global {
    # tproxy port to listen at. It is NOT a HTTP/SOCKS port, and is just used by eBPF program.
    # In normal case, you do not need to use it.
    tproxy_port: 12345

    # Log level: error, warn, info, debug, trace.
    log_level: info

    # Node connectivity check.
    # Host of URL should have both IPv4 and IPv6 if you have double stack in local.
    # Considering traffic consumption, it is recommended to choose a site with anycast IP and less response.
    tcp_check_url: 'http://keep-alv.google.com/generate_204'

    # This DNS will be used to check UDP connectivity of nodes. And if dns_upstream below contains tcp, it also be used to check
    # TCP DNS connectivity of nodes.
    # This DNS should have both IPv4 and IPv6 if you have double stack in local.
    udp_check_dns: 'dns.google:53'

    check_interval: 30s

    # Group will switch node only when new_latency <= old_latency - tolerance.
    check_tolerance: 50ms

    # Value can be scheme://host:port or empty string ''.
    # The scheme can be tcp/udp/tcp+udp. Empty string '' indicates as-is.
    # If host is a domain and has both IPv4 and IPv6 record, dae will automatically choose
    # IPv4 or IPv6 to use according to group policy (such as min latency policy).
    # Please make sure DNS traffic will go through and be forwarded by dae, which is REQUIRED for domain routing.
    # The upstream DNS answer MUST NOT be polluted, so domestic public DNS is not recommended.
    # The request to DNS upstream follows the routing defined below.
    dns_upstream: 'udp://dns.alidns.com:53'

    # The LAN interface to bind. Use it if you only want to proxy LAN instead of localhost.
    # Multiple interfaces split by ",".
    # lan_interface: docker0

    # SNAT for incoming connection to avoid MAC learning.
    # Set it true if you are NOT using dae as a transparent bridge, but will reduce forwarding
    # performance for direct traffic.
    # This option does not affect direct traffic performance of WAN.
    lan_nat_direct: true

    # The WAN interface to bind. Use it if you want to proxy localhost.
    # Multiple interfaces split by ",".
    wan_interface: wlp5s0

    # Allow insecure TLS certificates. It is not recommended to turn it on unless you have to.
    allow_insecure: false

    # Optional values of dial_mode are:
    # 1. "ip". Dial proxy using the IP from DNS directly. This allows your ipv4, ipv6 to choose the optimal path
    #       respectively, and makes the IP version requested by the application meet expectations. For example, if you
    #       use curl -4 ip.sb, you will request IPv4 via proxy and get a IPv4 echo. And curl -6 ip.sb will request IPv6.
    #       This may solve some wierd full-cone problem if your are be your node support that.
    # 2. "domain". Dial proxy using the domain from sniffing. This will relieve DNS pollution problem to a great extent
    #       if have impure DNS environment. Generally, this mode brings faster proxy response time because proxy will
    #       re-resolve the domain in remote, thus get better IP result to connect. This policy does not impact routing.
    #       That is to say, domain rewrite will be after traffic split of routing and dae will not re-route it.
    # 3. "domain+". Based on domain mode but do not check the authenticity of sniffing result. It is useful for users
    #       whose DNS requests do not go through dae but want faster proxy response time. Notice that, if DNS requests
    #       do not go through dae, dae cannot split traffic by domain.
    dial_mode: domain
}

# Subscriptions defined here will be resolved as nodes and merged as a part of the global node pool.
# Support to give the subscription a tag, and filter nodes from a given subscription in the group section.
subscription {
    # Add your subscription links here.
    my_sub: 'https://www.example.com/subscription/link'
    another_sub: 'https://example.com/another_sub'
    'https://example.com/no_tag_link'
}

# Nodes defined here will be merged as a part of the global node pool.
node {
    # Add your node links here.
    # Support socks5, http, https, ss, ssr, vmess, vless, trojan, trojan-go
    'socks5://localhost:1080'
    'ss://LINK'
}

# Node group (outbound).
group {
    my_group {
        # Filter nodes from the global node pool defined by the subscription and node section above.
        # Pass node names as input of keyword/regex filter.
        filter: name(regex:'HK|SG|TW', keyword:'JP', keyword: SH) && !name(keyword:"GCP")

        # Randomly select a node from the group for every connection.
        # policy: random

        # Select the first node from the group for every connection.
        # policy: fixed(0)

        # Select the node with min last latency from the group for every connection.
        # policy: min

        # Select the node with min moving average of latencies from the group for every connection.
        policy: min_moving_avg
    }

    group2 {
        # Filter nodes from the global node pool defined by the subscription and node section above.
        # Pass node names as input of keyword/regex filter.
        filter: subtag(regex: '^my_', another_sub) && !name(keyword: 'ExpireAt:')

        # Select the node with min average of the last 10 latencies from the group for every connection.
        policy: min_avg10
    }
}

# See routing.md for full examples.
routing {
    pname(NetworkManager, dnsmasq, systemd-resolved) -> must_direct # Traffic of domain name server and network manager in local must be direct to avoid loop and bad network connectivity check when binding to WAN.
    ip(geoip:private, 224.0.0.0/3, 'ff00::/8') -> direct # Put it in the front to prevent broadcast, multicast and other packets that should be sent to the LAN from being forwarded by the proxy.
    # Write your rules below.

    # dae arms DNS rush-answer filter so we can use dns.google regardless of DNS pollution.
    domain(full:dns.google) && port(53) -> direct

    ip(geoip:cn) -> direct
    domain(geosite:cn) -> direct

    fallback: my_group
}