只在必要时使用代理，怎么设置？

[playgithub]

如下设置，访问microsfot.com时没有用到代理

{
    "domainStrategy": "AsIs",
    "domains": {
        "block": [
            "geosite:category-ads-all"
        ],
        "direct": [
            "geosite:microsoft",
            "geosite:microsoft-dev"
        ]
    }
}

但是，由于github.com属于微软，这样设置时，访问不了。
改成如下设置

{
    "domainStrategy": "AsIs",
    "domains": {
        "block": [
            "geosite:category-ads-all"
        ],
        "direct": [
            "geosite:microsoft",
            "geosite:microsoft-dev"
        ],
        "proxy": [
            "geosite:geolocation-!cn"
        ]
    }
}

github可以访问，但是访问microsoft.com时，一些域名会使用代理

需要访问microsoft.com时不使用任何代理，同时可以访问github.com。
也就是，只在必要时使用代理。
有办法吗？

[gallium-aurum-yttrium]

I usually have two client instances of V2Ray running:

1. Blacklist instance Using GFW filter list, any domain known to be blocked in the list is directed through the proxy. Any other traffic is sent direcly to internet. This list is based on the GFW list, which is much better than the list proivded by default. These files are downloaded from:

• https://cdn.jsdelivr.net/gh/Loyalsoldier/v2ray-rules-dat@release/geosite.dat
• https://cdn.jsdelivr.net/gh/Loyalsoldier/v2ray-rules-dat@release/geoip.dat

"routing": {
  "domainStrategy": "AsIs",
  "rules": [

    { // 1. Do not route private IPs
      "type": "field",
      "ip": [
        "geoip:private"
      ],
      "outboundTag": "to-internet"
    },

    { // 2. Ignore ads domains
      "type": "field",
      "domain": [
        "geosite:category-ads"
      ],
      "outboundTag": "discard"
    },

    { // 3. Blocked domains (by China) go through the proxy
      // Uses geosite.dat from
      // https://cdn.jsdelivr.net/gh/Loyalsoldier/v2ray-rules-dat@release/geosite.dat

      "type": "field",
      "domain": [
        "geosite:category-anticensorship",
        "geosite:category-media",
        "geosite:category-entertainment",
        "geosite:category-companies",
        "geosite:gfw",
        "geosite:category-porn"
      ],
      "outboundTag": "to-trusted-server"
    },

    { // 4. Anything else not explicitly listed, uses internet directly
      "type": "field",
      "inboundTag": [
        "incoming-connection-socks",
        "incoming-connection-http"
      ],
      "outboundTag": "to-internet"
    }
  ]
}

2. Whitelist instance This instance is more restrictive (more international sites are sent through the proxy even if they are not blocked), it uses the CN geolocation filter to identify local sites (which are sent directly to the internet). All international sites are directed to the proxy.

"routing": {
  "domainStrategy": "AsIs",
  "rules": [

    { // 1. Do not route private IPs
      "type": "field",
      "ip": [
        "geoip:private"
      ],
      "outboundTag": "to-internet"
    },

    { // 2. Ignore ads domains
      "type": "field",
      "domain": [
        "geosite:category-ads"
      ],
      "outboundTag": "discard"
    },

    // 3. Chinese domains (like baidu.com, *.cn) through internet
    {
      "type": "field",
      "domain": [
        "geosite:cn"
      ],
      "outboundTag": "to-internet"
    },

    // 4. Any other traffic goes to the trusted server
    {
      "type": "field",
      "inboundTag": [
        "incoming-connection-socks",
        "incoming-connection-http"
      ],
      "outboundTag": "to-trusted-server"
    }
  ]
}

The first option limits the amount of traffic sent to the proxy, but sometimes, some other lesser-known blocked domains are not covered in the list. In that case I switch to the second client.

For Android, it's very easy, thanks to the multiple profiles you can define in V2RayNG and similar apps.
For Linux, I use a Gnome extension to manage a list of profiles for the system proxy. The system proxy can be changed from a menu to the client using method 1 or method 2 (both clients are running locally at the same time).

Note that the "outboundTag" must have been defined accordingly for each output. For example:

"outbounds": [
  // Internet
  {
    "protocol": "freedom",
    "tag": "to-internet"
  },
  // Discard packets (answer directly with HTTP 403), used to block ads
  {
    "protocol": "blackhole",
    "response": "http",
    "tag": "discard"
  },
  // Connection to trusted server configured with matching inbound
  {
    "protocol": "vmess",
    "tag": "to-trusted-server",
    "settings": {
       ...
    }
  }
]

[playgithub]

Great
With GFW rules, it'll be easy
I'll study it later

Thanks very much