新时代之sing-box：模块配置与工作原理详解

{
  "log": {},            // 日志
  "dns": {},            // DNS 服务器与 DNS 规则
  "ntp": {},            // 内置时间同步（可选）
  "certificate": {},    // 信任的 CA 证书（可选）
  "http_clients": [],   // 共享 HTTP 客户端，用于下载规则集等（1.14 新增）
  "endpoints": [],      // 端点：WireGuard、Tailscale 这类既能进又能出的
  "inbounds": [],       // 入站
  "outbounds": [],      // 出站
  "route": {},          // 路由规则、规则集
  "services": [],       // 独立服务（DERP、resolved 等，可选）
  "experimental": {}    // 缓存文件、Clash API 等
}

sing-box check -c config.json          # 校验配置（也会读取证书等文件）
sing-box format -w -c config.json      # 格式化并写回
sing-box run -c config.json            # 运行

{
  "log": {
    "level": "info",      // 日志级别，见下
    "timestamp": true,    // 每行加时间
    "output": ""          // 写入文件；留空则输出到控制台
  }
}

{
  "type": "mixed",
  "tag": "mixed-in",
  "listen": "127.0.0.1",   // 只监听本机；改成 0.0.0.0 才能给局域网其他设备用
  "listen_port": 2080,
  "set_system_proxy": false  // true 时启动后自动设置系统代理
}

{
  "type": "tun",
  "tag": "tun-in",
  "address": [
    "172.19.0.1/30",          // 虚拟网卡的 IPv4 地址
    "fdfe:dcba:9876::1/126"   // 虚拟网卡的 IPv6 地址
  ],
  "auto_route": true,         // 自动把系统默认路由指向 TUN
  "strict_route": true,       // 严格路由，防止流量绕过 TUN 泄漏
  "stack": "mixed"            // TCP/IP 栈：system / gvisor / mixed
}

{
  "type": "vless",
  "tag": "vless-reality",
  "server": "vps.example.com",     // 服务器地址（域名或 IP）
  "server_port": 443,
  "uuid": "7189a32f-1c95-480e-adfd-3f96b7d2060e",
  "flow": "xtls-rprx-vision",      // Vision 流控，避免"TLS 套 TLS"的特征
  "tls": {
    "enabled": true,
    "server_name": "www.microsoft.com",   // 伪装的目标站点（SNI）
    "utls": {
      "enabled": true,
      "fingerprint": "chrome"            // 模拟 Chrome 的 TLS 指纹
    },
    "reality": {
      "enabled": true,
      "public_key": "0qUcqyWeX_XGs3sbsowB6OgMI8vCiIoI1OuK9c4wvyo",
      "short_id": "14191e8010846d49"
    }
  }
}

{
  "type": "hysteria2",
  "tag": "hy2",
  "server": "vps.example.com",
  "server_port": 8443,
  "password": "ENywjWixW3adFk7teiqxOQ==",
  "tls": {
    "enabled": true,
    "server_name": "vps.example.com",   // 需要服务端有该域名的真实证书
    "alpn": ["h3"]
  }
}

{ "type": "direct", "tag": "direct" }

[
  {
    "type": "selector",           // 手动选择
    "tag": "proxy",
    "outbounds": ["auto", "vless-reality", "hy2"],
    "default": "auto"
  },
  {
    "type": "urltest",            // 自动测速选最快
    "tag": "auto",
    "outbounds": ["vless-reality", "hy2"],
    "url": "https://www.gstatic.com/generate_204",
    "interval": "3m",             // 测速间隔，默认 3m
    "tolerance": 50               // 新节点至少快 50ms 才切换，避免来回抖动
  }
]

{
  "type": "wireguard",
  "tag": "wg-ep",
  "address": ["10.0.0.2/32"],
  "private_key": "<本机私钥>",
  "peers": [
    {
      "address": "wg.example.com",
      "port": 51820,
      "public_key": "<对端公钥>",
      "allowed_ips": ["0.0.0.0/0", "::/0"]
    }
  ]
}

{
  "type": "logical",
  "mode": "and",                     // and / or
  "rules": [
    { "rule_set": "geoip-cn", "invert": true },   // 非中国 IP
    { "network": "udp", "port": 443 }            // 且是 QUIC
  ],
  "action": "reject"                 // 拒绝海外 QUIC，逼浏览器回落到 TCP
}

