Routing

Routing

The routing mode decides what happens to most traffic. Custom rules decide the exceptions: which sites, apps, countries or addresses always go through the proxy, go direct, or are blocked.

Routing modes

Pick one in the connection bar, the menu bar panel, Settings → Routing, or with Shortcuts.

Mode	Traffic that matches no rule
Global	goes through the server
Bypass regions	goes direct when it belongs to an enabled region (Iran, China, Russia), else through the server
Rules Only	goes direct; only traffic matching a Proxy rule reaches the server
Direct	goes direct; only Block rules are used

Settings → Routing → Traffic that matches no rule can override the mode: Follow mode (default), Proxy, Direct or Block. It also replaces a full config's own fallback.

Region packs

Bypass regions needs at least one region pack. Enable it in Settings → Routing; V2Mac downloads the geosite and geoip files, checks them, and keeps them up to date (weekly by default, or daily / never, plus Update Now). Iran uses Chocolate4U/Iran-v2ray-rules; China and Russia use Loyalsoldier/v2ray-rules-dat.

Rules

The Rules window

Open Rules from the glass button at the foot of the sidebar, with Open Rules… in Settings → Routing, from a connection in Connections, or from the menu bar. The list on the left is checked from the top, and the first rule that matches decides where the traffic goes:

1. Before your rules: Local network (this Mac, the LAN and names such as printer.local always go direct), Block QUIC (a switch), and Apps using the proxy port (set in Settings → Proxy).
2. My rules, in your order. Drag to reorder; each has a switch.
3. After your rules: the routing mode's own rules, then Everything else (follow the mode, Proxy, Direct or Block).

Every change is a draft: the changed rules get a dot, ⌘Z undoes, and Apply (⌘S) saves and restarts a running connection once. Closing the window with changes asks first.

A rule

• Send to: Proxy (the server you are connected to), Via a server or a group (the group's fastest server that answers), Direct or Block.
• Matches any of: apps, domains, exact names, keywords, addresses and ranges, countries and service lists. Type in the one field and pick from the suggestions (installed apps, services with their sizes, countries), paste many lines at once, or click Browse… for an app checklist, service tiles and the world map. Right-click a site to read it as an exact name, a keyword or a regular expression. Click an app to see what it matches on this Mac.
• Only when (optional): ports (443, 8000-8100), TCP or UDP, the protocol (TLS, HTTP, QUIC, BitTorrent) and apps. Every item must also meet these. For example, a rule with *.example.com and "Only when: Safari" matches only Safari's traffic to that site.

A rule with only "Only when" and no items matches all such traffic: "UDP, BitTorrent → Direct" sends torrents direct.

New Rule ▾ starts from a template: AI services, developer tools, Apple services, social and chat, streaming, region sites direct, torrents direct, ads and trackers.

Via another server

Via sends a rule's traffic through a different server than the one you are connected to, for example AI sites through a server in another country. Pick a server, or a group to use its fastest server that answers (checked every 30 seconds, and the next one takes over when it fails).

When none of its servers answers, the rule's traffic fails by default, so it never leaves another way. Turn on If its servers fail, use the current server to fall back instead. The rule shows how many servers answer, and the menu bar warns when none does.

Where does it go?

Type a site, a link, an address or an app name in the search field. Above the list V2Mac answers where it goes and why, such as "api.github.com → Proxy, by Developer (#8), matched geosite:github", working from your rules as they are now, applied or not.

Discovered lists apps and sites seen while the Rules or Connections window is open that no rule covers. Add one to a rule with Add to, drag it onto a rule, or Ignore it. A site is offered as its whole domain (github.com for api.github.com).

Tidy Up… (in the ⋯ menu) suggests merging rules that do the same thing, dropping rules an earlier one already covers, and removing repeated entries. Pick the ones you want; nothing changes until you Apply.

In Connections, right-click a row for Add App to Rule, Add Host to Rule and Show Rule. The menu bar panel shows the app in front, where it goes and Add to Rule. Shortcuts has an Add to Rule action.

Apps

Write an app as Telegram.app, a bundle id (com.example.chat), a pattern (*code*), a process name (curl) or a full path.

• App rules work for apps that use the system proxy or connect to V2Mac's port.
• In TUN mode the app is not known, so only host and IP rules apply.
• With System Proxy off, apps you pointed at V2Mac's port yourself skip the rules and use the server (shown orange as App's proxy setting in Connections). With System Proxy on, everything through the port follows the rules.

