Block all requests except limited ones

[BemoBit]

The issue I have with the core is that the rules are not applied correctly across all devices!
I want to block all websites and requests, giving users limited access to specific sites, and I have tried various solutions such as:

  "outbounds": [
    {
      "protocol": "freedom",
      "tag": "DIRECT"
    },
    {
      "protocol": "blackhole",
      "tag": "BLOCK"
    }
  ],
  "routing": {
    "domainStrategy": "AsIs",
    "rules": [
      {
        "type": "field",
        "ip": [
          "0.0.0.0/0",
          "::/0"
        ],
        "outboundTag": "BLOCK"
      },
      {
        "type": "field",
        "domain": [
          "domain:example.com",
          "domain:google",
          "geosite:google",
        ],
        "outboundTag": "DIRECT"
      },
      {
        "type": "field",
        "ip": [
          "8.8.8.8"
        ],
        "outboundTag": "DIRECT"
      }
    ]
  }
}

But most of them do not work properly on Android or different apps and do not produce consistent results!
Thank you for your guidance

[kingwilliam]

first you need to know,

1. rules is from up to down
2. ip not equal to domain
   • if www.abc.com = 7.7.7.7
   • block ip 7.7.7.7 not equal to block www.abc.com

back to your coding
your first rules is 
      "domainStrategy": "AsIs",
      {
        "type": "field",
        "ip": [
          "0.0.0.0/0",
          "::/0"
        ],
        "outboundTag": "BLOCK"
      },

      - if www.abc.com = 7.7.7.7

      your code only block https://7.7.7.7, ftp://7.7.7.7 openvpn 7.7.7.7, but cannot block https://www.abc.com

if you want to block all websites and requests, giving users limited access to specific sites

1. you need to pass specific sites first
2. block all sites

like

  "routing": {
    "domainStrategy": "AsIs",
    "rules": [
      {
        "type": "field",
        "domain": [
          "domain:example.com",
          "domain:google",
          "geosite:google",
        ],
        "outboundTag": "DIRECT"
      },
      {
        "network": "tcp,udp"
        "outboundTag": "BLOCK"
      }

ofcourse, you need put it back some service before block, like dns and ntp

[BemoBit]

Thank you for your guidance