IP-CIDR and GEOIP: routing by IP

Not every connection carries a domain — traffic that dials IPs directly (some apps, P2P, games) skips DNS entirely, so domain rules never see it. That is where IP rules come in:

IP-CIDR: by network block

- IP-CIDR,192.168.0.0/16,DIRECT     # LAN
- IP-CIDR,10.0.0.0/8,DIRECT
- IP-CIDR,203.0.113.0/24,Proxy      # a service's fixed range

The /16 or /24 denotes block size — bigger number, smaller block. Direct-routing the LAN ranges is standard in every profile; otherwise requests to your router or NAS would be thrown at the proxy.

GEOIP: by country

GEOIP,CN,DIRECT means "if the destination IP is in mainland China, go direct". The lookup uses the local Country.mmdb database (downloaded on first launch, updatable in Settings). This rule appears near the end of almost every profile as the safety net that sends any domestic traffic the domain rules missed back to a direct connection.

Two caveats: GEOIP needs an IP, so for domain traffic it triggers a DNS resolution first; and a stale database misclassifies — enable auto-update. The related no-resolve flag is covered in "no-resolve explained".