Skip to main content



Surfboard follow Surge's profile format

Surge's profile documentation can be viewed here

#!MANAGED-CONFIG interval=60 strict=true # subscribe profile url and auto update config
# Specify dns server used by application
dns-server = system,,,

# Specify doh server used by application
doh-server =

# Specify route rule and domain rule, matching traffic will not be redirected or rejected.
skip-proxy =,,,,, localhost, *.local, //444

# Test url used by url-test and manually node speed test. Redirect proxy will use this url.
proxy-test-url =

# Test url used by url-test and manually node speed test. Direct proxy will use this url.
internet-test-url =

# Timeout for all connectivity test
test-timeout = 5

# Match domain won't get fake ip dns response
always-real-ip = *, *, xbox.*, *

# Establish a http proxy server on your device and provide proxy service in specified ip
http-listen =

# Establish a socks5 proxy server on your device and provide proxy service in specified ip
socks5-listen =

# If proxy not support udp relay, use DIRECT or REJECT instead
udp-policy-not-supported-behaviour = DIRECT

# map '' to '' =

# map any domain end with '.dev' to ''
*.dev =

# alias '' dns query result to '' =

# assign '' as dns server for '' = server:

# build in policy
On = direct
Off = reject

# http proxy
ProxyHTTP = http,, 443, username, password

# https proxy
ProxyHTTPS = https,, 443, username, password, skip-cert-verify=true,

# socks5 proxy
ProxySOCKS5 = socks5,, 443, username, password, udp-relay=false

# socks5 over tls proxy
ProxySOCKS5TLS = socks5-tls,, 443, username, password, skip-cert-verify=true,

# shadowsocks proxy, simple-obfs supported
ProxySS = ss,, 8000, encrypt-method=chacha20-ietf-poly1305, password=abcd1234, udp-relay=false, obfs=http,, obfs-uri=/

# vmess proxy, tls and websocket supported, pure tcp is not supported
ProxyVMess = vmess,, 8000, username=0233d11c-15a4-47d3-ade3-48ffca0ce119, udp-relay=false, ws=true, tls=true, ws-path=/v2, ws-headers=X-Header-1:value|X-Header-2:value, skip-cert-verify=true,, vmess-aead=true

# trojan proxy, trojan grpc is not supported
ProxyTrojan = trojan,, 443, password=password1, udp-relay=false, skip-cert-verify=true,

# wireguard proxy
ProxyWireguard = wireguard, section-name = HomeServer

[WireGuard HomeServer]
private-key = sDEZLACT3zgNCS0CyClgcBC2eYROqYrwLT4wdtAJj3s=
self-ip =
dns-server =
mtu = 1280
peer = (public-key = fWO8XS9/nwUQcqnkfBpKeqIqbzclQ6EKP20Pgvzwclg=, allowed-ips =, endpoint =

[Proxy Group]
# proxy group whose selected proxy can be changed manually
SelectGroup = select, ProxyHTTP, ProxyHTTPS, DIRECT, REJECT

# proxy group whose selected proxy can be decided based on url test result automatically
AutoTestGroup = url-test, ProxySOCKS5, ProxySOCKS5TLS, url=, interval=600, tolerance=100, timeout=5, hidden=true

# proxy group with a external proxies list url
ExternalGroup = select, policy-path=, policy-regex-filter=HK-.*
AutoExternalGroup = url-test, policy-path=

# proxy group which contains all proxy under [Proxy] section
AllProxies = select, include-all-proxies = true

# proxy group which contains all proxy from other group by name
IncludeOtherGroup = select, include-other-group = "SelectGroup, ExternalGroup", policy-regex-filter=Proxy.*

# proxy group whose selection is chosen randomly
LoadBalanceGroup = load-balance, ProxyHTTP, ProxyHTTPS

# proxy group just like url-test but follow 'first come first served' rule
FallbackGroup = fallback, ProxySOCKS5, ProxySOCKS5TLS, url=, interval=600, timeout=5

# domain exact match '' will be redirected to proxy named 'ProxyHTTP' in [Proxy] section

# domain exact match '' will be redirected to proxy group named 'SelectGroup' in [Proxy Group] section

# domain ends with '' will be redirected to 'Proxy', DNS query of this domain will triggered in the remote proxy

# domain contains 'google' keyword will be redirected to 'Proxy', a fake ip will be returned in DNS query

# destination ip match route '' will be sent directly

# destination ip located in United State will be rejected

# traffic sent by application whose package name is '' will be sent to 'Proxy'
PROCESS-NAME,,Proxy # android package name
PROCESS-NAME,*google*,Proxy # android package name wildcard rule

# traffic match external rules defined in '' will be sent to 'ProxyVMess'

# traffic match external domain rules defined in '' will be rejected'

# traffic sent using wifi whose ssid name is 'CMCC' will be rejected

# traffic sent using wifi whose bssid is 'F4-98-A0-73-3A-5B' will be sent directly

# traffic sent through a router whose ip is '' will be sent directly

# traffic sent using wifi will be sent directly

# traffic sent using wired network will be sent directly

# traffic sent using mobile network will be sent through 'SelectGroup'

# traffic sent using mobile network whose MCC is 100 and MNC is 200, will be sent directly

# traffic doesn't match rules above will be sent to 'ProxyTrojan'

PanelA = title="Panel Title", content="Panel Content\nSecondLine", style=info

You can read on for detailed definitions of different sections