smxl/500: A Quantumult X, Loon and Stash Config Built Around GeoIP

What smxl/500 Actually Bundles

The repository is a set of pre-written configuration files for three iOS proxy clients: Quantumult X, Loon and Stash. It is not a proxy server, not a subscription service, and not an application. The top-level entries include 500.conf, loon.conf, quanx.conf and stash.conf, with supporting directories named loon/, quanx/, qx/ and stash/. The README describes the intent plainly: combine several rewrite configurations, drop most rules to save overhead, and use Vercel redirects to shorten rule and config URLs.

The audience is narrow and specific. You need one of those three clients already installed, you need your own proxy subscription, and you need to be willing to install a MITM certificate on the device. The README's step list assumes all three. Someone looking for a standalone ad blocker or a desktop proxy tool will find nothing here.

The rule set is split into two categories. Rules carry tags like ads, cn, global, hijacking, privacy, tg and unbreak, each exposed through a short link such as https://cnn.vercel.app/xf-ads. Rewrites carry tags like adlite, ads, adscript, apple, bing, bili, box, emby, fake, jsc, lk, upgrade, res, search and v, exposed through links such as https://cnn.vercel.app/xr-apple. That naming is the whole mental model: xf- for filter rules, xr- for rewrites.

How the GeoIP Rule Model Reduces Rule Count

The design leans on GeoIP rather than long hand-maintained domain lists. The README says the project uses Quantumult X and GeoIP features to consolidate multiple rewrite configs and to cut most rules for the sake of lower overhead. Vercel redirects then keep the URLs short, so a single config file can reference rule sets without embedding them.

Practically, this means the client resolves whether a destination is domestic or foreign through a GeoIP database instead of matching hundreds of domain patterns. The README instructs the user to add a GeoIP source under 其他设置, GeoLite2 来源, and offers three Country.mmdb or Country-only-cn-private.mmdb files to choose from, hosted by Loyalsoldier, Hackl0us and soffchen. The database is a user-supplied input, not something the repository ships. That is the trade-off: fewer rules to maintain, but correctness now depends on whichever mmdb you picked and on how current it is.

The rule tags map onto that split. cn handles mainland services going direct, global handles international services, ads blocks advertising domains, hijacking and privacy cover interception and tracking, tg covers Telegram, and unbreak is described as rule correction. The README notes that a 2024 change in the iOS API meant newer TikTok versions only need a system country change plus one rule, quoted as host-wildcard, *tiktok*, proxy. That single line is a good illustration of the project's philosophy: prefer one broad match over a maintained list.

Installing 500.conf in Quantumult X

The README gives a numbered walkthrough. You download or copy the configuration from either the GitHub raw URL or the Vercel mirror, then import it inside Quantumult X under the windmill icon, 配置文件, 下载, paste, confirm. The two documented sources are shown below. The Vercel one is the shorter link the project maintains.

https://github.com/smxl/500/raw/main/500.conf
https://cnn.vercel.app/500.conf

After importing, you generate and install a MITM certificate in the client, then trust it under Settings, General, About, Certificate Trust Settings. The README explicitly cautions that the config uses a public MITM certificate and suggests generating your own and replacing it, noting that exporting without a password skips the passphrase prompt. Treat that as the most important line in the document.

Next you attach a subscription. Under 节点, 引用, add an entry with a label and the resource path of your own airport subscription. If you have no subscription of your own, the config works as-is, but to use yours you edit the [server_remote] section and replace the default https://cnn.vercel.app/xv-sub with your own URL. The README also states the default subscription is publicly known information and advises against long-term use by anyone with higher privacy requirements. That is an honest disclosure, and it should shape how you use this.

Finally you add a GeoIP database under 其他设置, start the tunnel, and the README suggests enabling 其他设置, VPN, 始终开启 since Quantumult X does not support url-schema launching.

Choosing Which Rewrites to Enable

The rewrite list is long and the README does not pretend every entry works. It says some rewrites have already stopped functioning, and it recommends enabling only what fits your usage. If you rarely use overseas software, the lk rewrite for fake VIP on foreign services is useless to you. The fake rewrite is described as a trimmed version of lk that adds Spotify Pro. The README marks with an asterisk the apps where it is unsure whether in-app purchases are unlocked or VIP is merely simulated, which is a more careful statement than most projects of this kind make.

