# Generated — edit config.template.yaml, run ./build-config.sh flclash mixed-port: 7890 allow-lan: false ipv6: false find-process-mode: off tcp-concurrent: true keep-alive-idle: 60 keep-alive-interval: 30 log-level: warning external-controller: 127.0.0.1:9090 secret: "512355" geodata-mode: true geodata-loader: standard geox-url: geoip: "https://github.com/Loyalsoldier/v2ray-rules-dat/releases/latest/download/geoip.dat" geosite: "https://github.com/Loyalsoldier/v2ray-rules-dat/releases/latest/download/geosite.dat" mmdb: "https://github.com/MetaCubeX/meta-rules-dat/releases/download/latest/country.mmdb" profile: store-selected: true store-fake-ip: false # Cloudflare 1.1.1.1: DoH + DoT primary (prefer-h3 off — fewer stalls on targets/mikrotik/routeros/container) # TUN hijacks :53; clients use router DNS only — same Cloudflare on /ip dns (targets/mikrotik/routeros/dns-cloudflare.rsc) dns: enable: true listen: 127.0.0.1:1053 prefer-h3: false use-hosts: true use-system-hosts: true # Real DNS to clients; domain rules via DNS cache + TLS sniffer (see docs/fake-ip-pitfalls.md) enhanced-mode: redir-host # false: stable DNS upstream. true breaks SERVFAIL under AUTO churn (see docs/dns-enforcement.md). respect-rules: false default-nameserver: - 1.1.1.1 - 1.0.0.1 nameserver: - https://cloudflare-dns.com/dns-query - tls://1.1.1.1 fallback: - tls://8.8.8.8 - https://dns.google/dns-query fallback-filter: geoip: true geoip-code: ru proxy-server-nameserver: - 1.1.1.1 - 1.0.0.1 # ISP-poisoned / censored names: explicit DoH (not proxy DNS path). See docs/dns-enforcement.md. nameserver-policy: "+.nuget.org": - 1.1.1.1 - 8.8.8.8 "+.nuget.dev": - 1.1.1.1 - 8.8.8.8 "rule-set:ru-bundle,refilter-domains,ru-inline-banned,ru-inside,rknasnblock": - https://cloudflare-dns.com/dns-query - tls://1.1.1.1 "rule-set:category-ai,google-deepmind,speedtest-net": - https://cloudflare-dns.com/dns-query - tls://1.1.1.1 "geosite:telegram": - https://cloudflare-dns.com/dns-query - tls://1.1.1.1 "+.t.me": - https://cloudflare-dns.com/dns-query - tls://1.1.1.1 "+.telesco.pe": - https://cloudflare-dns.com/dns-query - tls://1.1.1.1 "geosite:category-ru": - tls://77.88.8.8 - tls://1.1.1.1 "rule-set:ru-cdn-domains,category-ru": - tls://77.88.8.8 - tls://1.1.1.1 # lazymedia-balancers: FlClash-safe (geosite:hdrezka fails decode on phone geodata) "rule-set:lazymedia-balancers": - https://cloudflare-dns.com/dns-query - tls://1.1.1.1 "+.kinopub.me": - https://cloudflare-dns.com/dns-query - tls://1.1.1.1 "+.kinopub.net": - https://cloudflare-dns.com/dns-query - tls://1.1.1.1 "+.kinopub.cc": - https://cloudflare-dns.com/dns-query - tls://1.1.1.1 "+.voidboost.net": - https://cloudflare-dns.com/dns-query - tls://1.1.1.1 "+.voidboost.com": - https://cloudflare-dns.com/dns-query - tls://1.1.1.1 "+.bazon.cc": - https://cloudflare-dns.com/dns-query - tls://1.1.1.1 "+.bazon.site": - https://cloudflare-dns.com/dns-query - tls://1.1.1.1 "+.collaps.la": - https://cloudflare-dns.com/dns-query - tls://1.1.1.1 "+.alloha.tv": - https://cloudflare-dns.com/dns-query - tls://1.1.1.1 "+.videocdn.so": - https://cloudflare-dns.com/dns-query - tls://1.1.1.1 - tls://8.8.8.8 "+.kodik.info": - https://cloudflare-dns.com/dns-query - tls://1.1.1.1 "+.lazycatsoftware.com": - https://cloudflare-dns.com/dns-query - tls://1.1.1.1 "+.zona.mobi": - https://cloudflare-dns.com/dns-query - tls://1.1.1.1 "+.vibix.org": - https://cloudflare-dns.com/dns-query - tls://1.1.1.1 "+.videocdn.pw": - https://cloudflare-dns.com/dns-query - tls://1.1.1.1 "+.kinovibe.ru": - https://cloudflare-dns.com/dns-query - tls://1.1.1.1 "+.kinovibe.com": - https://cloudflare-dns.com/dns-query - tls://1.1.1.1 "+.cvh.to": - https://cloudflare-dns.com/dns-query - tls://8.8.8.8 "+.coldcdn.xyz": - https://cloudflare-dns.com/dns-query - tls://1.1.1.1 "ae-deb": - 192.168.88.1 "ae-deb.lan": - 192.168.88.1 "ae-pc": - 192.168.88.1 "ae-pc.lan": - 192.168.88.1 "+.lan": - 192.168.88.1 "+.sovcombank.ru": - tls://1.1.1.1 - tls://1.0.0.1 "+.sovcombank.com": - tls://1.1.1.1 - tls://1.0.0.1 "+.halvacard.ru": - tls://1.1.1.1 - tls://1.0.0.1 "+.lanbook.com": - tls://8.8.8.8 - tls://1.1.1.1 "+.cursor.sh": - tls://1.1.1.1 - tls://8.8.8.8 "+.cursor.com": - tls://1.1.1.1 - tls://8.8.8.8 "+.cursorapi.com": - tls://1.1.1.1 - tls://8.8.8.8 "+.anysphere.co": - tls://1.1.1.1 - tls://8.8.8.8 "+.dns.ru": - tls://77.88.8.8 - tls://1.1.1.1 "+.dns-shop.ru": - tls://77.88.8.8 - tls://1.1.1.1 "+.toneperfect.app": - tls://1.1.1.1 - tls://8.8.8.8 "+.nalog.ru": - tls://1.1.1.1 - tls://8.8.8.8 "+.tax.gov.ru": - tls://1.1.1.1 - tls://8.8.8.8 "+.gstatic.com": - tls://1.1.1.1 - tls://8.8.8.8 cache-max-size: 1024 # Container/RouterOS path: allow slow DoH without instant SERVFAIL timeout: 10 # TLS/HTTP sniffer — legiz-style (override-destination false for redir-host). See docs/sniffer-reenable.md sniffer: enable: false tun: enable: true stack: gvisor auto-route: true auto-detect-interface: true strict-route: false dns-hijack: - any:53 mtu: 1400 proxy-providers: SUB1: type: http url: https://prism.ashleyvpn.cloud/app/users/c66d88ea-2faa-48ff-9ed2-100e13ffe569/keys/plain interval: 7200 path: ./build/sub1.yaml health-check: enable: true url: http://connectivitycheck.gstatic.com/generate_204 interval: 7200 timeout: 8000 lazy: false expected-status: 204 exclude-filter: '(?i)(🇷🇺|🇹🇷|Россия|Russia|Russian|Турция|Turkey|Moscow|Москва|Petersburg|Петербург|Санкт|\bSPB\b|Beget|Timeweb|Selectel|REG\.RU|FirstVDS|Fornex|UFO\s+Hosting|Yakovlev|rus\.fasti|ru\.fasti|tr\.fasti|wl\.bootless\.ru|wl\.boot-lee|wld\.boot-lee|\bWL\b)' SUB2: type: http