Distorted Scribbles

Understanding the Regulations on the Administration of Internet Information Services (Draft Amendment for Comment) — Is a Blanket Ban on Circumvention Tools Finally Coming?

Sun, 05 Jul 2026 21:44:28 +0800

The Cyberspace Administration of China (CAC)¹ recently opened another round of public consultation on the Regulations on the Administration of Internet Information Services (Draft Amendment for Comment)² (hereafter ’the Regulations’), and several of the revised provisions inside it have got a lot of people worried — particularly the language around ‘penetrating or circumventing technical measures’ and ‘information lawfully blocked’. Almost overnight, cries of ‘circumvention is now flatly illegal’ and ‘here comes the blanket ban’ started flooding the internet.

Discussions about ‘blanket bans’ and ‘whitelisting’ crop up online almost every year, and if you can’t quite gauge how big an audience this line of argument has, just look back at how the ‘ban on exporting personal data’ provision was interpreted a few years ago. Right then, let’s have a proper look at whether this round of the Regulations really is ‘an escalation in control’, or just a bit of routine technical legislative tidying up.

Article 26: Does it explicitly make ‘circumvention’ illegal?

Article 26 No organisation or individual shall carry out any of the following acts that disrupt the order of internet information services:

(1) Publishing, deleting, blocking, disconnecting links to, replacing, demoting, or algorithmically recommending information, or providing such services to others;

(2) Falsely registering or registering internet accounts in bulk, or illegally hoarding or trading internet accounts;

(3) Manipulating or using multiple internet accounts in bulk to publish information containing content prohibited by laws and administrative regulations and other harmful information, engaging in false clicks, votes, rankings, leaderboards, comments, transactions, or reviews, fabricating traffic, hijacking traffic, manufacturing false public opinion hotspots, or manipulating leaderboards and trending topics and other key elements;

(4) Carrying out unlawful acts of penetrating or circumventing the technical measures of relevant state institutions;

(5) Other acts prohibited by laws and administrative regulations.

Internet information service providers shall adopt measures such as monitoring for abnormal data and conducting manual review, and strengthen the prevention and monitoring of the acts specified in the preceding paragraph.

At first glance this looks genuinely alarming — doesn’t this explicitly make circumvention illegal? The drafting of laws and regulations demands close parsing of every word; almost every legal provision goes through repeated scrutiny and wording. Read that clause again, slowly:

Carrying out unlawful acts of penetrating or circumventing the technical measures of relevant state institutions

‘Unlawful’ is the modifier here, qualifying the act of ‘penetrating or circumventing the technical measures of relevant state institutions’. In other words, not all penetration or circumvention is prohibited — only the ‘unlawful’ kind is.

What counts as ‘unlawful’

So what does ‘unlawful’ (违法) actually mean here?

The NPC Standing Committee’s Legislative Affairs Commission’s Legislative Technical Specifications gives a clear definition of the concept of ‘unlawful’: ‘unlawful’ generally refers to conduct that violates a mandatory rule of law³. In other words, to determine that an act is ‘unlawful’, there has to be a clear, mandatory legal rule that it actually violates — you can’t just assert it out of thin air. Here are two reference examples given in that specification:

Example 1: If an inspected unit or individual refuses to stop unlawful conduct, causing serious soil erosion, and this is reported to and approved by the water administration authority, the tools, construction machinery, equipment, etc. used to carry out the unlawful conduct may be seized or impounded. (Article 43, Soil and Water Conservation Law)
Example 2: Where a villagers’ committee fails to promptly publicise matters that should be publicised, or the matters publicised are untrue, villagers have the right to report this to the township, ethnic township, or town government, or to the county-level government and its relevant competent department, and the relevant government or competent department shall be responsible for investigating and verifying the matter and ordering publication in accordance with the law; where unlawful conduct is confirmed upon investigation, the relevant persons shall bear responsibility in accordance with the law. (Article 31, Organic Law of Villagers’ Committees)

If that’s still not clicking, it helps to compare ‘unlawful’ (违法) with ‘illegal’ (非法). The Legislative Technical Specifications explains ‘illegal’ as: usually also a form of unlawfulness, but the emphasis is on conduct that lacks a legal basis. What does that mean? It doesn’t mean ’there’s no law that permits you to do this’ — it means: this type of conduct inherently requires some basis, permit, qualification, authorisation, or lawful source under the law, and the person carrying it out simply doesn’t have it. Take ‘practising medicine illegally’ (非法行医) — you’re supposed to hold a medical practitioner’s licence, but you don’t, so you’re practising medicine illegally. Apply the same structure to ‘practising medicine unlawfully’ (违法行医), and it starts to sound like you do hold a licence, but you’re practising in the wrong way — which is a much less common phrasing.

Term	Focus	Implication
Practising medicine illegally (非法行医)	You have no medical qualification at all	You shouldn’t be practising medicine
Practising medicine unlawfully (违法行医)	(Uncommon phrasing) implies you’re qualified but operating in violation of rules	You’re practising the wrong way
Illegally possessing firearms (非法持有枪支)	You have no lawful basis to possess them	You shouldn’t have this at all
Unlawful detention (非法拘禁)	You have no legal authority to detain anyone	You have no right to do this
Unlawful penetration (违法穿透)	A relevant law or administrative order has explicitly prohibited ‘penetration’	There’s a law or ban in place, and you’ve violated it

What this specification and its examples show is that determining whether an act is ‘unlawful’ requires a clear, pre-existing legal basis. The trouble is, where exactly would you go looking for one? As everyone knows, the GFW blocks Google, YouTube, Twitter, and so on, but that blocking has never once been backed by a court order, a signed administrative document, or even so much as an informal, official blocklist⁴. Take our hypothetical lawless everyman Zhang San⁵, who sets up his own ShadowSocks server to access Google, YouTube, Twitter, and the like: for a start, his conduct doesn’t even meet the precondition for the rule to apply — disrupting the order of internet information services — and second, there’s no law or administrative document explicitly blocking or prohibiting access to those sites either. So, in the strict legal sense, Zhang San is not acting ‘unlawfully’.

Which is to say: Article 26(4) simply doesn’t apply to Zhang San, because his conduct fails to meet the precondition of being ‘unlawful’ in the first place.

Who is this clause actually aimed at

This clause sits alongside the following types of conduct:

Manipulating information publication/deletion/algorithmic recommendation
Bulk fake account registration
Fake engagement, fake rankings, fake traffic, fake public sentiment
Unlawfully penetrating or circumventing the technical measures of relevant state institutions
Other

The targets of the first three items are pretty clear — black-market operators, astroturfing outfits, SEO/GEO manipulation, that sort of thing. Item (4) sits alongside them, and in that context it implies the target is organised, commercialised conduct that disrupts the order of information services — not Zhang San having a look at Google Scholar from his living room.

Plausible targets:

Commercial proxy providers⁶ and VPN services (operating telecoms business and circumvention technical measures without a licence — this used to sit in a grey area under the guise of ‘accelerators’, and in theory can now be caught here too)
Anyone using circumvention tools for overseas public-opinion manipulation, cross-border fraud, or gambling-referral schemes
Anyone helping a lawfully shut-down website come back to life via technical means
Attacks that breach the security measures of government or corporate intranets and private networks

Article 30: Strangling the entire grey-market supply chain?

Article 30 Where anyone knowingly aware that another person is violating this Regulation by carrying out any of the following acts, no organisation or individual shall provide that person with support, assistance, or other help in the form of data, technology, programs, tools, software, advertising, services, payment settlement, or otherwise:

(1) Producing, copying, publishing, or disseminating information that violates Article 24 or Article 25, Paragraphs 1 and 2 of this Regulation;

(2) Disrupting the order of internet information services in violation of Article 26, Paragraph 1 of this Regulation;

(3) Enabling another person to obtain or disseminate information lawfully blocked.

This one looks alarming too — does merely helping someone else see lawfully blocked information at any point in the chain now count as unlawful? Wouldn’t that sweep in proxy resellers, risky payment processors, review/promotion channels, and even the developers of circumvention cores, all under the jurisdiction of this one clause?

What counts as ‘information lawfully blocked’

In practice, ’lawful blocking’ tends to fall into a few categories: court rulings, administrative penalties, police case-handling, and ministry-led special operations.

Court rulings are most common in the intellectual property field. A rights holder sues a pirate website, the court finds infringement, and orders the ISP to block the domain. There’s a judgment, a case number, a defendant, and an effective date.

Then there’s administrative penalties — say, the telecoms regulator issues an administrative penalty decision against an unregistered⁷ website, orders it to rectify, and when it refuses to comply, notifies the access provider to stop service. There’s a penalty decision number, proof of service, a citation of legal basis, and notice of remedies (e.g. ‘if dissatisfied with this penalty decision, you may apply for administrative reconsideration to XX authority within sixty days of receiving this decision, or file an administrative lawsuit with the XX People’s Court within six months’).

Police case-handling is easy enough to picture — think anti-vice sweeps: for websites involved in fraud, gambling, or pornography, the police can open an investigation and require ISPs to cooperate in cutting off access. This usually comes with a formal case-opening decision and a written notice of assistance sent to the operator, which the operator keeps on file.

Ministry-led special operations are a slightly different case — for example, the National Copyright Administration’s annual ‘Sword Net’ campaign, which publishes a list of infringing websites each year and instructs ISPs to block them. There’s a public notice document, a list of websites, and a cited legal basis. The procedure is streamlined, but there’s still a paper trail from an actual government department.

Does helping someone else ‘circumvent the wall’ count as helping them obtain or disseminate lawfully blocked information?

The logic here mirrors what came before. In practice, there is no publicly available administrative document or court order anywhere that says anything like ‘pursuant to Article X of Law Y, it is hereby decided that access to Google/YouTube/Telegram shall be blocked’. You won’t find a stamped decision, you won’t find the name of the specific administrative body that made the blocking decision, you won’t find a stated duration for the block, and you won’t find any avenue for appeal.

Legally speaking, the GFW’s blocking of overseas websites has always been a factual act rather than a legal act. It exists, it functions, but it has never gone through the procedure of ‘issuing an administrative decision → notifying the party concerned → allowing appeal’. It’s not hard to see that the GFW’s blocking of platforms like Google and Twitter isn’t the ’lawful blocking’ this clause is talking about.

At this point someone might ask: Article 8 requires an ICP licence⁸ to provide internet information services within Mainland China → Google doesn’t have an ICP licence → Google is therefore providing services unlawfully → blocking an unlawful service = lawful blocking — doesn’t that add up to lawful blocking after all? It sounds plausible, but it runs into serious trouble on closer inspection.

First, the question of jurisdiction. Article 2 refers to ’engaging in internet information services within the People’s Republic of China’. Google’s servers aren’t in China, and neither is the company (it retained some R&D staff after exiting the Chinese market years ago, but that R&D arm doesn’t run any of Google’s public-facing services). Google hasn’t proactively conducted business within Chinese territory — a Chinese user visiting Google, and Google proactively conducting business within China, are two entirely different things. Article 92 does say that ‘where an organisation or individual outside the People’s Republic of China provides internet information services to the People’s Republic of China, it shall comply with the law’ — but that’s just a statement of obligation, not an automatic grant of jurisdiction. You’d first have to establish that it is ‘providing services within Chinese territory’, and that determination itself requires a formal administrative process.

Second, failing to obtain an ICP licence doesn’t carry ‘blocking’ as its legal consequence. Article 74 is quite clear: for anyone providing internet information services without a licence — ’the telecoms authority shall order rectification; where rectification is refused, it shall order suspension of business for rectification.’ Note the legal consequences here are ‘ordering rectification’ and ‘ordering suspension of business for rectification’, not blocking. And these penalty measures presuppose that you can actually serve notice and enforce them — that works fine against a domestic entity, but how do you ‘order’ a foreign one to do anything? You don’t even have an address to serve the notice to — are you going to mail the legal papers to Mountain View?

Third, Article 67 has no reach over overseas websites that never held a licence in the first place. ‘Where a licence or approval number is revoked, rescinded, or cancelled by the telecoms authority, the telecoms authority shall notify the relevant internet access service provider and domain name resolution service provider to stop providing services to it.’ This clause comes closest to describing lawful blocking — notifying an ISP to cut off service. But it applies to entities that have been ‘revoked, rescinded, or cancelled’ — you have to have held a licence first, and then had it taken away, for this clause to be triggered at all. It simply has no reach over an overseas website that has never held a licence in the first place.

In fact, you can work this out in reverse just by looking at the current state of the internet since the filing system came into force. We know that if ’lawful blocking’ were applied uniformly to every unregistered website, the effect would be identical to a whitelisting system — only registered websites could be accessed, and everything else would be blocked outright. But the reality is that the domestic internet is clearly not in a whitelist state — plenty of unregistered overseas websites remain perfectly accessible. From this we can conclude that the GFW’s blocking of specific websites isn’t ’lawful blocking’ in the sense the clause intends. And since information obtained through circumvention doesn’t count as ’lawfully blocked information’, Article 30(3) simply doesn’t apply either.

Article 15: Officially signing the death warrant for dedicated-line proxy resellers?

Article 15 The state implements a filing management system for the allocation and use of internet protocol addresses. IP address allocation bodies shall promptly report IP address information to the telecoms authority for filing.

Before providing access services, internet access service providers shall verify the corresponding IP address filing information, and shall not provide services to IP addresses that are unregistered or falsely registered.

This kind of regulatory provision targeting IDCs and ISPs has been around for a long time already, and proxy resellers have carried on operating regardless, under the guise of ‘accelerators’ or by piggybacking on other licensed entities. Exactly when and how vigorously it gets enforced is something the Ministry of Industry and Information Technology (MIIT) adjusts on the fly, depending on domestic political and economic needs. The recent wave of mass line-cutting happens to coincide with a leadership reshuffle at MIIT — whether this level of enforcement is a ’new broom sweeps clean’⁹ style temporary campaign, or signals a longer-term tightening, remains to be seen.

Penalties and other details

Article 84 Violations of Article 26, Article 30, Article 32, Article 48, or Article 49 of this Regulation shall be punished in accordance with the relevant laws and administrative regulations. Where laws and administrative regulations do not so provide, the cyberspace, telecoms, public security, and other relevant competent authorities shall, according to their duties, order rectification within a specified period, and may additionally impose a fine of no less than RMB 100,000 and no more than RMB 1,000,000; where rectification is refused or the circumstances are serious, a fine of no less than RMB 1,000,000 and no more than RMB 5,000,000 shall be imposed, and suspension of relevant business or suspension of business for rectification may additionally be ordered.

Note that the fine here starts at RMB 100,000, caps out at RMB 5,000,000, and can come with an order to ‘suspend relevant business or suspend business for rectification’ — this wording is clearly pointed at organisations and commercialised entities, not individual users. An individual using a proxy at home to look at Google doesn’t involve any ‘business’ or need for ‘rectification’ — and the way the penalty clause is designed backs this up: it’s aimed at organised commercial conduct, not ordinary internet users.

