Iran-sing-box-rules

فارسی

:writing_hand: Introduction

This is an Enhanced and All-in-One set of geo-location routing files optimized for Iranian users to use in sing-box and all its compatible clients.

:bulb: For V2Ray geolocation rules please refer to Iran V2Ray Rules
:bulb: For Clash geolocation rules please refer to Iran Clash Rules

:arrow_down: How to download

From GitHub

Rule-Set

New Geo-Assets format introduced in sing-box v1.8.0+ in order to replace GeoIP and GeoSite.
For more information visit rule-set

See here for a list of all supported rule-set assets.

[!WARNING] GeoIP, GeoSite and all .db files in general are deprecated in sing-box v1.8.0+ and you should use Rule-Set instead. Only use .db assets if you are using sing-box v1.7.x and lower.

:bulb: Rule-Set assets are in these formats: geoip-xx.srs and geosite-xx.srs. Replace xx with your desired category. For example:

Rule-Set https://raw.githubusercontent.com/Chocolate4U/Iran-sing-box-rules/rule-set/geoip-ir.srs
Rule-Set https://raw.githubusercontent.com/Chocolate4U/Iran-sing-box-rules/rule-set/geosite-ir.srs

DB

GeoIP https://raw.githubusercontent.com/Chocolate4U/Iran-sing-box-rules/release/geoip.db
GeoSite https://raw.githubusercontent.com/Chocolate4U/Iran-sing-box-rules/release/geosite.db

GeoIP-Lite https://raw.githubusercontent.com/Chocolate4U/Iran-sing-box-rules/release/geoip-lite.db
GeoSite-Lite https://raw.githubusercontent.com/Chocolate4U/Iran-sing-box-rules/release/geosite-lite.db

Security-IP https://raw.githubusercontent.com/Chocolate4U/Iran-sing-box-rules/release/security-ip.db
Security https://raw.githubusercontent.com/Chocolate4U/Iran-sing-box-rules/release/security.db

From jsdelivr CDN

Rule-Set

Rule-Set https://cdn.jsdelivr.net/gh/chocolate4u/Iran-sing-box-rules@rule-set/geoip-ir.srs
Rule-Set https://cdn.jsdelivr.net/gh/chocolate4u/Iran-sing-box-rules@rule-set/geosite-ir.srs

DB

GeoIP https://cdn.jsdelivr.net/gh/chocolate4u/Iran-sing-box-rules@release/geoip.db
GeoSite https://cdn.jsdelivr.net/gh/chocolate4u/Iran-sing-box-rules@release/geosite.db

GeoIP-Lite https://cdn.jsdelivr.net/gh/chocolate4u/Iran-sing-box-rules@release/geoip-lite.db
GeoSite-Lite https://cdn.jsdelivr.net/gh/chocolate4u/Iran-sing-box-rules@release/geosite-lite.db

Security-IP https://cdn.jsdelivr.net/gh/chocolate4u/Iran-sing-box-rules@release/security-ip.db
Security https://cdn.jsdelivr.net/gh/chocolate4u/Iran-sing-box-rules@release/security.db

:computer: Usage

sing-box core

Add the following to your sing-box client configuration:

