# ===== 基本设置 =====
mixed-port: 7890
allow-lan: true
mode: rule
log-level: info
ipv6: false

# ===== TUN：接管全局 + 劫持 DNS =====
tun:
  enable: true
  stack: system
  dns-hijack:
    - any:53
    - tcp://any:53
  auto-route: true
  auto-redirect: true
  auto-detect-interface: true

# ===== DNS：全用国内，并按规则走代理 =====
dns:
  enable: true
  listen: 0.0.0.0:7874
  ipv6: false
  enhanced-mode: fake-ip
  fake-ip-range: 198.18.0.1/16
  nameserver:
    - 223.5.5.5
    - 119.29.29.29
  proxy-server-nameserver:
    - 223.5.5.5
  respect-rules: true
  use-system-hosts: false

# ===== 回国节点（示例 hysteria2，按你实际改） =====
proxies:
  - name: CN-hysteria2-1
    type: hysteria2
    server: 23.27.240.217
    port: 60007
    password: LER1SPLqYBFp3UUv7JQBe+6b
    sni: bing.com
    skip-cert-verify: true
    up: 5 Mbps
    down: 5 Mbps
    alpn:
    - h3
  - name: CN-ss-2
    type: ss
    server: 23.94.98.196
    port: 1445
    cipher: chacha20-ietf-poly1305
    password: QwjJSc3QqDiNZV17K2MqFQ==
    udp: true
    udp-over-tcp: true
    udp-over-tcp-version: 2
    ip-version: ipv4

proxy-groups:
  - name: 国内
    type: select
    proxies:
      - CN-hysteria2-1
      - CN-ss-2

# ===== 路由：内网直连，其余全部走回国 =====
rules:
  - GEOIP,lan,DIRECT,no-resolve
  - MATCH,国内