Start with the boundary: this filters Fake-IP answers, not routing policy
This guide solves one problem: a domain should not receive a Fake-IP answer in OpenClash, or you need explicit control over which domains do. The steps apply to the stable OpenClash v0.47.156 release on OpenWrt, using the Mihomo core and OpenClash's fake-ip operation mode. Do not copy the interface steps to an older release, another Clash client, or a redir-host setup without rechecking them.
Mihomo's official DNS reference defines fake-ip-filter as a filter for Fake-IP mapping. It chooses whether a DNS query receives a synthetic address or a real resolver result. It does not choose DIRECT or PROXY; routing rules and proxy groups still select the outbound path. Adding a domain here is therefore not a substitute for a direct rule, and it cannot repair an unavailable proxy node.
If the setting is absent, stop and check the mode: the v0.47.156 UI source exposes Fake-IP Range, Fake-IP persistence, and Fake-IP-Filter only when the current operation mode is fake-ip. Do not force this procedure into a redir-host configuration merely to make the option appear.
The full path is normally “Services → OpenClash → Overwrite Settings → DNS Settings,” with localized equivalents in some LuCI themes and language packs. Identify the controls by Fake-IP-Filter and Fake-IP-Filter-Mode, not by a screenshot's position or color.
Choose the match direction before entering any domain
Open “Overwrite Settings → DNS Settings” and enable Fake-IP-Filter. OpenClash v0.47.156 offers blacklist, whitelist, and rule; blacklist is the default. These names describe the Fake-IP response set, not a blocklist or allowlist of proxy servers.
| Mode | DNS behavior | Best small use case |
|---|---|---|
blacklist | Matches use real resolution; non-matches may still receive Fake-IP | Exclude a few problematic domains; begin here |
whitelist | Matches receive Fake-IP; non-matches use real resolution | Only a defined set should use Fake-IP |
rule | Apply the first matching fake-ip or real-ip; default to Fake-IP if every rule misses | Mix both outcomes with explicit precedence |
A common mistake is selecting whitelist while continuing to treat the text area as a list of domains that should bypass Fake-IP. Whitelist mode is the inverse: only matches receive Fake-IP. If one printer, corporate hostname, captive-portal check, or application domain is failing, keep the default blacklist behavior for the first test instead of reversing DNS behavior for every other name.
Record the baseline: save the current mode, original list, DNS answer, and exact failure. Change either the mode or one entry at a time. Simultaneously replacing upstream DNS, mainland bypass, IPv6, rule sets, and browser Secure DNS removes the evidence needed to diagnose the result.
Run the first test with one domain in blacklist mode
Choose one full hostname that reliably reproduces the problem. device.example.net below is only a placeholder chosen not to overlap the bundled defaults; replace it with the actual failing hostname confirmed in your log. The Fake-IP-Filter editor accepts one entry per line. Do not add YAML list dashes or append prose. In v0.47.156, the UI writes this text to /etc/openclash/custom/openclash_custom_fake_filter.list; the overwrite process then merges the entries into dns.fake-ip-filter.
Fake-IP-Filter · blacklistdevice.example.net
- Confirm that OpenClash is running in
fake-ipmode, record the old DNS answer and application symptom, and back up the current list as described near the end of this guide. - Open “Overwrite Settings → DNS Settings,” enable Fake-IP-Filter, and leave the mode on
blacklist. - Add only the full hostname. When you are ready to test, use “Apply Settings” once; it commits the changes, enables OpenClash, restarts it, and regenerates the runtime configuration. You do not need to click “Commit Settings” first.
- Wait for the plugin to run again and check the startup log for the first YAML, Fake-IP-Filter, or DNS error.
- Query again from the same device while it still uses the router's DNS, then retry the original application without changing nodes or proxy mode.
