OpenClash
OpenClash copied to clipboard
Published
20 hours ago •
vernesong
vernesong
开启openclash后腾讯会议说话断断续续，听别人正常，玩lol手游延迟升高并有丢包现象
面板查看规则应该都是直连的。但是腾讯系的视频通话或者视频会议自己讲话别人反应会断断续续，但是听别人说是没问题的。另外就是最近玩lol手游，发现开启openclash会比不开提高30ms左右延迟，并且会有丢包延迟突然变红的情况。重启openclash会有一定改善，但是过几个小时又会这样。关闭openclash延迟就会降低，且不会丢包。看连接情况应该都是直连状态。 `OpenClash 调试日志
生成时间: 2022-05-07 08:17:37 插件版本: v0.45.06-beta 隐私提示: 上传此日志前请注意检查、屏蔽公网IP、节点、密码等相关敏感信息
#===================== 系统信息 =====================#
主机型号: Phicomm N1
固件版本: OpenWrt SNAPSHOT r3228-7883a5d2e
LuCI版本: git-21.114.56541-974fb04-1
内核版本: 5.4.125-flippy-60+o
处理器架构: aarch64_cortex-a53
#此项有值时,如不使用IPv6,建议到网络-接口-lan的设置中禁用IPV6的DHCP
IPV6-DHCP:
#此项结果应仅有配置文件的DNS监听地址
Dnsmasq转发设置: 127.0.0.1#7874
#===================== 依赖检查 =====================#
dnsmasq-full: 已安装
coreutils: 已安装
coreutils-nohup: 已安装
bash: 已安装
curl: 已安装
ca-certificates: 已安装
ipset: 已安装
ip-full: 已安装
iptables-mod-tproxy: 已安装
kmod-ipt-tproxy: 已安装
iptables-mod-extra: 已安装
kmod-ipt-extra: 已安装
libcap: 已安装
libcap-bin: 已安装
ruby: 已安装
ruby-yaml: 已安装
ruby-psych: 已安装
ruby-pstore: 已安装
ruby-dbm: 已安装
kmod-tun(TUN模式): 已安装
luci-compat(Luci-19.07): 已安装
kmod-inet-diag(PROCESS-NAME): 未安装
#===================== 内核检查 =====================#
运行状态: 运行中
进程pid: 11188
运行权限: 11188: = cap_dac_override,cap_net_bind_service,cap_net_admin,cap_net_raw,cap_sys_ptrace,cap_sys_resource+eip
运行用户: nobody
已选择的架构: linux-armv8
#下方无法显示内核版本号时请确认您的内核版本是否正确或者有无权限
Tun内核版本: 2022.04.11
Tun内核文件: 存在
Tun内核运行权限: 正常
Dev内核版本: v1.9.0-7-gb1a639f
Dev内核文件: 存在
Dev内核运行权限: 正常
Meta内核版本:
Meta内核文件: 不存在
Meta内核运行权限: 否
#===================== 插件设置 =====================#
当前配置文件: /etc/openclash/config/config.yaml
启动配置文件: /etc/openclash/config.yaml
运行模式: fake-ip-mix
默认代理模式: rule
UDP流量转发(tproxy): 停用
DNS劫持: 启用
自定义DNS: 启用
IPV6代理: 停用
IPV6-DNS解析: 停用
禁用Dnsmasq缓存: 启用
自定义规则: 启用
仅允许内网: 启用
仅代理命中规则流量: 启用
仅允许常用端口流量: 停用
绕过中国大陆IP: 停用
DNS远程解析: 停用
路由本机代理: 停用
#启动异常时建议关闭此项后重试
混合节点: 启用
保留配置: 停用
#启动异常时建议关闭此项后重试
第三方规则: 启用
#===================== 自定义规则 一 =====================#
##- DOMAIN-SUFFIX,google.com,Proxy 匹配域名后缀(交由Proxy代理服务器组)
##- DOMAIN-KEYWORD,google,Proxy 匹配域名关键字(交由Proxy代理服务器组)
##- DOMAIN,google.com,Proxy 匹配域名(交由Proxy代理服务器组)
##- DOMAIN-SUFFIX,ad.com,REJECT 匹配域名后缀(拒绝)
##- IP-CIDR,127.0.0.0/8,DIRECT 匹配数据目标IP(直连)
##- SRC-IP-CIDR,192.168.1.201/32,DIRECT 匹配数据发起IP(直连)
##- DST-PORT,80,DIRECT 匹配数据目标端口(直连)
##- SRC-PORT,7777,DIRECT 匹配数据源端口(直连)
##排序在上的规则优先生效,如添加（去除规则前的#号）：
##IP段：192.168.1.2-192.168.1.200 直连
##- SRC-IP-CIDR,192.168.1.2/31,DIRECT
##- SRC-IP-CIDR,192.168.1.4/30,DIRECT
##- SRC-IP-CIDR,192.168.1.8/29,DIRECT
##- SRC-IP-CIDR,192.168.1.16/28,DIRECT
##- SRC-IP-CIDR,192.168.1.32/27,DIRECT
##- SRC-IP-CIDR,192.168.1.64/26,DIRECT
##- SRC-IP-CIDR,192.168.1.128/26,DIRECT
##- SRC-IP-CIDR,192.168.1.192/29,DIRECT
##- SRC-IP-CIDR,192.168.1.200/32,DIRECT
##IP段：192.168.1.202-192.168.1.255 直连
##- SRC-IP-CIDR,192.168.1.202/31,DIRECT
##- SRC-IP-CIDR,192.168.1.204/30,DIRECT
##- SRC-IP-CIDR,192.168.1.208/28,DIRECT
##- SRC-IP-CIDR,192.168.1.224/27,DIRECT
##此时IP为192.168.1.1和192.168.1.201的客户端流量走代理（策略），其余客户端不走代理
##因为Fake-IP模式下，IP地址为192.168.1.1的路由器自身流量可走代理（策略），所以需要排除
##仅设置路由器自身直连：
##- SRC-IP-CIDR,192.168.1.1/32,DIRECT
- SRC-IP-CIDR,198.18.0.1/32,DIRECT
##DDNS
##- DOMAIN-SUFFIX,checkip.dyndns.org,DIRECT
##- DOMAIN-SUFFIX,checkipv6.dyndns.org,DIRECT
##- DOMAIN-SUFFIX,checkip.synology.com,DIRECT
##- DOMAIN-SUFFIX,ifconfig.co,DIRECT
##- DOMAIN-SUFFIX,api.myip.com,DIRECT
##- DOMAIN-SUFFIX,ip-api.com,DIRECT
##- DOMAIN-SUFFIX,ipapi.co,DIRECT
##- DOMAIN-SUFFIX,ip6.seeip.org,DIRECT
##- DOMAIN-SUFFIX,members.3322.org,DIRECT
##在线IP段转CIDR地址：http://ip2cidr.com
#===================== 自定义规则 二 =====================#
##- DOMAIN-SUFFIX,google.com,Proxy 匹配域名后缀(交由Proxy代理服务器组)
##- DOMAIN-KEYWORD,google,Proxy 匹配域名关键字(交由Proxy代理服务器组)
##- DOMAIN,google.com,Proxy 匹配域名(交由Proxy代理服务器组)
##- DOMAIN-SUFFIX,ad.com,REJECT 匹配域名后缀(拒绝)
##- IP-CIDR,127.0.0.0/8,DIRECT 匹配数据目标IP(直连)
##- SRC-IP-CIDR,192.168.1.201/32,DIRECT 匹配数据发起IP(直连)
##- DST-PORT,80,DIRECT 匹配数据目标端口(直连)
##- SRC-PORT,7777,DIRECT 匹配数据源端口(直连)
- DOMAIN-SUFFIX,hanime.tv,Proxy
#===================== 配置文件 =====================#
proxy-groups:
rules:
- DST-PORT,7895,REJECT
- DST-PORT,7892,REJECT
- IP-CIDR,198.18.0.1/16,REJECT,no-resolve
- RULE-SET,Apple News(By lhie1),Proxy
- RULE-SET,Apple TV(By lhie1),Proxy
- SRC-IP-CIDR,192.168.50.2/32,DIRECT
- DOMAIN-SUFFIX,awesome-hd.me,DIRECT
- DOMAIN-SUFFIX,broadcasthe.net,DIRECT
- DOMAIN-SUFFIX,chdbits.co,DIRECT
- DOMAIN-SUFFIX,classix-unlimited.co.uk,DIRECT
- DOMAIN-SUFFIX,empornium.me,DIRECT
- DOMAIN-SUFFIX,gazellegames.net,DIRECT
- DOMAIN-SUFFIX,hdchina.org,DIRECT
- DOMAIN-SUFFIX,hdsky.me,DIRECT
- DOMAIN-SUFFIX,icetorrent.org,DIRECT
- DOMAIN-SUFFIX,jpopsuki.eu,DIRECT
- DOMAIN-SUFFIX,keepfrds.com,DIRECT
- DOMAIN-SUFFIX,madsrevolution.net,DIRECT
- DOMAIN-SUFFIX,m-team.cc,DIRECT
- DOMAIN-SUFFIX,nanyangpt.com,DIRECT
- DOMAIN-SUFFIX,ncore.cc,DIRECT
- DOMAIN-SUFFIX,open.cd,DIRECT
- DOMAIN-SUFFIX,ourbits.club,DIRECT
- DOMAIN-SUFFIX,passthepopcorn.me,DIRECT
- DOMAIN-SUFFIX,privatehd.to,DIRECT
- DOMAIN-SUFFIX,redacted.ch,DIRECT
- DOMAIN-SUFFIX,springsunday.net,DIRECT
- DOMAIN-SUFFIX,tjupt.org,DIRECT
- DOMAIN-SUFFIX,totheglory.im,DIRECT
- DOMAIN-KEYWORD,announce,DIRECT
- DOMAIN-KEYWORD,torrent,DIRECT
- DOMAIN-KEYWORD,tracker,DIRECT
- PROCESS-NAME,aria2c,DIRECT
- PROCESS-NAME,BitComet,DIRECT
- PROCESS-NAME,fdm,DIRECT
- PROCESS-NAME,NetTransport,DIRECT
- PROCESS-NAME,qbittorrent,DIRECT
- PROCESS-NAME,Thunder,DIRECT
- PROCESS-NAME,transmission-daemon,DIRECT
