2108 字
11 分钟

sing-box规则配置进阶指南：路由分流、策略组与DNS优化（2026最新）

2026-07-12
代理工具
sing-box
/
代理工具
/
路由规则
/
DNS配置
/
策略组
/
Hysteria2

sing-box 的路由系统是其核心优势之一，比 Clash 更加灵活和强大。本文深入解析 sing-box 的路由分流机制、策略组配置、DNS 防污染优化，帮助你构建高效的代理分流规则。

sing-box规则配置进阶指南

阅读提示

本文与 《sing-box 全平台使用教程》 互为补充：后者聚焦基础配置与全平台安装，本文聚焦路由规则进阶与性能优化。

一、路由系统架构#

1.1 路由处理流程#

连接请求 → 源IP/端口 → 目标域名/IP → 协议检测
              ↓
        路由规则匹配（按顺序）
              ↓
        策略组选择（可选）
              ↓
        出站连接（direct/proxy/reject）

1.2 路由规则类型#

类型说明示例
ip_cidrIP地址段匹配192.168.1.0/24
domain精确域名匹配google.com
domain_suffix域名后缀匹配.google.com
domain_keyword域名关键词匹配google
domain_regex域名正则匹配^.*\.google\.com$
protocol协议匹配http, https, dns
port端口匹配80, 443, 8080
source_ip_cidr源IP匹配192.168.1.100
script脚本规则自定义JS逻辑
rule_set规则集远程加载规则文件

1.3 优先级规则#

route:
  rules:
    # 按顺序匹配，第一个匹配生效
    - type: domain_keyword
      keyword: "google"
      outbound: proxy


    - type: domain_suffix
      suffix: ".cn"
      outbound: direct


    - type: ip_cidr
      cidr: "10.0.0.0/8"
      outbound: direct


    # 默认规则
    - type: default
      outbound: proxy

二、策略组配置#

2.1 策略组类型#

类型说明适用场景
selector手动选择手动切换节点
url_test自动测速选择自动选最快节点
fallback故障转移主备切换
load_balance负载均衡多节点分摊流量
urltest同url_test（别名）自动测速

2.2 Selector 策略组#

outbounds:
  - type: selector
    tag: "auto"
    outbounds:
      - "proxy-hk"
      - "proxy-jp"
      - "proxy-us"
      - "direct"

使用：在路由规则中引用 auto，可通过 API 切换节点。

2.3 URL Test 策略组#

outbounds:
  - type: url_test
    tag: "auto-fast"
    outbounds:
      - "proxy-hk"
      - "proxy-jp"
      - "proxy-us"
    url: "http://www.gstatic.com/generate_204"
    interval: 300
    timeout: 10
    tolerance: 50

配置说明：

参数默认值说明
urlhttp://www.gstatic.com/generate_204测速URL
interval300测速间隔（秒）
timeout10超时时间（秒）
tolerance50容忍度（毫秒）

2.4 Fallback 策略组#

outbounds:
  - type: fallback
    tag: "fallback-group"
    outbounds:
      - "proxy-primary"
      - "proxy-secondary"
      - "direct"
    url: "http://www.gstatic.com/generate_204"
    interval: 60

特点：主节点失败后自动切换到备用节点。

2.5 Load Balance 策略组#

outbounds:
  - type: load_balance
    tag: "lb-group"
    outbounds:
      - "proxy-hk"
      - "proxy-jp"
    strategy: round_robin
    url: "http://www.gstatic.com/generate_204"

策略：

  • round_robin：轮询
  • least_load：最少负载
  • consistent_hash：一致性哈希

2.6 嵌套策略组#

outbounds:
  - type: selector
    tag: "main-selector"
    outbounds:
      - "auto-fast"    # url_test策略组
      - "fallback-group"  # fallback策略组
      - "direct"

三、规则集管理#

3.1 远程规则集#

route:
  rule_set:
    - tag: "geosite-cn"
      type: http
      url: "https://raw.githubusercontent.com/SagerNet/sing-geosite/rule-set/geosite-cn.srs"
      interval: 86400


    - tag: "geoip-cn"
      type: http
      url: "https://raw.githubusercontent.com/SagerNet/sing-geoip/rule-set/geoip-cn.srs"
      interval: 86400


