搜索

默认分类

用singbox重构代理配置

2026.05.25 / 25 阅读 / 0 评论 / 14015 字

默认分类

用singbox重构代理配置

阅读 25 评论 0 发表于2026.05.25

这篇文章记录一次 sing-box 配置重构。

这次重构的目标不是“堆功能”，而是把代理配置整理成更清晰、更可维护、更适合长期使用的结构。

核心目标：

节点信息不暴露。
策略组职责清楚。
DNS、TUN、FakeIP、路由规则各司其职。
尽量适配 Windows、iOS、OpenWrt。
不使用无意义的默认字段。
不写 sing-box 官方核心不支持的伪配置。

为什么最终选择 sing-box

如果只是导入订阅、切换节点，mihomo 已经非常成熟。

但我最后还是选择了 sing-box，原因主要有几个：

DNS 控制能力更强，可以细分本地 DNS、远程 DNS、FakeIP、DNS 反向映射。
TUN 配置更工程化，适合多平台统一维护。
路由规则支持 sniff、hijack-dns、reject 等规则动作。
原生支持 .srs 二进制规则集。
对 Hysteria2、AnyTLS、VLESS Reality、Shadowsocks 2022 等协议支持完整。
配置结构清晰，长期维护成本更低。

简单说，mihomo 更偏“易用客户端”，sing-box 更像“网络工具箱”。

策略组设计

总策略组

总入口只放地区策略组，不直接放具体节点：

{
  "tag": "PROXY",
  "type": "selector",
  "outbounds": [
    "HK",
    "TW",
    "SG",
    "US"
  ],
  "interrupt_exist_connections": true
}

这样做的好处是入口干净，不暴露真实节点，也方便按地区维护。

下载策略组

下载场景和普通网页代理不一样。比如 IDM 这类多线程下载器，如果跟随复杂策略组，容易出现连接不稳定或服务器拒绝连接。

所以我单独做了 DOWNLOAD 组。

DOWNLOAD 只包含：

DIRECT
所有裸节点

不包含 HK、TW、SG、US 这种地区策略组。

{
  "tag": "DOWNLOAD",
  "type": "selector",
  "outbounds": [
    "DIRECT",
    "HK-01",
    "HK-02",
    "TW-01",
    "TW-02",
    "SG-01",
    "SG-02",
    "US-01",
    "US-02"
  ],
  "interrupt_exist_connections": true
}

Windows 下可以用进程名匹配 IDM：

{
  "process_name": [
    "IDMan.exe",
    "IEMonitor.exe"
  ],
  "action": "route",
  "outbound": "DOWNLOAD"
}

这里不是“嗅探 exe”，而是 sing-box 的进程名匹配。它主要适用于 Windows、Linux、macOS。iOS 不支持进程级匹配，OpenWrt 也无法识别局域网客户端中的进程。

地区策略组

每个地区都采用：

一个手动选择组
一个 urltest 自动优选组
若干节点

例如香港：

{
  "tag": "HK",
  "type": "selector",
  "outbounds": [
    "HK-AUTO",
    "HK-01",
    "HK-02"
  ],
  "interrupt_exist_connections": true
}

{
  "tag": "HK-AUTO",
  "type": "urltest",
  "outbounds": [
    "HK-01",
    "HK-02"
  ],
  "interrupt_exist_connections": true
}

sing-box 官方核心没有 mihomo 风格的 fallback / load-balance 出站类型。为了保证配置干净、可导入、可维护，这里只使用官方支持的 selector 和 urltest。

节点命名规则

为了公开展示时不暴露真实信息，节点全部做了匿名化。

地区	命名
香港	`HK-01`、`HK-02`
台湾	`TW-01`、`TW-02`
新加坡	`SG-01`、`SG-02`
美国	`US-01`、`US-02`

节点协议模板

VLESS Reality

{
  "tag": "HK-01",
  "type": "vless",
  "server": "hk-01.example.com",
  "server_port": 443,
  "uuid": "00000000-0000-0000-0000-000000000000",
  "flow": "xtls-rprx-vision",
  "network": "tcp",
  "tls": {
    "enabled": true,
    "server_name": "www.example.com",
    "utls": {
      "enabled": true,
      "fingerprint": "chrome"
    },
    "reality": {
      "enabled": true,
      "public_key": "REALITY_PUBLIC_KEY",
      "short_id": "REALITY_SHORT_ID"
    }
  }
}