- PROCESS-NAME,transmission-qt,DIRECT
- PROCESS-NAME,uTorrent,DIRECT
- PROCESS-NAME,WebTorrent,DIRECT
- PROCESS-NAME,Folx,DIRECT
- PROCESS-NAME,Transmission,DIRECT
- PROCESS-NAME,transmission,DIRECT
- PROCESS-NAME,WebTorrent Helper,DIRECT
- PROCESS-NAME,v2ray,DIRECT
- PROCESS-NAME,ss-local,DIRECT
- PROCESS-NAME,ssr-local,DIRECT
- PROCESS-NAME,ss-redir,DIRECT
- PROCESS-NAME,ssr-redir,DIRECT
- PROCESS-NAME,ss-server,DIRECT
- PROCESS-NAME,trojan-go,DIRECT
- PROCESS-NAME,xray,DIRECT
- PROCESS-NAME,hysteria,DIRECT
- PROCESS-NAME,UUBooster,DIRECT
- PROCESS-NAME,uugamebooster,DIRECT
- DOMAIN-SUFFIX,smtp,DIRECT
- SRC-IP-CIDR,198.18.0.1/32,DIRECT
- RULE-SET,Reject,AdBlock
- RULE-SET,Special,DIRECT
- RULE-SET,Netflix,Netflix
- RULE-SET,Spotify,Spotify
- RULE-SET,YouTube,Youtube
- RULE-SET,Disney Plus,Disney
- RULE-SET,Bilibili,Bilibili
- RULE-SET,IQ,Asian TV
- RULE-SET,IQIYI,Asian TV
- RULE-SET,Letv,Asian TV
- RULE-SET,Netease Music,Asian TV
- RULE-SET,Tencent Video,Asian TV
- RULE-SET,Youku,Asian TV
- RULE-SET,WeTV,Asian TV
- RULE-SET,ABC,Global TV
- RULE-SET,Abema TV,Global TV
- RULE-SET,Amazon,Global TV
- RULE-SET,Apple News,Global TV
- RULE-SET,Apple TV,Global TV
- RULE-SET,Bahamut,Bahamut
- RULE-SET,BBC iPlayer,Global TV
- RULE-SET,DAZN,DAZN
- RULE-SET,Discovery Plus,Discovery Plus
- RULE-SET,encoreTVB,Global TV
- RULE-SET,Fox Now,Global TV
- RULE-SET,Fox+,Global TV
- RULE-SET,HBO Go,HBO Go
- RULE-SET,HBO Max,HBO Max
- RULE-SET,Hulu Japan,Global TV
- RULE-SET,Hulu,Global TV
- RULE-SET,Japonx,Global TV
- RULE-SET,JOOX,Global TV
- RULE-SET,KKBOX,Global TV
- RULE-SET,KKTV,Global TV
- RULE-SET,Line TV,Global TV
- RULE-SET,myTV SUPER,Global TV
- RULE-SET,Pandora,Global TV
- RULE-SET,PBS,Global TV
- RULE-SET,Pornhub,Pornhub
- RULE-SET,Soundcloud,Global TV
- RULE-SET,ViuTV,Global TV
- RULE-SET,Telegram,Telegram
- RULE-SET,Steam,Steam
- RULE-SET,Speedtest,Speedtest
- RULE-SET,PayPal,PayPal
- RULE-SET,Microsoft,Microsoft
- RULE-SET,Apple,Apple
- RULE-SET,Google FCM,Google FCM
- RULE-SET,Scholar,Scholar
- RULE-SET,PROXY,Proxy
- RULE-SET,Domestic,Domestic
- RULE-SET,Domestic IPs,Domestic
- RULE-SET,LAN,DIRECT
- DOMAIN-SUFFIX,hanime.tv,Proxy
- RULE-SET,Steam-社区(Beta),Others
- GEOIP,CN,Domestic
- DST-PORT,80,Others
- DST-PORT,443,Others
- DST-PORT,22,Others
- MATCH,DIRECT
dns:
nameserver:
- 127.0.0.1:1053
- tcp://127.0.0.1:1053
- tls://127.0.0.1:1053
- https://127.0.0.1:1053
enable: true
ipv6: false
enhanced-mode: fake-ip
fake-ip-range: 198.18.0.1/16
listen: 0.0.0.0:7874
fake-ip-filter:
- "*.lan"
- time.windows.com
- time.nist.gov
- time.apple.com
- time.asia.apple.com
- "*.ntp.org.cn"
- "*.openwrt.pool.ntp.org"
- time1.cloud.tencent.com
- time.ustc.edu.cn
- pool.ntp.org
- ntp.ubuntu.com
- ntp.aliyun.com
- ntp1.aliyun.com
- ntp2.aliyun.com
- ntp3.aliyun.com
- ntp4.aliyun.com
- ntp5.aliyun.com
- ntp6.aliyun.com
- ntp7.aliyun.com
- time1.aliyun.com
- time2.aliyun.com
- time3.aliyun.com
- time4.aliyun.com
- time5.aliyun.com
- time6.aliyun.com
- time7.aliyun.com
- "*.time.edu.cn"
- time1.apple.com
- time2.apple.com
- time3.apple.com
- time4.apple.com
- time5.apple.com
- time6.apple.com
- time7.apple.com
- time1.google.com
- time2.google.com
- time3.google.com
- time4.google.com
- music.163.com
- "*.music.163.com"
- "*.126.net"
- musicapi.taihe.com
- music.taihe.com
- songsearch.kugou.com
- trackercdn.kugou.com
- "*.kuwo.cn"
- api-jooxtt.sanook.com
- api.joox.com
- joox.com
- y.qq.com
- "*.y.qq.com"
- streamoc.music.tc.qq.com
- mobileoc.music.tc.qq.com
- isure.stream.qqmusic.qq.com
- dl.stream.qqmusic.qq.com
- aqqmusic.tc.qq.com
- amobile.music.tc.qq.com
- "*.xiami.com"
- "*.music.migu.cn"
- music.migu.cn
- "*.msftconnecttest.com"
- "*.msftncsi.com"
- localhost.ptlogin2.qq.com
- "+.srv.nintendo.net"
- "+.stun.playstation.net"
- xbox.*.microsoft.com
- "+.xboxlive.com"
- proxy.golang.org
- stun.*.*
- stun.*.*.*
- heartbeat.belkin.com
- "*.linksys.com"
- "*.linksyssmartwifi.com"
- "+.battlenet.com.cn"
- "+.jd.com"
- "+.xiaomi.com"
- "+.nflxvideo.net"
- "+.media.dssott.com"
default-nameserver:
- 127.0.0.1:1053
redir-port: 7892
tproxy-port: 7895
port: 7890
socks-port: 7891
mixed-port: 7893
mode: rule
log-level: silent
allow-lan: true
external-controller: 0.0.0.0:9090
bind-address: "*"
external-ui: "/usr/share/openclash/dashboard"
ipv6: false
tun:
enable: true
stack: gvisor
auto-route: false
auto-detect-interface: false
dns-hijack:
- tcp://8.8.8.8:53
- tcp://8.8.4.4:53
profile:
store-selected: true
store-fake-ip: true
rule-providers:
Reject:
type: http
behavior: classical
url: https://dler.cloud/Rules/Clash/Provider/Reject.yaml
path: "./rule_provider/Reject"
interval: 86400
Special:
type: http
behavior: classical
url: https://dler.cloud/Rules/Clash/Provider/Special.yaml
path: "./rule_provider/Special"
interval: 86400
Netflix:
type: http
behavior: classical
url: https://dler.cloud/Rules/Clash/Provider/Media/Netflix.yaml
path: "./rule_provider/Netflix"
interval: 86400
Spotify:
type: http
behavior: classical
url: https://dler.cloud/Rules/Clash/Provider/Media/Spotify.yaml
path: "./rule_provider/Spotify"
interval: 86400
YouTube:
type: http
behavior: classical
url: https://dler.cloud/Rules/Clash/Provider/Media/YouTube.yaml
path: "./rule_provider/YouTube"
interval: 86400
Bilibili:
type: http
behavior: classical
url: https://dler.cloud/Rules/Clash/Provider/Media/Bilibili.yaml
path: "./rule_provider/Bilibili"
interval: 86400
IQ:
type: http
behavior: classical
