# Subscription routing rules > How a provider sends rules for what goes through the VPN and what goes direct: a Happ profile in the routing header, Xray and sing-box JSON. A provider can send **routing rules** with the subscription: which sites and addresses go through the VPN, which go direct, and which are blocked. FlowLock applies them together with the user's own rules; the user's rules win. No provider ID is needed for this. ## Happ profile The same format Remnawave serves for Happ, as the `routing` header or a line in the body: ``` routing: happ://routing/add/ routing: happ://routing/onadd/ ``` - `add`: the subscription's rules simply work together with the person's rules. - `onadd`: the same, and if the profile has `GlobalProxy: false`, the app **offers** “Selective” mode (only what's in the rules goes through the VPN). It never switches the mode by itself. - `routing: off` or `routing-enable: 0`: don't apply the subscription's rules. Domains in a Happ profile (as in Xray) match as substrings, and FlowLock reads them the same way. ## JSON subscriptions - **Xray JSON**: rules from `routing.rules`. - **sing-box JSON**: rules from `route.rules`. ## What the person sees - The subscription's rules are shown as a separate list in the route editor, and each one can be turned off with a checkbox. - A subscription refresh changes **only** the subscription's rules; the person's own rules are kept. - Order: the user's block, “via VPN” and “direct” rules, then the same three lists from the subscription, then the routing mode. ## geosite and geoip categories Rules can refer to `geosite:` and `geoip:` categories. FlowLock's standard databases are SagerNet's, and categories missing there (for example `ru-blocked`) come from runetfreedom. A person can add their own databases (see [“Routes and custom databases”](https://flowlock.cc/en/docs/rules.md)). The links `flowlock://routing/add/…` and `flowlock://routing/onadd/…` add the same rules with a click (see [“flowlock:// links”](https://flowlock.cc/en/docs/links.md)).