# override-rules: proxy client configuration overrides that fit your own nodes

> override-rules is a MIT licensed set of override rules for the Mihomo kernel and for SubStore, the tooling behind Clash Party, Clash Verge and similar clients. It merges rule sources from other projects, adds dedicated groups for specific services, and generates only the proxy groups your actual subscription contains, with nine parameters that switch the whole profile. The author is explicit that it is a personal-use project with affiliate links to two proxy providers.

**powerfullz/override-rules** — powerfullz 的 Mihomo/SubStore 脚本和覆写规则。

- Repository: https://github.com/powerfullz/override-rules
- Stars: 609 · Forks: 134
- Language: TypeScript
- License: MIT
- Published: 2026-10-22 · Updated: 2026-10-22 · Language: en
- Canonical page: https://hysenlabs.com/projects/powerfullz-override-rules

## Why override rules exist at all

A proxy client subscription normally arrives with a rule set already attached to it, and that rule set is somebody else's opinion about which traffic goes where. override-rules is the repository of powerfullz's own opinion, expressed as overrides for the Mihomo kernel and for SubStore, and the README says plainly that it is not recommended for Stash.

The problem being solved is that a subscription is a moving target. The provider's rules change, the user's needs change, and the two rarely agree. An override is a layer applied on top of a subscription, so the rules can be your rules while the nodes remain the provider's.

The mechanism the project relies on is the client side, not the server side. Clash Party, Clash Verge Rev, Clash Nyanpasu and similar clients all support override files or override scripts that are applied to the subscription before the configuration is handed to the kernel. SubStore, the subscription management layer, can do the same thing with a script, and that is the path the README recommends.

Two features distinguish this repository from a hand-written YAML file. The first is that the rule set is assembled from other people's work: it integrates rules from SukkaW/Surge and from the 217heidai adblock filter collection, and it merges the GeoSite and GeoIP data from Loyalsoldier's v2ray-rules-dat. The second is that the override is dynamic. The script identifies the countries or regions of the nodes in your subscription and generates only the groups that actually exist, enumerating node names as they are.

The audience is a single user with a taste, and the author says so. The project is for personal use, issues and pull requests are welcome, and in the absence of specific feedback personal needs and experience come first.

## Rule sources, dedicated groups and the no-resolve default

The rule set is assembled rather than written from scratch, and the README names the pieces.

On top of the Surge and adblock filter collections, the project adds dedicated routing rules for specific services, naming Truth Social, E-Hentai, TikTok and cryptocurrency scenarios as examples. These are the kinds of rule that a general purpose list cannot have, because they only make sense for a user with an account somewhere.

The GeoSite and GeoIP data from v2ray-rules-dat is merged in, which is what gives the country and region groups their membership, and the README describes the aim as more precise routing rather than more rules.

One default is worth understanding because it affects your privacy and your latency rather than your routing. IP rules get no-resolve added by default, which the README says effectively reduces local DNS resolution and improves speed and privacy. The effect is that a rule that would otherwise need a hostname resolved to an IP address now matches on the address as it appears, without your client performing the lookup. This is a common pattern in proxy configurations, and it is worth knowing about because it changes which rules can match.

The structure is also trimmed, with redundant rules removed and the layout kept clear, which the README lists as a feature on its own. A rule set that is easier to read is easier to override, and an override set that is easier to read is easier to customise when you need a different rule for your own network.

## Nine parameters decide the whole profile

The dynamic script accepts parameters after a hash sign in the URL, separated by ampersands, and the README lists every one of them with its default. The set is short enough to hold in your head, and each one changes a visible part of the generated configuration.

grouptype sets the type of the region proxy groups: 0 for a manual select group, 1 for an automatic url-test group, 2 for a load-balance group, with a default of 1. ipv6 enables IPv6 support, default false. full generates a complete configuration rather than an override, which the README says suits a pure kernel start, default false. keepalive enables TCP keep alive, default false, and the footnote is the one to read: without a special need, do not enable it, because it causes abnormal battery drain on mobile devices.

fakeip selects the DNS enhancement mode, using fake-ip rather than redir-host. The default is true when the parameter is not passed, and passing false explicitly uses redir-host. The README mentions that enabling it may help with the problem of a TUN mode that cannot get online. quic allows QUIC traffic over UDP 443, default false, because QUIC is blocked by default to avoid poor UDP performance on nodes degrading the experience.

regex changes how groups are filled, with country and region groups using include-all plus regex filtering, letting the Mihomo kernel filter nodes at runtime rather than the script enumerating node names when it runs. That is the option you want if you have added your own nodes in the client and want them matched by a regular expression. tun enables TUN mode with the gvisor stack, automatic route exclusions and DNS hijacking, default false. And threshold hides a country or region group when it holds fewer nodes than the given value, default 2.