url: https://dler.cloud/Rules/Clash/Provider/Media/IQ.yaml
path: "./rule_provider/IQI"
interval: 86400
IQIYI:
type: http
behavior: classical
url: https://dler.cloud/Rules/Clash/Provider/Media/IQIYI.yaml
path: "./rule_provider/IQYI"
interval: 86400
Letv:
type: http
behavior: classical
url: https://dler.cloud/Rules/Clash/Provider/Media/Letv.yaml
path: "./rule_provider/Letv"
interval: 86400
Netease Music:
type: http
behavior: classical
url: https://dler.cloud/Rules/Clash/Provider/Media/Netease%20Music.yaml
path: "./rule_provider/Netease_Music"
interval: 86400
Tencent Video:
type: http
behavior: classical
url: https://dler.cloud/Rules/Clash/Provider/Media/Tencent%20Video.yaml
path: "./rule_provider/Tencent_Video"
interval: 86400
Youku:
type: http
behavior: classical
url: https://dler.cloud/Rules/Clash/Provider/Media/Youku.yaml
path: "./rule_provider/Youku"
interval: 86400
WeTV:
type: http
behavior: classical
url: https://dler.cloud/Rules/Clash/Provider/Media/WeTV.yaml
path: "./rule_provider/WeTV"
interval: 86400
ABC:
type: http
behavior: classical
url: https://dler.cloud/Rules/Clash/Provider/Media/ABC.yaml
path: "./rule_provider/ABC"
interval: 86400
Abema TV:
type: http
behavior: classical
url: https://dler.cloud/Rules/Clash/Provider/Media/Abema%20TV.yaml
path: "./rule_provider/Abema_TV"
interval: 86400
Amazon:
type: http
behavior: classical
url: https://dler.cloud/Rules/Clash/Provider/Media/Amazon.yaml
path: "./rule_provider/Amazon"
interval: 86400
Apple News:
type: http
behavior: classical
url: https://dler.cloud/Rules/Clash/Provider/Media/Apple%20News.yaml
path: "./rule_provider/Apple_News"
interval: 86400
Apple TV:
type: http
behavior: classical
url: https://dler.cloud/Rules/Clash/Provider/Media/Apple%20TV.yaml
path: "./rule_provider/Apple_TV"
interval: 86400
Bahamut:
type: http
behavior: classical
url: https://dler.cloud/Rules/Clash/Provider/Media/Bahamut.yaml
path: "./rule_provider/Bahamut"
interval: 86400
BBC iPlayer:
type: http
behavior: classical
url: https://dler.cloud/Rules/Clash/Provider/Media/BBC%20iPlayer.yaml
path: "./rule_provider/BBC_iPlayer"
interval: 86400
DAZN:
type: http
behavior: classical
url: https://dler.cloud/Rules/Clash/Provider/Media/DAZN.yaml
path: "./rule_provider/DAZN"
interval: 86400
Discovery Plus:
type: http
behavior: classical
url: https://dler.cloud/Rules/Clash/Provider/Media/Discovery%20Plus.yaml
path: "./rule_provider/Discovery_Plus"
interval: 86400
Disney Plus:
type: http
behavior: classical
url: https://dler.cloud/Rules/Clash/Provider/Media/Disney%20Plus.yaml
path: "./rule_provider/Disney_Plus"
interval: 86400
encoreTVB:
type: http
behavior: classical
url: https://dler.cloud/Rules/Clash/Provider/Media/encoreTVB.yaml
path: "./rule_provider/encoreTVB"
interval: 86400
Fox Now:
type: http
behavior: classical
url: https://dler.cloud/Rules/Clash/Provider/Media/Fox%20Now.yaml
path: "./rule_provider/Fox_Now"
interval: 86400
Fox+:
type: http
behavior: classical
url: https://dler.cloud/Rules/Clash/Provider/Media/Fox%2B.yaml
path: "./rule_provider/Fox+"
interval: 86400
HBO Go:
type: http
behavior: classical
url: https://dler.cloud/Rules/Clash/Provider/Media/HBO%20Go.yaml
path: "./rule_provider/HBO_Go"
interval: 86400
HBO Max:
type: http
behavior: classical
url: https://dler.cloud/Rules/Clash/Provider/Media/HBO%20Max.yaml
path: "./rule_provider/HBO_Max"
interval: 86400
Hulu Japan:
type: http
behavior: classical
url: https://dler.cloud/Rules/Clash/Provider/Media/Hulu%20Japan.yaml
path: "./rule_provider/Hulu_Japan"
interval: 86400
Hulu:
type: http
behavior: classical
url: https://dler.cloud/Rules/Clash/Provider/Media/Hulu.yaml
path: "./rule_provider/Hulu"
interval: 86400
Japonx:
type: http
behavior: classical
url: https://dler.cloud/Rules/Clash/Provider/Media/Japonx.yaml
path: "./rule_provider/Japonx"
interval: 86400
JOOX:
type: http
behavior: classical
url: https://dler.cloud/Rules/Clash/Provider/Media/JOOX.yaml
path: "./rule_provider/JOOX"
interval: 86400
KKBOX:
type: http
behavior: classical
url: https://dler.cloud/Rules/Clash/Provider/Media/KKBOX.yaml
path: "./rule_provider/KKBOX"
interval: 86400
KKTV:
type: http
behavior: classical
url: https://dler.cloud/Rules/Clash/Provider/Media/KKTV.yaml
path: "./rule_provider/KKTV"
interval: 86400
Line TV:
type: http
behavior: classical
url: https://dler.cloud/Rules/Clash/Provider/Media/Line%20TV.yaml
path: "./rule_provider/Line_TV"
interval: 86400
myTV SUPER:
type: http
behavior: classical
url: https://dler.cloud/Rules/Clash/Provider/Media/myTV%20SUPER.yaml
path: "./rule_provider/myTV_SUPER"
interval: 86400
Pandora:
type: http
behavior: classical
url: https://dler.cloud/Rules/Clash/Provider/Media/Pandora.yaml
path: "./rule_provider/Pandora"
interval: 86400
PBS:
type: http
behavior: classical
url: https://dler.cloud/Rules/Clash/Provider/Media/PBS.yaml
path: "./rule_provider/PBS"
interval: 86400
Pornhub:
type: http
behavior: classical
url: https://dler.cloud/Rules/Clash/Provider/Media/Pornhub.yaml
path: "./rule_provider/Pornhub"
interval: 86400
Soundcloud:
type: http
behavior: classical
url: https://dler.cloud/Rules/Clash/Provider/Media/Soundcloud.yaml
path: "./rule_provider/Soundcloud"
interval: 86400
ViuTV:
type: http
behavior: classical
url: https://dler.cloud/Rules/Clash/Provider/Media/ViuTV.yaml
path: "./rule_provider/ViuTV"
interval: 86400
Telegram:
type: http
behavior: classical
url: https://dler.cloud/Rules/Clash/Provider/Telegram.yaml
path: "./rule_provider/Telegram"
interval: 86400
