How to Use the Aegis Ruleset

Before using Aegis, it is necessary to briefly explain its position.

Aegis is a personal digital firewall ruleset based on Surge.

It helps users accurately identify and classify traffic locally on iOS and macOS, then define traffic policies according to their own needs.

Aegis is not traditional protection software, and it does not automatically make security decisions for you.

It is a ruleset for identifying and presenting network communication behavior.

In real use, Aegis identifies and classifies network communication.

It helps you understand more clearly how different applications and services communicate.

A rule match only means that a communication has been identified. It describes the type and behavior characteristics of the communication, but it does not itself make a risk judgment.

Based on this visible information, users can define corresponding traffic policies according to their own usage scenarios and needs.

This process is not complicated and does not depend on frequent adjustment. Instead, through long-term use, it gradually establishes a stable and sustainable way of judgment.

On this basis, the Aegis ruleset can also be used as a basis for traffic routing.

By identifying and classifying different communication behaviors, users can route traffic to different policies, nodes, or handling methods instead of being limited to simple allow or block decisions.

Obtain the Aegis Ruleset Subscription Link

You can obtain the latest ruleset subscription method from the Aegis project repository on GitHub. The project repository is maintained over the long term and continuously reviewed.

Aegis provides documentation in Simplified Chinese, Traditional Chinese, and English. Subscription configurations are also provided in these three languages, so users can choose according to their reading and usage preferences.

Aegis also supports dual-stack IPv4 and IPv6 design. If your network environment natively supports IPv6, use the IPv6 configuration. Otherwise, use the IPv4 configuration. Do not mix them, or requests may fail and DNS resolution may break.

Add the Subscription in Surge

The following is the most common usage method: add Aegis in Surge as a Rule Set subscription.

Simple Flow

iOS

Copy the configuration link -> Open Surge -> Download configuration from URL -> Paste the link -> Edit in text mode -> Replace “your node” with the correct node parameters -> Add the airport node domain rule -> Enable rules -> Update external resources -> Verify basic connectivity -> Done.

macOS

Copy the configuration link -> Open Surge -> Install configuration from URL -> Paste the link -> Edit in the text editor -> Replace “your node” with the correct node parameters -> Add the airport node domain rule -> Enable rules -> Update external resources -> Verify basic connectivity -> Done.

Detailed Steps

iOS

1. Copy the Aegis configuration link.

2. Open Surge and choose to download a configuration from URL.

3. Paste the configuration link and complete the import.

4. Edit in text mode and replace “your node” with the actual node parameters.

5. Add the airport node domain rule to ensure that node service domains are accessed through the Proxy policy group.

   Operation path: [Rule] -> New DOMAIN-SUFFIX,example.com,Proxy (airport node domain) -> Done.

6. Enable the corresponding rule modules as needed by removing the ”# ” before the corresponding rule module.

7. If you need to enable optional regional routing, remove the ”# ” before the corresponding country routing rule.

8. Manually refresh external resources.

9. Visit a site that can verify connectivity and confirm that basic network access is normal.

macOS

1. Copy the Aegis configuration link.

2. Open Surge and choose to install a configuration from URL.

3. Paste the configuration link and complete the import.

4. Enter text mode and replace “your node” with the actual node parameters.

5. Add the airport node domain rule to ensure that node service domains are accessed through the Proxy policy group.

   Operation path: Rules -> New Standard Rule -> DOMAIN-SUFFIX -> example.com (airport node domain) -> Proxy -> Done.

6. Enable the corresponding rule modules as needed.

7. Manually refresh external resources.

8. Visit a site that can verify connectivity and confirm that basic network access is normal.

Configuration Method

Enable the GeoIP Database

The first-time GeoIP database enablement method is:

Open Surge -> More -> General -> GeoIP Database -> Update Now -> Done.

Aegis supports GEOIP query rules for countries outside mainland China because the current database supports global country IP ranges.

Aegis enables this by default: GEOIP,CN,DIRECT # GEOIP matches mainland China

Optional Regional Routing

To provide ordinary users with simplified international routing and reduce access failures, Aegis supports optional regional routing for the following regions:

# GEOIP,US,Proxy # Route US regional traffic through the proxy. After enabling, US sites can be accessed.

# GEOIP,GB,Proxy # Route UK regional traffic through the proxy. After enabling, UK sites can be accessed.

# GEOIP,FR,Proxy # Route France regional traffic through the proxy. After enabling, French sites can be accessed.

# GEOIP,DE,Proxy # Route Germany regional traffic through the proxy. After enabling, German sites can be accessed.

# GEOIP,RU,Proxy # Route Russia regional traffic through the proxy. After enabling, Russian sites can be accessed.

# GEOIP,EU,Proxy # Route EU regional traffic through the proxy. After enabling, most European sites can be accessed.

# GEOIP,AU,Proxy # Route Australia regional traffic through the proxy. After enabling, Australian sites can be accessed.

# GEOIP,JP,Proxy # Route Japan regional traffic through the proxy. After enabling, Japanese sites can be accessed.

# GEOIP,KR,Proxy # Route South Korea regional traffic through the proxy. After enabling, Korean sites can be accessed.

# GEOIP,SG,Proxy # Route Singapore regional traffic through the proxy. After enabling, Singapore sites can be accessed.

Enablement method:

macOS: Open Surge -> Rules -> Optional Regional Routing -> Check the corresponding country routing entry -> Done.

iOS: Open Surge -> Aegis configuration -> Edit in text mode -> Optional Regional Routing -> Remove the ”# ” before the corresponding country routing rule -> Done.

FINAL Rule

Description: FINAL,REJECT is the default Aegis rejection policy. It ensures that all traffic not explicitly allowed is blocked.

