Routing

Routing Rules

Create practical rules for websites, networks, ports, protocols, and asset lists.

Updated 2026-06-02

A routing rule is a named decision with one or more real traffic conditions. The Rule Set is processed from top to bottom. Move specific rules above broader rules, because the first matching unpaused rule wins and the lower rules are not considered for that traffic.

A good rule has a purpose, a target, and a place

Name the purpose

Use names like Work Direct, Streaming Proxy, or Tracker Block so the list stays readable.
Choose the outcome

Pick Proxy, Freedom, Blackhole, or a specific proxy node from the Outbound menu.
Add focused conditions

Start with one domain, IP, port, protocol, or asset record before combining many conditions.
Place it carefully

Specific rules should sit above broad rules because the first match wins.

General Settings

Rule Edit starts with the fields that make the rule readable in the list and decide what happens when it matches.

Name

Name is the label shown in the Rule Set. If you leave it blank, Tunna uses the rule's default name. A clear name is still worth adding when the rule will be shared or revisited later.

Readable names

Use names that describe intent, such as Work Direct, Streaming Proxy, or Tracker Block.

Outbound

Outbound is the rule outcome. The menu includes Proxy, Freedom, and Blackhole, followed by individual proxy nodes. Proxy means the currently selected node in Outbound; a specific node keeps this rule tied to that node even when the selected node changes.

Proxy

Use the current outbound node.

Freedom or Blackhole

Send matching traffic direct or drop it.

Specific proxy node

Send only this rule's traffic through a chosen node from the proxy-node list.

Rule editor tabs

Use the tab picker to move between condition types. A dot on a tab means that part of the rule already contains a condition.

Asset

Search installed GeoSite and GeoIP records and attach matching chips. If no assets exist yet, the tab shows compact asset setup with Add Predefined.

Domain

Add Base, Full, Plain, or RegEx domain entries. Commas and new lines can add multiple entries.

IP

Add destination IP addresses or CIDR ranges. Use this when a destination is better known by network address than by name.

Port

Add destination ports one value at a time. Use this for a known service port; split any range into the exact ports you want Tunna to match.

Protocol

Toggle TCP or UDP under Transport Layer, and HTTP, TLS, or BT under Application Layer when Sniffing can identify the traffic.

Advanced

Configure a webhook URL, Deduplication, and optional Headers for match notifications or automation.

Rule Set controls

Plus menu

Create a New Rule or paste routing material. Paste accepts shared rule links, ordinary subscription URLs, and pasted rule data, then opens Resources for review when Tunna has importable items to show.

New rule outcome

When the Default Route is Proxy, a new rule starts as Freedom so you can carve out direct traffic. When the Default Route is Freedom or Blackhole, a new rule starts as Proxy.

Empty state

When no rules exist, use the pencil control to create the first rule or the clipboard control to process the current pasteboard.

Swipe actions

Swipe a rule from the leading edge to Pause or Unpause it. Swipe from the trailing edge to Share or Delete it.

Move

Reordering saves the new priority immediately. The first matching unpaused rule wins.

Rule Edit actions

The editor keeps creation actions at the top and saved-rule actions in the bottom toolbar.

Add or Save

Add appears for a new rule and Save appears after the rule has been saved once. The button stays disabled until the rule has at least one real condition.

Delete

Delete is available only for a saved rule and removes it from the Rule Set.

QR Code

QR Code is available only for a saved rule and opens a QR share sheet for the rule link.

Share is available only for a saved rule. Shared rule links may include asset source information so another device can review missing records in Resources.

Pause or Resume

Pause, or Resume for a paused rule, is available only after saving. It saves the changed state immediately and closes Rule Edit.

Add or Save waits for a real condition

A name and outbound choice are not enough by themselves. Add stays disabled until the rule has at least one condition such as an asset record, domain, IP, port, protocol, or webhook detail.

Rule conditions in plain language

Asset

Use provider-maintained GeoSite or GeoIP records instead of typing every destination. Tap a found chip to attach it. Tap an attached chip once to mark it excluded from this rule, and tap it again to include it again. GeoSite and GeoIP colors match the footer legend.

Domain

Match a site family, exact hostname, keyword, or pattern. Prefer Base or Full for ordinary website rules because they are easier to reason about and more useful for On-Demand.

IP and Port

Match network ranges or destination ports when a domain is not enough. The Port field currently accepts single integer ports.

Network protocol

Toggle TCP or UDP when the transport layer matters. This does not require Sniffing.

Application protocol

Toggle HTTP, TLS, or BT after Sniffing can identify the traffic. BT matching is only a clue; encrypted or disguised traffic may not be recognized. QUIC can be detected by Sniffing, but it is not a separate rule protocol choice.

Advanced webhook

Use URL for the webhook target, Deduplication to avoid repeated notifications for the same match, and Headers when the receiving service requires named header values.

Asset search starts from installed records

In the Asset tab, an empty search shows only records already attached to the rule. Type to search installed GeoSite and GeoIP records. Tunna searches case-insensitively, shows up to 20 new matches, prefers prefix matches, and adds the first found match when you press Return. While any asset is fetching or processing, the tab shows progress rows instead of search. Found and excluded chips use a pale background with a colored outline; included chips use the solid GeoSite or GeoIP color.

No assets yet? Add them from Rule Edit

If the Asset tab opens before any assets exist, Tunna shows compact asset setup instead of the search field. Use Add Predefined there to create the built-in GeoSite and GeoIP sources and start fetching them. Search returns after processing finishes.

Domain match types

Type	Best for	Risk
Base	A domain and its subdomains.	Broad domains can catch more than expected.
Full	One exact hostname.	Related subdomains will not match.
Plain	A simple keyword inside the domain.	Short words can match unrelated sites.
RegEx	A pattern that the other types cannot express.	Powerful patterns are easy to make too broad.

Rule list actions

Move

Reorder rules when a narrow rule must win before a broad one.

Pause

Disable a rule temporarily without deleting it.

Share from the list swipe action or from a saved rule editor. Shared rules are Tunna import links and may carry asset source information so Resources can fetch missing records.

Paste

Paste accepts shared rule links, ordinary subscription URLs, and pasted rule data, then opens Resources for review when Tunna has importable items to show.

Delete

Remove a rule after you are sure it is no longer needed.

Application protocol rules need Sniffing

HTTP, TLS, and BT matching depends on Tunna recognizing the traffic. If those rules do not match, open the Sniffing page from Settings and confirm the recognition choices.

Some editor actions require a saved rule

Delete, QR Code, Share, and Pause or Resume are available only after a rule has been saved once. Pause or Resume from Rule Edit saves immediately and closes the editor.

Only some Proxy rules can wake On-Demand

For On-Demand, use unpaused rules whose outbound is Proxy or a specific proxy node, with ordinary domain entries or GeoSite records. Those rules give Apple domain material it can evaluate before the tunnel is already running. Direct, Blackhole, paused, GeoIP-only, IP, port, TCP, UDP, and application-protocol rules are useful for routing after traffic enters Tunna, but they are not reliable wake triggers.

On-Demand routing use cases

Set Connect to On-Demand in Tunnel settings only after the relevant routing rules are saved and unpaused.

Use case	Good routing material	Avoid relying on
Wake Tunna for a work site	A Proxy or specific-node rule with Base or Full domain entries for the work domains.	Default Route alone, because it is only the fallback after the tunnel has traffic.
Wake Tunna for a site category	A Proxy or specific-node rule with non-RegEx GeoSite records from installed assets.	GeoIP records, ports, TCP, UDP, HTTP, TLS, or BT toggles.
Keep trusted networks quiet	Eligible Proxy domain rules plus Trusted Networks in Tunnel settings for networks where Tunna should stay off.	Paused rules or direct/block rules, because they should not be treated as startup requests.