diff --git a/app/router/config.go b/app/router/config.go
index 16d4fac69..be69e5923 100644
--- a/app/router/config.go
+++ b/app/router/config.go
@@ -59,12 +59,12 @@ func (rr *RoutingRule) BuildCondition() (Condition, error) {
 		conds.Add(matcher)
 	}
 
-	if len(rr.Cidr) > 0 {
-		cond, err := cidrToCondition(rr.Cidr, false)
-		if err != nil {
-			return nil, err
-		}
-		conds.Add(cond)
+	if len(rr.UserEmail) > 0 {
+		conds.Add(NewUserMatcher(rr.UserEmail))
+	}
+
+	if len(rr.InboundTag) > 0 {
+		conds.Add(NewInboundTagMatcher(rr.InboundTag))
 	}
 
 	if rr.PortRange != nil {
@@ -75,6 +75,14 @@ func (rr *RoutingRule) BuildCondition() (Condition, error) {
 		conds.Add(NewNetworkMatcher(rr.NetworkList))
 	}
 
+	if len(rr.Cidr) > 0 {
+		cond, err := cidrToCondition(rr.Cidr, false)
+		if err != nil {
+			return nil, err
+		}
+		conds.Add(cond)
+	}
+
 	if len(rr.SourceCidr) > 0 {
 		cond, err := cidrToCondition(rr.SourceCidr, true)
 		if err != nil {
@@ -83,14 +91,6 @@ func (rr *RoutingRule) BuildCondition() (Condition, error) {
 		conds.Add(cond)
 	}
 
-	if len(rr.UserEmail) > 0 {
-		conds.Add(NewUserMatcher(rr.UserEmail))
-	}
-
-	if len(rr.InboundTag) > 0 {
-		conds.Add(NewInboundTagMatcher(rr.InboundTag))
-	}
-
 	if conds.Len() == 0 {
 		return nil, newError("this rule has no effective fields").AtWarning()
 	}