# 代理 Clash 配置（Mihomo 内核通用，v8：黑名单模式，2026-11-07） # v8 改动：改成黑名单模式——只代理 GFW/已知被墙与限区服务，其他默认直连； # FINAL 由走代理改成 DIRECT；补 iFAST/Wise/银行直连、AI、流媒体； # GFW 双来源：内置 GEOSITE,gfw（v2ray geosite）+ ACL4SSR ProxyGFWlist（gfwlist 官方表）。 # 晚高峰三个节点在“节点选择”里切换对比，哪个快用哪个。 # 适用：苹果端 ClashMi、Windows 端 Clash Verge、安卓端 Clash Meta # 注意：新增的规则订阅地址导入后要在客户端里确认能下载成功，下载失败先用回简化前的那份 port: 7890 socks-port: 7891 allow-lan: true mode: rule log-level: info ipv6: false external-controller: 127.0.0.1:9090 dns: enable: true ipv6: false enhanced-mode: fake-ip fake-ip-range: 198.18.0.1/16 fake-ip-filter: - "*.lan" - "*.local" - "*.home.arpa" - "captive.apple.com" - "+.msftconnecttest.com" - "+.msftncsi.com" use-hosts: true default-nameserver: - 223.5.5.5 - 119.29.29.29 proxy-server-nameserver: - https://dns.alidns.com/dns-query - https://doh.pub/dns-query nameserver: - 223.5.5.5 - 119.29.29.29 nameserver-policy: "geosite:cn": - https://223.5.5.5/dns-query - https://dns.alidns.com/dns-query "geosite:gfw": - https://dns.cloudflare.com/dns-query fallback: - https://cloudflare-dns.com/dns-query - https://dns.alidns.com/dns-query - https://doh.pub/dns-query fallback-filter: geoip: true geoip-code: CN geosite: - gfw ipcidr: - 240.0.0.0/4 - 0.0.0.0/32 rule-providers: reject-list: type: http behavior: domain format: text url: "https://raw.githubusercontent.com/Loyalsoldier/clash-rules/release/reject.txt" path: ./ruleset/reject-list.txt interval: 86400 banprogramad: type: http behavior: classical url: "https://raw.githubusercontent.com/ACL4SSR/ACL4SSR/master/Clash/BanProgramAD.list" path: ./ruleset/banprogramad.yaml interval: 86400 cn-domain: type: http behavior: domain format: mrs url: "https://raw.githubusercontent.com/MetaCubeX/meta-rules-dat/meta/geo/geosite/cn.mrs" path: ./ruleset/cn-domain.mrs interval: 86400 # GFW 补充（2026-11-07）：ACL4SSR ProxyGFWlist，来源是 gfwlist 官方表 + 常用国外服务和地区后缀， # 和内置 GEOSITE,gfw（v2ray geosite）来源不同，互补覆盖 gfw-acl4ssr: type: http behavior: classical url: "https://raw.githubusercontent.com/ACL4SSR/ACL4SSR/master/Clash/ProxyGFWlist.list" path: ./ruleset/gfw-acl4ssr.yaml interval: 86400 # 流媒体规则集（2026-11-07）：blackmatrix7 按服务维护，含各家 CDN/边缘域名 netflix: type: http behavior: classical url: "https://raw.githubusercontent.com/blackmatrix7/ios_rule_script/master/rule/Shadowrocket/Netflix/Netflix.list" path: ./ruleset/netflix.yaml interval: 86400 disney: type: http behavior: classical url: "https://raw.githubusercontent.com/blackmatrix7/ios_rule_script/master/rule/Shadowrocket/Disney/Disney.list" path: ./ruleset/disney.yaml interval: 86400 hbo: type: http behavior: classical url: "https://raw.githubusercontent.com/blackmatrix7/ios_rule_script/master/rule/Shadowrocket/HBO/HBO.list" path: ./ruleset/hbo.yaml interval: 86400 spotify: type: http behavior: classical url: "https://raw.githubusercontent.com/blackmatrix7/ios_rule_script/master/rule/Shadowrocket/Spotify/Spotify.list" path: ./ruleset/spotify.yaml interval: 86400 proxies: - name: "VLESS" type: vless server: 161.153.23.27 port: 443 uuid: c4670bab-11e4-49c0-89ac-3422731c2b0f network: tcp tls: true udp: true flow: xtls-rprx-vision servername: www.microsoft.com client-fingerprint: chrome reality-opts: public-key: fkzKLCfFGRhlBcv8fU-Z0dvYM_nn49v9Ed2It8fmhHk short-id: b5205ad6 support-x25519mlkem768: true - name: "Hysteria2" type: hysteria2 server: 161.153.23.27 port: 443 ports: "20000-50000" hop-interval: 30 password: 4a6c14846c21c8e9033b5eec sni: www.microsoft.com skip-cert-verify: true up: "30 Mbps" down: "150 Mbps" - name: "TUIC" type: tuic server: 161.153.23.27 port: 8443 uuid: 83c1bbdd-8c85-4784-80de-0f840a0bbf84 password: 254da8c8989bb7df68758b59 alpn: [h3] sni: www.microsoft.com skip-cert-verify: true congestion-controller: bbr udp-relay-mode: native - name: "VLESS-IPv6" type: vless server: "2603:c020:27:5200:0:4556:5c98:beae" port: 443 uuid: c4670bab-11e4-49c0-89ac-3422731c2b0f network: tcp tls: true udp: true flow: xtls-rprx-vision servername: www.microsoft.com client-fingerprint: chrome reality-opts: public-key: fkzKLCfFGRhlBcv8fU-Z0dvYM_nn49v9Ed2It8fmhHk short-id: b5205ad6 support-x25519mlkem768: true - name: "Hysteria2-IPv6" type: hysteria2 server: "2603:c020:27:5200:0:4556:5c98:beae" port: 443 ports: "20000-50000" hop-interval: 30 password: 4a6c14846c21c8e9033b5eec sni: www.microsoft.com skip-cert-verify: true up: "30 Mbps" down: "150 Mbps" - name: "TUIC-IPv6" type: tuic server: "2603:c020:27:5200:0:4556:5c98:beae" port: 8443 uuid: 83c1bbdd-8c85-4784-80de-0f840a0bbf84 password: 254da8c8989bb7df68758b59 alpn: [h3] sni: www.microsoft.com skip-cert-verify: true congestion-controller: bbr udp-relay-mode: native proxy-groups: - name: "节点选择" type: select proxies: - "VLESS" - "Hysteria2" - "TUIC" - "VLESS-IPv6" - "Hysteria2-IPv6" - "TUIC-IPv6" - DIRECT rules: # 内网、本地 - IP-CIDR,127.0.0.0/8,DIRECT,no-resolve - IP-CIDR,10.0.0.0/8,DIRECT,no-resolve - IP-CIDR,172.16.0.0/12,DIRECT,no-resolve - IP-CIDR,192.168.0.0/16,DIRECT,no-resolve - IP-CIDR,100.64.0.0/10,DIRECT,no-resolve - IP-CIDR,169.254.0.0/16,DIRECT,no-resolve - IP-CIDR,224.0.0.0/4,DIRECT,no-resolve - GEOSITE,private,DIRECT # 广告拦截 - RULE-SET,reject-list,REJECT - RULE-SET,banprogramad,REJECT - GEOSITE,category-ads-all,REJECT # 直连：境外金融类（2026-11-07 新增）——服务器在新加坡/英国，未被墙，直连比绕美国代理快 - DOMAIN-SUFFIX,ifastgp.com,DIRECT - DOMAIN-SUFFIX,ifastfinancial.com,DIRECT - DOMAIN-SUFFIX,ifastnetwork.com,DIRECT - DOMAIN-SUFFIX,ifastfintech.com,DIRECT - DOMAIN-SUFFIX,ifastcorp.com,DIRECT - DOMAIN-SUFFIX,fundsupermart.com,DIRECT - DOMAIN-SUFFIX,bondsupermart.com,DIRECT - DOMAIN-SUFFIX,ifastgp.com.hk,DIRECT - DOMAIN-SUFFIX,ifastgp.com.sg,DIRECT - DOMAIN-SUFFIX,ifastfinancial.com.hk,DIRECT - DOMAIN-SUFFIX,ifastfinancial.com.sg,DIRECT - DOMAIN-SUFFIX,fundsupermart.com.hk,DIRECT - DOMAIN-SUFFIX,wise.com,DIRECT # 直连：国内银行主域名（2026-11-07 新增）——很多银行主域名是 .com，不在 .cn 直连里 - DOMAIN-SUFFIX,ccb.com,DIRECT - DOMAIN-SUFFIX,abchina.com,DIRECT - DOMAIN-SUFFIX,bankofchina.com,DIRECT - DOMAIN-SUFFIX,cmbchina.com,DIRECT - DOMAIN-SUFFIX,psbc.com,DIRECT - DOMAIN-SUFFIX,bankcomm.com,DIRECT - DOMAIN-SUFFIX,citicbank.com,DIRECT - DOMAIN-SUFFIX,cebbank.com,DIRECT - DOMAIN-SUFFIX,hxbank.com,DIRECT - DOMAIN-SUFFIX,cmbc.com,DIRECT - DOMAIN-SUFFIX,spdb.com,DIRECT - DOMAIN-SUFFIX,pingan.com,DIRECT # AI 服务（2026-11-07 新增）——AI 应用常用域名，写死在配置里，不依赖远程 GFW 表下载 - DOMAIN-SUFFIX,openai.com,节点选择 - DOMAIN-SUFFIX,chatgpt.com,节点选择 - DOMAIN-SUFFIX,oaiusercontent.com,节点选择 - DOMAIN-SUFFIX,oaistatic.com,节点选择 - DOMAIN-SUFFIX,anthropic.com,节点选择 - DOMAIN-SUFFIX,claude.ai,节点选择 - DOMAIN-SUFFIX,gemini.google.com,节点选择 - DOMAIN-SUFFIX,aistudio.google.com,节点选择 - DOMAIN-SUFFIX,generativelanguage.googleapis.com,节点选择 - DOMAIN-SUFFIX,ai.google.dev,节点选择 - DOMAIN-SUFFIX,grok.com,节点选择 - DOMAIN-SUFFIX,x.ai,节点选择 - DOMAIN-SUFFIX,perplexity.ai,节点选择 - DOMAIN-SUFFIX,poe.com,节点选择 - DOMAIN-SUFFIX,mistral.ai,节点选择 - DOMAIN-SUFFIX,meta.ai,节点选择 - DOMAIN-SUFFIX,copilot.microsoft.com,节点选择 # 流媒体（补充，2026-11-07 新增）——服务本身不对中国开放，且主域名不在 GFW 表里 - DOMAIN-SUFFIX,paramountplus.com,节点选择 - DOMAIN-SUFFIX,peacocktv.com,节点选择 - DOMAIN-SUFFIX,tv.apple.com,节点选择 - DOMAIN-SUFFIX,tidal.com,节点选择 # 流媒体规则集（2026-11-07 新增）——blackmatrix7 按服务维护，含各家 CDN/边缘域名 - RULE-SET,netflix,节点选择 - RULE-SET,disney,节点选择 - RULE-SET,hbo,节点选择 - RULE-SET,spotify,节点选择 # 被墙但不在 GFW 表里的域名（2026-11-08 新增）——swipt.io 在国内打不开（疑似被墙），且不在 GFW 表里，写死走代理 - DOMAIN-SUFFIX,swipt.io,节点选择 # Cloady 被墙（2026-11-09 新增）——cloady.com（控制台）与 cloady.io（部署的应用）都在国内打不开，且不在两张 GFW 表里，写死走代理 - DOMAIN-SUFFIX,cloady.com,节点选择 - DOMAIN-SUFFIX,cloady.io,节点选择 # ping0.cc 被墙（2026-11-09 新增）——在国内打不开，且不在两张 GFW 表里，写死走代理 - DOMAIN-SUFFIX,ping0.cc,节点选择 # Cloudflare 仪表盘被墙（2026-11-09 新增）——dash.cloudflare.com 在国内打不开，且不在两张 GFW 表里，写死走代理 - DOMAIN-SUFFIX,dash.cloudflare.com,节点选择 # Cloudflare Workers 订阅被墙（2026-11-09 新增）——*.workers.dev 在国内被 GFW 屏蔽，订阅更新须走代理，否则超时；写死走代理 - DOMAIN-SUFFIX,workers.dev,节点选择 # 需要走代理的（GFW 列表），双来源互补 - GEOSITE,gfw,节点选择 - RULE-SET,gfw-acl4ssr,节点选择 # 国内直连：ChinaMax 规模域名列表 + GEOSITE,cn + .cn 后缀 + 国内 IP - RULE-SET,cn-domain,DIRECT - GEOSITE,cn,DIRECT - DOMAIN-SUFFIX,cn,DIRECT - GEOIP,CN,DIRECT # 兜底：黑名单模式，默认直连；不在上面规则里的都直连 - MATCH,DIRECT