What’s more, the penalty clause only applies where Article 26 or Article 30 has actually been violated — and as already analysed above, an individual’s circumvention conduct doesn’t satisfy the elements required to trigger either clause. However severe the penalty, if the elements aren’t met, it never gets to you in the first place.

How ‘circumvention’ actually gets punished in practice

The Sword of Damocles

The analysis so far has looked at this purely from the angle of legal text: an individual circumventing the wall doesn’t meet the elements required under the new Regulation’s relevant clauses. But legal text is one thing, and real-world enforcement is another.

In fact, administrative penalties against individuals using VPNs have existed all along — just not under this new Regulation, but under Article 6 of the Interim Provisions on the Management of International Connections to Computer Information Networks¹⁰, enacted back in 1997 — ‘any direct international connection of a computer information network must use the international access channels provided by the state public telecommunications network under the Ministry of Posts and Telecommunications’ — along with the penalties set out in Article 14: a warning, confiscation of unlawful gains, a fine of up to RMB 5,000 for individuals, and up to RMB 15,000 for organisations.

This provision has been sitting on the books for nearly thirty years, dormant for most of that time. But it’s never been repealed, which means enforcement authorities can choose to activate it at any moment — and the timing, intensity, and choice of target depend entirely on the political climate and local enforcement appetite at the time.

Worth flagging: the concept of an ‘international access channel’ is itself vaguely defined. The Interim Provisions require use of ’the international access channel provided by the state public telecommunications network’, but many dedicated-line proxy resellers buy precisely the IPLC (International Private Leased Circuit) or IEPL (International Ethernet Private Line) services run by the three major state carriers — China Telecom, China Unicom, and China Mobile. These are legitimate international bandwidth products that the three carriers openly sell to corporate customers. If a user accesses overseas networks through a legally purchased carrier international leased line, does that satisfy the requirement of ‘using the international access channel provided by the state public telecommunications network’? The provision offers no answer, and enforcement practice has never settled the question either. This ambiguity only widens the scope for selective enforcement.

Real cases

Based on publicly searchable administrative penalty records¹¹, the number of documented penalty cases involving individuals using VPNs far exceeds what most people would assume. Here are a few well-documented examples:

Nanxiong, Shaoguan, Guangdong (2019): the party used Lantern to circumvent the wall 487 times in total, and was issued a warning and fined RMB 1,000 by the Nanxiong Public Security Bureau.
Jinhua, Zhejiang (2020): Decision No. Jingongdong (Cyber Police) Xingfajuezi [2020] No. 00751 — the party was administratively penalised for using an unauthorised international channel.
Suining, Sichuan (2019): Decision No. Suichuangong (Yong) Xingfajuezi [2019] No. 489 — a similar penalty.
Somewhere (2025): a party referred to as ‘Xiao Zhang’ was found to have VPN usage records during a network security inspection and was fined RMB 15,000 (the maximum penalty).
Xiaogan, Hubei (March 2026): the Xiaogan Xinhua Police Station sent more than ten officers in person, and the party was fined RMB 500 for using a VPN.

Almost all of the above cases cite the same legal basis: Articles 6 and 14 of the Interim Provisions on the Management of International Connections to Computer Information Networks.

Problems in enforcement

A few things worth noting stand out from these cases:

Selective enforcement. China’s circumvention-using population is conservatively estimated in the tens of millions¹², while publicly documented penalty cases number only in the dozens. This means the overwhelming majority of people will never be pursued — but anyone could, in theory, be the one who is. Here, the law isn’t functioning as a generally applicable rule so much as a sword hanging over everyone’s heads, and when it falls depends entirely on the will of the enforcer. With economic growth slowing in recent years and fiscal pressure mounting at the local level, the ‘distant-water fishing’¹³ phenomenon that’s emerged in some regions is perhaps the most darkly ironic illustration of this kind of selective enforcement — when you’re determined to convict someone, there’s never a shortage of pretexts. Hand over your ‘unlawful gains’ quietly, and hey, someone’s performance bonus is finally sorted.

Chaotic application of the law. Different regions cite different legal provisions for identical conduct: some rely on Article 6 of the Interim Provisions, others on Article 27 or Article 63 of the Cybersecurity Law, and others still on provisions in the Public Security Administration Punishment Law¹⁴. The same act can receive wildly different legal treatment depending on where it happens, which in itself shows just how inconsistent the standards for applying the law really are. It’s also worth pointing out that China is a civil law jurisdiction rather than a common law one, so court judgments carry no binding precedent — you might be fined RMB 500 for circumventing the wall in Region A, while the exact same conduct in Region B might draw a RMB 15,000 fine, or no action at all, and you have no way to invoke Region B’s inaction as a defence for what happened to you in Region A.

Enforcement action disproportionate to the offence. In the Xiaogan, Hubei case, more than ten officers were sent out to deal with an administrative violation that ultimately drew a RMB 500 fine — this kind of enforcement posture looks a lot more like intimidation than routine administrative management.

Using it as a pretext for other catch-all charges. In some cases, the penalty for circumventing the wall itself is negligible, but the police use it as an entry point to dig further into what the person has been saying on overseas platforms, and then pursue criminal liability under a catch-all charge like ‘picking quarrels and provoking trouble’¹⁵. Circumvention here becomes the pretext for invoking some other catch-all charge — what actually gets punished isn’t the act of circumventing the wall itself, but the person’s speech or political stance, with circumvention providing the excuse.

What you can actually do

After all that, you might be thinking: fine, it doesn’t hold up under the legal text, but there’s still real-world risk — so wasn’t this whole thing pointless?

No — this is a draft for public comment, and right now you have an actual, formally documented channel to participate in the legislative process.

Submit your comments on the draft

The Regulations are currently open for public comment. Under Article 15 of the Regulations on the Procedures for the Formulation of Rules, every citizen has the right to submit comments on a draft for comment. This isn’t a favour being granted to you — it’s a legally established procedure. You can submit your comments formally through the consultation channel published by the CAC — for example, suggesting that the wording around ‘unlawfully penetrating or circumventing’ be given a clearer definition of its elements, or that ’lawfully blocked’ be given a proper procedural definition to prevent the concept from being abused.

Contact your local People’s Congress deputy

Article 41 of the Constitution of the People’s Republic of China:

Citizens of the People’s Republic of China have the right to criticise and make suggestions to any state organ or functionary.

Article 4 of the Law on Deputies to the National People’s Congress and to the People’s Congresses at Various Local Levels of the People’s Republic of China:

Deputies shall maintain close contact with the electors or the electoral units that originally elected them, listen to and reflect the opinions and demands of electors and electoral units, and strive to serve the people.

The district/county-level People’s Congress deputy for your constituency has an obligation to hear your views, and district/county People’s Congress standing committee websites usually publish a list of deputies and their contact details. Find your deputy, give them a call or write them a letter, and tell them:

that you believe internet legislation should follow the principle of clarity, and that vague provisions shouldn’t become a tool for selective enforcement;
that you support governing the internet in accordance with the law, but oppose using the language of ‘in accordance with the law’ to mask what is in fact ’no law to rely on’;
that you’d like to see the concept of ’lawfully blocked’ given a clear procedural definition in law.

Putting core socialist values into practice starts with contacting your People’s Congress deputy.

TL;DR

This is routine technical legislative housekeeping. Carry on living your life as before, weigh your own risks for whatever you choose to do, and nothing to see here, folks.

Translator’s note: 网信办 (Wǎngxìnbàn) is the common short form for China’s Cyberspace Administration (CAC), the body that oversees internet content regulation and policy in Mainland China. ↩︎
The full text of the Regulations on the Administration of Internet Information Services (Draft Amendment for Comment) and the notice for public comment can be found on the CAC’s official website: https://www.cac.gov.cn/2025-04/15/c_1746821732498092.htm ↩︎
See the Legislative Technical Specifications (Trial) (II): https://npcobserver.com/wp-content/uploads/2023/02/Technical-Specifications-for-Legislation-for-Trial-Implementation-II.pdf ↩︎
The Chinese government has never formally acknowledged the existence of the GFW, nor has it ever published a complete list of blocked websites. In 2015, when a State Council spokesperson was asked about this by foreign journalists, they said only that ‘China manages the internet in accordance with the law’, without specifying any actual legal basis or blocklist. ↩︎
Translator’s note: 法外狂徒张三 (’lawless outlaw Zhang San’) is a running joke in Chinese legal commentary and internet culture — a stock hypothetical everyman used to test how a law would actually apply to an ordinary person’s mundane conduct, often deployed sarcastically to expose gaps between a law’s literal wording and its intended target. ↩︎
Translator’s note: 机场 (literally ‘airport’) is Chinese internet slang for a commercial proxy/VPN reseller offering paid access to overseas nodes — the term has nothing to do with actual airports and is used throughout this post. ↩︎
Translator’s note: ‘unregistered’ here refers to a website that hasn’t obtained ICP filing (see the note below) — the Mainland China requirement to register a website with the authorities before it can legally operate. ↩︎
Translator’s note: an ICP licence/filing (ICP 牌照/备案) is Mainland China’s mandatory registration and licensing regime for websites and online services. Any site operating ‘within’ China is legally required to register with, or obtain a licence from, the telecoms authority; unregistered domestic sites can be ordered offline. This regime — and the question of whether it can be stretched to cover foreign sites that never registered in the first place — sits at the heart of the legal argument in this section. ↩︎
Translator’s note: 新官上任三把火 is a Chinese idiom meaning a newly appointed official tends to make a show of forceful action early on to establish authority — roughly equivalent to ’new broom sweeps clean’, but with a stronger implication that the initial burst of activity may not be sustained. ↩︎
The full text of the Interim Provisions on the Management of International Connections to Computer Information Networks (promulgated in 1997, most recently amended in 2024) can be found on the State Council’s official website: https://www.cac.gov.cn/1996-02/02/c_126468621.htm ↩︎
Wang Yuyang (5 September 2020) searched the China Judgments Online database and administrative penalty disclosure platforms and found 51 relevant cases in total. ↩︎
A 2014 GlobalWebIndex survey found roughly 93 million VPN users in China, about 14% of internet users at the time. Given that the total number of internet users has kept growing since then, and circumvention tools have become steadily more widespread, the actual current figure can only be higher. ↩︎
Translator’s note: 远洋捕捞 (‘distant-water fishing’) is Chinese internet slang describing local law enforcement authorities travelling out of their own jurisdiction — often to economically wealthier regions or even pursuing targets with only tenuous ties to their jurisdiction — to investigate, prosecute, and seize the assets of businesses or individuals, with the seized funds reportedly used to help plug local fiscal shortfalls. The term likens this practice to fishing boats trawling waters far from home once local stocks run low, and it’s widely discussed as a niche but important symptom of local government revenue pressure translating into aggressive, revenue-driven policing. ↩︎
Translator’s note: the Public Security Administration Punishment Law (治安管理处罚法) is China’s general law governing administrative (non-criminal) penalties for public order offences, enforced directly by police without going through the courts — things like warnings, fines, and short-term detention for minor offences. ↩︎
Translator’s note: ‘picking quarrels and provoking trouble’ (寻衅滋事) is a notoriously broad and vaguely defined charge under Chinese criminal and public security law, frequently criticised for functioning as a catch-all that can be applied to almost any conduct authorities want to punish — including, in practice, online speech — precisely because its scope is so poorly defined. ↩︎

Clearing Up Misunderstandings About DNS Leaks

Mon, 18 May 2026 00:46:00 +0800

Anyone clicking into this article has probably already heard of the concept of DNS leaks, and plenty of people go pale at the mere mention of it. Since several people have raised related questions in the comments and issues, I’m writing this explainer to try to lay the problem out as clearly as possible, clear up some common misunderstandings about the concept, and give everyone a reference point for writing their own proxy configurations.

This concept has already been done to death by various VPN vendors and a whole pile of YouTubers. The basic idea is: while you’re using a proxy, your computer instead sends a DNS request over the local network to your local DNS server for the address you’re actually visiting, which lets your ISP work out your browsing history from its DNS query logs.

flowchart LR
    U[User device
Browser / App] --> VPN[VPN client
encrypted tunnel]

    VPN -->|Normal: DNS request via VPN| VPNDNS[VPN-provided DNS server]
    VPNDNS --> NET[Target website / Internet]

    U -.->|Abnormal: DNS leak| ISP[Local ISP DNS server]
    ISP -.-> LOG[ISP / third party can log
visited domains]

    NET --> SITE[example.com]

    subgraph Normal[Normal DNS resolution path]
        VPN
        VPNDNS
        NET
    end

    subgraph Leak[DNS leak path]
        ISP
        LOG
    end

    classDef safe fill:#e8f7ee,stroke:#2e7d32,stroke-width:2px,color:#1b5e20;
    classDef danger fill:#fdecea,stroke:#c62828,stroke-width:2px,color:#7f0000;
    classDef user fill:#e3f2fd,stroke:#1565c0,stroke-width:2px,color:#0d47a1;

    class U user;
    class VPN,VPNDNS,NET,SITE safe;
    class ISP,LOG danger;

Getting clear on what we actually need

The first thing worth thinking through properly is what we’re actually trying to achieve by going to such lengths to prevent DNS leaks. Most people’s gut reaction is probably: “Obviously, so the censors can’t see which sites we’re visiting through the proxy!”

That’s not entirely accurate, actually, and it depends on the situation. Think about it for a moment: would there be any real harm in the censors knowing you’re scrolling through Douyin¹ or chatting on WeChat? Probably not. But if they find out you’re browsing Wikipedia, checking X (Twitter), or looking at other content with a clear political slant that’s flagged as sensitive, then you’ve got a real problem. The point of preventing DNS leaks was never to score a full row of green ticks on some so-called “DNS leak test” website, nor to hide the fact that you use commonly-used domestic services. It’s to stop the censors from finding out that you’re accessing blocked sites and services that are considered sensitive.

For those of us living behind the Wall, working out what counts as sensitive content is actually pretty simple: just check the GFWList²³ directly. Whatever the Great Firewall (GFW) specifically bothers to block is, by definition, sensitive content.

The random domains used by these DNS leak test sites don’t even come close to touching the GFWList; they carry zero sensitivity to begin with. With a well-optimised proxy configuration, that kind of domain doesn’t get a second glance, it’s typically skipped straight through to the final catch-all rule (something like MATCH, DIRECT), and that process naturally triggers a local DNS resolution. So the test site lights up red as if it’s struck gold, warning you that “a DNS leak exists”. But once you understand the actual mechanism, it’s obvious that this so-called “leak” is often completely inconsequential. As long as your configuration is sound, the sensitive access history you actually need to protect has already matched an earlier routing rule and been safely sent down the encrypted tunnel.

What’s worse, commercial overseas VPN vendors like Surfshark and ExpressVPN, along with a bunch of unscrupulous YouTubers cashing in on sponsorships, keep using these utterly meaningless test results to whip up privacy anxiety. The ironic part is that these traditional commercial VPN clients often don’t even have the most basic domain-based routing rule functionality, and instead crudely shove all network traffic through the virtual network adapter in one go. Even more ironic still: even with that crude blanket-proxy approach, they’ve genuinely caused real DNS leaks in the past due to flaws in their own client software. So rather than taking these anxiety-peddling marketing pitches at face value, you’re better off understanding how proxy software actually works.

