From 6bfd39c8ccb234cc7e8dafc4768f95e7d5cb1721 Mon Sep 17 00:00:00 2001
From: salem <77879189@qq.com>
Date: Thu, 27 Aug 2026 01:04:56 +0800
Subject: [PATCH] =?UTF-8?q?=E6=9B=B4=E6=96=B0=20config/flcalsh/flclash.yam?=
 =?UTF-8?q?l?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 config/flcalsh/flclash.yaml | 32 ++++++++++++++++++++++----------
 1 file changed, 22 insertions(+), 10 deletions(-)

diff --git a/config/flcalsh/flclash.yaml b/config/flcalsh/flclash.yaml
index bc25da5..ca0758e 100644
--- a/config/flcalsh/flclash.yaml
+++ b/config/flcalsh/flclash.yaml
@@ -9,28 +9,40 @@ mode: rule
 log-level: info
 external-controller: 127.0.0.1:9090
 
+mixed-port: 7890
+allow-lan: true
+bind-address: "*"
+mode: rule
+log-level: info
+external-controller: 127.0.0.1:9090
+
 dns:
   enable: true
-  listen: 0.0.0.0:53
+  # listen: 0.0.0.0:53
   ipv6: false
 
-  default-nameserver:
-    - 223.5.5.5
-    - 119.29.29.29
+  default-nameserver: [223.5.5.5, 119.29.29.29]
   enhanced-mode: fake-ip
   fake-ip-range: 198.18.0.1/16
+  fake-ip-filter: 
+    - '*.lan'
+    - "rule-set:salem@cn,GitHub,fake-ip-filter"
+    - 'geosite:cn'
   use-hosts: true
-  nameserver:
-    - https://doh.pub/dns-query
-    - https://dns.alidns.com/dns-query
-  fallback:
-    - https://1.1.1.1/dns-query
+  nameserver: [https://223.5.5.5/dns-query, https://doh.pub/dns-query]
+  fallback: [https://1.1.1.1/dns-query, https://8.8.8.8/dns-query]
   fallback-filter:
     geoip: true
-    geoip-code: CN
+    geoip-code: CN                 # 关键核心：告诉 Stash 只要国内 DNS 解析出的 IP 不在中国境内，就代表被污染/泄露了，必须丢弃！
     ipcidr:
       - 240.0.0.0/4
       - 0.0.0.0/32
+    geosite:                       # 加上这个更保险
+      - gfw
+      - geolocation-!cn
+  nameserver-policy:
+    'geosite:cn': [https://223.5.5.5/dns-query, https://119.29.29.29/dns-query]
+    'rule-set:google,AI,geolocation-!cn': [https://1.1.1.1/dns-query, https://8.8.8.8/dns-query]
   fake-ip-filter: 
     - '*.lan'
     - "rule-set:salem@cn,GitHub,fake-ip-filter"