可以。先把结论定下来：你说的“1.4”我按 sing-box 1.14 来做。刚刚重新核对官方发布页后，当前 v1.14.0 已经是正式 latest 版本，测试线已经进入 v1.15.0-alpha.1。(GitHub)

关于规则源，我没有简单按照 GitHub Star 最高就硬套：Loyalsoldier/geoip 大约 6.4k stars，而且确实原生提供 sing-box SRS，但它主要解决 GeoIP/IP 分流，不能完整替代你需要的 Apple、Google、Spotify、AI、广告等域名规则。(GitHub) DustinWin/ruleset_geodata 约 1.4k stars，明确同时针对 mihomo 和 sing-box，且它目前专门发布了适用于 sing-box v1.14 的 version 5 SRS，国内域名、国内 IP、广告、AI、YouTube、Spotify、GFW、Telegram IP 等都有，因此我把它作为主规则源。(GitHub)

你原来的 MetaCubeX 实际上也有 sing 分支和 .srs，只是你贴出来的是 meta 分支的 .mrs，那是 Mihomo 格式，不能直接原样塞进 sing-box。(GitHub)

DustinWin 没有把 kaspersky / tencent / icloud / apple / cloudflare / google / telegram / twitter / github 全部拆成与你原配置一模一样的独立规则，所以这些我使用 SagerNet 官方 sing-geosite 做补充。这样比为了“只用一个作者”而改变你原来的分流语义更稳。

最终配置

下面这一版是 Linux / OpenWrt 优先版。你唯一必须修改的是 proxy-node 那一段，因为你没有给我实际代理节点信息；我先放了一个 Hysteria2 示例占位。

