Iran-sing-box-rules - Enhanced sing-box and sing-box-clients routing rul

项目说明

<picture>
<source media="(prefers-color-scheme: dark)" srcset="assets/logo-white.png">
<source media="(prefers-color-scheme: light)" srcset="assets/logo-dark.png">
<img alt="a logo for iran sing-box rules in both dark and light mode" src="assets/logo-dark.png">
</picture>

<p align="center">
<img alt="GitHub Workflow Status" src="
<img alt="GitHub release" src="
<img alt="GitHub Release Date" src="
<img alt="License" src="
</p>

فارسی

:writing_hand: Introduction

This is an Enhanced and All-in-One set of geo-location routing files optimized for Iranian users to use in sing-box and all its compatible clients.

:bulb: For V2Ray geolocation rules please refer to Iran V2Ray Rules
:bulb: For Clash geolocation rules please refer to Iran Clash Rules

:arrow_down: How to download

<picture><source media="(prefers-color-scheme: dark)" srcset=" media="(prefers-color-scheme: light)" srcset=" height="32" width="32" alt="github logo in dark and light mode." src=" From GitHub

Rule-Set

New Geo-Assets format introduced in sing-box v1.8.0+ in order to replace GeoIP and GeoSite.
For more information visit rule-set

See here for a list of all supported rule-set assets.

> [!WARNING]
> GeoIP, GeoSite and all .db files in general are deprecated in sing-box v1.8.0+ and you should use Rule-Set instead. Only use .db assets if you are using sing-box v1.7.x and lower.

:bulb: Rule-Set assets are in these formats: geoip-xx.srs and geosite-xx.srs. Replace xx with your desired category. For example:

Rule-Set
Rule-Set

DB

GeoIP
GeoSite

GeoIP-Lite
GeoSite-Lite

Security-IP
Security

<picture><source media="(prefers-color-scheme: dark)" srcset=" media="(prefers-color-scheme: light)" srcset=" height="32" width="32" alt="github logo in dark and light mode." src=" From jsdelivr CDN

Rule-Set

Rule-Set
Rule-Set

DB

GeoIP
GeoSite

GeoIP-Lite
GeoSite-Lite

Security-IP
Security

:computer: Usage

sing-box core

<details>
<summary><strong>Using Rule-Set (Requires sing-box v1.8.0+)</strong></summary>

Add the following to your sing-box client configuration:

</details>

<details>
<summary><strong>Using DB Files</strong></summary>

Add the following to your sing-box client configuration:

</details>

:page_with_curl: Categories

GeoIP

<details>
<summary><strong>Categories in <code>geoip.db</code></strong></summary>

Contains IP Addresses of all countries from Maxmind and IP2Location databases.

geoip:ir

Contains Iran IP addresses from Maxmind and IP2Location databases, IP addresses of Iranian messengers such as eitaa, rubika, etc. and IP addresses of ar, derakcloud, iranserver and parspack CDNs.

geoip:private

Contains a list of local (LAN) IP addresses.

geoip:ar

Contains the IP addresses of Ar.ir CDN. :information_source: Integrated in geoip:ir and no longer needed to be written as a separate rule.

geoip:derakcloud

Contains the IP addresses of Derak.cloud CDN. :information_source: Integrated in geoip:ir and no longer needed to be written as a separate rule.

geoip:iranserver

Contains the IP addresses of IranServer.com CDN. :information_source: Integrated in geoip:ir and no longer needed to be written as a separate rule.

geoip:parspack

Contains the IP addresses of ParsPack.com CDN. :information_source: Integrated in geoip:ir and no longer needed to be written as a separate rule.

geoip:cloudflare

Contains the IP addresses of Cloudflare CDN.

geoip:google

Contains the IP addresses of Google, GoogleCloud and GoogleBot.

geoip:amazon

Contains the IP addresses of Amazon and Amazon Web Services (AWS).

geoip:microsoft

Contains the IP addresses of Microsoft and Azure Platform.

geoip:bing

Contains the IP addresses of Bing and Bingbot.

geoip:github

Contains the IP addresses of GitHub.

geoip:facebook

Contains the IP addresses of the Meta ecosystem, including Facebook, Instagram and WhatsApp.

geoip:twitter

Contains the IP addresses of Twitter (now called X!).

geoip:

