草稿。本文按这次实机跑通的方案整理，但已经做成公版模板：节点地址、密码、API secret、个人域名和固定公网 IP 都已替换为示例值。RouterOS 侧只保留和 FakeIP/TProxy 对接必需的通用规则，不包含私有公网节点信息。
目标
把一台 Linux 机器做成家庭网络旁路透明网关：
- DNS 由 sing-box 接管，国内、Apple/iCloud、自己的 DDNS 域名返回真实 IP 并直连。
- Google、YouTube、GitHub、Telegram、Gemini、OpenRouter、Netflix 等明确代理域名返回 FakeIP；其它未命中的普通 A/AAAA 查询走
remote-dns返回真实 IP，避免把所有域名都强行 FakeIP。 - 客户端访问 FakeIP 后，流量被主路由送到这台 Linux，Linux 上的 nftables TProxy 把流量交给 sing-box。
- sing-box 根据 FakeIP 还原域名，再按域名规则走代理节点。
- 保留缓存，尤其保留
experimental.cache_file.store_fakeip = true，降低 sing-box 重启后客户端缓存旧 FakeIP 导致missing fakeip record的概率。
本文给四套 sing-box 配置：
- 生产双栈版：IPv4 + IPv6，包含当前生产环境里的美服 LoL / Riot real-ip 直连规则。
- 标准双栈版：IPv4 + IPv6，不包含 LoL 直连，适合普通旁路网关。
- 生产 IPv4-only 版：只处理 IPv4，但保留 LoL / Riot 直连规则。
- 标准 IPv4-only 版：只处理 IPv4，适合新机器先快速跑通。
示例参数
按自己的环境替换：
- Linux 网关 IPv4：
10.20.20.12 - Linux 网关 IPv6：
fd88::1212 - 入站网卡：
eth0 - DNS 端口：
53 - TProxy 端口：
9888 - Clash API：
10.20.20.12:9090 - 需要直连的个人 DDNS 后缀：
example-ddns.com - 代理节点只保留两个：
proxy-1-hy2、proxy-2-hy2 - 代理节点服务器、密码、obfs 密码、API secret 都要自行替换。
流量路径
客户端查询 www.google.com
-> DNS 指向 Linux 网关的 sing-box :53
-> sing-box 命中国外域名规则，返回 FakeIP，比如 28.0.0.x
-> 客户端连接 28.0.0.x
-> 主路由把 FakeIP 流量送到 Linux 网关
-> nftables TProxy 标记并转交 :9888
-> sing-box tproxy 入站接住，按 FakeIP 映射还原域名
-> route 规则命中 Proxy / Auto
-> 出站到 Hysteria2 节点国内、Apple/iCloud、自有 DDNS 域名返回真实 IP，route 也走 direct；未命中代理规则的普通域名由 remote-dns 解析真实 IP。
RouterOS 侧对接关系
sing-box 机器只负责 DNS、FakeIP 映射、TProxy 接包和代理出站；RouterOS 只需要把“应该由 sing-box 处理的目标网段”送到这台 Linux 网关，并避免 FastTrack 抢先放行这些连接。
按本文双栈示例，RouterOS 和 sing-box 的关键字段要这样对应：
- sing-box DNS IPv4 监听：
10.20.20.12:53，RouterOS DHCP/DNS 下发也应指向10.20.20.12。 - sing-box DNS IPv6 监听：
[fd88::1212]:53，如果启用 IPv6，RouterOS/客户端也要能访问这个 ULA 地址。 - sing-box FakeIP IPv4 池：
28.0.0.0/8，RouterOS 要把这个网段送入sing-box-v4路由表。 - sing-box FakeIP IPv6 池：
2001:2::/64，RouterOS 要把这个网段送入sing-box-v6路由表。 - sing-box TProxy 端口：
9888，只在 Linux 本机 nftables 内部使用；RouterOS 不需要转发到9888，只负责把目标为 FakeIP 的原始流量路由到 Linux 网关。 - 个人 DDNS 后缀：sing-box DNS 和 route 都应显式
direct，RouterOS 侧不要再把这些真实内网/公网地址强制送进 FakeIP 表。
RouterOS 双栈示例
下面是和本文 sing-box 示例匹配的一组 RouterOS 侧规则。接口名、表名和地址按自己的环境替换；如果你的主路由已经有同名路由表，只保留一份即可。
/routing table add name=sing-box-v4 fib
/routing table add name=sing-box-v6 fib
/ip route add dst-address=0.0.0.0/0 gateway=10.20.20.12 routing-table=sing-box-v4 comment="sing-box FakeIP v4 gateway"
/ipv6 route add dst-address=::/0 gateway=fd88::1212 routing-table=sing-box-v6 comment="sing-box FakeIP v6 gateway"
/routing rule add dst-address=28.0.0.0/8 action=lookup-only-in-table table=sing-box-v4 comment="FakeIP v4 -> sing-box"
/routing rule add dst-address=2001:2::/64 action=lookup-only-in-table table=sing-box-v6 comment="FakeIP v6 -> sing-box"
# 可选但推荐：把常见公共 DNS IP 也送到 sing-box 表，避免客户端绕过本机 DNS 直连公共 DNS 被污染。
/routing rule add dst-address=1.1.1.1/32 action=lookup table=sing-box-v4 comment="Public DNS -> sing-box"
/routing rule add dst-address=1.0.0.1/32 action=lookup table=sing-box-v4 comment="Public DNS -> sing-box"
/routing rule add dst-address=8.8.8.8/32 action=lookup table=sing-box-v4 comment="Public DNS -> sing-box"
/routing rule add dst-address=8.8.4.4/32 action=lookup table=sing-box-v4 comment="Public DNS -> sing-box"
/routing rule add dst-address=9.9.9.9/32 action=lookup table=sing-box-v4 comment="Public DNS -> sing-box"
/routing rule add dst-address=149.112.112.112/32 action=lookup table=sing-box-v4 comment="Public DNS -> sing-box"
/routing rule add dst-address=208.67.222.222/32 action=lookup table=sing-box-v4 comment="Public DNS -> sing-box"
/routing rule add dst-address=208.67.220.220/32 action=lookup table=sing-box-v4 comment="Public DNS -> sing-box"
/routing rule add dst-address=2001:4860:4860::8888/128 action=lookup table=sing-box-v6 comment="Public DNS -> sing-box"
/routing rule add dst-address=2001:4860:4860::8844/128 action=lookup table=sing-box-v6 comment="Public DNS -> sing-box"
/routing rule add dst-address=2606:4700:4700::1111/128 action=lookup table=sing-box-v6 comment="Public DNS -> sing-box"
/routing rule add dst-address=2606:4700:4700::1001/128 action=lookup table=sing-box-v6 comment="Public DNS -> sing-box"
/routing rule add dst-address=2620:fe::9/128 action=lookup table=sing-box-v6 comment="Public DNS -> sing-box"
/routing rule add dst-address=2620:fe::fe/128 action=lookup table=sing-box-v6 comment="Public DNS -> sing-box"
/routing rule add dst-address=2620:0:ccc::2/128 action=lookup table=sing-box-v6 comment="Public DNS -> sing-box"
/routing rule add dst-address=2620:0:ccd::2/128 action=lookup table=sing-box-v6 comment="Public DNS -> sing-box"
/ip dhcp-server network set [find address=10.20.20.0/24] dns-server=10.20.20.12如果只跑 IPv4-only 版，就不要添加 sing-box-v6、2001:2::/64、fd88::1212 和 IPv6 公共 DNS 相关规则。公共 DNS 规则不是 FakeIP 必需项，但生产环境建议保留：它能把客户端硬编码的 Google/Cloudflare/Quad9/OpenDNS DNS 请求也送入 sing-box 链路，减少本地链路污染或绕过。
FastTrack / 连接跟踪注意点
RouterOS 开了 FastTrack 时，FakeIP 流量可能在进入策略路由前被快速通道处理，导致流量没有送到 Linux 网关。需要在 FastTrack 规则之前排除 sing-box 网关相关连接，或让 FastTrack 只匹配不需要代理的普通连接。
示例写法之一：
/ip firewall filter add chain=forward src-address=10.20.20.12 action=accept place-before=[find action=fasttrack-connection][0] comment="Bypass FastTrack: sing-box out"
/ip firewall filter add chain=forward dst-address=10.20.20.12 action=accept place-before=[find action=fasttrack-connection][0] comment="Bypass FastTrack: sing-box in"更精细的环境也可以只排除 28.0.0.0/8、2001:2::/64 或指定客户端网段，原则是：要进 sing-box 的连接不要被 FastTrack 提前吞掉。
逐项匹配检查
配置完成后，按下面清单核对：
28.0.0.0/8必须和 sing-boxdns.servers.fakeip-dns.inet4_range完全一致。2001:2::/64必须和 sing-boxdns.servers.fakeip-dns.inet6_range完全一致；不用 IPv6 时两边都不要启用。sing-box-v4默认路由网关必须是 Linux 网关 IPv4，例如10.20.20.12。sing-box-v6默认路由网关必须是 Linux 网关 IPv6，例如fd88::1212。- DHCP/DNS 下发的 DNS 服务器必须能到达 sing-box DNS 入站；不要下发已经停用的旧 DNS 节点。
- 公共 DNS IP 的 RouterOS routing rule 和 sing-box route 里的公共 DNS IP 列表保持一致；这样客户端硬编码
8.8.8.8、1.1.1.1、9.9.9.9、OpenDNS 等也会走代理链路。 - 自有 DDNS 域名在 sing-box DNS 里走
local-dns返回真实 IP，在 sing-box route 里走direct；这样内网服务不会被 FakeIP 代理链路绕一圈。 - Linux nftables 的
bypass4/bypass6要包含内网网段和代理节点真实 IP，避免透明代理回环。
RouterOS 侧排障命令
/routing rule print detail
/ip route print detail where routing-table=sing-box-v4
/ipv6 route print detail where routing-table=sing-box-v6
/ip firewall filter print detail where action=fasttrack-connection
/ip dhcp-server network print detail期望结果：访问国外域名时 DNS 返回 28.x 或 2001:2::；客户端连接这些 FakeIP 后，RouterOS 按 routing rule 送到 Linux 网关；Linux 上 journalctl -u sing-box 能看到 tproxy-in 入站。
1. 安装基础组件
Ubuntu/Debian 示例：
apt update
apt install -y curl tar gzip nftables iproute2 ca-certificates systemd-resolved安装 sing-box。版本建议使用较新的 1.13.x 或更新版本。可以按官方脚本安装，也可以手动下载 release：
bash <(curl -fsSL https://sing-box.app/deb-install.sh)确认：
sing-box version2. 准备目录
mkdir -p /etc/sing-box/rules/geosite /etc/sing-box/rules/geoip /etc/sing-box/ui
chmod 700 /etc/sing-box3. 下载规则集
写入 /usr/local/sbin/sing-box-update-rules：
nvim /usr/local/sbin/sing-box-update-rules#!/usr/bin/env bash
set -euo pipefail
mkdir -p /etc/sing-box/rules/geosite /etc/sing-box/rules/geoip
raw_base="https://scg.jgaga.tk/https://raw.githubusercontent.com/MetaCubeX/meta-rules-dat/sing/geo"
cdn_base="https://cdn.jsdelivr.net/gh/MetaCubeX/meta-rules-dat@sing/geo"
fetch_rule() {
local subdir="$1" name="$2" dst="/etc/sing-box/rules/$subdir/$name.srs"
# 宿主机如果把 DNS 指向 sing-box，规则源可能被解析成 FakeIP；优先用 scg 反代，失败再走 CDN。
curl -4 -fL --retry 3 --connect-timeout 10 --max-time 60 "$raw_base/$subdir/$name.srs" -o "$dst" \
|| curl -4 -fL --retry 3 --connect-timeout 10 --max-time 60 "$cdn_base/$subdir/$name.srs" -o "$dst"
}
for name in speedtest telegram geolocation-!cn cn icloud@cn apple@cn geolocation-cn
do
fetch_rule geosite "$name"
done
for name in cn telegram
do
fetch_rule geoip "$name"
done授权并执行：
