Config Examples

[piyoki]

Welcome to share your config.dae in this discussion panel. Doing so can definitely benefit the dae community. Thanks in advance.

Geosite based on https://github.com/v2fly/domain-list-community

Regex Standard: https://github.com/google/re2/wiki/Syntax

[youwei5683]

global {
	# 绑定到 LAN 和/或 WAN 接口。将下述接口替换成你自己的接口名。
	lan_interface: eth0
	wan_interface: auto # 使用 "auto" 自动侦测 WAN 接口。
	dial_mode: domain++
	log_level: info
	allow_insecure: false
	auto_config_kernel_parameter: true
	tcp_check_http_method: GET
        check_tolerance: 50ms
	disable_waiting_network: true
}


subscription {}

node {
	chatgpt:'ss://'
	SHENGANGT48:'ss://'
	ZHANXUXIN:'ss://'
	chatgpt:'ss://'
}
dns {
	
        upstream {
                googledns: 'tcp+udp://8.8.8.8:53'
                alidns: 'udp://223.5.5.5:53'
        }
        routing {
          request {  
		#去广告 https://github.com/techprober/v2ray-rules-dat
	
		qname(geosite:category-ads) -> reject
		qname(geosite:category-ads-all) -> reject
		qname(geosite:cn) -> alidns
		fallback: googledns
          }
        }
}

group {

	proxy {
		#filter: subtag(sub)
		filter: name('SHENGANGT48')
      	        filter: name('ShuiMo')[add_latency: 150ms]
		filter: name('ZHANXUXIN')[add_latency: 300ms]
		policy: min_moving_avg
	}	
  	
  	chatgpt {
      	        filter: name('chatgpt')
		policy: min
	}
}
routing {
        pname(NetworkManager, systemd-resolved, dnsmasq) -> must_direct
        dip(224.0.0.0/3) -> direct
        
        #去广告 https://github.com/techprober/v2ray-rules-dat
        domain(geosite:category-ads) -> block
        domain(geosite:category-ads-all) -> block
        domain(gstatic.com) -> proxy
        
        l4proto(udp) && dport(443) && domain(geosite:youtube) -> block
        
        #chatGPT
        domain(openai.com,
                     pay.openai.com,
                     chat.openai.com,
                     challenges.cloudflare.com,
                     auth0.openai.com,
                     platform.openai.com,
                     # Add ai.com
                     ai.com,
                     # Add stripe.com
                     invoice.stripe.com,
                     stripe.com,
                     # Add justmysocks.ne
                     justmysocks.ne) -> chatgpt
        
        dip(geoip:private, geoip:cn) -> direct
        domain(geosite:cn) -> direct
        
        dport(23-65535) -> proxy
        fallback: proxy
}

[WhiteBalance2800K]

###自用 ImmortalWRT，未修改 dnsmasq 设置

global {
  lan_interface: 'br-lan'
  wan_interface: "auto"
  dial_mode: domain
#disable_waiting_network: false
  log_level: trace
  allow_insecure: false
  auto_config_kernel_parameter: true
}

subscription {     
    data: 'https://'
}


dns {
  ipversion_prefer: 4
  upstream {
    puredns: 'udp://221.131.165.165:53'
    alidns: 'udp://dns.alidns.com:53'
  }
  routing {
    request {
      fallback: alidns
    }
    # 根据 DNS 查询的回复， 决定接受或使用其他 upstream 重新查询。
    # 按由上到下的顺序匹配。
    response {
      # 可信的 upstream。总是接受它的回复。
      upstream(puredns) -> accept
      # 非大陆的网站，向 'puredns' 重查。
      !qname(geosite:cn) -> puredns
      # fallback 意为 default。
      fallback: accept
    }
  }
}

