The MATCH catch-all: writing the last rule

MATCH (formerly FINAL) matches unconditionally, so it always sits on the last line as the safety net for "nothing above caught this":

rules:
  # ...everything else...
  - GEOIP,CN,DIRECT
  - MATCH,Proxy Select

Two philosophies for the catch-all

• MATCH → proxy group (mainstream): unknown traffic defaults to the proxy. Rationale: domestic sites were already caught by domain rules and GEOIP, so whatever is left is probably foreign. Side effect: obscure domestic sites may detour abroad;
• MATCH → DIRECT: unknown traffic defaults to direct. This treats the proxy as a whitelist tool — only listed sites use it. Saves traffic, but new sites need manual rules.

Not sure which your profile uses? Visit an obscure foreign site and check the Connections page — connections whose Rule column shows Match were caught by the catch-all.

If some class of traffic keeps going the wrong way, do not edit MATCH — add a more specific rule above it. That is the correct fix.