# Mihomo Proxy Config

> Set up and configure mihomo (Clash Meta) proxy on Linux servers — installation, DNS for internal networks, AI rule sets, Web UI, systemd service.

- Skill: `tyrantlucifer/mihomo-proxy-config` (Agent Skill, multi-file: 3 files)
- Install (CLI): `npx skillmds@latest add tyrantlucifer/mihomo-proxy-config`
- Raw SKILL.md: https://api.skillmd.com/api/skills/tyrantlucifer/mihomo-proxy-config/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- License: MIT
- Author: TyrantLucifer (https://skillmd.com/u/tyrantlucifer)
- Updated: 2026-09-22
- Page: https://skillmd.com/skills/tyrantlucifer/mihomo-proxy-config

---


# Mihomo (Clash Meta) Proxy Configuration

Setup mihomo proxy on Linux servers, especially for China mainland machines that need access to external services (Google, X/Twitter, AI APIs).

## Trigger

- User asks to setup/configure proxy, clash, mihomo, or VPN on a Linux server
- User needs to access GitHub/X/Twitter/AI services from China
- User mentions "翻墙" or "代理"

## Step 1: Download & Install

Direct GitHub access from China is blocked. Use acceleration mirrors:

```bash
mkdir -p ~/mihomo && cd ~/mihomo
VERSION="v1.19.8"  # Check latest at https://github.com/MetaCubeX/mihomo/releases

# gh-proxy.com (primary mirror)
wget -O mihomo.gz "https://gh-proxy.com/https://github.com/MetaCubeX/mihomo/releases/download/${VERSION}/mihomo-linux-amd64-${VERSION}.gz"

# ghfast.top (fallback)
# wget -O mihomo.gz "https://ghfast.top/https://github.com/MetaCubeX/mihomo/releases/download/${VERSION}/mihomo-linux-amd64-${VERSION}.gz"

gunzip mihomo.gz && chmod +x mihomo && sudo cp mihomo /usr/local/bin/mihomo
mihomo -v
```

**Pitfall:** If `gunzip` says "not in gzip format", the file is an HTML error page (195 bytes). Check with `file mihomo.gz` — if "HTML document", the mirror URL is wrong. Try the other mirror.

## Step 2: Config Template

Create `~/.config/mihomo/config.yaml`:

```yaml
# ============================================================
# Mihomo Config
# ============================================================

mixed-port: 7893
port: 7890
socks-port: 7891
allow-lan: false
bind-address: "*"
mode: rule
log-level: info
ipv6: false

external-controller: 0.0.0.0:9090
secret: "your_password"           # REQUIRED for 0.0.0.0
external-ui: ui                    # Relative path, within config dir
external-ui-url: "https://gh-proxy.com/https://github.com/MetaCubeX/metacubexd/archive/refs/heads/gh-pages.zip"

geodata-mode: true
geox-url:
  geoip: "https://gh-proxy.com/https://github.com/MetaCubeX/meta-rules-dat/releases/download/latest/geoip-lite.dat"
  geosite: "https://gh-proxy.com/https://github.com/MetaCubeX/meta-rules-dat/releases/download/latest/geosite.dat"
  mmdb: "https://gh-proxy.com/https://github.com/MetaCubeX/meta-rules-dat/releases/download/latest/country-lite.mmdb"

# ---- DNS (Internal Network) ----
dns:
  enable: true
  ipv6: false
  respect-rules: true              # CRITICAL: DNS follows proxy rules
  enhanced-mode: fake-ip
  nameserver:
    - 10.0.0.53                    # <<<< Replace with your internal DNS
    - 10.0.0.54
  proxy-server-nameserver:
    - 10.0.0.53
    - 10.0.0.54
  nameserver-policy:
    "rule-set:ai":
      - https://1.1.1.1/dns-query
      - https://dns.google/dns-query
  fake-ip-filter-mode: rule
  fake-ip-filter:
    - RULE-SET,ai,fake-ip
    - MATCH,real-ip

# ---- Proxy Providers (Airport Subscription) ----
proxy-providers:
  airport:
    type: http
    url: ""                        # <<<< Replace with subscription URL
    path: ./providers/airport.yaml
    interval: 3600
    health-check:
      enable: true
      url: https://www.gstatic.com/generate_204
      interval: 300

# ---- Proxies (Self-hosted / Special Nodes) ----
proxies:
  - name: "claude-proxy"
    type: vless
    server: YOUR_SERVER_ADDRESS    # <<<< Replace
    port: 443
    uuid: YOUR_UUID                # <<<< Replace
    network: tcp
    tls: true
    servername: your-servername.example.com
    flow: xtls-rprx-vision

# ---- Proxy Groups (Country-based, no emojis) ----
proxy-groups:
  - name: "PROXY"
    type: select
    use: [airport]
    proxies: ["AUTO", "HK", "TW", "JP", "SG", "US", "KR", "EU", DIRECT]

  - name: "AUTO"
    type: url-test
    use: [airport]
    url: https://www.gstatic.com/generate_204
    interval: 300
    tolerance: 50

  - name: "AI"
    type: select
    use: [airport]
    filter: "(?i)美|us|美国|america"
    proxies: ["claude-proxy", "JP", "HK", "SG", "AUTO"]

  - name: "HK"
    type: url-test
    use: [airport]
    filter: "(?i)港|hk|hong kong"
    url: https://www.gstatic.com/generate_204
    interval: 300

  - name: "TW"
    type: url-test
    use: [airport]
    filter: "(?i)台|tw|taiwan"
    url: https://www.gstatic.com/generate_204
    interval: 300

  - name: "JP"
    type: url-test
    use: [airport]
    filter: "(?i)日|jp|japan"
    url: https://www.gstatic.com/generate_204
    interval: 300

  - name: "SG"
    type: url-test
    use: [airport]
    filter: "(?i)新|sg|singapore"
    url: https://www.gstatic.com/generate_204
    interval: 300

  - name: "US"
    type: url-test
    use: [airport]
    filter: "(?i)美|us|美国|america"
    url: https://www.gstatic.com/generate_204
    interval: 300

  - name: "KR"
    type: url-test
    use: [airport]
    filter: "(?i)韩|kr|korea"
    url: https://www.gstatic.com/generate_204
    interval: 300

  - name: "EU"
    type: url-test
    use: [airport]
    filter: "(?i)英|德|法|荷兰|uk|de|fr|nl|europe|germany|france|netherlands"
    url: https://www.gstatic.com/generate_204
    interval: 300

# ---- Rule Providers (Only AI domains as local file) ----
rule-providers:
  ai:
    type: file
    behavior: domain
    path: ./ruleset/ai.yaml

# ---- Rules (Built-in GEOSITE/GEOIP + local ai.yaml) ----
rules:
  - GEOSITE,private,DIRECT
  - GEOIP,private,DIRECT,no-resolve
  - RULE-SET,ai,AI
  - GEOSITE,cn,DIRECT
  - GEOSITE,geolocation-!cn,PROXY
  - GEOIP,CN,DIRECT,no-resolve
  - MATCH,PROXY
```