group {
  proxy {
    policy: fixed(0)
    filter: name(keyword: 'Hong')
  }
}

routing {
  !mac('xxxx') -> must_direct #白名单模式
  pname('NetworkManager','systemd-resolved','dnsmasq','zerotier-one') -> must_direct
  mac('xxxx') && !dport(21,22,23,53,80,123,143,194,443,465,587,853,993,995,998,2052,2053,2082,2083,2086,2095,2096,3000,8080,8443,8787,8880,8888) -> must_direct #高位端口直连，防止 BT 流量经过代理
  sport(33627,47643) -> must_direct #BT 软件端口
  !dport(53) && l4proto(udp) -> must_direct
  domain(keyword: tracker,announce,torrent) -> direct
  domain(suffix: 'docker.com','githubusercontent.com','themoviedb.org','tmdb.org','telegram.org','fanart.tv') -> proxy #NASTOOL 代理
  domain(suffix: 'torrent.com,'tracker.com') -> direct #BT 软件向 tracker 汇报直连，必须修改为自己的站点
  dip(224.0.0.0/3, 'ff00::/8') -> direct
  dip(geoip:private) -> direct
  dip(geoip:cn) -> direct
  domain(geosite:cn) -> direct

  fallback: proxy

[jdjingdian]

Is there a way to customize node parameters? I need to specify a server address for vless, and ignore SSL certificate.

[jdjingdian]

Sorry for this stupid question, I think I can simply modify the vless link to change the server address, and set allow_insecure: true

[sdttttt]

# 黑名单模式
# 运行在 OpenWRT
# geosite 和 geoip 来自 github.com/Loyalsoldier/v2ray-rules-dat

dns {
	ipversion_prefer: 4
	
        
	upstream {
	  cndns: 'tcp+udp://127.0.0.1:53' # dnsmasq
	  falldns: 'tcp+udp://1.1.1.1:53'
	}
	
	routing {
	  request {
	    qname(ext:'geosite.dat:category-ads-all') -> reject
	    fallback: cndns
	  }
	
	  response {
	            upstream(falldns) -> accept
	            qname(ext:'geosite.dat:private') -> accept
	            ip(geoip:private) && !qname(ext:'geosite.dat:cn') -> falldns
	            fallback: accept
	  }
	}
}

routing {
	pname(NetworkManager, systemd-resolved, dnsmasq) -> must_direct
	
	ipversion(6) -> direct

	# 目标非常用端口都走直连，避免BT流量走代理
	!dport(21,22,23,53,80,123,143,194,443,465,587,853,993,995,998) -> direct
	
	domain(ext:'geosite.dat:category-ads-all') -> block
	
	domain(ext:'geosite:github') -> proxy
	domain(ext:'geosite:telegram') -> proxy
	dip(ext:'geoip:telegram') -> proxy
        # 一般情况下gfw够用
	domain(ext:'geosite:gfw') -> proxy
	
        #domain(ext:'geosite:category-games') -> direct
	#domain(ext:'geosite:geolocation-!cn') -> proxy
	
	fallback: direct
}

[SoraShu]

An example for separated configuration, may be useful for switch config via tools like sed:

Directory Structure:

# tree /etc/dae
/etc/dae
├── config.d
│  ├── dns.dae
│  ├── node.dae
│  └── route.dae
└── config.dae

Config files:

# config.dae
include {
    config.d/*.dae
}
global {
    tproxy_port: 12345

    log_level: warn

    tcp_check_url: 'http://cp.cloudflare.com'
    udp_check_dns: 'dns.google.com:53'
    check_interval: 600s
    check_tolerance: 50ms

    #lan_interface: eth0
    wan_interface: eth0
    allow_insecure: false

    dial_mode: domain
    disable_waiting_network: false
    auto_config_kernel_parameter: true
    sniffing_timeout: 100ms
}

# dns.dae
dns {
    upstream {
        alidns: 'udp://dns.alidns.com:53'
        googledns: 'tcp+udp://dns.google.com:53'
    }

    routing {
        request {
            qname(geosite:category-ads) -> reject
            qname(geosite:category-ads-all) -> reject
            fallback: alidns
        }
        response {
            upstream(googledns) -> accept
            !qname(geosite:cn) && ip(geoip:private) -> googledns
            fallback: accept
        }
    }
}