Hysteria2

{
  "tag": "HK-02",
  "type": "hysteria2",
  "server": "hk-02.example.com",
  "server_ports": [
    "20000:30000"
  ],
  "password": "HY2_PASSWORD",
  "tls": {
    "enabled": true,
    "server_name": "www.example.com",
    "alpn": [
      "h3"
    ]
  },
  "hop_interval": "30s",
  "hop_interval_max": "60s",
  "up_mbps": 100,
  "down_mbps": 100
}

如果服务端使用自签证书，需要在 tls 中加入：

"insecure": true

AnyTLS

{
  "tag": "TW-01",
  "type": "anytls",
  "server": "tw-01.example.com",
  "server_port": 443,
  "password": "ANYTLS_PASSWORD",
  "tls": {
    "enabled": true,
    "server_name": "www.example.com"
  }
}

如果服务端配置了 padding_scheme，客户端不用写。padding_scheme 是 AnyTLS 服务端字段，不是客户端字段。

Shadowsocks 2022 + smux

{
  "tag": "TW-02",
  "type": "shadowsocks",
  "server": "tw-02.example.com",
  "server_port": 443,
  "method": "2022-blake3-aes-128-gcm",
  "password": "SS2022_PASSWORD",
  "multiplex": {
    "enabled": true,
    "protocol": "smux"
  }
}

