下载静态编译的 sing-box

```
mkdir -p /usr/local/bin /etc/sing-box
curl -Lo /tmp/sb.tar.gz https://github.com/SagerNet/sing-box/releases/download/v1.10.7/sing-box-1.10.7-linux-amd64.tar.gz
tar -xzf /tmp/sb.tar.gz -C /tmp
mv /tmp/sing-box-*/sing-box /usr/local/bin/sing-box
chmod +x /usr/local/bin/sing-box
rm -rf /tmp/sb* /tmp/sing-box*
```

生成 Reality 专用私钥、公钥与 UUID

```
/usr/local/bin/sing-box generate reality-keypair
/usr/local/bin/sing-box generate uuid
```

写入到文件/etc/sing-box/config.json

```
{
  "log": {
    "level": "warn",
    "output": "stderr"
  },
  "inbounds": [
    {
      "type": "vless",
      "tag": "vless-in",
      "listen": "0.0.0.0",
      "listen_port": 你的高位端口,
      "users": [
        {
          "uuid": "填入你的UUID",
          "flow": "xtls-rprx-vision"
        }
      ],
      "tls": {
        "enabled": true,
        "server_name": "dl.google.com",
        "reality": {
          "enabled": true,
          "handshake": {
            "server": "dl.google.com",
            "server_port": 443
          },
          "private_key": "填入你的PrivateKey",
          "short_id": [
            ""
          ]
        }
      }
    }
  ],
  "outbounds": [
    {
      "type": "direct",
      "tag": "direct"
    }
  ]
}
```

校验文件有效，无输出校验通过

```
/usr/local/bin/sing-box check -c /etc/sing-box/config.json
```

写入到文件/etc/systemd/system/sing-box.service

```
[Unit]
Description=sing-box service
After=network.target

[Service]
Type=simple
ExecStart=/usr/local/bin/sing-box run -c /etc/sing-box/config.json
Restart=on-failure
RestartSec=3s
MemoryLimit=45M
StandardOutput=null
StandardError=journal

[Install]
WantedBy=multi-user.target
```