Where leaks actually happen

Mainstream proxy software these days is quite mature, and with a properly set-up configuration there’s really nothing to worry about regarding DNS leaks. The problem is that a lot of configurations simply aren’t set up properly. Next I’ll briefly explain where DNS leaks can occur in proxy software under system proxy mode and transparent proxy (virtual network adapter) mode.

The proxy software itself

When using a system proxy (say the proxy address is socks5://127.0.0.1:7890⁴) and visiting https://www.example.com in a browser, the request goes through the following process:

Step one: the browser packages up the network request and sends it to socks5://127.0.0.1:7890
Step two: the proxy software receives the request and matches it against a node using the configured routing rules
Step three: the proxy software forwards the entire network request to the matched node

sequenceDiagram
    participant B as Browser
    participant P as Proxy software
(127.0.0.1:7890)
    participant R as Routing rule engine
    participant N as Remote proxy node

    B->>P: ① Packages and sends the request
(carries the domain, no DNS resolution)
    Note over B,P: Browser doesn't issue a DNS query
No leak here
    P->>R: ② Matches routing rules
based on domain and other info
    Note over P,R: Rule-matching process
may trigger a DNS query ⚠️
    R-->>P: Returns match result
(PROXY / DIRECT / REJECT)
    P->>N: ③ Encrypts and forwards the request to the node
    Note over P,N: Transmitted over encrypted tunnel
No leak here
    N-->>P: Returns response
    P-->>B: Returns response

Throughout the whole request process, the browser hands the network request off to the proxy without sending a request to the local DNS, so no leak occurs at this stage. The proxy software forwards the network request to the server, and that whole process is encrypted, so no leak occurs there either. The stage where the actual DNS leak occurs is during routing rule matching.

Issuing a domain lookup to local DNS isn’t necessarily a bad thing in itself, but a poorly configured routing rule can make the proxy software prematurely query local DNS the moment it gets the domain, leaking privacy information that shouldn’t have been leaked. Suppose, in some extreme hypothetical scenario, the Gestapo⁵ pulled everyone’s DNS query logs from the ISP, and anyone who’d queried a domain on the GFW’s blocklist got taken out and shot. In that kind of scenario, to protect ourselves, we’d need to configure our routing rules properly.

Take the widely-used Mihomo core as an example: when it’s acting as a client in system proxy mode, and Chrome is at the second step described above, the information the core already has on hand is:

Host⁶: example.com
Target port: 443
Network protocol: TCP
Name and full path of the requesting process: C:\Application\chrome.exe
Inbound IP: 127.0.0.1
Inbound name: DEFAULT-MIXED
Inbound port: a random high port

The core doesn’t need to make any extra DNS requests. Based on the information it already has, it can match all routing rules based on domain, port, process name, and network protocol without triggering any DNS resolution at all:

rules:
  # Domain-based matching rules
  - DOMAIN,ad.com,REJECT
  - DOMAIN-SUFFIX,google.com,auto
  - DOMAIN-KEYWORD,google,auto
  - DOMAIN-WILDCARD,*.google.com,auto
  - DOMAIN-REGEX,^abc.*com,PROXY
  - GEOSITE,youtube,PROXY
  # Port-based matching rules
  - DST-PORT,80,DIRECT
  - SRC-PORT,7777,DIRECT
  # Process-name-based matching rules
  - PROCESS-PATH,/usr/bin/wget,PROXY
  - PROCESS-PATH,C:\Application\chrome.exe,PROXY
  - PROCESS-NAME,curl,PROXY
  - PROCESS-NAME,chrome.exe,PROXY
  # Network-protocol-based matching rules
  - NETWORK,UDP,REJECT
  # Rules that don't depend on any of the above
  - MATCH,DIRECT

So none of the rule types above cause DNS leaks, because the core has no need to trigger DNS resolution to match against them.

For the remaining rule types, the target IP information needs to be known at step two before matching can proceed:

rules:
  - GEOIP,cn,DIRECT
  - IP-CIDR,127.0.0.0/8,DIRECT
  - IP-SUFFIX,8.8.8.8/24,PROXY
  - IP-ASN,13335,DIRECT

By default, to ensure matching accuracy, when the core reaches step two it doesn’t know the target IP, only the target host address www.example.com, so it has no choice but to look up the IP address for www.example.com, and that’s what causes the DNS leak. If you append no-resolve⁷ to the end of the rule, matching skips straight over the IP-based rule entirely, which makes no-resolve well suited to routing bare-IP requests from software like Telegram.

The problem with transparent proxying (TUN mode⁸)

Transparent proxying is, as the name suggests, a way of proxying where the system/software being proxied has no idea it’s being proxied at all. This approach is very convenient. Flip on TUN mode and everything just works, no need to laboriously configure every single piece of software that doesn’t respect the system proxy setting one by one. The cost is that very convenience: since the target system/software has no idea it’s being proxied, it carries on behaving exactly as it would on a normal network, and that naturally includes DNS resolution. But the target system/software doesn’t know it’s being proxied, and it still needs to get hold of an IP before it can establish a connection to the remote end. To solve this, Mihomo, for example, offers two DNS hijacking modes: redir-host and fake-ip.

redir-host mode:

flowchart TD
    A1[Target software issues a DNS query] --> A2[Proxy software queries the real IP
from upstream DNS]
    A2 --> A3[Upstream DNS returns the real IP]
    A3 --> A4[Real IP returned to the target software]
    A4 --> A5[Target software connects using the real IP]
    A5 --> A6[Proxy software intercepts and routes]

    A2 -.- LEAK["⚠️ The real DNS request leaks to the outside network"]

    classDef danger fill:#fdecea,stroke:#c62828,stroke-width:2px,color:#7f0000;
    class LEAK danger;

fake-ip mode:

flowchart TD
    B1[Target software issues a DNS query] --> B2[Proxy software immediately returns a fake IP
e.g. 198.18.0.x]
    B2 --> B3[Target software connects using the fake IP]
    B3 --> B4[Proxy software intercepts, checks the mapping table
and recovers the real domain]
    B4 --> B5[Forwards the request over the encrypted tunnel]

    classDef safe fill:#e8f7ee,stroke:#2e7d32,stroke-width:2px,color:#1b5e20;
    class B2,B4,B5 safe;

redir-host is the honest one of the two: since the target system/software issued a DNS query, it dutifully goes off and queries upstream DNS, and returns the real IP it gets back to the target system/software. Because this mode is bound to trigger a genuine DNS resolution lookup, it carries an inherent structural flaw that inevitably causes DNS leaks. The original Clash core actually dropped redir-host mode entirely in a later version.

That said, Mihomo, which inherited from the Clash Meta core, chose to keep it around, and bolstered it with sniffer⁹. Under redir-host mode, sniffer inspects features within the data packets (such as the SNI field¹⁰ in TLS) to try to recover the connected domain from traffic that’s already been resolved down to a bare IP, then runs that recovered domain back through the routing rules for matching, which patches up many of redir-host mode’s shortcomings when it comes to routing. But it’s worth being very clear on this point: sniffer solves the problem of routing accuracy, it does not eliminate the DNS leak itself. The DNS query has already gone out before sniffer even gets involved; whatever the ISP was going to log, it’s already logged.

One thing worth flagging here: if you still insist on using redir-host mode in a transparent proxy setup, you must set up a set of uncontaminated DNS servers. See my other article for a concrete example, otherwise your DNS access history will still leak.

By contrast, fake-ip mode takes an entirely different approach to solving this, and not only does it neatly sidestep the DNS leak problem under transparent proxying, it can even improve browser page load responsiveness as a side benefit.

How to avoid DNS leaks

Optimise the routing rules fed to the proxy software

As mentioned earlier, poorly designed routing rules cause the proxy software to trigger resolution prematurely. Here’s a classic example of what not to do:

rules:
  - GEOIP,cn,DIRECT
  - GEOSITE,telegram,Telegram
  - GEOIP,telegram,Telegram
  - MATCH,Proxy

The problem is in the first line, GEOIP,cn,DIRECT. When the device requests the domain telegram.org, the core matches from top to bottom, and the very first entry is an IP rule. But a domain isn’t an IP, so to work out whether it falls within a mainland Chinese IP range, the core has no choice but to resolve telegram.org first. And that resolution is exactly when the DNS query goes out, even though the second rule down, GEOSITE,telegram, could have matched directly without needing to know the IP at all.

flowchart TD
    Start[Request for telegram.org] --> Rule1{Rule 1
GEOIP,cn?}
    Rule1 --> Leak[⚠️ An IP rule meets a domain
telegram.org must be resolved first
DNS query leaks right here]
    Leak --> Judge{Is the resolved IP
in mainland China?}
    Judge -- No --> Rule2{Rule 2
GEOSITE,telegram?}
    Rule2 -- Yes --> ProxyTG[Routed via Telegram proxy
but the DNS has already leaked]

    classDef danger fill:#fdecea,stroke:#c62828,stroke-width:2px,color:#7f0000;
    class Leak danger;

Once the resolution request goes out, the ISP has already logged it. Whichever rule it ends up matching, or whether it goes through the proxy at all after that, no longer matters, the ISP already knows you’re accessing Telegram.

Rule matching proceeds top to bottom in order: every time the core receives a request, it checks each rule one by one until it finds a match. In other words, once a domain matches an earlier rule, none of the rules after it, whether it’s the second, the third, or even the ten-millionth, ever get a chance to run.

That’s exactly why, when writing rules, you should follow the principle of domain rules first, IP rules last. Even for a dedicated rule set targeting a specific service, any IP rules placed near the front should be tagged with no-resolve to tell the core to skip that rule if it doesn’t match, rather than resolving to try it. A classic example:

DOMAIN-SUFFIX,e-hentai.org
DOMAIN-SUFFIX,ehgt.org
DOMAIN-SUFFIX,ehwiki.org
DOMAIN-SUFFIX,exhentai.org
DOMAIN-SUFFIX,hath.network
DOMAIN-SUFFIX,hentaiverse.org
IP-CIDR,178.175.128.0/21,no-resolve

The same logic applies when using GeoSite and GeoIP databases: any IP rule near the front should carry no-resolve.

rules:
  - GEOSITE,telegram,Telegram
  - GEOIP,telegram,Telegram,no-resolve
  - GEOSITE,gfw,Proxy
  - GEOIP,cn,DIRECT
  - Match,Proxy

Compare this rule set against the earlier bad example, and the difference comes down to exactly when DNS resolution gets triggered:

flowchart TD
    Start[Request for telegram.org] --> Rule1{Rule 1
GEOSITE,telegram?}
    Rule1 -- Yes --> ProxyTG[Routed via Telegram proxy
✅ No resolution the whole way]
    Rule1 -- No --> Rule2{Rule 2
GEOIP,telegram,no-resolve?}

    Rule2 -- Yes,
only matches bare-IP requests --> ProxyTG
    Rule2 -- No --> Rule3{Rule 3
GEOSITE,gfw?}

    Rule3 -- Yes --> ProxyGFW[Routed via Proxy
✅ No resolution the whole way]
    Rule3 -- No --> NeedIP[Only now does it need an IP,
triggering local DNS resolution]

    NeedIP --> Rule4{Rule 4
GEOIP,cn?}
    Rule4 -- Yes --> Direct[DIRECT connection]
    Rule4 -- No --> ProxyOther[Match,Proxy
routed via Proxy]

    classDef safe fill:#e8f7ee,stroke:#2e7d32,stroke-width:2px,color:#1b5e20;
    classDef warn fill:#fff3e0,stroke:#ef6c00,stroke-width:2px,color:#8a4b00;
    class ProxyTG,ProxyGFW safe;
    class NeedIP warn;

Same request for telegram.org, but this time the very first rule is GEOSITE,telegram, the domain matches directly, the request gets handed to the proxy, and DNS never comes into it at all. Visiting other sites on the GFW’s blocklist works the same way, hitting GEOSITE,gfw,Proxy before ever reaching that non-negotiable GEOIP,cn,DIRECT rule, sending the request off to the node well before then. Anything that should go through the proxy already has, long before the IP-based rules further down ever get a chance to run, so DNS never gets an opportunity to leak.

Using fake-ip to sidestep the transparent proxy problem

fake-ip mode solves the DNS leak problem under transparent proxying, and also improves browser page load responsiveness as a side benefit.

When using transparent proxying in fake-ip mode, the moment the target software issues a DNS query, the proxy software doesn’t naively go off and query the real IP from a local or remote upstream server. Instead, it immediately returns a fake reserved private-range IP locally on the spot (for example, 198.18.0.2¹¹). The target software takes this fake IP at face value and promptly tries to establish a connection using it.

On the proxy software’s side, all it needs to do is intercept every request heading to one of the fake IPs it’s issued. Because the proxy software maintains a detailed mapping table of “fake IP to real domain” internally, even when the target software sends packets addressed to a fake IP, the proxy software still knows perfectly well what domain you’re actually trying to reach. So it extracts the original domain and forwards the network request down the encrypted proxy tunnel to the remote node for processing.

sequenceDiagram
    participant App as Target software
(browser, etc.)
    participant TUN as TUN virtual adapter
    participant Proxy as Proxy software
(Mihomo)
    participant Node as Remote proxy node
    participant Web as Target website

    App->>TUN: DNS query: what's the IP for google.com?
    TUN->>Proxy: Forwards the DNS query
    Note over Proxy: Doesn't issue any external DNS request!
Allocates a fake IP from the 198.18.0.0/15 pool
Records the mapping: 198.18.0.5 → google.com
    Proxy-->>TUN: Returns fake IP: 198.18.0.5
    TUN-->>App: DNS response: 198.18.0.5

    App->>TUN: Connects to 198.18.0.5:443 (HTTPS)
    TUN->>Proxy: Forwards the connection request
    Note over Proxy: Checks mapping table:
198.18.0.5 → google.com
Matches routing rules → PROXY
    Proxy->>Node: Encrypted forward: please connect to google.com:443
    Node->>Web: Establishes the real connection
    Web-->>Node: Returns page content
    Node-->>Proxy: Encrypted return
    Proxy-->>TUN: Returns content
    TUN-->>App: Receives the response

    Note over App,Web: No real DNS request leaks to the outside network the whole way through ✓

This mechanism solves the structural flaw whereby redir-host mode is bound to expose domain query records to the outside network under transparent proxying. But it’s worth pointing out that fake-ip only bypasses the leak risk that arises when the target software itself issues a DNS query. As mentioned earlier, if the routing rules are poorly configured, the proxy core itself will still proactively issue a genuine DNS resolution upstream, and that will still cause a leak. Given properly configured routing rules, though, fake-ip mode not only leaves censors with no way to peek at your real destinations, it also cuts out the time the local device would otherwise spend waiting for a real DNS response, substantially reducing Time To First Byte (TTFB¹²) for page loads as a bonus. Two birds, one stone.