    - tag: "geosite-gfw"
      type: http
      url: "https://raw.githubusercontent.com/SagerNet/sing-geosite/rule-set/geosite-gfw.srs"
      interval: 86400


  rules:
    - type: rule_set
      rule_set: "geosite-cn"
      outbound: direct


    - type: rule_set
      rule_set: "geosite-gfw"
      outbound: proxy


    - type: rule_set
      rule_set: "geoip-cn"
      outbound: direct


    - type: default
      outbound: proxy

3.2 本地规则集#

route:
  rule_set:
    - tag: "my-rules"
      type: file
      path: ./my-rules.srs


  rules:
    - type: rule_set
      rule_set: "my-rules"
      outbound: proxy

创建本地规则集（JSON格式）：

{
  "version": 1,
  "rules": [
    {
      "type": "domain",
      "domain": "example.com"
    },
    {
      "type": "domain_suffix",
      "suffix": ".example.com"
    }
  ]
}

3.3 常用规则集列表#

规则集来源用途
geosite-cnsing-geosite国内域名
geosite-gfwsing-geositeGFW域名
geosite-adssing-geosite广告域名
geosite-googlesing-geositeGoogle服务
geosite-netflixsing-geositeNetflix
geoip-cnsing-geoip国内IP
geoip-privatesing-geoip私有IP
geoip-ussing-geoip美国IP

四、DNS配置与防污染#

4.1 基础DNS配置#

dns:
  servers:
    - tag: "local"
      type: udp
      server: "223.5.5.5"
      detour: direct


    - tag: "remote"
      type: https
      server: "https://8.8.8.8/dns-query"
      detour: proxy


    - tag: "fallback"
      type: https
      server: "https://1.1.1.1/dns-query"
      detour: proxy


  rules:
    - type: domain_suffix
      suffix: ".cn"
      server: local


    - type: domain_keyword
      keyword: "google"
      server: remote


    - type: domain_keyword
      keyword: "facebook"
      server: remote


    - type: default
      server: remote


  cache:
    enable: true
    size: 4096
    ttl: 3600
    min_ttl: 60


  fallback:
    enable: true
    geoip: true
    geoip_code: CN

4.2 DNS over HTTPS/TLS#

dns:
  servers:
    # DNS over HTTPS
    - tag: "cloudflare-doh"
      type: https
      server: "https://cloudflare-dns.com/dns-query"
      detour: proxy


    # DNS over TLS
    - tag: "cloudflare-dot"
      type: tls
      server: "1.1.1.1"
      server_port: 853
      detour: proxy


    # DNS over QUIC
    - tag: "cloudflare-doq"
      type: quic
      server: "1.1.1.1"
      server_port: 853
      detour: proxy

4.3 防污染策略#

dns:
  servers:
    - tag: "safe"
      type: https
      server: "https://doh.pub/dns-query"
      detour: direct


    - tag: "foreign"
      type: https
      server: "https://dns.google/dns-query"
      detour: proxy


  rules:
    # 国内域名用国内DNS
    - type: domain_suffix
      suffix: ".cn"
      server: safe


    # 敏感域名用国外DNS
    - type: domain_keyword
      keyword: "twitter"
      server: foreign


    - type: domain_keyword
      keyword: "youtube"
      server: foreign


  fallback:
    enable: true
    geoip: true
    geoip_code: CN
    strategy: "ipv4_only"


  fakeip:
    enable: true
    range: 198.18.0.0/15

4.4 FakeIP模式#

dns:
  fakeip:
    enable: true
    range: 198.18.0.0/15
    fallback: true
    ipref: true

作用：

  • 将域名解析为虚拟IP（FakeIP）
  • 避免DNS污染导致的IP被污染
  • 减少DNS查询次数

五、高级路由配置示例#

5.1 完整路由配置#

route:
  rules:
    # 直连规则
    - type: ip_cidr
      cidr: "10.0.0.0/8"
      outbound: direct


    - type: ip_cidr
      cidr: "172.16.0.0/12"
      outbound: direct


    - type: ip_cidr
      cidr: "192.168.0.0/16"
      outbound: direct


    - type: ip_cidr
      cidr: "127.0.0.0/8"
      outbound: direct


    - type: rule_set
      rule_set: "geoip-cn"
      outbound: direct


    - type: rule_set
      rule_set: "geosite-cn"
      outbound: direct


    # 代理规则
    - type: rule_set
      rule_set: "geosite-gfw"
      outbound: proxy


    - type: domain_suffix
      suffix: ".google.com"
      outbound: proxy


    - type: domain_suffix
      suffix: ".twitter.com"
      outbound: proxy


    - type: domain_suffix
      suffix: ".youtube.com"
      outbound: proxy


    # 拒绝规则（广告）
    - type: rule_set
      rule_set: "geosite-ads"
      outbound: reject


    # 默认规则
    - type: default
      outbound: proxy

5.2 按协议分流#

route:
  rules:
    # DNS流量走DNS出站
    - type: protocol
      protocol: dns
      outbound: dns-out


