# Shadowrocket WHITELIST GLOBAL routing and DNS configuration
#
# ENG
# This file does not contain proxy nodes.
# First add a normal RAW/Base64 WHITELIST subscription to Shadowrocket and
# configure Shadowrocket's native automatic proxy testing/selection. Then
# import and activate this .conf in the Configuration ("Настройка") routing
# mode.
#
# WHITELIST GLOBAL means all external Internet traffic uses PROXY. Localhost,
# private networks, and LAN devices remain DIRECT so the router and local
# devices stay reachable.
#
# Russian and system DNS resolvers are used directly for bootstrap and DIRECT
# lookups. External DNS lookups for proxied traffic use DoH through PROXY.
#
# RU
# Этот файл не содержит прокси-узлов.
# Сначала добавьте в Shadowrocket обычную RAW/Base64-подписку WHITELIST и
# настройте встроенную автоматическую проверку и выбор прокси. Затем
# импортируйте этот файл .conf и активируйте его в режиме маршрутизации
# «Настройка».
#
# WHITELIST GLOBAL означает, что весь внешний интернет-трафик направляется
# через PROXY. Localhost, частные сети и устройства локальной сети остаются в
# режиме DIRECT, чтобы сохранить доступ к роутеру и другим локальным
# устройствам.
#
# Российские и системный DNS используются напрямую для bootstrap и запросов
# DIRECT. Зарубежные DoH для трафика PROXY доступны через прокси.
#
# For more information visit: github.com/igareck/vpn-configs-for-russia

[General]

ipv6 = false
prefer-ipv6 = false
ipv6-only-if-no-ipv4-dns = false

private-ip-answer = true
always-ip-address = false
allow-dns-svcb = false
allow-dns-all = true

dns-server = system,https://common.dot.dns.yandex.net/dns-query#no-h3,https://safe.dot.dns.yandex.net/dns-query#no-h3,https://family.dot.dns.yandex.net/dns-query#no-h3,77.88.8.1,77.88.8.2,77.88.8.3,77.88.8.7,77.88.8.8,77.88.8.88,89.175.167.27,94.72.28.59,95.31.212.206,82.140.107.246,83.149.26.2,188.162.79.131

fallback-dns-server = system
dns-fallback-system = true

proxy-dns-server = https://dns.google/dns-query#no-h3,https://dns.quad9.net/dns-query#no-h3,https://dns.adguard-dns.com/dns-query#no-h3,https://freedns.controld.com/p0#no-h3,https://dns.mullvad.net/dns-query#no-h3,https://cloudflare-dns.com/dns-query#no-h3,https://doh.opendns.com/dns-query#no-h3,https://doh.libredns.gr/dns-query#no-h3,https://doh.dns4all.eu/dns-query#no-h3,https://wikimedia-dns.org/dns-query#no-h3,https://dns.hostux.net/dns-query#no-h3,https://blank.dnsforge.de/dns-query#no-h3

dns-direct-system = false
dns-direct-fallback-proxy = false
hijack-dns = *:53

always-real-ip = *.lan,*.local,localhost,time.*.com,time.*.gov,time.*.apple.com,time-ios.apple.com,time1.*.com,time2.*.com,time3.*.com,time4.*.com,time5.*.com,time6.*.com,time7.*.com,ntp.*.com,ntp1.*.com,ntp2.*.com,ntp3.*.com,ntp4.*.com,ntp5.*.com,ntp6.*.com,ntp7.*.com,*.pool.ntp.org,push.apple.com,*.push.apple.com,stun.*.*,*.stun.*.*,stun.*.*.*,*.stun.*.*.*,stun.*.*.*.*,*.stun.*.*.*.*,stun.*.*.*.*.*,*.stun.*.*.*.*.*,stun.playstation.net,*.stun.playstation.net,lens.l.google.com,*.n.n.srv.nintendo.net,xbox.*.*.microsoft.com,*.*.xboxlive.com,*.msftncsi.com,*.msftconnecttest.com,WORKGROUP

skip-proxy = 127.0.0.0/8,10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,169.254.0.0/16,100.64.0.0/10,localhost,*.local,*.lan

tun-excluded-routes = 10.0.0.0/8,100.64.0.0/10,127.0.0.0/8,169.254.0.0/16,172.16.0.0/12,192.0.0.0/24,192.0.2.0/24,192.88.99.0/24,192.168.0.0/16,198.51.100.0/24,203.0.113.0/24,224.0.0.0/4,239.255.255.250/32,255.255.255.255/32

udp-policy-not-supported-behaviour = REJECT
block-quic = always-allow
use-local-host-item-for-proxy = true
icmp-auto-reply = false
always-reject-url-rewrite = false

[Rule]

DOMAIN,localhost,DIRECT
DOMAIN-SUFFIX,local,DIRECT
DOMAIN-SUFFIX,lan,DIRECT

IP-CIDR,127.0.0.0/8,DIRECT,no-resolve
IP-CIDR,10.0.0.0/8,DIRECT,no-resolve
IP-CIDR,172.16.0.0/12,DIRECT,no-resolve
IP-CIDR,192.168.0.0/16,DIRECT,no-resolve
IP-CIDR,169.254.0.0/16,DIRECT,no-resolve
IP-CIDR,100.64.0.0/10,DIRECT,no-resolve

IP-CIDR,::1/128,DIRECT,no-resolve
IP-CIDR,fc00::/7,DIRECT,no-resolve
IP-CIDR,fe80::/10,DIRECT,no-resolve

FINAL,PROXY

[Host]

localhost = 127.0.0.1