mixed-port: 7890

dns:
  enable: true
  use-hosts: true
  ipv6: false
  enhanced-mode: redir-host
  fake-ip-range: 198.18.0.1/16
  listen: 127.0.0.1:6868
  default-nameserver:
    - 119.29.29.29
    - 114.114.114.114
  nameserver:
    - https://doh.pub/dns-query
    - tls://223.5.5.5:853
  fallback:
    - 'https://1.0.0.1/dns-query#DNS'  # append the proxy adapter name or group name to the end of DNS URL with '#' prefix.
    - 'tls://8.8.4.4:853#DNS'
  fallback-filter:
    geoip: false
    geosite:
      - gfw  # `geosite` filter only use fallback server to resolve ip, prevent DNS leaks to unsafe DNS providers.
    domain:
      - +.example.com
    ipcidr:
      - 0.0.0.0/32

# Enable the TUN listener
#tun:
#  enable: true
#  stack: gvisor #  only gvisor
#  dns-hijack: 
#    - 0.0.0.0:53 # additional dns server listen on TUN
#  auto-route: true # auto set global route

rules:

  - IP-CIDR,127.0.0.0/8,DIRECT
  - IP-CIDR,10.8.0.0/16,DIRECT
  - IP-CIDR,172.19.76.0/24,DIRECT

#  # network(tcp/udp) condition for all rules
#  - DOMAIN-SUFFIX,bilibili.com,DIRECT,tcp
#  - DOMAIN-SUFFIX,bilibili.com,REJECT,udp

  # multiport condition for rules SRC-PORT and DST-PORT
  - DST-PORT,123/136/137-139/445,DIRECT,udp

  # rule GEOSITE
  - GEOSITE,category-ads-all,REJECT
#  - GEOSITE,icloud@cn,DIRECT
#  - GEOSITE,apple@cn,DIRECT
#  - GEOSITE,apple-cn,DIRECT
#  - GEOSITE,microsoft@cn,DIRECT
#  - GEOSITE,facebook,PROXY
#  - GEOSITE,youtube,PROXY
#  - GEOSITE,geolocation-cn,DIRECT
#  - GEOSITE,geolocation-!cn,PROXY

#  # source IPCIDR condition for all rules in gateway proxy
#  #- GEOSITE,geolocation-!cn,REJECT,192.168.1.88/32,192.168.1.99/32

#  - GEOIP,telegram,PROXY,no-resolve
#  - GEOIP,private,DIRECT,no-resolve
#  - GEOIP,cn,DIRECT

  - MATCH,relay

proxy-groups:
  # relay chains the proxies. proxies shall not contain a relay. No UDP support.
  # Traffic: clash <-> socks-tr <-> ss-osf <-> Internet
  - name: "relay"
    type: relay
    proxies:
      - socks-tr
      - ss-osf

#
#  - name: DNS
#    type: url-test
#    use:
#      - HK
#    url: http://cp.cloudflare.com
#    interval: 180
#    lazy: true

#
#  - name: 🚀 HK Group
#    type: select
#    use:
#      - ALL
#    filter: 'HK'

#  - name: 🚀 US Group
#    type: select
#    use:
#      - ALL
#    filter: 'US'

#  # url-test select which proxy will be used by benchmarking speed to a URL.
#  - name: "auto"
#    type: url-test
#    proxies:
#      - ss1
#      - ss2
#      - vmess1
#    # tolerance: 150
#    # lazy: true
#    url: 'http://www.gstatic.com/generate_204'
#    interval: 300

#  # fallback selects an available policy by priority. The availability is tested by accessing an URL, just like an auto url-test group.
#  - name: "fallback-auto"
#    type: fallback
#    proxies:
#      - ss1
#      - ss2
#      - vmess1
#    url: 'http://www.gstatic.com/generate_204'
#    interval: 300