chmod +x /usr/local/sbin/sing-box-update-rules
/usr/local/sbin/sing-box-update-rules这段只下载后文配置真实引用的规则集，规则源使用 MetaCubeX，不再依赖 SagerNet。speedtest 默认作为直连规则保留，避免测速流量占满代理节点；Telegram 同时保留 geosite 和 geoip，避免客户端直连官方 IP 段时只靠域名规则不够稳。如果新机器当前还不能访问 GitHub，可先在其它机器下载这些 .srs 后复制到同样路径。本文配置使用的是本地 rule-set，不依赖 sing-box 启动时在线下载。
4. 四套 /etc/sing-box/config.json
这篇文章保留四套完整配置，按需求选一套写入 /etc/sing-box/config.json 即可。两套双栈配置来自当前生产机上的实际文件，两套 IPv4-only 配置是在对应双栈配置上删掉 IPv6 相关项后整理出来的。
| 配置 | IPv4 | IPv6 | LoL / Riot 美服直连 | 适用场景 |
|---|---|---|---|---|
| 生产双栈 | 是 | 是 | 是 | 当前生产网关同款，需要保留游戏直连 |
| 标准双栈 | 是 | 是 | 否 | 普通家庭/旁路网关，IPv6 也交给 sing-box |
| 生产 IPv4-only | 是 | 否 | 是 | 只跑 IPv4，但保留 LoL / Riot 直连 |
| 标准 IPv4-only | 是 | 否 | 否 | 新机器最稳的最小配置 |
写入前统一替换这些占位符：
<SING_BOX_LAN_IP>：sing-box 网关的 LAN IPv4，例如10.20.20.12。<SING_BOX_LAN_IPV6>：sing-box 网关的 LAN IPv6；只跑 IPv4 时不用。<LAN_PUBLIC_IPV6_PREFIX>：你的公网 IPv6 前缀；只跑 IPv4 时不用。<DIRECT_DOMAIN>：你自己的 DDNS / 回家域名后缀，没有就删除对应 DNS 和 route 规则。<SERVER_IP_1>、<SERVER_IP_2>、<SERVER_IP_3>：代理节点真实 IP，必须在 route 里direct，避免代理节点连接自己又被透明代理套进去。<HY2_DOMAIN>：Hysteria2 节点域名。<HY2_PASSWORD_*>、<HY2_OBFS_PASSWORD_*>：Hysteria2 密码和 obfs 密码。<CLASH_API_SECRET>：Clash API 密钥，建议用长随机字符串。
修改配置：
nvim /etc/sing-box/config.json双栈和 IPv4-only 的其它同步修改点：
- 选双栈配置时，RouterOS 需要同时有 IPv4 和 IPv6 到 sing-box 的 routing rule，TProxy 脚本也要保留
ip -6 rule、ip -6 route、bypass6和 IPv6 forwarding。 - 选 IPv4-only 配置时，RouterOS 不要添加
sing-box-v6路由表和 IPv6 routing rule；TProxy 脚本使用第 8 节 IPv4-only 版本。 - 只要启用 Clash API 的
external_controller，9090不需要在 nft 里按端口全局绕过；管理访问目标是内网地址，会被私网目的地址 bypass 覆盖。 - 不要把
tcp dport 22 return当成通用规则，否则 GitHub SSH 会绕过 sing-box 直接出公网；LAN 内 SSH 目标已经被私网目的地址 bypass 覆盖。 - DNS 端口
53必须 return，因为 DNS 由 sing-box 本机接收和分流；NTP123不建议全局 return，时间同步问题优先用第 10 节的 timesyncd 配置解决。
4.1 生产双栈配置：含美服 LoL / Riot real-ip 直连
适合直接还原当前生产网关思路。国外常规流量走代理，Riot / LoL 美服相关域名走真实 DNS 和 direct，避免游戏登录、延迟或反作弊链路被 FakeIP 代理干扰。
{
"log": {
"level": "warn",
"timestamp": true
},
"dns": {
"cache_capacity": 20480,
"final": "remote-dns",
"strategy": "prefer_ipv4",
"servers": [
{
"tag": "remote-dns",
"type": "https",
"server": "1.1.1.1",
"server_port": 443,
"path": "/dns-query",
"tls": {
"server_name": "cloudflare-dns.com"
},
"detour": "Proxy"
},
{
"tag": "local-dns",
"type": "udp",
"server": "223.5.5.5",
"server_port": 53
},
{
"tag": "fakeip-dns",
"type": "fakeip",
"inet4_range": "28.0.0.0/8",
"inet6_range": "2001:2::/64"
}
],
"rules": [
{
"domain_suffix": [
"<DIRECT_DOMAIN>"
],
"action": "route",
"server": "local-dns",
"rewrite_ttl": 60
},
{
"inbound": [
"dns-in",
"dns-in-v6"
],
"domain_suffix": [
"<DIRECT_DOMAIN>"
],
"action": "route",
"server": "local-dns",
"rewrite_ttl": 60
},
{
"domain_suffix": [
"apple.com",
"icloud.com",
"mzstatic.com",
"cdn-apple.com",
"apple-dns.net",
"aaplimg.com",
"apple-cloudkit.com"
],
"action": "route",
"server": "local-dns",
"rewrite_ttl": 60
},
{
"domain_suffix": [
"riotgames.com",
"riotcdn.net",
"leagueoflegends.com",
"lolesports.com",
"pvp.net",
"lolstatic.com",
"lolstatic-a.akamaihd.net",
"rgpub.io",
"riotcdn.cn"
],
"action": "route",
"server": "remote-dns",
"rewrite_ttl": 60
},
{
"inbound": [
"dns-in",
"dns-in-v6"
],
"rule_set": [
"geosite-cn",
"geosite-geolocation-cn",
"geosite-icloud@cn",
"geosite-apple@cn"
],
"action": "route",
"server": "local-dns",
"rewrite_ttl": 60
},
{
"inbound": [
"dns-in",
"dns-in-v6"
],
"rule_set": [
"geosite-ai",
"geosite-youtube",
"geosite-google",
"geosite-telegram",
"geosite-github",
"geosite-cloudflare",
"geosite-netflix",
"geosite-facebook",
"geosite-instagram",
"geosite-tiktok",
"geosite-speedtest",
"geosite-jetbrains",
"geosite-spotify",
"geosite-disney",
"geosite-hbo",
"geosite-amazon",
"geosite-adobe",
"geosite-steam",
"geosite-category-pt@!cn",
"geosite-category-cryptocurrency",
"geosite-geolocation-!cn"
],
"action": "route",
"server": "fakeip-dns",
"rewrite_ttl": 60,
"query_type": [
"A",
"AAAA"
]
},
{
"inbound": [
"dns-in",
"dns-in-v6"
],
"query_type": [
"A",
"AAAA"
],
"action": "route",
"server": "remote-dns",
"rewrite_ttl": 60
},
{
"rule_set": [
"geosite-cn",
"geosite-geolocation-cn",
"geosite-icloud@cn",
"geosite-apple@cn"
],
"action": "route",
"server": "local-dns",
"rewrite_ttl": 60
},
{
"rule_set": [
"geosite-ai",
"geosite-youtube",
"geosite-google",
"geosite-telegram",
"geosite-github",
"geosite-cloudflare",
"geosite-netflix",
"geosite-facebook",
"geosite-instagram",
"geosite-tiktok",
"geosite-speedtest",
"geosite-jetbrains",
"geosite-spotify",
"geosite-disney",
"geosite-hbo",
"geosite-amazon",
"geosite-adobe",
"geosite-steam",
"geosite-category-pt@!cn",
"geosite-category-cryptocurrency",
"geosite-geolocation-!cn"
],
"action": "route",
"server": "remote-dns",
"rewrite_ttl": 60
}
],
"disable_cache": false,
"disable_expire": false
},
"inbounds": [
{
"type": "tproxy",
"tag": "tproxy-in",
"listen": "::",
"listen_port": 9888
},
{
"type": "direct",
"tag": "dns-in",
"listen": "<SING_BOX_LAN_IP>",
"listen_port": 53,
"override_address": "8.8.8.8",
"override_port": 53
},
{
"type": "direct",
"tag": "dns-in-v6",
"listen": "<SING_BOX_LAN_IPV6>",
"listen_port": 53,
"override_address": "8.8.8.8",
"override_port": 53
}
],
"outbounds": [
{
"type": "selector",
"tag": "Proxy",
"outbounds": [
"Auto",
"US-146-hy2",
"US-209-hy2",
"US-146-vless",
"US-232-hy2"
],
"default": "Auto",
"interrupt_exist_connections": true
},
{
"type": "urltest",
"tag": "Auto",
"outbounds": [
"US-146-hy2",
"US-209-hy2",
"US-146-vless",
"US-232-hy2"
],
"url": "https://www.gstatic.com/generate_204",
"interval": "2m",
"tolerance": 50
},
{
"type": "vless",
"tag": "US-146-vless",
"server": "<SERVER_IP_1>",
"server_port": 443,
"uuid": "<UUID_REDACTED>",
"flow": "",
"packet_encoding": "xudp",
"tcp_fast_open": true,
"tls": {
"enabled": true,
"server_name": "mirrors.kernel.org",
"utls": {
"enabled": true,
"fingerprint": "chrome"
},
"reality": {
"enabled": true,
"public_key": "<PUBLIC_KEY_REDACTED>",
"short_id": "<SHORT_ID_REDACTED>"
}
},
"multiplex": {
"enabled": true,
"protocol": "h2mux",
"padding": false,
"brutal": {
"enabled": true,
"up_mbps": 45,
"down_mbps": 300
}
}
},
{
"type": "hysteria2",
"tag": "US-232-hy2",
"server": "<SERVER_IP_2>",
"server_port": 443,
"up_mbps": 30,
"down_mbps": 220,
"password": "<PASSWORD_REDACTED>",
"tls": {
"enabled": true,
"server_name": "www.cloudflarestatus.com",
"insecure": true
},
"obfs": {
"type": "salamander",
"password": "<PASSWORD_REDACTED>"
}
},
{
"type": "hysteria2",
"tag": "US-146-hy2",
"server": "<SERVER_IP_1>",
"server_port": 443,
"password": "<PASSWORD_REDACTED>",
"up_mbps": 60,
"down_mbps": 360,
"tls": {
"enabled": true,
"server_name": "mirrors.kernel.org",
"insecure": true,
"alpn": [
"h3"
]
}
},
{
"type": "hysteria2",
"tag": "US-209-hy2",
"server": "<HY2_DOMAIN>",
"server_port": 443,
"up_mbps": 60,
"down_mbps": 360,
"password": "<PASSWORD_REDACTED>",
"obfs": {
"type": "salamander",
"password": "<PASSWORD_REDACTED>"
},
"tls": {
"enabled": true,
"server_name": "<HY2_DOMAIN>",
"insecure": true
}
},
{
"type": "direct",
"tag": "direct"
},
{
"type": "block",
"tag": "block"
}
],
"route": {
"auto_detect_interface": true,
"final": "Proxy",
"rules": [
{
"inbound": [
"dns-in",
"dns-in-v6"
],
"action": "hijack-dns"
},
{
"inbound": "tproxy-in",
"action": "sniff",
"sniffer": [
"tls",
"http"
],
"timeout": "300ms"
},
{
"domain_suffix": [
"<DIRECT_DOMAIN>"
],
"outbound": "direct"
},
{
"domain": [
"<HY2_DOMAIN>"
],
"outbound": "direct"
},
{
"domain_suffix": [
"riotgames.com",
"riotcdn.net",
"leagueoflegends.com",
"lolesports.com",
"pvp.net",
"lolstatic.com",
"lolstatic-a.akamaihd.net",
"rgpub.io",
"riotcdn.cn"
],
"outbound": "direct"
},
{
"ip_cidr": [
"<SERVER_IP_2>/32",
"<SERVER_IP_1>/32",
"<SERVER_IP_3>/32"
],
"outbound": "direct"
},
{
"type": "logical",
"mode": "or",
"rules": [
{
"port": 853
},
{