Steam:
type: http
behavior: classical
url: https://dler.cloud/Rules/Clash/Provider/Steam.yaml
path: "./rule_provider/Steam"
interval: 86400
Speedtest:
type: http
behavior: classical
url: https://dler.cloud/Rules/Clash/Provider/Speedtest.yaml
path: "./rule_provider/Speedtest"
interval: 86400
PayPal:
type: http
behavior: classical
url: https://dler.cloud/Rules/Clash/Provider/PayPal.yaml
path: "./rule_provider/PayPal"
interval: 86400
Microsoft:
type: http
behavior: classical
url: https://dler.cloud/Rules/Clash/Provider/Microsoft.yaml
path: "./rule_provider/Microsoft"
interval: 86400
PROXY:
type: http
behavior: classical
url: https://dler.cloud/Rules/Clash/Provider/Proxy.yaml
path: "./rule_provider/Proxy"
interval: 86400
Domestic:
type: http
behavior: classical
url: https://dler.cloud/Rules/Clash/Provider/Domestic.yaml
path: "./rule_provider/Domestic"
interval: 86400
Apple:
type: http
behavior: classical
url: https://dler.cloud/Rules/Clash/Provider/Apple.yaml
path: "./rule_provider/Apple"
interval: 86400
Google FCM:
type: http
behavior: classical
url: https://dler.cloud/Rules/Clash/Provider/Google%20FCM.yaml
path: "./rule_provider/Google FCM"
interval: 86400
Scholar:
type: http
behavior: classical
url: https://dler.cloud/Rules/Clash/Provider/Scholar.yaml
path: "./rule_provider/Scholar"
interval: 86400
Domestic IPs:
type: http
behavior: ipcidr
url: https://dler.cloud/Rules/Clash/Provider/Domestic%20IPs.yaml
path: "./rule_provider/Domestic_IPs"
interval: 86400
LAN:
type: http
behavior: classical
url: https://dler.cloud/Rules/Clash/Provider/LAN.yaml
path: "./rule_provider/LAN"
interval: 86400
Apple News(By lhie1):
type: http
behavior: classical
path: "/etc/openclash/rule_provider/Apple News.yaml"
url: https://raw.githubusercontent.com/dler-io/Rules/master/Clash/Provider/Media/Apple%20News.yaml
interval: 86400
Apple TV(By lhie1):
type: http
behavior: classical
path: "/etc/openclash/rule_provider/Apple TV.yaml"
url: https://raw.githubusercontent.com/dler-io/Rules/master/Clash/Provider/Media/Apple%20TV.yaml
interval: 86400
Steam-社区(Beta):
type: file
behavior: ipcidr
path: "./game_rules/Steam.rules"
script:
code: |
def main(ctx, metadata):
ruleset_action = {"Reject": "AdBlock",
"Special": "DIRECT",
"Netflix": "Netflix",
"Spotify": "Spotify",
"YouTube": "Youtube",
"Disney Plus": "Disney",
"Bilibili": "Bilibili",
"IQ": "Asian TV",
"IQIYI": "Asian TV",
"Letv": "Asian TV",
"Netease Music": "Asian TV",
"Tencent Video": "Asian TV",
"Youku": "Asian TV",
"WeTV": "Asian TV",
"ABC": "Global TV",
"Abema TV": "Global TV",
"Amazon": "Global TV",
"Apple News": "Global TV",
"Apple TV": "Global TV",
"Bahamut": "Bahamut",
"BBC iPlayer": "Global TV",
"DAZN": "DAZN",
"Discovery Plus": "Discovery Plus",
"encoreTVB": "Global TV",
"Fox Now": "Global TV",
"Fox+": "Global TV",
"HBO Go": "HBO Go",
"HBO Max": "HBO Max",
"Hulu Japan": "Global TV",
"Hulu": "Global TV",
"Japonx": "Global TV",
"JOOX": "Global TV",
"KKBOX": "Global TV",
"KKTV": "Global TV",
"Line TV": "Global TV",
"myTV SUPER": "Global TV",
"Pandora": "Global TV",
"PBS": "Global TV",
"Pornhub": "Pornhub",
"Soundcloud": "Global TV",
"ViuTV": "Global TV",
"Telegram": "Telegram",
"Steam": "Steam",
"Speedtest": "Speedtest",
"PayPal": "PayPal",
"Microsoft": "Microsoft",
"Apple": "Apple",
"Google FCM": "Google FCM",
"Scholar": "Scholar",
"PROXY": "Proxy",
"Domestic": "Domestic",
"Domestic IPs": "Domestic",
"LAN": "DIRECT"
}
port = int(metadata["dst_port"])
if metadata["network"] == "UDP":
if port == 443:
ctx.log('[Script] matched QUIC traffic use reject')
return "REJECT"
port_list = [21, 22, 23, 53, 80, 123, 143, 194, 443, 465, 587, 853, 993, 995, 998, 2052, 2053, 2082, 2083, 2086, 2095, 2096, 5222, 5228, 5229, 5230, 8080, 8443, 8880, 8888, 8889]
if port not in port_list:
ctx.log('[Script] not common port use direct')
return "DIRECT"
if metadata["dst_ip"] == "":
metadata["dst_ip"] = ctx.resolve_ip(metadata["host"])
for ruleset in ruleset_action:
if ctx.rule_providers[ruleset].match(metadata):
return ruleset_action[ruleset]
if metadata["dst_ip"] == "":
return "DIRECT"
code = ctx.geoip(metadata["dst_ip"])
if code == "CN":
ctx.log('[Script] Geoip CN')
return "Domestic"
ctx.log('[Script] FINAL')
return "Others"
#===================== 防火墙设置 =====================#
#IPv4 NAT chain
# Generated by iptables-save v1.8.4 on Sat May 7 08:17:40 2022
*nat
:PREROUTING ACCEPT [51917:7583964]
:INPUT ACCEPT [54351:4820325]
:OUTPUT ACCEPT [100121:10402966]
:POSTROUTING ACCEPT [144309:16285438]
:MINIUPNPD - [0:0]
:MINIUPNPD-POSTROUTING - [0:0]
:openclash - [0:0]
:openclash_output - [0:0]
:postrouting_lan_rule - [0:0]
:postrouting_rule - [0:0]
:postrouting_vpn_rule - [0:0]
:postrouting_wan_rule - [0:0]
:prerouting_lan_rule - [0:0]
:prerouting_rule - [0:0]
:prerouting_vpn_rule - [0:0]
:prerouting_wan_rule - [0:0]
:zone_lan_postrouting - [0:0]
:zone_lan_prerouting - [0:0]
:zone_vpn_postrouting - [0:0]
:zone_vpn_prerouting - [0:0]
:zone_wan_postrouting - [0:0]
:zone_wan_prerouting - [0:0]
-A PREROUTING -d 8.8.4.4/32 -p tcp -m comment --comment "OpenClash Google DNS Hijack" -m tcp --dport 53 -j ACCEPT
-A PREROUTING -d 8.8.8.8/32 -p tcp -m comment --comment "OpenClash Google DNS Hijack" -m tcp --dport 53 -j ACCEPT
-A PREROUTING -p tcp -m tcp --dport 53 -m comment --comment "OpenClash DNS Hijack" -j REDIRECT --to-ports 53
-A PREROUTING -p udp -m udp --dport 53 -m comment --comment "OpenClash DNS Hijack" -j REDIRECT --to-ports 53