# node.dae
node {
    node1: 'xxx'
    node2: 'xxx'
}

subscription {
    my_sub: 'https://www.example.com/subscription/link'
}

group {
    my_group {
        filter: subtag(my_sub) && !name(keyword: 'ExpireAt:')
        policy: min_moving_avg
    }

    local_group {
        filter: name(node1, node2)
        policy: fixed(0)
    }
}

# route.dae
routing {
    pname(NetworkManager) -> direct
    dip(224.0.0.0/3, 'ff00::/8') -> direct
    dip(geoip:private) -> direct

    dip(1.14.5.14) -> direct

    domain(geosite:openai) -> local_group
    dip(geoip:cn) -> direct
    domain(geosite:cn) -> direct
    domain(geosite:category-scholar-cn) -> direct
    domain(geosite:geolocation-cn) -> direct


    fallback: my_group
}

[Ziqi-Yang]

校园网下 DNS 和 Routing 的配置。 认证服务器如 lgn.xxxx.edu.cn 在内网。* 表示下一行是重要配置。
DNS

可能git push的时候使用ssh会有点问题，总之我现在用广电卡加移动wifi了，去tm的校园网 :P

dns {
  upstream {
    # * use `dig xxxx.edu.cn ns` or `nslookup -type=ns xxxx.edu.cn` to find the DNS server address
    xxxx: 'udp://10.21.200.28:53'
    googledns: 'tcp+udp://dns.google.com:53'
    alidns: 'udp://dns.alidns.com:53'
  }
  routing {
    request {
      // * A list of address to go through your university DNS server
      qname(full: my.xxxx.edu.cn, full:lgn.xxxx.edu.cn) -> xxxx
      fallback: alidns
    }
    # according to the response, we can decide to query DNS with other DNS upstreams
    response {
      // *
      upstream(xxxx) -> accept
      upstream(googledns) -> accept
      # If DNS request name is not in CN and response answers include private IP, which is most likely polluted
      # in China mainland. Therefore, resend DNS request to 'googledns' to get correct result.
      ip(geoip:private) && !qname(geosite:cn) -> googledns
      fallback: accept
    }
  }
}

Routing

routing {
  pname(NetworkManager) -> direct
  dip(224.0.0.0/3, 'ff00::/8') -> direct

  # * xxxx DNS
  sip(10.21.200.28) && l4proto(udp) && dport(53) -> must_direct
  
  # Disable h3 because it usually consumes too much cpu/mem resources.
  l4proto(udp) && dport(443) -> block
  dip(geoip:private) -> direct  # local address like 127.0.0.1
  dip(geoip:cn) -> direct
  domain(geosite:cn) -> direct

  fallback: proxy
}

[davidtall]

sip(10.21.200.28) && l4proto(udp) && dport(53) -> must_direct 这句不上应该用dip(10.21.200.28) ?

[tsx8]

校园网的网络都会配置校园网的DNS，所以可以不用像楼主这样特殊设置，只需要把dns routing的fallback设置为 asis，回退到上游DNS也就是校园网DNS即可。

[azone]

打开国内网站老是超时和丢包是怎么回事？

[hydroakri]

为nixos提供一下配置样例（需结合flake食用）和引入自定义geodb的思路：

# flake.nix
{
  description = "A simple NixOS flake";

  inputs = {
    nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
    geodb = {
      url = "github:Loyalsoldier/v2ray-rules-dat/release";
      flake = false;
    };
  };

  outputs = { self, nixpkgs, geodb, ... }@inputs: {
    nixosConfigurations.my-nixos = nixpkgs.lib.nixosSystem {
      system = "x86_64-linux";
      modules = [
        ./configuration.nix
      ];
    };
  };
}

