Clash Custom Rules: DOMAIN, IP-CIDR, GEOSITE Syntax and Matching Order

What Clash Plus is and who it is for

Clash Plus is an iPhone and iPad proxy client distributed through the official App Store. It gives users a free way to import a Clash-style subscription, select a proxy group, and create a local VPN connection without buying a separate utility before testing the workflow. For people who want a straightforward iOS client rather than a desktop-style configuration environment, that combination is its main appeal.

On iOS, the app does not work by exposing a local port such as 127.0.0.1:7890 for every application to use. Instead, it requests permission to create a VPN profile through Apple’s Network Extension framework. After the VPN switch is enabled, the client receives eligible traffic and applies the imported configuration, including proxy groups, domain rules, and the selected routing mode.

This makes Clash Plus a practical option for users who want a free Shadowrocket alternative, especially when the main requirements are subscription import, basic rule-based routing, and a clean interface. It is less suitable for users who need every advanced field supported by the latest mihomo configuration format, detailed script automation, or extensive desktop-style diagnostics. As with any iOS client, the correct choice depends on the node protocols and configuration features used by the subscription.

Main strengths and limitations

Why it is a useful Shadowrocket alternative

Shadowrocket is familiar to many iPhone users, but not every user wants to pay for a client before checking whether a Clash-style workflow meets their needs. Clash Plus lowers that initial barrier by offering a free App Store route. The difference is not simply the price: the two clients may present subscriptions, proxy groups, rule formats, and advanced options differently, so existing instructions cannot always be copied screen by screen.

Clash Plus is particularly convenient for a user whose provider already supplies a Clash or Clash Meta-compatible URL. After import, the interface can normally expose the available proxy entries and groups instead of requiring each server to be entered manually. That is much more practical than copying server address, port, password, encryption method, and transport parameters one at a time.

The ad-free interface is another practical advantage. A proxy client is often opened while troubleshooting a connection, changing a node, or approving a VPN profile. Advertising banners can make small controls harder to find and can be distracting when checking status or reading an error. A simpler screen does not improve the upstream node, but it reduces unnecessary visual noise during routine use.

Compare the workflow before switching

• Price: Clash Plus is a free starting point, while a paid client may be preferable if you already depend on its mature ecosystem or specialized features.
• Configuration style: Clash users generally think in terms of proxy groups, ordered rules, and YAML-based profiles. Other clients may organize the same concepts around individual node subscriptions.
• Protocol coverage: A client that imports a URL may still omit unsupported nodes. Compare the actual protocols in your subscription rather than relying on the word “Clash.”
• Advanced features: Verify support for rule providers, script rules, TUN-related settings, fake-IP DNS, IPv6 behavior, and mihomo extension fields if your profile depends on them.
• Account region: Clash Plus is useful when it is available in your normal App Store region and does not force you to create a special regional account just to begin testing.

A good migration test is to import the same subscription into Clash Plus while keeping the original client available. Check whether the node count is similar, whether the same proxy groups appear, and whether several representative websites follow the expected rules. If only a small number of nodes load, the issue may be protocol compatibility rather than a bad subscription URL.

Install Clash Plus from the App Store

Because iOS clients are distributed through the App Store, installation is simpler and safer than sideloading an unknown package. The exact product-page wording can change, so check the developer information, compatibility section, update history, and privacy details before tapping the download button. A familiar app name alone is not enough to verify that the application supports your configuration format.

1. Open the App Store on the iPhone or iPad and search for Clash Plus.
2. Open the product page and confirm the application name, developer, screenshots, ratings, update history, and required iOS version.
3. Review the “Information” or “Compatibility” section to make sure the current device can install the app.
4. Tap the download button and authenticate with Face ID, Touch ID, or the Apple Account password if requested.
5. Launch the app after installation and allow local notifications only if you want connection or update reminders.

Before importing anything, check the iPhone system version under “Settings” → “General” → “Software Update.” App Store compatibility and proxy-client compatibility are separate questions. A device may install the application successfully but still have limited support for a newer configuration feature. Older iOS releases may also display VPN permission wording differently from current versions.

Import a subscription and select a proxy group

The easiest setup is usually a subscription URL supplied by your provider. It may return a complete Clash YAML profile, a converted node list, or another format that the client recognizes. Copy the complete URL rather than copying only the visible text before a query string. Parameters after ? can identify the account, output format, or subscription conversion options.

1. Copy the subscription URL from the provider’s dashboard or account email.
2. Open Clash Plus and find the profile, configuration, subscription, or import section.
3. Choose the URL-based import option and paste the link into the address field.
4. Give the profile a short name such as “Primary subscription” so it is easy to distinguish from a test profile.
5. Save or update the profile, then wait for the application to download and parse it.
6. Open the proxy or groups screen and select a usable policy group or node.

Some providers use an “Update” action after the first import. This is not the same as importing a second profile. Updating the existing profile keeps its identity while retrieving newer nodes, changed rules, or altered group definitions. If the provider changes the subscription URL, delete or edit the old source rather than repeatedly adding duplicate profiles.