"network": "udp",
"port": 443
},
{
"protocol": "stun"
}
],
"action": "reject",
"method": "drop"
},
{
"ip_is_private": true,
"outbound": "direct"
},
{
"ip_cidr": [
"1.1.1.1/32",
"1.0.0.1/32",
"8.8.8.8/32",
"8.8.4.4/32",
"9.9.9.9/32",
"149.112.112.112/32",
"208.67.222.222/32",
"208.67.220.220/32",
"2001:4860:4860::8888/128",
"2001:4860:4860::8844/128",
"2606:4700:4700::1111/128",
"2606:4700:4700::1001/128",
"2620:fe::9/128",
"2620:fe::fe/128",
"2620:0:ccc::2/128",
"2620:0:ccd::2/128"
],
"outbound": "Proxy"
},
{
"rule_set": [
"geosite-ai"
],
"outbound": "Proxy"
},
{
"domain_suffix": [
"apple.com",
"icloud.com",
"mzstatic.com",
"cdn-apple.com",
"apple-dns.net",
"aaplimg.com",
"apple-cloudkit.com"
],
"outbound": "direct"
},
{
"rule_set": [
"geosite-youtube",
"geosite-google",
"geosite-telegram",
"geoip-telegram",
"geosite-github",
"geosite-cloudflare",
"geosite-netflix",
"geoip-netflix",
"geosite-facebook",
"geoip-facebook",
"geosite-instagram",
"geosite-tiktok",
"geosite-speedtest",
"geosite-jetbrains",
"geosite-spotify",
"geosite-disney",
"geosite-hbo",
"geosite-amazon",
"geosite-adobe",
"geosite-steam",
"geosite-category-pt@!cn",
"geosite-category-cryptocurrency",
"geosite-geolocation-!cn"
],
"outbound": "Proxy"
},
{
"rule_set": [
"geosite-cn",
"geosite-geolocation-cn",
"geosite-icloud@cn",
"geosite-apple@cn",
"geoip-cn"
],
"outbound": "direct"
}
],
"rule_set": [
{
"type": "local",
"tag": "geosite-ai",
"format": "binary",
"path": "/etc/sing-box/rules/geosite/category-ai-chat-!cn.srs"
},
{
"type": "local",
"tag": "geosite-youtube",
"format": "binary",
"path": "/etc/sing-box/rules/geosite/youtube.srs"
},
{
"type": "local",
"tag": "geosite-google",
"format": "binary",
"path": "/etc/sing-box/rules/geosite/google.srs"
},
{
"type": "local",
"tag": "geosite-telegram",
"format": "binary",
"path": "/etc/sing-box/rules/geosite/telegram.srs"
},
{
"type": "local",
"tag": "geosite-github",
"format": "binary",
"path": "/etc/sing-box/rules/geosite/github.srs"
},
{
"type": "local",
"tag": "geosite-cloudflare",
"format": "binary",
"path": "/etc/sing-box/rules/geosite/cloudflare.srs"
},
{
"type": "local",
"tag": "geosite-netflix",
"format": "binary",
"path": "/etc/sing-box/rules/geosite/netflix.srs"
},
{
"type": "local",
"tag": "geosite-facebook",
"format": "binary",
"path": "/etc/sing-box/rules/geosite/facebook.srs"
},
{
"type": "local",
"tag": "geosite-instagram",
"format": "binary",
"path": "/etc/sing-box/rules/geosite/instagram.srs"
},
{
"type": "local",
"tag": "geosite-tiktok",
"format": "binary",
"path": "/etc/sing-box/rules/geosite/tiktok.srs"
},
{
"type": "local",
"tag": "geosite-speedtest",
"format": "binary",
"path": "/etc/sing-box/rules/geosite/speedtest.srs"
},
{
"type": "local",
"tag": "geosite-jetbrains",
"format": "binary",
"path": "/etc/sing-box/rules/geosite/jetbrains.srs"
},
{
"type": "local",
"tag": "geosite-spotify",
"format": "binary",
"path": "/etc/sing-box/rules/geosite/spotify.srs"
},
{
"type": "local",
"tag": "geosite-disney",
"format": "binary",
"path": "/etc/sing-box/rules/geosite/disney.srs"
},
{
"type": "local",
"tag": "geosite-hbo",
"format": "binary",
"path": "/etc/sing-box/rules/geosite/hbo.srs"
},
{
"type": "local",
"tag": "geosite-amazon",
"format": "binary",
"path": "/etc/sing-box/rules/geosite/amazon.srs"
},
{
"type": "local",
"tag": "geosite-adobe",
"format": "binary",
"path": "/etc/sing-box/rules/geosite/adobe.srs"
},
{
"type": "local",
"tag": "geosite-steam",
"format": "binary",
"path": "/etc/sing-box/rules/geosite/steam.srs"
},
{
"type": "local",
"tag": "geosite-category-pt@!cn",
"format": "binary",
"path": "/etc/sing-box/rules/geosite/category-pt@!cn.srs"
},
{
"type": "local",
"tag": "geosite-category-cryptocurrency",
"format": "binary",
"path": "/etc/sing-box/rules/geosite/category-cryptocurrency.srs"
},
{
"type": "local",
"tag": "geosite-geolocation-!cn",
"format": "binary",
"path": "/etc/sing-box/rules/geosite/geolocation-!cn.srs"
},
{
"type": "local",
"tag": "geosite-cn",
"format": "binary",
"path": "/etc/sing-box/rules/geosite/cn.srs"
},
{
"type": "local",
"tag": "geosite-icloud@cn",
"format": "binary",
"path": "/etc/sing-box/rules/geosite/icloud@cn.srs"
},
{
"type": "local",
"tag": "geosite-apple@cn",
"format": "binary",
"path": "/etc/sing-box/rules/geosite/apple@cn.srs"
},
{
"type": "local",
"tag": "geosite-geolocation-cn",
"format": "binary",
"path": "/etc/sing-box/rules/geosite/geolocation-cn.srs"
},
{
"type": "local",
"tag": "geoip-cn",
"format": "binary",
"path": "/etc/sing-box/rules/geoip/cn.srs"
},
{
"type": "local",
"tag": "geoip-telegram",
"format": "binary",
"path": "/etc/sing-box/rules/geoip/telegram.srs"
},
{
"type": "local",
"tag": "geoip-netflix",
"format": "binary",
"path": "/etc/sing-box/rules/geoip/netflix.srs"
},
{
"type": "local",
"tag": "geoip-facebook",
"format": "binary",
"path": "/etc/sing-box/rules/geoip/facebook.srs"
}
],
"default_domain_resolver": "remote-dns"
},
"experimental": {
"clash_api": {
"external_controller": "<SING_BOX_LAN_IP>:9090",
"external_ui": "/etc/sing-box/ui",
"secret": "<SECRET_REDACTED>",
"default_mode": "rule"
},
"cache_file": {
"enabled": true,
"path": "/etc/sing-box/cache.db",
"store_fakeip": true
}
}
}4.2 标准双栈配置：不含 LoL 直连
适合没有游戏直连需求的标准旁路网关。它保留 IPv4 + IPv6、FakeIP、DNS 分流、Hysteria2 出站和 selector，但不包含 Riot / LoL 专用 real-ip 与 direct 规则。
{
"log": {
"level": "warn",
"timestamp": true
},
"dns": {
"cache_capacity": 20480,
"final": "remote-dns",
"strategy": "prefer_ipv4",
"servers": [
{
"tag": "remote-dns",
"type": "https",
"server": "1.1.1.1",
"server_port": 443,
"path": "/dns-query",
"tls": {
"server_name": "cloudflare-dns.com"
},
"detour": "Proxy"
},
{
"tag": "local-dns",
"type": "udp",
"server": "223.5.5.5",
"server_port": 53
},
{
"tag": "fakeip-dns",
"type": "fakeip",
"inet4_range": "28.0.0.0/8",
"inet6_range": "2001:2::/64"
}
],
"rules": [
{
"domain_suffix": [
"<DIRECT_DOMAIN>"
],
"action": "route",
"server": "local-dns",
"rewrite_ttl": 60
},
{
"inbound": [
"dns-in",
"dns-in-v6"
],
"domain_suffix": [
"<DIRECT_DOMAIN>"
],
"action": "route",
"server": "local-dns",
"rewrite_ttl": 60
},
{
"domain_suffix": [
"apple.com",
"icloud.com",
"mzstatic.com",
"cdn-apple.com",
"apple-dns.net",
"aaplimg.com",
"apple-cloudkit.com"
],
"action": "route",
"server": "local-dns",
"rewrite_ttl": 60
},
{
"inbound": [
"dns-in",
"dns-in-v6"
],
"rule_set": [
"geosite-cn",
"geosite-geolocation-cn",
"geosite-icloud@cn",
"geosite-apple@cn"
],
"action": "route",
"server": "local-dns",
"rewrite_ttl": 60
},
{
"inbound": [
"dns-in",
"dns-in-v6"
],
"rule_set": [
"geosite-ai",
"geosite-youtube",
"geosite-google",
"geosite-telegram",
"geosite-github",
"geosite-cloudflare",
"geosite-netflix",
"geosite-facebook",
"geosite-instagram",
"geosite-tiktok",
"geosite-speedtest",
"geosite-jetbrains",
"geosite-spotify",
"geosite-disney",
"geosite-hbo",
"geosite-amazon",
"geosite-adobe",
"geosite-steam",
"geosite-category-pt@!cn",
"geosite-category-cryptocurrency",
"geosite-geolocation-!cn"
],
"action": "route",
"server": "fakeip-dns",
"rewrite_ttl": 60,
"query_type": [
"A",
"AAAA"
]
},
{
"inbound": [
"dns-in",
"dns-in-v6"
],
"query_type": [
"A",
"AAAA"
],
"action": "route",
"server": "remote-dns",
"rewrite_ttl": 60
},
{
"rule_set": [
"geosite-cn",
"geosite-geolocation-cn",
"geosite-icloud@cn",
"geosite-apple@cn"
],
"action": "route",
"server": "local-dns",
"rewrite_ttl": 60
},
{
"rule_set": [
"geosite-ai",
"geosite-youtube",
"geosite-google",
"geosite-telegram",
"geosite-github",
"geosite-cloudflare",
"geosite-netflix",
"geosite-facebook",
"geosite-instagram",
"geosite-tiktok",
"geosite-speedtest",
"geosite-jetbrains",
"geosite-spotify",
"geosite-disney",
"geosite-hbo",
"geosite-amazon",
"geosite-adobe",
"geosite-steam",
