Zoom Proxy Routing Rules

English | 简体中文

Ready-to-subscribe rules for Loon / Clash (mihomo) / Shadowrocket / Surge / Quantumult X / sing-box, based on Zoom's official domains, 22 downloadable IP lists, and official firewall documentation for Zoom, CRC, and Zoom Rooms.

The rules cover documented public cloud destinations for Zoom sign-in, websites, Meetings and Webinars, chat, recordings, Phone, Contact Center, Virtual Agent, Cloud Room Connector, Zoom Apps, CDN, device management, and network assessment. Domain suffix rules cover the apex domain, its subdomains, and all URL paths; IPv4 and IPv6 CIDR rules also cover audio and video connections made directly to IP addresses.

Choose a rule set

Rule set	Contents	Best suited for
ZoomFull	Zoom + official Zoom Apps shared IPs + shared domains for CAPTCHA, web components, certificate validation, and related dependencies	The broadest coverage of documented public client dependencies
Zoom	Core Zoom domains + destination IPs for Meetings, CRC, Phone, Contact Center, Virtual Agent, CDN, and PSO	Everyday meetings, calls, and enterprise services, with fewer shared dependencies
ZoomDomains	Zoom domain rules only	Domain-based routing, or a separate routing policy for media IPs

ZoomFull includes Google static resources, hCaptcha, certificate services, and shared CDN infrastructure, so it may also match other applications using those services. Zoom also includes CDN addresses designated by Zoom; this does not mean those addresses are exclusive to Zoom. Choose either version; you do not need both.

See rule counts for current totals and the last source change time. See manifest.json for export counts and SHA-256 hashes.

Subscription links

These are rule subscriptions. Add them to an existing configuration and choose your proxy node or policy group. They do not include proxy server credentials.

Client	Full: ZoomFull	Standard: Zoom	Domains only: ZoomDomains
Loon	ZoomFull.list	Zoom.list	ZoomDomains.list
Clash / mihomo	ZoomFull.yaml	Zoom.yaml	ZoomDomains.yaml
Shadowrocket	ZoomFull.list	Zoom.list	ZoomDomains.list
Surge	ZoomFull.list	Zoom.list	ZoomDomains.list
Quantumult X	ZoomFull.list	Zoom.list	ZoomDomains.list
sing-box	ZoomFull.json	Zoom.json	ZoomDomains.json

To download all files, select Code → Download ZIP on GitHub. To pin a subscription to a specific revision, replace main in its URL with an existing commit SHA.

Configuration examples

All examples below use ZoomFull. Replace PROXY or proxy with a proxy node or policy group that actually exists in your configuration. Place these rules before any rule that would otherwise match Zoom traffic and before the final fallback rule. Preserve appropriate routing priority for enterprise LANs, VPNs, and local devices.

Loon

Add the corresponding URL as a remote rule and select a policy, or merge this into your existing configuration:

[Remote Rule]
https://raw.githubusercontent.com/proxyBug/zoom-rules/main/ZoomFull.list, policy=PROXY, tag=ZoomFull, enabled=true

Clash / mihomo

Merge the following sections into your existing rule-providers and rules. Do not create duplicate top-level YAML keys:

rule-providers:
  ZoomFull:
    type: http
    behavior: classical
    format: yaml
    url: https://raw.githubusercontent.com/proxyBug/zoom-rules/main/rule/Clash/ZoomFull.yaml
    path: ./ruleset/ZoomFull.yaml
    interval: 86400

rules:
  - RULE-SET,ZoomFull,PROXY
  # Keep your other rules here, with the final MATCH rule below.

To transparently capture a desktop client's UDP media traffic, use a supported TUN or virtual network adapter mode and a proxy node with UDP forwarding. Setting only the system HTTP proxy does not guarantee that all Zoom media traffic will be captured.

Shadowrocket / Surge

Add a RULE-SET to your current configuration and choose a proxy policy. For Shadowrocket:

[Rule]
RULE-SET,https://raw.githubusercontent.com/proxyBug/zoom-rules/main/rule/Shadowrocket/ZoomFull.list,PROXY

Surge uses the same syntax; replace Shadowrocket in the URL with Surge. Place the rule before FINAL.

Quantumult X

[filter_remote]
https://raw.githubusercontent.com/proxyBug/zoom-rules/main/rule/QuantumultX/ZoomFull.list, tag=ZoomFull, force-policy=PROXY, update-interval=86400, opt-parser=false, enabled=true

Set force-policy to an existing node or policy group. It overrides the default policy label Zoom in the file.

sing-box

The source rule sets use format version 2 and require sing-box 1.10 or later. On current versions, merge the following into your existing route configuration:

{
  "route": {
    "rule_set": [
      {
        "type": "remote",
        "tag": "zoom-full",
        "format": "source",
        "url": "https://raw.githubusercontent.com/proxyBug/zoom-rules/main/rule/sing-box/ZoomFull.json",
        "update_interval": "24h"
      }
    ],
    "rules": [
      { "rule_set": "zoom-full", "outbound": "proxy" }
    ]
  }
}

If you need a binary rule set, use the official compilation command:

sing-box rule-set compile --output ZoomFull.srs rule/sing-box/ZoomFull.json

Rules by service

Each group is available in all six client formats. Use the same paths as in the subscription table and replace the filename.