    # HTTP流量走代理
    - type: protocol
      protocol: http
      outbound: proxy


    # HTTPS流量走代理
    - type: protocol
      protocol: https
      outbound: proxy


    # SSH直连
    - type: protocol
      protocol: ssh
      outbound: direct


    # 默认
    - type: default
      outbound: proxy

5.3 按端口分流#

route:
  rules:
    # SSH端口直连
    - type: port
      port: 22
      outbound: direct


    # RDP端口直连
    - type: port
      port: 3389
      outbound: direct


    # 游戏端口走低延迟节点
    - type: port
      port: [27015, 7777, 25565]
      outbound: game-proxy


    # 默认
    - type: default
      outbound: proxy

5.4 按源IP分流#

route:
  rules:
    # 内网设备直连
    - type: source_ip_cidr
      cidr: "192.168.1.0/24"
      outbound: direct


    # 特定设备走代理
    - type: source_ip_cidr
      cidr: "192.168.1.100/32"
      outbound: proxy


    # 默认
    - type: default
      outbound: direct

六、流量统计与监控#

6.1 启用流量统计#

experimental:
  cache_file: /path/to/cache.db


inbounds:
  - type: mixed
    tag: "mixed-in"
    listen: 0.0.0.0
    listen_port: 7890
    sniff: true
    sniff_override_destination: true
    domain_strategy: prefer_ipv4
    udp_timeout: 300

6.2 API配置#

experimental:
  api:
    listen: 127.0.0.1:9090
    tag: "api"

API端点：

Terminal window
# 获取状态
curl http://127.0.0.1:9090/v1/status


# 获取流量统计
curl http://127.0.0.1:9090/v1/traffic


# 获取路由规则
curl http://127.0.0.1:9090/v1/routes


# 切换策略组
curl -X POST http://127.0.0.1:9090/v1/outbounds/selector/auto -d '{"outbound": "proxy-hk"}'

6.3 日志配置#

log:
  level: info
  timestamp: true
  output: /path/to/sing-box.log
  format: json

七、性能优化#

7.1 连接复用#

outbounds:
  - type: direct
    tag: "direct"
    mux:
      enabled: true
      concurrency: 8
      protocol: http2


  - type: vmess
    tag: "proxy-vmess"
    server: "example.com"
    server_port: 443
    uuid: "xxx"
    security: "auto"
    mux:
      enabled: true
      concurrency: 8

7.2 传输层优化#

outbounds:
  - type: hysteria2
    tag: "proxy-hy2"
    server: "example.com"
    server_port: 443
    obfs:
      type: "salamander"
      password: "xxx"
    alpn:
      - "h3"
    hop_interval: 10
    hop_interval_jitter: 3
    recv_window_conn: 15728640
    recv_window: 67108864
    max_conn_duration: 1800
    max_conn_count: 10
    disable_mtu_discovery: false

7.3 内存优化#

experimental:
  memory_limit: "512MB"
  cache_file: /path/to/cache.db
  cache_size: 32

7.4 CPU优化#

experimental:
  concurrency: 4
  tcp_fast_open: true

八、常见问题排错#

Q1：路由规则不生效#

排查：

Terminal window
# 检查配置文件语法
sing-box check -c config.json


# 查看日志
tail -f /path/to/sing-box.log


# 测试路由
curl -x socks5://localhost:7890 http://www.google.com

Q2：DNS污染导致连接失败#

解决：

  1. 启用 FakeIP 模式
  2. 配置 DNS over HTTPS/TLS
  3. 按域名分流 DNS 查询
  4. 启用 fallback 策略

Q3：策略组切换不生效#

排查：

Terminal window
# 检查策略组配置
curl http://127.0.0.1:9090/v1/outbounds


# 检查当前选中的出站
curl http://127.0.0.1:9090/v1/outbounds/selector/auto

Q4：规则集加载失败#

解决：

  1. 检查网络连接
  2. 检查规则集URL是否正确
  3. 配置本地规则集作为 fallback

Q5：连接速度慢#

优化：

  1. 启用 mux 多路复用
  2. 调整传输层参数
  3. 使用更快的协议（Hysteria2/QUIC）
  4. 选择更近的节点

九、完整配置示例#

{
  "log": {
    "level": "info",
    "timestamp": true,
    "format": "json"
  },


