Configuration recipes

Choose a recipe by its goal, not by its size. All JSON downloads and website code blocks use the same files. The manifest identifies import types, templates, required replacements and dependencies.

China direct, selected services direct, GitHub through VPN

Use Custom Routing’s complete example, or the corresponding Smart Routing controls if editable JSON is unnecessary.

Requires: two eligible existing nodes for this file, default Geosite and GeoIP. Rule order is ads → GitHub proxy → combined direct domains → combined direct IPs. GitHub must precede Microsoft direct rules. Only direct domain/IP rules are grouped; domain and IP remain separate rules to avoid turning OR intent into AND.

Import as Custom, select it on Connect and choose a group with enough nodes. Check the generated rules and a known GitHub, direct and blocked destination. An unmatched destination uses the first entry, not automatically every entry in the balancer.

Corporate names and private network

Ask for the actual office domain, subnet and a DNS resolver reachable directly. The values below are scenario placeholders; do not assume this subnet is the user’s LAN.

JSON: custom-office.json

{
  "name": "Office DNS and local network",
  "outbounds": [
    {}
  ],
  "dns": {
    "servers": [
      {
        "tag": "app-dns-direct",
        "address": "192.168.50.53"
      }
    ]
  },
  "routing": {
    "domainStrategy": "IPIfNonMatch",
    "rules": [
      {
        "ruleTag": "Office names",
        "domain": [
          "domain:corp.example.com"
        ],
        "outboundTag": "direct"
      },
      {
        "ruleTag": "Office network",
        "ip": [
          "192.168.50.0/24"
        ],
        "outboundTag": "direct"
      }
    ]
  }
}

The pure domain rule feeds the direct DNS server; the separate IP rule covers connections already using an address. Other traffic keeps the normal proxy default. This file asks for one existing node.

Usually no Tunnel DNS change is needed. If an Apple system route must bypass VPN completely, configure it separately with Capture all traffic off. Excluded routes do not configure DNS for you. Ask whether the service should be processed by Xray as direct or bypass Xray at the system layer.

One server, normal routing

Use the outbound templates after receiving real server parameters. Import into Servers, then retain Smart Routing. Do not export the App’s generated TUN/metrics into a server file.

Own DNS with existing App servers

Use Advanced Custom JSON for independent DNS, sniffing or additional local inbounds. Its examples reuse the selected App nodes and do not require copying proxy credentials. Rules and DNS paths remain entirely in the template.

Full node and chain composition

Use Raw JSON examples. The basic example has its own DNS interception and proxy resolver path. The two-entry example demonstrates two copies of a final exit and a balancer.

These are credential templates, not working subscriptions. Confirm the intended direct fallback and unmatched-traffic behavior before generating a final configuration.

Block QUIC on mobile

Use Custom protocol and localOS with the complete example. The two conditions are AND: sniffed QUIC and Xray running on iOS/Android. It does not identify a specific app. Protocol sniffing is not guaranteed for all traffic; blocking QUIC does not guarantee every app will fall back to TCP.

FakeDNS

Enable FakeDNS in Smart Routing, or import the Custom FakeDNS example. The App generates the pools and inbound recovery while retaining real proxy/direct DNS support. Read the cache and system-route limitations; ordinary Custom files must not include a root fakedns field. Advanced Custom instead owns its explicit pools, DNS and sniffing.

A UI-only solution

For “only these Android apps”, “disconnect on my home Wi-Fi”, or “select the Ethernet adapter”, use the VPN Tunnel guide. Generating routing JSON for a setting outside Xray is the wrong output.