Rule based Routing

Moved here from the README ｜ Wiki home ｜ 中文

The server stays the official snell-server — not sing-box or open-snell or any other reimplementation. Routing applies to the connections it makes: the sites clients reach through Snell go direct, are rejected, or leave through another exit (a residential SOCKS5, WARP …). Main menu 11. Rule-based routing:

1. (optional) 4. Add an exit: SOCKS5, HTTP proxy, Shadowsocks, or WireGuard (for WARP, the values wgcf and similar tools generate).
2. 2. Add a rule: what to match, then where it goes (reject / direct / an exit). Presets: ads and trackers (geosite category-ads-all); mainland China sites and IPs (geosite cn + geoip cn); private and LAN addresses (so clients cannot reach the server's network or the cloud metadata endpoint through it); BitTorrent; AI (openai, anthropic, google-gemini, perplexity); streaming (netflix, disney, hbo, primevideo, hulu). Or any geosite category, geoip country, domain suffix, IP range, or a remote sing-box .srs rule set. Rule sets come from SagerNet/sing-geosite and sing-geoip and update daily. Rules match top to bottom; anything else goes direct.
3. 1. Enable. Changes to rules and exits apply at once; 7. Disable sends everything direct again (the rules are kept).

How: nftables catches the new connections of the snell user (every Snell service runs as it) — TCP redirected, UDP by TPROXY — and hands them to a local sing-box (official 1.14.2, installed as /usr/local/bin/snell-router, leaving any other sing-box alone), which reads the domain from the TLS SNI / HTTP Host / QUIC and picks the exit.

• Replies to clients, other programs on the machine (root included) and Snell's own DNS lookups are not routed.
• If sing-box stops or crashes the interception goes with it and Snell is direct again — never cut off; systemd restarts it.
• Not together with egress control (netns): there Snell's traffic does not originate on the host.
• A Snell installed by PSM runs as root: enabling routing adds a systemd drop-in that runs it as the snell user (PSM's unit file untouched), removed again on disable.
• Uninstalling Snell removes the routing service, its config and its sing-box too.