Contains the IP addresses of

geoip:oracle

Contains the IP addresses of Oracle Cloud.

geoip:digitalocean

Contains the IP addresses of DigitalOcean-related services.

geoip:linode

Contains the IP addresses of Linode-related services.

geoip:openai

Contains the IP addresses of OpenAI and ChatGPT.

geoip:phishing

Contains Phishing IP addresses.

geoip:malware

Contains Acti IP addresses.
</details>

<details>
<summary><strong>Categories in <code>geoip-lite.db</code></strong></summary>

geoip:ir

Contains Iran IP addresses from Maxmind and IP2Location databases, IP addresses of Iranian messengers such as eitaa, rubika, etc. and IP addresses of ar, derakcloud, iranserver and parspack CDNs.

geoip:private

Contains a list of local (LAN) IP addresses.
</details>

<details>
<summary><strong>Categories in <code>security-ip.db</code></strong></summary>

geoip:phishing

Contains Phishing IP addresses.

geoip:malware

Contains Acti IP addresses.
</details>

<details>
<summary><strong>Categories in <code>geoip-services.db</code></strong></summary>

geoip:ar

Contains the IP addresses of Ar.ir CDN.

geoip:derakcloud

Contains the IP addresses of Derak.cloud CDN.

geoip:iranserver

Contains the IP addresses of IranServer.com CDN.

geoip:parspack

Contains the IP addresses of ParsPack.com CDN.

geoip:cloudflare

Contains the IP addresses of Cloudflare CDN.

geoip:google

Contains the IP addresses of Google, GoogleCloud and GoogleBot.

geoip:amazon

Contains the IP addresses of Amazon and Amazon Web Services (AWS).

geoip:microsoft

Contains the IP addresses of Microsoft and Azure Platform.

geoip:bing

Contains the IP addresses of Bing and Bingbot.

geoip:github

Contains the IP addresses of GitHub.

geoip:facebook

Contains the IP addresses of the Meta ecosystem, including Facebook, Instagram and WhatsApp.

geoip:twitter

Contains the IP addresses of Twitter (now called X!).

geoip:

Contains the IP addresses of

geoip:oracle

Contains the IP addresses of Oracle Cloud.

geoip:digitalocean

Contains the IP addresses of DigitalOcean-related services.

geoip:linode

Contains the IP addresses of Linode-related services.

geoip:openai

Contains the IP addresses of OpenAI and ChatGPT.
</details>

GeoSite

<details>
<summary><strong>Categories in <code>geosite.db</code></strong></summary>

All categories from domain-list-community are supported, plus the following categories:

geosite:ir

Contains non-ir TLD Iranian domains (e.g. .com .net .org etc.) and rules to bypass all .ir domains.

geosite:ads

Contains a list of Persian ad and tracking domains.

geosite:category-ads-all

Contains a curated list of Persian and Foreign ad and tracking domains based on multiple sources. It is optimized to have as low as possible false positi also retaining a small size and efficiency.

geosite:malware

Contains a list of acti domains.

geosite:phishing

Contains a list of scam and phishing domains.

geosite:cryptominers

Contains a list of cryptocurrency miners that run in the background of a web browser and affect system performance.

geosite:social

Contains Domain Addresses of popular social media platforms, including Facebook, Instagram, Whatsapp, Twitter, LinkedIn, MySpace, Pinterest, Tumblr, Reddit, TikTok, clubhouse.

geosite:nsfw

Contains a list of porn and gambling websites.
</details>

<details>
<summary><strong>Categories in <code>geosite-lite.db</code></strong></summary>

geosite:ir

Contains non-ir TLD Iranian domains (e.g. .com .net .org etc.) with dead domains removed and rules to bypass all .ir domains.
All IR domains from normal GeoSite get checked every 24 hours and after the removal of non-acti, will get in this category.
The test may not be very accurate, so I recommend updating this list daily or regularly.

geosite:ads

Contains a list of Persian ad and tracking domains.
</details>

<details>
<summary><strong>Categories in <code>security.db</code></strong></summary>

geosite:category-ads-all

Contains a curated list of Persian and Foreign ad and tracking domains based on multiple sources. It is optimized to have as low as possible false positi also retaining a small size and efficiency.

geosite:malware

Contains a list of acti domains.

geosite:phishing

Contains a list of scam and phishing domains.

geosite:cryptominers

Contains a list of cryptocurrency miners that run in the background of a web browser and affect system performance.
</details>

:information_desk_person: How is this made?

geoip.db,geoip-lite.db are generated using source code from my fork of sing-geoip. It uses Country.mmdb,Country-lite.mmdb from Iran V2Ray Rules to generate geoip.db,geoip-lite.db.
geosite.db,geosite-lite.db are generated using source code from my fork of sing-geosite. It uses geosite.dat,geosite-lite.dat from Iran V2Ray Rules to generate geosite.db,geosite-lite.db.

