Steps
- Write down the default policy first: should unmatched traffic be proxied or direct?
- Keep private IP ranges and LAN names on direct so router, NAS and printer traffic stays local.
- Add only the domain, IP, process or rule-set matches you need. Verify each small group against a known destination.
- Update geo data and rule sets periodically, then inspect logs for missing tags, download failures or circular dependencies.
Why this matters
More rules do not mean better routing. A small explainable policy is easier to test and diagnose from the matched rule in logs.
How to verify
Proxy targets hit proxy, LAN targets hit direct, and a deliberately blocked test creates no outbound connection.
Things to watch
Rules are commonly processed in order. An overly broad early rule can make every precise rule below it unreachable.