One piece of history is preserved: the older loadbalance parameter still works, and where grouptype is not given, loadbalance true equals grouptype 2 and loadbalance false equals grouptype 1. Booleans accept true or false as well as 1 and 0.

## Importing the script into Clash Party, Verge and SubStore

The install path depends on the client, and the difference matters because only one of them can update the override for you.

For Clash Party and Sparkle, the recommended route is the JavaScript dynamic override, served from jsDelivr:

```text
https://cdn.jsdelivr.net/gh/powerfullz/override-rules/convert.min.js
```

In Clash Party you open the Overrides section on the left, paste that link to import it, then go to Subscription management, open the three dot menu at the top right of the target subscription, choose Edit info, select the override script and save.

There is a catch in that client that the README flags. Clash Party takes over DNS and SNI, the domain sniffing, by default, so you have to turn off the control DNS settings and control domain sniffing options manually in its settings.

For the Clash Verge family, including Clash Verge Rev and Clash Nyanpasu, the instruction is to copy the YAML override you need into the overrides section, and there is no automatic updating.

SubStore is the recommended route, and the reason is dated. On 2025/06/17 the project added the JavaScript format override, which the README says is easier to maintain and has become the preferred method. In the script operation you paste the link with the parameter you want:

```text
https://cdn.jsdelivr.net/gh/powerfullz/override-rules/convert.min.js#grouptype=1
```

For an early look at unreleased work, the README points at the preview branch through a raw GitHub URL instead of the jsDelivr CDN.

The Clash Party limitation is worth repeating because it is a silent behaviour change: an override that sets up routing, combined with a client that manages your DNS, can produce results you did not expect until you look at the DNS settings.

## The pre-generated YAML files, and the limit they carry

Not every client can execute a JavaScript override, so the repository also publishes ready-made YAML files, and the README describes how they are produced.

The main branch no longer tracks or commits the generated artefacts, such as convert.js and the yamls/ directory, to keep the repository clean. Instead, the GitHub Actions release workflow builds them when a v* version is published and pushes them to the current branch and to the release, and it syncs the version in package.json and package-lock.json from the tag without anyone editing it by hand.

The file name encodes the switch settings, and the README gives the pattern:

```text
config_gt-{0|1|2}_ipv6-{0|1}_full-{0|1}_keepalive-{0|1}_fakeip-{0|1}_quic-{0|1}_tun-{0|1}.yaml
```

A specific file therefore corresponds to one combination of the parameters, and the URLs follow from that:

```text
https://cdn.jsdelivr.net/gh/powerfullz/override-rules/yamls/config_gt-0_ipv6-0_full-1_keepalive-0_fakeip-0_quic-0_tun-0.yaml
```

The same path with an @vX.Y.Z segment pins a historical version, and a Forgejo mirror is offered for the same file.

The limitation is stated in a note at the end of that section and it is a real one. The continuous integration only applies a dummy fake_proxies.json to simulate generation, so the YAML cannot tailor the groups to your actual nodes the way the dynamic script does, and it conservatively includes only the common countries and regions. The README's advice is to use the JavaScript override if you want the most efficient routing, and the pre-generated files are the fallback for clients that cannot run scripts.

## Static assets, the Sogou input method and chained proxies

Beyond the parameterised profile, the README documents the individual proxy groups and the reasoning behind the unusual ones.

The static resources group covers the common static content delivery domains and object storage domains. The argument is that images, video, audio, fonts, JavaScript and CSS live on separate domains with no risk control and no authentication, that those domains can be routed over an IP whose cleanliness does not matter, and that the network exit for them is usually better connected to the major CDNs at internet exchange points. The README puts the share of traffic these domains represent in normal browsing at around 70 percent, and the practical advice is that if your provider has cheap nodes, routing static assets there saves quota.

The Sogou input method group exists for a privacy reason. By default it is allowed through, which stops the input method from collecting every character you type and sending it back through domains such as get.sogou.com/q. The README says you can set the group to REJECT if you are concerned about that, and lists what it costs: account sync, dictionary updates and feedback are affected, while voice input and other features still work.

Two other fixes are shown as struck through, the Play store and Steam entries, with the note that they are now the default behaviour, which is a useful signal about how this kind of override evolves.

