一份 JSON 拓扑。

ads.example 走 blackhole，RFC1918 前缀与 internal.example 走 direct，其余流走 native 出站。运行 config check 前请换上真实的 REALITY 公钥。

{
  "log": { "level": "info" },
  "inbounds": [
    {
      "tag": "local",
      "type": "mixed",
      "address": ["127.0.0.1:1080"],
      "network": ["tcp", "udp"]
    }
  ],
  "outbounds": [
    {
      "tag": "proxy",
      "type": "native",
      "address": ["proxy.example.com:9443"],
      "token": "change-me",
      "transport": { "type": "raw" },
      "carrier": { "mode": "auto", "prefer": "quic", "udp_mode": "auto" },
      "mux": { "enabled": true },
      "security": {
        "type": "reality",
        "server_name": "example.com",
        "public_key": "REPLACE_WITH_SERVER_PUBLIC_KEY",
        "short_id": "abcd1234",
        "spider_x": "/"
      }
    },
    { "tag": "direct", "type": "direct" },
    { "tag": "block", "type": "blackhole" }
  ],
  "route": {
    "default_outbound": "proxy",
    "rules": [
      { "domain_suffixes": ["ads.example"], "outbound": "block" },
      { "ip_cidrs": ["10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16"], "outbound": "direct" },
      { "domain_suffixes": ["internal.example"], "outbound": "direct" }
    ]
  },
  "dns": {}
}

普通 CLI 流没有应用身份，所以两条规则都不会命中，流量走 direct。嵌入方在 Android 上返回 com.example.reader 且属性 profile=work 时选择 direct。以 com.example.game. 开头的 ID 选择 block。

{
  "log": { "level": "info" },
  "inbounds": [
    {
      "tag": "local",
      "type": "mixed",
      "address": ["127.0.0.1:1080"],
      "network": ["tcp", "udp"]
    }
  ],
  "outbounds": [
    { "tag": "direct", "type": "direct" },
    { "tag": "block", "type": "blackhole" }
  ],
  "route": {
    "default_outbound": "direct",
    "rules": [
      {
        "app": {
          "ids": ["com.example.reader"],
          "platforms": ["android"],
          "attributes": { "profile": ["work"] }
        },
        "outbound": "direct"
      },
      {
        "app": { "id_prefixes": ["com.example.game."] },
        "outbound": "block"
      }
    ]
  },
  "dns": {}
}

remote-access 使用 route_mode rules。已认证用户 alice 可以通过 direct 打开这两个前缀上的 TCP/UDP。其余已接受的流走 deny。这里只展示路由字段，并不导出家庭局域网。

{
  "log": { "level": "info" },
  "inbounds": [
    {
      "tag": "remote-access",
      "type": "native",
      "address": ["0.0.0.0:9443"],
      "network": ["tcp", "udp"],
      "users": [{ "principal": "alice", "id": "change-me" }],
      "transport": { "type": "raw" },
      "mux": { "enabled": true },
      "route_mode": "rules"
    }
  ],
  "outbounds": [
    { "tag": "direct", "type": "direct", "network": ["tcp", "udp"] },
    { "tag": "deny", "type": "blackhole" }
  ],
  "route": {
    "default_outbound": "deny",
    "rules": [
      {
        "inbound": ["remote-access"],
        "principals": ["alice"],
        "network": ["tcp", "udp"],
        "ip_cidrs": ["192.168.50.0/24", "fd12:3456:789a::/64"],
        "outbound": "direct"
      }
    ]
  },
  "dns": {}
}

"mux": {
  "enabled": true,
  "max_sessions": 4,
  "max_streams_per_session": 128,
  "warm_spares": 1
}

"carrier": { "mode": "auto" },
"mux": {
  "enabled": true,
  "resume": true,
  "resume_timeout": "15s",
  "resume_buffer_size": 4194304
}