FINDING · DEFENSE

Rule-based proxy tools (Clash, Shadowsocks, V2Ray) are documented as the most reliable solution for accessing GitHub from China, with split-tunneling rules routing only GitHub traffic through the proxy while keeping domestic traffic on the direct path. Git command-line tools require explicit proxy configuration (git config --global http.proxy http://127.0.0.1:7890) to route clone/push operations, as they do not inherit system proxy settings automatically.

From 2026-anon-github-2026-6-dns — GitHub无法访问？2026年最新6种解决方法（含DNS修改与加速工具） | 二毛 · §方法二 · 2026 · ermao.net (Chinese-language circumvention blog)

Implications

Circumvention clients should expose a local HTTP CONNECT proxy (e.g., on port 7890) and document git proxy configuration explicitly, since developers are a high-value user segment whose primary use case (git operations) bypasses the system proxy by default.
Domain-based split-tunneling rules for GitHub must resolve domain names through the proxy's DNS, not the system resolver, to prevent the poisoned system DNS from defeating rule matching before traffic reaches the proxy.