{
  "route": {
    "rules": [],
    "rule_set": [],                        // 规则集定义，见第八节
    "final": "proxy",                      // 兜底出站
    "auto_detect_interface": true,         // 出站绑定物理网卡，TUN 必开，防回环
    "default_domain_resolver": "local",    // 出站解析服务器域名时默认用的 DNS
    "default_http_client": "via-proxy"     // 下载远程规则集默认用的 HTTP 客户端
  }
}

{
  "rules": [
    { "action": "sniff" },                                    // 0 先嗅探
    { "protocol": "dns", "action": "hijack-dns" },            // 1 DNS 查询交给 DNS 模块
    { "ip_is_private": true, "outbound": "direct" },          // 2 局域网直连
    { "clash_mode": "direct", "outbound": "direct" },         // 3 面板切到"直连"模式
    { "clash_mode": "global", "outbound": "proxy" },          // 4 面板切到"全局"模式
    { "rule_set": "geosite-category-ads-all", "action": "reject" },       // 5 广告拒绝
    { "rule_set": ["geosite-cn", "geoip-cn"], "outbound": "direct" }      // 6 国内直连
  ]
  // 其余走 final: proxy
}

router: match[0] => sniff
router: sniffed protocol: tls, domain: doubleclick.net
router: match[5] rule_set=geosite-category-ads-all => reject

router: match[0] => sniff
router: match[6] rule_set=[geosite-cn geoip-cn] => route(direct)
outbound/direct[direct]: outbound connection to www.baidu.com:443

{
  "rule_set": [
    {
      "type": "remote",                  // 远程：定期自动下载
      "tag": "geosite-cn",
      "url": "https://raw.githubusercontent.com/SagerNet/sing-geosite/rule-set/geosite-cn.srs",
      "update_interval": "1d"            // 可选，默认 1d
    },
    {
      "type": "local",                   // 本地文件：修改后自动重新加载
      "tag": "my-rules",
      "path": "my-rules.srs"
    },
    {
      "type": "inline",                  // 内联：直接写在配置里
      "tag": "my-inline",
      "rules": [{ "domain_suffix": ["example.org"] }]
    }
  ]
}

{
  "version": 3,
  "rules": [
    { "domain_suffix": ["newzhxu.com"] },
    { "ip_cidr": ["67.230.176.0/24"] }
  ]
}

sing-box rule-set compile my-rules.json     # 生成 my-rules.srs

$ sing-box rule-set match -f binary geosite-cn.srs www.bilibili.com
match rules.[0]: domain/domain_suffix=<binary> ...

$ sing-box rule-set match -f binary geoip-cn.srs 220.181.111.1
match rules.[0]: ip_cidr=<binary>

$ sing-box rule-set match -f binary geoip-cn.srs 67.230.176.31
                                  # 没有输出 = 不匹配

{
  "servers": [
    {
      "type": "udp",               // 传统 UDP DNS
      "tag": "local",
      "server": "223.5.5.5"
    },
    {
      "type": "https",             // DoH
      "tag": "remote",
      "server": "1.1.1.1",         // 用 IP 就不需要再解析；用域名则需要 domain_resolver
      "detour": "proxy"            // 经代理发出，出口在海外
    }
  ]
}

{
  "dns": {
    "servers": [
      // local 和 remote，见上
    ],
    "rules": [
      { "clash_mode": "direct", "server": "local" },                           // 0
      { "clash_mode": "global", "server": "remote" },                          // 1
      { "rule_set": "geosite-category-ads-all", "action": "reject" },          // 2 广告
      { "rule_set": "geosite-cn", "server": "local" },                         // 3 国内名单
      { "rule_set": "geosite-geolocation-!cn", "server": "remote" },           // 4 海外名单
      { "action": "evaluate", "server": "local" },                             // 5 其余：先用国内 DNS 试查
      { "match_response": true, "rule_set": "geoip-cn", "action": "respond" }  // 6 结果是国内 IP 就采用
    ],
    "final": "remote",            // 否则交给 remote 重新查
    "strategy": "prefer_ipv4"
  }
}