TL;DR (summary)

A DNS leak itself isn’t something to fear. What’s actually worth worrying about is being led around by the nose by anxiety-driven marketing without understanding what’s really going on. Once you understand the mechanics, the way forward is quite clear:

System proxy mode: follow the principle of “domain rules first, IP rules last”, tag every IP-type rule with no-resolve, and sensitive domains will already have been routed away before they ever trigger DNS resolution.
TUN transparent proxy mode: favour fake-ip, which eliminates DNS query exposure at the root and also gets you lower TTFB as a bonus. If you insist on redir-host, you must pair it with uncontaminated upstream DNS, and be clear that sniffer can only improve routing accuracy, it can’t prevent the DNS request itself from leaking.
Don’t put blind faith in DNS leak test sites: the random domains they use aren’t on the GFW’s blocklist at all, so triggering local resolution for them is normal and harmless behaviour. A row of green ticks isn’t a measure of configuration quality.

Translator’s note: Douyin is ByteDance’s domestic Chinese short-video app, distinct from TikTok (also ByteDance-owned) which serves international markets. The two are separate apps with separate content and user bases. ↩︎
Translator’s note: GFWList is a publicly maintained list of domains blocked by China’s Great Firewall, commonly used by proxy software to determine which sites need routing through a proxy. ↩︎
A list of domains blocked by mainland China’s Great Firewall (GFW). ↩︎
SOCKS5 is a network proxy protocol (RFC 1928) that operates at the session layer, supports both TCP and UDP forwarding, and allows the client to pass the domain name straight to the proxy server for resolution, rather than resolving it locally first and then connecting. This is precisely the key feature that makes it better than a plain HTTP proxy (outside of CONNECT tunnel mode) at preventing DNS leaks. ↩︎
Translator’s note: this is a deliberately absurd, over-the-top hypothetical for comic effect, not a genuine comparison; the author is mocking VPN marketing fearmongering by exaggerating the stakes to an extreme. ↩︎
You can think of this as the domain name. ↩︎
no-resolve is a flag appended to the end of an IP-type rule. Its job is to tell the core: when the traffic’s target is a domain rather than an IP, skip this rule rather than proactively triggering DNS resolution just to try to match it. But if the traffic itself is a direct connection to an IP (such as a Telegram client connecting straight to a server IP), the rule will still participate in matching normally. ↩︎
What we normally call virtual network adapter mode. ↩︎
Traffic sniffing (Sniffer) refers to a technique where proxy software inspects the protocol characteristics of data packets to recover the target domain. For example, HTTPS connections send the target domain in plaintext during the handshake stage (i.e. the SNI), and HTTP request headers also carry a Host field; proxy software can extract the real target domain from these characteristics. ↩︎
Server Name Indication, an extension field in the TLS protocol. Since a single IP might host multiple HTTPS sites, the client needs to state in plaintext during the ClientHello stage of the TLS handshake which domain it wants to reach, so the server can return the correct certificate. This is also why, even over HTTPS, a man-in-the-middle can still see which domain you’re visiting (though not the specific path or content). ↩︎
By default, Mihomo uses the 198.18.0.0/15 address block to allocate fake IPs. This block is reserved by IANA under RFC 2544 specifically for network device benchmarking, and never appears in normal internet routing tables, so it never conflicts with any real public address. The full /15 block provides around 131,072 addresses for mapping. ↩︎
Time To First Byte, the time elapsed between the client sending a request and receiving the first byte of the server’s response. Under traditional setups, the browser has to wait for DNS resolution to complete (typically 20-120ms) before it can even open a TCP connection; under fake-ip mode, the DNS response is essentially instant (<1ms), which noticeably shortens overall page load time. ↩︎

First impressions of Terraform IaC

Thu, 09 Apr 2026 07:13:35 +0000

Terraform is an IaC tool. IaC stands for ‘Infrastructure as Code’: we write our infrastructure as declarative code, then use terraform apply to deploy it. With the same configuration, you will always get exactly the same infrastructure every time (Nix OS users rejoice).

Why use Terraform

Traditional infrastructure management mostly relies on manual work and the dashboards provided by various cloud vendors, which brings the following pain points:

Pain point	Explanation
Hard to reproduce	Configuring things by clicking around in a dashboard makes it easy to miss or misconfigure something, and hard to reproduce later
Environment drift	Manual changes gradually cause production and test environments to diverge, so in extreme cases testing is fine but production falls over
Hard to scale	Adding a new environment requires repeating lots of manual steps, which is time-consuming and error-prone
Hard to audit	There is no change history, ~~so when things go wrong it is harder to pass the buck~~
Hard to collaborate	Infrastructure ends up controlled by a small number of ‘people who know’, and anyone who wants to change something has to go through them, which is inefficient

To solve these problems, the concept of ‘Infrastructure as Code’ ¹ was introduced, and Terraform is one of the best-known solutions.

Take a realistic use case: suppose you buy a new GCP account with $300 trial credit every year. It is cheap, but every year you have to go back into the GCP console and recreate your machines. With Terraform, if you want to deploy the same setup again, you just replace the API token after switching accounts, then run terraform apply. In a few minutes, you can recreate exactly the same machines, VPCs, S3, firewall rules, and so on as in your previous account.

Another example is managing and migrating Cloudflare DNS and Tunnel. You only need to copy the old Tunnel’s Ingress Rule to the new Tunnel’s Ingress Rule. Even if you later migrate to other providers such as AliDNS or Route 53, you can still copy the data across as-is ².

This becomes especially useful when working with other people. Combined with Git, every change leaves a trace, merge conflicts are far less worrying, PRs can automatically generate previews of changes, and if something goes wrong you can roll back to the previous version immediately. None of this is really possible with the traditional approach of people directly operating a provider’s dashboard by hand.

Installing Terraform

Terraform is written in Go, and the compiled output is naturally a single executable file, so installation is very straightforward. On Windows, you can install it directly with Winget:

winget install Hashicorp.Terraform

If you do not want to use Winget, you can also use Scoop or another package manager, or place the precompiled binary into $PATH to complete the installation.

If you are on Linux, just use the appropriate package manager. If you install it by placing the binary into $PATH, remember to use sudo chmod +x terraform to make the file executable.

Two basic Terraform concepts

Provider(s)

As mentioned earlier, Terraform is an Infrastructure as Code tool. As a tool, it is not tied to any specific platform. Instead, it connects to different platforms through Provider(s). To see what Provider(s) are available, you can browse Terraform’s Registry.

State management

Terraform stores the state information from each infrastructure change operation in a state file. By default, this is saved as the terraform.tfstate file in the current working directory ³, though you can also configure a different backend such as S3 or Postgres. Every time you run terraform apply, Terraform compares the state declared in the current configuration files with the existing state file, calculates the differences, works out the correct order of operations, and then tells the Provider to apply those changes.

Terraform’s resource import problem

Importing existing resources has long been one of Terraform’s most criticised pain points. Hashi Corp. seems to have stuck to a stubborn and frankly silly idea for years: all your infrastructure should have been created with Terraform from the very beginning, so there is no such thing as a resource import problem.

Time	Version	Progress	Problem
2014–2022	v0.x–v1.4	Only `terraform import`, one resource at a time, and it did not generate any configuration	After importing, you still had to hand-write the HCL ⁴
2023.06	v1.5	Introduced the `import` block and the `-generate-config-out` parameter, so it could generate configuration	But you still had to write them one by one, and still had to provide the existing resource IDs yourself
2024.01	v1.7	The `import` block gained support for `for_each`	Batch import at last, but you still had to obtain the IDs yourself
Second half of 2024	v1.12	Introduced the `terraform query` and `list` blocks, finally enabling automatic resource discovery	But this feature has to be implemented by each Provider, and many Providers simply have not caught up

The community has been complaining about this for years, yet the question ‘I already have a pile of existing resources — how do I import them into Terraform?’ was never taken seriously. As an Infrastructure as Code tool, Terraform’s design philosophy is declarative configuration and idempotence ⁵. Hashi Corp. firmly believes that ‘the state declared in code is the only source of truth, so resources should be created from scratch with Terraform’. But in reality, most companies already have a large amount of legacy infrastructure. Having resources first and code later is the norm. Hashi Corp. acknowledged this contradiction very late; the terraform query in v1.12 was really the first time the official tooling took the issue seriously — though as for Provider ecosystem support… well, it has been rough.

Terraform file structure

Terraform’s file structure is very simple. When it runs, the main program blindly reads all .tf files in the working directory. As long as the required information is present, you can name the files whatever you like. For example, my file structure looks like this:

❯ tree -a -I .git
.
├── .editorconfig
├── .github
│   ├── dependabot.yml
│   └── workflows
│       ├── terraform-apply.yml
│       ├── terraform-plan.yml
│       └── your-fork.yml
├── .gitignore
├── .terraform.lock.hcl
├── cf_dns_zones.tf
├── cf_tunnel.tf
├── dns_example_com.tf
├── dns_example_net.tf
├── dns_example_top.tf
├── dns_example_cn.tf
├── main.tf                 # Basic configuration (terraform block)
├── moved.tf                # Moved resources
├── provider.tf             # Configuration for each Provider
├── README.md
├── rename_resources.ps1
└── variables.tf            # Custom variables

main.tf is used to store the basic configuration:

terraform {
  required_providers {
    cloudflare = {
      source  = "cloudflare/cloudflare"
      version = "~> 5"
    }

    tencentcloud = {
      source  = "tencentcloudstack/tencentcloud"
      version = ">= 1.81.43"
    }
  }
}

provider.tf is used to store the configuration for each Provider:

provider "cloudflare" {}
provider "tencentcloud" {}

It is left empty here because we can pass credentials through environment variables instead of writing them directly into the configuration file. For example, the Cloudflare Provider accepts CLOUDFLARE_API_TOKEN as an alternative to the api_token variable.

variables.tf is used to declare custom variables:

variable "cloudflare_zone_example_com" {
  description = "Cloudflare zone ID for example.com"
  type        = string
}

variable "cloudflare_zone_example_top" {
  description = "Cloudflare zone ID for example.top"
  type        = string
}

These variables can be passed in through environment variables prefixed with TF_VAR_. Terraform will also automatically read variables from the terraform.tfvars file. The main purpose of variables is to be referenced from other configuration files, for example:

resource "cloudflare_dns_record" "example_cname" {
  content = "${cloudflare_zero_trust_tunnel_cloudflared.Production_Tunnel.id}.cfargotunnel.com"
  name    = "example.example.com"
  proxied = true
  tags    = []
  ttl     = 1
  type    = "CNAME"
  zone_id = var.cloudflare_zone_id_example_com  # the cloudflare_zone_example_com variable is referenced here
  settings = {
    flatten_cname = false
  }
}

With these basic settings in place, we can run terraform init to initialise the Terraform environment and lock dependency versions. After that, the rest is just declaring our resources.

Importing existing resources into Terraform

As mentioned earlier, Terraform uses state management. This is great, but it also creates a problem during initialisation: by default, Terraform’s state file is obviously empty.

At this point, what we need to do is import the state of the existing resources from the cloud provider into Terraform, so that Terraform can take over and manage our infrastructure seamlessly. As you have probably noticed from the earlier rant, resource import in Terraform is a sore point. Taking DNS records hosted on Cloudflare as an example, if the Provider supports it, you can use terraform query, introduced in Terraform 1.12. In most cases, though, Providers have not implemented this new feature, and Cloudflare is one of those that does not support it.

Fortunately, even if Hashi Corp. has not taken the problem seriously, companies that use Terraform heavily to manage infrastructure have come up with their own solutions. Cloudflare maintains an import tool called cf-terraforming, which saves a lot of manual effort. First, install cf-terraforming. This tool is written in Go, so you either need a Go environment to install it, or you can place the official precompiled binary into $PATH and make it executable.

go install github.com/cloudflare/cf-terraforming/cmd/cf-terraforming@latest

The tool is fairly straightforward to use. First, you need the following environment variables:

# If you use an API Token
export CLOUDFLARE_API_TOKEN='Hzsq3Vub-7Y-hSTlAaLH3Jq_YfTUOCcgf22_Fs-j'

# If you use an API Key
export CLOUDFLARE_EMAIL='user@example.com'
export CLOUDFLARE_API_KEY='1150bed3f45247b99f7db9696fffa17cbx9'

# Specify the zone ID of the domain to import; this is not needed for account-level resources (such as Cloudflare Tunnel)
export CLOUDFLARE_ZONE_ID='81b06ss3228f488fh84e5e993c2dc17'

Tip
The commands here assume you are using Bash. If your shell is not compatible with Bash syntax, you will need to adjust them. For example, in PowerShell on Windows, the syntax for setting an environment variable is:
$env:CLOUDFLARE_API_TOKEN='Hzsq3Vub-7Y-hSTlAaLH3Jq_YfTUOCcgf22_Fs-j'

Usually, you only need to set CLOUDFLARE_API_TOKEN and CLOUDFLARE_ZONE_ID. When creating the API token in the console, remember to grant it the necessary permissions. In this case, we are only importing DNS records, so giving it permission to edit zone DNS is enough.

Right, all the preparation is done. Now we can start generating the configuration files.

First, import the domain configuration in the account, namely cloudflare_zone:

cf-terraforming generate \
  --key $CLOUDFLARE_API_KEY \
  --resource-type "cloudflare_zone" > zone.tf

This step generates a file called zone.tf in the current directory, containing content in the following format:

resource "cloudflare_zone" "REDACTED" {
  name                = "REDACTED"
  paused              = false
  type                = "full"
  vanity_name_servers = []
  account = {
    id   = "REDACTED"
    name = "REDACTED"
  }
}

resource "cloudflare_zone" "REDACTED" {
  name                = "REDACTED"
  paused              = false
  type                = "full"
  vanity_name_servers = []
  account = {
    id   = "REDACTED"
    name = "REDACTED"
  }
}

At this point, the domain resources have been imported, but their internal configuration has not. Next, import the DNS records under the domain:

cf-terraforming generate \
  --zone $CLOUDFLARE_ZONE_ID \
  --key $CLOUDFLARE_API_KEY \
  --resource-type "cloudflare_dns_record" >> dns.tf

This step generates a configuration file called dns.tf in the current directory, containing content in the following format:

resource "cloudflare_dns_record" "terraform_managed_resource_5deb14xxxxxb629bf123xxxxxxxc8f_0" {
  content  = "67.24.33.108"
  name     = "example.example.com"
  proxied  = true
  tags     = []
  ttl      = 1
  type     = "A"
  zone_id  = "81c7f2de8dfxxxxxx52629xxxxxxfc"
  settings = {}
}

resource "cloudflare_dns_record" "terraform_managed_resource_89xxxxx0bf9cxxxxxx9a_1" {
  content  = "35.27.108.33"
  name     = "terraform.example.com"
  proxied  = true
  tags     = []
  ttl      = 1
  type     = "A"
  zone_id  = "8xxxxxx7644e428526xxxxxx"
  settings = {}
}

If you need to import multiple domains, just set the CLOUDFLARE_ZONE_ID environment variable separately each time and rerun the command.