"outbounds": [
  {
    "type": "direct",
    "tag": "direct"
  },
  {
    "type": "block",
    "tag": "block"
  }
],
"route": {
    "rules": [
      {
        "ip_is_private": true,
        "outbound": "direct"
      },
      {
        "rule_set": [
          "geosite-category-ads-all",
          "geosite-malware",
          "geosite-phishing",
          "geosite-cryptominers",
          "geoip-malware",
          "geoip-phishing"
        ],
        "outbound": "block"
      },
      {
        "rule_set": [
          "geosite-ir",
          "geoip-ir"
        ],
        "outbound": "direct"
      }
    ],
    "rule_set": [
      {
        "tag": "geosite-ir",
        "type": "remote",
        "format": "binary",
        "url": "https://raw.githubusercontent.com/Chocolate4U/Iran-sing-box-rules/rule-set/geosite-ir.srs"
      },
      {
        "tag": "geosite-category-ads-all",
        "type": "remote",
        "format": "binary",
        "url": "https://raw.githubusercontent.com/Chocolate4U/Iran-sing-box-rules/rule-set/geosite-category-ads-all.srs"
      },
      {
        "tag": "geosite-malware",
        "type": "remote",
        "format": "binary",
        "url": "https://raw.githubusercontent.com/Chocolate4U/Iran-sing-box-rules/rule-set/geosite-malware.srs"
      },
      {
        "tag": "geosite-phishing",
        "type": "remote",
        "format": "binary",
        "url": "https://raw.githubusercontent.com/Chocolate4U/Iran-sing-box-rules/rule-set/geosite-phishing.srs"
      },
      {
        "tag": "geosite-cryptominers",
        "type": "remote",
        "format": "binary",
        "url": "https://raw.githubusercontent.com/Chocolate4U/Iran-sing-box-rules/rule-set/geosite-cryptominers.srs"
      },
      {
        "tag": "geoip-ir",
        "type": "remote",
        "format": "binary",
        "url": "https://raw.githubusercontent.com/Chocolate4U/Iran-sing-box-rules/rule-set/geoip-ir.srs"
      },
      {
        "tag": "geoip-malware",
        "type": "remote",
        "format": "binary",
        "url": "https://raw.githubusercontent.com/Chocolate4U/Iran-sing-box-rules/rule-set/geoip-malware.srs"
      },
      {
        "tag": "geoip-phishing",
        "type": "remote",
        "format": "binary",
        "url": "https://raw.githubusercontent.com/Chocolate4U/Iran-sing-box-rules/rule-set/geoip-phishing.srs"
      }
    ]
  },
  "experimental": {
    "cache_file": {
      "enabled": true
    }
  }

Add the following to your sing-box client configuration:

"outbounds": [
  {
    "type": "direct",
    "tag": "direct"
  },
  {
    "type": "block",
    "tag": "block"
  }
],
"route": {
  "geoip": {
      "download_url": "https://raw.githubusercontent.com/Chocolate4U/Iran-sing-box-rules/release/geoip.db"
  },
  "geosite": {
    "download_url": "https://raw.githubusercontent.com/Chocolate4U/Iran-sing-box-rules/release/geosite.db"
  },
  "rules": [
    {
      "geosite": [
        "category-ads-all",
        "malware",
        "phishing",
        "cryptominers"
      ],
      "outbound": "block"
    },
    {
      "geoip": [
        "malware",
        "phishing"
      ],
      "outbound": "block"
    },
    {
      "geosite": "ir",
      "outbound": "direct"
    },
    {
      "geoip": [
        "ir",
        "private"
      ],
      "outbound": "direct"
    }
  ]
}

:page_with_curl: Categories

GeoIP

• Contains IP Addresses of all countries from Maxmind and IP2Location databases.

• geoip:ir
  Contains Iran IP addresses from Maxmind and IP2Location databases, IP addresses of Iranian messengers such as eitaa, rubika, etc. and IP addresses of arvancloud, derakcloud, iranserver and parspack CDNs.

• geoip:private
  Contains a list of local (LAN) IP addresses.

• geoip:arvancloud
  Contains the IP addresses of ArvanCloud.ir CDN. :information_source: Integrated in geoip:ir and no longer needed to be written as a separate rule.

• geoip:derakcloud
  Contains the IP addresses of Derak.cloud CDN. :information_source: Integrated in geoip:ir and no longer needed to be written as a separate rule.

• geoip:iranserver
  Contains the IP addresses of IranServer.com CDN. :information_source: Integrated in geoip:ir and no longer needed to be written as a separate rule.

• geoip:parspack
  Contains the IP addresses of ParsPack.com CDN. :information_source: Integrated in geoip:ir and no longer needed to be written as a separate rule.

• geoip:cloudflare
  Contains the IP addresses of Cloudflare CDN.

• geoip:google
  Contains the IP addresses of Google, GoogleCloud and GoogleBot.

• geoip:amazon
  Contains the IP addresses of Amazon and Amazon Web Services (AWS).

• geoip:microsoft
  Contains the IP addresses of Microsoft and Azure Platform.

• geoip:bing
  Contains the IP addresses of Bing and Bingbot.