# configuration.nix
{ config, pkgs, ... }:

{
  # ......
services.dae = {
      enable = true;
      # configFile = "/etc/dae/config.dae";
      assetsPath = toString (pkgs.symlinkJoin {
        name = "dae-assets";
        paths = [ "${inputs.geodb}" ];
      });
      config = ''
        global {
          dial_mode: domain
          lan_interface: auto
          wan_interface: auto
          log_level: info
          auto_config_kernel_parameter: true
          tcp_check_url: 'http://cp.cloudflare.com,1.1.1.1,2606:4700:4700::1111'
          tcp_check_http_method: HEAD
          check_interval: 30s
          check_tolerance: 50ms
          auto_config_kernel_parameter: true
        }

        node {
          'socks5://localhost:1080'
        }

        dns {
          ipversion_prefer: 4
          upstream {
            alih3: 'h3://dns.alidns.com:443/dns-query'
            localdns: 'udp://127.0.0.1:53'
          }
          routing {
            request {
              qname(geosite:tld-cn, geosite:geolocation-cn, geosite:cn) -> alih3
              fallback: localdns
            }
          }
        }

        group {
            proxy {
                policy: min_moving_avg
            }
        }

        routing {
          pname(NetworkManager, chronyd, dnscrypt-proxy, AdGuardHome, nekoray, nekobox_core, sing-box, verge-mihomo, clash-verge, clash-verge-service) -> must_direct
          dip(224.0.0.0/3, 'ff00::/8', geoip:private) -> must_direct
          domain(geosite:private) -> must_direct
          domain(geosite:category-ads-all) -> block

          domain(geosite:google-cn, geosite:google, tradingview.com) -> proxy
          domain(geosite:apple@cn, geosite:category-games-cn, geosite:category-game-accelerator-cn, geosite:category-game-platforms-download, geosite:category-pt, geosite:category-public-tracker, geosite:category-bank-cn, geosite:category-finance, geosite:category-securities-cn) -> direct

          domain(geosite:gfw, geosite:geolocation-!cn) -> proxy
          !domain(geosite:tld-cn, geosite:geolocation-cn, geosite:cn) -> proxy

          domain(geosite:tld-cn, geosite:geolocation-cn, geosite:cn, geosite:china-list) -> direct

          fallback: proxy
        }
      '';
    };
  # ......
}

[zeus-x99]

我的nixos怎么搞都没办法代理本机，lan是有效的，看日志也没有出现本机的流量

[hydroakri]

开了domain+？

[zeus-x99]

开了domain+？

刚刚解决了，我的是pppoe拨号用的稳定版0.9，换成1.0就可以了

[guiys]

国内网站v4/v6双栈，国外网站仅保留v4。且有国内CDN的国外网站（amd.com/apple.com等）保留直连。不用修改routing{}。没有使用geosite:cn，不知道效率会不会高一点😀
dial_mode: ip

dns {
    upstream {
        googledns: 'tcp+udp://8.8.8.8:53'
    }
    routing {
        request {
            # 所有请求全扔国内DNS
            fallback: asis
        }
 response {
      # 国内站点，以及amd.com/apple.com等，能够返回国内IP，直连。
      ip(geoip:cn) ->accept
      # 在此添加直连白名单
      qname(suffix:***.com) -> accept
      upstream(googledns)  -> accept    
      !qtype(a) -> reject
      fallback: googledns
    }
    }
}

[MaurUppi]

额外的配置

• GeoIP/GeoSite ，Subscription 都单独采用 systemd service/timer 完成更新
• 加入了 Grafito，journal 设置了如下参数持久保存 log，以便于切换期间观察log_level: trace的记录，查找问题。