#  # relay chains the proxies. proxies shall not contain a relay. No UDP support.
#  # Traffic: clash <-> http <-> vmess <-> ss1 <-> ss2 <-> Internet
#  - name: "relay"
#    type: relay
#    proxies:
#      - http
#      - vmess
#      - ss1
#      - ss2

#  # url-test select which proxy will be used by benchmarking speed to a URL.
#  - name: "auto"
#    type: url-test
#    proxies:
#      - ss1
#      - ss2
#      - vmess1
#    # tolerance: 150
#    # lazy: true
#    url: 'http://www.gstatic.com/generate_204'
#    interval: 300

#  # fallback selects an available policy by priority. The availability is tested by accessing an URL, just like an auto url-test group.
#  - name: "fallback-auto"
#    type: fallback
#    proxies:
#      - ss1
#      - ss2
#      - vmess1
#    url: 'http://www.gstatic.com/generate_204'
#    interval: 300

#proxy-providers:
#  ALL:
#    type: http
#    url: "xxxxx"
#    interval: 3600
#    path: "xxxxx"
#    health-check:
#      enable: true
#      interval: 600
#      url: http://www.gstatic.com/generate_204

#  provider1:
#    type: http
#    url: "url"
#    interval: 3600
#    path: ./provider1.yaml
#    health-check:
#      enable: true
#      interval: 600
#      # lazy: true
#      url: http://www.gstatic.com/generate_204
#  test:
#    type: file
#    path: /test.yaml
#    health-check:
#      enable: true
#      interval: 36000
#      url: http://www.gstatic.com/generate_204

#  - name: UseProvider
#    type: select
#    use:
#      - provider1
#    proxies:
#      - Proxy
#      - DIRECT

proxies:
#  - name: "vless"
#    type: vless
#    server: server
#    port: 443
#    uuid: uuid
#    servername: example.com # AKA SNI
#    # flow: xtls-rprx-direct # xtls-rprx-origin  # enable XTLS
#    # skip-cert-verify: true

#  - name: "vless-ws"
#    type: vless
#    server: server
#    port: 443
#    uuid: uuid
#    tls: true
#    udp: true
#    network: ws
#    servername: example.com # priority over wss host
#    # skip-cert-verify: true
#    ws-opts:
#      path: /path
#      headers: { Host: example.com, Edge: "12a00c4.fm.huawei.com:82897" }

#  - name: "vless-grpc"
#    type: vless
#    server: server
#    port: 443
#    uuid: uuid
#    tls: true
#    udp: true
#    network: grpc
#    servername: example.com # priority over wss host
#    # skip-cert-verify: true
#    grpc-opts: 
#      grpc-service-name: grpcname

  - name:   "ss-osf"
    type:   ss
    server: tartar.work
    port:   443
    tls:    true
    udp:    true
    servername: tartar.work
    cipher: aes-256-gcm
    password: "MkH64uEDLNKy2PKz"
    plugin: v2ray-plugin
    plugin-opts:
      mode: websocket # no QUIC now
      tls: true # wss
      # skip-cert-verify: true
      host: tartar.work
      path: "/v2ray"
      # mux: true
      # headers:
      #   custom: value

# vmess
#  # cipher support auto/aes-128-gcm/chacha20-poly1305/none
#  - name: "vmess"
#    type: vmess
#    server: server
#    port: 443
#    uuid: uuid
#    alterId: 32
#    cipher: auto
#    # udp: true
#    # tls: true
#    # skip-cert-verify: true
#    # servername: example.com # priority over wss host
#    # network: ws
#    # ws-opts:
#    #   path: /path
#    #   headers:
#    #     Host: v2ray.com
#    #   max-early-data: 2048
#    #   early-data-header-name: Sec-WebSocket-Protocol

#  - name: "vmess-h2"
#    type: vmess
#    server: server
#    port: 443
#    uuid: uuid
#    alterId: 32
#    cipher: auto
#    network: h2
#    tls: true
#    h2-opts:
#      host:
#        - http.example.com
#        - http-alt.example.com
#      path: /
  