Expand the match only after the exact name works. In Mihomo's Clash-style domain syntax, *.example.com matches one subdomain level but not the root or deeper levels. +.example.com behaves like a suffix match and includes the root plus multiple subdomain levels. Wildcards need quotes in Mihomo YAML, but this OpenClash editor stores plain text lines: do not paste YAML quotes or list dashes here.
Verify before broadening*.device.example.net
+.corp.example.net
Do not add an entire public suffix because several names look related. Determine the exact requested hostname from logs or a DNS trace first. A broad filter can switch a large set of names to real resolution and hide the upstream DNS or routing problem you intended to isolate.
Use whitelist or rule mode only for an intentional design
whitelist is appropriate when only a small, defined set should receive Fake-IP and all other names should receive real resolution. Switching to it changes the default for every non-match; it is not an alternative spelling of a blacklist. Test sign-in flows, LAN services, representative local and remote sites, and routing rules on one device before applying that design network-wide.
Back up and audit the final runtime list before switching: in whitelist mode, every existing plain entry in the merged list is inverted to mean “return Fake-IP on a match.” In rule mode, every non-comment item in the final dns.fake-ip-filter—including filters from the subscription and entries generated by OpenClash—must be a complete rule ending in fake-ip or real-ip. A final MATCH is not required for parsing; Mihomo defaults to Fake-IP when no rule matches, but an explicit fallback is still recommended for auditability. The examples below are standalone test lists, not lines to append to an existing blacklist-style list. Do not switch to rule mode if you cannot audit the final list.
Fake-IP-Filter · whitelist+.proxy-test.example.net
api.proxy-test.example.net
rule mode uses a top-down match order similar to Mihomo routing rules, but the relevant actions are fake-ip and real-ip. Mihomo defaults to Fake-IP when no rule matches; an explicit final action is still recommended to make the result reviewable. This example returns real addresses for two test scopes and Fake-IP for everything else:
Fake-IP-Filter · ruleDOMAIN,device.example.net,real-ip
DOMAIN-SUFFIX,corp.example.net,real-ip
MATCH,fake-ip
Do not use plain blacklist entries in rule mode, and do not put DIRECT, PROXY, or a proxy-group name in the action position. Mihomo also supports GEOSITE and RULE-SET here, but the referenced collection must exist and have a compatible behavior. If you cannot audit its contents, a few explicit DOMAIN and DOMAIN-SUFFIX rules are safer to maintain.
Prefer blacklist for one failing hostname: it preserves existing Fake-IP behavior for everything else and is easiest to undo. Choose whitelist or rule only when “a small Fake-IP set” or “ordered mixed outcomes” is the actual requirement.
Verify DNS, the OpenClash log, and a real request separately
In v0.47.156, “Commit Settings” saves the current form and custom list without restarting OpenClash. “Apply Settings” also saves the settings, then enables and restarts OpenClash so the runtime configuration is regenerated. One Apply action is therefore sufficient when you are ready to test; a separate Commit first is unnecessary. A short interruption during restart is expected; a persistent outage is not. Wait for the plugin status to recover and read the generation log before testing DNS.
Replace both placeholders with real valuesnslookup device.example.net <router-LAN-address>
Use the active configuration's fake-ip-range as the authority. The template bundled with OpenClash v0.47.156 uses 198.18.0.1/16, while the overwrite control does not force that value over a subscription by default. After a blacklist match, the response should instead be the upstream's real address, a private address, or an explicit negative answer. The exact result depends on your resolver and domain; merely leaving the configured Fake-IP pool does not prove that the application is fixed.
- Confirm that the test device actually uses the router's DNS instead of browser Secure DNS, application DoH, or a manually configured resolver.
- Query the exact hostname and record the answering server, address, and response status.
- Read the OpenClash log for filter syntax errors or a rejected configuration.
- Repeat the original sign-in, discovery, page load, or connection action.
- Use the connection log to confirm the domain still reaches the intended routing rule and proxy group.
These checks prove different layers: client DNS path, Fake-IP mapping, configuration validity, application behavior, and outbound routing. A ping result alone is insufficient because many services ignore ICMP, and seeing a reserved Fake-IP during fake-ip operation does not automatically mean proxied TCP or UDP has failed.