url: https://m.creati.win/sub/eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxNjgxODE0NjYifQ.M8ndbnCFCS3tZj2g_nKtMPuXzq-Ob8R_SLg2_zqiV3o interval: 7200 path: ./build/sub2.yaml health-check: enable: true url: http://connectivitycheck.gstatic.com/generate_204 interval: 7200 timeout: 8000 lazy: false expected-status: 204 exclude-filter: '(?i)(🇷🇺|🇹🇷|Россия|Russia|Russian|Турция|Turkey|Moscow|Москва|Petersburg|Петербург|Санкт|\bSPB\b|Beget|Timeweb|Selectel|REG\.RU|FirstVDS|Fornex|UFO\s+Hosting|Yakovlev|rus\.fasti|ru\.fasti|tr\.fasti)' SUB3: type: http url: https://connliberty.com/connection/subs/e859c3a9-9f4d-4c25-8f3b-783c1a37b328 interval: 600 path: ./build/sub3.yaml health-check: enable: true url: http://connectivitycheck.gstatic.com/generate_204 interval: 600 timeout: 8000 lazy: false expected-status: 204 exclude-filter: '(?i)(🇷🇺|🇹🇷|Россия|Russia|Russian|Турция|Turkey|Moscow|Москва|Petersburg|Петербург|Санкт|\bSPB\b|Beget|Timeweb|Selectel|REG\.RU|FirstVDS|Fornex|UFO\s+Hosting|Yakovlev|rus\.fasti|ru\.fasti|tr\.fasti|grinoree\.ru|anriqkeqsd\.online)' SUB4: type: http url: https://prism.ashleyvpn.cloud/app/users/830e0d36-78a6-4bc5-b389-4dce706f1f34/keys/plain interval: 600 path: ./build/sub4.yaml health-check: enable: true url: http://connectivitycheck.gstatic.com/generate_204 interval: 600 timeout: 8000 lazy: false expected-status: 204 exclude-filter: '(?i)(🇷🇺|🇹🇷|Россия|Russia|Russian|Турция|Turkey|Moscow|Москва|Petersburg|Петербург|Санкт|\bSPB\b|Beget|Timeweb|Selectel|REG\.RU|FirstVDS|Fornex|UFO\s+Hosting|Yakovlev|rus\.fasti|ru\.fasti|tr\.fasti)' SUB5: type: http url: https://whiteprism.xyz/sub/dXNlcl8xNjgxODE0NjYsMTc4NTg4NTI1OAr9v8eLMOEt interval: 600 path: ./build/sub5.yaml health-check: enable: true url: http://connectivitycheck.gstatic.com/generate_204 interval: 600 timeout: 8000 lazy: false expected-status: 204 exclude-filter: '(?i)(🇷🇺|🇹🇷|Россия|Russia|Russian|Турция|Turkey|Moscow|Москва|Petersburg|Петербург|Санкт|\bSPB\b|Beget|Timeweb|Selectel|REG\.RU|FirstVDS|Fornex|UFO\s+Hosting|Yakovlev|rus\.fasti|ru\.fasti|tr\.fasti)' proxy-groups: # Generated from subscriptions.yaml / .env URI list # 00-GLOBAL: only the all-provider automatic pool; never Static. - name: 00-GLOBAL type: fallback proxies: [01-AUTO] url: http://connectivitycheck.gstatic.com/generate_204 interval: 600 tolerance: 300 timeout: 8000 expected-status: 204 max-failed-times: 5 empty-fallback: REJECT lazy: false - name: 01-AUTO type: url-test use: [SUB1, SUB2, SUB3, SUB4, SUB5] # One health-tested pool across every raw subscription leaf. url: http://connectivitycheck.gstatic.com/generate_204 interval: 600 tolerance: 300 timeout: 8000 expected-status: 204 max-failed-times: 5 empty-fallback: REJECT lazy: true - name: 02-AUTO-FALLBACK type: fallback proxies: [01-AUTO, 04-STATIC-RELIABLE] url: http://connectivitycheck.gstatic.com/generate_204 interval: 600 tolerance: 300 timeout: 8000 expected-status: 204 max-failed-times: 5 empty-fallback: REJECT lazy: false - name: 03-STATIC type: select use: [SUB1, SUB2, SUB3, SUB4, SUB5] proxies: [DIRECT, REJECT] - name: 04-STATIC-RELIABLE type: select use: [SUB1, SUB2, SUB3, SUB4, SUB5] # Pinned by auto-rank's rolling availability score; never selected by 00-GLOBAL. empty-fallback: REJECT # Static / static-reliable expose all current subscription leaves; Global remains automatic. - name: 20-CURSOR type: select proxies: [DIRECT, 00-GLOBAL, 01-AUTO, 02-AUTO-FALLBACK, 03-STATIC, 04-STATIC-RELIABLE, REJECT] - name: 22-STEAM type: select proxies: [DIRECT, 00-GLOBAL, 01-AUTO, 02-AUTO-FALLBACK, 03-STATIC, 04-STATIC-RELIABLE, REJECT] - name: 23-GAME_UDP type: select # Legacy panel group; catch-all is NETWORK,udp,DIRECT (voice/video exceptions in rules §6) proxies: [DIRECT, 00-GLOBAL, 01-AUTO, 02-AUTO-FALLBACK, 03-STATIC, 04-STATIC-RELIABLE, REJECT] - name: 28-TELEGRAM type: select # 00-GLOBAL first: 03-STATIC is often pinned DIRECT (games) — Telegram needs VPN on RU ISP proxies: [00-GLOBAL, 01-AUTO, 02-AUTO-FALLBACK, 04-STATIC-RELIABLE, 03-STATIC, DIRECT, REJECT] - name: 29-DISCORD type: select proxies: [03-STATIC, 04-STATIC-RELIABLE, 00-GLOBAL, 01-AUTO, 02-AUTO-FALLBACK, DIRECT, REJECT] - name: 24-JETBRAINS type: select proxies: [03-STATIC, 04-STATIC-RELIABLE, 00-GLOBAL, 01-AUTO, 02-AUTO-FALLBACK, DIRECT, REJECT] - name: 32-FIGMA type: select proxies: [03-STATIC, 04-STATIC-RELIABLE, 00-GLOBAL, 01-AUTO, 02-AUTO-FALLBACK, DIRECT, REJECT] - name: 25-PACMAN type: select # Linux package mirrors (Arch, Debian) — DIRECT only; VPN stalls apt bulk downloads proxies: [DIRECT, 00-GLOBAL, 01-AUTO, 02-AUTO-FALLBACK, 03-STATIC, 04-STATIC-RELIABLE, REJECT] - name: 26-XBOX type: select # Default DIRECT (ISP via gateway). xbox-static + pin 03-STATIC leaf for foreign store / non-RU Live. proxies: [DIRECT, 00-GLOBAL, 01-AUTO, 02-AUTO-FALLBACK, 03-STATIC, 04-STATIC-RELIABLE, REJECT] - name: 33-EA type: select # EA / Apex: default DIRECT (ISP egress via mihomo gateway — not to_wan). Pin 03-STATIC only if account needs VPN region. # Game UDP: NETWORK,udp,DIRECT. No local FlClash/Verge full TUN on gaming PC (EAC conflict); router to_vpn stays on. proxies: [DIRECT, 00-GLOBAL, 01-AUTO, 02-AUTO-FALLBACK, 03-STATIC, 04-STATIC-RELIABLE, REJECT] - name: 35-HIREZ type: select # Hi-Rez / Paladins / Smite: auth + EAC + launcher DIRECT via gateway (not 00-GLOBAL). Game UDP: NETWORK,udp,DIRECT. proxies: [DIRECT, 00-GLOBAL, 01-AUTO, 02-AUTO-FALLBACK, 03-STATIC, 04-STATIC-RELIABLE, REJECT] - name: 36-DBD type: select # DBD: 03-STATIC + Vless UDP leaf (not 00-GLOBAL/xhttp — no game UDP). Pin Poland/Finland in