-A PREROUTING -m comment --comment "!fw3: Custom prerouting rule chain" -j prerouting_rule
-A PREROUTING -i br-lan -m comment --comment "!fw3" -j zone_lan_prerouting
-A PREROUTING -i tun0 -m comment --comment "!fw3" -j zone_vpn_prerouting
-A PREROUTING -p tcp -m tcp --dport 53 -j REDIRECT --to-ports 53
-A PREROUTING -p tcp -j openclash
-A OUTPUT -j openclash_output
-A POSTROUTING -m comment --comment "!fw3: Custom postrouting rule chain" -j postrouting_rule
-A POSTROUTING -o br-lan -m comment --comment "!fw3" -j zone_lan_postrouting
-A POSTROUTING -o tun0 -m comment --comment "!fw3" -j zone_vpn_postrouting
-A openclash -p tcp -m tcp --sport 1688 -j RETURN
-A openclash -p tcp -m tcp --sport 10240 -j RETURN
-A openclash -p tcp -m tcp --sport 1194 -j RETURN
-A openclash -m set --match-set localnetwork dst -j RETURN
-A openclash -p tcp -j REDIRECT --to-ports 7892
-A openclash_output -p tcp -m tcp --sport 1688 -j RETURN
-A openclash_output -p tcp -m tcp --sport 10240 -j RETURN
-A openclash_output -p tcp -m tcp --sport 1194 -j RETURN
-A openclash_output -m set --match-set localnetwork dst -j RETURN
-A openclash_output -d 198.18.0.0/16 -p tcp -m owner ! --uid-owner 65534 -j REDIRECT --to-ports 7892
-A openclash_output -p tcp -m owner ! --uid-owner 65534 -j REDIRECT --to-ports 7892
-A zone_lan_postrouting -j MINIUPNPD-POSTROUTING
-A zone_lan_postrouting -m comment --comment "!fw3: Custom lan postrouting rule chain" -j postrouting_lan_rule
-A zone_lan_prerouting -j MINIUPNPD
-A zone_lan_prerouting -m comment --comment "!fw3: Custom lan prerouting rule chain" -j prerouting_lan_rule
-A zone_vpn_postrouting -m comment --comment "!fw3: Custom vpn postrouting rule chain" -j postrouting_vpn_rule
-A zone_vpn_postrouting -m comment --comment "!fw3" -j FULLCONENAT
-A zone_vpn_prerouting -m comment --comment "!fw3: Custom vpn prerouting rule chain" -j prerouting_vpn_rule
-A zone_vpn_prerouting -m comment --comment "!fw3" -j FULLCONENAT
-A zone_wan_postrouting -m comment --comment "!fw3: Custom wan postrouting rule chain" -j postrouting_wan_rule
-A zone_wan_postrouting -m comment --comment "!fw3" -j FULLCONENAT
-A zone_wan_prerouting -m comment --comment "!fw3: Custom wan prerouting rule chain" -j prerouting_wan_rule
-A zone_wan_prerouting -m comment --comment "!fw3" -j FULLCONENAT
COMMIT
# Completed on Sat May 7 08:17:40 2022
#IPv4 Mangle chain
# Generated by iptables-save v1.8.4 on Sat May 7 08:17:40 2022
*mangle
:PREROUTING ACCEPT [2875529:3538612810]
:INPUT ACCEPT [2670640:3511968277]
:FORWARD ACCEPT [114662:15059265]
:OUTPUT ACCEPT [1754847:3258325935]
:POSTROUTING ACCEPT [1869533:3273366749]
:openclash - [0:0]
:openclash_dns_hijack - [0:0]
:openclash_output - [0:0]
-A PREROUTING -p udp -j openclash
-A PREROUTING -p tcp -m tcp --dport 53 -j openclash_dns_hijack
-A OUTPUT -j openclash_output
-A openclash -p udp -m udp --sport 1194 -j RETURN
-A openclash -p udp -m udp --sport 500 -j RETURN
-A openclash -p udp -m udp --sport 68 -j RETURN
-A openclash -i utun -j RETURN
-A openclash -m set --match-set localnetwork dst -j RETURN
-A openclash -j MARK --set-xmark 0x162/0xffffffff
-A openclash_dns_hijack -d 8.8.8.8/32 -m comment --comment "OpenClash Google DNS Hijack" -j MARK --set-xmark 0x162/0xffffffff
-A openclash_dns_hijack -d 8.8.4.4/32 -m comment --comment "OpenClash Google DNS Hijack" -j MARK --set-xmark 0x162/0xffffffff
-A openclash_output -p udp -m udp --sport 1194 -j RETURN
-A openclash_output -p udp -m udp --sport 500 -j RETURN
-A openclash_output -p udp -m udp --sport 68 -j RETURN
-A openclash_output -i utun -j RETURN
-A openclash_output -m set --match-set localnetwork dst -j RETURN
-A openclash_output -p udp -m owner ! --uid-owner 65534 -j MARK --set-xmark 0x162/0xffffffff
COMMIT
# Completed on Sat May 7 08:17:40 2022
#IPv4 Filter chain
# Generated by iptables-save v1.8.4 on Sat May 7 08:17:40 2022
*filter
:INPUT ACCEPT [15448:4129872]
:FORWARD ACCEPT [670:63166]
:OUTPUT ACCEPT [7:420]
:MINIUPNPD - [0:0]
:forwarding_lan_rule - [0:0]
:forwarding_rule - [0:0]
:forwarding_vpn_rule - [0:0]
:forwarding_wan_rule - [0:0]
:input_lan_rule - [0:0]
:input_rule - [0:0]
:input_vpn_rule - [0:0]
:input_wan_rule - [0:0]
:output_lan_rule - [0:0]
:output_rule - [0:0]
:output_vpn_rule - [0:0]
:output_wan_rule - [0:0]
:reject - [0:0]
:syn_flood - [0:0]
:zone_lan_dest_ACCEPT - [0:0]
:zone_lan_forward - [0:0]
:zone_lan_input - [0:0]
:zone_lan_output - [0:0]
:zone_lan_src_ACCEPT - [0:0]
:zone_vpn_dest_ACCEPT - [0:0]
:zone_vpn_forward - [0:0]
:zone_vpn_input - [0:0]
:zone_vpn_output - [0:0]
:zone_vpn_src_ACCEPT - [0:0]
:zone_wan_dest_ACCEPT - [0:0]
:zone_wan_dest_REJECT - [0:0]
:zone_wan_forward - [0:0]
:zone_wan_input - [0:0]
:zone_wan_output - [0:0]
:zone_wan_src_REJECT - [0:0]
-A INPUT -i lo -m comment --comment "!fw3" -j ACCEPT
-A INPUT -m comment --comment "!fw3: Custom input rule chain" -j input_rule
-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment "!fw3" -j ACCEPT
-A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -m comment --comment "!fw3" -j syn_flood
-A INPUT -i br-lan -m comment --comment "!fw3" -j zone_lan_input
-A INPUT -i tun0 -m comment --comment "!fw3" -j zone_vpn_input
-A FORWARD -o utun -p udp -m udp --dport 443 -m comment --comment "OpenClash QUIC REJECT" -m set ! --match-set china_ip_route dst -j REJECT --reject-with icmp-port-unreachable
-A FORWARD -o utun -m comment --comment "OpenClash TUN Forward" -j ACCEPT
-A FORWARD -m comment --comment "!fw3: Custom forwarding rule chain" -j forwarding_rule