The generated configuration file here can be used directly — it is the Terraform configuration file we need later. However, at this point we have only generated the configuration file; Terraform’s state is still empty. If you run terraform apply now, Terraform will blindly treat all the declarations we just imported as new resources and throw a pile of ‘Alredy Exists’ errors. So next, we need to import the generated configuration into Terraform’s terraform.tfstate state.

Terraform introduced the import block in version 1.5, which is much more modern than typing import commands one line at a time. The process is to generate an .tf file containing import blocks. The next time you run terraform apply, Terraform will automatically perform the import for you.

Generate the import blocks for cloudflare_zone:

cf-terraforming import \
  --resource-type "cloudflare_zone" \
  --modern-import-block \
  --key $CLOUDFLARE_API_KEY \
  --zone $CLOUDFLARE_ZONE_ID >> import.tf

Generate the import blocks for cloudflare_dns_record:

cf-terraforming import \
  --resource-type "cloudflare_dns_record" \
  --modern-import-block \
  --key $CLOUDFLARE_API_KEY \
  --zone $CLOUDFLARE_ZONE_ID >> import.tf

This step generates import.tf in the current directory. It contains the import information needed to tell Terraform which cloud-provider resource ID corresponds to each resource block generated in the previous step. This ID is the code the cloud provider uses internally to identify a resource. You would not normally see it in the control panel; you only get it by requesting it through the API. Terraform needs this ID during import to confirm that the local definition matches the cloud resource, ensuring strict idempotence.

Right, now let us run terraform plan:

$ terraform plan
cloudflare_dns_record.minio_a: Refreshing state... [id=xxxxxxxxxxx53]
cloudflare_zero_trust_tunnel_cloudflared_config.raspberrypi: Refreshing state...
......

Terraform will perform the following actions:

  # cloudflare_dns_record.terraform_managed_resource_0 will be imported
    resource "cloudflare_dns_record" "terraform_managed_resource_REDACTED_0" {
        content     = "67.24.33.108"
        created_on  = "2026-04-08T10:18:12Z"
        id          = "5deb14c21xxxxxxx20f1c8f"
        meta        = jsonencode({})
        modified_on = "2026-04-08T10:18:12Z"
        name        = "example.example.com"
        proxiable   = true
        proxied     = true
        settings    = {}
        tags        = []
        ttl         = 1
        type        = "A"
        zone_id     = "REDACTED"
    }

  # cloudflare_dns_record.terraform_managed_resource_1 will be imported
    resource "cloudflare_dns_record" "terraform_managed_resource_89c149exxxxxxxxxxxba13xxxxxa_1" {
        content     = "35.27.108.33"
        created_on  = "2026-04-08T10:17:54Z"
        id          = "89cxxxxxxxxxxxxxxxxxx09a"
        meta        = jsonencode({})
        modified_on = "2026-04-08T10:17:54Z"
        name        = "terraform.example.com"
        proxiable   = true
        proxied     = true
        settings    = {}
        tags        = []
        ttl         = 1
        type        = "A"
        zone_id     = "81xxxxxxxxxxxxxxxxxxxxxfc"
    }

Plan: 2 to import, 0 to add, 0 to change, 0 to destroy.

────────────────────────────────────────────────────────────────────────────────────────────────────────

Note: You didn't use the -out option to save this plan, so Terraform can't guarantee to take exactly
these actions if you run "terraform apply" now.

If the numbers for Add, Change, and Destroy are all 0, then the import has gone correctly. Just run terraform apply --auto-approve, and the resources will be imported.

$ terraform apply --auto-approve
cloudflare_dns_record.push_a: Refreshing state... [id=REDACTED]

Terraform will perform the following actions:

  # cloudflare_dns_record.terraform_managed_resource_REDACTED_0 will be imported
    resource "cloudflare_dns_record" "terraform_managed_resource_REDACTED_0" {
        content     = "67.24.33.108"
        created_on  = "2026-04-08T10:18:12Z"
        id          = "REDACTED"
        meta        = jsonencode({})
        modified_on = "2026-04-08T10:18:12Z"
        name        = "example.example.com"
        proxiable   = true
        proxied     = true
        settings    = {}
        tags        = []
        ttl         = 1
        type        = "A"
        zone_id     = "REDACTED"
    }

  # cloudflare_dns_record.terraform_managed_resource_REDACTED_1 will be imported
    resource "cloudflare_dns_record" "terraform_managed_resource_REDACTED_1" {
        content     = "35.27.108.33"
        created_on  = "2026-04-08T10:17:54Z"
        id          = "REDACTED"
        meta        = jsonencode({})
        modified_on = "2026-04-08T10:17:54Z"
        name        = "terraform.example.com"
        proxiable   = true
        proxied     = true
        settings    = {}
        tags        = []
        ttl         = 1
        type        = "A"
        zone_id     = "REDACTED"
    }

Plan: 2 to import, 0 to add, 0 to change, 0 to destroy.
cloudflare_dns_record.terraform_managed_resource_REDACTED_1: Importing... [id=REDACTED/REDACTED]
cloudflare_dns_record.terraform_managed_resource_REDACTED_1: Import complete [id=REDACTED/REDACTED]
cloudflare_dns_record.terraform_managed_resource_REDACTED_0: Importing... [id=REDACTED/REDACTED]
cloudflare_dns_record.terraform_managed_resource_REDACTED_0: Import complete [id=REDACTED/REDACTED]

Apply complete! Resources: 2 imported, 0 added, 0 changed, 0 destroyed.

State storage and continuous integration

One of IaC’s core strengths is that it makes Git-based collaboration and CI easy, but before that there is another problem to solve: where exactly should terraform.tfstate live? Nobody wants to painstakingly import state for each environment only to lose it every time they switch.

Terraform currently supports the following state backends:

local
remote
azurerm
consul
cos
gcs
http
Kubernetes
oci
oss
pg
s3

If you do not have any special requirements, you can choose s3 as I do. Cloudflare R2 has a free tier, after all, so you might as well use it.

terraform {
  backend "s3" {
    bucket = "terraform"
    key    = "terraform.tfstate"
    region = "auto"
    endpoints = {
      s3 = "https://REDACTED.r2.cloudflarestorage.com"
    }

    # R2 does not need this AWS validation
    skip_credentials_validation = true
    skip_metadata_api_check     = true
    skip_region_validation      = true
    skip_requesting_account_id  = true
    use_path_style              = true
  }
}

For the S3 backend, it is recommended to store credentials in the two environment variables AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY:

export AWS_ACCESS_KEY_ID='REDACTED'
export AWS_SECRET_ACCESS_KEY='REDACTED'

Once configured, run terraform init -migrate-state and the state will be stored successfully in the cloud. After that, no matter where you edit the configuration or run terraform apply, you will not need to worry about Terraform state getting out of sync.

Next comes the GitHub CI configuration. It is actually very simple: on each git push, just trigger terraform init, terraform fmt, and terraform apply. Here is my .github/workflows/apply.yml:

name: "Terraform Apply"

on:
  push:
    branches:
      - main

env:
  TF_IN_AUTOMATION: "true"
  CLOUDFLARE_API_TOKEN: "${{ secrets.CLOUDFLARE_API_TOKEN }}"
  AWS_ACCESS_KEY_ID: "${{ secrets.AWS_ACCESS_KEY_ID }}"
  AWS_SECRET_ACCESS_KEY: "${{ secrets.AWS_SECRET_ACCESS_KEY }}"
  TF_VAR_cloudflare_zone_id_example_com: "${{ vars.TF_VAR_CLOUDFLARE_ZONE_ID_EXAMPLE_COM }}"
  TF_VAR_cloudflare_zone_id_example_top: ${{ vars.TF_VAR_CLOUDFLARE_ZONE_ID_EXAMPLE_TOP }}

jobs:
  terraform:
    name: "Terraform Apply"
    runs-on: ubuntu-latest
    permissions:
      contents: read
    concurrency:
      group: terraform-apply
      cancel-in-progress: false
    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Setup Terraform
        uses: hashicorp/setup-terraform@v4

      - name: Terraform Init
        run: terraform init -input=false

      - name: Terraform Apply
        run: terraform apply -input=false -auto-approve

For PRs, CI should automatically attach the output of terraform plan to each PR:

name: Terraform Plan

on:
  pull_request:
    paths:
      - "**/*.tf"
      - ".github/workflows/terraform-plan.yml"

permissions:
  contents: read
  pull-requests: write

env:
  TF_IN_AUTOMATION: "true"
  CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
  AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
  AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
  TF_VAR_cloudflare_zone_id_example_com: "${{ vars.TF_VAR_CLOUDFLARE_ZONE_ID_EXAMPLE_COM }}"
  TF_VAR_cloudflare_zone_id_example_top: ${{ vars.TF_VAR_CLOUDFLARE_ZONE_ID_EXAMPLE_TOP }}

jobs:
  plan:
    name: Terraform Plan
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6

      - uses: hashicorp/setup-terraform@v4

      - name: Terraform fmt
        id: fmt
        run: terraform fmt -check -recursive
        continue-on-error: true

      - name: Terraform Init
        id: init
        run: terraform init -input=false

      - name: Terraform Validate
        id: validate
        run: terraform validate -no-color

      - name: Terraform Plan
        id: plan
        run: terraform plan -input=false -no-color
        continue-on-error: true

      - name: Post Plan to PR
        uses: actions/github-script@v8
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          script: |
            const { data: comments } = await github.rest.issues.listComments({
              owner: context.repo.owner,
              repo: context.repo.repo,
              issue_number: context.issue.number,
            });
            const botComment = comments.find(c =>
              c.user.type === 'Bot' && c.body.includes('')
            );

            const planOutput = `${{ steps.plan.outputs.stdout }}`.substring(0, 65000);

            const body = `
            #### Terraform Plan

            | Step     | Result                            |
            | -------- | --------------------------------- |
            | fmt      | \`${{ steps.fmt.outcome }}\`      |
            | init     | \`${{ steps.init.outcome }}\`     |
            | validate | \`${{ steps.validate.outcome }}\` |
            | plan     | \`${{ steps.plan.outcome }}\`     |

            Expand Plan details

            \`\`\`terraform
            ${planOutput}
            \`\`\`
            `;

            if (botComment) {
              await github.rest.issues.updateComment({
                owner: context.repo.owner,
                repo: context.repo.repo,
                comment_id: botComment.id,
                body
              });
            } else {
              await github.rest.issues.createComment({
                issue_number: context.issue.number,
                owner: context.repo.owner,
                repo: context.repo.repo,
                body
              });
            }

      - name: Fail if plan failed
        if: steps.plan.outcome == 'failure'
        run: exit 1

Ongoing workflow

At this point, Terraform’s initial ‘takeover’ is complete, and after that you move into day-to-day maintenance. At this stage there are really only three things to do:

Create new resources
Modify existing resources
Delete resources that are no longer needed

There are only two common operations: terraform plan and terraform apply. If you are working alone, you can usually just commit small changes directly. If you are working in a team, though, each change should follow the principle of using a PR whenever possible rather than committing directly.

Creating infrastructure

Suppose you want to add a new DNS record, create a new Tunnel, or create a new object storage bucket. The process looks like this:

flowchart TD
  C1[Create a new branch
such as feat/add-minio-record] --> C2[Add a new resource block]
  C2 --> C3[terraform fmt + validate]
  C3 --> C4[terraform plan]
  C4 --> C5{Only the expected new resources?}
  C5 -- No --> C6[Fix the configuration and rerun plan]
  C6 --> C4
  C5 -- Yes --> C7[Submit PR]
  C7 --> C8[After merge, CI apply]

The ideal plan output is:

X to add
0 to change
0 to destroy

If you only meant to add something but to destroy appears, do not rush in. Usually it means a bad reference, a wrong variable, or that you accidentally changed a resource address. Check carefully to see what went wrong.

Modifying and deleting infrastructure

The process for modifying resources is similar to creating them, but there is one extra step: evaluate whether the change will trigger a rebuild.

That is because many Provider fields are ForceNew. You think you are only changing one field, and Terraform replies: ‘Right then, delete and recreate it.’ In a DNS scenario like this, that is not a huge issue, but for something like a cloud instance, deleting and recreating it can obviously cause real damage.

It is best to follow this order:

flowchart TD
  M1[Modify .tf] --> M2[terraform plan]
  M2 --> M3{replace/destroy appears?}
  M3 -- No --> M7[Confirm the scope of impact]
  M7 --> M8[terraform apply]
  M3 -- Yes --> M4[Pause and review the change]
  M4 --> M5[Add lifecycle protection if needed]
  M5 --> M6[Schedule a maintenance window]
  M6 --> M8

For production environments, being a bit slower when creating or modifying things is not a big problem. What matters most is correctness. Go a bit slower; do not make mistakes. IaC is not a speed contest — it is about predictability.

If you are deleting resources instead (for example, retiring a DNS record or cleaning up an abandoned Tunnel), follow the process below ⁶:

flowchart TD
  D1[Confirm the resource is no longer needed; check dependencies in services, monitoring, and scripts] --> D2[Delete the resource block or adjust count/for_each]
  D2 --> D3[terraform plan]
  D3 --> D4{Does to destroy match expectations?}
  D4 -- No --> D5[Revert the change and continue checking dependencies]
  D5 --> D1
  D4 -- Yes --> D6[Prepare a rollback plan and choose a low-traffic window]
  D6 --> D7[PR approved]
  D7 --> D8[terraform apply]
  D8 --> D9[Availability check after deletion]

Suggestions for day-to-day collaboration

Put credentials in environment variables or CI secrets; do not write them into .tf or the repository
Enable protection policies for critical resources to prevent accidental deletion
Split directories by resource type
Run terraform plan regularly to check for and correct infrastructure drift ⁷, so you do not end up with manual dashboard changes by mistake

Although this workflow may look a bit cumbersome, every change is recorded, auditable, and reversible — and most importantly, reproducible. That is where IaC delivers its real value.

References

Infrastructure as Code refers to a method of defining and deploying the required infrastructure using machine-readable configuration files. ↩︎
Each provider uses different field names and formats in its configuration files, but these can be converted fairly easily with a script. ↩︎
One especially important thing to note is that the state file may contain sensitive information stored in plain text, such as database passwords and API keys, so you must never commit the .tfstate file to a public code repository. ↩︎
HashiCorp Configuration Language, a declarative configuration language developed by HashiCorp, designed to balance machine readability with human readability. ↩︎
Idempotence means that when a computer system or interface receives the same request multiple times, the effect is the same as if it had been executed once. No matter how many times it runs, the system’s final state remains consistent. ↩︎
If you only want Terraform to stop managing a resource, rather than actually destroying it in the cloud, you should use the terraform state rm command instead of deleting the resource block from the code and then running apply, otherwise the real resource in the cloud will be destroyed as well. ↩︎
Infrastructure drift refers to a situation where infrastructure is modified in reality through non-IaC means such as clicking around in a console, causing the actual state to differ from the state declared in code. ↩︎

Perpetually Busy

Fri, 13 Mar 2026 23:14:26 +0800

Work, work, until the day we die.