"geosite-category-pt@!cn",
"geosite-category-cryptocurrency",
"geosite-geolocation-!cn"
],
"action": "route",
"server": "remote-dns",
"rewrite_ttl": 60
}
],
"disable_cache": false,
"disable_expire": false
},
"inbounds": [
{
"type": "tproxy",
"tag": "tproxy-in",
"listen": "::",
"listen_port": 9888
},
{
"type": "direct",
"tag": "dns-in",
"listen": "<SING_BOX_LAN_IP>",
"listen_port": 53,
"override_address": "8.8.8.8",
"override_port": 53
},
{
"type": "direct",
"tag": "dns-in-v6",
"listen": "<SING_BOX_LAN_IPV6>",
"listen_port": 53,
"override_address": "8.8.8.8",
"override_port": 53
}
],
"outbounds": [
{
"type": "selector",
"tag": "Proxy",
"outbounds": [
"Auto",
"US-146-hy2",
"US-209-hy2",
"US-146-vless",
"US-232-hy2"
],
"default": "Auto",
"interrupt_exist_connections": true
},
{
"type": "urltest",
"tag": "Auto",
"outbounds": [
"US-146-hy2",
"US-209-hy2",
"US-146-vless",
"US-232-hy2"
],
"url": "https://www.gstatic.com/generate_204",
"interval": "2m",
"tolerance": 50
},
{
"type": "vless",
"tag": "US-146-vless",
"server": "<SERVER_IP_1>",
"server_port": 443,
"uuid": "<UUID_REDACTED>",
"flow": "",
"packet_encoding": "xudp",
"tcp_fast_open": true,
"tls": {
"enabled": true,
"server_name": "mirrors.kernel.org",
"utls": {
"enabled": true,
"fingerprint": "chrome"
},
"reality": {
"enabled": true,
"public_key": "<PUBLIC_KEY_REDACTED>",
"short_id": "<SHORT_ID_REDACTED>"
}
},
"multiplex": {
"enabled": true,
"protocol": "h2mux",
"padding": false,
"brutal": {
"enabled": true,
"up_mbps": 45,
"down_mbps": 300
}
}
},
{
"type": "hysteria2",
"tag": "US-232-hy2",
"server": "<SERVER_IP_2>",
"server_port": 443,
"up_mbps": 30,
"down_mbps": 220,
"password": "<PASSWORD_REDACTED>",
"tls": {
"enabled": true,
"server_name": "www.cloudflarestatus.com",
"insecure": true
},
"obfs": {
"type": "salamander",
"password": "<PASSWORD_REDACTED>"
}
},
{
"type": "hysteria2",
"tag": "US-146-hy2",
"server": "<SERVER_IP_1>",
"server_port": 443,
"password": "<PASSWORD_REDACTED>",
"up_mbps": 60,
"down_mbps": 360,
"tls": {
"enabled": true,
"server_name": "mirrors.kernel.org",
"insecure": true,
"alpn": [
"h3"
]
}
},
{
"type": "hysteria2",
"tag": "US-209-hy2",
"server": "<HY2_DOMAIN>",
"server_port": 443,
"up_mbps": 60,
"down_mbps": 360,
"password": "<PASSWORD_REDACTED>",
"obfs": {
"type": "salamander",
"password": "<PASSWORD_REDACTED>"
},
"tls": {
"enabled": true,
"server_name": "<HY2_DOMAIN>",
"insecure": true
}
},
{
"type": "direct",
"tag": "direct"
},
{
"type": "block",
"tag": "block"
}
],
"route": {
"auto_detect_interface": true,
"final": "Proxy",
"rules": [
{
"inbound": [
"dns-in",
"dns-in-v6"
],
"action": "hijack-dns"
},
{
"inbound": "tproxy-in",
"action": "sniff",
"sniffer": [
"tls",
"http"
],
"timeout": "300ms"
},
{
"domain_suffix": [
"<DIRECT_DOMAIN>"
],
"outbound": "direct"
},
{
"domain": [
"<HY2_DOMAIN>"
],
"outbound": "direct"
},
{
"ip_cidr": [
"<SERVER_IP_2>/32",
"<SERVER_IP_1>/32",
"<SERVER_IP_3>/32"
],
"outbound": "direct"
},
{
"type": "logical",
"mode": "or",
"rules": [
{
"port": 853
},
{
"network": "udp",
"port": 443
},
{
"protocol": "stun"
}
],
"action": "reject",
"method": "drop"
},
{
"ip_is_private": true,
"outbound": "direct"
},
{
"ip_cidr": [
"1.1.1.1/32",
"1.0.0.1/32",
"8.8.8.8/32",
"8.8.4.4/32",
"9.9.9.9/32",
"149.112.112.112/32",
"208.67.222.222/32",
"208.67.220.220/32",
"2001:4860:4860::8888/128",
"2001:4860:4860::8844/128",
"2606:4700:4700::1111/128",
"2606:4700:4700::1001/128",
"2620:fe::9/128",
"2620:fe::fe/128",
"2620:0:ccc::2/128",
"2620:0:ccd::2/128"
],
"outbound": "Proxy"
},
{
"rule_set": [
"geosite-ai"
],
"outbound": "Proxy"
},
{
"domain_suffix": [
"apple.com",
"icloud.com",
"mzstatic.com",
"cdn-apple.com",
"apple-dns.net",
"aaplimg.com",
"apple-cloudkit.com"
],
"outbound": "direct"
},
{
"rule_set": [
"geosite-youtube",
"geosite-google",
"geosite-telegram",
"geoip-telegram",
"geosite-github",
"geosite-cloudflare",
"geosite-netflix",
"geoip-netflix",
"geosite-facebook",
"geoip-facebook",
"geosite-instagram",
"geosite-tiktok",
"geosite-speedtest",
"geosite-jetbrains",
"geosite-spotify",
"geosite-disney",
"geosite-hbo",
"geosite-amazon",
"geosite-adobe",
"geosite-steam",
"geosite-category-pt@!cn",
"geosite-category-cryptocurrency",
"geosite-geolocation-!cn"
],
"outbound": "Proxy"
},
{
"rule_set": [
"geosite-cn",
"geosite-geolocation-cn",
"geosite-icloud@cn",
"geosite-apple@cn",
"geoip-cn"
],
"outbound": "direct"
}
],
"rule_set": [
{
"type": "local",
"tag": "geosite-ai",
"format": "binary",
"path": "/etc/sing-box/rules/geosite/category-ai-chat-!cn.srs"
},
{
"type": "local",
"tag": "geosite-youtube",
"format": "binary",
"path": "/etc/sing-box/rules/geosite/youtube.srs"
},
{
"type": "local",
"tag": "geosite-google",
"format": "binary",
"path": "/etc/sing-box/rules/geosite/google.srs"
},
{
"type": "local",
"tag": "geosite-telegram",
"format": "binary",
"path": "/etc/sing-box/rules/geosite/telegram.srs"
},
{
"type": "local",
"tag": "geosite-github",
"format": "binary",
"path": "/etc/sing-box/rules/geosite/github.srs"
},
{
"type": "local",
"tag": "geosite-cloudflare",
"format": "binary",
"path": "/etc/sing-box/rules/geosite/cloudflare.srs"
},
{
"type": "local",
"tag": "geosite-netflix",
"format": "binary",
"path": "/etc/sing-box/rules/geosite/netflix.srs"
},
{
"type": "local",
"tag": "geosite-facebook",
"format": "binary",
"path": "/etc/sing-box/rules/geosite/facebook.srs"
},
{
"type": "local",
"tag": "geosite-instagram",
"format": "binary",
"path": "/etc/sing-box/rules/geosite/instagram.srs"
},
{
"type": "local",
"tag": "geosite-tiktok",
"format": "binary",
"path": "/etc/sing-box/rules/geosite/tiktok.srs"
},
{
"type": "local",
"tag": "geosite-speedtest",
"format": "binary",
"path": "/etc/sing-box/rules/geosite/speedtest.srs"
},
{
"type": "local",
"tag": "geosite-jetbrains",
"format": "binary",
"path": "/etc/sing-box/rules/geosite/jetbrains.srs"
},
{
"type": "local",
"tag": "geosite-spotify",
"format": "binary",
"path": "/etc/sing-box/rules/geosite/spotify.srs"
},
{
"type": "local",
"tag": "geosite-disney",
"format": "binary",
"path": "/etc/sing-box/rules/geosite/disney.srs"
},
{
"type": "local",
"tag": "geosite-hbo",
"format": "binary",
"path": "/etc/sing-box/rules/geosite/hbo.srs"
},
{
"type": "local",
"tag": "geosite-amazon",
"format": "binary",
"path": "/etc/sing-box/rules/geosite/amazon.srs"
},
{
"type": "local",
"tag": "geosite-adobe",
"format": "binary",
"path": "/etc/sing-box/rules/geosite/adobe.srs"
},
{
"type": "local",
"tag": "geosite-steam",
"format": "binary",
"path": "/etc/sing-box/rules/geosite/steam.srs"
},
{
"type": "local",
"tag": "geosite-category-pt@!cn",
"format": "binary",
"path": "/etc/sing-box/rules/geosite/category-pt@!cn.srs"
},
{
"type": "local",
"tag": "geosite-category-cryptocurrency",
"format": "binary",
"path": "/etc/sing-box/rules/geosite/category-cryptocurrency.srs"
},
{
"type": "local",
"tag": "geosite-geolocation-!cn",
"format": "binary",
"path": "/etc/sing-box/rules/geosite/geolocation-!cn.srs"
},
{
"type": "local",
"tag": "geosite-cn",
"format": "binary",
"path": "/etc/sing-box/rules/geosite/cn.srs"
},
{
"type": "local",
"tag": "geosite-icloud@cn",
"format": "binary",
"path": "/etc/sing-box/rules/geosite/icloud@cn.srs"
},
{
"type": "local",
"tag": "geosite-apple@cn",
"format": "binary",
"path": "/etc/sing-box/rules/geosite/apple@cn.srs"
},
{
"type": "local",
"tag": "geosite-geolocation-cn",
"format": "binary",
"path": "/etc/sing-box/rules/geosite/geolocation-cn.srs"
},
{
"type": "local",
"tag": "geoip-cn",
"format": "binary",
"path": "/etc/sing-box/rules/geoip/cn.srs"
},
{
"type": "local",
"tag": "geoip-telegram",
"format": "binary",
"path": "/etc/sing-box/rules/geoip/telegram.srs"
},
{
"type": "local",
"tag": "geoip-netflix",
