[General]
bypass-system = true
skip-proxy = 10.0.0.0/8, 100.64.0.0/10, 127.0.0.0/8, 169.254.0.0/16, 172.16.0.0/12, 192.168.0.0/16, 224.0.0.0/4, localhost, *.local, captive.apple.com, sequoia.apple.com, proxy.cal3.li, proxy.cal3.dev, 38.207.175.150
ipv6 = false
prefer-ipv6 = false
dns-server = 223.5.5.5,119.29.29.29
dns-direct-system = false
dns-direct-fallback-proxy = false
icmp-auto-reply = true

[Rule]
# The tunnel endpoints must be DIRECT to prevent recursive routing.
DOMAIN,proxy.cal3.li,DIRECT
DOMAIN,proxy.cal3.dev,DIRECT
IP-CIDR,38.207.175.150/32,DIRECT,no-resolve

# Explicit international exceptions remain on the Popcorn SIM.
RULE-SET,https://raw.githubusercontent.com/blackmatrix7/ios_rule_script/master/rule/Shadowrocket/Apple/Apple.list,DIRECT
RULE-SET,https://raw.githubusercontent.com/blackmatrix7/ios_rule_script/master/rule/Shadowrocket/iCloud/iCloud.list,DIRECT
RULE-SET,https://raw.githubusercontent.com/blackmatrix7/ios_rule_script/master/rule/Shadowrocket/Google/Google.list,DIRECT
RULE-SET,https://raw.githubusercontent.com/blackmatrix7/ios_rule_script/master/rule/Shadowrocket/GitHub/GitHub.list,DIRECT
RULE-SET,https://raw.githubusercontent.com/blackmatrix7/ios_rule_script/master/rule/Shadowrocket/Cloudflare/Cloudflare.list,DIRECT
RULE-SET,https://raw.githubusercontent.com/blackmatrix7/ios_rule_script/master/rule/Shadowrocket/OpenAI/OpenAI.list,DIRECT

# Small supplements for services that have previously escaped the maintained list.
DOMAIN-KEYWORD,didi,WireGuard
DOMAIN-KEYWORD,xiaoju,WireGuard
DOMAIN-KEYWORD,amap,WireGuard
DOMAIN-KEYWORD,autonavi,WireGuard
DOMAIN-KEYWORD,gaode,WireGuard
DOMAIN-KEYWORD,finka,WireGuard

# WeChat core domains only. Do not use USER-AGENT,WeChat* or
# USER-AGENT,MicroMessenger*, because those capture every embedded H5/CDN call.
DOMAIN-SUFFIX,iot-tencent.com,WireGuard
DOMAIN-SUFFIX,lbs.gtimg.com,WireGuard
DOMAIN-SUFFIX,map.qq.com,WireGuard
DOMAIN-SUFFIX,qlogo.cn,WireGuard
DOMAIN-SUFFIX,qpic.cn,WireGuard
DOMAIN-SUFFIX,servicewechat.com,WireGuard
DOMAIN-SUFFIX,tenpay.com,WireGuard
DOMAIN-SUFFIX,vweixinthumb.tc.qq.com,WireGuard
DOMAIN-SUFFIX,wechat.com,WireGuard
DOMAIN-SUFFIX,wechatlegal.net,WireGuard
DOMAIN-SUFFIX,wechatos.net,WireGuard
DOMAIN-SUFFIX,wechatpay.com,WireGuard
DOMAIN-SUFFIX,weixin.com,WireGuard
DOMAIN-SUFFIX,weixin.qq.com,WireGuard
DOMAIN-SUFFIX,weixinbridge.com,WireGuard
DOMAIN-SUFFIX,weixinsxy.com,WireGuard
DOMAIN-SUFFIX,wx.gtimg.com,WireGuard
DOMAIN-SUFFIX,wx.qq.com,WireGuard
DOMAIN-SUFFIX,wxapp.tc.qq.com,WireGuard
DOMAIN-SUFFIX,wxs.qq.com,WireGuard

# Use the domain-only ChinaMax variant. Unlike ChinaMax.list, this file cannot
# apply USER-AGENT,WeChat* / MicroMessenger* to every request made inside WeChat.
# Keeping domain matches before GEOIP also avoids DNS lookups for known domains.
DOMAIN-SET,https://raw.githubusercontent.com/blackmatrix7/ios_rule_script/master/rule/Shadowrocket/ChinaMax/ChinaMax_Domain.list,WireGuard

# Resolve only domains not already classified above, then route CN IPs by WG.
GEOIP,CN,WireGuard

# Unknown/non-China traffic stays on the Popcorn SIM.
FINAL,DIRECT

[Host]
proxy.cal3.dev = 38.207.175.150