{
  "rules": [
    {
      "type": "field",
      "protocol": [
        "ssh"
      ],
      "outboundTag": "rule1",
      "ruleTag": "ssh-ban"
    },
    {
      "type": "field",
      "network": "tcp",
      "port": "25",
      "outboundTag": "rule3",
      "ruleTag": "mail-spam-port"
    },
    {
      "type": "field",
      "protocol": [
        "bittorrent"
      ],
      "outboundTag": "rule3",
      "ruleTag": "bittorrent-protocol-ban"
    },
    {
      "type": "field",
      "network": "tcp,udp",
      "port": "6881-6999,51413",
      "outboundTag": "rule3",
      "ruleTag": "bittorrent-port-ban"
    },
    {
      "type": "field",
      "network": "tcp",
      "port": "22,23,2222,3389,5900-5901",
      "outboundTag": "rule3",
      "ruleTag": "remote-login-scan-port"
    },
    {
      "type": "field",
      "network": "tcp",
      "port": "135,137-139,445",
      "outboundTag": "rule3",
      "ruleTag": "windows-smb-scan-port"
    },
    {
      "type": "field",
      "network": "tcp",
      "port": "1433,1521,3306,5432,6379,9200,9300,11211,27017-27019",
      "outboundTag": "rule3",
      "ruleTag": "database-scan-port"
    },
    {
      "type": "field",
      "network": "udp",
      "port": "19,69,111,137,161,389,1900,5353,11211",
      "outboundTag": "rule3",
      "ruleTag": "udp-amplification-port"
    },
    {
      "type": "field",
      "domain": [
        "domain:gjogvvpsf.biz"
      ],
      "outboundTag": "rule3",
      "ruleTag": "malware-expiro-domain-ban"
    },
    {
      "type": "field",
      "domain": [
        "domain:brederaad-010.nl",
        "domain:mach3builders.nl",
        "domain:ogen.com",
        "domain:tierxhosting.com"
      ],
      "outboundTag": "rule3",
      "ruleTag": "domain-scan"
    },
    {
      "type": "field",
      "domain": [
        "domain:gov.cn",
        "keyword:dafahao",
        "full:api.nn.ci",
        "full:ifconfig.co",
        "full:api.ip.sb",
        "full:myip.ipip.net",
        "full:jsonip.com",
        "full:ip.zxinc.org",
        "full:ip.gs",
        "full:ipwho.is",
        "full:ipv4-ip.api.skk.moe",
        "full:ipv6-ip.api.skk.moe",
        "full:ip.api.skk.moe",
        "domain:ping0.cc",
        "domain:dafahao.com",
        "domain:dwnews.com",
        "domain:pincong.rocks",
        "domain:rfa.org",
        "domain:epochweekly.com",
        "domain:tuidang.org",
        "domain:minghui.org",
        "domain:dongtaiwang.com",
        "domain:epochtimes.com",
        "domain:ntdtv.com",
        "domain:falundafa.org",
        "domain:chinadigitaltimes.net",
        "domain:wujieliulan.com",
        "domain:botanwang.com",
        "full:www.falungong.club",
        "domain:falunaz.net",
        "domain:jinpianwang.com",
        "domain:voachinese.com",
        "domain:voanews.com",
        "domain:bannedbook.org",
        "domain:newhighlandvision.com",
        "domain:ming-jian.net",
        "domain:a513.website",
        "domain:fl513.site",
        "domain:mingjingnews.com",
        "domain:epochtimes.today",
        "domain:mhradio.org",
        "domain:elplural.com",
        "domain:shoplineapp.com",
        "full:db.laomoe.com",
        "full:pass.loukky.com",
        "domain:jiyou.cloud"
      ],
      "outboundTag": "rule3",
      "ruleTag": "domain-ban"
    },
    {
      "type": "field",
      "ip": [
        "8.138.80.41/32"
      ],
      "outboundTag": "rule3",
      "ruleTag": "caclog-ip"
    },
    {
      "type": "field",
      "user": [
        "regexp:\\|48740\\z",
        "regexp:\\|3631312\\z",
        "regexp:\\|19011\\z",
        "regexp:\\|67259\\z",
        "regexp:\\|3060\\z",
        "regexp:\\|67351\\z",
        "regexp:\\|3731098\\z",
        "regexp:\\|1559220\\z",
        "regexp:\\|67510\\z",
        "regexp:\\|3964420\\z"
      ],
      "outboundTag": "rule4",
      "ruleTag": "caclog-user"
    }
  ],
  "outbounds": [
    {
      "type": "allow",
      "outTag": "rule1",
      "data": {
        "rate": 60,
        "burst": 0,
        "time": 60
      }
    },
    {
      "type": "block",
      "outTag": "rule3"
    },
    {
      "type": "record",
      "outTag": "rule4"
    }
  ]
}