[General]
bypass-system = true
skip-proxy = localhost, *.local, captive.apple.com
tun-excluded-routes = 10.0.0.0/8, 100.64.0.0/10, 127.0.0.0/8, 169.254.0.0/16, 172.16.0.0/12, 192.0.0.0/24, 192.0.2.0/24, 192.88.99.0/24, 192.168.0.0/16, 198.51.100.0/24, 203.0.113.0/24, 224.0.0.0/4, 255.255.255.255/32, 239.255.255.250/32
dns-server = https://1.1.1.1/dns-query, https://[2606:4700:4700::1111]/dns-query,
fallback-dns-server = https://1.0.0.1/dns-query, https://[2606:4700:4700::1001]/dns-query
dns-direct-system = false

[Rule]
RULE-SET, https://joyus.org/rules/ads.txt, REJECT-200

# Allowlist CDNs and most visited sites
DOMAIN-KEYWORD, cloudflare, DIRECT
DOMAIN-KEYWORD, github, DIRECT
DOMAIN-KEYWORD, google, DIRECT
DOMAIN-SUFFIX, akamaiedge.net, DIRECT
DOMAIN-SUFFIX, akamaihd.net, DIRECT
DOMAIN-SUFFIX, akamaized.net, DIRECT
DOMAIN-SUFFIX, apple.com, DIRECT
DOMAIN-SUFFIX, azureedge.net, DIRECT
DOMAIN-SUFFIX, cdn-apple.com, DIRECT
DOMAIN-SUFFIX, cdn.bsky.app, DIRECT
DOMAIN-SUFFIX, cdnjs.com, DIRECT
DOMAIN-SUFFIX, ch, DIRECT
DOMAIN-SUFFIX, cloudfront.net, DIRECT
DOMAIN-SUFFIX, edgekey.net, DIRECT
DOMAIN-SUFFIX, fastly-edge.com, DIRECT
DOMAIN-SUFFIX, ggpht.com, DIRECT
DOMAIN-SUFFIX, gstatic.com, DIRECT
DOMAIN-SUFFIX, icloud.com, DIRECT
DOMAIN-SUFFIX, mzstatic.com, DIRECT
DOMAIN-SUFFIX, youtu.be, DIRECT
DOMAIN-SUFFIX, youtube.com, DIRECT
DOMAIN-SUFFIX, ytimg.com, DIRECT

# Sites with reCAPTCHA or proxies banning concerns
DOMAIN-SUFFIX, chat.com, DIRECT
DOMAIN-SUFFIX, chatgpt.com, DIRECT
DOMAIN-SUFFIX, claude.ai, DIRECT
DOMAIN-SUFFIX, openai.com, DIRECT
DOMAIN-SUFFIX, schwab.com, DIRECT
DOMAIN-SUFFIX, ubs.com, DIRECT

# NOTE: force-remote-dns won't work when any IP based rules (GEOIP, IP-CIDR,
# IP-ASN) are present. We rely on DoH to protect DNS queries.
FINAL, PROXY