-A FORWARD -m comment --comment "!fw3: Traffic offloading" -m conntrack --ctstate RELATED,ESTABLISHED -j FLOWOFFLOAD
-A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment "!fw3" -j ACCEPT
-A FORWARD -i br-lan -m comment --comment "!fw3" -j zone_lan_forward
-A FORWARD -i tun0 -m comment --comment "!fw3" -j zone_vpn_forward
-A OUTPUT -o lo -m comment --comment "!fw3" -j ACCEPT
-A OUTPUT -m comment --comment "!fw3: Custom output rule chain" -j output_rule
-A OUTPUT -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment "!fw3" -j ACCEPT
-A OUTPUT -o br-lan -m comment --comment "!fw3" -j zone_lan_output
-A OUTPUT -o tun0 -m comment --comment "!fw3" -j zone_vpn_output
-A reject -p tcp -m comment --comment "!fw3" -j REJECT --reject-with tcp-reset
-A reject -m comment --comment "!fw3" -j REJECT --reject-with icmp-port-unreachable
-A syn_flood -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -m limit --limit 25/sec --limit-burst 50 -m comment --comment "!fw3" -j RETURN
-A syn_flood -m comment --comment "!fw3" -j DROP
-A zone_lan_dest_ACCEPT -o br-lan -m comment --comment "!fw3" -j ACCEPT
-A zone_lan_forward -j MINIUPNPD
-A zone_lan_forward -m comment --comment "!fw3: Custom lan forwarding rule chain" -j forwarding_lan_rule
-A zone_lan_forward -m comment --comment "!fw3: Zone lan to wan forwarding policy" -j zone_wan_dest_ACCEPT
-A zone_lan_forward -m comment --comment "!fw3: Zone lan to vpn forwarding policy" -j zone_vpn_dest_ACCEPT
-A zone_lan_forward -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port forwards" -j ACCEPT
-A zone_lan_forward -m comment --comment "!fw3" -j zone_lan_dest_ACCEPT
-A zone_lan_input -m comment --comment "!fw3: Custom lan input rule chain" -j input_lan_rule
-A zone_lan_input -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port redirections" -j ACCEPT
-A zone_lan_input -m comment --comment "!fw3" -j zone_lan_src_ACCEPT
-A zone_lan_output -m comment --comment "!fw3: Custom lan output rule chain" -j output_lan_rule
-A zone_lan_output -m comment --comment "!fw3" -j zone_lan_dest_ACCEPT
-A zone_lan_src_ACCEPT -i br-lan -m conntrack --ctstate NEW,UNTRACKED -m comment --comment "!fw3" -j ACCEPT
-A zone_vpn_dest_ACCEPT -o tun0 -m conntrack --ctstate INVALID -m comment --comment "!fw3: Prevent NAT leakage" -j DROP
-A zone_vpn_dest_ACCEPT -o tun0 -m comment --comment "!fw3" -j ACCEPT
-A zone_vpn_forward -m comment --comment "!fw3: Custom vpn forwarding rule chain" -j forwarding_vpn_rule
-A zone_vpn_forward -m comment --comment "!fw3: Zone vpn to wan forwarding policy" -j zone_wan_dest_ACCEPT
-A zone_vpn_forward -m comment --comment "!fw3: Zone vpn to lan forwarding policy" -j zone_lan_dest_ACCEPT
-A zone_vpn_forward -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port forwards" -j ACCEPT
-A zone_vpn_forward -m comment --comment "!fw3" -j zone_vpn_dest_ACCEPT
-A zone_vpn_input -m comment --comment "!fw3: Custom vpn input rule chain" -j input_vpn_rule
-A zone_vpn_input -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port redirections" -j ACCEPT
-A zone_vpn_input -m comment --comment "!fw3" -j zone_vpn_src_ACCEPT
-A zone_vpn_output -m comment --comment "!fw3: Custom vpn output rule chain" -j output_vpn_rule
-A zone_vpn_output -m comment --comment "!fw3" -j zone_vpn_dest_ACCEPT
-A zone_vpn_src_ACCEPT -i tun0 -m conntrack --ctstate NEW,UNTRACKED -m comment --comment "!fw3" -j ACCEPT
-A zone_wan_forward -m comment --comment "!fw3: Custom wan forwarding rule chain" -j forwarding_wan_rule
-A zone_wan_forward -p esp -m comment --comment "!fw3: Allow-IPSec-ESP" -j zone_lan_dest_ACCEPT
-A zone_wan_forward -p udp -m udp --dport 500 -m comment --comment "!fw3: Allow-ISAKMP" -j zone_lan_dest_ACCEPT
-A zone_wan_forward -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port forwards" -j ACCEPT
-A zone_wan_forward -m comment --comment "!fw3" -j zone_wan_dest_REJECT
-A zone_wan_input -m comment --comment "!fw3: Custom wan input rule chain" -j input_wan_rule
-A zone_wan_input -p udp -m udp --dport 68 -m comment --comment "!fw3: Allow-DHCP-Renew" -j ACCEPT
-A zone_wan_input -p icmp -m icmp --icmp-type 8 -m comment --comment "!fw3: Allow-Ping" -j ACCEPT
-A zone_wan_input -p igmp -m comment --comment "!fw3: Allow-IGMP" -j ACCEPT
-A zone_wan_input -p tcp -m tcp --dport 8118 -m comment --comment "!fw3: adblock" -j DROP
-A zone_wan_input -p tcp -m tcp --dport 1194 -m comment --comment "!fw3: openvpn" -j ACCEPT
-A zone_wan_input -p udp -m udp --dport 1194 -m comment --comment "!fw3: openvpn" -j ACCEPT
-A zone_wan_input -p tcp -m tcp --dport 10240 -m comment --comment "!fw3: ssrs" -j ACCEPT
-A zone_wan_input -p tcp -m tcp --dport 1688 -m comment --comment "!fw3: kms" -j ACCEPT
-A zone_wan_input -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port redirections" -j ACCEPT
-A zone_wan_input -m comment --comment "!fw3" -j zone_wan_src_REJECT
-A zone_wan_output -m comment --comment "!fw3: Custom wan output rule chain" -j output_wan_rule
-A zone_wan_output -m comment --comment "!fw3" -j zone_wan_dest_ACCEPT
COMMIT
# Completed on Sat May 7 08:17:40 2022
#IPv6 NAT chain
# Generated by ip6tables-save v1.8.4 on Sat May 7 08:17:40 2022
*nat
:PREROUTING ACCEPT [26198:3473957]
:INPUT ACCEPT [11771:1304328]
:OUTPUT ACCEPT [47816:4490053]
:POSTROUTING ACCEPT [47816:4490053]
COMMIT
# Completed on Sat May 7 08:17:40 2022
#IPv6 Mangle chain
# Generated by ip6tables-save v1.8.4 on Sat May 7 08:17:40 2022
*mangle
