From 3aef29bab294376e8e030473e83efb17e15d4eb6 Mon Sep 17 00:00:00 2001
From: salem <77879189@qq.com>
Date: Sat, 29 Aug 2026 16:19:42 +0800
Subject: [PATCH] =?UTF-8?q?=E6=9B=B4=E6=96=B0=20config/stash/mrs-test.yaml?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 config/stash/mrs-test.yaml | 84 ++++++++++++--------------------------
 1 file changed, 27 insertions(+), 57 deletions(-)

diff --git a/config/stash/mrs-test.yaml b/config/stash/mrs-test.yaml
index a0a8a52..e4ca7b9 100644
--- a/config/stash/mrs-test.yaml
+++ b/config/stash/mrs-test.yaml
@@ -12,72 +12,42 @@ external-controller: 127.0.0.1:9090  # 外部控制器监听地址，可以使
 ipv6: false                           # 开启 IPv6 总开关，关闭阻断所有 IPv6 链接和屏蔽 DNS 请求 AAAA 记录
 
 dns:
-  enable: true                       # 关闭将使用系统 DNS
-  #listen: 0.0.0.0:7874               # DNS 监听地址
-  ipv6: false                        # IPV6解析开关；如果为false，将返回ipv6结果为空
-  
-  enhanced-mode: fake-ip             # 模式：redir-host或fake-ip
-  fake-ip-range: 198.18.0.1/16       # Fake-IP 解析地址池
-  fake-ip-filter:                    # Fake-ip 过滤，列表中的域名返回真实IP
+  enable: true
+  #listen: 0.0.0.0:7874
+  ipv6: false
+
+  enhanced-mode: fake-ip
+  fake-ip-range: 198.18.0.1/16
+  fake-ip-filter:
     - '*.lan'
+    - '*.local'
     - "rule-set:salem@cn,GitHub,fake-ip-filter"
-    - 'geosite:cn'
-    - '*.lan'
-    - "rule-set:salem@cn,GitHub,fake-ip-filter"
-    - 'geosite:cn'
-    #STUN
-    - '+.stun.*.*'
-    - '+.stun.*.*.*'
-    - '+.stun.*.*.*.*'
-    - '+.stun.*.*.*.*.*'
-    - 'stun.*'
-    - 'ntp.*.com'
-    - 'time.*.com'
-    - 'ntp?.*.com'
-    - 'time?.*.com'
-    - 'time.*.gov'
-    - 'time.*.edu.cn'
-    #微信登录
-    - 'localhost.*.weixin.qq.com'
-    - 'localhost.*.qq.com'
-    #放行NTP服务
-    - 'time.*.apple.com'
-    - 'time-ios.apple.com'
-    - 'time1.*.com'
-    - 'time2.*.com'
-    - 'time3.*.com'
-    - 'time4.*.com'
-    - 'time5.*.com'
-    - 'time6.*.com'
-    - 'time7.*.com'
-    - 'ntp1.*.com'
-    - 'ntp2.*.com'
-    - 'ntp3.*.com'
-    - 'ntp4.*.com'
-    - 'ntp5.*.com'
-    - 'ntp6.*.com'
-    - 'ntp7.*.com'
-    #Microsoft Xbox
-    - 'xbox.*.*.microsoft.com'
-    - '*.*.xboxlive.com'
-    - 'xbox.*.microsoft.com'
-    - '*.xboxlive.com'
+    - 'geosite:private'
+
   use-hosts: true
-  use-system-hosts: true
-    
+  use-system-hosts: false   # 关闭系统hosts，消除旁路泄露
+
+  # default‑nameserver：仅用于解析DoH域名服务器，必须IP
   default-nameserver: [116.228.111.118, 223.5.5.5]
-  nameserver: [1.1.1.1, 8.8.8.8]
+
+  # 顶层全局nameserver：仅国内DNS，禁止填境外DNS！
+  nameserver:
+    - https://doh.pub/dns-query
+
   nameserver-policy:
-    'geosite:cn': 
-    - 116.228.111.118
-    - 223.5.5.5
-    'geosite:geolocation-!cn': [1.1.1.1, 8.8.8.8]
-    'geosite:google': [1.1.1.1, 8.8.8.8]
-    'geosite:category-ai-!cn': [1.1.1.1, 8.8.8.8]
+    # 国内域名走国内DNS
+    'geosite:cn':
+      - 116.228.111.118
+      - 223.5.5.5
+    # 所有非CN，启用fake‑ip，不在本地做DNS查询；这里不要写1.1.1.1/8.8.8.8！
+    # geolocation‑!cn 直接交给fake‑ip，解析在代理远端完成，杜绝本地DNS泄露
+
+  # 仅解析代理节点域名，节点域名的DNS
   proxy-server-nameserver:
     - 223.5.5.5
     - 119.29.29.29
 
+
 # 本地服务器
 proxies: 
 - {name: "🟢 直连", type: direct, udp: true, ip-version: ipv4}