Clash rule syntax 101: reading your first rule

Open any profile and the rules: section is a long list like this:

rules:
  - DOMAIN-SUFFIX,google.com,Proxy Select
  - DOMAIN-KEYWORD,bilibili,DIRECT
  - IP-CIDR,192.168.0.0/16,DIRECT
  - GEOIP,CN,DIRECT
  - MATCH,Proxy Select

Every line is a three-part statement — TYPE,matcher,policy:

• TYPE: how to match — by domain suffix (DOMAIN-SUFFIX), by keyword (DOMAIN-KEYWORD), by IP range (IP-CIDR), by IP geolocation (GEOIP), and so on;
• matcher: the concrete domain, CIDR block or country code;
• policy: where matching traffic goes — a proxy group's name, DIRECT (no proxy) or REJECT (drop it; the ad-blocking workhorse).

For each connection Clash walks the list top to bottom and stops at the first match — which is why ordering is everything (see "Rule priority").

With this mental model you can read the Rule column on the Connections page — and you have the foundation for writing rules of your own.