/etc/systemd/journald.conf

Storage=persistent
SystemMaxUse=10G
MaxRetentionSec=90d
MaxFileSec=1month

config.dae

global {
    log_level: trace
    tproxy_port: 12345
    allow_insecure: false
    check_interval: 900s
    check_tolerance: 50ms
    lan_interface: enp5s0f0np0
    wan_interface: auto
    udp_check_dns: 'dns.google.com:53,8.8.8.8,2001:4860:4860::8888'
    tcp_check_url: 'http://cp.cloudflare.com,1.1.1.1,2606:4700:4700::1111'
    dial_mode: domain
    tcp_check_http_method: HEAD
    disable_waiting_network: true
    enable_local_tcp_fast_redirect: false
    auto_config_kernel_parameter: true
    sniffing_timeout: 100ms
    tls_implementation: tls
    utls_imitate: chrome_auto
    tproxy_port_protect: true
    so_mark_from_dae: 0
    mptcp: false
}

subscription {
     FC: 'FC.sub'
}

dns {
#    ipversion_prefer: 4

    upstream {
      VyOS: 'udp://192.168.1.8:53'
      cloudfare: 'https://1.1.1.1:443/dns-query'
    }

    routing {
      request {
        fallback: VyOS
      }
      
      response {
        ip(geoip:private) && !qname(geosite:cn) -> cloudfare

        fallback: accept
        }
    }
}

group {
    proxy {
        policy: min_moving_avg
        filter: subtag(FC) && name(keyword: 'ABC')
    }

}

routing {
    pname(NetworkManager, systemd-resolved) -> must_direct
    sip(192.168.1.8) && l4proto(udp) && dport(53) -> must_direct

    # 禁用Quic，避免CPU高负载及内存泄露
    # l4proto(udp) && dport(443) -> block

    # IPv4 多播 / 保留地址，或 IPv6 多播地址的流量
    dip(224.0.0.0/3, 'ff00::/8') -> direct
    dip(geoip:private) -> direct

    # 内网网段直连/私有地址使用must规则
    dip(192.168.1.0/24) -> must_direct
    dip(geoip:private) -> direct

    # DSCP rule (match DSCP; is useful for BT bypass)
    dscp(0x4) -> direct

    # 规则 (https://github.com/daeuniverse/dae/blob/main/docs/en/configuration/routing.md)
    ## Example
    ### Multiple domains rule
    # domain(keyword: google, suffix: www.twitter.com, suffix: v2raya.org) -> my_group

    ## Cases
    domain(full:statsig.anthropic.com, suffix: wxs.qq.com) -> block
    domain(keyword: navitime) -> TW
    domain(keyword: ibkr, suffix: oyunfor.com) -> direct
    domain(geosite:microsoft@cn) -> direct

    ## PayPal
    domain(geosite:paypal) -> direct

    ## AppleCN
    domain(geosite:apple@cn) -> direct

    ## SteamCN
    domain(geosite:steam@cn) -> direct
    domain(geosite:category-games@cn) -> direct

    ## WX DOMAIN
    domain(geosite:tencent) -> direct

    ## 国内AI类应用
    domain(geosite:category-ai-cn)  -> direct

    ## 国内IP/域名直连
    dip(geoip:cn) -> direct
    domain(geosite:cn) -> direct
    domain(geosite:china-list) -> direct

    ## 海外AI类应用
    domain(geosite:category-ai-!cn) -> TW

    ## Netflix/Github/telegram/Docker/non-CN
    dip(geoip:netflix) -> proxy
    domain(geosite:netflix) -> proxy
    domain(geosite:github) -> proxy
    dip(geoip:telegram) -> proxy
    domain(geosite:docker) -> proxy
    domain(geosite:category-public-tracker) -> proxy
    domain(geosite:category-cdn-!cn) -> proxy
    domain(geosite:geolocation-!cn) -> proxy

    # 默认出站分组
    fallback: proxy
}

用户不多，所以当前 C3558 的Ubuntu 24.04 机器， dae v1.0 运行情况大于如下

SpeedTest 能跑到千兆宽带极限了，C3558 估计能撑住 NIC 的 2.5G上限。