# Sets & Routing Rules

## `[domain-sets]`

Domain sets select an output through `[routing]`; they are separate from HTTP capture domains and exact DNS host records.

This section defines named sets of domains for use in routing rules. The key is the set name.

**Example:**
```ini
[domain-sets]
social-media=twitter.com,facebook.com,instagram.com
```

## `[cidr-sets]`

This section defines named sets of IP ranges (CIDRs) for use in routing rules. The key is the set name.

**Example:**
```ini
[cidr-sets]
private-ips=10.0.0.0/8,192.168.0.0/16
```

## `[routing]`

Rules use fixed priority levels, not one global top-to-bottom list. Domain sets use the most specific suffix; only keywords use saved order. IP ranges use longest-prefix matching. See the [routing engine](../core-components/routing-engine.md) for DNS precedence, packet routing, and examples.

**Rule Format:** `TYPE,VALUE,ACTION,TARGET` for match rules, or `TYPE,ACTION,TARGET` for reserved/default rules such as `DNS-FALLBACK`, `VPN-DNS-SERVER-DOMAINS`, and `DEFAULT`.

| Type | Value | Action | Target | Description |
|---|---|---|---|---|
| `DOMAIN-SET` | Name of a domain set | `L3VPN`, `L4PROXY`, `DIRECT`, `DROP`, `REJECT` | Name of an l3vpn/l4proxy | Route based on a domain set. |
| `DOMAIN-KEYWORD` | Keyword | `L3VPN`, `L4PROXY`, `DIRECT`, `DROP`, `REJECT` | L3VPN/L4PROXY | Literal substring of the canonical DNS name; first matching keyword in saved order. Domain sets always take precedence. A forwarding match bypasses the ad filter. |
| `CIDR-SET` | Name of a CIDR set | `L3VPN`, `L4PROXY`, `DIRECT`, `DROP`, `REJECT` | Name of an l3vpn/l4proxy | Route based on a CIDR set. |
| `CIDR` | A single CIDR | `L3VPN`, `L4PROXY`, `DIRECT`, `DROP`, `REJECT` | Name of an l3vpn/l4proxy | Route based on a single IP range. |
| `DNS-FALLBACK` | (Not used) | `DIRECT`, `L3VPN`, `L4PROXY`, etc. | Name of an l3vpn/l4proxy | Default DNS behavior for domains not in any set. |
| `VPN-DNS-SERVER-DOMAINS` | (Not used) | `L3VPN`, `L4PROXY` | Name of an l3vpn/l4proxy | (New in 1.9.0) route encrypted VPN DNS server domain bootstrap traffic through a selected VPN/proxy. Required when `vpn-dns` uses DoT/DoH upstreams with domain names. |
| `DEFAULT` | (Not used) | `DIRECT`, `L3VPN`, `L4PROXY`, etc. | Name of an l3vpn/l4proxy | The final catch-all rule for all traffic. |

**Example:**
```ini
[routing]
DOMAIN-SET,social-media,L4PROXY,my-shadowsocks
CIDR-SET,private-ips,DIRECT
VPN-DNS-SERVER-DOMAINS,L4PROXY,my-shadowsocks
DEFAULT,L3VPN,my-wireguard
```