Check the result instead of assuming success

• Profile loaded: Confirm that the profile shows a recent update time and does not display a YAML parsing error.
• Node count: Compare the number of imported nodes with the provider’s dashboard. A large difference can indicate unsupported protocols or an incompatible output format.
• Proxy groups: Look for the expected selector, fallback, load-balance, or automatic-test groups. If only individual nodes appear, the app may be receiving a generic node list rather than the complete Clash profile.
• Rules: Confirm that the profile contains the expected rule behavior. A client may accept the file while ignoring unsupported rule-provider, script, or DNS fields.
• Connection state: Select a node, enable the VPN, and check whether the system shows the VPN indicator or an active VPN entry.

proxies:
  - name: Example Node
    type: trojan
    server: edge.example.net
    port: 443
    password: replace-with-provider-value
    udp: true

proxy-groups:
  - name: Proxy
    type: select
    proxies:
      - Example Node
      - DIRECT

rules:
  - DOMAIN-SUFFIX,example.com,Proxy
  - MATCH,DIRECT

The example above illustrates the relationship between a node, a policy group, and a rule. The rule does not select a server directly; it sends matching traffic to the Proxy group. The group then uses the selected node. If the group name in the rule does not exactly match the group name in proxy-groups, the profile may fail to load or the intended policy may not be used.

Enable the VPN and test real traffic

After selecting a profile and proxy group, enable the connection inside Clash Plus. iOS should display a system permission prompt asking whether the app may add a VPN configuration. Read the prompt carefully and approve it only for the client you intended to use. The first approval may also require device authentication.

1. Open the active profile and select a node or proxy group with a reachable server.
2. Tap the connection switch in Clash Plus.
3. Approve the iOS VPN configuration prompt when it appears.
4. Wait for the status to change from connecting to connected.
5. Open a normal browser page and test a destination that should match the selected rule.
6. Test a second destination that should use DIRECT, if your configuration has separate direct and proxy policies.

Do not judge the setup only by the VPN icon. An active VPN profile proves that the system tunnel was created, but it does not prove that every node is reachable or that every rule is correct. Test several types of traffic: a normal webpage, an application that uses HTTPS, a domain expected to use the proxy, and a domain expected to bypass it.

Keep in mind that iOS applications may use different networking APIs. Some applications honor the system VPN path normally, while others use their own connection methods, apply certificate pinning, or restrict traffic in ways that make troubleshooting more complicated. A browser working through Clash Plus does not guarantee that every game, video application, or enterprise app will follow the same route.

Understand protocol and feature compatibility

Clash Plus can be useful with a standard Clash-style profile, but “Clash-compatible” is not a universal guarantee. The profile may contain nodes based on Shadowsocks, VMess, Trojan, SOCKS5, HTTP, or other transports. It may also contain newer fields associated with Clash Meta or mihomo. The client must support the actual node type and the fields required to establish the connection.

A common mistake is to see the subscription imported successfully and assume that all nodes are available. The application may parse the outer subscription response while skipping entries with unsupported protocols. Another possibility is that the node appears in the list but fails during connection because a transport option, TLS setting, WebSocket path, authentication field, or UDP requirement is not implemented as expected.

For a first test, use a simple profile containing one known-compatible node, one select group, and a small number of ordinary rules. If that works, add the full provider profile or rule providers later. This staged approach makes it easier to identify whether a failure comes from the node, the profile structure, or an advanced feature that the iOS client does not support completely.

Troubleshoot common problems and decide whether to use it

The subscription will not import

First check whether the URL is complete and still valid. Many provider links include an access token, expiration parameter, or output-format parameter. Paste the URL again without adding spaces or line breaks. If the provider offers separate formats, choose Clash, Clash Meta, or YAML rather than a format intended only for another client.

If the URL opens but the client reports a parse error, the response may be an HTML login page, an expired-account notice, or a server-side error rather than a configuration file. A provider can also return a profile that relies on unsupported remote rule syntax. Ask the provider for a standard Clash-compatible output instead of repeatedly editing the downloaded file by hand.

The VPN connects but pages fail

Try a different node in the same group first. If every node fails, check whether the selected policy is REJECT, whether the profile has a broken DNS setting, and whether the rule sends traffic to a group with no available members. If only one domain fails, inspect its matching rule and test the same domain through another policy.

Also check whether the provider expects a particular DNS mode or whether the network blocks the node endpoint. A successful VPN permission step does not repair an expired node, incorrect server address, or invalid authentication field. Look for connection logs in Clash Plus if the app provides them, and record the exact error rather than only saying that the page does not open.

When Clash Plus is the right choice

• Choose it when you want a free App Store client for basic Clash-style subscriptions.
• Choose it when an ad-free interface and simple profile management matter more than extensive customization.
• Choose it when the app is available in your normal App Store region and you do not want to create a special regional account.
• Choose it when your provider uses common protocols and a standard configuration that you can test easily.
• Consider another client when you depend on advanced mihomo extensions, complex scripts, specialized DNS behavior, or a protocol that Clash Plus does not support.

Overall, Clash Plus is a sensible Shadowrocket alternative for iPhone and iPad users who want to start with a free, clean, and App Store-distributed client. Its value is strongest in the everyday workflow: import a compatible subscription, select a group, approve the VPN profile, and test traffic without unnecessary account or interface complications. Before treating it as a permanent replacement, verify the node protocols, rule providers, DNS behavior, and applications that matter most to you.