www.baidu.com       dns: match[3] rule_set=geosite-cn => route(local)
www.google.com      dns: match[4] rule_set=geosite-geolocation-!cn => route(remote)
ads.doubleclick.net dns: match[2] rule_set=geosite-category-ads-all => reject
h.newzhxu.com       dns: match[5] => evaluate(local)

router: sniffed packet protocol: dns
router: match[1] protocol=dns => hijack-dns          ← 路由模块把 DNS 交给 DNS 模块
dns: exchange h.newzhxu.com. IN A
dns: match[5] => evaluate(local)                     ← 先用国内 DNS 试查
dns: exchanged A h.newzhxu.com. 58 IN A 67.230.176.31
outbound/...: outbound connection to 1.1.1.1:443     ← 不是国内 IP，改走 remote（DoH 经代理）

{
  "servers": [
    // ...前面的 local、remote
    {
      "type": "fakeip",
      "tag": "fakeip",
      "inet4_range": "198.18.0.0/15",
      "inet6_range": "fc00::/18"
    }
  ],
  "rules": [
    { "query_type": ["A", "AAAA"], "rule_set": "geosite-geolocation-!cn", "server": "fakeip" }
  ]
}

{
  "http_clients": [
    {
      "tag": "via-proxy",
      "detour": "proxy"        // 拨号字段：经代理下载
    }
  ],
  "route": {
    "default_http_client": "via-proxy"   // 远程规则集默认用它下载
  }
}

{
  "experimental": {
    "cache_file": {
      "enabled": true,       // 缓存到 cache.db
      "store_dns": true      // 持久化 DNS 缓存（取代已废弃的 store_rdrc）
    },
    "clash_api": {
      "external_controller": "127.0.0.1:9090",
      "default_mode": "rule",
      "secret": ""           // 监听非本机地址时务必设置
    }
  }
}

{
  "log": {
    "level": "info",
    "timestamp": true
  },
  "dns": {
    "servers": [
      {
        "type": "udp",
        "tag": "local",
        "server": "223.5.5.5"
      },
      {
        "type": "https",
        "tag": "remote",
        "server": "1.1.1.1",
        "detour": "proxy"
      }
    ],
    "rules": [
      {
        "clash_mode": "direct",
        "server": "local"
      },
      {
        "clash_mode": "global",
        "server": "remote"
      },
      {
        "rule_set": "geosite-category-ads-all",
        "action": "reject"
      },
      {
        "rule_set": "geosite-cn",
        "server": "local"
      },
      {
        "rule_set": "geosite-geolocation-!cn",
        "server": "remote"
      },
      {
        "action": "evaluate",
        "server": "local"
      },
      {
        "match_response": true,
        "rule_set": "geoip-cn",
        "action": "respond"
      }
    ],
    "final": "remote",
    "strategy": "prefer_ipv4"
  },
  "http_clients": [
    {
      "tag": "via-proxy",
      "detour": "proxy"
    }
  ],
  "inbounds": [
    {
      "type": "tun",
      "tag": "tun-in",
      "address": [
        "172.19.0.1/30",
        "fdfe:dcba:9876::1/126"
      ],
      "auto_route": true,
      "strict_route": true,
      "stack": "mixed"
    },
    {
      "type": "mixed",
      "tag": "mixed-in",
      "listen": "127.0.0.1",
      "listen_port": 2080
    }
  ],
  "outbounds": [
    {
      "type": "selector",
      "tag": "proxy",
      "outbounds": [
        "auto",
        "vless-reality",
        "hy2"
      ],
      "default": "auto"
    },
    {
      "type": "urltest",
      "tag": "auto",
      "outbounds": [
        "vless-reality",
        "hy2"
      ],
      "url": "https://www.gstatic.com/generate_204",
      "interval": "3m",
      "tolerance": 50
    },
    {
      "type": "vless",
      "tag": "vless-reality",
      "server": "vps.example.com",
      "server_port": 443,
      "uuid": "7189a32f-1c95-480e-adfd-3f96b7d2060e",
      "flow": "xtls-rprx-vision",
      "tls": {
        "enabled": true,
        "server_name": "www.microsoft.com",
        "utls": {
          "enabled": true,
          "fingerprint": "chrome"
        },
        "reality": {
          "enabled": true,
          "public_key": "0qUcqyWeX_XGs3sbsowB6OgMI8vCiIoI1OuK9c4wvyo",
          "short_id": "14191e8010846d49"
        }
      }
    },
    {
      "type": "hysteria2",
      "tag": "hy2",
      "server": "vps.example.com",
      "server_port": 8443,
      "password": "ENywjWixW3adFk7teiqxOQ==",
      "tls": {
        "enabled": true,
        "server_name": "vps.example.com",
        "alpn": [
          "h3"
        ]
      }
    },
    {
      "type": "direct",
      "tag": "direct"
    }
  ],
  "route": {
    "rules": [
      {
        "action": "sniff"
      },
      {
        "protocol": "dns",
        "action": "hijack-dns"
      },
      {
        "ip_is_private": true,
        "outbound": "direct"
      },
      {
        "clash_mode": "direct",
        "outbound": "direct"
      },
      {
        "clash_mode": "global",
        "outbound": "proxy"
      },
      {
        "rule_set": "geosite-category-ads-all",
        "action": "reject"
      },
      {
        "rule_set": [
          "geosite-cn",
          "geoip-cn"
        ],
        "outbound": "direct"
      }
    ],
    "rule_set": [
      {
        "type": "remote",
        "tag": "geosite-cn",
        "url": "https://raw.githubusercontent.com/SagerNet/sing-geosite/rule-set/geosite-cn.srs"
      },
      {
        "type": "remote",
        "tag": "geosite-geolocation-!cn",
        "url": "https://raw.githubusercontent.com/SagerNet/sing-geosite/rule-set/geosite-geolocation-!cn.srs"
      },
      {
        "type": "remote",
        "tag": "geosite-category-ads-all",
        "url": "https://raw.githubusercontent.com/SagerNet/sing-geosite/rule-set/geosite-category-ads-all.srs"
      },
      {
        "type": "remote",
        "tag": "geoip-cn",
        "url": "https://raw.githubusercontent.com/SagerNet/sing-geoip/rule-set/geoip-cn.srs"
      }
    ],
    "final": "proxy",
    "auto_detect_interface": true,
    "default_domain_resolver": "local",
    "default_http_client": "via-proxy"
  },
  "experimental": {
    "cache_file": {
      "enabled": true,
      "store_dns": true
    },
    "clash_api": {
      "external_controller": "127.0.0.1:9090",
      "default_mode": "rule"
    }
  }
}