"format": "binary",
"path": "/etc/sing-box/rules/geoip/netflix.srs"
},
{
"type": "local",
"tag": "geoip-facebook",
"format": "binary",
"path": "/etc/sing-box/rules/geoip/facebook.srs"
}
],
"default_domain_resolver": "remote-dns"
},
"experimental": {
"clash_api": {
"external_controller": "<SING_BOX_LAN_IP>:9090",
"external_ui": "/etc/sing-box/ui",
"secret": "<SECRET_REDACTED>",
"default_mode": "rule"
},
"cache_file": {
"enabled": true,
"path": "/etc/sing-box/cache.db",
"store_fakeip": true
}
}
}4.3 生产 IPv4-only 配置：含 LoL / Riot real-ip 直连
适合新机器暂时只跑 IPv4，但仍需要保留 LoL 美服直连逻辑。它去掉 IPv6 DNS 入站、FakeIP IPv6 段、IPv6 公共 DNS CIDR 和 IPv6 监听。
{
"log": {
"level": "warn",
"timestamp": true
},
"dns": {
"cache_capacity": 20480,
"final": "remote-dns",
"strategy": "prefer_ipv4",
"servers": [
{
"tag": "remote-dns",
"type": "https",
"server": "1.1.1.1",
"server_port": 443,
"path": "/dns-query",
"tls": {
"server_name": "cloudflare-dns.com"
},
"detour": "Proxy"
},
{
"tag": "local-dns",
"type": "udp",
"server": "223.5.5.5",
"server_port": 53
},
{
"tag": "fakeip-dns",
"type": "fakeip",
"inet4_range": "28.0.0.0/8"
}
],
"rules": [
{
"domain_suffix": [
"<DIRECT_DOMAIN>"
],
"action": "route",
"server": "local-dns",
"rewrite_ttl": 60
},
{
"inbound": [
"dns-in"
],
"domain_suffix": [
"<DIRECT_DOMAIN>"
],
"action": "route",
"server": "local-dns",
"rewrite_ttl": 60
},
{
"domain_suffix": [
"apple.com",
"icloud.com",
"mzstatic.com",
"cdn-apple.com",
"apple-dns.net",
"aaplimg.com",
"apple-cloudkit.com"
],
"action": "route",
"server": "local-dns",
"rewrite_ttl": 60
},
{
"domain_suffix": [
"riotgames.com",
"riotcdn.net",
"leagueoflegends.com",
"lolesports.com",
"pvp.net",
"lolstatic.com",
"lolstatic-a.akamaihd.net",
"rgpub.io",
"riotcdn.cn"
],
"action": "route",
"server": "remote-dns",
"rewrite_ttl": 60
},
{
"inbound": [
"dns-in"
],
"rule_set": [
"geosite-cn",
"geosite-geolocation-cn",
"geosite-icloud@cn",
"geosite-apple@cn"
],
"action": "route",
"server": "local-dns",
"rewrite_ttl": 60
},
{
"inbound": [
"dns-in"
],
"rule_set": [
"geosite-ai",
"geosite-youtube",
"geosite-google",
"geosite-telegram",
"geosite-github",
"geosite-cloudflare",
"geosite-netflix",
"geosite-facebook",
"geosite-instagram",
"geosite-tiktok",
"geosite-speedtest",
"geosite-jetbrains",
"geosite-spotify",
"geosite-disney",
"geosite-hbo",
"geosite-amazon",
"geosite-adobe",
"geosite-steam",
"geosite-category-pt@!cn",
"geosite-category-cryptocurrency",
"geosite-geolocation-!cn"
],
"action": "route",
"server": "fakeip-dns",
"rewrite_ttl": 60,
"query_type": [
"A",
"AAAA"
]
},
{
"inbound": [
"dns-in"
],
"query_type": [
"A",
"AAAA"
],
"action": "route",
"server": "remote-dns",
"rewrite_ttl": 60
},
{
"rule_set": [
"geosite-cn",
"geosite-geolocation-cn",
"geosite-icloud@cn",
"geosite-apple@cn"
],
"action": "route",
"server": "local-dns",
"rewrite_ttl": 60
},
{
"rule_set": [
"geosite-ai",
"geosite-youtube",
"geosite-google",
"geosite-telegram",
"geosite-github",
"geosite-cloudflare",
"geosite-netflix",
"geosite-facebook",
"geosite-instagram",
"geosite-tiktok",
"geosite-speedtest",
"geosite-jetbrains",
"geosite-spotify",
"geosite-disney",
"geosite-hbo",
"geosite-amazon",
"geosite-adobe",
"geosite-steam",
"geosite-category-pt@!cn",
"geosite-category-cryptocurrency",
"geosite-geolocation-!cn"
],
"action": "route",
"server": "remote-dns",
"rewrite_ttl": 60
}
],
"disable_cache": false,
"disable_expire": false
},
"inbounds": [
{
"type": "tproxy",
"tag": "tproxy-in",
"listen": "::",
"listen_port": 9888
},
{
"type": "direct",
"tag": "dns-in",
"listen": "<SING_BOX_LAN_IP>",
"listen_port": 53,
"override_address": "8.8.8.8",
"override_port": 53
}
],
"outbounds": [
{
"type": "selector",
"tag": "Proxy",
"outbounds": [
"Auto",
"US-146-hy2",
"US-209-hy2",
"US-146-vless",
"US-232-hy2"
],
"default": "Auto",
"interrupt_exist_connections": true
},
{
"type": "urltest",
"tag": "Auto",
"outbounds": [
"US-146-hy2",
"US-209-hy2",
"US-146-vless",
"US-232-hy2"
],
"url": "https://www.gstatic.com/generate_204",
"interval": "2m",
"tolerance": 50
},
{
"type": "vless",
"tag": "US-146-vless",
"server": "<SERVER_IP_1>",
"server_port": 443,
"uuid": "<UUID_REDACTED>",
"flow": "",
"packet_encoding": "xudp",
"tcp_fast_open": true,
"tls": {
"enabled": true,
"server_name": "mirrors.kernel.org",
"utls": {
"enabled": true,
"fingerprint": "chrome"
},
"reality": {
"enabled": true,
"public_key": "<PUBLIC_KEY_REDACTED>",
"short_id": "<SHORT_ID_REDACTED>"
}
},
"multiplex": {
"enabled": true,
"protocol": "h2mux",
"padding": false,
"brutal": {
"enabled": true,
"up_mbps": 45,
"down_mbps": 300
}
}
},
{
"type": "hysteria2",
"tag": "US-232-hy2",
"server": "<SERVER_IP_2>",
"server_port": 443,
"up_mbps": 30,
"down_mbps": 220,
"password": "<PASSWORD_REDACTED>",
"tls": {
"enabled": true,
"server_name": "www.cloudflarestatus.com",
"insecure": true
},
"obfs": {
"type": "salamander",
"password": "<PASSWORD_REDACTED>"
}
},
{
"type": "hysteria2",
"tag": "US-146-hy2",
"server": "<SERVER_IP_1>",
"server_port": 443,
"password": "<PASSWORD_REDACTED>",
"up_mbps": 60,
"down_mbps": 360,
"tls": {
"enabled": true,
"server_name": "mirrors.kernel.org",
"insecure": true,
"alpn": [
"h3"
]
}
},
{
"type": "hysteria2",
"tag": "US-209-hy2",
"server": "<HY2_DOMAIN>",
"server_port": 443,
"up_mbps": 60,
"down_mbps": 360,
"password": "<PASSWORD_REDACTED>",
"obfs": {
"type": "salamander",
"password": "<PASSWORD_REDACTED>"
},
"tls": {
"enabled": true,
"server_name": "<HY2_DOMAIN>",
"insecure": true
}
},
{
"type": "direct",
"tag": "direct"
},
{
"type": "block",
"tag": "block"
}
],
"route": {
"auto_detect_interface": true,
"final": "Proxy",
"rules": [
{
"inbound": [
"dns-in"
],
"action": "hijack-dns"
},
{
"inbound": "tproxy-in",
"action": "sniff",
"sniffer": [
"tls",
"http"
],
"timeout": "300ms"
},
{
"domain_suffix": [
"<DIRECT_DOMAIN>"
],
"outbound": "direct"
},
{
"domain": [
"<HY2_DOMAIN>"
],
"outbound": "direct"
},
{
"domain_suffix": [
"riotgames.com",
"riotcdn.net",
"leagueoflegends.com",
"lolesports.com",
"pvp.net",
"lolstatic.com",
"lolstatic-a.akamaihd.net",
"rgpub.io",
"riotcdn.cn"
],
"outbound": "direct"
},
{
"ip_cidr": [
"<SERVER_IP_2>/32",
"<SERVER_IP_1>/32",
"<SERVER_IP_3>/32"
],
"outbound": "direct"
},
{
"type": "logical",
"mode": "or",
"rules": [
{
"port": 853
},
{
"network": "udp",
"port": 443
},
{
"protocol": "stun"
}
],
"action": "reject",
"method": "drop"
},
{
"ip_is_private": true,
"outbound": "direct"
},
{
"ip_cidr": [
"1.1.1.1/32",
"1.0.0.1/32",
"8.8.8.8/32",
"8.8.4.4/32",
"9.9.9.9/32",
"149.112.112.112/32",
"208.67.222.222/32",
"208.67.220.220/32"
],
"outbound": "Proxy"
},
{
"rule_set": [
"geosite-ai"
],
"outbound": "Proxy"
},
{
"domain_suffix": [
"apple.com",
"icloud.com",
"mzstatic.com",
"cdn-apple.com",
"apple-dns.net",
"aaplimg.com",
"apple-cloudkit.com"
],
"outbound": "direct"
},
{
"rule_set": [
"geosite-youtube",
"geosite-google",
"geosite-telegram",
"geoip-telegram",
"geosite-github",
"geosite-cloudflare",
"geosite-netflix",
"geoip-netflix",
"geosite-facebook",
"geoip-facebook",
"geosite-instagram",
"geosite-tiktok",
"geosite-speedtest",
"geosite-jetbrains",
"geosite-spotify",
"geosite-disney",
"geosite-hbo",
"geosite-amazon",
"geosite-adobe",
"geosite-steam",
"geosite-category-pt@!cn",
"geosite-category-cryptocurrency",
"geosite-geolocation-!cn"
],
"outbound": "Proxy"
},
{
"rule_set": [
"geosite-cn",
"geosite-geolocation-cn",
"geosite-icloud@cn",
"geosite-apple@cn",
"geoip-cn"
],
"outbound": "direct"
}
],
"rule_set": [
{
"type": "local",
"tag": "geosite-ai",
"format": "binary",
"path": "/etc/sing-box/rules/geosite/category-ai-chat-!cn.srs"
},
{
"type": "local",
"tag": "geosite-youtube",
"format": "binary",
"path": "/etc/sing-box/rules/geosite/youtube.srs"
},
{