When the list has no effect, diagnose in a fixed order
If the answer does not change, do not immediately widen the list. Work through the following order to separate a rule that never entered the runtime configuration from a query that bypassed OpenClash entirely.
| Symptom | Check first | Next action |
|---|---|---|
| Fake-IP-Filter is not displayed | Whether operation mode is fake-ip | Confirm scope; do not force it into redir-host |
| One hostname still returns Fake-IP | Enable switch, mode, spelling, actual queried hostname | Return to blacklist with one exact domain |
| Router query is correct but browser still fails | Secure DNS, in-app DoH, caches | Make the test use router DNS and clear the relevant cache |
| Real IP is returned but the site still fails | Routing rule, proxy group, node, certificate error | Separate mapping from outbound connectivity |
| OpenClash fails after Apply | Rule syntax and the first log error | Restore the old list and mode, then add one line |
Also check whether a subscription or another overwrite replaces the DNS section during restart. OpenClash's merge script only handles the custom file when the filter is enabled and the generated configuration is in fake-ip mode. It prepends those entries to the existing dns.fake-ip-filter array, strips each line from # onward, trims surrounding whitespace, and deduplicates only normalized strings that are then identical. Semantically overlapping wildcard and exact-host entries can remain together. OpenClash may also add generated entries. The editor is therefore not the complete runtime list, and a file on disk is not proof that the running configuration consumed it.
Do not turn one symptom into a global exception: find the actual requested hostname in the log before adding a game, printer, or corporate service. Adding geosite:cn, a vendor-wide suffix, or a public collection without evidence can change a very large query set and create a harder second failure.
If the evidence instead points to an IPv6 proxy-node hostname, upstream AAAA response, or DNS hijacking path, use our separate OpenClash IPv6 node-domain DNS troubleshooting guide rather than forcing both problems into fake-ip-filter.
Keep the original list and make every exception reversible
Before the first edit, use SSH to copy the custom list to a private location readable by the administrator. Confirm that the source exists first; if it has not been created, record the disabled control and empty list in LuCI instead. The command backs up only the filter list and overwrites a destination with the same name, so choose a new filename if a backup already exists:
OpenWrt Shellcp /etc/openclash/custom/openclash_custom_fake_filter.list /root/openclash_custom_fake_filter.list.bak
To roll back, restore the original mode and text in LuCI, or disable the custom Fake-IP-Filter, then use “Apply Settings” to regenerate and restart OpenClash. If you copy the backup with the SSH command below, reload LuCI and confirm that the restored text is visible before applying, so a stale form cannot overwrite the file. Confirm that DNS and the original application behavior have returned before testing a narrower entry. Do not delete every subscription, rule set, or client installation to undo one domain exception.
Run only after verifying the backupcp /root/openclash_custom_fake_filter.list.bak /etc/openclash/custom/openclash_custom_fake_filter.list
For ongoing maintenance, record the device or service behind each custom rule, the original symptom, and the last verification date. After a service upgrade or hostname change, remove one exception temporarily and retest. Delete obsolete entries so the file does not become an unreviewed second domain database.
Completion criteria: the change covers only a confirmed hostname scope; blacklist, whitelist, or rule direction matches the requirement; DNS results, logs, and the live application request all show the expected behavior; and the original list plus rollback procedure remain available.
To verify supported platforms or obtain an OpenClash- or Mihomo-related client, visit the site's download page. A download or upgrade does not replace the backup and one-variable test described here.
Official sources and version scope
- OpenClash v0.47.156 official release
- OpenClash v0.47.156 overwrite UI source
- OpenClash v0.47.156 YAML merge source
- Mihomo official DNS configuration
- Mihomo official syntax reference
- Mihomo Fake-IP filter decision source
Version numbers, filenames, and interface labels can change. Confirm them in the linked project documentation before making changes.