https://github.com/SagerNet/sing-box

https://sing-box.sagernet.org/zh/configuration/

https://sing-box-dashboard.sagernet.org

https://metacubex.github.io/metacubexd/

Note: rules 中的规则越靠前(上),优先级就越高。

{
    "$schema": "https://sing-box.sagernet.org/schema.json",
    "log": {
        "level": "info"
    },
    "inbounds": [
        {
            "type": "tun", // 透明代理
            "address": ["172.19.0.1/30"],
            "auto_route": true,
            "strict_route": true
        },
        {
            "type": "mixed", // SOCKS5 HTTP 代理
            "listen": "127.0.0.1",
            "listen_port": 1080,
            "set_system_proxy": true
        },
        {
            "type": "direct",
            "listen": "127.0.0.1",
            "listen_port": 53 // 对外提供 DNS(域名解析服务)
        }
    ],
    "outbounds": [
        {
            "tag": "自选",
            "type": "selector",
            "default": "东京",
            "outbounds": [
                "香港2024-1",
                "香港2024-2",
                "台湾2024-1",
                "首尔",
                "东京",
                "洛杉矶",
                "悉尼",
                "墨尔本",
                "法兰克福",
                "巴林",
                "德里",
                "孟买1",
                "孟买2",
                "雅加达",
                "自动"
            ]
        },
        {
            "tag": "自动",
            "type": "urltest",
            "interval": "2m",
            "outbounds": [
                "香港2024-1",
                "香港2024-2",
                "台湾2024-1",
                "首尔",
                "东京",
                "洛杉矶",
                "悉尼",
                "墨尔本",
                "法兰克福",
                "巴林",
                "德里",
                "孟买1",
                "孟买2",
                "雅加达"
            ]
        },
        {
            "tag": "香港2024-1",
            "type": "trojan",
            "password": "123456",
            "server": "liads.wsone.icu",
            "server_port": 443,
            "tls": {
                "enabled": true,
                "server_name": "liads.wsone.icu",
                "insecure": true,
                "utls": {
                    "enabled": true,
                    "fingerprint": "firefox"
                }
            }
        },
        {
            "tag": "直连",
            "type": "direct"
        }
    ],
    "http_clients": [
        {
            "tag": "default",
            "detour": "自选"
        }
    ],
    "dns": {
        "strategy": "ipv4_only",
        "servers": [
            {
                "tag": "remote",
                "type": "https",
                "server": "9.9.9.9",
                "detour": "自选"
            },
            {
                "tag": "local",
                "type": "https",
                "server": "223.5.5.5"
            }
        ],
        "rules": [
            {
                "clash_mode": "Direct",
                "server": "local"
            },
            {
                "clash_mode": "Global",
                "server": "remote"
            },
            {
                "domain": ["services.googleapis.cn"], // Google Play 应用更新
                "server": "remote"
            },
            {
                "rule_set": "geosite-category-ads-all",
                "action": "reject"
            },
            {
                "rule_set": "geosite-cn",
                "server": "local"
            }
        ]
    },
    "route": {
        "find_process": true,
        "find_neighbor": true,
        "auto_detect_interface": true,
        "default_domain_resolver": "local",
        "rules": [
            {
                "action": "sniff"
            },
            {
                "protocol": "dns",
                "action": "hijack-dns"
            },
            {
                "ip_is_private": true,
                "outbound": "直连"
            },
            {
                "clash_mode": "Direct",
                "outbound": "直连"
            },
            {
                "clash_mode": "Global",
                "outbound": "自选"
            },
            {
                "domain": ["services.googleapis.cn"], // Google Play 应用更新
                "outbound": "自选"
            },
            {
                "rule_set": ["geosite-category-ads-all"],
                "action": "reject"
            },
            {
                "rule_set": [
                    "geoip-cn",
                    "geosite-cn",
                    "geosite-tld-cn",
                    "geosite-category-games-cn",
                    "geosite-category-game-platforms-download",
                    "geosite-category-companies@cn",
                    "geosite-connectivity-check",
                    "geosite-private"
                ],
                "outbound": "直连"
            }
        ],
        "rule_set": [
            {
                "tag": "geoip-cn",
                "type": "remote",
                "format": "binary",
                "url": "https://raw.githubusercontent.com/SagerNet/sing-geoip/rule-set/geoip-cn.srs"
            },
            {
                "tag": "geosite-cn",
                "type": "remote",
                "format": "binary",
                "url": "https://raw.githubusercontent.com/SagerNet/sing-geosite/rule-set/geosite-cn.srs"
            },
            {
                "tag": "geosite-tld-cn",
                "type": "remote",
                "format": "binary",
                "url": "https://raw.githubusercontent.com/SagerNet/sing-geosite/rule-set/geosite-tld-cn.srs"
            },
            {
                "tag": "geosite-category-games-cn",
                "type": "remote",
                "format": "binary",
                "url": "https://raw.githubusercontent.com/SagerNet/sing-geosite/rule-set/geosite-category-games-cn.srs"
            },
            {
                "tag": "geosite-category-game-platforms-download",
                "type": "remote",
                "format": "binary",
                "url": "https://raw.githubusercontent.com/SagerNet/sing-geosite/rule-set/geosite-category-game-platforms-download.srs"
            },
            {
                "tag": "geosite-category-ads-all",
                "type": "remote",
                "format": "binary",
                "url": "https://raw.githubusercontent.com/SagerNet/sing-geosite/rule-set/geosite-category-ads-all.srs"
            },
            {
                "tag": "geosite-category-companies@cn",
                "type": "remote",
                "format": "binary",
                "url": "https://raw.githubusercontent.com/SagerNet/sing-geosite/rule-set/geosite-category-companies@cn.srs"
            },
            {
                "tag": "geosite-connectivity-check",
                "type": "remote",
                "format": "binary",
                "url": "https://raw.githubusercontent.com/SagerNet/sing-geosite/rule-set/geosite-connectivity-check.srs"
            },
            {
                "tag": "geosite-private",
                "type": "remote",
                "format": "binary",
                "url": "https://raw.githubusercontent.com/SagerNet/sing-geosite/rule-set/geosite-private.srs"
            }
        ]
    },
    "services": [
        {
            "type": "api",
            "listen": "127.0.0.1",
            "listen_port": 9091,
            "secret": "123456"
        }
    ],
    "experimental": {
        "cache_file": {
            "enabled": true,
            "store_dns": true
        },
        "clash_api": {
            "external_controller": "127.0.0.1:9090",
            "secret": "123456",
            "access_control_allow_origin": [
                "https://yacd.haishan.me",
                "https://yacd.metacubex.one",
                "https://metacubex.github.io",
                "https://metacubexd.pages.dev"
            ]
        }
    }
}

