Digital Nomad | Attack on Life

How to Use a Hong Kong CSL SIM Card (Step-by-Step Guide)

Thu, 04 Dec 2025 22:45:27 +0800

A friend recently helped me get a Hong Kong CSL SIM card. Although I already use a UK Giffgaff (GG) card, having a Hong Kong number is a great addition, especially for managing HK-based services. Here’s a quick guide on how to activate and use it.

Prerequisites

CSL SIM Card: Available online or at convenience stores in Hong Kong. Check the “Activate by” date on the card.
CSL App: Download the CSL app from a non-mainland App Store (e.g., HK or US).
ID for KYC: You’ll need either a Passport or a Mainland Travel Permit for Hong Kong and Macau Residents (Exit-Entry Permit) for mandatory real-name registration.

Activation Steps

Insert the SIM card into your phone.
Open the CSL app and register/log in.
Real-Name Registration: The app will redirect you to a browser page. Follow the prompts for registration: enter your phone number, receive the verification code, select your ID type (Passport/Permit), and upload a photo of your document. Approval is usually instantaneous, though the service might be suspended if the backend audit fails later.
Maintenance: The card usually comes with a pre-loaded starter plan. To keep the card active for another year, simply purchase any plan before the current one expires. You can cancel the auto-renewal immediately after purchase.

Once activated, you can receive SMS verification codes in mainland China for free.

If you have a Hong Kong number, you can register (or switch) your WeChat account to the Hong Kong region. This enables the WeChat Pay HK wallet, allowing you to spend the balance on your Hong Kong cards directly.

Benefits: Purchases under 200 HKD are usually fee-free, and RMB transactions are automatically converted to HKD.
Why do this?: It’s a great way to keep your HK card active and spend HKD without using up your annual mainland foreign exchange quota.

Final Thoughts

Whether it’s Giffgaff or CSL, I highly recommend having at least one international SIM card. It’s essential for receiving verification codes and registering for global services that might be restricted in certain regions.

Subscribing to X Premium in a Low-Price Region

Wed, 26 Nov 2025 20:44:42 +0800

After spending some time on domestic content platforms, I found the returns were low, and more importantly, content creation is severely restricted. Consequently, I decided to focus on X (formerly Twitter). With Black Friday approaching, it was the perfect time to subscribe to X Premium. Here is the process I followed.

Subscribing via Web

The price displayed is influenced by your proxy’s location. For example, if I use a US proxy, the price is shown in USD. I happened to catch a “$1 for the first month” promotion, so I went ahead and subscribed.
X uses Stripe for payments. In my experience, a Visa card issued by China Merchants Bank works perfectly. Note that subscriptions auto-renew, so if you’re just trying it out, remember to cancel in time.

Subscribing via iOS App Store (Low-Price Regions)

Once my first-month promotion expires, I plan to switch to the iOS App Store for the subscription, as prices can be even lower. For example, if your App Store region is set to Turkey, the X app will display prices in Lira. You can subscribe normally from there. However, if you already have an active web subscription, you cannot subscribe via the App Store until the current membership expires.

How to Cancel

Visit https://x.com/i/premium and click on Manage Premium to cancel your subscription.

Benefits of Premium

Beyond the “blue checkmark” status, I believe the real value of X Premium lies in the ability to participate in the Creator Ads Revenue Sharing program. Of course, this requires building a significant following first.

The eligibility requirements for creator revenue sharing are as follows:

Identity Verification

Revenue sharing now requires identity verification, so I completed this ahead of time:

Select “United States” as the country.
Choose “Passport Visa” as the document type.
Aim the camera at the US visa page of your passport.
Follow the prompts for a “liveness check” (moving your head left and right).

The verification was successful and quite straightforward.

Final Thoughts

With Premium active and my identity verified, the next step is to consistently manage my X account. Given the size of the Chinese-speaking community on X and the even larger global English audience, investing time here feels much more rewarding than on domestic platforms. Time to get to work!

Applying for a Japanese Visa

Thu, 22 May 2025 13:44:53 +0800

I recently planned a trip to Japan, so I applied for a Japanese visa in advance. I found that even in 2025, it’s still quite complicated, though it’s relatively simpler when handled through a company. Here’s a record of the application process for future reference.

Note: The following is the complete process I went through in Beijing. It’s generally the same everywhere, but still follow the travel agency’s requirements carefully.

Choosing a Travel Agency

Japanese visas can only be processed through travel agencies, which is also stated on the official website. There are many travel agencies to choose from. I prioritized internet-based travel companies like Ctrip, Qunar, and Mafengwo. After a quick comparison, I ultimately chose Ctrip.

Notes

Always choose reputable travel agencies as they are relatively more standardized and secure, though prices might be higher.
For agencies like Ctrip/Qunar, always choose their self-operated services for better reliability.

Single Entry, Three Years, or Five Years?

Different types have different prices and different documentation requirements. Since I don’t have much savings and have a low income, I ultimately chose a 3-year multiple entry visa, which costs 488 CNY on Ctrip. It’s all because I’m poor - otherwise I would prefer the 5-year visa.

Notes

Choose the option that includes flight and hotel documentation assistance, because visa applications require flight/hotel information, but we often can’t fully confirm our plans or when the visa will be approved. To avoid losses, it’s better to get the visa first, then buy tickets and book hotels.
If you have sufficient savings or high income, you can choose the 5-year multiple entry visa, which is definitely more cost-effective.

Document Preparation

Ctrip provides very detailed instructions about documents. Here I’ll briefly highlight the key points:

Original passport
Original photos
- 2 inches, white background
- Recommended to take photos at home against a wall. Apps like Alipay support one-click background replacement, then you can buy photo printing services on JD.com. For example, I printed photos for 2 people on JD for only 14 CNY.
ID card photocopy
Household registration book photocopy
- If you’re from outside Beijing like me, you also need residence permit photocopy and original residence permit confirmation
Tax statement photocopy
Marriage certificate photocopy
Original application form
- Personal signature required
Applicant information processing consent form
- Personal signature required

Visa Application Process

Ctrip’s process is already very professional and clear, so just follow the steps above:

Confirm you meet the requirements and place an online order.
Prepare documents.
Submit documents - Ctrip online review.
- Ctrip provides an online document submission portal. After submission, results come within one business day. If there are issues with documents, they will notify you.
After Ctrip pre-approval - mail documents.
- Make sure to confirm no documents are missing, otherwise you’ll have to mail again and waste time.
- If there are document issues, Ctrip will call to notify you, so pay attention to phone calls.
Wait for visa approval, usually 7 business days.

Final Thoughts

Life is short, we need to explore. If you have time, I still recommend going out to see the world.

Ctrip - Japan Individual Tourist Visa 3-Year Multiple Entry Beijing Submission - Simplified Processing

Purchasing JetBrains AI Assistant from Low-Price Regions

Fri, 03 Jan 2025 11:50:57 +0800

JetBrains charges USD 10/month for AI Assistant in the US store—steep. The China store currently offers 50% off, albeit with Alibaba Cloud-backed AI if you connect directly. With a little region juggling and a proxy, you can pay China-store pricing while keeping the JetBrains-hosted AI service.

Change your JetBrains account region

Visit https://account.jetbrains.com/profile-details and set your country to China.

As of this writing JetBrains lets you switch countries multiple times—no hard limit observed.

Pricing follows the country on your account, so confirm the change before purchasing. The current monthly price is ¥41.

https://www.jetbrains.com.cn/ai/#plans-and-pricing

Check your license

Visit https://account.jetbrains.com/licenses to confirm the AI Assistant subscription.

If your JetBrains account belongs to an organization (e.g., an open-source license pool), grant AI Assistant access to the members explicitly.