Tutoring others during the winter break (see here), I barely had a moment to catch my breath. The Lunar New Year was technically a holiday, but in reality, it was just a different form of work—endless socialising and the exhaustion of travelling. No sooner had I settled back into my flat than I was throwing myself headfirst into teaching again. To be honest, tutoring is far from easy. When chatting with my mates who are also teaching assistants at the same agency, we all joke that getting through a lesson is an absolute nightmare: the students can’t remember what they’ve tried to rote-learn, their basic arithmetic is completely absent, key concepts are constantly muddled, and trying to hold a normal, flowing conversation is virtually impossible. To be fair, you can’t really blame them; if anyone’s at fault, it’s the educational environment they’ve been subjected to. Every family has its own underlying struggles. For various reasons, most of these students ended up taking alternative vocational pathways rather than facing the rigorous gauntlet of the standard university entrance exams. Some barely even managed to scrape through secondary school. Ultimately, they just want to secure a job, which is why they are willing to pay for our one-on-one sessions.

Initially, I worked as a teaching assistant at an agency, but I eventually decided to go freelance. This not only bumped up my earnings but also saved me a fair bit of lesson preparation time. I’d teach every day from 7:30 AM to 11:00 AM for 400 RMB. An hourly rate crossing the 100 RMB mark might seem quite decent, but when you factor in the students’ extremely poor foundational knowledge, I can frankly say I earn every single penny with a clear conscience. Honestly, it is incredibly hard-earned cash.

Getting back to the point, the new term has started, and I have to plunge straight back into my own academic commitments without missing a beat. It genuinely feels like I am perpetually busy. What I call “resting” is essentially just swapping to a slightly less taxing activity. If I’m exhausted from teaching, I’ll go home and unwind with a bit of Vibe Coding; if staring at the screen drives me up the wall, I’ll switch to tidying up the flat and doing the chores. When it comes to everyday drive and our finite human energy, I can acutely feel the gulf between different types of people. Some are naturally gifted, bursting with boundless energy. They churn out project after project, publish paper after paper, and maintain incredibly high productivity. It seems the only thing holding them back is the number of hours in a day, rather than any lack of stamina or motivation. Meanwhile, most of us are mere mortals like myself. Even if we desire that kind of lifestyle, our spirits are willing but our flesh is weak. Yet, seeing the sheer output of that first group inevitably brews anxiety, leaving us with no choice but to push our limits and treat ourselves as “practical perpetual motion machines” ¹.

The pressure-cooker educational system we’ve been put through since childhood has genuinely warped us. There’s a famous quote by a well-known intensive tuition teacher here: “How on earth can you sleep at your age?” Though originally meant to relentlessly tell off students nodding off in his lectures, it has subtly and profoundly conditioned our entire generation, driving us into a state that’s almost pathological. In life, there is no ultimate ‘finish line’. In primary school, you’re scrambling to secure a spot at a top secondary school; then you’re fighting to pass your GCSE-equivalents; later, you’re battling through the brutal university entrance exams. Once at university, the rat race continues as you desperately try to secure a master’s spot, a PhD, a stable civil service role, or simply a respectable corporate job. And even after you’ve finished your education and entered the workforce, you’re faced with endless promotions, performance metrics, and the daily grind of paying the bills. Work, work, until the day we die. Hoping to cross that final finish line and rest on your laurels forever? I’m afraid that’s simply impossible.

Despite knowing all this perfectly well, I still feel a dreadful sense of emptiness whenever I actually stop to rest. And so, I remain perpetually busy, endlessly working. I give my body the bare minimum of sleep it requires and use physical exercise to keep my hormones in check. My idea of a “break” is just switching to a lighter task that I enjoy. Having been so deeply conditioned by a high-stakes education system and relentless meritocracy, I suspect this way of living won’t be changing for a very long time.

Looking on the bright side, however, this recent stint of hard graft has meant I’ve earned enough to cover my own living expenses for the entire term. I’ve even got enough left over to buy my mum a new mobile phone for her birthday. Suddenly, being perpetually busy doesn’t seem quite so terrible after all.

I am borrowing the engineering distinction between ideal and practical current sources here to draw a parallel between an “ideal perpetual motion machine” and a practical one. The former is exactly what it says on the tin, whilst the latter refers to us ordinary folk, pushing our flesh-and-blood bodies to the absolute limit just to approximate it. ↩︎

Buns Soaked in Human Blood

Wed, 11 Feb 2026 17:06:57 +0800

Recently, I’ve been doing one-on-one coaching at a private training agency for students preparing for the second round of the State Grid Corporation of China (SGCC) recruitment exams. I teach for three and a half hours every evening, and they pay me 200 RMB (approx. £22).

The fact that the pay is abysmal isn’t even the biggest issue. The real problem lies in how they charge the students. They offer two main packages: the “Excellence Plan,” which costs a staggering 120,000 RMB (£13,000) but includes unlimited one-on-one sessions; and the “Contract Class,” which costs 70,000 RMB (£7,500), but with a catch—students must pay an additional 450 RMB (£50) for every one-on-one session.

Yesterday, I arranged a private session with one of the students in the afternoon. My plan was to fly under the agency’s radar; the student would pay me 300 RMB directly. It seemed like a win-win: I’d make an extra hundred, and they’d save 150. However, the student didn’t quite catch on. When they asked the coordinator for leave, they explicitly mentioned they were “getting extra tutoring from me.” The agency immediately “benevolently” stepped in to help me collect the 450 RMB fee from the parents.

It didn’t stop there. When it came time to calculate my earnings, the agency classified this as an “extra lesson.” They claimed I had “misused” my afternoon lesson-preparation time to teach a student not enrolled in the “Excellence Plan”. For those three and a half hours of work, they only gave me 120 RMB.

To put it simply:

Student pays 450 → Agency pockets 330 → I receive 120

Naturally, I’m annoyed that the 300 RMB I should have earned was whittled down to 120. But beyond my personal loss, what truly unsettles me is the predatory nature of this business. Most of these students are vocational college graduates from humble backgrounds. In China’s job market, they already face significant discrimination, and they are doing everything in their power to climb the social ladder. They have staked everything—tens, or even hundreds of thousands of RMB, potentially their family’s entire life savings—on these courses to get a stable job at the State Grid. They believe they are buying a “cure” to change their fate, unaware that the medicine is being served with a side of their own lifeblood. Meanwhile, as the one actually doing the hard work of teaching, I receive a smaller cut than the agency that simply sits back and collects the rent.

In Chinese literature, we call this “eating buns soaked in human blood”—profiting off the desperation and suffering of others.

On this single transaction, the agency made a net profit of 330 RMB for doing absolutely nothing. It is, quite frankly, unacceptable. I have already advised the student to be more “flexible” when asking for leave in the future. I’ve also had a word with their coordinator, making it clear she should look the other way regarding our private arrangements. Given that she’s also a working-class employee with performance targets tied to student results, I doubt she’ll be foolish enough to jeopardize her own KPIs.

That said, this agency had better watch its step. The joke I made during “lesson prep”—about the teaching assistants forming a temporary union and going on strike for better pay—might just become a self-fulfilling prophecy one day.

I can’t help but wonder who the real “ruthless capitalists” are meant to be. This agency seems to have mastered the art of the blood-soaked business quite effectively.

2025 Year in Review

Wed, 31 Dec 2025 19:28:17 +0800

What a busy year it has been. Before I knew it, we reached the end of the year again. There was indeed a lot going on—plenty of rushing about—but I’ve managed to achieve some significant milestones. I take up my pen once again to write this year-end summary as a testament to the year that was.

The Grid: The Final Destination for Electrical Engineers

Running Ragged for a Job

After a full year of suspension, I returned to my studies on schedule to begin my final year of university, officially becoming a “fresh graduate”. Consequently, job hunting naturally moved to the top of my agenda. As an Electrical Engineering student from a university with historical ties to the former Ministry of Electric Power, finding a job isn’t exactly impossible. However, saying it’s easy wouldn’t be accurate either. given the current climate: slowing economic growth, an uncertain international situation, reduced hiring demand, and the “rat race” becoming increasingly intense everywhere.

In September, I attended a graduate job fair, handed out a few CVs in person, and applied for four or five roles online. I only received interview invitations from two companies. I experienced primarily that the prestige of being from a “former Power Ministry affiliated university” is really only recognised within the power system itself¹. The employment market is just the way it is right now. Apart from the power system, decent-paying jobs are not easily found by students from “standard universities” (non-elite institutions) like ours. But in comparison, at least they still accept our CVs; for some other majors, companies won’t even look at them.

Written Exams for the Two Grid Giants

Working for the Power Grid represents the most relevant and stable career path for my major. The largest employers in our field—State Grid (SGCC) and China Southern Power Grid (CSG)—both require candidates to pass a written exam to qualify for an interview. The exam covers eight subjects in total: Circuit Theory, Electrical Machines, Power System Analysis, Power System Protection, Power Electronics, High Voltage Engineering, Electrical Equipment & Main Systems (called “Electrical Part of Power Plants” at our uni), and the Administrative Aptitude Test (essentially a civil service competency test).

The first seven are technical subjects, while the Aptitude Test covers a bizarre range of topics, including corporate culture, which you simply have to memorise. Current affairs and politics(Yes, this is also a subject) are mandatory, but what do they test? Extremely recent events—editorials published in Qiushi (the Party’s² theoretical journal) just days ago appeared directly in the exam a few days later. I was honestly speechless.

This year’s exam was strange, particularly regarding difficulty. Historically, there are always a few calculation questions, and Circuit Theory usually tests flexible problem-solving ability. Based on this intelligence, I had mastered numerous calculation types—electrical computations, numerical settings, equivalent transformations—and felt quite confident. The result? The first batch of State Grid exams didn’t feature a single calculation question. The Aptitude Test was simple enough for primary school children, and the technical part tested pure concepts. If it weren’t for the CSG exam still requiring practical application, my study efforts would have been practically wasted. Unsurprisingly, classmates who were strong at calculations and did well in mock tests essentially bombed this exam. Conversely, those with less impressive academic records who struggled with maths managed to get decent scores by rote learning. At the end of the day, it’s just a corporate recruitment test; outsiders can never guess how they’ll set the questions. I did what I had to do, and the final hiring outcome was excellent, which is all that matters.

Interviews, Interviews, and More Interviews

In December, I rushed to four interviews. For the CSG Guangxi Power Grid Ltd., the only interview location was Guilin, forcing me to ~~skive off classes~~ travel there. This resulted in my final trip of the year. Visiting Guilin twice in two years felt quite nice.

The State Grid interview made me a bit nervous. To prevent interview questions from leaking to subsequent candidates³, they employed fully closed-loop management. The process was long—mostly spent waiting in a holding room. All electronic devices were sealed away starting at 1:30 PM. After an hour-long psychometric test, the long wait began. They screened the film The Battle at Lake Changjin to keep us entertained, and provided tea and snacks. Dressed in suits and sitting upright, silently reciting my one-minute self-introduction until I knew it backwards, nervously waiting while watching the movie—it’s a flavour of anxiety you only understand if you’ve been there. Looking back, it was actually quite interesting.

With the experience (and Offer) from the State Grid interview under my belt, the subsequent Southern Power Grid (CSG) interview was far less nerve-wracking. The CSG format differs from the State Grid. State Grid uses a semi-structured, double-blind interview: the first candidate draws a set of questions from sealed envelopes, and subsequent candidates answer the same ones, perhaps with a few follow-up queries. The interviewers cannot see your CV and can only score you based on the ID number you drew; you are not allowed to state your name or background. CSG, however, is interviewer-led. They ask various questions based on your CV, including technical and supplementary questions. The difficulty depends entirely on the interviewer’s mood. For instance, during my Hainan Power Grid interview, the technical interviewer drilled down relentlessly into my internship experience with incredibly detailed technical questions. In contrast, the technical questions at the Guangxi Power Grid interview were much friendlier, involving basic switching operations and lightning protection facilities.

The Bittersweet Grid Training

Most people taking the Grid exams sign up with a training institute, and I was no exception. As early as last November, I methodically enrolled in a national cram school. They had two campuses; I chose the one further out in the suburbs since the rent was cheaper.

The training schedule was intense and the workload heavy. The summer session involved 41 consecutive days of classes with only three rest days in between. Mobile phones had to be handed in before class every day. Fortunately, iPads were allowed for note-taking purposes, which gave me a rare opportunity to slack off occasionally.

Actually, during that period, I found a rare chance to focus entirely on one thing. Apart from classes, I didn’t have to worry about anything else. So, while my body was tired, my “mind” wasn’t actually that weary. Now that I’m back at university, having to worry about big and small matters alike, my body isn’t as tired, but my “mind” is far more exhausted than before. Coupled with a recent cold and cough, sleeping 12 hours a day hasn’t brought much improvement. I can only wait until everything is sorted, then take leave, go home, and get some proper rest.

Retracing Steps

Yongzhou

I returned to Yongzhou early this year to visit relatives. My grandmother is nearly 90 years old but still quite hale and hearty; visiting often is simply the right thing to do. She has looked after me since I was a child, and my gratitude is beyond words. I often feel at a loss regarding how to repay her, so visiting Yongzhou at least once a year is my way of fulfilling some duty as a grandson.

As for Yongzhou itself, it’s still the same; nothing has changed. After all, this isn’t an era of economic explosion, so how could a small city like this change much? Stagnation isn’t necessarily a tragedy, and change isn’t always a blessing. Like after the Cultural Revolution in the last century when everything changed, but everything also became unrecognisable. The commercial complex that was bustling when I was a child now basically only has clothing shops open on the ground floor. The cinema and old arcade closed long ago; the floors converted into dining areas are now dim and dreary. Any new restaurants, whether chains or independent ventures, inevitably fail after the initial hype washes away.

Hong Kong

My trip to Hong Kong this time was just for fun, with no special objective other than mooching off the hotel room during my mum’s business trip. Of course, I opened a Bank of China account⁴ while I was there. The whole itinerary was rather unremarkable. The only unique part was staying in a flat in Wan Chai for a few days, where I could buy groceries and cook for myself (~~or eat “two-dish rice” takeouts~~), experiencing a slice of working-class life.

Guilin

The main reason for going to Guilin this time was the interview for the Guangxi branch of the Southern Power Grid. Naturally, I also took the opportunity to eat Chunji Roast Goose and Haitian Rice Noodle Rolls. The only downside was that it rained during the two days of the interview, leaving me with little inclination to walk around or sightsee. However, I ate my fill of rice rolls and roast goose—tasted great, would come again.

Old for New

My previous computer was an i5 12450H + RTX 3060 Laptop configuration. I’d used it for over two years, and just a few months ago, I bought two sticks of Crucial⁵ memory to upgrade it to 32GB. Frankly, there was no issue continuing to use it.