:handshake: Contribution

All contributions are welcome and appreciated. You can contribute to this project in 2 ways:

1. Contribute to its upstream sources
Do you know a Domain that should be bypassed? report it to Iran Hosted Domains
Do you know a Persian ad domain that should be blocked or a false positi it to PersianBlocker
Do you know... OK, you got the idea!
2. Contribute directly to this project
Report issues, open pull requests, suggest new sources or categories or any idea, in general, to make this repository more useful for e.

:raising_hand_man: Also one more thing, if this repository was useful to you, kindly leave a :star: up there so this project can be seen by more people.

:copyright: License

This project, except for upstream sources, is licensed under the GNU GPLv3 License - see the LICENSE file for details.

All rights are reserved for All upstream sources used in this project according to their respecti. Please refer to Sources section for more details.

:package: Sources

GeoIP

| Source | Maintainer | Home Page | License | Category |
| ---------------------- | -------------------- | ----------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------ | ----------------- |
| GeoLite2 | MaxMind | Home Page | CC BY-SA 4.0 | Country IPs |
| IP2Location LITE | IP2Location | Home Page | CC BY-SA 4.0 | Country IPs |
| ITO GOV | ITO GOV | Home Page | N/A | ir(messenger IPs) |
| | Loyalsoldier | Home Page | GPL-3.0 | cn |
| Ar | Ar | Home Page | All rights reserved | ar |
| Derak Cloud | Derak Cloud | Home Page | All rights reserved | derakcloud |
| IranServer | IranServer | Home Page | All rights reserved | iranserver |
| ParsPack | ParsPack | Home Page | All rights reserved | parspack |
| Cloudflare | Cloudflare | Home Page | All rights reserved | cloudflare |
| Home Page | CC0 | malware |
| Phishing URL Blocklist | malware-filter Group | Home Page | MIT | phishing |
| IPRanges | lord-alfred | Home Page | CC0 1.0 | e else |

GeoSite

| Source | Maintainer | Home Page | License | Category |
| --------------------------- | --------------------- | -------------------------------------------------------------- | ------------------------------------------------------------------------------- | --------------- |
| Iran Hosted Domains | bootmortis | Home Page | MIT | ir |
| PersianBlocker | MasterKia | Home Page | AGPL-3.0 | ads |
| DNS Blocklists | Hagezi | Home Page | All rights reserved | ads |
| Ad and tracking server list | Peter Lowe | Home Page | McRae GPL | ads |
| GoodbyeAds | jerryn70 | Home Page | MIT | ads |
| AdGuard DNS filter | Adguard Team | Home Page | GPL-3.0 | ads |
| URLhaus | abuse.ch | Home Page | CC0 | malware |
| Phishing URL Blocklist | malware-filter Group | Home Page | MIT | phishing |
| NoCoin adblock list | hoshsadiq | Home Page | MIT | cryptominers |
| Unified Hosts | Ste | Home Page | MIT | social, nsfw |
| Domain list community | Domain list community | Home Page | MIT | e else |

:warning: Disclaimer

This repository is not affiliated, associated, authorized, endorsed by, or in any way officially connected to any of the aforementioned resources, websites, services, or any entity to which this may concern, in any way.
The data in this repository is gathered from publicly a resources and is provided as-is, intended for informational purposes only with no guarantee of accuracy, liability or a We are not responsible for any harm or damage that may arise from using the data in this repository. Please do your research before using any data from this repository.

:pray: Special Thanks

All maintainers that are mentioned in this project.

Project S

项目信息

开发语言：未知

Star 数：340

技术要点

该项目属于病毒分析方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Enhanced sing-box and sing-box-clients routing rules with built-in Iranian domains and a focus on security and adblocking.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。