Enable the plugin inside the IDE

Install the JetBrains AI Assistant plugin.
Activate the license. If the IDE reports an invalid license, deactivate and reactivate—it will refresh against your account.

Route the IDE through a proxy

To access the JetBrains-hosted models, the IDE must go through a proxy. Without the proxy it falls back to the China-region Alibaba Cloud models.

Surge users can reuse my consolidated AI rule set: https://github.com/alanhe421/surge-config/blob/main/rules/AI.rule
For other tools, proxy at least the following domain:

api.app.prod.grazie.aws.intellij.net

Troubleshooting

Error: “Your access to AI Assistant could not be verified.”

Confirm your subscription is active.
Verify the proxy is working.
For organization accounts, ensure the member permissions include AI Assistant.

Notes

Because subscriptions auto-renew, consider canceling renewal immediately or avoid changing your region again; renewal happens at the current region’s price, which might not include the discount. I disabled auto-renew while testing.

Final Thoughts

This approach lets you pay the lower China-store price while tapping into the global JetBrains AI backend—a neat bit of arbitrage.
That said, the JetBrains AI Assistant still lags tools like Cursor: weaker interactions and no Claude models. It’s better than nothing, but manage expectations.

Surge Configuration Tips: Subscription Nodes + Custom Rules

Wed, 20 Nov 2024 22:38:06 +0800

Background

Airports often supply full Surge configs containing nodes, rules, scripts, etc. Sometimes I only want their nodes while keeping my own rules. Modules can override parts of a profile, but what if you want to ignore the provider’s rules entirely? Here’s the setup I use.

Create a Policy Group with Subscription Nodes

Add an external subscription policy group and enable auto-update. Use whichever policy type (auto/manual) fits your workflow.

Most subscriptions include a dummy node that reports remaining bandwidth. I keep it—it’s handy for monitoring quota.

Create Additional Policy Groups

Build other policy groups that reference the subscription group, and add any custom nodes you maintain manually.

Now you have a policy group that combines all airport nodes with your own endpoints.

Use Filters to Build Specialized Groups

Need Netflix-only nodes (e.g., SG + JP)? Create a manual policy group, include the subscription group, and add filters to narrow the selection.

This approach lets you form country/app-specific policy groups. I have dedicated ones for Netflix, Spotify, Telegram, etc.

Add Your Own Rules

Because we’re not using the airport’s rules, add rules manually (or subscribe to trusted rulesets). To avoid surprises, I prefer explicit hand-maintained rules tailored to my setup.

Final Thoughts

With this structure you can subscribe to remote nodes, keep custom policies, and retain full control over routing logic.

Saving on AI: Subscribing to ChatGPT Plus via the Turkey Region

Fri, 15 Nov 2024 16:55:23 +0800

For a long time, I subscribed to ChatGPT Plus using a US-based Apple ID. Even in tax-free states, the cost was a flat $20 per month (approximately 145 CNY). In an effort to optimize my digital expenses, I switched to the Turkey region. The price there is currently 499 TRY (inclusive of tax), which works out to about 92 CNY per month—a significant saving.

1. Register a Turkish Apple ID

Visit the Apple ID creation page and follow these steps:

Click “Create Your Apple ID”.
Set the country/region to Turkey.
You can use your existing mobile number (including +86 numbers) for verification; Apple generally allows one number to be linked to multiple IDs across different regions.
For the required Turkish address, you can use a random address generator to fill in the placeholders.

2. Signing In

Sometimes, logging into a new regional ID directly on your device can trigger errors or verification loops. If this happens, try logging in through the web portal at account.apple.com using a reliable proxy set to a neutral location (like Japan or the US). Once the account is verified on the web, it usually works smoothly on your iPhone or Mac.

3. Funding Your Account

This is the most critical part, as standard international credit cards (like a Chinese Visa/Mastercard) cannot be linked directly to a Turkish Apple ID.

No Digital Gift Cards: Apple does not sell official digital gift cards on its Turkish website.
Third-Party Sellers: You will need to purchase Turkish Apple Gift Cards from marketplaces like Taobao, Xianyu, or SeaGM.
- Tip: Only buy from reputable sellers with high ratings to avoid “black cards” (purchased with stolen credit cards), which can lead to your Apple ID being banned.
- For reference, I recently purchased a 1,000 TRY gift card for approximately 182.5 CNY.

Once you redeem the code in the App Store, your balance will be updated, and you can complete the ChatGPT Plus subscription within the app.

What About the Nigeria Region?

You might have heard that Nigeria is even cheaper, with ChatGPT Plus costing around 9,900 NGN (~43 CNY/month). However, Nigeria is much harder to access:

They do not support Apple Gift Cards.
You need a local Nigerian bank card (like those from Chipper or Geegpay).
Registration often requires a local phone number. Unless you enjoy extreme “digital nomad” challenges, I wouldn’t recommend it. Turkey offers the best balance of ease and savings.

Final Thoughts

Once you’ve set up a Turkish Apple ID for ChatGPT, you can also use it to save on other services like YouTube Premium, iCloud storage, or Netflix.
Compared to the standard US pricing, this method cuts your monthly cost by roughly 35%, adding up to significant savings over a year.

Linux.do Discussion on Regional Subscriptions

How to Use a Physical Giffgaff SIM (Step-by-Step Guide)

Mon, 19 Aug 2024 22:09:22 +0800

我新买的GoogleVoice又被封，同时Claude绑定手机号也屏蔽了GoogleVoice，所以只能换办法解决。

这里接受朋友的推荐，搞了下GG卡，实际体验效果还不错。

购买空白卡

推荐访问电报群-@giffgaffchat，查看公告中的微信小程序，直接扫码进入小程序，直接购买，我这里花费大约4CNY,48小时内发货。
快递会以挂号信形式发送，注意填写正确手机号接收即可。

手机卡激活

手机插入卡，很快会收到激活短信链接，推荐走PC访问进行GG注册。
- 注意保存登录名称和密码。
选择合适套餐，由于我这里目前只是接收短信验证码，因此选择Pay as you go，这样无月租，初次注册，需要充值10英镑，注册成功会赠送5英镑。

套餐后期也可更改，因此不必担心。
注册成功后，手机会收到一条信息，告知最终手机号。注意这里没带+44英国区号。
iPhone的话，注意facetime/imessage关闭该手机号的使用，关闭语音留言。

到此，一个英国手机号OK了。

GG卡资费

了解下GG卡的一些资费情况。

短信每条0.3英镑2.773人民币。
接打电话每分钟1英镑。
流量上网 MB/0.2英镑。

保活

海外运营商一般都有保号要求，99卡要求每180天话费余额需要变动一次，否则号码会被回收。在国内，最低成本就是发出一条短信，发送对象是国内外手机号码均可以，每条0.3磅，因此一年消费0.6磅，仅仅不到6元人民币。每次话费余额变化后，例如充值，消费，保号周期重新开始计算。首次充值，也属于余额变动，因此在180天内完成保号即可。

简单点，直接每6个月发条短信到国内手机号或者其它GG号即可。比如GG卡要加0044，国内手机号加0086。

总花费

挂号信 4.5CNY
保活/年，6CNY

整体成本还行，并不贵。

手机号用途

辛苦搞定了手机号，那用在哪呢？其实地方很多。

Claude
Telegram
Twitter

等等，即使是国内App服务，注册只要可以选择英国都可以使用，一般也不会被屏蔽。

GG vs Google Voice

Google Voice 是谷歌公司通过互联网技术创新，利用运营商面向企业提供的虚拟号码服务，转为面向中小企业和个人的互联网无卡电话服务，提供了灵活的通话及短信价格、个人隐私保护功能，从而极大的降低了基础移动通信的用户成本，使用便利性。

