โ ๏ธ Experimental description (important)
This article is the third part of a series of practice, continuation(1): The principle of minimalism and the construction of the first editionAnd(2): DNS minimum correctionexperimental technical exploration.
The current configuration is still in the validation stage:
- Not guaranteed to apply to all network environments
- It is not recommended to directly copy for production or critical business
- The main purpose is to verify the feasibility of ‘simple rule model + minimum DNS overwriting’
The network environment, DNS behavior and VPS line quality in different regions will have an impact on the final effect. If it runs stably in the future, this description will be removed in the final chapter, and it will be released as a reference stable plan.
1. Problems
When using flclash (the Android client of the Clash Meta core) with the self-built ZgoCloud + Wstunnel + Wireguard scheme, I have a typical problem:
- Play Store Page: You can open and browse normally.
- App Updates/Downloads: After clicking ‘Update’, the application has been stuck in the ‘Waiting’ state, there is no download progress, and finally fails.
At the same time, the same set of Clash Verge Rev works perfectly on a Windows computerโโGoogle access is normal, and the web version of the Play Store can also be opened. Only the Play Store app on Android phones cannot be downloaded.
The problem positioning
On this issue, I am in another blogCan’t update the Play Store app after self-built VPN? Don’t toss wstunnel, the problem is in the Clash diversion rules’There is a detailed analysis, and the core conclusion is:
The root of the problem is not in wstunnel or network link, but in that the clash shunting rules are not detailed enough.
The specific solution is to adjust the order of the rules – will geosite, google, proxy Put on geosite, private before.
The solution
3.1 Core changes
On the basis of v2 configuration, just add one row of rules and adjust its position:
rules:
# Wstunnel ๆๅกๅจ IP ๅผบๅถ็ด่ฟ
- IP-CIDR,154.21.196.249/32,DIRECT,no-resolve
# ===== ๅ
ณ้ฎ๏ผGoogle ๆๅก่ตฐไปฃ็๏ผๅฟ
้กปๆพๅจ GEOSITE,private ไนๅ๏ผ =====
- GEOSITE,google,Proxy
# ๆฌๅฐ/็งๆ็ฝ็ป็ด่ฟ
- GEOSITE,private,DIRECT
- GEOIP,private,DIRECT,no-resolve
...3.2 Why put it in geosite, private before?
Measured found: geosite, google, proxy Put on geosite, private Before, the PLAY store download is back to normal; put in geosite,cn It doesn’t work afterwards.
3.3 Final Profile (V3)
The full configuration has been uploaded to GitHub:shuijingwan/clash-config
# ==============================================
# ZgoCloud + Wstunnel + WireGuard
# MetaCubeX ๆ็ฎ็จณๅฎ็ v3 (Google Play ไผๅ)
# ๅ
ผๅฎน๏ผClash Verge Rev / FlClash
#
# ็น็น๏ผ
# - ๆๅฐๅ DNS ่ฆๅ๏ผไป
้ฒๆฑกๆ๏ผ
# - ไธไฝฟ็จ SMTP / YouTube ็นๆฎ่งๅ
# - ๅบไบ GEOSITE + GEOIP
# - ็ปๆๆๅฐๅ๏ผไพฟไบๆ้
#
# ่ฐๆด๏ผๅฐ GEOSITE,google ๅ็ฝฎๅฐ private ไนๅ๏ผ
# ็กฎไฟ Google ๆๅกไผๅ
่ตฐไปฃ็๏ผๅฎๆตๅฏ่งฃๅณ Play ไธ่ฝฝ้ฎ้ข๏ผใ
# ==============================================
# ----- ้็จ่ฎพ็ฝฎ -----
profile:
store-selected: true # ่ฎฐไฝ็จๆทๅจ Proxy ็ปไธญๆๅจ้ๆฉ็่็น๏ผ้ๅฏๅไธไธขๅคฑ๏ผ
# ----- DNS ๆๅฐ่ฆๅ๏ผ้ฒๆฑกๆ๏ผ -----
dns:
# ๅฝๅ
ๅๅ่งฃๆ๏ผไฝฟ็จ้ฟ้ๅ
ฌๅ
ฑ DNS over HTTPS๏ผ็ด่ฟไธ็ป่ฟไปฃ็
nameserver:
- https://dns.alidns.com/dns-query
# ใๅ
ณ้ฎใ่ฎฉๆๆ DNS ๆฅ่ฏข๏ผ็นๅซๆฏ fallback๏ผ้ฝ้่ฟไปฃ็็ป Proxy ๅๅบ๏ผ้ฟๅ