完整配置模板

下面是一份可替换自用的完整模板。

{
  "log": {
    "level": "warn",
    "timestamp": true
  },
  "dns": {
    "servers": [
      {
        "tag": "dns-local",
        "type": "https",
        "server": "223.5.5.5",
        "tls": {
          "server_name": "dns.alidns.com"
        }
      },
      {
        "tag": "dns-remote",
        "type": "tls",
        "server": "8.8.8.8",
        "tls": {
          "server_name": "dns.google"
        },
        "detour": "PROXY"
      },
      {
        "tag": "dns-fakeip",
        "type": "fakeip",
        "inet4_range": "198.18.0.0/15"
      }
    ],
    "rules": [
      {
        "query_type": "HTTPS",
        "action": "reject"
      },
      {
        "domain": "localhost",
        "action": "route",
        "server": "dns-local"
      },
      {
        "domain_suffix": [
          "local",
          "lan",
          "home.arpa",
          "msftconnecttest.com",
          "msftncsi.com"
        ],
        "action": "route",
        "server": "dns-local"
      },
      {
        "rule_set": "geosite-ads",
        "action": "reject"
      },
      {
        "rule_set": [
          "geosite-douyin",
          "geosite-bytedance",
          "geosite-apple",
          "geosite-cn",
          "geolocation-cn"
        ],
        "action": "route",
        "server": "dns-local"
      },
      {
        "query_type": "A",
        "action": "route",
        "server": "dns-fakeip"
      }
    ],
    "final": "dns-remote",
    "strategy": "prefer_ipv4",
    "optimistic": true,
    "reverse_mapping": true
  },
  "http_clients": [
    {
      "tag": "rule-download",
      "detour": "PROXY"
    }
  ],
  "inbounds": [
    {
      "tag": "tun-in",
      "type": "tun",
      "address": [
        "172.19.0.1/30",
        "fdfe:dcba:9876::1/126"
      ],
      "mtu": 1400,
      "auto_route": true,
      "strict_route": true,
      "route_exclude_address": [
        "10.0.0.0/8",
        "100.64.0.0/10",
        "127.0.0.0/8",
        "169.254.0.0/16",
        "172.16.0.0/12",
        "192.168.0.0/16",
        "224.0.0.0/4",
        "240.0.0.0/4",
        "::1/128",
        "fc00::/7",
        "fe80::/10",
        "ff00::/8",
        "223.5.5.5/32"
      ]
    },
    {
      "tag": "mixed-in",
      "type": "mixed",
      "listen": "127.0.0.1",
      "listen_port": 7890
    }
  ],
  "outbounds": [
    {
      "tag": "PROXY",
      "type": "selector",
      "outbounds": [
        "HK",
        "TW",
        "SG",
        "US"
      ],
      "interrupt_exist_connections": true
    },
    {
      "tag": "DOWNLOAD",
      "type": "selector",
      "outbounds": [
        "DIRECT",
        "HK-01",
        "HK-02",
        "TW-01",
        "TW-02",
        "SG-01",
        "SG-02",
        "US-01",
        "US-02"
      ],
      "interrupt_exist_connections": true
    },
    {
      "tag": "YOUTUBE",
      "type": "selector",
      "outbounds": [
        "HK",
        "US"
      ],
      "interrupt_exist_connections": true
    },
    {
      "tag": "AI",
      "type": "selector",
      "outbounds": [
        "TW",
        "US"
      ],
      "interrupt_exist_connections": true
    },
    {
      "tag": "TIKTOK",
      "type": "selector",
      "outbounds": [
        "TW",
        "SG",
        "US"
      ],
      "interrupt_exist_connections": true
    },
    {
      "tag": "SPEEDTEST",
      "type": "selector",
      "outbounds": [
        "HK",
        "TW",
        "SG",
        "US"
      ],
      "interrupt_exist_connections": true
    },
    {
      "tag": "HK",
      "type": "selector",
      "outbounds": [
        "HK-AUTO",
        "HK-01",
        "HK-02"
      ],
      "interrupt_exist_connections": true
    },
    {
      "tag": "TW",
      "type": "selector",
      "outbounds": [
        "TW-AUTO",
        "TW-01",
        "TW-02"
      ],
      "interrupt_exist_connections": true
    },
    {
      "tag": "SG",
      "type": "selector",
      "outbounds": [
        "SG-AUTO",
        "SG-01",
        "SG-02"
      ],
      "interrupt_exist_connections": true
    },
    {
      "tag": "US",
      "type": "selector",
      "outbounds": [
        "US-AUTO",
        "US-01",
        "US-02"
      ],
      "interrupt_exist_connections": true
    }
  ],
  "route": {
    "default_http_client": "rule-download",
    "default_domain_resolver": "dns-local",
    "auto_detect_interface": true,
    "rules": [
      {
        "type": "logical",
        "mode": "or",
        "rules": [
          {
            "protocol": "dns"
          },
          {
            "port": 53
          }
        ],
        "action": "hijack-dns"
      },
      {
        "clash_mode": "Direct",
        "action": "route",
        "outbound": "DIRECT"
      },
      {
        "clash_mode": "Global",
        "action": "route",
        "outbound": "PROXY"
      },
      {
        "domain_suffix": [
          "msftconnecttest.com",
          "msftncsi.com"
        ],
        "action": "route",
        "outbound": "DIRECT"
      },
      {
        "network": "tcp",
        "port": 80,
        "action": "sniff",
        "sniffer": [
          "http"
        ]
      },
      {
        "network": "tcp",
        "port": [
          443,
          8443
        ],
        "action": "sniff",
        "sniffer": [
          "tls"
        ]
      },
      {
        "network": "udp",
        "port": 443,
        "action": "sniff",
        "sniffer": [
          "quic"
        ]
      },
      {
        "rule_set": "geosite-ads",
        "action": "reject"
      },
      {
        "process_name": [
          "IDMan.exe",
          "IEMonitor.exe"
        ],
        "action": "route",
        "outbound": "DOWNLOAD"
      },
      {
        "rule_set": [
          "geosite-douyin",
          "geosite-bytedance"
        ],
        "action": "route",
        "outbound": "DIRECT"
      },
      {
        "rule_set": "geosite-ai",
        "action": "route",
        "outbound": "AI"
      },
      {
        "rule_set": "geosite-youtube",
        "action": "route",
        "outbound": "YOUTUBE"
      },
      {
        "rule_set": [
          "geosite-cn",
          "geolocation-cn"
        ],
        "action": "route",
        "outbound": "DIRECT"
      },
      {
        "rule_set": "geolocation-!cn",
        "action": "route",
        "outbound": "PROXY"
      },
      {
        "ip_cidr": "198.18.0.0/15",
        "action": "route",
        "outbound": "PROXY"
      },
      {
        "ip_is_private": true,
        "action": "route",
        "outbound": "DIRECT"
      },
      {
        "rule_set": "geoip-cn",
        "action": "route",
        "outbound": "DIRECT"
      }
    ],
    "rule_set": [
      {
        "tag": "geoip-cn",
        "type": "remote",
        "url": "https://raw.githubusercontent.com/SagerNet/sing-geoip/rule-set/geoip-cn.srs"
      },
      {
        "tag": "geosite-cn",
        "type": "remote",
        "url": "https://raw.githubusercontent.com/SagerNet/sing-geosite/rule-set/geosite-cn.srs"
      },
      {
        "tag": "geolocation-cn",
        "type": "remote",
        "url": "https://raw.githubusercontent.com/SagerNet/sing-geosite/rule-set/geosite-geolocation-cn.srs"
      },
      {
        "tag": "geolocation-!cn",
        "type": "remote",
        "url": "https://raw.githubusercontent.com/SagerNet/sing-geosite/rule-set/geosite-geolocation-!cn.srs"
      },
      {
        "tag": "geosite-ads",
        "type": "remote",
        "url": "https://raw.githubusercontent.com/SagerNet/sing-geosite/rule-set/geosite-category-ads-all.srs"
      },
      {
        "tag": "geosite-youtube",
        "type": "remote",
        "url": "https://raw.githubusercontent.com/SagerNet/sing-geosite/rule-set/geosite-youtube.srs"
      },
      {
        "tag": "geosite-ai",
        "type": "remote",
        "url": "https://raw.githubusercontent.com/SagerNet/sing-geosite/rule-set/geosite-category-ai-!cn.srs"
      },
      {
        "tag": "geosite-douyin",
        "type": "remote",
        "url": "https://raw.githubusercontent.com/SagerNet/sing-geosite/rule-set/geosite-douyin.srs"
      },
      {
        "tag": "geosite-bytedance",
        "type": "remote",
        "url": "https://raw.githubusercontent.com/SagerNet/sing-geosite/rule-set/geosite-bytedance.srs"
      }
    ],
    "final": "PROXY"
  },
  "experimental": {
    "cache_file": {
      "enabled": true,
      "cache_id": "template",
      "store_fakeip": true,
      "store_dns": true
    }
  }
}