目前 Google Voice 为了满足美国政府的数字安全法案规定，新申请用户，必须用一个美国真实号码来绑定。同时，goolge voice也给客户提供了付费转换，把虚拟号码转为客户指定的的美国运营商真实号码。这个也说明了，无论虚拟号码还是真实号码本质上是一回事情，

差异主要是集中在是否有实体卡，以及通信服务的权限大小不同，场景不同。因此，google vocie 就是谷歌提供的虚拟号服务，而giffgaff 的手机卡是真实号码。

写在最后

搞定了GG卡，以后不怎么担心国外手机号绑定了。

常见问题

发送短信失败

发送短信及呼出电话格式：0086+中国电话，海外区号+海外手机号码，例如英国是0044+7xxxxxxxxx
经众多卡友实践，即便切换信号到中国移动，如果对方是中国移动的手机号码，由于国内防电信欺诈的原因，通常收不到你发的短信。目前联通及电信的手机号码，还是能接受gg卡发出的国际短信

Enable HTTPS Decryption with Surge on Apple TV

Sun, 16 Jun 2024 23:19:11 +0800

Enabling MITM on Mac or iPhone with Surge is straightforward. How do you do it on Apple TV? Here’s the process I use.

Option 1: Mac Gateway Mode

If Surge on macOS runs in gateway mode with MITM enabled, every Apple TV request routed through the Mac is decrypted automatically—even if Surge on tvOS is off.

Option 2: Direct MITM on Apple TV

Export the certificate from Surge on macOS/iOS (whichever device generated the tvOS profile). Use the same device that created the config to avoid mismatched certificate settings.
Upload the certificate to a cloud service (e.g., Dropbox) to obtain a direct download link. I use Dropbox with dl=1, such as https://www.dropbox.com/scl/fi/aaa.crt?rlkey=xxx&e=1&dl=1.
On Apple TV: Settings → General → Privacy & Security. Under “Share Apple TV Analytics,” press the Play button to add a profile. Enter the certificate URL, then complete the installation.
Go to Settings → General → About → Certificate Trust and trust the certificate.
Add MITM rules to the Surge tvOS profile just as you would on macOS or iOS.
MITM is now active—you can inspect traffic via Surge Dashboard on Mac or iPhone.

Some services (Spotify, Apple, etc.) use SSL pinning. Don’t MITM those hosts or the apps will fail.

Final Thoughts

That’s all it takes to enable MITM on Apple TV.

References

How to Use Surge for tvOS (Step-by-Step Guide)

Sun, 30 Jul 2023 12:00:18 +0800

Surge for tvOS finally opened its beta. I upgraded my Apple TV and documented the steps here.

Notes

tvOS 17 introduced third-party VPN support, enabling Surge to build a tvOS client. Minimum system: tvOS 17.
The tvOS VPN only proxies the Apple TV itself—it doesn’t act as a router.

Setup Steps

Upgrade Apple TV to tvOS 17 beta
- On iPhone, open Apple’s Developer app → Account → sign in (no paid developer membership required).
- On Apple TV, sign in with the same Apple ID. Go to Settings → System → Software Updates and enable beta updates. If the toggle isn’t visible, reboot.
- Install the beta.
Join the Surge TestFlight beta (iOS)
- Visit https://nssurge.com/account → click Apply TestFlight.
- Follow the invite link on iPhone, install TestFlight, and update Surge to the beta.
- In TestFlight on tvOS, install Surge.
Deploy a profile to tvOS
- Launch Surge on Apple TV.
- On iOS: Surge → More → Extra → Surge tvOS, pick the Apple TV and the profile, then tap Deploy.
- Back on tvOS, open Surge and tap Activate.

Common Issues

“Profile Not Found”

Please configure using Surge iOS under the same iCloud account first, and then try again after waiting for a few minutes.

Deploy the profile from iOS (Step 3) and try again.

Apple TV not using the VPN?

Surge only handles device-level proxying. For whole-network routing, use a router/gateway solution.

Connection refused when adding Apple TV under Tools

Remove the TV from Surge iOS (home screen → Surge Ponte), then redeploy.

Additional Info

Surge for tvOS currently doesn’t count against your iOS license quota—free to use during beta.

Final Thoughts

After this setup, Apple TV can proxy traffic cleanly. Router-based solutions still work, but Surge makes per-device control effortless.

Reference

Official guide: https://community.nssurge.com/d/1936-surge-tvos

How to Use Surge Together with Whistle (Step-by-Step Guide)

Thu, 30 Sep 2021 17:46:58 +0800

Surge is my go-to proxy tool—flexible rules plus an open API make automation easy. At work, though, I still rely on the company’s OA client and Whistle for HTTP debugging. During a break I explored how to make them coexist cleanly.

Current Setup

Personal Macs: Surge handles all proxies and “over-the-wall” access.
Work Mac:
1. Company OA client handles internal network, authentication, and internet access.
2. Whistle + SwitchyOmega handles web debugging.

Chrome proxies through Whistle; unmatched traffic falls back to the system proxy.

Improvements I Already Have

Alfred workflow for Whistle to switch rules quickly.
Alfred workflow for Surge to toggle modes/policies fast.

Pain Points

SwitchyOmega requires manual toggles.
Whistle sometimes crashes (partly corporate network instability, partly heavy load).
The OA client handles external sites but is slower than my personal proxies, and some sites are blocked.

Goal: run OA + Surge + Whistle together, dropping SwitchyOmega.

Benefits

Eliminate SwitchyOmega—let Surge distribute traffic for Chrome, Safari, etc.
External requests that don’t need Whistle go straight through Surge for better speed.
Easily choose between OA routes and personal nodes for internet access.
Toggle Whistle debugging on/off with a rule or module.

Solution

Remove SwitchyOmega from Chrome. Keep the OA client running, enable Surge, but disable Surge enhanced mode.

Update Surge config:

Add a Whistle proxy node:

Dev-Whistle-local = http, 127.0.0.1, 8899

Add rules routing browser processes through Whistle:

PROCESS-NAME,Google Chrome*,Dev-Whistle-local
OR,((PROCESS-NAME,Safari*), (PROCESS-NAME,/Library/Apple/System/Library/StagedFrameworks/Safari/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.Networking.xpc/Contents/MacOS/com.apple.WebKit.Networking), (PROCESS-NAME,/System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.Networking.xpc/Contents/MacOS/com.apple.WebKit.Networking)),Dev-Whistle-local
PROCESS-NAME,firefox*,Dev-Whistle-local
PROCESS-NAME,Microsoft Edge*,Dev-Whistle-local

Notes

Place these process rules after domain-based ones so sites like Google/GitHub still hit the desired proxy first.
Safari is tricky—Surge matches on proc_pidpath(), so versions live in different locations. Use an OR expression to cover them.
Since Surge’s HTTP API doesn’t edit rules directly, wrap these rules in a module and toggle via module API/UI.

Result

Workflows no longer need SwitchyOmega. When I need Whistle, I enable the module and all browsers route through it automatically.
The OA client can’t proxy every app, so Gmail in Mail.app used to fail. With Surge managing proxies, I can add a rule for Mail and Gmail works again.

Drawbacks

Enhanced mode must stay off; otherwise corporate services fail auth (they expect traffic to originate from the OA proxy).
I don’t list every corporate domain; the final rule defaults to DIRECT to ensure internal access continues to work.
With Chrome fully proxied to Whistle, requests that need an external proxy must be handled by earlier rules; otherwise they’ll go direct.

What About Enhanced Mode?