Rule set	Contents
ZoomMeetings	Meetings / Webinars IPv4 and IPv6
ZoomPhone	The combined Phone lists and the TCP 443/5091/390 and UDP 3478/20000–64000 lists
ZoomContactCenter	Contact Center client destination IPs
ZoomVirtualAgent	Virtual Agent client destination IPs
ZoomCRC	Cloud Room Connector / Enhanced API Connector; combines the web tables and downloadable lists
ZoomCDN	Officially designated CDN IPs for recordings, installers, firmware, and related files
ZoomApps	Shared IPs from the Zoom Apps download lists; already included in ZoomFull
ZoomPSO	Official network assessment tool destination IPs
ZoomIP	All destination IPs from Zoom, without domain rules
ZoomDependencies	Shared web components, CAPTCHA, and certificate validation domains; already included in ZoomFull
ZoomOnPrem	zoomonprem.com; private enterprise deployments that require an appropriate LAN, VPN, or proxy policy

Service IP groups do not repeat the common sign-in domains. Combine them with ZoomDomains when subscribing to individual services. Contact Center also requires Meetings network access, so include ZoomMeetings when configuring it separately. Both are already included in Zoom and ZoomFull.

ZoomOnPrem is not included in Zoom / ZoomFull: these names may resolve to local enterprise servers. Choose DIRECT, an enterprise VPN, or a proxy according to your deployment. Zoom Rooms controller, local sharing, and device discovery ports are retained in the port inventory; they are not converted into broad rules that proxy all traffic using those ports.

IP, port, and source exports

• Standard IPv4 / IPv6 / domains
• Full IPv4 / IPv6 / domains
• Official firewall port tables, CSV: protocols, ports, sources, destinations, and source URLs.
• 22 original official download lists: original entries retained for comparison.
• Structured firewall facts from the web pages: supplements addresses missing from the downloadable lists.
• Source IPv4 addresses for outbound requests from Zoom servers: intended for customer server allowlists. These are not client proxy destinations and are excluded from proxy subscriptions.

For example, the CRC web page lists 192.204.12.0/22, while its download list uses /23. The rules include the union of both ranges and retain both sources. CIDRs are merged only when coverage is unchanged; individual cloud server IPs are never expanded into entire AWS, Azure, CloudFront, or ASN ranges.

Updates and maintenance

GitHub Actions checks the official sources daily at 03:23 UTC / 11:23 Beijing and Singapore time. When upstream content changes, the workflow downloads and validates it, generates all six formats, runs tests, and commits the results. Clients retrieve new files according to their own subscription refresh intervals. You can also manually run Update official Zoom sources in Actions.

Updates proceed only after every source has been retrieved successfully. Empty lists, invalid addresses, added or removed download lists, unrecognized table structures, or a drop of more than 25% in an individual list's entry count cause the update to fail, preserving the published version. Persistent upstream structural changes require a maintainer to update the parser. Domains primarily come from official documentation; additional domains and their evidence are recorded in sources/config.json.

Local maintenance requires only Python 3.10 or later and its standard library:

python scripts/update.py
python scripts/generate.py
python -m unittest discover -s tests -v
python scripts/generate.py --check

See the validation record for the initial release's actual core parsing and loading results.

A successful check with unchanged content does not create a new commit. GitHub may delay scheduled runs and may disable schedules in public repositories with prolonged inactivity; consult the Actions history for actual runs. See GitHub's schedule documentation.

Coverage and connectivity

• This project covers Zoom-related network destinations that can be confirmed from public documentation. Custom enterprise SSO, external calendars, customer-hosted servers, third-party Zoom Apps, and unpublished or changing addresses may require environment-specific additions. No static rule collection can guarantee that it will capture every Zoom connection indefinitely.
• Suffixes such as zoom.us and zoom.com already cover api, cdn, assets, zdmapi, and regional subdomains. There is no need to enumerate individual meeting links or HTTPS paths, or to enable HTTPS decryption.
• zoomgov.com is included as a confirmed government-service domain; commercial IP lists do not establish complete coverage of government media IPs. zoom.com.cn is a regional domain previously confirmed by Zoom staff and retained for regional and historical links; the evidence includes its original date.
• Routing rules determine the selected route. Actual connectivity also depends on TCP/UDP support, destination ports, IPv6, and the client's traffic capture mode. The client must capture UDP traffic, and the proxy node must allow the corresponding media ports.
• IP rules use no-resolve; sing-box follows its native behavior. These rules match existing destination IPs without forcing DNS lookups for every unmatched domain. An unlisted third-party hostname on a shared CDN may therefore not match solely because its IP appears in a list.

Sources and license

The main sources are Zoom network firewall settings, CRC firewall settings, and Zoom Rooms firewall settings. Client formats reference the official documentation for Loon, mihomo, Surge, Quantumult X, and sing-box.

The structure follows the same author's tigertrade-moomoo-rules. Original scripts and documentation are licensed under the MIT License. See NOTICE.md for attribution of upstream network facts and third-party marks. This project is not affiliated with Zoom.