最近把规则都转到了mrs格式上，顺便把DNS 侧漏也修复了，测试了一下，100%无侧漏

食用方法：

mihomo

扔给AI，让它帮你补齐你所需要的分流，策略组，最后你自己再手动完成敏感的

proxies/proxy-providers```

Mihomo DNS / Leak-Guard Minimal Example

...

dns:
enable: true
listen: :53
ipv6: false
cache-algorithm: arc
respect-rules: true
use-hosts: false
use-system-hosts: false
prefer-h3: false

# Bootstrap DNS
default-nameserver:
- 223.5.5.5
- 114.114.114.114

# 国内域名使用国内 DNS
nameserver-policy:
rule-set:CN_Domain:
- https://223.5.5.5/dns-query
- https://1.12.12.12/dns-query

# 其他域名使用海外 DoH，并通过 Proxy 发出
nameserver:
- https://cloudflare-dns.com/dns-query#Proxy
- https://dns.google/dns-query#Proxy

# 代理节点域名解析
proxy-server-nameserver:
- 223.5.5.5
- 119.29.29.29

# DIRECT 流量使用国内 DNS
direct-nameserver:
- https://223.5.5.5/dns-query
- https://1.12.12.12/dns-query

direct-nameserver-follow-policy: false

enhanced-mode: fake-ip
fake-ip-range: 198.18.0.1/16
fake-ip-filter-mode: rule

# Fake-IP 例外尽量少
fake-ip-filter:
- DOMAIN-SUFFIX,lan,real-ip
- DOMAIN-SUFFIX,local,real-ip
- DOMAIN-SUFFIX,arpa,real-ip
- DOMAIN-SUFFIX,ntp.org,real-ip
- RULE-SET,Private_Domain,real-ip
- MATCH,fake-ip

tun:
enable: true
stack: mips
auto-route: true
auto-detect-interface: true
disable-icmp-forwarding: true

dns-hijack:
- any:53
- tcp://any:53

strict-route: true

sniffer:
enable: true
parse-pure-ip: false
override-destination: false

sniff:
TLS:
ports:
- 443
- 8443
HTTP:
ports:
- 80
- 8080-8880
override-destination: true

...

rule-providers:
Private_Domain:
type: http
behavior: domain
format: mrs
url: https://raw.githubusercontent.com/MetaCubeX/meta-rules-dat/meta/geo/geosite/private.mrs
interval: 86400

CN_Domain:
type: http
behavior: domain
format: mrs
url: https://raw.githubusercontent.com/MetaCubeX/meta-rules-dat/meta/geo/geosite/cn.mrs
interval: 86400

CN_IP:
type: http
behavior: ipcidr
format: mrs
url: https://raw.githubusercontent.com/MetaCubeX/meta-rules-dat/meta/geo/geoip/cn.mrs
interval: 86400

rules:
# 私有域名与明确私网地址直连
- RULE-SET,Private_Domain,DIRECT
- IP-CIDR,10.0.0.0/8,DIRECT,no-resolve
- IP-CIDR,100.64.0.0/10,DIRECT,no-resolve
- IP-CIDR,127.0.0.0/8,DIRECT,no-resolve
- IP-CIDR,169.254.0.0/16,DIRECT,no-resolve
- IP-CIDR,172.16.0.0/12,DIRECT,no-resolve
- IP-CIDR,192.168.0.0/16,DIRECT,no-resolve

# 禁止 QUIC，减少 UDP/443 旁路
- AND,((NETWORK,udp),(DST-PORT,443)),REJECT

自定义强制代理规则应放在 CN 规则之前

# 大陆明确直连
- RULE-SET,CN_Domain,DIRECT
- RULE-SET,CN_IP,DIRECT,no-resolve

# 其他未命中流量默认代理
- MATCH,Final