It’s possible if you map every corporate domain to the OA proxy—but that’s labor-intensive and brittle. I don’t recommend it.

Final Thoughts

After some tweaking, Surge and Whistle coexist nicely alongside the corporate OA client. Safari and other apps can now route through Whistle without juggling Chrome extensions.

How to Use Surge Module (Step-by-Step Guide)

Wed, 04 Aug 2021 09:43:15 +0800

I used to ignore Surge modules—installed a few community ones, never dug deeper. After reading more and experimenting, I realized they solve specific problems elegantly. Here’s what I learned.

What Is a Module?

Officially, a module patches the active profile. Think of it as an overlay with limited sections (Rules, MITM, etc.). Support matrix: https://community.nssurge.com/d/225-module
Module settings override the base profile. Multiple modules apply in order; later ones win.
Module enable/disable states are not synced across devices (the files themselves are).
Profiles now support #!include fragments, but fragments must contain entire sections. You can’t split the [Rule] block between main and fragment. Modules, however, can inject partial config.

Editing & Reloading

JS changes in a module take effect immediately—no restart needed.
Changing cron jobs requires a restart.

Debugging

Use console.log in module scripts; view logs here:

macOS: ~/Library/Logs/Surge/
iOS: Tools → Log (or Files app under Surge’s sandbox)

How I Use Modules

Install community modules (e.g., CMB/JD daily check-ins). They’re great for automation and HTTP reverse engineering. Be cautious: modules can exfiltrate data—only install from trusted sources. Some require MITM; too many can hurt performance, so enable on demand.
Build custom modules. Example: MitM All. When debugging an app, you might need to decrypt all hosts temporarily; doing that via rules is tedious. With a module you can toggle full MITM on/off quickly.

Installed Modules

v2ex-DailyBonus — auto claim coins.
Mitm All — enable MITM for every host temporarily.
iQIYI DailyBonus
JD DailyBonus
SS Subscription Info — display airport traffic usage.

Find more modules:

After editing a module, restart Surge for changes to apply.

Example: JD DailyBonus

Follow module instructions:

Visit https://bean.m.jd.com (MITM must be enabled).
You’ll see a notification that a cookie was stored.
Cron jobs will run the sign-in automatically.

How it works: the module grabs cookies from the intercepted HTTPS request and saves them. Cron scripts then call the API at scheduled times.

Automating Module Toggles

macOS: use the Alfred workflow to enable/disable modules via Surge API.
iOS: use Shortcuts + Surge’s “Run Script” action.

Common Errors

invalid module — check device restrictions (#!system=Mac fails on iPhone).
Failed to load detached section… — on iOS, use iCloud Drive for profile sync.

Final Thoughts

Surge is powerful but has a learning curve. Modules are developer-oriented, yet they unlock a lot once you grasp the basics.

References

How to Use Surge to Switch Proxy Modes Based on Wi-Fi (Step-by-Step Guide)

Sat, 06 Feb 2021 11:59:35 +0800

If your home router already handles global proxying, there’s no need to enable another proxy on your Mac—it just adds latency. But once you leave home and join office or café Wi-Fi, you do need it. Surge event scripts make this easy to automate.

Docs: https://manual.nssurge.com/scripting/common.html

Configuration

Add this to your config:

[Script]
script1 = type=event,event-name=network-changed,script-path=wifi-changed.js

wifi-changed.js:

const WIFI_DONT_NEED_PROXYS = ['xiaomi_Alan_5G_1'];
const CURRENT_WIFI_SSID_KEY = 'current_wifi_ssid';

if (wifiChanged()) {
 const mode = WIFI_DONT_NEED_PROXYS.includes($network.wifi.ssid)
 ? 'direct'
 : 'rule';
 $surge.setOutboundMode(mode);
 $notification.post(
 'Surge',
 `Wi-Fi changed to ${$network.wifi.ssid || 'cellular'}`,
 `use ${mode} mode`
 );
}

function wifiChanged() {
 const currentWifiSSid = $persistentStore.read(CURRENT_WIFI_SSID_KEY);
 const changed = currentWifiSSid !== $network.wifi.ssid;
 if (changed) $persistentStore.write($network.wifi.ssid, CURRENT_WIFI_SSID_KEY);
 return changed;
}

$done();

Whenever the Wi-Fi SSID changes, Surge switches outbound mode and posts a notification.

The network-changed event fires for any network transition (e.g., toggling VPN). We use $persistentStore to detect real Wi-Fi changes.

Final Thoughts

Out of the box Surge can handle this sort of quality-of-life automation—one more reason it’s my go-to network tool.

Share Surge Proxy Across the LAN

Sat, 23 Jan 2021 22:01:13 +0800

Surge handles per-device proxying nicely, but what about other hardware—smart TVs, Nintendo Switch, etc.? Here are two approaches I use so those devices can hop the firewall without installing Surge.

Use case: the Switch needs a proxy to post to Twitter.

Option 1: Manual Wi-Fi Proxy

Ensure iPhone and Switch are on the same Wi-Fi network.
On the iPhone running Surge, enable Allow Wi-Fi Access.
On the Switch, set Wi-Fi proxy to the IP/port shown in Surge.
Post on Twitter—if it succeeds, you’re done.

macOS Surge works similarly; iPhone is just the example here.

Option 2: macOS DHCP Gateway

Only available on macOS. Treat your MacBook Pro as a bypass gateway.

Disable DHCP on the router (e.g., router IP 192.168.31.1).
Assign a static IP to the Mac (e.g., 192.168.31.2).
In Surge for Mac, enable DHCP. Surge checks the router’s DHCP status and proceeds if it’s off. Recommended IP range: 100-200. Devices that should bypass Surge can stick to addresses outside the range (e.g., 3-99).
Restart the router. As devices reconnect, Surge will list them. By default they do not use Surge as a gateway; right-click each device and select Use Surge as Gateway. Reconnect the device to apply.

Disabling DHCP

In Surge → Devices, turn off DHCP Server.
Re-enable DHCP on the router and reconnect devices.

Practical Notes

Using a primary Mac as a soft router is heavy-handed. I only route select devices through Surge and leave others on the router gateway for stability.
Devices already running Surge (iPhone/iPad) can still use the router gateway (192.168.31.1) to avoid double proxying.
Non-Apple devices get Use Surge as Gateway so they benefit from Surge rules/ad blocking.

Final Thoughts

I’m a Surge fan, so these solutions revolve around it. Each approach has trade-offs, but together they let non-Surge devices enjoy an open internet quickly.

Decrypting HTTPS with Surge

Wed, 30 Dec 2020 19:29:25 +0800

I wasn’t satisfied that a certain fitness app’s personal health data could only be viewed in the official app. Using Surge, I captured the requests; now I can pull data via Postman or my own scripts/apps.

Benefits of Decryption

Decrypting lets you capture and view request/response payloads. Benefits include:

Auditing whether a web/app client is sending sensitive data in the background
Building your own client or admin panels based on the APIs
Writing scripts for one‑click actions, like checking balances or automating daily check‑ins

Here’s how to enable decryption.

Enable Decryption

Examples use macOS v4.0.3 and iOS v4.4.3.
Surge has supported decryption since macOS v3 and iOS v3; features and names may differ slightly.

Configure (macOS)

As shown, in order: enable HTTPS decryption → generate certificate → install at the system level → add domains.

Configure (iOS)

iOS is a bit more involved. First set the default browser to Safari (if you only have Safari, ignore this). iOS recognizes the downloaded certificate properly via Safari.

Then follow the steps as illustrated:

After installation, go to General => About => Certificate Trust Settings and trust the certificate. Surge will indicate trust status when configured correctly.

Finally, enable MitM and add the domains.

