# Headless Rule - sing-box
The universal proxy platform.
Author: nekohasekai

Skip to content

# Headless Rule

Changes in sing-box 1.14.0

package_name_regex
query_type

Changes in sing-box 1.13.0

network_interface_address
default_interface_address

Changes in sing-box 1.11.0

network_type
network_is_expensive
network_is_constrained

### Structure

Since sing-box 1.8.0

    {
      "rules": [
        {
          "query_type": [
            "A",
            "HTTPS",
            32768
          ],
          "network": [
            "tcp"
          ],
          "domain": [
            "test.com"
          ],
          "domain_suffix": [
            ".cn"
          ],
          "domain_keyword": [
            "test"
          ],
          "domain_regex": [
            "^stun\\..+"
          ],
          "source_ip_cidr": [
            "10.0.0.0/24",
            "192.168.0.1"
          ],
          "ip_cidr": [
            "10.0.0.0/24",
            "192.168.0.1"
          ],
          "source_port": [
            12345
          ],
          "source_port_range": [
            "1000:2000",
            ":3000",
            "4000:"
          ],
          "port": [
            80,
            443
          ],
          "port_range": [
            "1000:2000",
            ":3000",
            "4000:"
          ],
          "process_name": [
            "curl"
          ],
          "process_path": [
            "/usr/bin/curl"
          ],
          "process_path_regex": [
            "^/usr/bin/.+"
          ],
          "package_name": [
            "com.termux"
          ],
          "package_name_regex": [
            "^com\\.termux.*"
          ],
          "network_type": [
            "wifi"
          ],
          "network_is_expensive": false,
          "network_is_constrained": false,
          "network_interface_address": {
            "wifi": [
              "2000::/3"
            ]
          },
          "default_interface_address": [
            "2000::/3"
          ],
          "wifi_ssid": [
            "My WIFI"
          ],
          "wifi_bssid": [
            "00:00:00:00:00:00"
          ],
          "invert": false
        },
        {
          "type": "logical",
          "mode": "and",
          "rules": [],
          "invert": false
        }
      ]
    }

You can ignore the JSON Array [] tag when the content is only one item

### Default Fields

The default rule uses the following matching logic:
(`domain` || `domain_suffix` || `domain_keyword` || `domain_regex` || `ip_cidr`) &&
(`port` || `port_range`) &&
(`source_port` || `source_port_range`) &&
`other fields`

#### query_type

Changes in sing-box 1.14.0

When a DNS rule references this rule-set, this field now also applies when the DNS rule is matched from an internal domain resolution that does not target a specific DNS server. In earlier versions, only DNS queries received from a client evaluated this field. See Migration for the full list.

When a DNS rule references a rule-set containing this field, the DNS rule is incompatible in the same DNS configuration with Legacy Address Filter Fields in DNS rules, the Legacy `strategy` DNS rule action option, and the Legacy `rule_set_ip_cidr_accept_empty` DNS rule item.

DNS query type. Values can be integers or type name strings.

#### network

`tcp` or `udp`.

#### domain

Match full domain.

#### domain_suffix

Match domain suffix.

#### domain_keyword

Match domain using keyword.

#### domain_regex

Match domain using regular expression.

#### source_ip_cidr

Match source IP CIDR.

#### ip_cidr

`ip_cidr` is an alias for `source_ip_cidr` when `rule_set_ipcidr_match_source` enabled in route/DNS rules.

Match IP CIDR.

#### source_port

Match source port.

#### source_port_range

Match source port range.

#### port

Match port.

#### port_range

Match port range.

#### process_name

Only supported on Linux, Windows, and macOS.

Match process name.

#### process_path

Only supported on Linux, Windows, and macOS.

Match process path.

#### process_path_regex

Since sing-box 1.10.0

Only supported on Linux, Windows, and macOS.

Match process path using regular expression.

#### package_name

Match android package name.

#### package_name_regex

Since sing-box 1.14.0

Match android package name using regular expression.

#### network_type

Since sing-box 1.11.0

Only supported in graphical clients on Android and Apple platforms.

Match network type.

Available values: `wifi`, `cellular`, `ethernet` and `other`.

#### network_is_expensive

Since sing-box 1.11.0

Only supported in graphical clients on Android and Apple platforms.

Match if network is considered Metered (on Android) or considered expensive, such as Cellular or a Personal Hotspot (on Apple platforms).

#### network_is_constrained

Since sing-box 1.11.0

Only supported in graphical clients on Apple platforms.

Match if network is in Low Data Mode.

#### network_interface_address

Since sing-box 1.13.0

Only supported in graphical clients on Android and Apple platforms.

Matches network interface (same values as `network_type`) address.

#### default_interface_address

Since sing-box 1.13.0

Only supported on Linux, Windows, and macOS.

Match default interface address.

#### wifi_ssid

Only supported in graphical clients on Android and Apple platforms.

Match WiFi SSID.

#### wifi_bssid

Only supported in graphical clients on Android and Apple platforms.

Match WiFi BSSID.

#### invert

Invert match result.

### Logical Fields

#### type

`logical`

#### mode

Required

`and` or `or`

#### rules

Required

Included rules.