• geoip:github
  Contains the IP addresses of GitHub.

• geoip:facebook
  Contains the IP addresses of the Meta ecosystem, including Facebook, Instagram and WhatsApp.

• geoip:twitter
  Contains the IP addresses of Twitter (now called X!).

• geoip:telegram
  Contains the IP addresses of Telegram Messenger.

• geoip:oracle
  Contains the IP addresses of Oracle Cloud.

• geoip:digitalocean
  Contains the IP addresses of DigitalOcean-related services.

• geoip:linode
  Contains the IP addresses of Linode-related services.

• geoip:openai
  Contains the IP addresses of OpenAI and ChatGPT.

• geoip:phishing
  Contains Phishing IP addresses.

• geoip:malware
  Contains Active Malware IP addresses.

• geoip:ir
  Contains Iran IP addresses from Maxmind and IP2Location databases, IP addresses of Iranian messengers such as eitaa, rubika, etc. and IP addresses of arvancloud, derakcloud, iranserver and parspack CDNs.

• geoip:private
  Contains a list of local (LAN) IP addresses.

• geoip:phishing
  Contains Phishing IP addresses.

• geoip:malware
  Contains Active Malware IP addresses.

• geoip:arvancloud
  Contains the IP addresses of ArvanCloud.ir CDN.

• geoip:derakcloud
  Contains the IP addresses of Derak.cloud CDN.

• geoip:iranserver
  Contains the IP addresses of IranServer.com CDN.

• geoip:parspack
  Contains the IP addresses of ParsPack.com CDN.

• geoip:cloudflare
  Contains the IP addresses of Cloudflare CDN.

• geoip:google
  Contains the IP addresses of Google, GoogleCloud and GoogleBot.

• geoip:amazon
  Contains the IP addresses of Amazon and Amazon Web Services (AWS).

• geoip:microsoft
  Contains the IP addresses of Microsoft and Azure Platform.

• geoip:bing
  Contains the IP addresses of Bing and Bingbot.

• geoip:github
  Contains the IP addresses of GitHub.

• geoip:facebook
  Contains the IP addresses of the Meta ecosystem, including Facebook, Instagram and WhatsApp.

• geoip:twitter
  Contains the IP addresses of Twitter (now called X!).

• geoip:telegram
  Contains the IP addresses of Telegram Messenger.

• geoip:oracle
  Contains the IP addresses of Oracle Cloud.

• geoip:digitalocean
  Contains the IP addresses of DigitalOcean-related services.

• geoip:linode
  Contains the IP addresses of Linode-related services.

• geoip:openai
  Contains the IP addresses of OpenAI and ChatGPT.

GeoSite

• All categories from domain-list-community are supported, plus the following categories:

• geosite:ir
  Contains non-ir TLD Iranian domains (e.g. .com .net .org etc.) and rules to bypass all .ir domains.

• geosite:ads
  Contains a list of Persian advertisement and tracking domains.

• geosite:category-ads-all
  Contains a curated list of Persian and Foreign advertisement and tracking domains based on multiple sources. It is optimized to have as low as possible false positives while also retaining a small size and efficiency.

• geosite:malware
  Contains a list of active malware domains.

• geosite:phishing
  Contains a list of scam and phishing domains.

• geosite:cryptominers
  Contains a list of cryptocurrency miners that run in the background of a web browser and affect system performance.

• geosite:social
  Contains Domain Addresses of popular social media platforms, including Facebook, Instagram, Whatsapp, Twitter, LinkedIn, MySpace, Pinterest, Tumblr, Reddit, TikTok, clubhouse.

• geosite:nsfw Contains a list of porn and gambling websites.

• geosite:ir
  Contains non-ir TLD Iranian domains (e.g. .com .net .org etc.) with dead domains removed and rules to bypass all .ir domains.
  All IR domains from normal GeoSite get checked every 24 hours and after the removal of non-active domains, will get in this category.
  The test may not be very accurate, so I recommend updating this list daily or regularly.
• geosite:ads
  Contains a list of Persian advertisement and tracking domains.

