diff --git a/template/render_route.go b/template/render_route.go
index ca3aa9f..02f62af 100644
--- a/template/render_route.go
+++ b/template/render_route.go
@@ -44,34 +44,6 @@ func (t *Template) renderRoute(metadata M.Metadata, options *option.Options) err
 			},
 		},
 	}
-	if !t.DisableTrafficBypass && !t.DisableDefaultRules {
-		blockTag := t.BlockTag
-		if blockTag == "" {
-			blockTag = DefaultBlockTag
-		}
-		options.Route.Rules = append(options.Route.Rules, option.Rule{
-			Type: C.RuleTypeLogical,
-			LogicalOptions: option.LogicalRule{
-				Mode: C.LogicalTypeOr,
-				Rules: []option.Rule{
-					{
-						Type: C.RuleTypeDefault,
-						DefaultOptions: option.DefaultRule{
-							Network: []string{N.NetworkUDP},
-							Port:    []uint16{443},
-						},
-					},
-					{
-						Type: C.RuleTypeDefault,
-						DefaultOptions: option.DefaultRule{
-							Protocol: []string{C.ProtocolSTUN},
-						},
-					},
-				},
-				Outbound: blockTag,
-			},
-		})
-	}
 	directTag := t.DirectTag
 	defaultTag := t.DefaultTag
 	if directTag == "" {
@@ -145,5 +117,27 @@ func (t *Template) renderRoute(metadata M.Metadata, options *option.Options) err
 	} else {
 		options.Route.Rules = append(options.Route.Rules, t.CustomRules...)
 	}
+	if !t.DisableTrafficBypass && !t.DisableDefaultRules {
+		blockTag := t.BlockTag
+		if blockTag == "" {
+			blockTag = DefaultBlockTag
+		}
+		options.Route.Rules = append(options.Route.Rules, option.Rule{
+			Type: C.RuleTypeLogical,
+			LogicalOptions: option.LogicalRule{
+				Mode: C.LogicalTypeOr,
+				Rules: []option.Rule{
+					{
+						Type: C.RuleTypeDefault,
+						DefaultOptions: option.DefaultRule{
+							Network: []string{N.NetworkUDP},
+							Port:    []uint16{443},
+						},
+					},
+				},
+				Outbound: blockTag,
+			},
+		})
+	}
 	return nil
 }