ๆฌๅฐ DNS ๆฑกๆ
proxy: Proxy
# ๅขๅคๅๅ่งฃๆ๏ผไฝฟ็จ Cloudflare DNS over TLS๏ผ่งฃๆ็ปๆ็ฑไปฃ็้ง้ไฟๆค
fallback:
- tls://1.1.1.1:853
# ๅช่ฎฉ้ไธญๅฝ IP ็ๅๅไฝฟ็จ fallback๏ผๅฝๅ
ๅๅๅผบๅถ่ตฐ nameserver
fallback-filter:
geoip: true
geoip-code: CN
# ----- ไปฃ็่็นๅฎไน -----
proxies:
- name: ZgoCloud-WG # ่็นๅ็งฐ๏ผๅฏ่ชๅฎไน
type: wireguard # ็ฑปๅ๏ผWireGuard
server: 127.0.0.1 # ใๅฟ
้กปไฟฎๆนใWireGuard ๆๅกๅจ็ๅฐๅ๏ผๆญคๅคไธบๆฌๅฐ wstunnel ๆ ๅฐ็ซฏๅฃ๏ผ
port: 51820 # ใๅฟ
้กปไฟฎๆนใWireGuard ็ซฏๅฃ
ip: x.x.x.x # ใๅฟ
้กปไฟฎๆนใๅ้
็ปๆฌๆบ็ WireGuard ๅ
็ฝ IP
public-key: xxx # ใๅฟ
้กปไฟฎๆนใๆๅกๅจๅ
ฌ้ฅ
private-key: xxx # ใๅฟ
้กปไฟฎๆนใๆฌๆบ็ง้ฅ
pre-shared-key: xxx # ใๅฟ
้กปไฟฎๆนใ้ขๅ
ฑไบซๅฏ้ฅ
udp: true # ๅฏ็จ UDP ่ฝฌๅ
mtu: 1280 # MTU๏ผ่ฅ้้จๅ็ฝ็ซๅก้กฟๅฏๅฐ่ฏ่ฐๆดไธบ 1200 ๆ 1000
# ----- ไปฃ็็ป -----
proxy-groups:
- name: Proxy # ไปฃ็็ปๅ็งฐ๏ผ่ขซๅๆต่งๅๅผ็จ
type: select # ็ฑปๅ๏ผๆๅจ้ๆฉ
proxies:
- ZgoCloud-WG # ไธปไปฃ็่็น
- DIRECT # ็ด่ฟ๏ผไธ่ตฐไปฃ็๏ผ
# ----- ๅๆต่งๅ๏ผๅบไบๅฐ็ๆฐๆฎ้๏ผ -----
rules:
# Wstunnel ๆๅกๅจ IP ๅผบๅถ็ด่ฟ๏ผ้ฟๅ
้ง้่ช่บซๆต้ๅ็ฏ๏ผno-resolve ่กจ็คบไป
ๅน้
IP ่งๅ๏ผไธ่งฆๅ DNS ่งฃๆ๏ผ
- IP-CIDR,154.21.196.249/32,DIRECT,no-resolve # ใๅฟ
้กปไฟฎๆนใๆฟๆขไธบไฝ ็ Wstunnel ๆๅกๅจๅ
ฌ็ฝ IP
# ===== ๅ
ณ้ฎ๏ผGoogle ๆๅก่ตฐไปฃ็๏ผๅฟ
้กปๆพๅจ GEOSITE,private ไนๅ๏ผ =====
- GEOSITE,google,Proxy
# ๆฌๅฐ/็งๆ็ฝ็ป็ด่ฟ
- GEOSITE,private,DIRECT
- GEOIP,private,DIRECT,no-resolve
# ไธญๅฝๅคง้ๅๅๅ IP ็ด่ฟ๏ผไฟ่ฏๅฝๅ
่ฎฟ้ฎ้ๅบฆ
- GEOSITE,cn,DIRECT
- GEOIP,CN,DIRECT,no-resolve
# ๆๆ้ไธญๅฝๅคง้ๅๅ่ตฐไปฃ็
- GEOSITE,geolocation-!cn,Proxy
# ๆชๅน้
ๅฐไปปไฝ่งๅ็ๆต้๏ผ้ป่ฎค่ตฐไปฃ็๏ผ้ฒๆญขๆณๆผ๏ผ
- MATCH,Proxy4. Verification results
After the configuration modification is completed, after reloading the Clash:
| verification item | Result |
|---|---|
| Play Store Page | โ Normal load, browsing is not affected |
| app download | โ The progress bar appears normally, the speed is stable |
| Google Web Access | โ Normal |
View real-time request logs in flclash, all Play Store-related requestsAll go to the agent, the download works normally:
tcp://play-fe.googleapis.com:443 โ ZgoCloud-WG / Proxy
tcp://rr2---sn-a5mekn6l.xn--ngstr-Ira8j.com:443 โ ZgoCloud-WG / Proxy
tcp://services.googleapis.cn:443 โ ZgoCloud-WG / Proxy
tcp://connectivitycheck.gstatic.com:443 โ ZgoCloud-WG / ProxyThis is exactly the expected behavior:geosite, google The rule will uniformly identify Google-related domain names as proxy traffic, and the complete communication link of the Play Store will be established, and the download will return to normal.
5. Summary
Looking back at the entire investigation process, the biggest lessons are:
Don’t attribute the problem to the underlying network too early.
Wstunnel, although the long link, is not the root cause of the play update to get stuck. The real crux of the Sequence of Clash shunting rules.
In the end, only one line of configuration was changed.– will geosite, google, proxy Put on geosite, private before. This is the power of ‘minimalized configuration’: the problem is in the order of the rules, rather than the need to build up complex DNS overwrites or sets of external rules.
The complete code of the three configurations of this series has been uploaded to GitHub:
๐ shuijingwan/clash-config
Welcome to STAR and FORK, and welcome to submit ISSUE discussions.
Related reading:
Leave a Reply