ShellCrash icon indicating copy to clipboard operation
ShellCrash copied to clipboard

【建议】添加对 nftables 的支持

Open ohmykreee opened this issue 2 years ago • 4 comments

即将到来的 OpenWrt 22.03 将默认使用 nftables,替代原有的 iptables。( OpenWrt 22.03.0-rc1 - Release Notes

(虽然说现在可以通过手动安装 iptables-legacy iptables-mod-nat-extra ipset 包来临时添加回 iptables

(以及测试了一下当前版本的 ShellClash 配 iptables-nftip6tables-nft来“强制”添加对nftables的支持,会报以下错误:

iptables v1.8.7 (nf_tables): unknown option "--to"
Try 'iptables -h' or 'iptables --help' for more information.
iptables v1.8.7 (nf_tables): unknown option "--to"
Try 'iptables -h' or 'iptables --help' for more information.
ip6tables v1.8.7 (nf_tables): unknown option "--to"
Try 'ip6tables -h' or 'ip6tables --help' for more information.
ip6tables v1.8.7 (nf_tables): unknown option "--to"
Try 'ip6tables -h' or 'ip6tables --help' for more information.
iptables v1.8.7 (nf_tables): unknown option "--to-port"
Try 'iptables -h' or 'iptables --help' for more information.

ohmykreee avatar Apr 26 '22 14:04 ohmykreee

会在openwrt稳定版发布后适配

juewuy avatar Apr 29 '22 07:04 juewuy

现在已经发布了稳定版,但是shellclash似乎还没有适配支持 报错如下:

iptables v1.8.7 (nf_tables): unknown option "--to"
Try `iptables -h' or 'iptables --help' for more information.
iptables v1.8.7 (nf_tables): unknown option "--to-ports"
Try `iptables -h' or 'iptables --help' for more information.
iptables v1.8.7 (nf_tables): unknown option "--to-ports"
Try `iptables -h' or 'iptables --help' for more information.

我的Openwrt版本为OpenWrt 22.03.0, r19685-512e76967f

SnowWarri0r avatar Sep 11 '22 09:09 SnowWarri0r

现在已经发布了稳定版,但是shellclash似乎还没有适配支持 报错如下:

iptables v1.8.7 (nf_tables): unknown option "--to"
Try `iptables -h' or 'iptables --help' for more information.
iptables v1.8.7 (nf_tables): unknown option "--to-ports"
Try `iptables -h' or 'iptables --help' for more information.
iptables v1.8.7 (nf_tables): unknown option "--to-ports"
Try `iptables -h' or 'iptables --help' for more information.

我的Openwrt版本为OpenWrt 22.03.0, r19685-512e76967f

另外,在该版本下,让本机代理经过clash内核,如果设置为iptable增强模式会报如下错误

iptables v1.8.7 (nf_tables): Couldn't load match `owner':No such file or directory

Try `iptables -h' or 'iptables --help' for more information.
iptables v1.8.7 (nf_tables): Couldn't load match `owner':No such file or directory

Try `iptables -h' or 'iptables --help' for more information.

SnowWarri0r avatar Sep 25 '22 14:09 SnowWarri0r

@SnowWarri0r 面包会有的……

juewuy avatar Sep 25 '22 22:09 juewuy

公测版已支持 https://github.com/juewuy/ShellClash/commit/ca40f6bbba7bdfe80057994a9839dd74591b8791

juewuy avatar Dec 05 '22 11:12 juewuy

在 OpenWrt 22.03.0 中使用 1.6.13d 版本,在启动时发现防火墙错误提示。

shellclash 提示服务启动,面板中能看到代理和规则,但是概览、连接均无内容。

欢迎使用ShellClash!		版本:1.6.13d
Clash服务没有运行(Nft模式),未设置开机启动!
TG频道:https://t.me/ShellClash
-----------------------------------------------
 1 启动/重启clash服务
 2 clash功能设置
 3 停止clash服务
 4 clash启动设置
 5 设置定时任务
 6 导入配置文件
 7 clash进阶设置
 8 其他工具
 9 更新/卸载
-----------------------------------------------
 0 退出脚本
请输入对应数字 > 1
-----------------------------------------------
Error: Could not process rule: No such file or directory
add rule inet shellclash prerouting ip daddr {{0.0.0.0/8, 10.0.0.0/8, 127.0.0.0/8, 100.64.0.0/10, 169.254.0.0/16, 172.16.0.0/12, 192.168.0.0/16, 224.0.0.0/4, 240.0.0.0/4}} return
                         ^^^^^^^^^^
Error: Could not process rule: No such file or directory
add rule inet shellclash prerouting tcp dport != {22, 53, 123, 587, 465, 995, 993, 143, 80, 443, 8080} return
                         ^^^^^^^^^^
Error: Could not process rule: No such file or directory
add rule inet shellclash prerouting meta nfproto ipv6 return
                         ^^^^^^^^^^

clash服务已启动!
请使用 http://10.0.0.1:9999/ui 管理内置规则

yanglw avatar Dec 13 '22 09:12 yanglw

@yanglw nftables相关依赖不完整 firewall4 以及kmod-nft-tproxy

juewuy avatar Dec 13 '22 12:12 juewuy

公测版已支持 ca40f6b

这个问题貌似还存在

tianzhich avatar Feb 26 '23 09:02 tianzhich