:PREROUTING ACCEPT [3037755:745625952]
:INPUT ACCEPT [2871705:731950111]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [136157:16976131]
:POSTROUTING ACCEPT [136546:17015420]
COMMIT
# Completed on Sat May 7 08:17:40 2022
#IPv6 Filter chain
# Generated by ip6tables-save v1.8.4 on Sat May 7 08:17:40 2022
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [60:4560]
:MINIUPNPD - [0:0]
:forwarding_lan_rule - [0:0]
:forwarding_rule - [0:0]
:forwarding_vpn_rule - [0:0]
:forwarding_wan_rule - [0:0]
:input_lan_rule - [0:0]
:input_rule - [0:0]
:input_vpn_rule - [0:0]
:input_wan_rule - [0:0]
:output_lan_rule - [0:0]
:output_rule - [0:0]
:output_vpn_rule - [0:0]
:output_wan_rule - [0:0]
:reject - [0:0]
:syn_flood - [0:0]
:zone_lan_dest_ACCEPT - [0:0]
:zone_lan_forward - [0:0]
:zone_lan_input - [0:0]
:zone_lan_output - [0:0]
:zone_lan_src_ACCEPT - [0:0]
:zone_vpn_dest_ACCEPT - [0:0]
:zone_vpn_forward - [0:0]
:zone_vpn_input - [0:0]
:zone_vpn_output - [0:0]
:zone_vpn_src_ACCEPT - [0:0]
:zone_wan_dest_ACCEPT - [0:0]
:zone_wan_dest_REJECT - [0:0]
:zone_wan_forward - [0:0]
:zone_wan_input - [0:0]
:zone_wan_output - [0:0]
:zone_wan_src_REJECT - [0:0]
-A INPUT -i lo -m comment --comment "!fw3" -j ACCEPT
-A INPUT -m comment --comment "!fw3: Custom input rule chain" -j input_rule
-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment "!fw3" -j ACCEPT
-A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -m comment --comment "!fw3" -j syn_flood
-A INPUT -i br-lan -m comment --comment "!fw3" -j zone_lan_input
-A INPUT -i tun0 -m comment --comment "!fw3" -j zone_vpn_input
-A FORWARD -m comment --comment "!fw3: Custom forwarding rule chain" -j forwarding_rule
-A FORWARD -m comment --comment "!fw3: Traffic offloading" -m conntrack --ctstate RELATED,ESTABLISHED -j FLOWOFFLOAD
-A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment "!fw3" -j ACCEPT
-A FORWARD -i br-lan -m comment --comment "!fw3" -j zone_lan_forward
-A FORWARD -i tun0 -m comment --comment "!fw3" -j zone_vpn_forward
-A OUTPUT -o lo -m comment --comment "!fw3" -j ACCEPT
-A OUTPUT -m comment --comment "!fw3: Custom output rule chain" -j output_rule
-A OUTPUT -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment "!fw3" -j ACCEPT
-A OUTPUT -o br-lan -m comment --comment "!fw3" -j zone_lan_output
-A OUTPUT -o tun0 -m comment --comment "!fw3" -j zone_vpn_output
-A reject -p tcp -m comment --comment "!fw3" -j REJECT --reject-with tcp-reset
-A reject -m comment --comment "!fw3" -j REJECT --reject-with icmp6-port-unreachable
-A syn_flood -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -m limit --limit 25/sec --limit-burst 50 -m comment --comment "!fw3" -j RETURN
-A syn_flood -m comment --comment "!fw3" -j DROP
-A zone_lan_dest_ACCEPT -o br-lan -m comment --comment "!fw3" -j ACCEPT
-A zone_lan_forward -j MINIUPNPD
-A zone_lan_forward -m comment --comment "!fw3: Custom lan forwarding rule chain" -j forwarding_lan_rule
-A zone_lan_forward -m comment --comment "!fw3: Zone lan to wan forwarding policy" -j zone_wan_dest_ACCEPT
-A zone_lan_forward -m comment --comment "!fw3: Zone lan to vpn forwarding policy" -j zone_vpn_dest_ACCEPT
-A zone_lan_forward -m comment --comment "!fw3" -j zone_lan_dest_ACCEPT
-A zone_lan_input -m comment --comment "!fw3: Custom lan input rule chain" -j input_lan_rule
-A zone_lan_input -m comment --comment "!fw3" -j zone_lan_src_ACCEPT
-A zone_lan_output -m comment --comment "!fw3: Custom lan output rule chain" -j output_lan_rule
-A zone_lan_output -m comment --comment "!fw3" -j zone_lan_dest_ACCEPT
-A zone_lan_src_ACCEPT -i br-lan -m conntrack --ctstate NEW,UNTRACKED -m comment --comment "!fw3" -j ACCEPT
-A zone_vpn_dest_ACCEPT -o tun0 -m conntrack --ctstate INVALID -m comment --comment "!fw3: Prevent NAT leakage" -j DROP
-A zone_vpn_dest_ACCEPT -o tun0 -m comment --comment "!fw3" -j ACCEPT
-A zone_vpn_forward -m comment --comment "!fw3: Custom vpn forwarding rule chain" -j forwarding_vpn_rule
-A zone_vpn_forward -m comment --comment "!fw3: Zone vpn to wan forwarding policy" -j zone_wan_dest_ACCEPT
-A zone_vpn_forward -m comment --comment "!fw3: Zone vpn to lan forwarding policy" -j zone_lan_dest_ACCEPT
-A zone_vpn_forward -m comment --comment "!fw3" -j zone_vpn_dest_ACCEPT
-A zone_vpn_input -m comment --comment "!fw3: Custom vpn input rule chain" -j input_vpn_rule
-A zone_vpn_input -m comment --comment "!fw3" -j zone_vpn_src_ACCEPT
-A zone_vpn_output -m comment --comment "!fw3: Custom vpn output rule chain" -j output_vpn_rule
-A zone_vpn_output -m comment --comment "!fw3" -j zone_vpn_dest_ACCEPT
-A zone_vpn_src_ACCEPT -i tun0 -m conntrack --ctstate NEW,UNTRACKED -m comment --comment "!fw3" -j ACCEPT
-A zone_wan_forward -m comment --comment "!fw3: Custom wan forwarding rule chain" -j forwarding_wan_rule
-A zone_wan_forward -p ipv6-icmp -m icmp6 --icmpv6-type 128 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Forward" -j ACCEPT
-A zone_wan_forward -p ipv6-icmp -m icmp6 --icmpv6-type 129 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Forward" -j ACCEPT
-A zone_wan_forward -p ipv6-icmp -m icmp6 --icmpv6-type 1 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Forward" -j ACCEPT
-A zone_wan_forward -p ipv6-icmp -m icmp6 --icmpv6-type 2 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Forward" -j ACCEPT
-A zone_wan_forward -p ipv6-icmp -m icmp6 --icmpv6-type 3 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Forward" -j ACCEPT
