geodata-mode: true
geox-url:
  geoip: "https://xn--r09h.st/mihomo/geoip.dat"
  geosite: "https://xn--r09h.st/mihomo/geosite.dat"
  mmdb: "https://xn--r09h.st/mihomo/country.mmdb"
geo-auto-update: true
geo-update-interval: 24

mixed-port: 7890
allow-lan: true
mode: rule
log-level: info

proxies:
  - name: shadowsocks-out
    type: ss
    server: 95.216.26.180        # The public IP of the server you set up in step 1
    port: 20001
    cipher: 2022-blake3-aes-256-gcm
    password:                   # Enter Password 
    udp: true

proxy-groups:
  - name: PROXY
    type: select
    proxies:
      - shadowsocks-out

rules:
  # LAN always direct
  - IP-CIDR,127.0.0.0/8,DIRECT,no-resolve
  - IP-CIDR,192.168.0.0/16,DIRECT,no-resolve
  - IP-CIDR,10.0.0.0/8,DIRECT,no-resolve
  - IP-CIDR,172.16.0.0/12,DIRECT,no-resolve

  # Known-blocked or foreign domains → proxy
  - GEOSITE,gfw,PROXY
  - GEOSITE,geolocation-!cn,PROXY

  # Chinese sites and IPs → direct (faster, avoids geoblocks)
  - GEOSITE,cn,DIRECT
  - GEOIP,CN,DIRECT

  # Fallback for unknowns — your choice
  - MATCH,PROXY

tun:
  enable: true
  stack: system          # or 'gvisor' — system is faster on Linux
  dns-hijack:
    - any:53
  auto-route: true       # adds routes so all traffic goes through TUN
  auto-redirect: true    # handles edge cases for LAN traffic
  auto-detect-interface: true
  # Optional: exclude your LAN so SSH-to-local-boxes still works directly
  # inet4-route-exclude-address:
  #   - 192.168.0.0/16
  #   - 10.0.0.0/8

# Make sure DNS is configured, otherwise nothing resolves
dns:
  enable: true
  listen: 127.0.0.1:53
  enhanced-mode: fake-ip
  fake-ip-range: 198.18.0.1/16
  fake-ip-filter:
    - '*.lan'
    - '*.local'
    - localhost.ptlogin2.qq.com
  nameserver:
    - 1.1.1.1
    - 8.8.8.8
  fallback:
    - tls://1.1.1.1:853
    - tls://8.8.8.8:853

