01

Every rule is three fields

A rule is always type, value and policy, separated by commas. DOMAIN-SUFFIX,github.com,PROXY reads as: any domain ending in github.com goes to the policy group named PROXY.

The types worth knowing come in three families. By domain: DOMAIN for an exact match, DOMAIN-SUFFIX for anything ending in that string, DOMAIN-KEYWORD for anything containing it. By address: IP-CIDR and GEOIP. And PROCESS-NAME, which matches the program that opened the connection.

A wrong policy name breaks the config
The third field must be a policy group that already exists, or DIRECT or REJECT. Anything else and the profile will not load.

SponsoredWhere does the subscription link come from?Our partner provider gives you 1 GB of high-speed Hong Kong data at signup — import it in one click.Get high-speed nodes
02

Where to put them so an update does not erase them

  1. 1

    Editing the downloaded profile is wasted work

    The file your subscription produced is a cache. The next update overwrites it whole and every line you added goes with it. Almost everyone makes this mistake once.

  2. 2

    Use prepend-rules in the extended config

    Open the edit menu on the profile and choose the extended configuration, the Merge file. Add a prepend-rules block and list your rules under it. Clash Verge inserts them ahead of the subscription rules every time the final config is built.

  3. 3

    Position is priority

    Inside prepend-rules, higher means earlier. Your lines have to sit above the broad group rules the provider ships, or those match first. Writing rules at the bottom does nothing, because nothing after the closing MATCH is ever read.

03

Three places this goes wrong

DOMAIN-SUFFIX matches the end of a name, so example.com catches every subdomain, which is usually what you want. DOMAIN-KEYWORD is a substring test, and a short keyword like google collects every domain containing those letters. IP rules have a hidden catch: a domain has to be resolved to an address before the rule can compare anything, and that lookup may already have gone the wrong way.

  • Search the domain on the Rules page and confirm the first match is your line
  • A yaml parse error in the log is nearly always indentation or a missing comma
  • Connections opened before the change keep the old route; close them first
04

Common questions

The rule is in and traffic still takes the old path. Where do I start?

Confirm the profile reloaded: the top of the log page should show a reload entry, and any error there comes first. Then search the domain on the Rules page and see which line matches; if it is not yours, something above it caught the request. Last, check the Chains column on the Connections page.

What goes in PROCESS-NAME on Windows and on macOS?

On Windows it is the executable name with its extension, for example chrome.exe. On macOS and Linux it is the binary name with no extension, for example curl. Match the process list exactly, capitalization included, and note that the core needs permission to read process information.