"type": "local",
"tag": "geosite-google",
"format": "binary",
"path": "/etc/sing-box/rules/geosite/google.srs"
},
{
"type": "local",
"tag": "geosite-telegram",
"format": "binary",
"path": "/etc/sing-box/rules/geosite/telegram.srs"
},
{
"type": "local",
"tag": "geosite-github",
"format": "binary",
"path": "/etc/sing-box/rules/geosite/github.srs"
},
{
"type": "local",
"tag": "geosite-cloudflare",
"format": "binary",
"path": "/etc/sing-box/rules/geosite/cloudflare.srs"
},
{
"type": "local",
"tag": "geosite-netflix",
"format": "binary",
"path": "/etc/sing-box/rules/geosite/netflix.srs"
},
{
"type": "local",
"tag": "geosite-facebook",
"format": "binary",
"path": "/etc/sing-box/rules/geosite/facebook.srs"
},
{
"type": "local",
"tag": "geosite-instagram",
"format": "binary",
"path": "/etc/sing-box/rules/geosite/instagram.srs"
},
{
"type": "local",
"tag": "geosite-tiktok",
"format": "binary",
"path": "/etc/sing-box/rules/geosite/tiktok.srs"
},
{
"type": "local",
"tag": "geosite-speedtest",
"format": "binary",
"path": "/etc/sing-box/rules/geosite/speedtest.srs"
},
{
"type": "local",
"tag": "geosite-jetbrains",
"format": "binary",
"path": "/etc/sing-box/rules/geosite/jetbrains.srs"
},
{
"type": "local",
"tag": "geosite-spotify",
"format": "binary",
"path": "/etc/sing-box/rules/geosite/spotify.srs"
},
{
"type": "local",
"tag": "geosite-disney",
"format": "binary",
"path": "/etc/sing-box/rules/geosite/disney.srs"
},
{
"type": "local",
"tag": "geosite-hbo",
"format": "binary",
"path": "/etc/sing-box/rules/geosite/hbo.srs"
},
{
"type": "local",
"tag": "geosite-amazon",
"format": "binary",
"path": "/etc/sing-box/rules/geosite/amazon.srs"
},
{
"type": "local",
"tag": "geosite-adobe",
"format": "binary",
"path": "/etc/sing-box/rules/geosite/adobe.srs"
},
{
"type": "local",
"tag": "geosite-steam",
"format": "binary",
"path": "/etc/sing-box/rules/geosite/steam.srs"
},
{
"type": "local",
"tag": "geosite-category-pt@!cn",
"format": "binary",
"path": "/etc/sing-box/rules/geosite/category-pt@!cn.srs"
},
{
"type": "local",
"tag": "geosite-category-cryptocurrency",
"format": "binary",
"path": "/etc/sing-box/rules/geosite/category-cryptocurrency.srs"
},
{
"type": "local",
"tag": "geosite-geolocation-!cn",
"format": "binary",
"path": "/etc/sing-box/rules/geosite/geolocation-!cn.srs"
},
{
"type": "local",
"tag": "geosite-cn",
"format": "binary",
"path": "/etc/sing-box/rules/geosite/cn.srs"
},
{
"type": "local",
"tag": "geosite-icloud@cn",
"format": "binary",
"path": "/etc/sing-box/rules/geosite/icloud@cn.srs"
},
{
"type": "local",
"tag": "geosite-apple@cn",
"format": "binary",
"path": "/etc/sing-box/rules/geosite/apple@cn.srs"
},
{
"type": "local",
"tag": "geosite-geolocation-cn",
"format": "binary",
"path": "/etc/sing-box/rules/geosite/geolocation-cn.srs"
},
{
"type": "local",
"tag": "geoip-cn",
"format": "binary",
"path": "/etc/sing-box/rules/geoip/cn.srs"
},
{
"type": "local",
"tag": "geoip-telegram",
"format": "binary",
"path": "/etc/sing-box/rules/geoip/telegram.srs"
},
{
"type": "local",
"tag": "geoip-netflix",
"format": "binary",
"path": "/etc/sing-box/rules/geoip/netflix.srs"
},
{
"type": "local",
"tag": "geoip-facebook",
"format": "binary",
"path": "/etc/sing-box/rules/geoip/facebook.srs"
}
],
"default_domain_resolver": "remote-dns"
},
"experimental": {
"clash_api": {
"external_controller": "<SING_BOX_LAN_IP>:9090",
"external_ui": "/etc/sing-box/ui",
"secret": "<SECRET_REDACTED>",
"default_mode": "rule"
},
"cache_file": {
"enabled": true,
"path": "/etc/sing-box/cache.db",
"store_fakeip": true
}
}
}4.4 标准 IPv4-only 配置：不含 LoL 直连
适合最小化 IPv4 旁路网关。先用这一套跑通 DNS 分流、FakeIP 和 TProxy，确认稳定后再按需升级到双栈或添加 LoL 直连。
{
"log": {
"level": "warn",
"timestamp": true
},
"dns": {
"cache_capacity": 20480,
"final": "remote-dns",
"strategy": "prefer_ipv4",
"servers": [
{
"tag": "remote-dns",
"type": "https",
"server": "1.1.1.1",
"server_port": 443,
"path": "/dns-query",
"tls": {
"server_name": "cloudflare-dns.com"
},
"detour": "Proxy"
},
{
"tag": "local-dns",
"type": "udp",
"server": "223.5.5.5",
"server_port": 53
},
{
"tag": "fakeip-dns",
"type": "fakeip",
"inet4_range": "28.0.0.0/8"
}
],
"rules": [
{
"domain_suffix": [
"<DIRECT_DOMAIN>"
],
"action": "route",
"server": "local-dns",
"rewrite_ttl": 60
},
{
"inbound": [
"dns-in"
],
"domain_suffix": [
"<DIRECT_DOMAIN>"
],
"action": "route",
"server": "local-dns",
"rewrite_ttl": 60
},
{
"domain_suffix": [
"apple.com",
"icloud.com",
"mzstatic.com",
"cdn-apple.com",
"apple-dns.net",
"aaplimg.com",
"apple-cloudkit.com"
],
"action": "route",
"server": "local-dns",
"rewrite_ttl": 60
},
{
"inbound": [
"dns-in"
],
"rule_set": [
"geosite-cn",
"geosite-geolocation-cn",
"geosite-icloud@cn",
"geosite-apple@cn"
],
"action": "route",
"server": "local-dns",
"rewrite_ttl": 60
},
{
"inbound": [
"dns-in"
],
"rule_set": [
"geosite-ai",
"geosite-youtube",
"geosite-google",
"geosite-telegram",
"geosite-github",
"geosite-cloudflare",
"geosite-netflix",
"geosite-facebook",
"geosite-instagram",
"geosite-tiktok",
"geosite-speedtest",
"geosite-jetbrains",
"geosite-spotify",
"geosite-disney",
"geosite-hbo",
"geosite-amazon",
"geosite-adobe",
"geosite-steam",
"geosite-category-pt@!cn",
"geosite-category-cryptocurrency",
"geosite-geolocation-!cn"
],
"action": "route",
"server": "fakeip-dns",
"rewrite_ttl": 60,
"query_type": [
"A",
"AAAA"
]
},
{
"inbound": [
"dns-in"
],
"query_type": [
"A",
"AAAA"
],
"action": "route",
"server": "remote-dns",
"rewrite_ttl": 60
},
{
"rule_set": [
"geosite-cn",
"geosite-geolocation-cn",
"geosite-icloud@cn",
"geosite-apple@cn"
],
"action": "route",
"server": "local-dns",
"rewrite_ttl": 60
},
{
"rule_set": [
"geosite-ai",
"geosite-youtube",
"geosite-google",
"geosite-telegram",
"geosite-github",
"geosite-cloudflare",
"geosite-netflix",
"geosite-facebook",
"geosite-instagram",
"geosite-tiktok",
"geosite-speedtest",
"geosite-jetbrains",
"geosite-spotify",
"geosite-disney",
"geosite-hbo",
"geosite-amazon",
"geosite-adobe",
"geosite-steam",
"geosite-category-pt@!cn",
"geosite-category-cryptocurrency",
"geosite-geolocation-!cn"
],
"action": "route",
"server": "remote-dns",
"rewrite_ttl": 60
}
],
"disable_cache": false,
"disable_expire": false
},
"inbounds": [
{
"type": "tproxy",
"tag": "tproxy-in",
"listen": "::",
"listen_port": 9888
},
{
"type": "direct",
"tag": "dns-in",
"listen": "<SING_BOX_LAN_IP>",
"listen_port": 53,
"override_address": "8.8.8.8",
"override_port": 53
}
],
"outbounds": [
{
"type": "selector",
"tag": "Proxy",
"outbounds": [
"Auto",
"US-146-hy2",
"US-209-hy2",
"US-146-vless",
"US-232-hy2"
],
"default": "Auto",
"interrupt_exist_connections": true
},
{
"type": "urltest",
"tag": "Auto",
"outbounds": [
"US-146-hy2",
"US-209-hy2",
"US-146-vless",
"US-232-hy2"
],
"url": "https://www.gstatic.com/generate_204",
"interval": "2m",
"tolerance": 50
},
{
"type": "vless",
"tag": "US-146-vless",
"server": "<SERVER_IP_1>",
"server_port": 443,
"uuid": "<UUID_REDACTED>",
"flow": "",
"packet_encoding": "xudp",
"tcp_fast_open": true,
"tls": {
"enabled": true,
"server_name": "mirrors.kernel.org",
"utls": {
"enabled": true,
"fingerprint": "chrome"
},
"reality": {
"enabled": true,
"public_key": "<PUBLIC_KEY_REDACTED>",
"short_id": "<SHORT_ID_REDACTED>"
}
},
"multiplex": {
"enabled": true,
"protocol": "h2mux",
"padding": false,
"brutal": {
"enabled": true,
"up_mbps": 45,
"down_mbps": 300
}
}
},
{
"type": "hysteria2",
"tag": "US-232-hy2",
"server": "<SERVER_IP_2>",
"server_port": 443,
"up_mbps": 30,
"down_mbps": 220,
"password": "<PASSWORD_REDACTED>",
"tls": {
"enabled": true,
"server_name": "www.cloudflarestatus.com",
"insecure": true
},
"obfs": {
"type": "salamander",
"password": "<PASSWORD_REDACTED>"
}
},
{
"type": "hysteria2",
"tag": "US-146-hy2",
