From domain names to access protocols.
Match by full domain name, domain suffix, or keyword, and select actions by IP range, GeoIP country, destination port, and network protocol.
Company traffic goes through the proxy. Everyday browsing can connect directly.
In Surge 6, Mihomo, or Shadowrocket, select paths by rule so that different business traffic on the same device uses different egress points.
Learn about business rulesPick a path based on the destination.
Company business traffic selects a specified Relay, frequently used services can be handled by rule packages, and destinations that need to be blocked select denial.
A set of services managed with a rule pack.
Select a business category from the rule package catalog, review the destinations in the package, then set a unified action. Published versions use the selected rule package version.
Specific rules, placed first.
Business rules match in order, and the first match determines the access method. Place company business before general rules; if nothing matches, the default action applies.
For this kind of traffic,
use the Cloud Pulse egress.
For the rule, select "use the Cloud Pulse proxy after reaching the Connector", then choose a purchased or bring-your-own Cloud Pulse. Matched access travels along the Relay to the final Connector, where the node uses the SOCKS5 service.
Proxy credentials are used by nodes and are not included in employee client configurations. Such rules use a Relay; a direct-connect Gateway cannot be selected.
Learn about Cloud Pulse →Publish new rules, then refresh the existing subscription.
Select the subscription for Surge 6, Mihomo (Clash format) or Shadowrocket. When an administrator saves a draft, devices continue using the published configuration; after publishing, employees refresh the original link to retrieve and enable the new rules.
When a new version appears in the rule pack catalog, it does not automatically update configurations that have already been published. Review the targets in the pack, select the version you need, then publish the update.
Learn about client subscriptions →Frequently asked questions.
Are "direct connection" and "direct-connect Gateway" the same thing?
The client's "direct connection" action uses the device's local network to reach the target. A Gateway that supports native AnyTLS and has direct-connect mode enabled is still a proxy node; selecting it routes access through that Gateway.
Can custom rules override platform security rules?
No. The client's platform security rules take precedence over business rules: localhost, private networks, link-local addresses and explicit AXVIA control domains use a direct connection, while known cloud metadata endpoints are denied access. Other business rules are matched in order.
How do I choose between client-side traffic routing and node traffic routing?
If Surge 6, Mihomo or Shadowrocket must select the path on the device, use client-side traffic routing. If an ingress or egress node must handle all access passing through it uniformly, use node traffic routing. Resolution, enabling and connection-failure handling on the client depend on the software used, and the two types of policy are managed separately.