panel. proxies: [03-STATIC, 04-STATIC-RELIABLE, 00-GLOBAL, 01-AUTO, 02-AUTO-FALLBACK, DIRECT, REJECT] - name: 27-XBOX_DL type: select proxies: [DIRECT, 00-GLOBAL, 01-AUTO, 02-AUTO-FALLBACK, 03-STATIC, 04-STATIC-RELIABLE, REJECT] # Cloudflare-protected torrent sites — CF blocks many VPN exits; default DIRECT (toggle in panel if ISP blocks) - name: 31-TORRENT_CF type: select proxies: [DIRECT, 00-GLOBAL, 01-AUTO, 02-AUTO-FALLBACK, 03-STATIC, 04-STATIC-RELIABLE, REJECT] # NetBird remote GitLab/NuGet (panel: default DIRECT; do NOT pin 03-STATIC — shared with Discord/z13) - name: 34-NETBIRD-NUGET type: select proxies: [DIRECT, 00-GLOBAL, 01-AUTO, 02-AUTO-FALLBACK, 03-STATIC, 04-STATIC-RELIABLE, REJECT] - name: 37-HOST-TUN type: select # Dashboard Global (to_tun): full tunnel via 00-GLOBAL (TCP); 03-STATIC for UDP voice pin. proxies: [00-GLOBAL, 01-AUTO, 02-AUTO-FALLBACK, 04-STATIC-RELIABLE, 03-STATIC, DIRECT, REJECT] # Dedicated, ordered leaf pool for long-lived TCP. Do not route 00-GLOBAL # here: their latency-driven selection can change underneath an open stream. - name: stable_auto type: fallback # Same dynamic provider pool as 01-AUTO. Keep WhitePrism as a # candidate, but do not strand Cloudflare on it when its Germany leaves # are dead. `use` remains provider-based so offline validation survives # subscription node rotation. use: [SUB1, SUB2, SUB3, SUB4, SUB5] exclude-filter: '(?i)(🇷🇺|🇹🇷|Россия|Russia|Russian|Турция|Turkey|Moscow|Москва|Petersburg|Петербург|Санкт|\bSPB\b|Beget|Timeweb|Selectel|REG\.RU|FirstVDS|Fornex|UFO\s+Hosting|Yakovlev|rus\.fasti|ru\.fasti|tr\.fasti)' url: https://www.cloudflare.com/cdn-cgi/trace interval: 300 tolerance: 500 timeout: 12000 expected-status: 200 max-failed-times: 3 empty-fallback: REJECT lazy: false # Cloudflare Tunnel control stream only. Must never inherit 00-GLOBAL: a # manual/global pin can take all LAN traffic down while recovering :7844. - name: 40-CF-TUNNEL type: select use: [SUB1, SUB2, SUB3, SUB4, SUB5] proxies: [stable_auto, REJECT] rule-providers: local: type: file behavior: classical path: ./rule-providers/local.yaml interval: 86400 ru-direct: type: file behavior: domain format: text path: ./rule-providers/ru-direct.txt interval: 0 jetbrains: type: file behavior: classical path: ./rule-providers/jetbrains.yaml interval: 0 pacman-mirrors: type: file behavior: classical path: ./rule-providers/pacman-mirrors.yaml interval: 0 debian-mirrors: type: file behavior: classical path: ./rule-providers/debian-mirrors.yaml interval: 86400 cursor: type: file behavior: classical path: ./rule-providers/cursor.yaml interval: 0 my-nalog: type: file behavior: classical path: ./rule-providers/my-nalog.yaml interval: 0 banks-ru: type: file behavior: classical path: ./rule-providers/banks-ru.yaml interval: 0 xbox-download: type: file behavior: classical path: ./rule-providers/xbox-download.yaml interval: 0 xbox-cdn-ips: type: file behavior: ipcidr format: text path: ./rule-providers/xbox-cdn-ips.txt interval: 0 dbd-gamelift: type: file behavior: classical path: ./rule-providers/dbd-gamelift.yaml interval: 0 dbd-gamelift-ips: type: file behavior: ipcidr format: text path: ./rule-providers/dbd-gamelift-ips.txt interval: 86400 host-policy: type: file behavior: classical path: ./rule-providers/host-policy.yaml interval: 0 ru-ecosystem: type: file behavior: ipcidr format: text path: ./rule-providers/ru-ecosystem-ipv4.txt interval: 86400 discord-voice-ips: type: file behavior: ipcidr format: text path: ./rule-providers/discord-voice-ips.txt interval: 86400 cloudflare-ips: type: file behavior: ipcidr format: mrs path: ./rule-providers/cloudflare-ips.mrs interval: 86400 discord-voice-legiz: type: file behavior: ipcidr format: mrs path: ./rule-providers/discord-voice-legiz.mrs interval: 86400 discord-vc: type: inline behavior: classical payload: - AND,(NETWORK,udp),(IP-CIDR,138.128.136.0/21),(DST-PORT,50000-50100) - AND,(NETWORK,udp),(IP-CIDR,162.158.0.0/15),(DST-PORT,50000-50100) - AND,(NETWORK,udp),(IP-CIDR,172.64.0.0/13),(DST-PORT,50000-50100) - AND,(NETWORK,udp),(IP-CIDR,34.0.0.0/15),(DST-PORT,50000-50100) - AND,(NETWORK,udp),(IP-CIDR,34.2.0.0/15),(DST-PORT,50000-50100) - AND,(NETWORK,udp),(IP-CIDR,35.192.0.0/12),(DST-PORT,50000-50100) - AND,(NETWORK,udp),(IP-CIDR,35.208.0.0/12),(DST-PORT,50000-50100) - AND,(NETWORK,udp),(IP-CIDR,5.200.14.128/25),(DST-PORT,50000-50100) - AND,(NETWORK,udp),(IP-CIDR,66.22.192.0/18),(DST-PORT,50000-50100) category-ru: type: file behavior: domain format: mrs path: ./rule-providers/category-ru.mrs interval: 86400 geoip-private: type: file behavior: ipcidr format: mrs path: ./rule-providers/geoip-private.mrs interval: 86400 category-ai: type: file behavior: domain format: mrs path: ./rule-providers/category-ai.mrs interval: 86400 google-deepmind: type: file behavior: domain format: mrs path: ./rule-providers/google-deepmind.mrs interval: 86400 speedtest-net: type: file behavior: domain format: mrs path: ./rule-providers/speedtest-net.mrs interval: 86400 remote-control: type: file behavior: domain format: mrs path: ./rule-providers/remote-control.mrs interval: 86400 ru-bundle: type: file behavior: domain format: mrs path: ./rule-providers/ru-bundle.mrs interval: 86400 refilter-domains: type: file behavior: domain format: mrs path: ./rule-providers/refilter-domains.mrs interval: 86400 ru-inside: type: file behavior: domain format: text path: ./rule-providers/ru-inside.lst interval: 86400 rknasnblock: type: file behavior: classical format: mrs path: ./rule-providers/rknasnblock.mrs interval: 86400 geosite-private: type: file