json
{
  "log": {
    "level": "info",
    "timestamp": true
  },
  "dns": {
    "servers": [
      {
        "type": "local",
        "tag": "dns-local",
        "neighbor_domain": [
          ".",
          ".lan"
        ]
      },
      {
        "type": "https",
        "tag": "dns-cn",
        "server": "223.5.5.5",
        "server_port": 443,
        "path": "/dns-query",
        "tls": {
          "enabled": true,
          "server_name": "dns.alidns.com"
        }
      },
      {
        "type": "https",
        "tag": "dns-global",
        "server": "1.1.1.1",
        "server_port": 443,
        "path": "/dns-query",
        "tls": {
          "enabled": true,
          "server_name": "cloudflare-dns.com"
        },
        "detour": "PROXY"
      }
    ],
    "rules": [
      {
        "preferred_by": "dns-local",
        "action": "route",
        "server": "dns-local"
      },
      {
        "rule_set": "private",
        "action": "route",
        "server": "dns-local"
      },
      {
        "rule_set": "ads",
        "action": "reject"
      },
      {
        "domain_suffix": "959698.xyz",
        "action": "route",
        "server": "dns-cn"
      },
      {
        "domain": [
          "cdn.zhezhi.art",
          "test.ustc.edu.cn",
          "clash.razord.top",
          "yacd.haishan.me"
        ],
        "domain_suffix": [
          "cc.cd"
        ],
        "action": "route",
        "server": "dns-cn"
      },
      {
        "rule_set": [
          "kaspersky",
          "tencent",
          "icloud",
          "apple"
        ],
        "action": "route",
        "server": "dns-cn"
      },
      {
        "domain": [
          "emby101.origamiart.uk"
        ],
        "domain_suffix": [
          "1password.com",
          "nodeseek.com",
          "lightting.net",
          "online-fix.me",
          "linux.do",
          "v2ex.com"
        ],
        "action": "route",
        "server": "dns-global"
      },
      {
        "rule_set": [
          "spotify",
          "cloudflare",
          "google",
          "youtube",
          "telegram",
          "twitter",
          "ai",
          "github",
          "gfw",
          "proxy"
        ],
        "action": "route",
        "server": "dns-global"
      },
      {
        "rule_set": "cn",
        "action": "route",
        "server": "dns-cn"
      }
    ],
    "final": "dns-global",
    "strategy": "prefer_ipv4",
    "cache_capacity": 8192,
    "optimistic": {
      "enabled": true,
      "timeout": "24h"
    },
    "timeout": "5s"
  },
  "inbounds": [
    {
      "type": "tun",
      "tag": "tun-in",
      "interface_name": "singtun0",
      "address": [
        "172.19.0.1/30",
        "fdfe:dcba:9876::1/126"
      ],
      "mtu": 1500,
      "auto_route": true,
      "auto_redirect": true,
      "strict_route": true,
      "dns_mode": "hijack",
      "stack": "system"
    },
    {
      "type": "mixed",
      "tag": "mixed-in",
      "listen": "127.0.0.1",
      "listen_port": 7890
    }
  ],
  "outbounds": [
    {
      "type": "selector",
      "tag": "PROXY",
      "outbounds": [
        "proxy-node"
      ],
      "default": "proxy-node",
      "interrupt_exist_connections": true
    },
    {
      "type": "hysteria2",
      "tag": "proxy-node",
      "server": "proxy.example.com",
      "server_port": 443,
      "password": "CHANGE_ME",
      "tls": {
        "enabled": true,
        "server_name": "proxy.example.com"
      }
    },
    {
      "type": "direct",
      "tag": "DIRECT"
    }
  ],
  "route": {
    "rules": [
      {
        "action": "sniff"
      },
      {
        "rule_set": "kaspersky",
        "action": "route",
        "outbound": "DIRECT"
      },
      {
        "domain_suffix": "959698.xyz",
        "action": "route",
        "outbound": "DIRECT"
      },
      {
        "network": "udp",
        "port": 443,
        "action": "reject"
      },
      {
        "rule_set": "privateip",
        "action": "route",
        "outbound": "DIRECT"
      },
      {
        "ip_is_private": true,
        "action": "route",
        "outbound": "DIRECT"
      },
      {
        "rule_set": "private",
        "action": "route",
        "outbound": "DIRECT"
      },
      {
        "rule_set": "ads",
        "action": "reject"
      },
      {
        "domain": [
          "cdn.zhezhi.art",
          "test.ustc.edu.cn"
        ],
        "domain_suffix": [
          "cc.cd"
        ],
        "action": "route",
        "outbound": "DIRECT"
      },
      {
        "rule_set": "tencent",
        "action": "route",
        "outbound": "DIRECT"
      },
      {
        "domain": [
          "clash.razord.top",
          "yacd.haishan.me"
        ],
        "action": "route",
        "outbound": "DIRECT"
      },
      {
        "rule_set": [
          "icloud",
          "apple"
        ],
        "action": "route",
        "outbound": "DIRECT"
      },
      {
        "domain": [
          "emby101.origamiart.uk"
        ],
        "domain_suffix": [
          "1password.com",
          "nodeseek.com",
          "lightting.net",
          "online-fix.me",
          "linux.do",
          "v2ex.com"
        ],
        "action": "route",
        "outbound": "PROXY"
      },
      {
        "rule_set": [
          "spotify",
          "cloudflare",
          "google",
          "youtube",
          "telegram",
          "telegramip",
          "twitter",
          "ai",
          "github",
          "gfw"
        ],
        "action": "route",
        "outbound": "PROXY"
      },
      {
        "rule_set": "cn",
        "action": "route",
        "outbound": "DIRECT"
      },
      {
        "rule_set": "cnip",
        "action": "route",
        "outbound": "DIRECT"
      }
    ],
    "rule_set": [
      {
        "type": "remote",
        "tag": [
          "private",
          "ads",
          "spotify",
          "youtube",
          "ai",
          "gfw",
          "proxy",
          "cn",
          "privateip",
          "cnip",
          "telegramip"
        ],
        "format": "binary",
        "url": "https://github.com/DustinWin/ruleset_geodata/releases/download/sing-box-ruleset/{tag}.srs",
        "update_interval": "1d",
        "http_client": {
          "detour": "PROXY"
        }
      },
      {
        "type": "remote",
        "tag": [
          "kaspersky",
          "tencent",
          "icloud",
          "apple",
          "cloudflare",
          "google",
          "telegram",
          "twitter",
          "github"
        ],
        "format": "binary",
        "url": "https://raw.githubusercontent.com/SagerNet/sing-geosite/rule-set/geosite-{tag}.srs",
        "update_interval": "1d",
        "http_client": {
          "detour": "PROXY"
        }
      }
    ],
    "final": "PROXY",
    "auto_detect_interface": true,
    "default_domain_resolver": "dns-cn"
  },
  "experimental": {
    "cache_file": {
      "enabled": true,
      "path": "cache.db",
      "store_dns": true
    },
    "clash_api": {
      "external_controller": "127.0.0.1:9090",
      "access_control_allow_origin": [
        "https://clash.razord.top",
        "https://yacd.haishan.me"
      ],
      "access_control_allow_private_network": true,
      "default_mode": "Rule"
    }
  }
}