## Step 3: AI Domains Rule Set

Create `~/.config/mihomo/ruleset/ai.yaml`:

**CRITICAL: Use `+.` prefix for all domains!** Without `+.`, `openai.com` only matches the bare domain, NOT subdomains like `api.openai.com`. With `+.openai.com`, all subdomains are matched.

```yaml
payload:
  # OpenAI
  - '+.openai.com'
  - '+.chatgpt.com'
  - '+.oaiusercontent.com'
  - '+.oaistatic.com'

  # Anthropic / Claude
  - '+.anthropic.com'
  - '+.claude.ai'
  - '+.claude.com'
  - '+.claudeusercontent.com'

  # Google AI
  - '+.gemini.google.com'
  - '+.ai.google.dev'
  - '+.generativelanguage.googleapis.com'

  # xAI / Grok
  - '+.x.ai'
  - '+.grok.com'

  # Groq
  - '+.groq.com'

  # Cohere
  - '+.cohere.com'

  # Mistral
  - '+.mistral.ai'

  # Together AI
  - '+.together.ai'

  # Replicate
  - '+.replicate.com'

  # Perplexity
  - '+.perplexity.ai'

  # DeepSeek
  - '+.deepseek.com'

  # OpenRouter
  - '+.openrouter.ai'

  # Hugging Face
  - '+.huggingface.co'

  # Cursor
  - '+.cursor.sh'

  # Nous Research
  - '+.nousresearch.com'

  # Stability AI
  - '+.stability.ai'

  # Midjourney
  - '+.midjourney.com'

  # Runway
  - '+.runwayml.com'

  # Suno
  - '+.suno.com'
  - '+.suno.ai'
```

**Pitfall:** Without `+.` prefix, `api.openai.com` falls through to `GEOSITE,geolocation-!cn` → PROXY instead of matching `RULE-SET,ai` → AI. Always use `+.domain.com` format.

**To add/remove domains:** Just edit this file and `systemctl --user restart mihomo`. No need to touch config.yaml.

## Step 4: Start & Verify

```bash
# Validate config
mihomo -d ~/.config/mihomo -t

# Frontend test
mihomo -d ~/.config/mihomo

# Systemd service (long-term)
cat > ~/.config/systemd/user/mihomo.service << 'EOF'
[Unit]
Description=Mihomo Proxy Service
After=network.target

[Service]
Type=simple
ExecStart=/usr/local/bin/mihomo -d %h/.config/mihomo
Restart=on-failure
RestartSec=5

[Install]
WantedBy=default.target
EOF

systemctl --user daemon-reload
systemctl --user enable mihomo
systemctl --user start mihomo

# Verify AI routing
curl -x http://127.0.0.1:7890 -s https://api.openai.com -o /dev/null
journalctl --user -u mihomo --no-pager -n 3 | grep openai
# Should show: match RuleSet(ai) using AI[...]
```

## Step 5: Hermes Proxy Integration

Add to `~/.hermes/.env`:

```
HTTP_PROXY=http://127.0.0.1:7890
HTTPS_PROXY=http://127.0.0.1:7890
ALL_PROXY=socks5://127.0.0.1:7891
NO_PROXY=localhost,127.0.0.1,*.cn,*.corp.example.com
```

Then `hermes gateway restart`.

## Pitfalls

- **ALWAYS use `+.domain.com` in ai.yaml** — bare `domain.com` doesn't match subdomains in file-based rule providers
- **NEVER fabricate URLs** — rule provider URLs, GeoX URLs must be verified or use local files
- **`global-client-fingerprint` is REMOVED** in newer mihomo versions — set per-proxy instead
- **`external-ui` must be relative path** within config dir — absolute paths outside config dir are rejected
- **Use built-in GEOSITE/GEOIP** — don't create external HTTP rule providers that may 404
- **Internal DNS** — don't use public DNS (223.5.5.5) as nameserver on internal networks
- **`respect-rules: true`** is critical — without it, DNS queries don't follow proxy rules
- **GitHub blocked in China** — all download URLs need `gh-proxy.com` or `ghfast.top` mirrors
- **gunzip "not in gzip format"** — download returned HTML error page, try different mirror
- **No emojis in group names** — use HK, TW, JP abbreviations

## Private Documentation

Keep environment-specific DNS addresses, subscription URLs, and internal documentation links in private configuration or documentation. Do not commit them to a public Skill repository.