关于域名规则和IP规则优先级的问题

[Benjamin1919]

如果要访问的域名在进入xray之前就已经被解析出了IP，那么入站后xray会优先匹配域名规则还是优先匹配IP规则呢？

举例：要访问example.com，首先被本地的smartdns（或mosdns）解析出IP为1.2.3.4，然后该IP进入xray，此时xray客户端的部分配置如下：

{
  "routing": {
    "domainStrategy": "AsIs",
    "domainMatcher": "hybrid",
    "rules": [
      {
        "type": "field",
        "domain": ["example.com"],
        "network": "tcp,udp",
        "outboundTag": "proxy" //该域名走代理出站
      },
      {
        "type": "field",
        "ip": ["1.2.3.4"],
        "network": "tcp,udp",
        "outboundTag": "direct" //该IP直连出站
      }
    ]
  },
  "inbounds": [
    {
      "listen": "127.0.0.1",
      "port": 1080,
      "protocol": "socks",
      "settings": {}, //配置省略
      "sniffing": {
        "enabled": true,
        "destOverride": ["http", "tls", "quic"],
        "routeOnly": true
      }
    }
  ],
  "outbounds": [
    {
      "protocol": "freedom",
      "tag": "direct"
    },
    {
      "protocol": "vless",
      "settings": {}, //配置省略
      "tag": "proxy"
    }
  ]
}

如果按照IP规则来匹配，那么最终会直连出站；
但是由于入站配置开启了sniffing和destOverride，xray会从IP1.2.3.4嗅探出对应的域名example.com，同时由于路由配置的domainStrategy为AsIs，所以按照域名规则应该要走代理出站。
请问这两者哪个优先级更高？

[chise0713]

AsIs下是按从上到下的顺序走，假设这个连接有两个属性，分别匹配到规则1和规则2，会优先命中规则1；假设是IPOnDemand，所有的域名都会在遇到IP规则时被解析为IP地址进行匹配；假设是IPIfNonMatch，会首先AsIs进行一轮匹配，若是没有任何规则能匹配到，那么会重新使用IPOnDemand在第二轮进行匹配。

[chika0801]

但是由于入站配置开启了sniffing和destOverride，xray会从IP1.2.3.4嗅探出对应的域名example.com，同时由于路由配置的domainStrategy为AsIs，所以按照域名规则应该要走代理出站。
请问这两者哪个优先级更高？

接收到的请求是IP，你使用了sniffing和destOverride，得到了域名。进入路由部分。用AsI要，我认为也选是用域名作为条件去匹配，从上到下，就命中代理了。

假设你没有代理那段规则。应该是命中IP直连。具体你可以找个网址写下具体规则，日志用debug看看处理的逻辑顺序 。

[us254]

Given the routing rules:

1: Rule for the domain: If the connection is to example.com, it is set to go through a proxy.
2: Rule for the IP: If the connection is to 1.2.3.4, it is set for direct connection.
And given that the domainStrategy AsIs means the rules will be evaluated as they are listed, with the first matching rule taking precedence, the client's behavior will be:

Since example.com resolves to 1.2.3.4, we have a connection that has two attributes, presumably the domain name and the IP address.
With sniffing enabled and destOverride in effect, Xray can determine the connection is intended for example.com, even if the IP 1.2.3.4 is already known.
Because of the AsIs strategy, Xray will evaluate the rules from top to bottom, and will apply the first matching rule.
Thus, rule 1 (the domain rule for example.com to use a proxy) will be hit first before considering the IP rule.
In conclusion, even though the IP has been resolved before the traffic enters Xray and the IP has a rule for a direct connection, the domain name rule will take precedence and the traffic for example.com will use the proxy because sniffing allows Xray to apply domain-based routing and the AsIs setting follows the rules in order. Therefore, in this specific configuration, the domain name rule will have higher priority and the connection will go through the proxy as per rule 1.

[Benjamin1919]

Thanks, I got it. By the way, if the "domainStrategy" is "IPOnDemand", will it become a direct connection?

[chise0713]

Thanks, I got it. By the way, if the "domainStrategy" is "IPOnDemand", will it become a direct connection?

It won't, before the stream into the routing part, it has been rewrite to domain, in your case, it will hit the first rule and route to proxy.