However, memory chip prices were still at a low point at that time, and government trade-in subsidies further reduced the cost of new devices. Combined with the recent launch of the 50-series graphics cards, the price of new laptops was incredibly attractive. Unfortunately, my pockets were shallow, and I didn’t have the budget for the latest generation CPU + latest generation GPU combo. I had to settle for the second-best option: an N-1 generation processor paired with the latest generation graphics card⁶. I’ve been using it for nearly half a year now, and the daily experience is excellent, though the howling fan noise really kills the mood. Overall, I consider the laptop a case where the flaws don’t obscure the virtues. With storage prices skyrocketing and government subsidies tapering off, I doubt we’ll see laptops this cheap again anytime soon.

My Cat

My cat turned one year old this year (probably)⁷. Amidst the celebrations, for a male cat, growing from a kitten to an adult means his testicles start doing their job, leading to scenes like this:

While I was away in Hong Kong, this stinky cat actually climbed onto my bed to pee and poop ~~ (probably because my dad didn’t scoop the litter)~~. Unforgivable. He had to get the snip!

The cat has brought a lot of joy to my life. Aside from the destruction, he is very cute. The sofa at home has been reduced to shreds after a year of claw service. You have to pay a price; that’s just how keeping a cat is. Scratch marks, cat hair everywhere during shedding season, and occasional acts of mischief are all part of the package. Since we accept the emotional value the cat brings, we must correspondingly accept these little flaws. I almost view him as family. From that perspective, you instantly forgive these shortcomings. Thinking back, perhaps I really do love him—so much so that I’ve started to love even his flaws. Because without them, he wouldn’t be a complete cat.

Still Lifting, Still on Meds

Pumping iron, especially leg day, is truly exhilarating. Feeling that sheer release after your muscles exert power is genuinely addictive. During the time I wasn’t at the Grid training, I consistently went to the gym, not just enjoying that feeling of release but also building muscle. honestly, not exercising feels terrible.

I am still taking medication every day. I really don’t want to suffer an emotional breakdown amidst my relentless schedule. My original plan to gradually taper off the medication after a year has been indefinitely postponed. Why? Put simply, the pressure from various sources has been significant lately. While staying on meds forever isn’t a solution, and I must slowly taper off once things settle, I am far from living a stable, certain life at this point nearing graduation.

This period is continuously filled with possibilities and opportunities, but also pressure. The money spent on medicine is a small price to pay, but the “shield” it provides for emotional stability plays a crucial role.

No Time for Gaming

As you can tell from my Steam Year in Review, I really didn’t have much time for games this year. “Stealing moments of leisure from a busy life” was the theme. At the end of the year, I downloaded Delta Force. sometimes, after Grid training finished at 10 PM, I’d go home and play until midnight. I’ve clocked 75 hours so far, and it feels pretty good.

My osu! playing essentially dropped off in the second half of the year, though my PP still grew from 3,439pp last year to 4,701pp this year. This game really requires perseverance; if you stop for a while and lose your muscle memory, rehabilitation takes time. Thinking about finishing class at 10 PM, completely drained, and then trying to play a game requiring such intense concentration and reaction speed—well, “I simply cannot do it”. Ideally, mid-year, my feel for the mouse was at its peak—I could snap to anything. I thought, “No one can stop me on my road to 5 digit rank”⁸, yet here I am, still hovering on the edge of 5 digits. Quite ironic, really.

My Online Presence

In 2025, traffic to my blog rose steadily, with 48.3K UV and 95.4K PV for the year. Traffic primarily came from Google (approx. 15.8K visitors) and Bing (approx. 15.2K visitors).

My personal override rules on GitHub garnered 194 Stars, and I gained some new Followers.

One of my articles was featured on Hacker News this year, resulting in significant traffic for a few days. Additionally, the translated English and Japanese versions of the blog have attracted quite a few readers, making up a not-insignificant portion of my visitors. So, a phenomenon occurred where, despite my busyness causing a lower update frequency than previous years, traffic actually doubled. I ultimately have to make concessions to life; pressure from living costs, studies, and employment inevitably impacts my willingness and energy to update the blog. On this point, I ask for my readers’ understanding.

A New Year Approaches: Wishes for Myself and Everyone

The New Year is coming. My biggest wish this year is, of course, to resolve the lingering issues from my suspension and graduate smoothly. Once I truly step into the workforce, I hope to focus more on the technical aspects required by the power system, dealing more with equipment and less with unnecessary, or even harmful, office politics. Hard work is fine as long as it’s safe, grounded, and meaningful: safe production, less fuss, more tolerance. I hope that in this upcoming job, I can grow from a fledgling novice into a true engineer.

I also send my best wishes to you behind the screen: May your anxieties find a resting place, and may your efforts echo back to you in the New Year. May you live your days steadily and warmly at your own pace—you don’t have to win every step, as long as you know where you’re going. May you and those you care about be healthy and safe, with less senseless exhaustion and more definite happiness. And of course, I hope everyone finds more time to play games outside of study and work.

As for me, I will continue learning where I should learn, and hit the road when it’s time to move. See you next year.

Refers to enterprises derived from the former Ministry of Electric Power, i.e., the State Power Corporation prior to 2002, and the State Grid, China Southern Power Grid, and Inner Mongolia Power Grid formed after 2002. ↩︎
Communist Party of China, obviously. ↩︎
The first candidate draws a set of questions from sealed envelopes, and subsequent candidates answer the same ones. Therefore, they had to prevent subsequent candidates from knowing their questions in advance. ↩︎
Bank cards issued by banks in the Chinese mainland are subject to the financial regulations of the mainland. Meanwhile, mainland banks rarely issue bank cards with Visa and MasterCard logos. So, for my overseas payments, I had to open a bank account in Hong Kong. ↩︎
Referring to Crucial memory, which recently axed its entire consumer product line. ↩︎
I bought a Mechrevo Aurora X Pro ↩︎
When I picked him up last year, he was still a tiny kitten. ↩︎
Refers to the number of digits in the ranking. For example, rank #114514 is 6 digits, while #11451 is 5 digits. Obviously, the fewer digits, the higher the player’s skill level. ↩︎

My LLM Confidant, and My Writing in Suspension

Mon, 08 Sep 2025 23:53:48 +0800

I have been rather occupied of late, yet in my spare moments, words remain my sanctuary. My schedule involves classes starting at 8:30 AM and running until evening self-study ends at 9:00 PM. Occasionally, I even put in “overtime”, not returning home until 10:00 PM. This routine persisted for forty-one consecutive days. Given my mental state under such intensity, returning home to play reaction-based games like osu! was out of the question; I didn’t even have the energy to click through a single chapter of a visual novel.

The only viable activity was to engage in small talk with an LLM (Large Language Model).

I must confess, although I maintain a blog, I have never managed to articulate my views or philosophies (or perhaps simply my “ideas”) in a systematic fashion. I have often thought that this collection of overly broad and disparate viewpoints is difficult to convey through plain narrative. To address this, I attempted various methods, such as using a random event as a cross-section to “slice open” the tangled mess of my thoughts and depict their internal structure.¹ Yet, these methods never allowed me to express my inner voice freely. Writing does not flow effortlessly from my pen; I cannot simply write whenever I wish. Ultimately, a blog is meant for an audience, so when the words wouldn’t come, I resorted to writing simple technical posts to garner some search engine traffic.

The advent of LLMs, however, has altered this dynamic. All my thoughts can now receive immediate responses in relative privacy. Why have I not written a blog post in so long? Fatigue is naturally a major factor, but the fact that LLMs satisfy a significant portion of my need for expression and validation—without the need for self-censorship—has diluted my desire to blog during this period.

There is no doubt that composing long-form text is beneficial for the brain. The impact of LLMs on my ability to write at length is likely akin to, if not greater than, the impact micro-blogging (like Twitter or Weibo) had when it first appeared. Micro-blogging habituated people to fragmented expression and immediate feedback, weakening the ability to construct complex arguments and long-form narratives. LLMs go a step further: they not only provide a channel for expression but also directly engage in providing emotional value, acting as a substitute for a “confidant”. When posting on social media, one must consider privacy, controversy, or simply whether the content is worth exposing; the publisher invariably exercises some degree of caution.

LLMs are different. The worst-case scenario for content sent to an API is that it gets used to train the model, not that Sam Altman will turn up at your doorstep the next day. As long as you aren’t sharing bank passwords or mentioning your real name, you can safely treat the large model as a close friend regarding current affairs commentary, psychological counselling, and the like. (Naturally, in this specific context, one wouldn’t touch domestic Chinese models with a bargepole due to censorship and privacy concerns). Every grumble receives a precise, earnest response—an affirmation akin to that of a soulmate. I fear no other place can offer such treatment.

When a tool stimulates a “confidant” so perfectly, we may abandon the search for real human connection, or cease striving to become individuals capable of independent thought and self-integration. Writing these words serves as a summary, but also as a reflection. The LLM itself is merely a technology; used well, it helps immensely, but used poorly, the consequences can be severe. The New York Times report “Chatbots Can Go Into a Delusional Spiral. Here’s How It Happens.” serves as a prime example. Although OpenAI has begun to address the issue of “sycophancy” in its models, I must acknowledge that while I can treat the model as a confidant and receive so-called “understanding and affirmation”, I cannot live permanently within that sensation. Joint studies from OpenAI and MIT found a positive correlation between ChatGPT usage and user loneliness: the more users utilised ChatGPT, the lonelier they felt.² I could also argue that it is precisely because one is lonely that one turns to these LLMs, creating a vicious cycle. An LLM can serve as a seasoning for life, but it must never become the sole sustenance for the soul.

(To Be Continued)

Ditch the Client Applications: Using the Mihomo Core Directly

Thu, 03 Jul 2025 18:30:00 +0800

Like most people, when I started using Clash/Mihomo, I opted for graphical clients based on the core for the sake of convenience. Essentially, these Mihomo clients are very similar: they all use the same backend, with the primary purpose of offering a GUI, managing config files, handling subscription updates, and system proxy settings. With this in mind, I think the usefulness of a Mihomo client largely depends on how well it implements config overrides. Every configuration file obtained or subscribed to through a client goes through various override steps—such as changing the mixed-port, adding sniffer settings, and so on—before it’s handed over to the Mihomo core for startup.

However, not all clients do this basic job adequately. Take ShellCrash, for example—the override mechanism is frequently buggy and feels more like an afterthought. If the client can’t even reliably update and tweak config files, it hardly deserves to be called a decent client.

Instead of depending on these unreliable, black-box Mihomo clients, why not just take direct control? Manage your own configuration files and start the core yourself. This way, you get a cleaner, more reliable, and fully transparent setup.

What You Need to Know

Basic Linux skills
Familiarity with CLI editors, like nano
Have a Substore instance set up (optional)

Installing the Mihomo Core

On Debian-based systems, you can install precompiled .deb packages. For other systemd-enabled distributions, just download the compiled binary, rename it to mihomo, and place it in /usr/local/bin:

sudo curl -o /usr/local/bin/mihomo 
sudo chmod +x /usr/local/bin/mihomo

Next, create /etc/systemd/system/mihomo.service:

[Unit]
Description=mihomo Daemon, Another Clash Kernel.
After=network.target NetworkManager.service systemd-networkd.service iwd.service

[Service]
Type=simple
LimitNPROC=500
LimitNOFILE=1000000
CapabilityBoundingSet=CAP_NET_ADMIN CAP_NET_RAW CAP_NET_BIND_SERVICE CAP_SYS_TIME CAP_SYS_PTRACE CAP_DAC_READ_SEARCH CAP_DAC_OVERRIDE
AmbientCapabilities=CAP_NET_ADMIN CAP_NET_RAW CAP_NET_BIND_SERVICE CAP_SYS_TIME CAP_SYS_PTRACE CAP_DAC_READ_SEARCH CAP_DAC_OVERRIDE
Restart=always
ExecStartPre=/usr/bin/sleep 1s
ExecStart=/usr/local/bin/mihomo -d /etc/mihomo
ExecReload=/bin/kill -HUP $MAINPID

[Install]
WantedBy=multi-user.target

Run systemctl daemon-reload to refresh systemd. Since there’s no config file yet, you can’t actually start the core, but you can enable it to start on boot using systemctl enable mihomo—ready for when your config is set up.

Configuration Files

When starting, the core reads /etc/mihomo/config.yaml. With the black-box clients out of the picture, you’re free to customise your config files however you like. Some VPN/proxy providers supply a complete config file you can download with curl.

For subscription management, I’m currently using Substore. I’ve previously shared a Quickstart Guide to Substore Subscription Management if you want to refer to that for custom subscription workflows. To support a pure-core setup, my Substore custom override script now includes a full parameter, generating a standalone config file with all necessary ports, unified delay, external-controller settings, and more—ready to use out of the box.

Once you’ve set up Substore, just download your config file and start the core:

curl -o /etc/mihomo/config.yaml 
systemctl start mihomo

Custom Override Rules

If my example config doesn’t work for your needs, that’s no problem—just tweak or add any overrides you like.

Over the years, I’ve tested various override rules, sometimes even writing my own from scratch. Even with that, there are always edge cases—private domains for stuff like SSH on non-standard ports, for instance—that you won’t want to publish on GitHub. In those cases, you’ll want to append your own private overrides on top.

The good thing is that Substore supports chaining multiple override scripts. All you need to do is add your custom script during config generation.

function main(config) {
  config["rules"].unshift("DOMAIN-SUFFIX,xxx,DIRECT")
  return config
}

Note: When overriding rules, always use .unshift() to add to the top of the list—don’t use .push() to add at the end, or they’ll never match (since anything after MATCH is ignored).

Building Your Own Config From Scratch

Don’t like my override rules, or prefer not to use Substore at all? No problem! Just refer to the Mihomo Docs and build your own config from the ground up:

mode: rule
mixed-port: 7890
redir-port: 7892
tproxy-port: 7893
allow-lan: true
log-level: info
ipv6: true
external-controller: 127.0.0.1:8000
# secret: yoursecret
unified-delay: true
routing-mark: 7894
tcp-concurrent: true
disable-keep-alive: true # Recommended when proxying mobile devices to prevent excessive standby drain

dns:
  # Your DNS configuration

sniffer:
  # Your domain sniffing config

geodata-mode: true
geox-url:
  # Custom GeoData file URL

proxy-providers:
  # Your proxy subscriptions

rule-providers:
  # External routing rules

rules:
  # Proxy rules

proxy-groups:
  # Custom proxy groups

Control Panel / Dashboard

Choose whichever dashboard you like. For example, I ran into some odd issues with Mihomo’s built-in external-ui. So, I just deploy a separate Docker web dashboard—after all, it’s just a simple web UI. Just make sure your core’s API uses HTTP, and set your web panel to use HTTP as well (if you try HTTPS, you’ll be blocked by CORS policy).