Some entries are off by default. The covidsc rewrites for 24-hour nucleic acid test reports in 四川天府健康通 and 河南豫康码 are listed as 默认关闭. Others are marked 手动添加, meaning you add them yourself rather than expecting them in the bundle. The apple rewrite unlocks restricted Apple services; the README notes that weather compatibility with iOS 16 requires a Scriptable, IQair or 在意空气 widget to display a US AQI reading. The bing rewrite is described as New Bing with Safari and Edge, and the search rewrite sets DuckDuckGo as the Safari default engine with two-letter prefixes for other engines, for example bd for Baidu, mm for Magi, tt for Twitter, yt for YouTube, wa for WolframAlpha, followed by a space and the keyword.

The honest reading is that this is a curated grab bag rather than a coherent product. You are expected to prune it. That pruning is the actual work, and the README gives you the tag names to do it.

NaiveProxy and the OpenWRT Workaround

One limitation is structural rather than incidental. Quantumult X does not support NaiveProxy, and the README says so directly. The suggested workaround is to run it on an OpenWRT router inside the local network and connect through a local SOCKS5 service, quoted as socks5=192.168.124.124:1080, tag=LAN, with a startup script on the router running the naive binary against a config.json path.

That means the config file alone is not sufficient for a NaiveProxy setup. You need a second device, a router you control, and a script you write yourself. The README gives the shape of the solution but not the script contents. If your only proxy option is NaiveProxy and you do not have an OpenWRT box, this project does not solve your problem.

The same applies to the MITM requirement more broadly. Every rewrite that inspects or modifies HTTPS traffic depends on a trusted certificate on the device. The README's own warning about the public certificate is the clearest signal that the default setup is not the one you should keep. Certificate pinning in some apps will also break rewrites, though the README does not discuss that case.

Alternatives and Where the Approach Differs

The obvious alternative is building your own configuration from upstream rule sets. The README points at a minimal template at https://cnn.vercel.app described as stripping most useless configuration and keeping only the basic framework. That is the same project's own answer for users who find 500.conf too heavy: start from the skeleton and add only the tags you need.

A second alternative is the rule sources this project already references. The README says the config cites several projects and services, that you can find them in vercel.json, and that references use the format https://github.com/用户/项目/raw/分支/目录/文件 so you can paste the prefix into a browser to reach the original. The GeoIP databases from Loyalsoldier, Hackl0us and soffchen are themselves standalone inputs you can use with any client that accepts an mmdb file. The difference in approach is that smxl/500 makes opinionated choices for you and bundles rewrites alongside rules, while assembling from the upstream sources gives you only the pieces and no rewrite scripts.

The third path is a client with a different rule model. Loon and Stash are both supported here with their own files, loon.conf and stash.conf, so switching clients does not mean abandoning the project. What changes is which rewrite syntax applies and which of the tag entries remain functional.

Maintenance, Licence and Upgrade Cost

The repository is not archived, and the last push was on 2026-06-19. There are no retrieved releases, so updates arrive as commits to the config files rather than versioned artifacts. That matters for upgrades: you re-import 500.conf or pull the raw file again, and any local edits you made to [server_remote] or to the enabled rewrite list are overwritten unless you keep them separately. The README does not document a rollback path or a way to diff your changes against upstream.

The licence is unknown. The repository metadata does not state one, and the README does not name a licence file among the top-level entries. Without a licence, the default position is that no rights are granted beyond what the hosting platform's terms allow, which is a real constraint if you intend to redistribute the config or embed it in a product. This is not legal advice; it is a statement that the terms are simply not declared.

There is also a content provenance note worth reading before you rely on anything here. The README's disclaimer states that part of the scripts and content were written by ChatGPT, and that all content is for reference only with no responsibility accepted for third-party content. Combined with the admission that some rewrites have stopped working and that the default subscription is public information, the maintenance picture is one of a personal config that is shared, not a supported distribution.

Editorial conclusion

Adopt smxl/500 if you already run Quantumult X, Loon or Stash, understand MITM certificate handling, and want a GeoIP-driven rule set you can trim by deleting rewrite entries. Do not adopt it if you need documented maintenance commitments, a stated licence, or a configuration whose default subscription you can trust with sensitive traffic. Before importing 500.conf, generate your own MITM certificate rather than relying on the public one the README warns about, and replace the default server_remote entry with your own subscription URL.

Frequently asked questions

Official sources

1. Issues
2. Project website
3. README
4. smxl/500 on GitHub