Security: Keeping it as REJECT maintains the highest protection level and prevents unknown domains, suspicious requests, or potential attack traffic from bypassing rules.

Adjustment: Changing REJECT to Proxy or enabling optional regional routing can improve access compatibility, but it reduces overall security.

Use Aegis Policy Groups for Routing

• Direct (DIRECT)
• Proxy (Proxy)
• Reject (REJECT)

In most cases, users can keep the default routing policy group configuration. The default is DIRECT and should generally not be changed. The default routing country is the United States. Users should set this consistently according to their own situation to avoid inconsistent routing, such as some traffic using the United States while other traffic uses Singapore.

Use Aegis Main Rule Modules for Identification and Classification

• Advanced modules (disabled by default)
• Identification modules (disabled by default)
• Blocking modules (enabled by default)
• Observation modules (enabled by default)

Enablement method:

macOS: Open Surge -> Rules -> Check the corresponding module -> Done.

iOS: Open Surge -> Aegis configuration -> Edit in text mode -> Find the corresponding module rule -> Remove the ”# ” before the corresponding module rule -> Done.

Automated Updates

Aegis uses GitHub hosting to implement an automatic update mechanism, ensuring that data remains up to date and supporting Surge remote subscription usage.

If automatic reload after configuration changes is not enabled, you can also manually refresh external resources or reload the configuration to ensure that the ruleset remains up to date.

Version Notes

Aegis follows semantic versioning: vMAJOR.MINOR.PATCH. Example: Aegis v3.0.1, MAJOR=3, MINOR=0, PATCH=1.

MAJOR (X) version, major update: structural adjustments or compatibility changes. You must re-download the configuration and re-add nodes.

MINOR (Y) version, new feature: new policy groups, new modules, or new capabilities. It is recommended to re-download the configuration and re-add nodes.

PATCH (Z) version, fix update: rule fixes, comment completion, or minor optimization. You do not need to re-download the configuration; just update external resources.

Notes

1. Rule Mode must be enabled, otherwise the Aegis ruleset may not execute any protection, routing, or blocking mechanism.

   Aegis is a personal digital firewall system built on rule mode and depends on Surge's rule matching mechanism for domain classification, policy routing, and malicious blocking.
   
   Aegis can only provide full functionality when Rule Mode is enabled. If Global Mode or Direct Mode is used, external networks may still be accessed according to policy, but the entire rule matching process will be skipped, causing the following risks:
   
   • Domains and IPs cannot be identified and classified
   • All blocking mechanisms and module policies become ineffective
   • Core capabilities such as routing, protection, and ad removal cannot function
   
   If certain domains are temporarily inaccessible because of rule matching failure, you may temporarily switch to Global Mode or Direct Mode for emergency handling. At the same time, it is strongly recommended to report the issue in the project Telegram group as soon as possible. We will add it to the corresponding ruleset as quickly as possible so future access does not require bypassing.

2. It is recommended to use China.list domain rules together with GEOIP,CN IP range rules to improve matching accuracy for China traffic:

   RULE-SET,https://raw.githubusercontent.com/Thoseyearsbrian/Aegis/main/rules/China.list, DIRECT   # Precisely match China domains
   GEOIP,CN,DIRECT    # Match mainland China IPs not covered by domain rules
   FINAL,REJECT       # Final default rejection rule. Do not place GEOIP after it.

3. GEOIP query rules for countries outside mainland China are supported because the current database supports global country IP ranges.

   GEOIP, US, Proxy   # Correct
   GEOIP, AU, Proxy   # Correct
   GEOIP, CN, DIRECT  # Correct

4. About the message “tun-excluded-routes is configured, and this parameter may cause issues after switching networks. Use with caution.”

   This message is not an error or conflict. It is a system-level reminder from Surge. In a fixed network environment, it can be safely ignored.
   If LAN communication issues occur after switching networks, such as Wi-Fi to hotspot, affecting AirDrop, Bonjour, NAS, or similar services, choose "Stop Proxy" -> "Start Proxy" from the menu to rebuild the routing table and restore the connection.

5. Usage notes for domain rules and IP network segment rules

   It is recommended to prioritize DOMAIN-SUFFIX domain rules to identify specific services and business ownership, while using IP-CIDR and IP-CIDR6 rules as references for network carrier and infrastructure ownership. Large platform network segments may carry third-party services or open source project resources and are not equivalent to specific service or business ownership. Avoid confusing service identity with the carrier network.

Updates and Maintenance

Aegis will continue maintaining and reviewing rules. You only need to keep the subscription updating normally.

When you find that certain websites or application features behave abnormally, it is recommended to troubleshoot in the following order:

• Temporarily switch to global mode or direct mode to confirm whether the issue comes from a rule match
• Confirm which category of communication caused the impact
• Choose to allow, route, or ignore it according to your needs
• Report reproducible issues to the Telegram group for later review and improvement

What You Can Do Next

After reading this article, you can continue exploring according to your own goals:

• Read How to Use the Aegis Ruleset to learn practical usage
• Watch the iOS video tutorials and macOS video tutorials for a deeper understanding
• Review the complete rules and module documentation on GitHub

With these resources, you can move from theoretical understanding to practical use and define policies on your own devices that better fit your usage scenarios.

FAQ

“Can I use rules from other people at the same time?”

The Aegis ruleset uses a systematic and modular design. The rules have clear construction logic and boundary separation.

To avoid rule conflicts or behavior overrides, it is not recommended to stack independent rules from unknown sources or rules that have not been adapted while using Aegis.

If you encounter communication scenarios not yet covered in real use, or if you have questions about existing rules, you can raise specific issues in the Telegram group for later review and improvement.