Dashboard

After enabling decryption, view decrypted bodies in Dashboard (macOS) or Utilities => Recent Requests (iOS).

Demo uses the macOS Dashboard; browsing there is recommended.
In the Dashboard, enable HTTP Capture; otherwise bodies won’t be decrypted.
Note the small icon color — on success it looks as shown; if decryption fails you’ll see MitM failed.

You should now see request and response bodies.

Connect to a Remote Device

Sometimes you want to view iOS capture data from your Mac. Steps:

Enable Remote Controller: Home => More Settings => Remote Controller

If you see connection refused, verify IP/port/password and retry.

Notes

MitM adds an extra decrypt/encrypt step for requests/responses and may slightly impact performance.
Some apps only trust specific certificates (certificate pinning), so MitM will fail.

Apps with certificate pinning only trust certain certificates or issuers. MitM won’t work in those cases (e.g., iOS requests to apple.com and icloud.com).
The generated certificate is self-signed; if the private key leaks, manually untrust it.
MitM failure is unrelated to performance. It usually means the client closed the connection during the handshake (pinned certs, client logic canceled the request, or you attempted MitM on non‑TLS traffic). Also, enabling MitM without installing or trusting the cert will cause failures.

Final Thoughts

Surge’s HTTPS decryption makes it convenient to inspect local or LAN device traffic. With it, features like custom ad blocking become feasible.
Note that Surge cannot fully replace Charles or Fiddler; it covers basic packet capture use cases.

References

Internet Access Solutions

Sat, 20 Jun 2020 00:00:00 +0800

Without Google access, unable to properly visit GitHub, or browse YouTube, information access becomes very limited. As a programmer, this is even more serious. So on the path of how to access the internet freely, I’ve always needed to explore, especially as restrictions become stricter. But solutions always outnumber problems, and these can be overcome one by one.

My Current Solution

Solutions

Purchasing Proxy Services `Recommended`

I recommend this ✈️ Shadowsocks Proxy Service, been using it for 10+ years.
- Lite membership: $20/year
- Pro membership: $12.95/month, $99.95 USD/year
Proxy services generally provide subscription addresses, recommended for those who don’t want to deal with setup complexity
I chose the annual Pro membership. The difference between Pro and Lite is as follows (refer to the official site for accuracy, below is for reference only):
For pricing, if you’re purchasing around Double 11 (Nov 11), it’s worth waiting for the annual Double 11 renewal activity. For example in 2023, the activity ran from 00:00 on November 10, 2023 to 23:59 on November 13, 2023. Prices are significantly discounted.

⚠️ This solution is suitable for friends who don’t want to build their own nodes - high stability and no hassle.

Self-built Nodes with Vultr/Lightnode and Other Cloud Providers

Recommend Singapore/Hong Kong/Japan
v2ray+https+websocket, decent stability, average latency around 500ms+, not particularly fast, but can solve daily Google searches
Pricing: Recommend choosing hourly billing, like Vultr

Free Cloud Provider Machines

Such as Oracle, for setup instructions see Oracle Permanent Free Machine Usage

Using Private Servers Outside Mainland

For example, using machines from friends outside the mainland. The advantage is exclusive use, and since IPs are usually dynamic, if blocked, generally just restart the machine. Currently I’m using one in Macau with ~100ms latency, which is acceptable.

Clients

Mac
- Surge Paid
- ClashX Free
iPhone
- Surge Paid
- ShadowRocket Paid
  - Supports clash subscriptions
- Spectre Free
Windows
- Clash Free
Android
- Clash Free
Chrome Extension
- Proxy SwitchyOmega Free
AppleTV
- Surge Paid

My Current Tool Stack

Subscription - Shadowsocks proxy service
Surge proxy software (Mac/iOS/ATV multi-platform)
Oracle machine and other VPS for building personal proxy nodes

Using multiple approaches to ensure overall stability.

My Views on Self-built vs Proxy Services

Both self-built and proxy services have pros and cons, both are viable. But for self-built, unless you buy good VPS like Hong Kong ones, latency is still quite high - for example, YouTube HD won’t be satisfactory. So choose proxy methods based on stability and cost considerations. If you’re really unsure and want convenience, I recommend the third approach mentioned above - cheap, try for a year, and find what suits you best through actual usage.
Due to uncertain external environment impacts, there’s no absolute stability, but generally it’s OK. The proxy services recommended above are ones I’ve been using personally, so stability is pretty good.

Final Thoughts

I hope the above information can help some friends.

For Information Freedom — Part 3 (2020)

Sat, 04 Apr 2020 11:23:22 +0800

I recently tried to scale the Great Firewall again for a Udacity promotion. That didn’t work out, but I refined my Google-access setup, which made the effort worth it. Sharing the details for anyone still wondering how to reach Google.

Statement: Accessing Google is strictly for learning and constructive purposes.

A Method That Still Works

v2ray + WebSocket + HTTPS

Quick Deployment Steps

Register a domain name.
Rent a Vultr instance.
- Billed hourly
- Supports Alipay
- Pick CentOS 7
- I recommend the Japan region for lower latency
Follow my README to deploy.

Once you get the hang of it, the whole process takes about 10 minutes.

Vultr Referral

Final Thoughts

Without Google, it’s harder to learn—especially for engineers.
What works today might break tomorrow (think whitelists and policy shifts). That’s just how it is.
Solving this sharpens your grasp of HTTP, DNS, Docker, Shell, and more. Definitely time well spent.

Applying for a U.S. Visa

Sat, 18 Jan 2020 23:15:13 +0800

At the start of the year I began the U.S. visa process. From Jan 6 (prep) to Jan 15 (passport returned), it went smoothly. Sharing tips and pitfalls that may help.

I was applying for a business trip, so it’s a business visa, but the final visa I got is B1/B2.

What to prepare

Required

Invitation letter
Passport
DS-160 application form and confirmation page
Photo (due to date restrictions, it is recommended to take a new photo at a photo studio)
Itinerary
Personal English resume
Assignment letter (issued by my company)
Interview
EVUS registration

Optional

I didn’t actually use these during my interview, but it’s still recommended to prepare them:

Household registration book, salary certificate from the past year, bank statement
Employment contract (not the original)

That’s the full list. Bring more rather than less — it’s hard to make multiple trips. A few highlights below.

Principles

Keep information consistent across invitation, DS‑160, itinerary, etc.
Don’t lie. Answer sensitive questions (e.g., party membership) truthfully.

Invitation letter

It needs to be issued by the U.S. side. Pay attention to the following:

Invitation letter date
Position
Purpose of business trip
Time period

Passport

This won’t be elaborated on here; just prepare it in advance.

DS‑160

I filled out this form several times. Please note a few points

Save often; long forms can crash.
Save your Application ID to resume later.
Don’t submit until you’ve double‑checked everything.

Photo

As mentioned above, take a new photo. Don’t use an old one.

Itinerary

In the itinerary, ensure the time period, address, and purpose are consistent with the invitation letter

Resume (EN)

Fill it out truthfully

Assignment letter

The position mentioned in the assignment letter must be consistent with the information in the above forms.

Interview

It is recommended to go early because the lines are very long. Note that the interview time does not include waiting time, so arrive early; otherwise, if you are late, you will have to reschedule.

Passport return

I had my interview on the 10th, and my passport was mailed to the bank on the 15th. When picking it up, bring your ID and the AWB number received in the email.