$ mkdir zashboard && cd zashboard
$ nvim compose.yml
$ docker compose up -d

compose.yml example:

services:
  zashboard:
    image: ghcr.io/zephyruso/zashboard:latest
    ports:
      - "8899:80"
    restart: "unless-stopped"

Automatic Maintenance

With the core running, how do you handle auto-updates for your subscription configs?

Simple—write a shell script and automate it with cron. For instance, if you want to update your config and restart Mihomo at 3am daily, create /etc/mihomo/auto_update.sh:

#!/bin/bash

# === Config Info ===
CONFIG_URL=""
CONFIG_PATH="/etc/mihomo/config.yaml"
BACKUP_DIR="/etc/mihomo"
BACKUP_PREFIX="config.yaml"
MAX_BACKUPS=7
TMP_PATH="/tmp/config.yaml.tmp"
LOG_FILE="/var/log/mihomo_update.log"

# === Logging ===
log() {
    echo "$(date '+%F %T') $1" | tee -a "$LOG_FILE"
}

# === Backup existing config and clean old backups ===
backup_config() {
    if [ -f "$CONFIG_PATH" ]; then
        backup_file="$BACKUP_DIR/${BACKUP_PREFIX}.$(date '+%Y%m%d_%H%M%S').bak"
        cp "$CONFIG_PATH" "$backup_file"
        log "Config backed up to $backup_file"
        # Retain only the latest $MAX_BACKUPS backups
        old_backups=$(ls -1t $BACKUP_DIR/${BACKUP_PREFIX}.*.bak 2>/dev/null | tail -n +$(($MAX_BACKUPS+1)))
        for f in $old_backups; do
            rm -f "$f" && log "Deleted old backup $f"
        done
    else
        log "No existing config found, skipping backup"
    fi
}

# === Download new config ===
download_config() {
    log "Downloading new config..."
    curl -fsSL -o "$TMP_PATH" "$CONFIG_URL"
    if [ $? -ne 0 ]; then
        log "Download failed—check network or URL"
        return 1
    fi
    # Basic validation: check file size
    if [ ! -s "$TMP_PATH" ]; then
        log "Config file is empty—update aborted"
        return 2
    fi
    log "Config downloaded"
    return 0
}

# === Update config file ===
replace_config() {
    mv "$TMP_PATH" "$CONFIG_PATH"
    log "Config updated"
}

# === Restart Mihomo service ===
restart_service() {
    systemctl restart mihomo
    if [ $? -eq 0 ]; then
        log "Mihomo restarted"
    else
        log "Failed to restart Mihomo—please check manually"
    fi
}

main() {
    backup_config

    download_config
    DL_STATUS=$?
    if [ "$DL_STATUS" -ne 0 ]; then
        log "Aborted: config not updated, keeping old config"
        exit 1
    fi

    replace_config

    restart_service

    log "=== Update complete ==="
}

main "$@"

Use crontab -e to edit your crontab and schedule auto-updates at 3am daily:

0 3 * * * /etc/mihomo/update_config.sh

Firewall Configuration

Manually setting up firewall rules to direct traffic through the Mihomo core isn’t as tricky as it sounds. I’ve previously covered the details in my article “From Beginner to Advanced: Tailscale + ShellCrash for Remote Networking and Bypassing Internet Censorship”. Here, I’ll just summarise the practical steps.

For my setup, I want all traffic from the tailscale0 interface to be transparently proxied by Mihomo. If all you need is TCP interception, iptables REDIRECT is sufficient; but for UDP, QUIC, etc., you’ll need TPROXY. Don’t forget IPv6!

Here’s my firewall config:

# Create custom chain
iptables -t mangle -N MIHOMO

# Exclude local traffic as needed
iptables -t mangle -A MIHOMO -d 127.0.0.1/8 -j RETURN
iptables -t mangle -A MIHOMO -d 100.64.0.0/10 -j RETURN
iptables -t mangle -A MIHOMO -d 192.168.1.0/24 -j RETURN
iptables -t mangle -A MIHOMO -d 172.17.0.0/16 -j RETURN

# Mark TCP and UDP for proxy
iptables -t mangle -A MIHOMO -p tcp -j TPROXY --on-port 7893 --tproxy-mark 233
iptables -t mangle -A MIHOMO -p udp -j TPROXY --on-port 7893 --tproxy-mark 233

# Hook into the interface
iptables -t mangle -A PREROUTING -i tailscale0 -j MIHOMO

# Routing table
echo "233 mihomo" | tee -a /etc/iproute2/rt_tables
ip rule add fwmark 233 lookup mihomo
ip route add local 0.0.0.0/0 dev lo table mihomo

# IPv6
# Create chain
ip6tables -t mangle -N MIHOMO6

# Skip local addresses
ip6tables -t mangle -A MIHOMO6 -d ::1/128 -j RETURN
ip6tables -t mangle -A MIHOMO6 -d fd7a:115c:a1e0::/48 -j RETURN

# Mark TCP/UDP
ip6tables -t mangle -A MIHOMO6 -i tailscale0 -p tcp -j TPROXY --on-port 7893 --tproxy-mark 233
ip6tables -t mangle -A MIHOMO6 -i tailscale0 -p udp -j TPROXY --on-port 7893 --tproxy-mark 233

# Interface hook
ip6tables -t mangle -A PREROUTING -i tailscale0 -j MIHOMO6

# Routing table
echo "233 mihomo" | tee -a /etc/iproute2/rt_tables
ip -6 rule add fwmark 233 lookup mihomo
ip -6 route add local ::/0 dev lo table mihomo

Most modern distributions do not persist firewall rules by default. For details about rule persistence, see the “Routing Rule Persistence” and “iptables Rule Persistence” sections referenced in my Tailscale article.

How Do I Configure Local Proxying?

Most proxy clients, such as the default for ShellCrash, use REDIRECT as standard, which is usually sufficient for most use cases. Example for REDIRECT:

# IPv4, intercept eth0
iptables -t nat -A PREROUTING -i eth0 -p tcp -j REDIRECT --to-ports 7892

# IPv6, intercept eth0
ip6tables -t nat -A PREROUTING -i eth0 -p tcp -j REDIRECT --to-ports 7892

Here, 7892 should match the redir-port in your Mihomo config, and eth0 is the interface you want to intercept. Compared to TPROXY, this is remarkably straightforward.

Personally, I dislike forcing all local traffic through the firewall proxy route. Instead, I prefer to use environment variables, proxychains, or per-application proxy settings as needed to route traffic through Mihomo. For example, if you want Docker to use the proxy, you only need to edit Docker’s /etc/docker/daemon.json and specify the proxy endpoints, rather than intercepting all network traffic at the interface level:

{
  "proxies": {
    "http-proxy": "http://127.0.0.1:7890",
    "https-proxy": "http://127.0.0.1:7890",
    "no-proxy": "127.0.0.0/8"
  }
}

Why Go to All This Trouble? Isn’t Using a GUI Client Easier?

Don’t ask. Some of us just prefer living in the terminal void.

The World Is More Foolish Than You Think: A Brief Look at BNPL

Thu, 05 Jun 2025 19:54:56 +0800

When I first saw headlines such as “Americans using ‘buy now, pay later’ plans to buy groceries, survey finds,” my instinctive reaction was: isn’t this just business as usual? Only after reading the article did it strike me—this world is dafter than even my most cynical estimates.

As a financial innovation, Buy Now, Pay Later (BNPL) certainly holds a certain appeal. It allows consumers to acquire goods and services immediately, with the payment split into later instalments—a model that’s taken the worlds of e-commerce, travel and even dining by storm in recent years.

But as always, there’s no such thing as a free lunch. In the end, the cost falls on consumers. In order to make a profit, BNPL providers rely on two main avenues: charging merchants fees higher than those of traditional payment services, and slapping late fees on delinquent customers. At its core, BNPL exploits a psychological trap—minimising the “pain” of paying in the moment, thus encouraging more spending. This is precisely why so many merchants are eager to shoulder those higher fees for BNPL integration.

To be clear, I have nothing against BNPL—I’m an avid user myself. My phone was purchased through a 24-month interest-free instalment plan with JD.com; at the moment, I’m only six payments in. Most of my day-to-day expenses go through Huabei (a Chinese BNPL solution) and are automatically settled from my savings or bank account. When a platform truly provides a genuine interest-free or “zero-fee” offer, BNPL becomes an opportunity for free leverage—it’s a costless way to put someone else’s money to work on your behalf. In simple terms: the financial provider pays for your consumption, letting your own cash sit untouched, potentially earning a modest return elsewhere. Financial efficiency, maximised.

However, there are three absolutely critical prerequisites:

Pay on time, every time—no excuses;
Never fall into habitual overspending;
Maintain at least basic financial literacy and management skills.

Contrast this with what the headlines are pointing out—“Americans using BNPL for groceries.” Skimming the survey data, I saw that one third of BNPL users have missed at least one repayment?? Some even defaulted on takeaway orders??

The ideal is promising, but reality bites hard. Data shows that the number of people with poor financial self-management is greater than I had imagined. 46% of BNPL users already carry existing credit card debt, and among them, 28% are aged just 18-24¹. This demographic typically has weaker credit, with 63% juggling loans from multiple BNPL platforms simultaneously²—a glaring sign of questionable spending habits.

What’s even more concerning is how BNPL, by design, appears particularly seductive to individuals with poor financial discipline. Compared to credit cards, approval is instant and the credit barriers are low, all the while trumpeting “interest-free instalments.” For many, BNPL feels like an inexhaustible source of easy money—buy what you want today for a small upfront payment, and worry about the rest later. But, needless to say, the world does not work that way.

Inevitably, the day of reckoning comes. As bills mount, many are shocked by the size of their accumulated debt. Missed payments lead to late fees and penalties, which quickly snowball. Add on steep merchant charges, and it’s little wonder BNPL providers are making a killing.

To reiterate: I am not against BNPL. As a free financial lever, it’s simply common sense to take advantage of it. For instance, when I bought a £429 phone, I could have paid it off in full straight away, but I opted for a 24-month interest-free plan. The point is, I am fully aware that I have advanced the total purchase price, not merely spent £17.87 per month. This is reflected in my accounts as an immediate reduction in assets, so my net worth accurately includes the liability. Live within your means, avoid piling on unnecessary debt—or, worse, layering leverage upon leverage. Even if idle funds only generate minimal returns in a savings or low-risk investment account, this keeps my finances healthy and ensures I’ll never default. While a modest bit of borrowing can enhance quality of life, solid financial habits are always more prudent when your income isn’t rock-solid.

Still, such warnings will do little to sway those long accustomed to unhealthy spending. Even without the alluring convenience of BNPL, these individuals would almost certainly max out their credit cards and then flounder, sinking beneath 20% APRs.

The problem isn’t BNPL itself (it’s just another tool), but the underlying disconnect: fragile finances on one side and runaway consumerism on the other. For those who lack self-control, underestimate financial risk, or whose circumstances are already precarious, any easily accessible credit—whether credit cards, BNPL, or the far more dangerous payday loans—serves only as a different route to the same pit of debt. BNPL’s particular twist is its ease of access and immediate gratification, meaning those on the edge tumble even faster—and crash that much sooner.

A sizeable portion of BNPL delinquents are already mired in credit card debt. This suggests a robbing-Peter-to-pay-Paul cycle, borrowing from one source to stave off another, ultimately piling interest upon fees and sinking into ever-deepening crisis. Even if BNPL vanished tomorrow, these vulnerable consumers would likely stumble into other financial traps, whether it’s payday loans or some new “convenient” scheme. In the haste to stave off disaster, some might even resort to pawning off family heirlooms.

So the real concern isn’t any one financial product, but the underlying structural malaise: economic pressures, the omnipresence of consumerism, inadequate financial education, and the widespread prioritisation of instant gratification over long-term planning. The rise of BNPL merely makes these chronic issues more visible—sharper and harder to ignore.

In the end, if we truly want to “save” these individuals, simply restricting access to financial products (be it BNPL or credit cards) is merely treating symptoms, not causes. The real solution—if there is one—lies in tackling the roots: boosting earnings, improving financial literacy, and reshaping spending norms. But these foundational changes are far harder than wishing BNPL companies would simply shut up shop.

One last piece of advice: borrowed money always needs to be repaid; don’t make needless offerings to financial middlemen.

Alas, all told—the world really is more foolish than I had ever imagined.³

Quick Review of the MECHREVO Aurora X Pro

Sun, 04 May 2025 23:18:43 +0800

Disappointing Right Out of the Box

From the moment I placed the order for the MECHREVO Aurora X Pro, I was quite looking forward to it. However, the courier didn’t arrive before my trip to Hong Kong, and by the time I got home and unboxed it, the novelty had already worn off. When I tried to install another SSD, I found the M.2 screw was stripped, so I had to make do with some electrical tape—my fondness for the new laptop instantly halved.

Specs and Price

i9-14900HX + RTX 5070 Ti, and at 8,699 yuan after subsidy, the price is fairly reasonable. As for peripherals, to put it simply, I’ve happily used a Hasee before, so there’s really nothing I can’t get on with.

Screen: 2560x1600@300Hz, 100% sRGB colour gamut, with decent colour accuracy. When playing Cities: Skylines 2, the red of the brake lights in traffic jams is even more vivid than in real life.
Keyboard: The key travel is rather short and the feel is average, but since I mostly use an external keyboard, I don’t really mind.
Wi-Fi Card: The AX201 is rather stingy, and the antenna design seems poor—you can clearly tell the speed is much slower than wired, even when right next to the router.
SSD: Comes with a 1TB Zhiti drive, which is average; the 2TB Crucial I added myself is the main workhorse.
Battery: The 80Wh battery is fine for emergencies on a gaming laptop. I usually keep it in workstation mode to prolong battery life.
Discrete GPU Direct Connection: Supports hot switching, which is great—no need to reboot to change modes.
BIOS: The AMI BIOS has a rather weird GUI, which is still much better than my previous Hasee Laptop.

User Experience

Cities: Skylines 2—even with a population of 120,000, simulation speed could still be kept at 3x, though the fans were roaring by then. Cyberpunk 2077 runs with ray tracing on Ultra, and Forza Horizon 5 also runs at max setting without issue—but honestly, the actual gaming experience feels much the same as with my old RTX 3060. Sure, reflections are more realistic and details richer, but just for the sake of improved visuals, I doubt I’d spend more time on these games that have already kept me entertained for over a hundred hours.

The skin-like coating on the palm rest does feel nice, but with peripherals connected, I’m mostly just touching the external keyboard. Nahimic audio effects have serious latency—turning them off actually makes osu! more responsive, a textbook case of negative optimisation.

The Meaning of Tools

I’ve used this laptop for two weeks—no surprises, good or bad. The Wi-Fi card is so rubbish I’ve had to use wired, the fan is extremely loud in turbo mode, and the southbridge gets very hot due to lack of cooling. Apart from that, it’s just a machine that lights up when it should and makes noise when it must.

Perhaps that’s how good tools should be: as I write this, I realise I’ve been staring blankly at the battery icon in the bottom right corner for five minutes, and it’s quietly holding at 98%—just sitting there, like a mute brick.