#  - name: "vmess-http"
#    type: vmess
#    server: server
#    port: 443
#    uuid: uuid
#    alterId: 32
#    cipher: auto
#    # udp: true
#    # network: http
#    # http-opts:
#    #   # method: "GET"
#    #   # path:
#    #   #   - '/'
#    #   #   - '/video'
#    #   # headers:
#    #   #   Connection:
#    #   #     - keep-alive

#  - name: vmess-grpc
#    server: server
#    port: 443
#    type: vmess
#    uuid: uuid
#    alterId: 32
#    cipher: auto
#    network: grpc
#    tls: true
#    servername: example.com
#    # skip-cert-verify: true
#    grpc-opts:
#      grpc-service-name: "example"

# socks5
  - name: "socks-tr"
    type: socks5
    server: 88.151.11.4
    port: 57261
    username: 5cbWGF9g
    password: db82Kfwb
    #tls: true
    # skip-cert-verify: true
    udp: true

#  # http
#  - name: "http"
#    type: http
#    server: server
#    port: 443
#    # username: username
#    # password: password
#    # tls: true # https
#    # skip-cert-verify: true
#    # sni: custom.com

#  # Snell
#  # Beware that there's currently no UDP support yet
#  - name: "snell"
#    type: snell
#    server: server
#    port: 44046
#    psk: yourpsk
#    # version: 2
#    # obfs-opts:
#      # mode: http # or tls
#      # host: bing.com

#  # Trojan
#  - name: "trojan"
#    type: trojan
#    server: server
#    port: 443
#    password: yourpsk
#    # udp: true
#    # sni: example.com # aka server name
#    # alpn:
#    #   - h2
#    #   - http/1.1
#    # skip-cert-verify: true

#  - name: trojan-grpc
#    server: server
#    port: 443
#    type: trojan
#    password: "example"
#    network: grpc
#    sni: example.com
#    # skip-cert-verify: true
#    udp: true
#    grpc-opts:
#      grpc-service-name: "example"

#  - name: trojan-ws
#    server: server
#    port: 443
#    type: trojan
#    password: "example"
#    network: ws
#    sni: example.com
#    # skip-cert-verify: true
#    udp: true
#    # ws-opts:
#      # path: /path
#      # headers:
#      #   Host: example.com

#  # ShadowsocksR
#  # The supported ciphers (encryption methods): all stream ciphers in ss
#  # The supported obfses:
#  #   plain http_simple http_post
#  #   random_head tls1.2_ticket_auth tls1.2_ticket_fastauth
#  # The supported supported protocols:
#  #   origin auth_sha1_v4 auth_aes128_md5
#  #   auth_aes128_sha1 auth_chain_a auth_chain_b  
#  - name: "ssr"
#    type: ssr
#    server: server
#    port: 443
#    cipher: chacha20-ietf
#    password: "password"
#    obfs: tls1.2_ticket_auth
#    protocol: auth_sha1_v4
#    # obfs-param: domain.tld
#    # protocol-param: "#"
#    # udp: true


# load-balance: The request of the same eTLD+1 will be dial to the same proxy.
#  - name: "load-balance"
#    type: load-balance
#    proxies:
#      - ss1
#      - ss2
#      - vmess1
#    url: 'http://www.gstatic.com/generate_204'
#    interval: 300
#    # strategy: consistent-hashing # or round-robin

#  # select is used for selecting proxy or proxy group
#  # you can use RESTful API to switch proxy is recommended for use in GUI.
#  - name: Proxy
#    type: select
#    # disable-udp: true
#    proxies:
#      - ss1
#      - ss2
#      - vmess1
#      - auto
 
#  # direct to another infacename or fwmark, also supported on proxy
#  - name: en1
#    type: select
#    interface-name: en1
#    routing-mark: 6667
#    proxies:
#      - DIRECT


# Enable the TPROXY listener
#tproxy-port: 9898
#
#iptables:
#  enable: true # default is false
#  inbound-interface: eth0 # detect the inbound interface, default is 'lo'