EVUS registration

The Chrome browser on Mac will report an error on the final submission page. It is recommended to use Edge or IE for registration

Notes and personal takeaways

I hesitated about whether to declare that I’m a Communist Party member, but in the end, I answered truthfully.
I joined the new company on the 6th, and the invitation letter was also dated the 6th. Initially, I was worried I might be asked to explain why I was going to the U.S. so soon after joining. I prepared an explanation, but it turned out not to be an issue. The online advice that you should have at least one year of stable work experience before applying for a U.S. visa is unfounded. Personally, I don’t think this is a problem as long as all materials are genuine.
Because I was in a hurry, I scheduled the interview for the morning. I was the second person at my interview window. The interviewer was nice; he didn’t ask any questions, just took my passport and said I was approved. So, interviews don't necessarily involve questions. In my case, I wasn’t asked a single question. My experience is that it’s better to go early — the interviewer has just started their workday, so they might be in a better, more relaxed mood.
Some colleagues around me undergo political review every time they go for an interview. The specific reason isn’t clear, but he previously worked at Huawei — whether that’s the reason or not is hard to say.
If your English is not good, don’t try to be brave; just use Chinese. The interviewers can speak Chinese.
For all materials and your performance, remember the basic principle: you will not stay in the U.S.; you are just there for a business trip or tourism. So, if you insist on showing off your English, or if you lack confidence or lie, would you approve such an application if you were the interviewer?

Final Thoughts

Preparing all the materials was very troublesome, but seeing the final 10-year B1/B2 visa was somewhat comforting. These few lines may help some friends.

Deploy V2Ray with Docker

Sat, 16 Nov 2019 15:14:20 +0800

For obvious reasons, getting to Google has become harder. I’ve moved from SS to V2Ray and cycled through Bandwagon, DigitalOcean, and Vultr as VPS providers. Each switch means redeploying everything from scratch—tedious. To save time, I built a Docker image tailored to my needs so I can deploy or update in one go.

Quick Deployment

I put together a helper to generate configs quickly: https://alanhe421.github.io/v2ray-docker/

Fill in the fields, download the generated files, and you’re ready to deploy.

Prerequisites

~~A working connection to reach the VPS provider’s site (e.g., https://bandwagonhost.com/)~~

Picking a VPS

The usual suspects apply. I use Vultr because the pricing is flexible and it has Japanese regions. DO currently lacks Japan nodes.

Once the server is ready, move on to configuration.

Vultr Referral

Notes

The server’s time zone doesn’t really matter—V2Ray adjusts automatically—but make sure the clock is accurate.
DigitalOcean bills by the hour. Shutting down the droplet doesn’t stop charges; deleting it does.
I go with CentOS 7 x64.
I prefer the Japan region: good speed and Hong Kong YouTube Premium works there.

Install Docker CE

$ wget -qO- https://get.docker.com/ | sh

# Allow non-root users to run docker (skip if you’re root)
$ sudo usermod -aG docker username

Start Docker CE

CE stands for Community Edition.

$ sudo systemctl enable docker
$ sudo systemctl start docker

Install Docker Compose

$ sudo curl -L "https://github.com/docker/compose/releases/download/1.24.1/docker-compose-$(uname -s)-$(uname -m)" -o /usr/local/bin/docker-compose
$ sudo chmod +x /usr/local/bin/docker-compose
$ sudo ln -s /usr/local/bin/docker-compose /usr/bin/docker-compose
$ docker-compose --version # verify installation

Prepare the Files

.
├── docker-compose.yml # compose config
├── init-letsencrypt.sh # script to fetch certificates
├── nginx
│   └── conf.d
│   └── default.conf
└── v2ray
 └── config.json

3 directories, 4 files

The full configs live here: alanhe421/v2ray-docker. Below are the fields you need to tweak.

`init-letsencrypt.sh`

Update domains with your own domain name.
Fill in the contact email.

`nginx/conf.d/default.conf`

Replace server_name with your domain.
Update the certificate paths to point to your domain.

`v2ray/config.json`

Change clients.id. I recommend generating a new UUID with this generator.

Uploading the Files

FileZilla works well, or use scp:

$ scp -r /Users/xxx/Documents/GitHub/v2ray-docker root@ip:/var/v2ray-docker

Start the Services

SSH into the VPS and run:

$ cd /var/v2ray-docker
$ chmod +x ./init-letsencrypt.sh
$ ./init-letsencrypt.sh
$ docker-compose up -d

Tips

Containers can reach each other via service names, e.g., V2Ray listens at http://v2ray:10086 inside the network.
When configs change, run docker-compose up -d to recreate the containers. Compose removes the old ones, creates new ones with fresh IPs, and keeps the service names unchanged. Connections to the old containers drop and reconnect to the new ones.
When ./init-letsencrypt.sh succeeds, you’ll see a confirmation message. Failures can happen (for instance, I hit issues on CentOS 8 and switched to 7).
docker-compose restart nginx returning success doesn’t guarantee Nginx actually started—check the logs.
Inside an Nginx container, localhost points to the container itself. Use service names or IPs for upstreams.

Handy Commands

$ docker network ls
$ docker-compose restart # restart all services
$ docker-compose restart nginx # restart just nginx

DNS

Log into your DNS provider and create an A record that points the domain to the VPS IP.

Client Setup

Once the server side is running, configure your client. I use Surge; here’s the latency difference between my old DigitalOcean U.S. node and the current Vultr Japan node:

Reminder

Even with correct settings, connectivity might take a moment. If everything looks right but still fails, give it about 10 minutes.

TL;DR

If you don’t want the background, generate the config bundle here and deploy directly:

https://alanhe421.github.io/v2ray-docker

Suggestions

On Vultr, pick a Japan instance running CentOS 7 x64.
Use clients such as Clash or Surge.

Final Thoughts

After this automation work, spinning up a new V2Ray server only requires inputting the config, uploading the package, and starting the stack—no more tedious manual steps. Totally worth it.

References

How to Use Surge for macOS (Step-by-Step Guide)

Sat, 09 Feb 2019 15:14:20 +0800

I bought Surge for Mac because I wanted fine-grained control over network traffic. For example, sending Gmail via the Mail app should go through a proxy, while messages to other domains should be direct. You can cobble that together with Shadowsocks + Proxifier, but Surge is a cleaner, all-in-one solution.

The manual is long, the price is high ($69.99 for macOS, $49.99 for iOS + $14.99/year for feature unlocks), but after using it for a while and comparing it with similar apps, you’ll understand the appeal—it really does “meet all your personalization about network.”

Purchase link: Official site Payment: Alipay or credit card Tip: Buy from the website, NOT via in-app purchase! Web purchases give you a license key + email immediately; in-app purchases lock you out of license binding for 90 days. Don’t underestimate that email—you’ll need it for beta access or multi-device registration.

Current Versions

I’m a long-time Surge user and always keep it updated. Current versions:

Surge for Mac v5.10.0
Surge for iOS v5.21.0

Download

macOS builds are only available from nssurge.com—Surge Mac is not on the App Store. iOS/tvOS are on the App Store.

Initial Configuration

Surge’s configuration is complex and has a learning curve. The best approach is to start with a template and adjust based on your needs.

Launch Surge → Settings → Configuration.

Choose Install from URL and enter: https://raw.githubusercontent.com/alanhe421/surge-config/main/surge.conf

Proxy Servers

After importing the template, open Proxies and edit the servers to match your own nodes. For example, I have multiple SS endpoints configured:

Once configured, connect to a proxy server. If Google loads, you’re good. Also, in Mail, Gmail messages will route through the proxy while 163.com stays direct.

SS is outdated now; I recommend against building or purchasing SS services.

V2Ray Support

macOS 3.3.1+ / iOS 4.1.0+ support V2Ray.

Configuration Format

v2rayProxy = vmess, xxx.xxx.com, 30544, username=xxxxxx-xx-406xe-8d63-x,, tls=true, ws=true, ws-path=/helloMario

Trojan Support

Supported since 3.4.