OpenConnect Client (GlobalProtect)

{
    "$schema": "https://sing-box.sagernet.org/schema.json",
    "endpoints": [
        {
            "tag": "ba_vpn",
            "type": "openconnect",
            "server": "pa.test.com:32768",
            "flavor": "gp",
            "hip": {
                "wrapper_path": "/Library/Application Support/ba_vpn/hipreport.sh"
            }
        }
    ],
    "dns": {
        "servers": [
            // 放在首位(默认使用第一个)
            {
                "endpoint": "ba_vpn",
                "type": "openconnect",
                "accept_default_resolvers": true,
                "accept_search_domain": true
            }
        ]
    },
    "route": {
        "rules": [
            {
                "domain_suffix": ["secfdg.net", "toolsfdg.net", "difft.org"],
                "outbound": "ba_vpn"
            }
        ]
    }
}
hipreport.sh
#!/bin/sh

COOKIE=""
IP=""
IPV6=""
MD5=""
CLIENTOS=""
while [ -n "$1" ]; do
    case "$1" in
        --cookie)      shift; COOKIE="$1" ;;
        --client-ip)   shift; IP="$1" ;;
        --client-ipv6) shift; IPV6="$1" ;;
        --md5)         shift; MD5="$1" ;;
        --client-os)   shift; CLIENTOS="$1" ;;
    esac
    shift
done

NOW=$(/bin/date +'%m/%d/%Y %H:%M:%S')

