keep a verified copy of your routing profile. If one site has a problem later, change only one variable at a time: first determine whether the issue involves a domain category, an IP category, DNS, or the node connection, then add the narrowest possible exception. This makes it easier to identify what changed and revert if the fix does not work.

• Before saving: make sure domain and IP conditions are in the correct fields and the ad rule is not overridden by a broader rule.
• After enabling: confirm that the default outbound is proxy and that local network and mainland China test connections use direct.
• After updating the data: confirm that the core loads successfully, the existing categories are available, and key sites are routed as expected.
• When sharing troubleshooting details: provide only the necessary rules and redacted logs. Do not share subscription URLs or node authentication details.