For chained proxy setups, where a subscription is combined with a self-purchased exit node, the README describes adding a dialer-proxy script when you add the self-built node in SubStore, which makes the override detect it and add two new proxy groups, one for the front proxy and one for the exit node.

## Tailscale nodes, the build pipeline, and a candid licence note

The most recent addition to the rule set is Tailscale. The README notes that the Mihomo kernel supports Tailscale outbound in recent updates, and the override has been updated to configure the proxy groups, the TUN settings and the routing rules automatically when it detects a node of type tailscale in the subscription, with Magic DNS support. A node in that shape looks like this:

```yaml
    type: tailscale
    auth-key: tskey-auth-xxxxxxxx
    control-url: https://controlplane.tailscale.com
    ephemeral: true
    udp: true
```

The README also warns about the node name: it must not be Tailscale, because that would collide with the proxy group of the same name and the client would fail to start. That is the kind of detail that only appears once something has already broken.

The build side is a TypeScript project with a small dependency footprint. The runtime dependency list is one package, the yaml library, and the scripts are the usual ones:

```json
"typecheck": "node node_modules/typescript-native/bin/tsc --noEmit",
"build": "npm run typecheck && node scripts/build.mjs",
"generate": "tsx scripts/yaml_generator/generator.ts",
"artifacts": "npm run build && npm run generate",
```

The tests run through the Node test runner with tsx, linting is ESLint, formatting is Prettier, husky manages the commit hooks, and git-cliff generates the changelog. There is an AGENTS.md for automated contributors, plus documentation pages for customising your own override and for contributing code.

One point of transparency deserves repeating. The README carries an AFF section with registration links to two proxy providers, one of which it calls its main provider, and it says the project is for personal use with personal needs taking priority absent other feedback. That is not a criticism of the rule set, which is openly documented, but it is a fact a team should weigh before making a shared configuration depend on it. The licence is MIT, and the release history is regular, with v2.8.0 published on 2026-10-20 alongside a push to the same day.

## Conclusion

override-rules suits a Clash or Mihomo user who wants one policy applied consistently across subscriptions, who wants groups for specific services rather than a generic country list, and who is willing to read nine parameters before importing a script URL. It does not suit you if you need it to work with Stash, which the README says it is not recommended for, and it does not suit a team that wants a maintained, audited configuration baseline, because the author states that personal needs come first when there is no other feedback. Check three things before you rely on it: that your client can execute a JavaScript override, since the pre-generated YAML path is a fallback with known limits, that you understand the parameter defaults, particularly that keepalive is off by default because of a mobile battery drain issue, and that the DNS and domain sniffing behaviour in your client is what you want, since Clash Party takes over both by default. The newest release is v2.8.0 from 2026-10-20 and the last push to the repository was on the same day.

## FAQ

### What is override-rules and which clients does it work with?

It is a set of configuration overrides for the Mihomo kernel and for SubStore, designed for Clash Party, Sparkle, Clash Verge Rev, Clash Nyanpasu and similar clients. The README states that it is not recommended for Stash.

### How do I pass parameters to the override script?

Append them to the script URL after a hash sign, using ampersands between several of them, for example #grouptype=1. The supported parameters are grouptype, ipv6, full, keepalive, fakeip, quic, regex, tun and threshold, and booleans accept true or false as well as 1 and 0.

### What is the difference between the JS override and the pre-generated YAML files?

The JavaScript script generates groups dynamically from the nodes in your subscription, while the YAML files are pre-generated per parameter combination and can only conservatively include the common countries and regions, because continuous integration simulates generation with a dummy node list. The README recommends the script where the client can run it.

### Why should I keepalive stay disabled in override-rules?

The README says that unless you have a specific need you should not enable it, because it causes abnormal battery drain on mobile devices. It is a startup parameter and defaults to false.

### Does override-rules support Tailscale nodes?

Yes. The override detects nodes of type tailscale in the subscription and configures the proxy groups, the TUN settings and the routing rules automatically, with Magic DNS support. The README warns that a node must not be named Tailscale, since that would collide with the proxy group name and prevent the client from starting.

## Sources

- [Issues](https://github.com/powerfullz/override-rules/issues)
- [License: MIT](https://github.com/powerfullz/override-rules/blob/main/LICENSE)
- [powerfullz/override-rules on GitHub](https://github.com/powerfullz/override-rules)
- [README](https://github.com/powerfullz/override-rules/blob/main/README.md)
- [Releases](https://github.com/powerfullz/override-rules/releases)

---

Hysen Labs editorial analysis, written from the project's own repository and release notes. Cite the canonical page: https://hysenlabs.com/projects/powerfullz-override-rules