철저 해설
Clash 코어 고도 설정

# TUN mode configuration
tun:
  enable: true
  stack: mixed        # mixed = gVisor(UDP) + system(TCP), best compatibility
  auto-route: true    # auto-add routing rules for TUN interface
  auto-redirect: true # auto-redirect TCP connections (Linux)
  auto-detect-interface: true
  dns-hijack:
    - any:53           # intercept all DNS queries to prevent leaks
  strict-route: true  # stricter routing, prevents traffic bypass

# proxy groups
proxy-groups:
  - name: PROXY
    type: select
    proxies:
      - Auto-Speed-Test
      - HK-01
      - US-01

  - name: Auto-Speed-Test
    type: url-test
    url: https://www.gstatic.com/generate_204
    interval: 300
    proxies:
      - HK-01
      - US-01

# rule-sets from community-maintained lists
rule-providers:
  reject:
    type: http
    behavior: domain
    url: "https://cdn.jsdelivr.net/gh/Loyalsoldier/clash-rules@release/reject.txt"
    path: ./ruleset/reject.yaml
    interval: 86400

  proxy:
    type: http
    behavior: domain
    url: "https://cdn.jsdelivr.net/gh/Loyalsoldier/clash-rules@release/proxy.txt"
    path: ./ruleset/proxy.yaml
    interval: 86400

  direct:
    type: http
    behavior: domain
    url: "https://cdn.jsdelivr.net/gh/Loyalsoldier/clash-rules@release/direct.txt"
    path: ./ruleset/direct.yaml
    interval: 86400

# rules — matched top to bottom, first match wins
rules:
  - RULE-SET,reject,REJECT       # block ads/trackers
  - RULE-SET,direct,DIRECT       # CN domains → direct
  - RULE-SET,proxy,PROXY         # known proxy domains
  - DOMAIN-SUFFIX,cn,DIRECT
  - GEOIP,LAN,DIRECT
  - GEOIP,CN,DIRECT
  - MATCH,PROXY                  # everything else → proxy

dns:
  enable: true
  ipv6: false
  listen: 0.0.0.0:53
  enhanced-mode: fake-ip      # fake-ip prevents DNS leaks, recommended
  fake-ip-range: 198.18.0.1/16

  # Nameservers for domains NOT matched by nameserver-policy
  nameserver:
    - https://dns.google/dns-query       # Google DoH
    - https://cloudflare-dns.com/dns-query # Cloudflare DoH
    - tls://1.1.1.1:853                    # Cloudflare DoT

  # Fallback: used when nameserver returns potentially polluted result
  fallback:
    - https://dns.google/dns-query
    - https://doh.pub/dns-query             # Tencent DoH (fast in CN)

  # Fallback filter: if GEOIP is CN → use nameserver; else use fallback
  fallback-filter:
    geoip: true
    geoip-code: CN
    ipcidr:
      - 240.0.0.0/4

  # Policy: route specific domains to specific servers
  nameserver-policy:
    "geosite:cn":
      - https://doh.pub/dns-query   # fast domestic resolver for CN domains
      - 114.114.114.114
    "geosite:geolocation-!cn":
      - https://dns.google/dns-query
      - https://cloudflare-dns.com/dns-query

# Reference multiple subscription sources
proxy-providers:
  AirportA:
    type: http
    url: "https://your-airport-a.com/clash/subscribe?token=xxx"
    interval: 86400         # refresh every 24 hours
    path: ./providers/airport_a.yaml
    health-check:
      enable: true
      interval: 600
      url: https://www.gstatic.com/generate_204

  AirportB:
    type: http
    url: "https://your-airport-b.com/clash/subscribe?token=yyy"
    interval: 86400
    path: ./providers/airport_b.yaml
    health-check:
      enable: true
      interval: 600
      url: https://www.gstatic.com/generate_204

# Use providers in proxy groups
proxy-groups:
  - name: PROXY
    type: select
    use:
      - AirportA      # include all nodes from AirportA
      - AirportB      # include all nodes from AirportB

  - name: Auto-Best
    type: url-test
    use:
      - AirportA
      - AirportB
    url: https://www.gstatic.com/generate_204
    interval: 300

proxy-groups:
  # Auto select lowest-latency node
  - name: Auto-Best
    type: url-test
    url: https://www.gstatic.com/generate_204
    interval: 300         # test every 5 minutes
    tolerance: 50          # switch only if new node is 50ms faster (prevents thrashing)
    lazy: true             # only test when traffic is present
    proxies:
      - HK-01
      - HK-02
      - US-01
      - SG-01

  # Failover: use HK-01 first, switch if unavailable
  - name: Failover
    type: fallback
    url: https://www.gstatic.com/generate_204
    interval: 180
    proxies:
      - HK-01       # primary
      - US-01       # backup 1
      - SG-01       # backup 2

  # Load balance across multiple nodes
  - name: LoadBalance
    type: load-balance
    strategy: consistent-hashing  # same domain always uses same node
    url: https://www.gstatic.com/generate_204
    interval: 300
    proxies:
      - HK-01
      - US-01
      - SG-01

  # Manual selection group (top-level entry point)
  - name: PROXY
    type: select
    proxies:
      - Auto-Best
      - Failover
      - LoadBalance
      - HK-01
      - US-01