Advanced Routing Rules in iOS Surge: A Complete Configuration Guide

Surge 4 for iOS uses a rule-based routing engine that evaluates traffic against ordered lists of domain, IP, CIDR, and header patterns to determine whether requests route through proxy groups or connect directly, with optional URL rewriting for advanced traffic manipulation.

Advanced routing rules in iOS Surge provide granular control over network traffic by combining proxy definitions, policy groups, and rule-based routing into a single configuration file. According to the bannedbook/fanqiang repository, this architecture allows users to direct specific domains, IP ranges, or application traffic through different proxy protocols while maintaining direct connections for local services. The configuration syntax supports Shadowsocks, V2Ray, WireGuard, and other protocols through standardized INI-format files.

Understanding Surge 4's Routing Architecture

Surge 4 processes network requests through four core components defined in your configuration file. In ios/Surge.md, the repository documents how these elements interact to form the complete routing pipeline.

Proxy Definitions

The [Proxy] section declares individual server endpoints with protocol-specific parameters. As shown in ios/Surge.md#L5-L12, each proxy entry specifies the server host, port, authentication credentials, and optional flags like udp-relay or tls.

Policy Groups

Policy groups are logical collections that aggregate multiple proxies or define routing strategies. The ios/Surge.md#L57-L63 reference demonstrates how to create select groups for manual switching or url-test groups for automatic latency-based selection.

Rule Sets

The [Rule] section contains an ordered list of matching criteria and target policies. Surge supports DOMAIN-SUFFIX, DOMAIN-KEYWORD, IP-CIDR, GEOSITE, GEOIP, URL-REGEX, and HEADER-MATCH directives. Rules evaluate from top to bottom, with the first match determining the traffic path.

Rewrite Engine

The Rewrite engine modifies request headers, URL paths, or body content before transmission. This component requires explicit activation in the Surge UI, as documented at ios/Surge.md#L51.

How Advanced Routing Rules Work

Surge processes network requests through a deterministic pipeline:

1. Configuration Loading – Surge loads the remote or local .conf file when you activate the profile in Configuration Management.

2. Rule Evaluation – For each outgoing request, Surge tests against rules in sequence until finding a match. The associated policy (proxy group or DIRECT) handles the connection.

3. Rewrite Processing – If enabled in the UI and the selected policy permits it, Surge applies URL-REWRITE and HEADER-REWRITE directives before the request leaves the device.

4. Connection Establishment – The request routes through the selected proxy or direct interface based on the resolved policy.

Writing Advanced Routing Rules

Effective configurations combine multiple rule types to handle complex routing scenarios.

Domain and IP-Based Rules

Use DOMAIN-SUFFIX for specific domains and IP-CIDR for network blocks. Place specific rules before general ones:

[Rule]

# Direct connection for China domains

DOMAIN-SUFFIX,cn,DIRECT
DOMAIN-KEYWORD,google,Auto

# Force video CDN through proxy

IP-CIDR,203.0.113.0/24,Streaming

Header-Based Routing

The HEADER-MATCH directive inspects HTTP request headers to identify specific applications or clients:

# Route Telegram traffic through auto-select group

HEADER-MATCH,User-Agent,Telegram,Auto

Geo-IP Routing

GEOIP rules redirect traffic based on the destination country's IP registry:

# Send all US traffic through proxy

GEOIP,US,🚀 Auto

Enabling the Rewrite Engine

Surge 3 and later versions require manual activation of the Rewrite feature. According to the ios/Surge.md tutorial, you must toggle the Rewrite switch on the Rule Mode page before the [Rewrite] section becomes active.

Typical rewrite rules add missing headers to bypass censorship:

[Rewrite]

# Add Referer header to unblock image requests

^https?://images\.example\.com/.*\.(png|jpg) url-rewrite://?header=Referer%3A%20https://example.com

Complete Configuration Example

This comprehensive configuration from the bannedbook/fanqiang repository demonstrates proxy definitions, policy groups, advanced routing rules, and rewrite directives working together:

[Proxy]

# Shadowsocks proxy with UDP relay

ss = ss, us01.example.com, 8388, password, aes-256-gcm, udp-relay=true

# V2Ray VMess proxy with TLS

vm = vmess, us02.example.com, 443, auto, aes-128-gcm, tls=true, path=/ray

[Policy]
Auto = select, ss, vm, direct
Streaming = url-test, ss, vm, url='https://www.google.com/generate_204', interval=300

[Rule]

# China sites bypass proxy

DOMAIN-SUFFIX,cn,DIRECT

# Video streaming through auto-select

IP-CIDR,203.0.113.0/24,Streaming

# Telegram app traffic

HEADER-MATCH,User-Agent,Telegram,Auto

# Final catch-all

FINAL,Auto

[Rewrite]

# Anti-blocking header injection

^https?://(www\.)?example\.com/ url-rewrite://?header=Referer%3A%20https://example.com

Summary

• Rule order determines routing: Surge evaluates rules sequentially, so place specific matches (like DOMAIN-SUFFIX) before general catch-alls (like FINAL).
• Enable Rewrite in UI: The [Rewrite] section only functions after activating the toggle in Surge's Rule Mode settings, as noted in ios/Surge.md#L51.
• Use policy groups for flexibility: Combine select and url-test groups to balance manual control with automatic failover.
• Reference existing configurations: The bannedbook/fanqiang repository provides working examples in ios/Surge.md, macos/Surge.md, and router/Merlin.md.

Frequently Asked Questions

What is the correct order for Surge routing rules?

Surge processes rules from top to bottom, stopping at the first match. Place highly specific rules (individual domains or IPs) at the top, followed by broader patterns (GEOIP, large CIDR blocks), with a FINAL rule at the bottom as a catch-all. This prevents early generic matches from blocking later specific exceptions.

How do I test which rule is matching my traffic?

Open Surge's built-in Log view from the main interface. Each connection entry shows the matched rule name, target policy, and processing time. Use this to verify that traffic routes through your intended proxy group or direct connection, and adjust rule ordering if matches occur against the wrong directives.

Why are my Rewrite rules not taking effect?

Surge requires explicit activation of the Rewrite engine in the user interface. Navigate to the Rule Mode page and ensure the Rewrite toggle is enabled, as documented at ios/Surge.md#L51. Without this switch, Surge ignores the entire [Rewrite] section even if properly configured in the file.

Can I use the same configuration file for macOS Surge?

Yes, with minor adjustments. The macos/Surge.md file in the bannedbook/fanqiang repository shows that macOS Surge uses identical syntax for [Proxy], [Policy], and [Rule] sections. However, macOS configurations may include system-specific features like enhanced process matching that iOS does not support.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}