mixed-port: 7890
allow-lan: true
bind-address: '*'
mode: rule
log-level: info
ipv6: false

external-controller: 0.0.0.0:9090

tun:
  enable: true
  stack: gvisor
  mtu: 1500
  auto-route: true
  auto-detect-interface: true
  route-exclude-address:
    - 18.136.60.128/32
  dns-hijack:
    - any:53

dns:
  enable: true
  listen: 0.0.0.0:53
  enhanced-mode: fake-ip
  fake-ip-persist: true
  fake-ip-range: 198.18.0.0/15
  fake-ip-filter:
    - '*.lan'
    - '*.local'
    - 'time.*.com'
    - 'ntp.*.com'
    - '+.pool.ntp.org'
    # Tailscale 控制面/DERP 必须解析为真实 IP，否则 fake-ip 会导致 tailscaled
    # 连不上控制服务器、tailscale up 卡住不打印登录 URL。详见 docs/public-access.md
    - '+.tailscale.com'
    - '+.tailscale.io'
    - '+.tailscale-dns.com'
  nameserver:
    - 114.114.114.114
    - 223.5.5.5
  fallback:
    - 8.8.8.8
    - 1.1.1.1
  fallback-filter:
    geoip: true
    geoip-code: CN

proxies:
  - name: "ec2-sg"
    type: vless
    server: 18.136.60.128
    port: 443
    uuid: <VLESS_UUID>
    network: tcp
    tls: true
    udp: true
    reality-opts:
      public-key: fHHr9qWw2JuqNxpv3XTcZTi5k73HWfjipa4vnXFu9W8
      short-id: 6eb28f1a766a
    servername: www.cloudflare.com
    client-fingerprint: chrome

proxy-groups:
  - name: "Proxy"
    type: select
    proxies:
      - ec2-sg
      - DIRECT

rules:
  - GEOIP,private,DIRECT
  - GEOSITE,cn,DIRECT
  - GEOIP,CN,DIRECT
  - MATCH,Proxy