132 lines
3.7 KiB
YAML
132 lines
3.7 KiB
YAML
# ============================================================
|
|
# 由 gen-clash.sh 自动生成，请勿手工编辑（重新生成会覆盖）
|
|
#
|
|
# ⚠ 需要 Clash.Meta / mihomo 内核（Clash Verge Rev、ClashX Meta、
|
|
# FlClash 等）。原版 Clash / Clash Premium 不支持 VLESS + Reality。
|
|
#
|
|
# ⚠ 本文件含真实 UUID 与服务器地址，等同凭据，切勿提交到版本库或外传。
|
|
# ============================================================
|
|
|
|
mixed-port: 7890
|
|
allow-lan: false
|
|
mode: rule
|
|
log-level: info
|
|
|
|
# fake-ip 下开启嗅探，才能从流量中还原域名，让域名类规则对直连 IP 也生效
|
|
sniffer:
|
|
enable: true
|
|
sniff:
|
|
HTTP:
|
|
ports: [80, 8080-8880]
|
|
override-destination: true
|
|
TLS:
|
|
ports: [443, 8443]
|
|
QUIC:
|
|
ports: [443, 8443]
|
|
skip-domain:
|
|
- "+.push.apple.com"
|
|
|
|
dns:
|
|
enable: true
|
|
ipv6: false
|
|
enhanced-mode: fake-ip
|
|
fake-ip-range: 198.18.0.1/16
|
|
# 这些域名必须拿到真实 IP，否则局域网发现、时间同步、
|
|
# 网络连通性检测等会出问题
|
|
fake-ip-filter:
|
|
- "*.lan"
|
|
- "*.local"
|
|
- "*.localdomain"
|
|
- "*.home.arpa"
|
|
- "+.msftconnecttest.com"
|
|
- "+.msftncsi.com"
|
|
- "time.*.com"
|
|
- "ntp.*.com"
|
|
- "+.pool.ntp.org"
|
|
- "localhost.ptlogin2.qq.com"
|
|
# 用于解析下面 fallback 里 DoH 服务器自身的域名
|
|
default-nameserver:
|
|
- 223.5.5.5
|
|
- 119.29.29.29
|
|
nameserver:
|
|
- 223.5.5.5
|
|
- 119.29.29.29
|
|
# fallback 的意义是绕过投毒，必须用加密 DNS——
|
|
# 明文 UDP 的 8.8.8.8 在国内同样会被污染，等于没有 fallback
|
|
fallback:
|
|
- https://1.1.1.1/dns-query
|
|
- https://dns.google/dns-query
|
|
fallback-filter:
|
|
geoip: true
|
|
geoip-code: CN
|
|
ipcidr:
|
|
- 240.0.0.0/4
|
|
- 0.0.0.0/32
|
|
|
|
proxies:
|
|
- name: "vps-reality-1"
|
|
type: vless
|
|
server: 45.32.69.133
|
|
port: 443
|
|
uuid: 5b05151b-a681-46db-a223-95dd45b13589
|
|
network: tcp
|
|
udp: true
|
|
tls: true
|
|
flow: xtls-rprx-vision
|
|
servername: www.apple.com
|
|
client-fingerprint: chrome
|
|
reality-opts:
|
|
public-key: IgxAG9DOh7IFLkGi7Zrn3L00lYDYW9blDWRyzmxU6Bk
|
|
short-id: c6bdf22bcb510f78
|
|
|
|
- name: "vps-reality-2"
|
|
type: vless
|
|
server: 45.32.71.199
|
|
port: 443
|
|
uuid: cbf3836d-517d-4dfb-86d4-a636bca27713
|
|
network: tcp
|
|
udp: true
|
|
tls: true
|
|
flow: xtls-rprx-vision
|
|
servername: www.apple.com
|
|
client-fingerprint: chrome
|
|
reality-opts:
|
|
public-key: UXWjZU9YEIhZmvLJYgnvd4eKiddR4ewRS2xCnmFwfWc
|
|
short-id: ab115ca2444053d1
|
|
|
|
proxy-groups:
|
|
- name: "Proxy"
|
|
type: select
|
|
proxies:
|
|
- Auto-Select
|
|
- "vps-reality-1"
|
|
- "vps-reality-2"
|
|
- DIRECT
|
|
|
|
- name: "Auto-Select"
|
|
type: url-test
|
|
url: "http://www.gstatic.com/generate_204"
|
|
interval: 300
|
|
tolerance: 50
|
|
proxies:
|
|
- "vps-reality-1"
|
|
- "vps-reality-2"
|
|
|
|
rules:
|
|
# 代理服务器自身必须直连。否则 TUN / 系统代理会把「连接代理服务器」
|
|
# 这件事本身也丢进代理，形成回环，表现为 REALITY 握手拿到真证书。
|
|
- IP-CIDR,45.32.69.133/32,DIRECT,no-resolve
|
|
- IP-CIDR,45.32.71.199/32,DIRECT,no-resolve
|
|
# 本机与局域网直连（fake-ip 下不加这条，路由器/NAS 会被丢进代理）
|
|
- IP-CIDR,127.0.0.0/8,DIRECT,no-resolve
|
|
- IP-CIDR,10.0.0.0/8,DIRECT,no-resolve
|
|
- IP-CIDR,172.16.0.0/12,DIRECT,no-resolve
|
|
- IP-CIDR,192.168.0.0/16,DIRECT,no-resolve
|
|
- IP-CIDR,169.254.0.0/16,DIRECT,no-resolve
|
|
# 域名规则放在 IP 规则之前：GEOSITE 直接按域名命中，
|
|
# 不必先做一次真实 DNS 解析（fake-ip 下 GEOIP 前置会触发额外解析）
|
|
- GEOSITE,cn,DIRECT
|
|
- GEOIP,CN,DIRECT
|
|
# 兜底。MATCH 是终结规则，其后任何规则都不可达
|
|
- MATCH,Proxy
|