# Advanced Routing Rules in iOS Surge: A Complete Configuration Guide

> Master advanced routing rules in iOS Surge 4. Configure domain, IP, and header patterns for smart traffic management and proxy control. Optimize your network now.

- Repository: [如何翻墙/fanqiang](https://github.com/bannedbook/fanqiang)
- Tags: how-to-guide
- Published: 2026-08-10

---

**Surge 4 for iOS uses a rule-based routing engine that evaluates traffic against ordered lists of domain, IP, CIDR, and header patterns to determine whether requests route through proxy groups or connect directly, with optional URL rewriting for advanced traffic manipulation.**

Advanced routing rules in iOS Surge provide granular control over network traffic by combining **proxy definitions**, **policy groups**, and **rule-based routing** into a single configuration file. According to the [bannedbook/fanqiang](https://github.com/bannedbook/fanqiang) repository, this architecture allows users to direct specific domains, IP ranges, or application traffic through different proxy protocols while maintaining direct connections for local services. The configuration syntax supports Shadowsocks, V2Ray, WireGuard, and other protocols through standardized INI-format files.

## Understanding Surge 4's Routing Architecture

Surge 4 processes network requests through four core components defined in your configuration file. In [`ios/Surge.md`](https://github.com/bannedbook/fanqiang/blob/main/ios/Surge.md), the repository documents how these elements interact to form the complete routing pipeline.

### Proxy Definitions

The `[Proxy]` section declares individual server endpoints with protocol-specific parameters. As shown in [ios/Surge.md#L5-L12](https://github.com/bannedbook/fanqiang/blob/master/ios/Surge.md#L5-L12), each proxy entry specifies the server host, port, authentication credentials, and optional flags like `udp-relay` or `tls`.

### Policy Groups

**Policy groups** are logical collections that aggregate multiple proxies or define routing strategies. The [ios/Surge.md#L57-L63](https://github.com/bannedbook/fanqiang/blob/master/ios/Surge.md#L57-L63) reference demonstrates how to create `select` groups for manual switching or `url-test` groups for automatic latency-based selection.

### Rule Sets

The `[Rule]` section contains an ordered list of matching criteria and target policies. Surge supports `DOMAIN-SUFFIX`, `DOMAIN-KEYWORD`, `IP-CIDR`, `GEOSITE`, `GEOIP`, `URL-REGEX`, and `HEADER-MATCH` directives. Rules evaluate from top to bottom, with the first match determining the traffic path.

### Rewrite Engine

The **Rewrite engine** modifies request headers, URL paths, or body content before transmission. This component requires explicit activation in the Surge UI, as documented at [ios/Surge.md#L51](https://github.com/bannedbook/fanqiang/blob/master/ios/Surge.md#L51).

## How Advanced Routing Rules Work

Surge processes network requests through a deterministic pipeline:

1. **Configuration Loading** – Surge loads the remote or local `.conf` file when you activate the profile in **Configuration Management**.

2. **Rule Evaluation** – For each outgoing request, Surge tests against rules in sequence until finding a match. The associated policy (proxy group or `DIRECT`) handles the connection.

3. **Rewrite Processing** – If enabled in the UI and the selected policy permits it, Surge applies `URL-REWRITE` and `HEADER-REWRITE` directives before the request leaves the device.

4. **Connection Establishment** – The request routes through the selected proxy or direct interface based on the resolved policy.

## Writing Advanced Routing Rules

Effective configurations combine multiple rule types to handle complex routing scenarios.

### Domain and IP-Based Rules

Use `DOMAIN-SUFFIX` for specific domains and `IP-CIDR` for network blocks. Place specific rules before general ones:

```ini
[Rule]

# Direct connection for China domains

DOMAIN-SUFFIX,cn,DIRECT
DOMAIN-KEYWORD,google,Auto

# Force video CDN through proxy

IP-CIDR,203.0.113.0/24,Streaming

```

### Header-Based Routing

The `HEADER-MATCH` directive inspects HTTP request headers to identify specific applications or clients:

```ini

# Route Telegram traffic through auto-select group

HEADER-MATCH,User-Agent,Telegram,Auto

```

### Geo-IP Routing

`GEOIP` rules redirect traffic based on the destination country's IP registry:

```ini

# Send all US traffic through proxy

GEOIP,US,🚀 Auto

```

## Enabling the Rewrite Engine

Surge 3 and later versions require manual activation of the Rewrite feature. According to the [`ios/Surge.md`](https://github.com/bannedbook/fanqiang/blob/main/ios/Surge.md) tutorial, you must toggle the **Rewrite** switch on the **Rule Mode** page before the `[Rewrite]` section becomes active.