运行

```
systemctl daemon-reload
systemctl restart sing-box
```

客户端配置

```
mixed-port: 7890
allow-lan: true
bind-address: '*'
mode: rule
log-level: info
external-controller: '127.0.0.1:9090'
unified-delay: true
tcp-concurrent: true
geox-url:
  geoip: 'https://testingcf.jsdelivr.net/gh/MetaCubeX/meta-rules-dat@release/geoip.dat'
  geosite: 'https://testingcf.jsdelivr.net/gh/MetaCubeX/meta-rules-dat@release/geosite.dat'
  mmdb: 'https://testingcf.jsdelivr.net/gh/MetaCubeX/meta-rules-dat@release/country.mmdb'
dns:
  enable: true
  ipv6: true
  enhanced-mode: fake-ip
  fake-ip-range: 198.18.0.1/16
  use-hosts: true
  default-nameserver: [system, 119.29.29.29, 223.5.5.5, 114.114.114.114, '2400:3200::1']
  nameserver: ['https://223.5.5.5/dns-query#skip-cert-verify=true', 'https://doh.pub/dns-query#skip-cert-verify=true', 'https://dns.alidns.com/dns-query#skip-cert-verify=true', 'tls://223.5.5.5#skip-cert-verify=true', 'tls://dot.pub#skip-cert-verify=true', 'tls://dns.alidns.com#skip-cert-verify=true']
  proxy-server-nameserver: ['https://223.5.5.5/dns-query#skip-cert-verify=true', 'https://doh.pub/dns-query#skip-cert-verify=true', 'https://dns.alidns.com/dns-query#skip-cert-verify=true', 'tls://223.5.5.5#skip-cert-verify=true', 'tls://dot.pub#skip-cert-verify=true', 'tls://dns.alidns.com#skip-cert-verify=true']
  fake-ip-filter:
    - '*.lan'
    - '*.localdomain'
    - '*.example'
    - '*.invalid'
    - '*.localhost'
    - '*.test'
    - '*.local'
    - '*.home.arpa'
    - 'time.*.com'
    - 'time.*.gov'
    - 'time.*.edu.cn'
    - 'time.*.apple.com'
    - '*.time.edu.cn'
    - '*.ntp.org.cn'
    - '+.pool.ntp.org'
    - swscan.apple.com
    - mesu.apple.com
    - '*.msftconnecttest.com'
    - '*.msftncsi.com'
    - 'stun.*.*'
    - 'stun.*.*.*'
    - speedtest.cros.wr.pvp.net
    - '*.xboxlive.com'

proxies:
  - name: TW-Reality
    type: vless
    server: 43.213.40.147
    port: 23456
    uuid: 你的UUID
    network: tcp
    tls: true
    udp: true
    flow: xtls-rprx-vision
    servername: dl.google.com
    reality-opts:
      public-key: ipfAmnyKCj4JA3DyycUCtPP0N1D_41TXaoXFseUDyHg
      short-id: ""
    client-fingerprint: chrome

proxy-groups:
  - name: PROXY
    type: select
    proxies:
      - TW-Reality
      - DIRECT
    url: 'http://www.apple.com/library/test/success.html'
    interval: 1800

rules:
  # =====================
  # 🌐 内网（必须）
  # =====================
  - IP-CIDR,127.0.0.0/8,DIRECT,no-resolve
  - IP-CIDR,10.0.0.0/8,DIRECT,no-resolve
  - IP-CIDR,172.16.0.0/12,DIRECT,no-resolve
  - IP-CIDR,192.168.0.0/16,DIRECT,no-resolve

  # =====================
  # 🇨🇳 国内直连
  # =====================
  - GEOIP,CN,DIRECT

  # =====================
  # 🍎 Apple（避免异常）
  # =====================
  - DOMAIN-SUFFIX,icloud.com,DIRECT
  - DOMAIN-SUFFIX,icloud-content.com,DIRECT
  - DOMAIN-SUFFIX,apple.com,DIRECT
  - DOMAIN-SUFFIX,mzstatic.com,DIRECT
  - DOMAIN-SUFFIX,itunes.apple.com,DIRECT

  # =====================
  # 🧠 AI / 大模型
  # =====================
  - DOMAIN-SUFFIX,openai.com,PROXY
  - DOMAIN-SUFFIX,chatgpt.com,PROXY
  - DOMAIN-SUFFIX,anthropic.com,PROXY
  - DOMAIN-SUFFIX,claude.ai,PROXY
  - DOMAIN-SUFFIX,gemini.google.com,PROXY

  # =====================
  # 🌍 Google / YouTube
  # =====================
  - DOMAIN-SUFFIX,google.com,PROXY
  - DOMAIN-SUFFIX,googleapis.com,PROXY
  - DOMAIN-SUFFIX,youtube.com,PROXY
  - DOMAIN-SUFFIX,ytimg.com,PROXY

  # =====================
  # 💻 开发平台
  # =====================
  - DOMAIN-SUFFIX,github.com,PROXY
  - DOMAIN-SUFFIX,githubusercontent.com,PROXY

  # =====================
  # 📱 社交媒体
  # =====================
  - DOMAIN-SUFFIX,facebook.com,PROXY
  - DOMAIN-SUFFIX,instagram.com,PROXY
  - DOMAIN-SUFFIX,x.com,PROXY
  - DOMAIN-SUFFIX,twitter.com,PROXY
  - DOMAIN-SUFFIX,telegram.org,PROXY

  # Apple Intelligence, Siri
  - DOMAIN-SUFFIX,apple-relay.akamaized.net,PROXY
  - DOMAIN-SUFFIX,apple-relay.apple.com,PROXY
  - DOMAIN-SUFFIX,apple-relay.cloudflare.com,PROXY
  - DOMAIN-SUFFIX,apple-relay.fastly-edge.com,PROXY
  - DOMAIN,gspe1-ssl.ls.apple.com,PROXY
  - DOMAIN-SUFFIX,guzzoni.apple.com,PROXY
  - DOMAIN-SUFFIX,apple-relay.mask.apple-dns.net,PROXY

  # =====================
  # 🧱 兜底
  # =====================
  - MATCH,PROXY
```