Global Services & GFW Rules

The Self-Rule repository provides a collection of custom-maintained traffic-forwarding rules designed for proxy clients like Clash. Based on the ACL4SSR project, its primary purpose is to intelligently route network traffic based on destination domains or IP addresses. This allows users to automatically proxy services that are blocked by firewalls (like the GFW), while maintaining direct connections to domestic or unblocked services for optimal speed and latency.

The system is composed of several layers, including comprehensive GFW lists, a lighter curated proxy list, specific rulesets for popular global services (e.g., AI, Developer tools), and bypass/unban lists to prevent incorrect proxying of essential services. The rules are managed through a semi-automated workflow where simple .list files are converted into Clash-compatible .yaml provider files.

Rule Architecture

The rule system is defined across multiple YAML files, primarily located in the Clash/Providers/ directory. These files serve as "rule providers" that a Clash client can subscribe to.

Rule Syntax

Each rule provider file contains a payload section, which is a list of individual rule definitions. The syntax follows a TYPE,VALUE format.

# Example from Clash/Providers/ProxyLite.yaml
payload:
  # 国外域名关键字
  - DOMAIN-KEYWORD,google
  # Top Blocked Sites
  - DOMAIN-SUFFIX,github.com
  # Amazon
  - IP-CIDR,13.32.0.0/15,no-resolve

Sources: Clash/Providers/ProxyLite.yaml:2-46

The primary rule types used in this repository are summarized below.

Sources: Clash/Providers/ProxyGFWlist.yaml, update_sing_box.py:80-87, Clash/Providers/ProxyLite.yaml

Rule Generation Workflow

The YAML rule providers are not intended to be edited directly. Instead, they are generated from simpler .list files located throughout the Clash/ directory (excluding Clash/Providers/). The update_providers.py script automates this conversion.

The script performs the following actions:

1. Scans the Clash/ directory for .list files.
2. For each .list file, it reads the contents line by line.
3. It creates a corresponding .yaml file in the Clash/Providers/ directory, preserving the original path structure.
4. Each line from the .list file is prepended with - and added to the payload: section of the new YAML file.
5. Lines that are comments (#) or specific rule types not directly supported in the simple format (USER-AGENT, URL-REGEX) are commented out in the output YAML.

This workflow is visualized in the diagram below.

Sources: update_providers.py:12-41

Core Proxy Lists

Two main proxy lists form the foundation of the GFW-bypassing functionality.

ProxyGFWlist.yaml

This is the most comprehensive rule provider, containing thousands of rules derived from the GFW list project. It is designed to ensure that nearly all domains and IP ranges known to be blocked by the GFW are routed through the proxy. It includes domains for major global services, news outlets, social media, and developer tools.

Sources: Clash/Providers/ProxyGFWlist.yaml

ProxyLite.yaml

This is a curated, lightweight version of the proxy list. It includes rules for the most common and essential global services like Google, Facebook, Twitter, and various developer tools, but omits the exhaustive list from ProxyGFWlist.yaml. This provider is suitable for users who prefer a smaller rule set for better performance or have more specific proxying needs.

Sources: Clash/Providers/ProxyLite.yaml

Categorized RuleSets

To provide more granular control, the repository contains numerous specific rulesets in the Clash/Providers/Ruleset/ directory. These allow users to selectively proxy traffic for certain categories of services.

Sources: Clash/Providers/Ruleset/AI.yaml, Clash/Providers/Ruleset/Developer.yaml, Clash/Providers/Ruleset/Github.yaml, Clash/Providers/Microsoft.yaml, Clash/Providers/Ruleset/Scholar.yaml, Clash/Providers/Ruleset/Wikipedia.yaml, Clash/Providers/Ruleset/Crypto.yaml

Bypass and Unban Mechanisms

To ensure that domestic Chinese services and other essential connections are not incorrectly routed through a proxy, the configuration includes several bypass and unban mechanisms.

Clash for Windows System Proxy Bypass

The GeneralClashConfig.yml file defines a cfw-bypass list. This feature, specific to the Clash for Windows client, instructs the system proxy to ignore the specified domains, ensuring they are always connected to directly. The list is extensive and includes hundreds of domains for major Chinese companies and services.

A small sample of the bypass list:

cfw-bypass:
  # Alibaba
  - "*.1688.com"
  - "*.alipay.com"
  - "*.taobao.com"
  # Baidu
  - "*.baidu.com"
  - "*.baidupcs.com"
  # Bilibili
  - "*.bilibili.com"
  - "*.hdslb.com"
  # ByteDance
  - "*.douyin.com"
  - "*.toutiao.com"
  # Tencent
  - "*.qq.com"
  - "*.weixin.com"
  # Local and Private Networks
  - localhost
  - 127.*
  - 192.168.*
  - <local>

Sources: Clash/GeneralClashConfig.yml:211-789

UnBan Rule Provider

The Clash/Providers/UnBan.yaml file serves as a whitelist to prevent certain domains from being blocked or proxied by other, more aggressive rule sets (such as ad-blocking lists, which are not part of this context but are a common use case). For example, it ensures that essential subdomains like dl.google.com (for downloads) and tracking.miui.com (for Xiaomi device functions) are not interfered with.

The following diagram illustrates the simplified rule evaluation logic, highlighting the priority of bypass/unban rules.

Sources: Clash/Providers/UnBan.yaml, Clash/GeneralClashConfig.yml