REPORT=$(/bin/cat <<EOF
<?xml version="1.0" encoding="UTF-8"?>
<hip-report>
	<md5-sum>$MD5</md5-sum>
	<user-name>peter.y</user-name>
	<domain></domain>
	<host-name>Q5XKTJXY2L</host-name>
	<host-id>16:2c:82:c6:a1:37</host-id>
	<ip-address>$IP</ip-address>
	<ipv6-address>$IPV6</ipv6-address>
	<generate-time>$NOW</generate-time>
	<hip-report-version>4</hip-report-version>
	<categories>
		<entry name="host-info">
			<client-version>6.2.8-243</client-version>
			<os>Apple Mac OS X 26.5.2</os>
			<os-vendor>Apple</os-vendor>
			<domain></domain>
			<host-name>Q5XKTJXY2L</host-name>
			<host-id>16:2c:82:c6:a1:37</host-id>
			<network-interface>
				<entry name="en4">
					<description>en4</description>
					<mac-address>26:06:ca:9b:2e:19</mac-address>
				</entry>
				<entry name="en5">
					<description>en5</description>
					<mac-address>26:06:ca:9b:2e:1a</mac-address>
				</entry>
				<entry name="en6">
					<description>en6</description>
					<mac-address>26:06:ca:9b:2e:1b</mac-address>
				</entry>
				<entry name="bridge0">
					<description>bridge0</description>
					<mac-address>36:17:c0:2a:f0:80</mac-address>
				</entry>
				<entry name="en0">
					<description>en0</description>
					<mac-address>16:2c:82:c6:a1:37</mac-address>
					<ip-address>
						<entry name="192.168.1.106"/>
					</ip-address>
					<ipv6-address>
						<entry name="fe80::50:5124:592a:bd52"/>
					</ipv6-address>
				</entry>
				<entry name="en1">
					<description>en1</description>
					<mac-address>36:17:c0:2a:f0:80</mac-address>
				</entry>
				<entry name="en2">
					<description>en2</description>
					<mac-address>36:17:c0:2a:f0:84</mac-address>
				</entry>
				<entry name="en3">
					<description>en3</description>
					<mac-address>36:17:c0:2a:f0:88</mac-address>
				</entry>
			</network-interface>
		</entry>
		<entry name="anti-malware">
			<list>
				<entry>
					<ProductInfo>
						<Prod vendor="SentinelOne" name="Sentinel Agent" version="25.2.2.8193" defver="2026.08.05" engver="" datemon="8" dateday="5" dateyear="2026" prodType="3" osType="4"/>
						<real-time-protection>yes</real-time-protection>
						<last-full-scan-time>n/a</last-full-scan-time>
					</ProductInfo>
				</entry>
				<entry>
					<ProductInfo>
						<Prod vendor="Apple Inc." name="Xprotect" version="5353" defver="5353" engver="" datemon="7" dateday="29" dateyear="2026" prodType="3" osType="4"/>
						<real-time-protection>yes</real-time-protection>
						<last-full-scan-time>n/a</last-full-scan-time>
					</ProductInfo>
				</entry>
				<entry>
					<ProductInfo>
						<Prod vendor="Apple Inc." name="Gatekeeper" version="26.5.2" defver="" engver="" datemon="" dateday="" dateyear="" prodType="3" osType="4"/>
						<real-time-protection>yes</real-time-protection>
						<last-full-scan-time>n/a</last-full-scan-time>
					</ProductInfo>
				</entry>
			</list>
		</entry>
		<entry name="disk-backup">
			<list>
				<entry>
					<ProductInfo>
						<Prod vendor="Apple Inc." name="Time Machine" version="1.3"/>
						<last-backup-time>n/a</last-backup-time>
					</ProductInfo>
				</entry>
			</list>
		</entry>
		<entry name="disk-encryption">
			<list>
				<entry>
					<ProductInfo>
						<Prod vendor="Apple Inc." name="FileVault" version="26.5.2"/>
						<drives>
							<entry>
								<drive-name>Macintosh HD</drive-name>
								<enc-state>encrypted</enc-state>
							</entry>
							<entry>
								<drive-name>Data</drive-name>
								<enc-state>encrypted</enc-state>
							</entry>
							<entry>
								<drive-name>All</drive-name>
								<enc-state>encrypted</enc-state>
							</entry>
						</drives>
					</ProductInfo>
				</entry>
			</list>
		</entry>
		<entry name="firewall">
			<list>
				<entry>
					<ProductInfo>
						<Prod vendor="SentinelOne" name="Sentinel Agent" version="25.2.2.8193"/>
						<is-enabled>yes</is-enabled>
					</ProductInfo>
				</entry>
				<entry>
					<ProductInfo>
						<Prod vendor="Apple Inc." name="Mac OS X Builtin Firewall" version="26.5.2"/>
						<is-enabled>yes</is-enabled>
					</ProductInfo>
				</entry>
				<entry>
					<ProductInfo>
						<Prod vendor="OpenBSD" name="Packet Filter" version="26.5.2"/>
						<is-enabled>no</is-enabled>
					</ProductInfo>
				</entry>
			</list>
		</entry>
		<entry name="patch-management">
			<list>
				<entry>
					<ProductInfo>
						<Prod vendor="JAMF Software" name="Jamf Pro" version="11.30.2"/>
						<is-enabled>yes</is-enabled>
					</ProductInfo>
				</entry>
				<entry>
					<ProductInfo>
						<Prod vendor="Apple Inc." name="Software Update" version="3.0"/>
						<is-enabled>yes</is-enabled>
					</ProductInfo>
				</entry>
			</list>
			<missing-patches>
			</missing-patches>
		</entry>
		<entry name="data-loss-prevention">
			<list>
			</list>
		</entry>
	</categories>
</hip-report>
EOF
)
printf '%s' "$REPORT"

Mac App Sandbox 白名单路径 (application.sb)

/Applications/sing-box.app/  -  io.nekohasekai.sfavt  -  com.apple.security.app-sandbox
/Library/Application Support/<任意子目录>/  <- 首选
~/Library/Application Scripts/group.io.nekohasekai.sfavt/
~/Library/Application Scripts/io.nekohasekai.sfavt/
~/Library/Application Scripts/io.nekohasekai.sfavt.extension/

Reference