"server": "<SERVER_IP_1>",
"server_port": 443,
"password": "<PASSWORD_REDACTED>",
"up_mbps": 60,
"down_mbps": 360,
"tls": {
"enabled": true,
"server_name": "mirrors.kernel.org",
"insecure": true,
"alpn": [
"h3"
]
}
},
{
"type": "hysteria2",
"tag": "US-209-hy2",
"server": "<HY2_DOMAIN>",
"server_port": 443,
"up_mbps": 60,
"down_mbps": 360,
"password": "<PASSWORD_REDACTED>",
"obfs": {
"type": "salamander",
"password": "<PASSWORD_REDACTED>"
},
"tls": {
"enabled": true,
"server_name": "<HY2_DOMAIN>",
"insecure": true
}
},
{
"type": "direct",
"tag": "direct"
},
{
"type": "block",
"tag": "block"
}
],
"route": {
"auto_detect_interface": true,
"final": "Proxy",
"rules": [
{
"inbound": [
"dns-in"
],
"action": "hijack-dns"
},
{
"inbound": "tproxy-in",
"action": "sniff",
"sniffer": [
"tls",
"http"
],
"timeout": "300ms"
},
{
"domain_suffix": [
"<DIRECT_DOMAIN>"
],
"outbound": "direct"
},
{
"domain": [
"<HY2_DOMAIN>"
],
"outbound": "direct"
},
{
"ip_cidr": [
"<SERVER_IP_2>/32",
"<SERVER_IP_1>/32",
"<SERVER_IP_3>/32"
],
"outbound": "direct"
},
{
"type": "logical",
"mode": "or",
"rules": [
{
"port": 853
},
{
"network": "udp",
"port": 443
},
{
"protocol": "stun"
}
],
"action": "reject",
"method": "drop"
},
{
"ip_is_private": true,
"outbound": "direct"
},
{
"ip_cidr": [
"1.1.1.1/32",
"1.0.0.1/32",
"8.8.8.8/32",
"8.8.4.4/32",
"9.9.9.9/32",
"149.112.112.112/32",
"208.67.222.222/32",
"208.67.220.220/32"
],
"outbound": "Proxy"
},
{
"rule_set": [
"geosite-ai"
],
"outbound": "Proxy"
},
{
"domain_suffix": [
"apple.com",
"icloud.com",
"mzstatic.com",
"cdn-apple.com",
"apple-dns.net",
"aaplimg.com",
"apple-cloudkit.com"
],
"outbound": "direct"
},
{
"rule_set": [
"geosite-youtube",
"geosite-google",
"geosite-telegram",
"geoip-telegram",
"geosite-github",
"geosite-cloudflare",
"geosite-netflix",
"geoip-netflix",
"geosite-facebook",
"geoip-facebook",
"geosite-instagram",
"geosite-tiktok",
"geosite-speedtest",
"geosite-jetbrains",
"geosite-spotify",
"geosite-disney",
"geosite-hbo",
"geosite-amazon",
"geosite-adobe",
"geosite-steam",
"geosite-category-pt@!cn",
"geosite-category-cryptocurrency",
"geosite-geolocation-!cn"
],
"outbound": "Proxy"
},
{
"rule_set": [
"geosite-cn",
"geosite-geolocation-cn",
"geosite-icloud@cn",
"geosite-apple@cn",
"geoip-cn"
],
"outbound": "direct"
}
],
"rule_set": [
{
"type": "local",
"tag": "geosite-ai",
"format": "binary",
"path": "/etc/sing-box/rules/geosite/category-ai-chat-!cn.srs"
},
{
"type": "local",
"tag": "geosite-youtube",
"format": "binary",
"path": "/etc/sing-box/rules/geosite/youtube.srs"
},
{
"type": "local",
"tag": "geosite-google",
"format": "binary",
"path": "/etc/sing-box/rules/geosite/google.srs"
},
{
"type": "local",
"tag": "geosite-telegram",
"format": "binary",
"path": "/etc/sing-box/rules/geosite/telegram.srs"
},
{
"type": "local",
"tag": "geosite-github",
"format": "binary",
"path": "/etc/sing-box/rules/geosite/github.srs"
},
{
"type": "local",
"tag": "geosite-cloudflare",
"format": "binary",
"path": "/etc/sing-box/rules/geosite/cloudflare.srs"
},
{
"type": "local",
"tag": "geosite-netflix",
"format": "binary",
"path": "/etc/sing-box/rules/geosite/netflix.srs"
},
{
"type": "local",
"tag": "geosite-facebook",
"format": "binary",
"path": "/etc/sing-box/rules/geosite/facebook.srs"
},
{
"type": "local",
"tag": "geosite-instagram",
"format": "binary",
"path": "/etc/sing-box/rules/geosite/instagram.srs"
},
{
"type": "local",
"tag": "geosite-tiktok",
"format": "binary",
"path": "/etc/sing-box/rules/geosite/tiktok.srs"
},
{
"type": "local",
"tag": "geosite-speedtest",
"format": "binary",
"path": "/etc/sing-box/rules/geosite/speedtest.srs"
},
{
"type": "local",
"tag": "geosite-jetbrains",
"format": "binary",
"path": "/etc/sing-box/rules/geosite/jetbrains.srs"
},
{
"type": "local",
"tag": "geosite-spotify",
"format": "binary",
"path": "/etc/sing-box/rules/geosite/spotify.srs"
},
{
"type": "local",
"tag": "geosite-disney",
"format": "binary",
"path": "/etc/sing-box/rules/geosite/disney.srs"
},
{
"type": "local",
"tag": "geosite-hbo",
"format": "binary",
"path": "/etc/sing-box/rules/geosite/hbo.srs"
},
{
"type": "local",
"tag": "geosite-amazon",
"format": "binary",
"path": "/etc/sing-box/rules/geosite/amazon.srs"
},
{
"type": "local",
"tag": "geosite-adobe",
"format": "binary",
"path": "/etc/sing-box/rules/geosite/adobe.srs"
},
{
"type": "local",
"tag": "geosite-steam",
"format": "binary",
"path": "/etc/sing-box/rules/geosite/steam.srs"
},
{
"type": "local",
"tag": "geosite-category-pt@!cn",
"format": "binary",
"path": "/etc/sing-box/rules/geosite/category-pt@!cn.srs"
},
{
"type": "local",
"tag": "geosite-category-cryptocurrency",
"format": "binary",
"path": "/etc/sing-box/rules/geosite/category-cryptocurrency.srs"
},
{
"type": "local",
"tag": "geosite-geolocation-!cn",
"format": "binary",
"path": "/etc/sing-box/rules/geosite/geolocation-!cn.srs"
},
{
"type": "local",
"tag": "geosite-cn",
"format": "binary",
"path": "/etc/sing-box/rules/geosite/cn.srs"
},
{
"type": "local",
"tag": "geosite-icloud@cn",
"format": "binary",
"path": "/etc/sing-box/rules/geosite/icloud@cn.srs"
},
{
"type": "local",
"tag": "geosite-apple@cn",
"format": "binary",
"path": "/etc/sing-box/rules/geosite/apple@cn.srs"
},
{
"type": "local",
"tag": "geosite-geolocation-cn",
"format": "binary",
"path": "/etc/sing-box/rules/geosite/geolocation-cn.srs"
},
{
"type": "local",
"tag": "geoip-cn",
"format": "binary",
"path": "/etc/sing-box/rules/geoip/cn.srs"
},
{
"type": "local",
"tag": "geoip-telegram",
"format": "binary",
"path": "/etc/sing-box/rules/geoip/telegram.srs"
},
{
"type": "local",
"tag": "geoip-netflix",
"format": "binary",
"path": "/etc/sing-box/rules/geoip/netflix.srs"
},
{
"type": "local",
"tag": "geoip-facebook",
"format": "binary",
"path": "/etc/sing-box/rules/geoip/facebook.srs"
}
],
"default_domain_resolver": "remote-dns"
},
"experimental": {
"clash_api": {
"external_controller": "<SING_BOX_LAN_IP>:9090",
"external_ui": "/etc/sing-box/ui",
"secret": "<SECRET_REDACTED>",
"default_mode": "rule"
},
"cache_file": {
"enabled": true,
"path": "/etc/sing-box/cache.db",
"store_fakeip": true
}
}
}5. TProxy 策略路由和 nftables 脚本：双栈版
写入 /usr/local/sbin/sing-box-tproxy-setup：
nvim /usr/local/sbin/sing-box-tproxy-setup#!/usr/bin/env bash
set -euo pipefail
# 按实际网卡名修改，常见为 eth0 / ens18 / enp1s0。
LAN_IF="eth0"
TPROXY_PORT="9888"
MARK="1"
TABLE="100"
# Kernel forwarding / loose reverse path filtering for policy-routed transparent proxy.
sysctl -w net.ipv4.ip_forward=1 >/dev/null
sysctl -w net.ipv4.conf.all.rp_filter=0 >/dev/null
sysctl -w net.ipv4.conf.default.rp_filter=0 >/dev/null
sysctl -w net.ipv4.conf.${LAN_IF}.rp_filter=0 >/dev/null 2>&1 || true
sysctl -w net.ipv6.conf.all.forwarding=1 >/dev/null
sysctl -w net.ipv6.conf.default.forwarding=1 >/dev/null
sysctl -w net.ipv6.conf.${LAN_IF}.forwarding=1 >/dev/null 2>&1 || true
# Policy route for packets marked by nft tproxy.
ip rule add fwmark ${MARK} table ${TABLE} priority 100 2>/dev/null || true
ip route replace local 0.0.0.0/0 dev lo table ${TABLE}
ip -6 rule add fwmark ${MARK} table ${TABLE} priority 100 2>/dev/null || true
ip -6 route replace local ::/0 dev lo table ${TABLE}
# nftables TProxy rules.
nft -f - <<NFT
add table inet singbox_tproxy
flush table inet singbox_tproxy
table inet singbox_tproxy {
set bypass4 {
type ipv4_addr
flags interval
elements = {
0.0.0.0/8,
10.0.0.0/8,
100.64.0.0/10,
127.0.0.0/8,
169.254.0.0/16,
172.16.0.0/12,
192.168.0.0/16,
224.0.0.0/4,
240.0.0.0/4,
198.51.100.10/32,
198.51.100.20/32
}
}
set bypass6 {
type ipv6_addr
flags interval
elements = {
::/128,
::1/128,
fc00::/7,
fe80::/10,
ff00::/8,
fd88::/64
}
}
chain prerouting {
type filter hook prerouting priority mangle; policy accept;