Configuration Format

ProxyTrojan = trojan, 192.168.20.6, 443, password=password1

Free Proxy Nodes?

The proxy servers in the downloaded config file are just examples—they don’t actually work. Some people ask me why the proxy isn’t working… well, those are placeholders. Are there free proxy nodes? Yes, search for them yourself.

Free options are the least reliable—they always come at a cost, whether it's time or privacy.

Recommended: use ✈️ or self-host a VPS
Recommended: Docker-based HTTPS+V2Ray setup, reference here

Proxy Chains

When adding a proxy server, you’ll see a “Proxy Chain” option. This lets the proxy access through a downstream proxy instead of directly, hiding your machine’s access info.

For example, I set up a new Singapore server, but SSH direct access was unstable—likely due to the domestic network environment (e.g., IP blacklisting). So I configured a proxy chain: Singapore → HK proxy (dedicated line, fast and stable). After adding the chain, everything worked smoothly. Of course, chaining adds latency since traffic passes through extra hops.

Policy Rules

Route International via Proxy, Domestic via Direct

Adding rules for specific domains is tedious, and too many rules slow down resolution. Instead, set CN traffic to direct and default everything else to proxy:

Generally, it’s not recommended to exceed 500 rules. Rules within rule sets count toward this total.

Ad Blocking Rules

Ad blocking works by rejecting certain links/sites. If you don’t want to maintain your own rules, use community-maintained rule sets. Surge updates them on schedule:
Surge processes rules top-to-bottom with lazy matching. If a rule set doesn’t fit your needs, you can manually add or modify individual rules.

DOMAIN-SET,https://raw.githubusercontent.com/privacy-protection-tools/anti-AD/master/anti-ad-surge2.txt,REJECT

Repo: Click here

Temporary Rules

Via the menu bar’s Temporary Rules, you can add rules on the fly for temporary needs. Temporary rules expire when Surge next reloads the profile.

Policy Groups

Here, I created a policy group (e.g., group-auto-switch) configured to ping a URL every 600ms and select the node with the lowest latency. If, say, the Macau node goes down, it automatically switches to US:

Note: Don't use Google as the test URL—reportedly it doesn't work well.

External Policy Subscription

Besides adding locally configured proxies to policy groups, you can pull policies directly from remote subscription URLs.

For example, I paste my airport subscription URL in, and after confirming, the new policy group auto-populates with all the airport’s proxy nodes. This way you get remote nodes without maintaining them yourself while still using your own proxy rules, rather than adopting the airport’s entire config.

Note: To filter proxies, use Including Filter. For example, setting US will only include proxy names containing “US.”

Need to Temporarily Switch to a Specific Node?

Sometimes you want to temporarily use a specific node. For example, registering a US Apple ID requires a US IP. Auto-switching is convenient, but here’s a better approach than editing the group to remove non-US nodes:

Create a new policy group (e.g., group-final-select), type select, with choices being the auto-switch group and the specific US proxy.
In Rules, replace all instances of group-auto-switch with group-final-select.

Note: A policy group is itself a policy. Understanding this helps.

Day-to-day, you manually select group-auto-switch. When you temporarily need US, just switch to the US proxy.

Smart Policy Groups

v5 introduced the smart policy group type, designed to replace the previous automatic test. The old auto-switch periodically checked and decided the proxy, while smart records the history of selected policies per site and dynamically collects proxy performance data—theoretically getting smarter over time.

Recommended changes for regular users:

Replace url-test with smart directly.
For sites with strict IP requirements, keep dedicated policy groups with manual proxy selection—don’t use smart.
Smart also supports custom weights, but unless you have special needs, leave the defaults:
```
policy-priority="Premium:0.9;SG:1.3"
```

System Proxy

Can System Proxy and VPN Coexist?

Yes. Add the following configuration with your internal domains, so both intranet resolution and external proxy work simultaneously:

[Host]
internal.example.com = server:syslib

Surge’s official answer: Click here

Note: To match multiple subdomains, use *.example.com. Don’t use example.com—the latter sometimes doesn’t work in testing.

Enhanced Mode

Some apps don’t use the system proxy. Enhanced mode solves this.

For example, the Mac Telegram client just shows loading without enhanced mode. Enable it and the issue resolves. You could also set a proxy within Telegram, but handling it all in one app is more elegant.

Click the menu bar → check Enhanced Mode.

Using VPN with Enhanced Mode?

For example, when working remotely I need OpenConnect for the company VPN, but Surge’s enhanced mode routes all traffic through the proxy—they conflict. With enhanced mode on, you can’t connect to the company VPN. So you need to turn it off.

But if enhanced mode is off, Mail or Telegram need their own proxy configs for internet access.

Mail can be handled by adding a ProcessName type Rule:
Telegram can’t be solved via Rules, but the app itself has proxy settings:

Setting => Data and Storage => Proxy

So if you need to simultaneously connect to a company VPN, enhanced mode must be off.

iCloud Configuration Sync

Surge has great iCloud support. I recommend storing your config files in the iCloud path for easy multi-device sync and backup.

iOS Sync

On iOS, go to More → Profile Sync → import the profile from iCloud.

Auto-Reload Configuration

Mac: Surge → More → Profile → select Automatically reload
iOS automatically updates. If a new config syncs while the app is active, you’ll get a notification.

HTTPS Traffic Capture

After three configuration steps, you can view decrypted request and response bodies in the Dashboard.

Advanced Configuration

Surge has some advanced settings that casual users can skip. Power users, read on.

skip-proxy

I was using Surge + Whistle for work proxy rule switching, but recently 192.168.x.x rules stopped working. Network logs showed no related records. Initially I suspected Whistle, but external IPs worked fine, so I narrowed it down to Surge not routing those requests to Whistle. The culprit was the skip-proxy setting.

Solution: remove 192.168.1.1/16 from the config.

This parameter tells Surge to bypass (not proxy) specified domains/IP ranges. For example, 127.0.0.1 doesn’t need proxying—forcing it would only waste resources. Configure as needed.

bypass-tun

The key difference from skip-proxy is shown below:

Hide VPN icon:

Add bypass-tun = 0.0.0.0/8, 192.168.0.0/16, 10.0.0.0/8, 172.16.0.0/12

Proxy Explanation

Surge Proxy server: When Surge is active, it automatically proxies all HTTP/HTTPS traffic on iOS, using a single proxy session for maximum performance. Use skip-proxy to specify which traffic bypasses the proxy server.
Surge TUN interface: Most iOS apps use HTTP/HTTPS, but some (e.g., iOS Mail, Facebook) use other protocols like SPDY that can’t be proxied by the proxy server. The TUN interface handles these at a lower level. Use bypass-tun to specify which traffic bypasses TUN processing.
The current TUN interface only handles TCP. ICMP and UDP traffic is dropped, so use bypass-tun to allow those through.

force-http-engine-hosts

I was using Surge to capture WeChat Mini Program requests, but they showed as TCP connections rather than HTTP requests. After consulting the community, I found a solution:

force-http-engine-hosts=112.65.*.*

Normal TCP requests can be captured this way. However, WeChat requests use mmtls encryption, so even when forced to HTTP parsing, the request/response bodies fail to decode.

dns-server

DNS configuration matters—without proper settings, DNS resolution timeouts can cause proxy failures.

dns-server = 114.114.114.114,223.5.5.5,208.67.222.222, system

Local DNS Mapping

Surge supports local DNS mapping, eliminating the need for separate apps like SwitchHosts, iHosts, or manually editing /etc/hosts.
Local DNS mapping is useful for development—e.g., accessing a local or LAN web service via a custom domain.