  "dns": {
    "servers": [
      {
        "tag": "local",
        "type": "udp",
        "server": "223.5.5.5",
        "detour": "direct"
      },
      {
        "tag": "remote",
        "type": "https",
        "server": "https://8.8.8.8/dns-query",
        "detour": "proxy"
      }
    ],
    "rules": [
      {
        "type": "domain_suffix",
        "suffix": ".cn",
        "server": "local"
      },
      {
        "type": "default",
        "server": "remote"
      }
    ],
    "cache": {
      "enable": true,
      "size": 4096
    },
    "fakeip": {
      "enable": true,
      "range": "198.18.0.0/15"
    }
  },


  "inbounds": [
    {
      "type": "mixed",
      "tag": "mixed-in",
      "listen": "0.0.0.0",
      "listen_port": 7890,
      "sniff": true,
      "domain_strategy": "prefer_ipv4"
    }
  ],


  "outbounds": [
    {
      "type": "direct",
      "tag": "direct",
      "mux": {
        "enabled": true
      }
    },
    {
      "type": "hysteria2",
      "tag": "proxy-hk",
      "server": "hk.example.com",
      "server_port": 443,
      "obfs": {
        "type": "salamander",
        "password": "xxx"
      }
    },
    {
      "type": "vmess",
      "tag": "proxy-jp",
      "server": "jp.example.com",
      "server_port": 443,
      "uuid": "xxx",
      "security": "auto"
    },
    {
      "type": "selector",
      "tag": "auto",
      "outbounds": [
        "proxy-hk",
        "proxy-jp",
        "direct"
      ]
    },
    {
      "type": "url_test",
      "tag": "auto-fast",
      "outbounds": [
        "proxy-hk",
        "proxy-jp"
      ],
      "url": "http://www.gstatic.com/generate_204",
      "interval": 300
    }
  ],


  "route": {
    "rule_set": [
      {
        "tag": "geosite-cn",
        "type": "http",
        "url": "https://raw.githubusercontent.com/SagerNet/sing-geosite/rule-set/geosite-cn.srs"
      },
      {
        "tag": "geosite-gfw",
        "type": "http",
        "url": "https://raw.githubusercontent.com/SagerNet/sing-geosite/rule-set/geosite-gfw.srs"
      },
      {
        "tag": "geoip-cn",
        "type": "http",
        "url": "https://raw.githubusercontent.com/SagerNet/sing-geoip/rule-set/geoip-cn.srs"
      }
    ],
    "rules": [
      {
        "type": "rule_set",
        "rule_set": "geosite-cn",
        "outbound": "direct"
      },
      {
        "type": "rule_set",
        "rule_set": "geoip-cn",
        "outbound": "direct"
      },
      {
        "type": "rule_set",
        "rule_set": "geosite-gfw",
        "outbound": "auto-fast"
      },
      {
        "type": "default",
        "outbound": "auto-fast"
      }
    ]
  },


  "experimental": {
    "api": {
      "listen": "127.0.0.1:9090",
      "tag": "api"
    }
  }
}

十、总结#

sing-box 的路由系统提供了强大的分流能力：

特性说明重要性
多维度匹配IP/CIDR/域名/协议/端口⭐⭐⭐⭐⭐
策略组selector/url_test/fallback⭐⭐⭐⭐⭐
规则集远程加载规则⭐⭐⭐⭐
DNS防污染FakeIP/DOH/DOT⭐⭐⭐⭐⭐
API控制动态切换节点⭐⭐⭐

行动建议：

  1. 使用规则集管理大规模规则
  2. 配置策略组实现自动/手动切换
  3. 启用DNS防污染和缓存
  4. 定期更新规则集
  5. 监控流量和连接状态

📚 相关文章推荐#

:::info 免责声明 本文为技术信息分享，不构成任何建议。请遵守当地法律法规，合理使用网络服务。 :::

sing-box规则配置进阶指南：路由分流、策略组与DNS优化（2026最新）
https://971918.xyz/posts/proxy-tools/sing-box-rules-advanced/
作者
九所长
发布于
2026-07-12
许可协议
CC BY-NC-SA 4.0
Quantumult X配置完全指南：iOS高级代理工具从入门到精通（2026最新）
飞牛NAS（fnOS）全平台远程访问完全指南：Tailscale 组网 + DDNS + 内网穿透三方案对比 | 2026
© 2026 九所长. All Rights Reserved. / 关于我们 / 友情链接 / 免责声明 / 服务条款 / 隐私政策 / RSS / Sitemap
Powered by Astro & Fuwari