Network

The note is generated by CatDesk.

Problem

After enabling Clash system proxy, Meituan intranet sites (*.sankuai.com, *.meituan.com) and internal IPs (33.x.x.x, 11.x.x.x) become inaccessible.

Root Cause Analysis

1. Fake-IP mode interference — Clash’s fake-ip mode assigns fake IPs (198.18.x.x) to all domains, which means intranet traffic that should match IP-CIDR,10.0.0.0/8,DIRECT rules can never match because the domain was mapped to a fake IP instead of the real internal IP.
2. Missing domain DIRECT rules — DIRECT rules for intranet domains are positioned too far down in the rule list, so higher-priority rules match first and route traffic through the proxy.
3. Incomplete system proxy bypass list — macOS’s default proxy bypass list only includes 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16, but not 33.0.0.0/8 or other Meituan internal IP ranges.

Solution (Clash Verge Rev)

Config directory: ~/Library/Application Support/io.github.clash-verge-rev.clash-verge-rev/

The note is generated by CatDesk.

What is DNS

DNS (Domain Name System) is the “phone book” of the internet. It translates human-readable domain names (like www.google.com) into machine-readable IP addresses (like 142.250.80.46). Without DNS, you’d have to memorize IP addresses for every website you visit.

How DNS Resolution Works

When you type mlp.sankuai.com in your browser, a chain of lookups happens:

Browser cache → OS cache → Router → Recursive Resolver → Root Server → TLD Server → Authoritative Server

Step by step:

The note is generated by CatDesk.

What is Fake-IP

Fake-IP is a DNS resolution strategy used by proxy tools like Clash (Mihomo), Clash Verge, and similar transparent proxy software. Instead of performing a real DNS lookup when an application requests a domain, the proxy immediately returns a fabricated IP address from a reserved subnet (typically 198.18.0.0/16). The proxy maintains an internal mapping table between these fake IPs and the original domains, so when traffic is later routed to a fake IP, the proxy knows which domain the traffic was actually destined for.