广告拦截

这份配置使用域名级广告拦截：

{
  "rule_set": "geosite-ads",
  "action": "reject"
}

它可以处理一部分广告域名、统计域名、追踪域名。

但它不能彻底处理：

YouTube 贴片广告。
与正文同域的网页广告。
需要元素隐藏的网页广告。

这是域名级拦截的正常边界。

嗅探规则

配置只保留有实际分流价值的嗅探：

http
tls
quic

这样可以提升域名分流准确性，尤其是 FakeIP 场景下。

和 mihomo / Clash 的区别

mihomo 更适合订阅导入和图形化使用，使用门槛低。

sing-box 更适合精细化控制。

这份配置用到的一些 sing-box 特性包括：

dns.fakeip
dns.reverse_mapping
dns.optimistic
route.action: hijack-dns
route.action: sniff
network_interface_address
default_interface_address
远程 .srs 规则集
http_clients
cache_file.store_fakeip
cache_file.store_dns
Hysteria2 端口跳跃
AnyTLS
Shadowsocks 2022 + smux

如果只是日常用代理，mihomo 足够。

如果想把 DNS、TUN、分流、FakeIP 和协议细节都控制清楚，sing-box 更值得长期维护。

使用建议

替换所有 example.com、PASSWORD、UUID、PUBLIC_KEY 等占位符。
如果节点服务器直接写 IP，建议把节点 IP 加入 route_exclude_address。
如果 Hysteria2 使用自签证书，在对应 tls 中添加 "insecure": true。
iOS 不支持进程名匹配，process_name 规则不会生效。
OpenWrt 无法识别局域网客户端进程，只能匹配路由器本机进程。
如果客户端不支持 AnyTLS，请升级到支持对应 sing-box 版本的客户端。

本文著作权归作者 [ Miku ] 享有，未经作者书面授权，禁止转载，封面图片来源于 [ 互联网 ] ，本文仅供个人学习、研究和欣赏使用。如有异议，请联系博主及时处理。

— END —

搜索

标签

用singbox重构代理配置

用singbox重构代理配置

为什么最终选择 sing-box

策略组设计

总策略组

下载策略组

地区策略组

节点命名规则

节点协议模板

VLESS Reality

Hysteria2

AnyTLS

Shadowsocks 2022 + smux

完整配置模板

广告拦截

嗅探规则

和 mihomo / Clash 的区别

使用建议