Rule, Global and Direct modes explained

What each mode does with a request

Those buttons set one top-level key, mode, which in the file reads mode: rule. Changing it needs no core restart; the engine switches live.

• rule: the request, carrying a domain or an address, is compared against rules from the top down, and the first match hands it to the policy group named on that line. Anything unmatched at the closing MATCH belongs to that line, so its target decides where unclaimed traffic goes.
• global: rules is skipped completely and every request goes to the group named GLOBAL, which normally lists every node in the profile. Whatever you pick there is what you get.
• direct: rules are skipped too, and everything leaves untouched, using no node at all.

Here is the tail of a typical rule list. The first two lines push domestic domains and addresses out directly, and the last one catches the rest:

mode: rule
rules:
  - DOMAIN-SUFFIX,cn,DIRECT
  - GEOIP,CN,DIRECT,no-resolve
  - MATCH,PROXY

Global is a diagnostic, not a speed switch

Switching to Global removes rules from the equation. A site will not open and you suspect a DIRECT rule quietly sent it out unproxied. Switch over: if it works at once, the fault is in the rules. If it still fails, the rules are innocent and the node or DNS is next.

1. Note which mode you are in and which node the main group has selected, because you are coming back.
2. Switch to Global and pick a node in the GLOBAL group that you know works.
3. Clear the connection list, then reload the site. Skip that and you may be watching an old connection behave the old way.
4. If it loads, return to Rule and check on the connections page which rule matched that domain. If not, try another node; when two fail, the mode is not your problem.

Direct is not the same as quitting

In Direct everything really does leave unproxied, but the client is still in the path. The system proxy switch is still on, so the browser keeps handing requests to the mixed port on 127.0.0.1, and with TUN enabled the virtual adapter still owns the routes. The core just stops forwarding to a node and sends the traffic itself. DNS may still go through the core's own resolver.

That is what makes it useful for ruling the proxy out, and cleaner than quitting. Quit instead and the system proxy setting is left pointing at a port nobody is listening on, the browser fails on everything at once, and you can no longer tell a broken proxy from a broken site.

Old connections survive the switch

An established TCP connection had its path fixed at handshake time, and a later change to mode does not reach it. Browsers reuse keep-alive connections; video players and chat apps hold them open for hours. Hence the familiar complaint that global mode changed nothing. Clear the connection list after switching, or restart the core; in the browser you sometimes have to close the tab and open it again.