根据 Surge 的说明，QUIC 流量会被自动 block。

下面是我的 Proxy 配置（示例）：

EXAMPLE = ss, HOST, PORT, encrypt-method=aes-128-gcm, password=PASSWORD, tfo=false, udp-relay=false

但是在 iOS 上打开 OpenAI 客户端时，QUIC 流量没有被 block，而是走了 DIRECT。信息如下：

10:44:29.542686 [TLS] QUIC TLS SNI: ios.chat.openai.com
10:44:29.543908 [Rule] Sub-rule matched: .openai.com(in ai_suit)
10:44:29.543944 [Rule] Rule matched: RULE-SET ai_suit
10:44:29.544044 [Rule] Policy decision path: AI -> Proxy -> TW Auto
10:44:29.544273 [UDP] Fallback to DIRECT since the policy doesn't support UDP
10:44:29.545817 [UDP] QUIC traffic detected, allowed based on policy settings
10:44:29.552822 [UDP] New remote address: 31.13.67.19:443

我尝试在 Policy Parameters 中加入 block-quic=true：

EXAMPLE = ss, HOST, PORT, encrypt-method=aes-128-gcm, password=PASSWORD, tfo=false, udp-relay=false, block-quic=true

但是没有效果，流量依旧走的是 DIRECT。

但是如果设置 udp-relay=true：

EXAMPLE = ss, HOST, PORT, encrypt-method=aes-128-gcm, password=PASSWORD, tfo=false, udp-relay=true

则可使 QUIC 流量被正确 block。信息如下：

10:52:42.982609 [TLS] QUIC TLS SNI: ios.chat.openai.com
10:52:42.983253 [Rule] Sub-rule matched: .openai.com(in ai_suit)
10:52:42.983283 [Rule] Rule matched: RULE-SET ai_suit
10:52:42.983368 [Rule] Policy decision path: AI -> TWManual
10:52:42.984960 [UDP] QUIC traffic detected, blocked based on policy settings

或者将 udp-policy-not-supported-behaviour 设置为 REJECT：

[General]
udp-policy-not-supported-behaviour = REJECT

也可以可使 QUIC 流量被正确 block。信息如下：

10:58:34.577464 [TLS] QUIC TLS SNI: ios.chat.openai.com
10:58:34.580868 [Rule] Sub-rule matched: .openai.com(in ai_suit)
10:58:34.580975 [Rule] Rule matched: RULE-SET ai_suit
10:58:34.581115 [Rule] Policy decision path: AI -> TWManual
10:58:34.581401 [UDP] Fallback to REJECT since the policy doesn't support UDP

QUIC 流量走 DIRECT 的话，会导致 iPad 上的 ChatGPT 无法登录（我在 iPhone 上可以正常登录，Surge 配置文件是一样的，原因未知），请考虑修复这个问题。谢谢！

其他相关 Report：

Surge iOS 对 QUIC 协议的处理有些问题