我也给你保存成了 JSON 文件：

下载 sing-box 1.14 完整配置

这份配置为什么这样处理

1. 国内 DNS 和国外 DNS 是真正分开的。 dns-cn 使用 AliDNS DoH，并且直接连接；dns-global 使用 Cloudflare DoH，而且自身明确 detour: "PROXY"，也就是说 Google、YouTube、OpenAI、GitHub、GFW、你的自定义代理域名等，不仅网页流量走代理，DNS 查询本身也经过代理，避免“流量代理了、DNS 却在国内裸查”的问题。sing-box 1.14 已经删除旧式 address: "https://..." DNS server 写法，所以这里全部采用新的结构化 type: "https"。(Sing Box)

2. TUN 使用 1.14 新的 DNS 劫持机制。 dns_mode: "hijack" 会设置接口 DNS 并处理 53 端口；这里故意没有设置 dns_address，这样 sing-box 会根据 TUN 地址自动派生 DNS 地址，并自动把它劫持进自身 DNS 模块，所以不需要再写老教程里那种单独 hijack-dns 规则。auto_detect_interface 用于避免 TUN 自己把自己的出站再次套进去。Linux/OpenWrt 下官方明确推荐 auto_redirect。(Sing Box)

3. 你原来的 QUIC 规则完整保留了顺序语义。 Kaspersky 和 959698.xyz 在 UDP/443 拦截之前，所以它们如果使用 UDP/443 依然可以直连；其余普通 UDP/443 会 reject。之后才处理私网、广告、自定义 DIRECT、Apple 和代理规则。这与原来的 Clash 顺序基本一致。sing-box 不需要 Clash 的 no-resolve 修饰词，privateip、cnip 本身就是 IP CIDR rule-set。

4. 规则下载也走代理。 1.14 已经不推荐旧的 download_detour，新方式是 rule-set 的 http_client。因此我给两个远程规则源都写了 "http_client":{"detour":"PROXY"}。这样 GitHub/raw GitHub 在大陆环境下不会因为下载规则本身被阻断而启动失败。(Sing Box) 同时利用了 1.14 新增的“一个 rule-set 定义多个 tag + {tag} URL 占位符”，所以不用把二十几个 rule-set 对象重复写一遍。(Sing Box)

5. DNS 缓存用了 1.14 的新能力。 optimistic 可以在缓存刚过期时先返回旧结果并后台更新，store_dns: true 则会把 DNS cache 持久化到 cache.db。这两个都是 1.14 的新功能。(Sing Box) PROXY 做成 selector，因此以后你有香港、日本、新加坡、美国多个节点，可以全部加入这个组，并通过 Clash API 面板切换；官方文档目前也说明 selector 主要由 Clash API 控制。(Sing Box)

还有两个使用时非常重要的地方。第一，这个版本默认是 Linux/OpenWrt：如果你实际跑在 Windows 或 macOS，把 TUN 里的 "auto_redirect": true 删除即可，auto_route + strict_route + dns_mode:hijack 保留；auto_redirect 是 Linux 专用，而 Windows 下 strict_route 反而有助于避免多宿主 DNS 泄漏。(Sing Box) 第二，你必须把：

json
{
  "type": "hysteria2",
  "tag": "proxy-node",
  "server": "proxy.example.com",
  "server_port": 443,
  "password": "CHANGE_ME",
  "tls": {
    "enabled": true,
    "server_name": "proxy.example.com"
  }
}

替换成你自己的实际节点。你如果使用的是 VLESS-Reality、Hysteria2、TUIC、Shadowsocks、Trojan 或订阅里的一组节点，这一块的结构会不同；规则、DNS、TUN 部分不需要重新设计。Hysteria2 这里的字段本身符合当前 1.14 文档。(Sing Box)

替换节点之后，建议先执行：

bash
sing-box check -c config.json

确认无误再启动。官方也提供 sing-box check 用来检查配置。(Sing Box)

如果你告诉我你实际是在 OpenWrt、Windows、Linux 服务器、macOS 还是 Android 上运行，以及把你的节点/订阅格式贴出来，我可以在这份基础上把 proxy-node 部分也直接改成最终可启动版，并顺便给你做好 自动测速/香港-日本-新加坡-美国分组/AI 单独选节点。