behavior: domain format: mrs path: ./rule-providers/geosite-private.mrs interval: 86400 telegram-geoip: type: file behavior: ipcidr format: mrs path: ./rule-providers/telegram-geoip.mrs interval: 86400 torrent-trackers: type: file behavior: domain format: mrs path: ./rule-providers/torrent-trackers.mrs interval: 86400 geoip-for-ru: type: file behavior: ipcidr format: mrs path: ./rule-providers/geoip-for-ru.mrs interval: 86400 ru-inline-banned: type: inline behavior: classical payload: - DOMAIN-SUFFIX,habr.com - DOMAIN-SUFFIX,seasonvar.ru - DOMAIN-SUFFIX,lib.social - DOMAIN-SUFFIX,kemono.su - DOMAIN-SUFFIX,jut.su - DOMAIN-SUFFIX,kara.su - DOMAIN-SUFFIX,theins.ru - DOMAIN-SUFFIX,tvrain.ru - DOMAIN-SUFFIX,echo.msk.ru - DOMAIN-SUFFIX,the-village.ru - DOMAIN-SUFFIX,snob.ru - DOMAIN-SUFFIX,novayagazeta.ru - DOMAIN-SUFFIX,moscowtimes.ru - DOMAIN-SUFFIX,natribu.org - DOMAIN-KEYWORD,yummyanime - DOMAIN-KEYWORD,yummy-anime - DOMAIN-KEYWORD,animeportal - DOMAIN-KEYWORD,anime-portal - DOMAIN-KEYWORD,animedub - DOMAIN-KEYWORD,anidub - DOMAIN-KEYWORD,animelib - DOMAIN-KEYWORD,ikianime - DOMAIN-KEYWORD,anilibria ru-cdn-domains: type: inline behavior: classical payload: - DOMAIN-SUFFIX,mycdn.me - DOMAIN-SUFFIX,yastatic.net - DOMAIN-SUFFIX,yandex.net - DOMAIN-SUFFIX,kinescope.io - DOMAIN-KEYWORD,kinescopecdn - DOMAIN-KEYWORD,diginetica lazymedia-balancers: type: file behavior: domain format: text path: ./rule-providers/lazymedia-balancers.txt interval: 86400 rules: # --- 0 infra DIRECT --- - GEOSITE,connectivity-check,DIRECT - DOMAIN,detectportal.firefox.com,DIRECT - DOMAIN,connectivitycheck.gstatic.com,DIRECT - DOMAIN,clients3.google.com,DIRECT - DOMAIN,clients4.google.com,DIRECT - DOMAIN,www.msftconnecttest.com,DIRECT - DOMAIN,msftconnecttest.com,DIRECT - DOMAIN,ipv6.msftconnecttest.com,DIRECT - DOMAIN,time.xbox.com,DIRECT - DOMAIN,xds.xboxlive.com,DIRECT - DOMAIN,dev.virtualearth.net,DIRECT - DOMAIN,captive.apple.com,DIRECT - DOMAIN-SUFFIX,netbird.io,DIRECT - DOMAIN-SUFFIX,auth0.com,DIRECT # NetBird SOCKS: block all private/LAN pivot (RFC1918 + overlay + link-local) - AND,(SRC-IP-CIDR,100.64.0.0/10),(IP-CIDR,10.0.0.0/8,no-resolve),REJECT - AND,(SRC-IP-CIDR,100.64.0.0/10),(IP-CIDR,172.16.0.0/12,no-resolve),REJECT - AND,(SRC-IP-CIDR,100.64.0.0/10),(IP-CIDR,192.168.0.0/16,no-resolve),REJECT - AND,(SRC-IP-CIDR,100.64.0.0/10),(IP-CIDR,100.64.0.0/10,no-resolve),REJECT - AND,(SRC-IP-CIDR,100.64.0.0/10),(IP-CIDR,127.0.0.0/8,no-resolve),REJECT - AND,(SRC-IP-CIDR,100.64.0.0/10),(IP-CIDR,169.254.0.0/16,no-resolve),REJECT # direct-in (:7894): force ISP egress for explicit proxy clients (bypasses rule chain) - IN-NAME,direct-in,DIRECT # NetBird GitLab/NuGet -> 34-NETBIRD-NUGET (not MATCH,00-GLOBAL / dead AUTO retry) - AND,(IN-NAME,netbird-in),(DOMAIN-SUFFIX,nuget.org),34-NETBIRD-NUGET - AND,(IN-NAME,netbird-in),(DOMAIN-SUFFIX,nuget.dev),34-NETBIRD-NUGET - AND,(IN-NAME,netbird-in),(DOMAIN-SUFFIX,github.com),34-NETBIRD-NUGET - AND,(IN-NAME,netbird-in),(DOMAIN-SUFFIX,githubusercontent.com),34-NETBIRD-NUGET - AND,(IN-NAME,netbird-in),(DOMAIN-SUFFIX,gitlab.com),34-NETBIRD-NUGET # tun-in re-inject drops IN-NAME; SRC 100.64 remains. CONNECT :443 needs this or -> MATCH,00-GLOBAL hang. - AND,(SRC-IP-CIDR,100.64.0.0/10),(DOMAIN-SUFFIX,nuget.org),DIRECT - AND,(SRC-IP-CIDR,100.64.0.0/10),(DOMAIN-SUFFIX,nuget.dev),DIRECT - AND,(SRC-IP-CIDR,100.64.0.0/10),(DOMAIN-SUFFIX,github.com),DIRECT - AND,(SRC-IP-CIDR,100.64.0.0/10),(DOMAIN-SUFFIX,githubusercontent.com),DIRECT - AND,(SRC-IP-CIDR,100.64.0.0/10),(DOMAIN-SUFFIX,gitlab.com),DIRECT # Dashboard Global (to_tun): Discord/Telegram before catch-all (voice UDP + chat TCP) - AND,(RULE-SET,host-policy),(NETWORK,udp),(GEOSITE,discord),29-DISCORD - AND,(RULE-SET,host-policy),(NETWORK,udp),(DOMAIN-SUFFIX,discord.com),29-DISCORD - AND,(RULE-SET,host-policy),(NETWORK,udp),(DOMAIN-SUFFIX,discord.gg),29-DISCORD - AND,(RULE-SET,host-policy),(NETWORK,udp),(DOMAIN-SUFFIX,discord.media),29-DISCORD - AND,(RULE-SET,host-policy),(NETWORK,udp),(DOMAIN-SUFFIX,discordapp.com),29-DISCORD - AND,(RULE-SET,host-policy),(NETWORK,udp),(RULE-SET,discord-voice-ips,no-resolve),(DST-PORT,19200-19500),29-DISCORD - AND,(RULE-SET,host-policy),(NETWORK,udp),(RULE-SET,discord-voice-ips,no-resolve),(DST-PORT,50000-65535),29-DISCORD - AND,(RULE-SET,host-policy),(NETWORK,tcp),(GEOSITE,discord),29-DISCORD - AND,(RULE-SET,host-policy),(NETWORK,tcp),(DOMAIN-SUFFIX,discord.com),29-DISCORD - AND,(RULE-SET,host-policy),(NETWORK,tcp),(DOMAIN-SUFFIX,discord.gg),29-DISCORD - AND,(RULE-SET,host-policy),(NETWORK,tcp),(DOMAIN-SUFFIX,discord.media),29-DISCORD - AND,(RULE-SET,host-policy),(NETWORK,tcp),(DOMAIN-SUFFIX,discordapp.com),29-DISCORD - AND,(RULE-SET,host-policy),(GEOSITE,telegram),28-TELEGRAM - AND,(RULE-SET,host-policy),(DOMAIN-SUFFIX,telegram.org),28-TELEGRAM - AND,(RULE-SET,host-policy),(DOMAIN-SUFFIX,google.com),37-HOST-TUN - AND,(RULE-SET,host-policy),(DOMAIN-SUFFIX,googleapis.com),37-HOST-TUN - AND,(RULE-SET,host-policy),(DOMAIN-SUFFIX,gstatic.com),37-HOST-TUN # Dashboard Global (to_tun): explicit RFC/LAN DIRECT (AND+RULE-SET,local was broken — stole DNS :53) - AND,(RULE-SET,host-policy),(IP-CIDR,192.168.88.0/24,no-resolve),DIRECT - AND,(RULE-SET,host-policy),(IP-CIDR,192.168.89.0/24,no-resolve),DIRECT - AND,(RULE-SET,host-policy),(IP-CIDR,192.168.0.0/16,no-resolve),DIRECT - AND,(RULE-SET,host-policy),(IP-CIDR,10.0.0.0/8,no-resolve),DIRECT - AND,(RULE-SET,host-policy),(IP-CIDR,172.16.0.0/12,no-resolve),DIRECT - AND,(RULE-SET,host-policy),(IP-CIDR,127.0.0.0/8,no-resolve),DIRECT - RULE-SET,host-policy,37-HOST-TUN - RULE-SET,local,DIRECT - RULE-SET,remote-control,DIRECT - DOMAIN-SUFFIX,ads.twitch.tv,DIRECT - DOMAIN-SUFFIX,playlist.ttvnw.net,DIRECT # Public DoH — browser bypasses router DNS; VPN path adds multi-second stalls - DOMAIN-SUFFIX,cloudflare-dns.com,DIRECT - DOMAIN-SUFFIX,dns.google,DIRECT - DOMAIN,dns.google,DIRECT - DOMAIN-SUFFIX,mozilla.cloudflare-dns.com,DIRECT - DOMAIN,one.one.one.one,DIRECT - DOMAIN-SUFFIX,dns.quad9.net,DIRECT # Dev / ads — DIRECT on ISP; must be before GEOIP,private and MATCH,00-GLOBAL (sniffer off) - DOMAIN-SUFFIX,blockchain-ads.com,DIRECT - DOMAIN,blockchain-ads.com,DIRECT # VK / Mail.ru — .com TLD; before SELECTOR/censored and GEOIP,ru - DOMAIN-SUFFIX,vk.com,DIRECT - DOMAIN-SUFFIX,vk.ru,DIRECT - DOMAIN-SUFFIX,vk.me,DIRECT - DOMAIN-SUFFIX,userapi.com,DIRECT - DOMAIN-SUFFIX,vkuser.net,DIRECT - DOMAIN-SUFFIX,vk-portal.net,DIRECT - DOMAIN-SUFFIX,vkuseraudio.net,DIRECT - DOMAIN-SUFFIX,vkuservideo.net,DIRECT - DOMAIN-SUFFIX,vk-cdn.net,DIRECT - DOMAIN-SUFFIX,vk-cdn.me,DIRECT - DOMAIN-SUFFIX,mvk.com,DIRECT # ZONT smart home (my.zont.online — .online TLD, not category-ru) - DOMAIN-SUFFIX,zont.online,DIRECT - DOMAIN-SUFFIX,zont.ru,DIRECT # GitLab — DIRECT on ISP (00-GLOBAL/Finland SUB1 breaks page load) - DOMAIN-SUFFIX,gitlab.com,DIRECT - DOMAIN-SUFFIX,gitlab.io,DIRECT - DOMAIN-SUFFIX,gitlab.net,DIRECT - DOMAIN-SUFFIX,gitlab-static.net,DIRECT - DOMAIN-SUFFIX,gitlab-static.io,DIRECT - DOMAIN-SUFFIX,about.gitlab.com,DIRECT # YouTube (TV/phone/CDN) — 00-GLOBAL -> 01-AUTO (best node). # MUST be before GEOIP,private (fake-ip 198.18.x -> DIRECT trap) - GEOSITE,youtube,00-GLOBAL - DOMAIN-SUFFIX,youtube.com,00-GLOBAL - DOMAIN-SUFFIX,youtu.be,00-GLOBAL - DOMAIN-SUFFIX,googlevideo.com,00-GLOBAL - DOMAIN-SUFFIX,ytimg.com,00-GLOBAL - DOMAIN-SUFFIX,youtube-nocookie.com,00-GLOBAL - DOMAIN-SUFFIX,ggpht.com,00-GLOBAL - DOMAIN-SUFFIX,gvt1.com,00-GLOBAL - DOMAIN-SUFFIX,youtubei.googleapis.com,00-GLOBAL # Google Meet is blocked in Russia; WebRTC UDP already caught by YouTube/Global rules - DOMAIN-SUFFIX,meet.google.com,00-GLOBAL # Google search / account / gstatic — DIRECT on Rules (Global: host-policy catch-all above wins) - DOMAIN,accounts.google.com,DIRECT - DOMAIN-SUFFIX,google.com,DIRECT - DOMAIN-SUFFIX,gstatic.com,DIRECT - DOMAIN-SUFFIX,googleusercontent.com,DIRECT - DOMAIN-SUFFIX,googleapis.com,DIRECT - GEOIP,private,DIRECT,no-resolve - RULE-SET,geoip-private,DIRECT,no-resolve - RULE-SET,geosite-private,DIRECT # --- 1 CURSOR (default DIRECT; switch in 20-CURSOR group) --- - DOMAIN,api2.cursor.sh,20-CURSOR - DOMAIN,api2geo.cursor.sh,20-CURSOR - DOMAIN,api2direct.cursor.sh,20-CURSOR - DOMAIN-SUFFIX,api5.cursor.sh,20-CURSOR - RULE-SET,cursor,20-CURSOR - DOMAIN-SUFFIX,cursor.sh,20-CURSOR - DOMAIN-SUFFIX,cursor.com,20-CURSOR - DOMAIN-SUFFIX,cursorapi.com,20-CURSOR - DOMAIN-SUFFIX,anysphere.co,20-CURSOR - DOMAIN-SUFFIX,toneperfect.app,DIRECT # --- 2 VPN apps (-> 00-GLOBAL / 01-AUTO) --- - RULE-SET,category-ai,00-GLOBAL - RULE-SET,google-deepmind,00-GLOBAL - RULE-SET,speedtest-net,00-GLOBAL # Public BitTorrent trackers (legiz torrent-trackers.mrs) — VPN on router; ae-deb uses ISP bypass at mangle - RULE-SET,torrent-trackers,00-GLOBAL # RU torrent trackers — ISP blocked; before GEOIP,ru / DOMAIN-SUFFIX,ru,DIRECT - DOMAIN-SUFFIX,t-ru.org,00-GLOBAL - DOMAIN-SUFFIX,rutracker.org,00-GLOBAL - DOMAIN-SUFFIX,rutracker.net,00-GLOBAL - DOMAIN-SUFFIX,rutracker.nl,00-GLOBAL - DOMAIN-SUFFIX,rutracker.ru,00-GLOBAL - DOMAIN-KEYWORD,rutracker,00-GLOBAL # RU indexers — ISP blocked; VPN like rutracker (not 31-TORRENT_CF/DIRECT) - DOMAIN-SUFFIX,rutor.org,00-GLOBAL - DOMAIN-SUFFIX,rutor.info,00-GLOBAL - DOMAIN-SUFFIX,rutor.is,00-GLOBAL - DOMAIN-SUFFIX,rutor.net,00-GLOBAL - DOMAIN-SUFFIX,new-rutor.org,00-GLOBAL - DOMAIN-SUFFIX,yotor.ru,00-GLOBAL # Cloudflare front — VPN/datacenter IP often CF 1020/403; default DIRECT in 31-TORRENT_CF - DOMAIN-SUFFIX,bigfangroup.org,31-TORRENT_CF - DOMAIN-SUFFIX,bigfangroup.net,31-TORRENT_CF - DOMAIN-SUFFIX,bigfangroup.name,31-TORRENT_CF - DOMAIN-SUFFIX,freebfg.org,31-TORRENT_CF - DOMAIN-KEYWORD,bigfangroup,31-TORRENT_CF # Magnet/hash shortener (.ru TLD but FI-hosted; DOMAIN-SUFFIX,ru,DIRECT breaks HTTPS on ISP) - DOMAIN-SUFFIX,hashurl.ru,00-GLOBAL - GEOSITE,steam,22-STEAM # Steam downloads / API use many FQDNs not only geosite:steam; without these, GEOIP,ru,DIRECT sends CDN to ISP -> RU region + slow path - DOMAIN-SUFFIX,steampowered.com,22-STEAM - DOMAIN-SUFFIX,steamstatic.com,22-STEAM - DOMAIN-SUFFIX,steamcontent.com,22-STEAM - DOMAIN-SUFFIX,steamserver.net,22-STEAM - DOMAIN-SUFFIX,steamcommunity.com,22-STEAM - DOMAIN-SUFFIX,steam-api.com,22-STEAM - DOMAIN-SUFFIX,steamdeck.net,22-STEAM - DOMAIN-SUFFIX,valvesoftware.com,22-STEAM # Steam downloads often arrive as IP-only flows with sniffer disabled; keep Valve CDN IPs on STEAM group too. - IP-CIDR,155.133.224.0/19,22-STEAM,no-resolve - IP-CIDR,162.254.192.0/21,22-STEAM,no-resolve - IP-CIDR,208.64.200.0/22,22-STEAM,no-resolve # EA / Apex — gameplay + EAC + telemetry DIRECT; auth/API via 33-EA (default DIRECT, still through mihomo gateway) - DOMAIN-SUFFIX,respawn.com,DIRECT - DOMAIN-SUFFIX,apexlegends.com,DIRECT - DOMAIN-SUFFIX,projectapex.com,DIRECT - DOMAIN-SUFFIX,tnt-ea.com,DIRECT - DOMAIN-SUFFIX,easports.com,DIRECT - DOMAIN-SUFFIX,easyanticheat.net,DIRECT - DOMAIN-SUFFIX,eac-cdn.com,DIRECT - DOMAIN-SUFFIX,origin.com,33-EA - DOMAIN-SUFFIX,ea.com,33-EA - GEOSITE,ea,33-EA # Hi-Rez / Paladins / Smite — auth + patches DIRECT; MATCH→00-GLOBAL breaks EAC + launcher on RU ISP - DOMAIN-SUFFIX,hirez.com,35-HIREZ - DOMAIN-SUFFIX,hirezstudios.com,35-HIREZ - DOMAIN-SUFFIX,hirezcdn.com,35-HIREZ - DOMAIN-SUFFIX,paladins.com,35-HIREZ - DOMAIN-SUFFIX,paladinsgame.com,35-HIREZ - DOMAIN-SUFFIX,api.paladins.com,35-HIREZ - DOMAIN-SUFFIX,smitegame.com,35-HIREZ - DOMAIN-SUFFIX,api.smitegame.com,35-HIREZ - DOMAIN-KEYWORD,hirez,35-HIREZ # Fall Guys / Epic — oncatapult (Azure) DIRECT; AWS ol/rtcp blocked from RU ISP → 00-GLOBAL - DOMAIN-SUFFIX,oncatapult.com,DIRECT - DOMAIN-SUFFIX,fallguys.com,DIRECT - DOMAIN-SUFFIX,mediatonic.com,DIRECT - DOMAIN-SUFFIX,rtcp.on.epicgames.com,00-GLOBAL - DOMAIN-SUFFIX,ol.epicgames.com,00-GLOBAL - DOMAIN-SUFFIX,eos-gateway.epicgames.dev,00-GLOBAL - GEOSITE,epicgames,00-GLOBAL - DOMAIN-SUFFIX,epicgames.com,00-GLOBAL - DOMAIN-SUFFIX,epicgames.dev,00-GLOBAL # DBD / Behaviour / GameLift — matchmaking + dedicated servers via VPN (not NETWORK,udp,DIRECT) - RULE-SET,dbd-gamelift,36-DBD - DOMAIN-KEYWORD,bhvr,36-DBD - DOMAIN-SUFFIX,deadbydaylight.com,36-DBD - DOMAIN-KEYWORD,gamelift,36-DBD - RULE-SET,dbd-gamelift-ips,36-DBD,no-resolve # Metin2 / Gameforge — launcher + patch TCP must not use 00-GLOBAL (sniffer off => also in fake-ip-filter) - DOMAIN-SUFFIX,gameforge.com,DIRECT - DOMAIN-SUFFIX,metin2.gameforge.com,DIRECT - DOMAIN-KEYWORD,gameforge,DIRECT - DOMAIN-KEYWORD,metin2,DIRECT # Microsoft account login (M365 + MSN/Hotmail/Outlook) — one path DIRECT; split => login loop - DOMAIN-SUFFIX,login.microsoftonline.com,DIRECT - DOMAIN-SUFFIX,login.microsoft.com,DIRECT - DOMAIN-SUFFIX,microsoftonline.com,DIRECT - DOMAIN,login.live.com,DIRECT - DOMAIN-SUFFIX,account.live.com,DIRECT - DOMAIN-SUFFIX,account.microsoft.com,DIRECT - DOMAIN-SUFFIX,msauth.net,DIRECT - DOMAIN-SUFFIX,msftauth.net,DIRECT - DOMAIN-SUFFIX,hotmail.com,DIRECT - DOMAIN-SUFFIX,outlook.com,DIRECT - DOMAIN-SUFFIX,outlook.live.com,DIRECT - DOMAIN-SUFFIX,msn.com,DIRECT # hsprotect (PerimeterX) captcha on login/signup — VPN exit => "please try again" - DOMAIN-SUFFIX,hsprotect.net,DIRECT - DOMAIN-SUFFIX,perimeterx.net,DIRECT - DOMAIN,fpt.live.com,DIRECT - DOMAIN-SUFFIX,signup.live.com,DIRECT # Windows activation / licensing — DIRECT (VPN path → slmgr 0x8004FE92) - DOMAIN-SUFFIX,sls.microsoft.com,DIRECT - DOMAIN-SUFFIX,licensing.mp.microsoft.com,DIRECT - DOMAIN-SUFFIX,purchase.mp.microsoft.com,DIRECT - DOMAIN,ctldl.windowsupdate.com,DIRECT - DOMAIN-SUFFIX,windowsupdate.com,DIRECT # KMS / Azure activation (*.windows.net — not matched by windows.com → 26-XBOX) - DOMAIN-SUFFIX,core.windows.net,DIRECT - DOMAIN-SUFFIX,vortex-win.data.microsoft.com,DIRECT # Azure OAuth IPs (sniffer off — no hostname) → 26-XBOX, not DIRECT (RU account limits) - IP-CIDR,20.33.0.0/16,26-XBOX,no-resolve - IP-CIDR,20.32.0.0/16,26-XBOX,no-resolve - IP-CIDR,40.76.0.0/14,26-XBOX,no-resolve # Xbox / Microsoft services (panel default 00-GLOBAL → 01-AUTO) - DOMAIN,user.auth.xboxlive.com,26-XBOX - DOMAIN,title.auth.xboxlive.com,26-XBOX - DOMAIN,xsts.auth.xboxlive.com,26-XBOX - DOMAIN-SUFFIX,live.com,26-XBOX - DOMAIN-SUFFIX,xbox.com,26-XBOX - DOMAIN-SUFFIX,microsoft.com,26-XBOX - DOMAIN-SUFFIX,windows.com,26-XBOX # Linux mirrors before xbox-cdn-ips (Fastly 151.101.x overlaps Debian CDN) - GEOSITE,archlinux,25-PACMAN - GEOSITE,debian,25-PACMAN - DOMAIN-KEYWORD,debian,25-PACMAN - DOMAIN-SUFFIX,debian.org,25-PACMAN - DOMAIN-SUFFIX,debian.net,25-PACMAN - IP-CIDR,151.101.0.0/16,25-PACMAN,no-resolve - RULE-SET,debian-mirrors,25-PACMAN - DOMAIN-SUFFIX,cachyos.org,25-PACMAN - RULE-SET,pacman-mirrors,25-PACMAN # SourceForge CDN (CachyOS resources, sf downloads) — VPN/CF stalls a.fsdn.com - GEOSITE,sourceforge,25-PACMAN - DOMAIN-SUFFIX,fsdn.com,25-PACMAN - DOMAIN-SUFFIX,sourceforge.com,25-PACMAN - DOMAIN-SUFFIX,sourceforge.net,25-PACMAN - DOMAIN-SUFFIX,sf.net,25-PACMAN # Xbox: CDN/downloads DIRECT (27); live/auth/social via proxy (26) # Sniffer off → downloads often arrive as raw CDN IPs; match before DOMAIN-SUFFIX xboxlive.com → 26-XBOX. - RULE-SET,xbox-cdn-ips,27-XBOX_DL,no-resolve - DOMAIN,assets1.xboxlive.com,27-XBOX_DL - DOMAIN,assets2.xboxlive.com,27-XBOX_DL - DOMAIN,dlassets-ssl.xboxlive.com,27-XBOX_DL - DOMAIN,images-eds-ssl.xboxlive.com,27-XBOX_DL - RULE-SET,xbox-download,27-XBOX_DL - DOMAIN-SUFFIX,xboxservices.com,26-XBOX - DOMAIN-SUFFIX,xboxlive.com,26-XBOX - RULE-SET,jetbrains,24-JETBRAINS # Figma — all TCP + QUIC/WebSocket on one path (sniffer off: UDP was falling into 23-GAME_UDP) - DOMAIN-SUFFIX,figma.com,32-FIGMA - DOMAIN-SUFFIX,figma.site,32-FIGMA - DOMAIN-SUFFIX,figma.app,32-FIGMA - DOMAIN-SUFFIX,figma-gov.com,32-FIGMA - DOMAIN-SUFFIX,figma-gov.site,32-FIGMA - DOMAIN-SUFFIX,jsdelivr.net,32-FIGMA - DOMAIN-SUFFIX,esm.sh,32-FIGMA # --- 3 FNS / Мой налог DIRECT (before category-ru; VPN breaks lknpd API) --- - RULE-SET,my-nalog,DIRECT # --- 3 RU banks (before GEOIP; VPN breaks apps / 3DS / pinning) --- - RULE-SET,banks-ru,DIRECT # GEOSITE,category-bank-ru omitted — not in Loyalsoldier geosite.dat; banks-ru rule-set covers it # --- 3 RU apps (Firebase RTDB DIRECT; VPN exit breaks Pepper netconn) --- - DOMAIN-SUFFIX,pepper.ru,DIRECT - DOMAIN-SUFFIX,firebasedatabase.app,DIRECT - DOMAIN-SUFFIX,dns.ru,DIRECT - DOMAIN-SUFFIX,dns-shop.ru,DIRECT # --- 3 RU / Ozon DIRECT (before category-ru) --- - IP-ASN,44386,DIRECT,no-resolve - DOMAIN-SUFFIX,ozon.ru,DIRECT - DOMAIN-SUFFIX,ozon.com,DIRECT - DOMAIN-SUFFIX,ozon.by,DIRECT - DOMAIN-SUFFIX,ozon.kz,DIRECT - DOMAIN-SUFFIX,ozonusercontent.com,DIRECT - DOMAIN-SUFFIX,ozone.ru,DIRECT - DOMAIN-SUFFIX,o3.ru,DIRECT - DOMAIN-SUFFIX,o3t.ru,DIRECT # RU banks/NSPK ASN prefixes (router bypass_mihomo primary; safety net