# Only handle packets arriving from LAN NIC. Do not touch local output.
iifname != "${LAN_IF}" return
# Keep LAN/private destinations direct. This already covers management
# traffic to 10.20.20.12:9090 and LAN SSH targets; do not globally bypass
# TCP/22, otherwise GitHub SSH skips sing-box and goes direct.
ip daddr @bypass4 return
ip6 daddr @bypass6 return
# DNS is served locally by sing-box; do not TProxy DNS queries.
udp dport 53 return
tcp dport 53 return
# Do not return udp/443 here. Let sing-box receive QUIC, then route rule can drop it or proxy it;
# returning here may make YouTube/Google QUIC bypass the gateway.
meta l4proto { tcp, udp } meta mark set ${MARK} tproxy to :${TPROXY_PORT} accept
}
}
NFT授权：
chmod +x /usr/local/sbin/sing-box-tproxy-setup注意：
LAN_IF="eth0"必须改成实际接收 LAN 流量的网卡名。bypass4里要加入代理服务器真实 IP，避免代理连接再次被 TProxy 抓回形成回环。示例里用198.51.100.10/32、198.51.100.20/32占位。bypass6里要加入自己的 ULA/内网 IPv6 段，例如fd88::/64。- 不要全局写
tcp dport { 22, 9090 } return。内网管理 SSH 和10.20.20.12:9090已经被bypass4覆盖；如果全局放行 TCP/22，GitHub SSH 会绕过 sing-box 直连，容易在当前网络环境下超时。 udp dport 53 return和tcp dport 53 return建议保留。DNS 已经由 sing-box 的 DNS 入站单独处理，不需要再进 TProxy。udp dport 123 return不建议默认添加。NTP 异常更适合给systemd-timesyncd单独配置可直连 NTP 源，而不是提前放行所有客户端的 UDP/123。- 不要在 nftables 里写
udp dport 443 return。生产环境验证过：这会让 YouTube/Google QUIC 直接绕过 TProxy，容易出现解析正确但访问异常；应让 UDP/443 进入 sing-box，再由 route 里的 UDP/443/STUN reject 规则丢弃，促使客户端回落到 TCP。
6. systemd 单元
/etc/systemd/system/sing-box.service：
[Unit]
Description=sing-box service
Documentation=https://sing-box.sagernet.org
After=network.target nss-lookup.target
Wants=network.target
[Service]
User=root
ExecStart=/usr/local/bin/sing-box run -c /etc/sing-box/config.json
Restart=on-failure
RestartSec=10s
LimitNOFILE=infinity
[Install]
WantedBy=multi-user.target/etc/systemd/system/sing-box-tproxy.service：
[Unit]
Description=sing-box TProxy policy routing and nftables rules
Documentation=https://sing-box.sagernet.org
After=network-online.target
Wants=network-online.target
Before=sing-box.service
[Service]
Type=oneshot
ExecStart=/usr/local/sbin/sing-box-tproxy-setup
RemainAfterExit=yes
[Install]
WantedBy=multi-user.target启动顺序重点是：TProxy oneshot 在 network-online.target 后执行，并且 Before=sing-box.service。这样重启或开机时，策略路由和 nftables 先准备好，sing-box 再启动。
7. 启动和验证
先检查配置：
sing-box check -c /etc/sing-box/config.json加载 systemd：
systemctl daemon-reload
systemctl enable --now sing-box-tproxy.service
systemctl enable --now sing-box.service如果改过配置或 nft 脚本：
systemctl restart sing-box-tproxy.service
systemctl restart sing-box.service看状态：
systemctl status sing-box --no-pager
systemctl status sing-box-tproxy --no-pager检查策略路由：
ip rule show
ip route show table 100
ip -6 rule show
ip -6 route show table 100期望看到：
100: from all fwmark 0x1 lookup 100
local default dev lo scope host检查监听端口：
ss -lntup | grep -E ':(53|9888|9090)'期望看到：
10.20.20.12:53 sing-box
[fd88::1212]:53 sing-box
*:9888 sing-box
10.20.20.12:9090 sing-box检查 nft：
nft list rulesetDNS 分流验证示例：
dig @10.20.20.12 github.com A +short
dig @10.20.20.12 www.google.com A +short
dig @10.20.20.12 www.youtube.com A +short
dig @10.20.20.12 apple.com A +short
dig @10.20.20.12 www.baidu.com A +short
dig @10.20.20.12 test.example-ddns.com A +short期望：
- Google / YouTube / GitHub / Telegram / Gemini 等明确代理域名返回
28.x.x.x。 - 未命中代理规则的普通域名返回真实 IP，不再由兜底规则全部 FakeIP。
- Apple / iCloud 返回真实 IP。
- 国内站点返回真实 IP。
- 自己的 DDNS 后缀返回真实 IP。
IPv6 验证：
dig @fd88::1212 www.google.com AAAA +short
dig @fd88::1212 apple.com AAAA +short
dig @fd88::1212 test.example-ddns.com AAAA +short期望：
- 国外代理域名返回
2001:2::/64FakeIP。 - 未命中代理规则的普通域名返回真实 IPv6。
- Apple、自有 DDNS 返回真实 IPv6。
日志验证：
journalctl -u sing-box -f正常流量应该能看到类似：
inbound/tproxy[tproxy-in] connection to github.com:443
outbound/hysteria2[proxy-1-hy2] outbound connection to github.com:4438. IPv4-only 还要同步修改哪些地方
如果选第 4.3 或第 4.4 的 IPv4-only config.json，不要只替换 sing-box 配置文件，下面这些地方也要同步改成 IPv4-only。这样可以避免 RouterOS 继续把 IPv6 流量送进一台没有监听 IPv6 TProxy / DNS 的网关。
需要删除或不要添加的双栈项：
- RouterOS 的
sing-box-v6routing table。 - RouterOS IPv6 mangle/routing rule 中把公网 IPv6 目的地址送往 sing-box 的规则。
- Linux TProxy 脚本里的
net.ipv6.conf.*.forwarding、ip -6 rule、ip -6 route和bypass6。 - sing-box
dns-in-v6入站、FakeIPinet6_range、IPv6 公共 DNS CIDR 规则和所有只服务 IPv6 的监听地址。
仍然要保留的项：
udp dport 53 return和tcp dport 53 return，DNS 继续由 sing-box 本机处理。- 私网目的地址 bypass，LAN 内管理口和 LAN SSH 都靠它直连。
- 代理节点真实 IP
direct规则，避免代理节点连接被透明代理再次拦截。 - 如果你选的是第 4.3，LoL / Riot 的 real-ip DNS 和
directroute 规则也要保留。
IPv4-only 的 config.json 直接使用第 4.3 或第 4.4。这里单独给 TProxy 脚本：
IPv4-only /usr/local/sbin/sing-box-tproxy-setup
#!/usr/bin/env bash
set -euo pipefail
LAN_IF="eth0"
TPROXY_PORT="9888"
MARK="1"
TABLE="100"
sysctl -w net.ipv4.ip_forward=1 >/dev/null
sysctl -w net.ipv4.conf.all.rp_filter=0 >/dev/null
sysctl -w net.ipv4.conf.default.rp_filter=0 >/dev/null
sysctl -w net.ipv4.conf.${LAN_IF}.rp_filter=0 >/dev/null 2>&1 || true
ip rule add fwmark ${MARK} table ${TABLE} priority 100 2>/dev/null || true
ip route replace local 0.0.0.0/0 dev lo table ${TABLE}
nft -f - <<NFT
add table inet singbox_tproxy
flush table inet singbox_tproxy
table inet singbox_tproxy {
set bypass4 {
type ipv4_addr
flags interval
elements = {
0.0.0.0/8,
10.0.0.0/8,
100.64.0.0/10,
127.0.0.0/8,
169.254.0.0/16,
172.16.0.0/12,
192.168.0.0/16,
224.0.0.0/4,
240.0.0.0/4,
198.51.100.10/32,
198.51.100.20/32
}
}
chain prerouting {
type filter hook prerouting priority mangle; policy accept;
iifname != "${LAN_IF}" return
ip daddr @bypass4 return
udp dport 53 return
tcp dport 53 return
# Do not return udp/443 here; let sing-box receive and reject/proxy QUIC.
meta l4proto { tcp, udp } meta mark set ${MARK} tproxy to :${TPROXY_PORT} accept
}
}
NFTsystemd 单元和双栈版相同。
IPv4-only 验证：
sing-box check -c /etc/sing-box/config.json
systemctl restart sing-box-tproxy.service sing-box.service
ip rule show
ip route show table 100
ss -lntup | grep -E ':(53|9888|9090)'
dig @10.20.20.12 github.com A +short
dig @10.20.20.12 apple.com A +shortIPv4-only 版同样不要全局绕过 TCP/22 或 TCP/9090。访问内网 SSH、Clash API 管理端口和其它私网地址时，10.0.0.0/8、192.168.0.0/16 等私网 bypass 已经会让它们直连；公网 github.com:22 则应该交给 sing-box 按域名规则走 Proxy。
9. Clash API 切换节点
配置里启用了 Clash API：
10.20.20.12:9090如果某些服务，例如 Gemini，提示地区不支持，而 DNS 和 TProxy 日志确认已经走代理，通常是节点出口 IP 被风控。可以切换 Proxy 到另一个节点，或保持 Auto。
查看代理组：
curl -s -H 'Authorization: Bearer REPLAC...RET' http://10.20.20.12:9090/proxies/Proxy切换到 Auto：
curl -s -X PUT -H 'Authorization: Bearer REPLAC...RET' -H 'Content-Type: application/json' -d '{"name":"Auto"}' http://10.20.20.12:9090/proxies/Proxy切换到固定节点：
curl -s -X PUT -H 'Authorization: Bearer REPLAC...RET' -H 'Content-Type: application/json' -d '{"name":"proxy-2-hy2"}' http://10.20.20.12:9090/proxies/Proxy10. 常见问题
only IP queries are supported by fakeip
这是客户端查询 HTTPS/SVCB 记录时，FakeIP DNS 服务器不支持非 A/AAAA 查询导致的。修复方式是：所有走 fakeip-dns 的 DNS rule 加：
"query_type": ["A", "AAAA"]本文配置已经加好。HTTPS/SVCB 查询会走正常 DNS 路径，不会再把这类查询丢给 fakeip。
missing fakeip record, try enable experimental.cache_file
常见于 sing-box 重启后，客户端仍缓存旧 28.x 或 2001:2:: FakeIP，但 sing-box 内存里的 FakeIP 映射没了。本文配置保留：
"experimental": {
"cache_file": {
"enabled": true,
"path": "/etc/sing-box/cache.db",
"store_fakeip": true
}
}不建议关闭。缓存文件很小，但对 FakeIP 稳定性很重要。
Apple/iCloud 不要轻易走 FakeIP
Apple 相关服务容易因为 geolocation-!cn 被误伤。本文显式把这些后缀放到真实 IP + direct：
apple.com
icloud.com
mzstatic.com
cdn-apple.com
apple-dns.net
aaplimg.com
apple-cloudkit.com代理节点真实 IP 必须 bypass
如果代理服务器的真实 IP 也被 TProxy 抓回 sing-box，容易形成回环或连接异常。处理方式有两层：
- nft
bypass4/bypass6加代理服务器真实 IP。 - sing-box route 加代理服务器真实 IP 到
direct。
本文示例用 198.51.100.10/32、198.51.100.20/32 占位，实际要换成自己的节点 IP。
GitHub SSH 22 超时，但 443 可用
如果出现下面这种现象：
github.com:22 超时
ssh.github.com:443 正常先不要急着判断是 GitHub 账号、SSH key 或仓库权限问题。检查 nft TProxy 入口规则：
nft list chain inet singbox_tproxy prerouting如果看到：
tcp dport { 22, 9090 } return说明所有 TCP/22 都在进入 sing-box 前被放行直连了，github.com:22 不会走 geosite-github -> Proxy。删除这条全局端口绕过，重启 TProxy 规则：
systemctl restart sing-box-tproxy.service再测试：
ssh -T git@github.com
git ls-remote git@github.com:OWNER/REPO.git HEAD正常结果类似：
Hi your-user! You've successfully authenticated, but GitHub does not provide shell access.9090 也不需要按端口全局绕过。它是内网管理端口，目标地址通常是 10.20.20.12:9090，已经被私网目的地址 bypass 覆盖。
系统时间同步被 FakeIP 影响
如果网关机器自己的 DNS 也指向 sing-box，systemd-timesyncd 可能把 ntp.ubuntu.com 解析到 FakeIP，然后 UDP/123 超时。现象类似：
Timed out waiting for reply from 28.0.0.x:123 (ntp.ubuntu.com).
System clock synchronized: no不要为了这个问题盲目在 nft 里全局添加 udp dport 123 return。更稳的做法是给 timesyncd 配可直连 NTP 源：
mkdir -p /etc/systemd/timesyncd.conf.d
nvim /etc/systemd/timesyncd.conf.d/local-cn.conf[Time]
NTP=ntp.aliyun.com ntp.tencent.com cn.pool.ntp.org
FallbackNTP=ntp.ubuntu.com time.cloudflare.com重启并确认：
systemctl restart systemd-timesyncd
timedatectl
timedatectl timesync-status --no-pager看到 System clock synchronized: yes 才算真正同步成功。
新机器上 rule-set 下载失败
配置里使用本地 .srs 文件。如果新机器初始状态访问 GitHub 不稳定，可以先在其它机器下载：
/usr/local/sbin/sing-box-update-rules再把 /etc/sing-box/rules/ 整个目录复制到新机器。
11. 最小检查清单
每次修改后按这个顺序查：
sing-box check -c /etc/sing-box/config.json
systemctl restart sing-box-tproxy.service
systemctl restart sing-box.service
systemctl is-active sing-box-tproxy sing-box
ip rule show
ip route show table 100
nft list ruleset
ss -lntup | grep -E ':(53|9888|9090)'
dig @10.20.20.12 github.com A +short
dig @10.20.20.12 apple.com A +short
journalctl -u sing-box --since '5 minutes ago' --no-pager能同时满足下面几条，基本就是跑通了：
sing-box和sing-box-tproxy都是active。ip rule里有fwmark 0x1 lookup 100。table 100里有local default dev lo。nft list ruleset里有table inet singbox_tproxy。- DNS
:53、TProxy:9888、API:9090都监听。 - 国外域名返回 FakeIP，国内/Apple/自有 DDNS 返回真实 IP。
- 日志里能看到
inbound/tproxy到代理出站。 - 公共 DNS IP 访问会命中 RouterOS 的 sing-box routing rule，并在 sing-box route 里走
Proxy，不是客户端直连。