Skip to content


In addition to everything that expr already provides, we also have some extra built-in functions that you can use in your expressions:


cidr(ip: string, cidr: string) -> bool

Check if an IP address is in a CIDR range. Example:

- name: block cidr
  action: block
  expr: cidr(string(ip.dst), "")


geoip(ip: string, country: string) -> bool

Check if an IP address belongs to a specific country, using data from


- name: block CN geoip
  action: block
  expr: geoip(string(ip.dst), "cn")


geosite(domain: string, category: string) -> bool

Check if a domain belongs to a specific category, using data from


- name: block bilibili geosite
  action: block
  expr: geosite(string(tls?.req?.sni), "bilibili")


lookup(domain: string) -> list<string>
lookup(domain: string, server: string) -> list<string>

Perform a DNS lookup for a domain, returns the list of IP addresses (both A and AAAA records) returned by the DNS server. If the server address is not specified, it uses the system default. Note that this uses the standard DNS protocol (not DNS over TLS, DNS over HTTPS, for example), and you must specify both IP and port for the server address (e.g.


- name: SNI mismatch
  log: true
  expr: tls?.req?.sni != nil && ip.dst not in lookup(tls.req.sni)