Hosts

Separate entries with new lines, commas, spaces or ;. Lines starting with #, // or ! are comments.

Write	Matches
example.com, *.example.com, +.example.com, .ir	the domain and all subdomains
full:www.example.com	only that name
keyword:shop, *shop*	any name containing the word
regexp:^ads\d+\.	a regular expression
1.2.3.4, 10.0.0.0/8, 2001:db8::/32, 10.0.0.1-10.0.0.9	an address or range
geosite:google, geosite:category-ads-all	a site list from geosite.dat
geoip:de, geoip:telegram	a country's or service's addresses
ext:region-ir-geosite.dat:ir	a list from a region pack
DOMAIN-SUFFIX,example.com,DIRECT	Clash rules (the rule's action decides)
0.0.0.0 ads.example.com	hosts file lines
||ads.example.com^	Adblock domain lines

Anything not understood shows as a red token and is skipped. A geosite: list that does not exist stops the core; the log names it.

Import from other apps

V2Mac reads the rules of other apps, so you can move over without retyping them: Proxifier (.ppx), Clash / Mihomo (.yaml), sing-box (.json), v2rayN / v2rayNG / Xray rule exports (.json) and Shadowrocket / Surge (.conf). The format is recognised by itself.

1. In the Rules window, choose Import… in the ⋯ menu.
2. Pick the file.
3. Check the review and click Import. Nothing changes before that.

Export (⋯ menu) writes all or the selected rules. The profile menu keeps several named rule sets (home, work, travel).

Clash, Shadowrocket and Surge

Each TYPE,value,POLICY line becomes part of a rule: DIRECT → Direct, REJECT → Block, any other policy (a proxy group) → Proxy. Lines in a row with the same policy become one rule named after it. DOMAIN, DOMAIN-SUFFIX, DOMAIN-KEYWORD, DOMAIN-REGEX, IP-CIDR, GEOIP, GEOSITE and PROCESS-NAME are read; MATCH / FINAL is left to the routing mode. DST-PORT, NETWORK and AND of plain conditions become Only when; RULE-SET, OR and NOT are skipped and named in the review.

sing-box and v2rayN

Each route rule becomes one rule; its outbound decides the action (direct, block/reject, anything else is Proxy). v2rayN keeps each rule's name and on/off state. Port, port range, network and protocol become Only when; rules that limit the inbound are skipped rather than imported wider than they were, and so are rule sets.

Proxifier

In Proxifier	In V2Mac
Rule to a proxy on this Mac (V2Mac's port)	Proxy rule
Direct / Block rule	the same action
Disabled rule	imported, switched off
Rule to another proxy or a chain	skipped and named in orange
Applications field	the rule's apps ("App.app", bundle ids, *pattern*, process names)
Target hosts (*.example.com, ranges like 10.0.0.0-10.255.255.255)	the rule's hosts
Target ports	Only when ports
Block UDP 443 option	Block QUIC turned on

Imported rules go after your own, so existing rules keep priority. Afterwards everything is an ordinary V2Mac rule you can edit, reorder or turn off.

Differences from Proxifier: V2Mac identifies apps only for traffic that uses the system proxy or its port, not in TUN mode (use host rules there).

Examples

Goal	Action	Hosts
Block ads everywhere	Block	geosite:category-ads-all
AI services through the proxy, with Iran bypassed	Proxy	geosite:openai, geosite:anthropic
Keep Apple and Microsoft updates off the proxy	Direct	geosite:apple, geosite:microsoft
Reach the office network directly	Direct	10.0.0.0/8, full:intranet.example.com
Only Telegram through the proxy	Proxy (in Rules Only mode)	apps: Telegram.app

Full JSON configs

For a full Xray config, V2Mac's rules and mode run first, then the config's own routing as fallback (purple Config fallback in Connections).

Command line

V2Mac includes a signed v2mac command for agents and terminal workflows. Install it from Settings → About; Homebrew users get the same embedded executable automatically. It supports status/connect/disconnect and complete rule, profile, import, template, Tidy Up and built-in management.

Use v2mac rules list --json to obtain the current revision, then pass --revision with every write. Add --dry-run to validate and preview without saving or reconnecting. Commands talk to the running app and never edit preferences directly; stale revisions and unapplied Rules-window drafts fail safely.

v2mac status --json
v2mac rules list --json
v2mac rules export > rules.json