As shown, I’ve configured domains for both intranet services and local services, allowing access via custom domains like mymac.cn:

Notes

Surge’s skip-proxy typically includes localhost and 127.0.0.1, which tells Surge to skip proxying those addresses. This doesn’t conflict with DNS mapping, so localhost-type addresses still work.
Some apps don’t use Surge’s proxy by default (e.g., Terminal). To ensure DNS mapping works, make sure the app goes through Surge—the simplest way is to enable Enhanced Mode.

Vmess-alterId

If your VMess node requires alterId=0, check the corresponding option in Surge. Other alterId values aren’t supported.

What alterId=0 means:

When VMess AlterID is set to 0, it enables VMessAEAD header encryption to counter replay attacks and length detection.

Module Rules

Besides defining rules in the main config (processed top-to-bottom), you can inject rules via modules that can be dynamically toggled.

Key point: Module rules take priority over the current Profile, and multiple modules are processed in order (later overrides earlier).

A common use case: you want to conditionally route Chrome through a specific proxy but also want a quick toggle. Rules themselves don’t have on/off switches, but modules do.

Example module:

#!name=browser proxy under whistle
#!desc=Route browsers (Chrome, Safari) through Whistle proxy. Requires a proxy node named Dev-Whistle-local
#!system=mac

[Rule]
# Dev debugging - Whistle
PROCESS-NAME,Google Chrome*,Dev-Whistle-local
OR,((PROCESS-NAME,Safari*), (PROCESS-NAME,/Library/Apple/System/Library/StagedFrameworks/Safari/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.Networking.xpc/Contents/MacOS/com.apple.WebKit.Networking), (PROCESS-NAME,/System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.Networking.xpc/Contents/MacOS/com.apple.WebKit.Networking)),Dev-Whistle-local
OR,((PROCESS-NAME,/Applications/Firefox.app/Contents/MacOS/firefox)),Dev-Whistle-local

[Panel]

The iOS version supports custom panels. Combined with Scripts, you can create dynamic panels:

Official docs: here
Example: here

Interface Language

Surge Mac follows the system language by default and doesn’t provide a language switch. To change it without modifying system settings:

# English
defaults write com.nssurge.surge-mac AppleLanguages '(en)'
# Chinese
defaults write com.nssurge.surge-mac AppleLanguages '(zh-Hans)'

For iOS, go to System Settings → find Surge → change “Preferred Language.”

[URL Rewrite]

Surge can also redirect specific domains/URLs:

^https?://(www.)?google.cn https://www.google.com 302

Note: HTTPS URL redirects require enabling MitM decryption for those domains.

HTTP API

Surge Mac provides an HTTP API for programmatic control—e.g., switching profiles or proxy modes.

Enable it:

http-api = examplekey@0.0.0.0:6171

Example

I built an Alfred workflow based on Surge’s HTTP API for quick Surge operations.

Modules

Modules were mentioned above for rules, but they can do much more. Broadly speaking, most Surge configuration can be organized via modules: Rules, Scripts, MitM hostnames, custom Panels, etc.

Here are some modules I personally use:

https://github.com/alanhe421/surge-config

Dashboard

The Dashboard lets you view request data from local or remote devices.

Common uses:

Check proxy routing status
Capture MitM packet data
View DNS resolution results (same as iOS Tools → DNS Result)

IPv6

With Surge proxying enabled, http://www.test-ipv6.com may still fail. Enable IPv6:

ipv6 = true
ipv6-vif = auto

Beta Builds

iOS

To use iOS beta builds, you need to join TestFlight. If you purchased via web/email:

Log in at https://nssurge.com/account
Click Apply TestFlight
Open the invite link on your phone → download TestFlight
Update Surge to the beta

For in-app purchases, you’ll need to wait 90 days, then bind your email in the license section to get a license key. Then follow the same steps.

Related docs: Click here

Mac

Check “Include beta versions” and click Check Now.

Surge Upgrades

Mac versions are one-time purchases. Older versions can be upgraded by paying the difference.

Visit https://nssurge.com/buy_now → click Upgrade

For example, Surge 2.x was discontinued in 2018. If you’re an old v2 user, upgrading is recommended.

Legacy Versions

Surge Mac legacy downloads: here

Multi-Device Strategy (Mac/iOS/tvOS)

Surge currently runs on Mac/iOS/tvOS. For flexible use across devices, here are my practices:

Mac and iOS have independent main config files; tvOS can reuse the iOS config.

Extract proxy servers, proxy groups, and proxy rules into separate file blocks, then include them in the main config:

[Proxy]
#!include block_proxy.dconf

[Proxy Group]
#!include block_group.dconf

[Rule]
#!include block_rule.dconf

Other Issues

License Device Limits

Different licenses have different device limits (max 5). No upgrade to more than 5 devices is available—buy another license if needed.

Account/license management: here

Combining Airport Rules with Local Rules

If you subscribe to an airport’s Surge config but also want custom rules:

Use modules—module rules take priority over profile rules.
Use only the airport’s proxies and maintain all rules locally.

Windows Support?

Surge has no plans for Windows—Apple ecosystem only. Use Clash or similar on Windows.

Still Have Questions?

Official forum: https://community.nssurge.com/
Email: support@nssurge.com
Comment on this blog

Final Thoughts

With all this configured, browsing works seamlessly—proxy failover, automatic node switching—all happening transparently behind the scenes. Powerful, right?

Of course, this guide only covers basic internet access. Surge is far more capable—keep exploring.

References

Network Proxy in WeChat Browser

Sun, 03 Sep 2017 17:56:42 +0800

The website we developed targets specific user groups. For user convenience, we implemented IP login, meaning users can directly log in just by accessing our webpage in a specific network environment. However, we found that when users access our webpage through WeChat browser, but in the same network environment, using mobile browsers doesn’t have this issue.

First, facing this situation - IP login not working, the only possibility is that the IP address changed. I used WeChat to access a test page on our site (IP and UA header information will be displayed), which shows the user’s actual IP. I found the IP had changed, so there’s only one possibility – WeChat is using network proxy!!!

WeChat IP Proxy

I used my Android phone Meizu Note 5 and iPhone iPhone 6 WeChat clients to access the problematic webpage, obtaining corresponding IP address information. The results are as follows:

Seeing this result, I wondered if this problem only exists for this webpage. I tried other webpages, the following is my own site, accessed through the above phones respectively:

Wow, I found no proxy information exists, which proves that WeChat doesn't proxy all sites.

Explanation:

IP is the IP obtained by the backend through request information, i.e., the client’s real IP
IPS is X-Forwarded-For, which records the proxy IP information that the client connection went through to reach the web server

WeChat on Google Play

Since the iOS version of WeChat has no proxy, while the Android version has proxy for some sites, with this difference, likely because Apple is strict, it’s easy to think about the international version of WeChat, since Google Play Store is also very strict. So, I downloaded WeChat app from Google Store, accessed the website, and found it’s consistent with iOS - no proxy IP issues exist.

Conclusion

There’s a difference between WeChat Android and iOS versions - iOS version doesn’t have proxy IP issues
WeChat Android version accesses different sites differently - accessing site A, IP remains unchanged; accessing site B, IP is proxied, and the proxy field itself doesn’t add hop IP information
WeChat client downloaded from Google Play has no proxy issues when accessing any website, consistent with iOS WeChat
Domestic WeChat Android version performs network proxy, and doesn’t put proxy information in X-Forwarded-For, meaning the server side cannot get the client’s real IP

As for which sites WeChat targets for network proxy, this would need direct communication with WeChat customer service. Simply testing to find patterns is time-consuming and meaningless.