clash-rs
A custom protocol, rule-based network proxy written in Rust
clash-rs routes traffic by source, destination, domain or GeoIP across a long list of inbound and outbound protocols, with a local anti-spoofing DNS server and dynamic remote rule loading. It is the engine inside ChocLite, and it runs on Linux, macOS, Windows and iOS.
- Linux
- macOS
- Windows
- iOS
mixed-port: 8899mode: ruleexternal-controller: :9090 dns: enable: true enhanced-mode: fake-ip fake-ip-range: 198.18.0.2/16 nameserver: - tls://1.1.1.1:853#auto # DNS over TLS proxy-groups: - name: Proxy type: url-test proxies: [hk-01, sg-01, jp-01] url: http://cp.cloudflare.com/generate_204 rules: - DOMAIN-SUFFIX,watfaq.com,DIRECT - GEOIP,AU,DIRECT - MATCH,Proxy- proxy protocols
- 13
- inbound modes
- 9
- platforms
- 4
Features
What clash-rs does
Flexible routing
Rules match on source and destination IP, domain, GeoIP and more, with a dynamic remote loader for rule sets and proxy lists.
Anti-spoofing DNS
A local DNS server that resolves over UDP, TCP, DoH or DoT upstream and re-exposes itself as a local UDP, TCP, DoH or DoT server.
Protocols, broadly
AnyTLS, Hysteria2, Shadowquic, Shadowsocks, SOCKS5, SSH, Tailscale, Tor, Trojan, TUIC, VLESS, VMess and userspace WireGuard outbound — over gRPC, TLS, H2, WebSocket, QUIC and REALITY transports.
Inbound modes to match
HTTP, SOCKS5, mixed, Shadowsocks and AnyTLS inbounds, plus TUN for transparent proxying everywhere and TProxy or redir on Linux.
Observable
Distributed tracing with Jaeger, and an external controller API for anything that wants to drive it.
Support for clash-rs
For anything else, email [email protected] or visit the support page.