• geosite:category-ads-all
  Contains a curated list of Persian and Foreign advertisement and tracking domains based on multiple sources. It is optimized to have as low as possible false positives while also retaining a small size and efficiency.

• geosite:malware
  Contains a list of active malware domains.

• geosite:phishing
  Contains a list of scam and phishing domains.

• geosite:cryptominers
  Contains a list of cryptocurrency miners that run in the background of a web browser and affect system performance.

:information_desk_person: How is this made?

geoip.db,geoip-lite.db are generated using source code from my fork of sing-geoip. It uses Country.mmdb,Country-lite.mmdb from Iran V2Ray Rules to generate geoip.db,geoip-lite.db.
geosite.db,geosite-lite.db are generated using source code from my fork of sing-geosite. It uses geosite.dat,geosite-lite.dat from Iran V2Ray Rules to generate geosite.db,geosite-lite.db.

:handshake: Contribution

All contributions are welcome and appreciated. You can contribute to this project in 2 ways:

1. Contribute to its upstream sources
   Do you know a Domain that should be bypassed? report it to Iran Hosted Domains
   Do you know a Persian advertisement domain that should be blocked or a false positive? report it to PersianBlocker
   Do you know... OK, you got the idea!
2. Contribute directly to this project
   Report issues, open pull requests, suggest new sources or categories or any idea, in general, to make this repository more useful for everyone.

:raising_hand_man: Also one more thing, if this repository was useful to you, kindly leave a :star: up there so this project can be seen by more people.

:copyright: License

This project, except for upstream sources, is licensed under the GNU GPLv3 License - see the LICENSE file for details.

All rights are reserved for All upstream sources used in this project according to their respective licenses. Please refer to Sources section for more details.

:package: Sources

GeoIP

Source	Maintainer	Home Page	License	Category
GeoLite2	MaxMind	Home Page	CC BY-SA 4.0	Country IPs
IP2Location LITE	IP2Location	Home Page	CC BY-SA 4.0	Country IPs
ITO GOV	ITO GOV	Home Page	N/A	ir(messenger IPs)
V2ray-rules-dat	Loyalsoldier	Home Page	GPL-3.0	cn
Arvan Cloud	Arvan Cloud	Home Page	All rights reserved	arvancloud
Derak Cloud	Derak Cloud	Home Page	All rights reserved	derakcloud
IranServer	IranServer	Home Page	All rights reserved	iranserver
ParsPack	ParsPack	Home Page	All rights reserved	parspack
Cloudflare	Cloudflare	Home Page	All rights reserved	cloudflare
Telegram	Telegram	Home Page	All rights reserved	Telegram
URLhaus	abuse.ch	Home Page	CC0	malware
Phishing URL Blocklist	malware-filter Group	Home Page	MIT	phishing
IPRanges	lord-alfred	Home Page	CC0 1.0	everything else

GeoSite

Source	Maintainer	Home Page	License	Category
Iran Hosted Domains	bootmortis	Home Page	MIT	ir
PersianBlocker	MasterKia	Home Page	AGPL-3.0	ads
DNS Blocklists	Hagezi	Home Page	All rights reserved	ads
Ad and tracking server list	Peter Lowe	Home Page	McRae GPL	ads
GoodbyeAds	jerryn70	Home Page	MIT	ads
AdGuard DNS filter	Adguard Team	Home Page	GPL-3.0	ads
URLhaus	abuse.ch	Home Page	CC0	malware
Phishing URL Blocklist	malware-filter Group	Home Page	MIT	phishing
NoCoin adblock list	hoshsadiq	Home Page	MIT	cryptominers
Unified Hosts	StevenBlack	Home Page	MIT	social, nsfw
Domain list community	Domain list community	Home Page	MIT	everything else

:warning: Disclaimer

This repository is not affiliated, associated, authorized, endorsed by, or in any way officially connected to any of the aforementioned resources, websites, services, or any entity to which this may concern, in any way.
The data in this repository is gathered from publicly available resources and is provided as-is, intended for informational purposes only with no guarantee of accuracy, liability or availability We are not responsible for any harm or damage that may arise from using the data in this repository. Please do your research before using any data from this repository.

:pray: Special Thanks

• All maintainers that are mentioned in this project.
• Project S