if packet hits TUN) - RULE-SET,ru-ecosystem,DIRECT,no-resolve # Sovcombank / Halva: Qrator + pinning; must match by domain before GEOIP - DOMAIN-SUFFIX,sovcombank.ru,DIRECT - DOMAIN-SUFFIX,sovcombank.com,DIRECT - DOMAIN-SUFFIX,halvacard.ru,DIRECT - DOMAIN-SUFFIX,cdndatasource.com,DIRECT - DOMAIN-KEYWORD,sovcom,DIRECT - DOMAIN-KEYWORD,halva,DIRECT # HDRezka / mirrors — keyword catches rotating TLDs (hdrezka.fi, hdrezka9bsbhq.org, etc.) - DOMAIN-KEYWORD,hdrezka,00-GLOBAL - DOMAIN-KEYWORD,rezka,00-GLOBAL # LazyMedia balancers (videocdn/cvh/kinovibe etc.) — dynamic CDNs often missing from ru-bundle.mrs - DOMAIN-KEYWORD,videocdn,00-GLOBAL - DOMAIN-KEYWORD,kinovibe,00-GLOBAL - DOMAIN-KEYWORD,coldcdn,00-GLOBAL - DOMAIN-KEYWORD,ashdi,00-GLOBAL - DOMAIN-KEYWORD,voidboost,00-GLOBAL - DOMAIN-KEYWORD,hdvb,00-GLOBAL - DOMAIN-SUFFIX,apivb.com,00-GLOBAL - RULE-SET,lazymedia-balancers,00-GLOBAL # Telegram + Discord before legiz refilter/ru-inside (those lists include discord.* -> 00-GLOBAL steals voice TCP) - GEOSITE,telegram,28-TELEGRAM - DOMAIN-SUFFIX,telesco.pe,28-TELEGRAM - DOMAIN-SUFFIX,t.me,28-TELEGRAM - DOMAIN-SUFFIX,telegram.me,28-TELEGRAM - RULE-SET,telegram-geoip,28-TELEGRAM,no-resolve - IP-CIDR,149.154.160.0/20,28-TELEGRAM,no-resolve - IP-CIDR,91.108.4.0/22,28-TELEGRAM,no-resolve - IP-CIDR,91.108.8.0/22,28-TELEGRAM,no-resolve - IP-CIDR,91.108.12.0/22,28-TELEGRAM,no-resolve - IP-CIDR,91.108.16.0/22,28-TELEGRAM,no-resolve - IP-CIDR,91.108.20.0/22,28-TELEGRAM,no-resolve - IP-CIDR,91.108.56.0/22,28-TELEGRAM,no-resolve - IP-CIDR,91.105.192.0/23,28-TELEGRAM,no-resolve - RULE-SET,discord-vc,29-DISCORD - AND,(NETWORK,tcp),(GEOSITE,discord),29-DISCORD - AND,(NETWORK,tcp),(DOMAIN-SUFFIX,discord.com),29-DISCORD - AND,(NETWORK,tcp),(DOMAIN-SUFFIX,discord.gg),29-DISCORD - AND,(NETWORK,tcp),(DOMAIN-SUFFIX,discord.media),29-DISCORD - AND,(NETWORK,tcp),(DOMAIN-SUFFIX,discordapp.com),29-DISCORD - AND,(NETWORK,tcp),(DOMAIN-SUFFIX,discordapp.net),29-DISCORD - AND,(NETWORK,tcp),(DOMAIN-SUFFIX,discordcdn.com),29-DISCORD - AND,(NETWORK,tcp),(RULE-SET,discord-voice-ips,no-resolve),29-DISCORD - AND,(NETWORK,tcp),(IP-CIDR,162.159.128.0/17,no-resolve),29-DISCORD - AND,(NETWORK,tcp),(IP-CIDR,34.0.0.0/12,no-resolve),29-DISCORD - AND,(NETWORK,tcp),(IP-CIDR,34.64.0.0/11,no-resolve),29-DISCORD - AND,(NETWORK,tcp),(IP-CIDR,34.96.0.0/11,no-resolve),29-DISCORD - AND,(NETWORK,tcp),(IP-CIDR,35.216.0.0/14,no-resolve),29-DISCORD - AND,(NETWORK,tcp),(IP-CIDR,104.29.0.0/16,no-resolve),29-DISCORD - AND,(NETWORK,tcp),(IP-CIDR,104.16.0.0/14,no-resolve),29-DISCORD - AND,(NETWORK,tcp),(IP-CIDR,66.22.192.0/18,no-resolve),29-DISCORD - AND,(NETWORK,tcp),(IP-CIDR,138.128.0.0/16,no-resolve),29-DISCORD - AND,(NETWORK,tcp),(IP-CIDR,216.198.192.0/18,no-resolve),29-DISCORD # legiz censored stacks — before GEOIP,ru,DIRECT (order: refilter, itdog inside, inline gaps, ASN, bundle) - RULE-SET,refilter-domains,00-GLOBAL - RULE-SET,ru-inside,00-GLOBAL - RULE-SET,ru-inline-banned,00-GLOBAL - RULE-SET,rknasnblock,00-GLOBAL,no-resolve - RULE-SET,ru-bundle,00-GLOBAL # RU CDN domains (legiz ru-inline subset) + foreign CDN IPs (Davoyan geoip-for-ru) - RULE-SET,ru-cdn-domains,DIRECT - RULE-SET,geoip-for-ru,DIRECT,no-resolve - RULE-SET,category-ru,DIRECT - GEOIP,ru,DIRECT,no-resolve - GEOSITE,category-ru,DIRECT - DOMAIN-SUFFIX,ru,DIRECT - DOMAIN-SUFFIX,su,DIRECT - DOMAIN-SUFFIX,lanbook.com,DIRECT - RULE-SET,ru-direct,DIRECT # X5 / Перекресток / Пятерочка: loyalty/auth/apps break or rate-limit when seen from VPN exits - DOMAIN-SUFFIX,5ka.ru,DIRECT - DOMAIN-SUFFIX,5post.ru,DIRECT - DOMAIN-SUFFIX,perekrestok.ru,DIRECT - DOMAIN-SUFFIX,perekrestok.com,DIRECT - DOMAIN-SUFFIX,pyaterochka.ru,DIRECT - DOMAIN-SUFFIX,vprok.ru,DIRECT - DOMAIN-SUFFIX,x5.ru,DIRECT - DOMAIN-SUFFIX,x5.ai,DIRECT - DOMAIN-SUFFIX,x5.com,DIRECT - DOMAIN-SUFFIX,x5.digital,DIRECT - DOMAIN-SUFFIX,x5.group,DIRECT - DOMAIN-SUFFIX,x5.media,DIRECT - DOMAIN-SUFFIX,x5.team,DIRECT - DOMAIN-SUFFIX,x5.tech,DIRECT - DOMAIN-SUFFIX,x5club.ru,DIRECT - DOMAIN-SUFFIX,x5id.ru,DIRECT - DOMAIN-SUFFIX,x5static.net,DIRECT # --- 4 Sber IoT cloud (control APIs DIRECT; block analytics subdomains only) --- - DOMAIN-SUFFIX,devices.sberbank.ru,DIRECT - DOMAIN-SUFFIX,staros-api-md.devices.sberbank.ru,DIRECT - DOMAIN-SUFFIX,ihub.devices.sberbank.ru,DIRECT - DOMAIN-SUFFIX,sberdevices.ru,DIRECT - DOMAIN-SUFFIX,sberdevices.com,DIRECT - DOMAIN-SUFFIX,salute-content.sberdevices.ru,DIRECT - DOMAIN-SUFFIX,cdn.sm.sberdevices.ru,DIRECT - DOMAIN-SUFFIX,clickbeat.sberdevices.ru,DIRECT - DOMAIN-SUFFIX,sberportal.ru,DIRECT - DOMAIN-SUFFIX,sberbox.ru,DIRECT - DOMAIN-SUFFIX,salute.sber,DIRECT - DOMAIN-SUFFIX,analytics.sberdevices.ru,REJECT - DOMAIN-SUFFIX,telemetry.sberdevices.ru,REJECT - DOMAIN-SUFFIX,metrics.sberdevices.ru,REJECT - DOMAIN-SUFFIX,crash-reporting.sberdevices.ru,REJECT - DOMAIN-SUFFIX,logs.sberdevices.ru,REJECT - DOMAIN-SUFFIX,google-analytics.com,REJECT - DOMAIN-SUFFIX,app-measurement.com,REJECT - DOMAIN-SUFFIX,crashlytics.com,REJECT - DOMAIN-SUFFIX,crashlyticsreports-pa.googleapis.com,REJECT - DOMAIN-SUFFIX,adfox.ru,REJECT - DOMAIN-SUFFIX,mytarget.ru,REJECT - DOMAIN-SUFFIX,adriver.ru,REJECT - DOMAIN-SUFFIX,mediarithmics.com,REJECT - DOMAIN-SUFFIX,cdninstagram.com,00-GLOBAL - DOMAIN-SUFFIX,facebook.com,00-GLOBAL - DOMAIN-SUFFIX,x.com,00-GLOBAL - DOMAIN-SUFFIX,twitter.com,00-GLOBAL # IP check sites — show VPN exit (legiz cosmetic) - DOMAIN,ipwho.is,00-GLOBAL - DOMAIN,api.myip.com,00-GLOBAL - DOMAIN,ipapi.co,00-GLOBAL - DOMAIN,ident.me,00-GLOBAL - DOMAIN,ip-api.com,00-GLOBAL - DOMAIN,ipinfo.io,00-GLOBAL - DOMAIN,api.ip.sb,00-GLOBAL - DOMAIN,2ip.io,00-GLOBAL - DOMAIN,2ipcore.com,00-GLOBAL # --- 5b DOMAIN-KEYWORD (O(N) scan; after SUFFIX/RULE-SET/GEOIP/GEOSITE) --- - DOMAIN-KEYWORD,toneperfect,DIRECT - DOMAIN-KEYWORD,lknpd,DIRECT - DOMAIN-KEYWORD,statusnpd,DIRECT - DOMAIN-KEYWORD,ozon,DIRECT - DOMAIN-KEYWORD,perekrestok,DIRECT - DOMAIN-KEYWORD,pyaterochka,DIRECT - DOMAIN-KEYWORD,sberbank,DIRECT - DOMAIN-KEYWORD,tinkoff,DIRECT - DOMAIN-KEYWORD,tbank,DIRECT - DOMAIN-KEYWORD,vtb,DIRECT - DOMAIN-KEYWORD,alfabank,DIRECT - DOMAIN-KEYWORD,gosuslugi,DIRECT - DOMAIN-KEYWORD,gazprombank,DIRECT - DOMAIN-KEYWORD,raiffeisen,DIRECT - DOMAIN-KEYWORD,rosbank,DIRECT - DOMAIN-KEYWORD,nspk,DIRECT - DOMAIN-KEYWORD,mirpay,DIRECT - DOMAIN-KEYWORD,cbr.,DIRECT - DOMAIN-KEYWORD,uralsib,DIRECT - DOMAIN-KEYWORD,rshb,DIRECT - DOMAIN-KEYWORD,psbank,DIRECT - DOMAIN-KEYWORD,tochka,DIRECT - DOMAIN-KEYWORD,openbank,DIRECT # --- 6 UDP: DIRECT default; VPN for voice / video / streaming QUIC only --- - AND,(NETWORK,udp),(GEOSITE,telegram),28-TELEGRAM - AND,(NETWORK,udp),(DOMAIN-SUFFIX,telegram.org),28-TELEGRAM - AND,(NETWORK,udp),(DOMAIN-SUFFIX,t.me),28-TELEGRAM - DST-PORT,596-599,28-TELEGRAM - DST-PORT,1400,28-TELEGRAM - AND,(NETWORK,udp),(RULE-SET,telegram-geoip,no-resolve),28-TELEGRAM - AND,(NETWORK,udp),(GEOSITE,discord),29-DISCORD - AND,(NETWORK,udp),(DOMAIN-SUFFIX,discord.com),29-DISCORD - AND,(NETWORK,udp),(DOMAIN-SUFFIX,discord.gg),29-DISCORD - AND,(NETWORK,udp),(DOMAIN-SUFFIX,discord.media),29-DISCORD - AND,(NETWORK,udp),(DOMAIN-SUFFIX,discordapp.com),29-DISCORD - AND,(NETWORK,udp),(DOMAIN-SUFFIX,discordapp.net),29-DISCORD - AND,(NETWORK,udp),(DOMAIN-SUFFIX,discordcdn.com),29-DISCORD - AND,(NETWORK,udp),(RULE-SET,cloudflare-ips,no-resolve),(DST-PORT,19200-19500),29-DISCORD - AND,(NETWORK,udp),(RULE-SET,cloudflare-ips,no-resolve),(DST-PORT,50000-65535),29-DISCORD - AND,(NETWORK,udp),(RULE-SET,discord-voice-legiz,no-resolve),(DST-PORT,50000-65535),29-DISCORD - AND,(NETWORK,udp),(RULE-SET,discord-voice-ips,no-resolve),(DST-PORT,19200-19500),29-DISCORD - AND,(NETWORK,udp),(RULE-SET,discord-voice-ips,no-resolve),(DST-PORT,50000-65535),29-DISCORD # hCaptcha (Discord / login captcha widget) — bare rule pins TCP + QUIC(UDP/443) to a clean exit. # Without it, hcaptcha QUIC falls to NETWORK,udp,DIRECT -> ISP breaks it -> challenge never renders. - DOMAIN-SUFFIX,hcaptcha.com,00-GLOBAL # Cloudflare Turnstile / managed JS challenge — same QUIC trap as hcaptcha. # Site TCP -> MATCH,00-GLOBAL; challenge QUIC to challenges.cloudflare.com -> NETWORK,udp,DIRECT # => spinner / "checking your browser" never finishes on MikroTik LAN. - DOMAIN-SUFFIX,challenges.cloudflare.com,00-GLOBAL - DOMAIN-SUFFIX,cloudflareinsights.com,00-GLOBAL # Photon Cloud (PEAK + many Unity co-op games) — Exit Games. RU ISP blocks Photon IPs -> "Failed to connect to Photon". # Name server is reached by domain; master/game servers are handed back as raw IPs, so also match by Photon UDP ports. # Ports: legacy 5055-5058, current 27000-27002 (Master/Game/Name). Note: 27000-27002 lightly overlaps Steam client UDP # (harmless — tunnels a sliver of Steam UDP; Steam works over VPN). Does NOT collide with EA/Apex/Hi-Rez game ports. - DOMAIN-SUFFIX,photonengine.io,00-GLOBAL - DOMAIN-SUFFIX,photonengine.com,00-GLOBAL - DOMAIN-SUFFIX,exitgames.com,00-GLOBAL - AND,(NETWORK,udp),(DST-PORT,5055-5058),00-GLOBAL - AND,(NETWORK,udp),(DST-PORT,27000-27002),00-GLOBAL - AND,(NETWORK,udp),(GEOSITE,whatsapp),00-GLOBAL - AND,(NETWORK,udp),(DOMAIN-SUFFIX,whatsapp.com),00-GLOBAL - AND,(NETWORK,udp),(DOMAIN-SUFFIX,whatsapp.net),00-GLOBAL - AND,(NETWORK,udp),(GEOSITE,youtube),00-GLOBAL - AND,(NETWORK,udp),(DOMAIN-SUFFIX,youtube.com),00-GLOBAL - AND,(NETWORK,udp),(DOMAIN-SUFFIX,googlevideo.com),00-GLOBAL - AND,(NETWORK,udp),(DOMAIN-SUFFIX,ytimg.com),00-GLOBAL - AND,(NETWORK,udp),(IP-CIDR,74.125.0.0/16,no-resolve),00-GLOBAL - AND,(NETWORK,udp),(IP-CIDR,64.233.128.0/17,no-resolve),00-GLOBAL - AND,(NETWORK,udp),(IP-CIDR,142.250.0.0/15,no-resolve),00-GLOBAL - AND,(NETWORK,udp),(IP-CIDR,172.217.0.0/16,no-resolve),00-GLOBAL - AND,(NETWORK,udp),(IP-CIDR,216.58.192.0/19,no-resolve),00-GLOBAL - AND,(NETWORK,udp),(IP-CIDR,173.194.0.0/16,no-resolve),00-GLOBAL - AND,(NETWORK,udp),(RULE-SET,lazymedia-balancers,no-resolve),00-GLOBAL - AND,(NETWORK,udp),(DOMAIN-SUFFIX,figma.com),32-FIGMA - AND,(NETWORK,udp),(DOMAIN-SUFFIX,figma.site),32-FIGMA - AND,(NETWORK,udp),(DOMAIN-SUFFIX,figma.app),32-FIGMA - AND,(NETWORK,udp),(RULE-SET,dbd-gamelift),36-DBD - AND,(NETWORK,udp),(DOMAIN-KEYWORD,gamelift),36-DBD - AND,(NETWORK,udp),(DOMAIN-KEYWORD,bhvr),36-DBD - AND,(NETWORK,udp),(DOMAIN-SUFFIX,deadbydaylight.com),36-DBD - AND,(NETWORK,udp),(RULE-SET,dbd-gamelift-ips,no-resolve),(DST-PORT,7770-65535),36-DBD - AND,(NETWORK,udp),(DST-PORT,7770),36-DBD - NETWORK,udp,DIRECT - AND,(NETWORK,tcp),(RULE-SET,dbd-gamelift),36-DBD - AND,(NETWORK,tcp),(DOMAIN-KEYWORD,gamelift),36-DBD - AND,(NETWORK,tcp),(DOMAIN-KEYWORD,bhvr),36-DBD - AND,(NETWORK,tcp),(DOMAIN-SUFFIX,deadbydaylight.com),36-DBD - AND,(NETWORK,tcp),(RULE-SET,dbd-gamelift-ips,no-resolve),36-DBD # Cloudflare Tunnel edge transport. Keep it isolated from 00-GLOBAL: only # official region1/region2 IPv4 ranges on TCP/7844 use this dedicated group. # Ref: docs/incident-2026-07-29-cloudflare-tunnel-1033.md - AND,(NETWORK,tcp),(IP-CIDR,198.41.192.0/24,no-resolve),(DST-PORT,7844),40-CF-TUNNEL - AND,(NETWORK,tcp),(IP-CIDR,198.41.200.0/24,no-resolve),(DST-PORT,7844),40-CF-TUNNEL - AND,(NETWORK,tcp),(DST-PORT,444-65535),DIRECT # --- 7 catch-all --- - MATCH,00-GLOBAL