sudo sing-box run -c config.json

{
  "log": {
    "level": "info",
    "timestamp": true
  },
  "inbounds": [
    {
      "type": "vless",
      "tag": "vless-in",
      "listen": "::",
      "listen_port": 443,
      "users": [
        {
          "name": "me",
          "uuid": "7189a32f-1c95-480e-adfd-3f96b7d2060e",
          "flow": "xtls-rprx-vision"
        }
      ],
      "tls": {
        "enabled": true,
        "server_name": "www.microsoft.com",
        "reality": {
          "enabled": true,
          "handshake": {
            "server": "www.microsoft.com",
            "server_port": 443
          },
          "private_key": "4FqBLltJaY30k5AwdYhxEbOgyAIM-dyMTmps-E1nv3E",
          "short_id": [
            "14191e8010846d49"
          ]
        }
      }
    },
    {
      "type": "hysteria2",
      "tag": "hy2-in",
      "listen": "::",
      "listen_port": 8443,
      "users": [
        {
          "name": "me",
          "password": "ENywjWixW3adFk7teiqxOQ=="
        }
      ],
      "masquerade": "https://www.bing.com",
      "tls": {
        "enabled": true,
        "alpn": [
          "h3"
        ],
        "certificate_path": "/etc/sing-box/cert.pem",
        "key_path": "/etc/sing-box/key.pem"
      }
    }
  ],
  "outbounds": [
    {
      "type": "direct",
      "tag": "direct"
    }
  ],
  "route": {
    "rules": [
      {
        "action": "sniff"
      },
      {
        "protocol": "bittorrent",
        "action": "reject"
      },
      {
        "ip_is_private": true,
        "action": "reject"
      }
    ],
    "final": "direct"
  }
}

sing-box generate reality-keypair   # PrivateKey 填服务端，PublicKey 填客户端
sing-box generate uuid              # VLESS 用户 UUID
sing-box generate rand --hex 8      # REALITY short_id
sing-box generate rand --base64 16  # Hysteria2 密码