Typical rewrite rules add missing headers to bypass censorship:

```ini
[Rewrite]

# Add Referer header to unblock image requests

^https?://images\.example\.com/.*\.(png|jpg) url-rewrite://?header=Referer%3A%20https://example.com

```

## Complete Configuration Example

This comprehensive configuration from the bannedbook/fanqiang repository demonstrates proxy definitions, policy groups, advanced routing rules, and rewrite directives working together:

```ini
[Proxy]

# Shadowsocks proxy with UDP relay

ss = ss, us01.example.com, 8388, password, aes-256-gcm, udp-relay=true

# V2Ray VMess proxy with TLS

vm = vmess, us02.example.com, 443, auto, aes-128-gcm, tls=true, path=/ray

[Policy]
Auto = select, ss, vm, direct
Streaming = url-test, ss, vm, url='https://www.google.com/generate_204', interval=300

[Rule]

# China sites bypass proxy

DOMAIN-SUFFIX,cn,DIRECT

# Video streaming through auto-select

IP-CIDR,203.0.113.0/24,Streaming

# Telegram app traffic

HEADER-MATCH,User-Agent,Telegram,Auto

# Final catch-all

FINAL,Auto

[Rewrite]

# Anti-blocking header injection

^https?://(www\.)?example\.com/ url-rewrite://?header=Referer%3A%20https://example.com

```

## Summary

- **Rule order determines routing**: Surge evaluates rules sequentially, so place specific matches (like `DOMAIN-SUFFIX`) before general catch-alls (like `FINAL`).
- **Enable Rewrite in UI**: The `[Rewrite]` section only functions after activating the toggle in Surge's Rule Mode settings, as noted in `ios/Surge.md#L51`.
- **Use policy groups for flexibility**: Combine `select` and `url-test` groups to balance manual control with automatic failover.
- **Reference existing configurations**: The bannedbook/fanqiang repository provides working examples in [`ios/Surge.md`](https://github.com/bannedbook/fanqiang/blob/main/ios/Surge.md), [`macos/Surge.md`](https://github.com/bannedbook/fanqiang/blob/main/macos/Surge.md), and [`router/Merlin.md`](https://github.com/bannedbook/fanqiang/blob/main/router/Merlin.md).

## Frequently Asked Questions

### What is the correct order for Surge routing rules?

Surge processes rules from top to bottom, stopping at the first match. Place highly specific rules (individual domains or IPs) at the top, followed by broader patterns (GEOIP, large CIDR blocks), with a `FINAL` rule at the bottom as a catch-all. This prevents early generic matches from blocking later specific exceptions.

### How do I test which rule is matching my traffic?

Open Surge's built-in **Log** view from the main interface. Each connection entry shows the matched rule name, target policy, and processing time. Use this to verify that traffic routes through your intended proxy group or direct connection, and adjust rule ordering if matches occur against the wrong directives.

### Why are my Rewrite rules not taking effect?

Surge requires explicit activation of the Rewrite engine in the user interface. Navigate to the **Rule Mode** page and ensure the **Rewrite** toggle is enabled, as documented at `ios/Surge.md#L51`. Without this switch, Surge ignores the entire `[Rewrite]` section even if properly configured in the file.

### Can I use the same configuration file for macOS Surge?

Yes, with minor adjustments. The [`macos/Surge.md`](https://github.com/bannedbook/fanqiang/blob/main/macos/Surge.md) file in the bannedbook/fanqiang repository shows that macOS Surge uses identical syntax for `[Proxy]`, `[Policy]`, and `[Rule]` sections. However, macOS configurations may include system-specific features like enhanced process matching that iOS does not support.