-A zone_wan_forward -p ipv6-icmp -m icmp6 --icmpv6-type 4/0 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Forward" -j ACCEPT
-A zone_wan_forward -p ipv6-icmp -m icmp6 --icmpv6-type 4/1 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Forward" -j ACCEPT
-A zone_wan_forward -p esp -m comment --comment "!fw3: Allow-IPSec-ESP" -j zone_lan_dest_ACCEPT
-A zone_wan_forward -p udp -m udp --dport 500 -m comment --comment "!fw3: Allow-ISAKMP" -j zone_lan_dest_ACCEPT
-A zone_wan_forward -m comment --comment "!fw3" -j zone_wan_dest_REJECT
-A zone_wan_input -m comment --comment "!fw3: Custom wan input rule chain" -j input_wan_rule
-A zone_wan_input -s fc00::/6 -d fc00::/6 -p udp -m udp --dport 546 -m comment --comment "!fw3: Allow-DHCPv6" -j ACCEPT
-A zone_wan_input -s fe80::/10 -p ipv6-icmp -m icmp6 --icmpv6-type 130/0 -m comment --comment "!fw3: Allow-MLD" -j ACCEPT
-A zone_wan_input -s fe80::/10 -p ipv6-icmp -m icmp6 --icmpv6-type 131/0 -m comment --comment "!fw3: Allow-MLD" -j ACCEPT
-A zone_wan_input -s fe80::/10 -p ipv6-icmp -m icmp6 --icmpv6-type 132/0 -m comment --comment "!fw3: Allow-MLD" -j ACCEPT
-A zone_wan_input -s fe80::/10 -p ipv6-icmp -m icmp6 --icmpv6-type 143/0 -m comment --comment "!fw3: Allow-MLD" -j ACCEPT
-A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 128 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT
-A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 129 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT
-A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 1 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT
-A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 2 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT
-A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 3 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT
-A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 4/0 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT
-A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 4/1 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT
-A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 133 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT
-A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 135 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT
-A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 134 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT
-A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 136 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT
-A zone_wan_input -p tcp -m tcp --dport 8118 -m comment --comment "!fw3: adblock" -j DROP
-A zone_wan_input -p tcp -m tcp --dport 1194 -m comment --comment "!fw3: openvpn" -j ACCEPT
-A zone_wan_input -p udp -m udp --dport 1194 -m comment --comment "!fw3: openvpn" -j ACCEPT
-A zone_wan_input -p tcp -m tcp --dport 10240 -m comment --comment "!fw3: ssrs" -j ACCEPT
-A zone_wan_input -p tcp -m tcp --dport 1688 -m comment --comment "!fw3: kms" -j ACCEPT
-A zone_wan_input -m comment --comment "!fw3" -j zone_wan_src_REJECT
-A zone_wan_output -m comment --comment "!fw3: Custom wan output rule chain" -j output_wan_rule
-A zone_wan_output -m comment --comment "!fw3" -j zone_wan_dest_ACCEPT
COMMIT
# Completed on Sat May 7 08:17:40 2022
#===================== IPSET状态 =====================#
Name: cn
Name: ct
Name: cnc
Name: cmcc
Name: crtc
Name: cernet
Name: gwbn
Name: othernet
Name: music
Name: mwan3_connected_v4
Name: mwan3_connected_v6
Name: mwan3_source_v6
Name: mwan3_dynamic_v4
Name: mwan3_dynamic_v6
Name: mwan3_custom_v4
Name: mwan3_custom_v6
Name: china
Name: china_ip_route
Name: shuntlist
Name: gfwlist
Name: chnroute
Name: localnetwork
Name: shuntlist6
Name: gfwlist6
Name: chnroute6
Name: blacklist6
Name: mwan3_connected
#===================== 路由表状态 =====================#
#route -n
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
0.0.0.0 192.168.50.1 0.0.0.0 UG 0 0 0 br-lan
172.31.0.0 0.0.0.0 255.255.255.0 U 0 0 0 docker0
192.168.50.0 0.0.0.0 255.255.255.0 U 0 0 0 br-lan
198.18.0.0 0.0.0.0 255.255.0.0 U 0 0 0 utun
#ip route list
default via 192.168.50.1 dev br-lan proto static
172.31.0.0/24 dev docker0 proto kernel scope link src 172.31.0.1 linkdown
192.168.50.0/24 dev br-lan proto kernel scope link src 192.168.50.2
198.18.0.0/16 dev utun proto kernel scope link src 198.18.0.1
#ip rule show
0: from all lookup local
32765: from all fwmark 0x162 lookup 354
32766: from all lookup main
32767: from all lookup default
#===================== Tun设备状态 =====================#
utun: tun
#===================== 端口占用状态 =====================#
tcp 0 0 :::7890 :::* LISTEN 11188/clash
tcp 0 0 :::7891 :::* LISTEN 11188/clash
tcp 0 0 :::7892 :::* LISTEN 11188/clash
tcp 0 0 :::7893 :::* LISTEN 11188/clash
tcp 0 0 :::7895 :::* LISTEN 11188/clash
tcp 0 0 :::9090 :::* LISTEN 11188/clash
udp 0 0 :::57242 :::* 11188/clash
udp 0 0 :::59292 :::* 11188/clash
udp 0 0 :::38846 :::* 11188/clash
udp 0 0 :::43966 :::* 11188/clash
udp 0 0 :::44999 :::* 11188/clash
udp 0 0 :::49101 :::* 11188/clash
udp 0 0 :::45011 :::* 11188/clash
udp 0 0 :::39896 :::* 11188/clash
udp 0 0 :::41945 :::* 11188/clash
udp 0 0 :::57333 :::* 11188/clash
udp 0 0 :::60407 :::* 11188/clash
udp 0 0 :::59385 :::* 11188/clash
udp 0 0 :::36859 :::* 11188/clash
udp 0 0 :::54271 :::* 11188/clash
udp 0 0 :::47104 :::* 11188/clash
udp 0 0 :::55296 :::* 11188/clash
udp 0 0 :::51202 :::* 11188/clash
udp 0 0 :::45089 :::* 11188/clash
udp 0 0 :::54321 :::* 11188/clash
udp 0 0 :::43102 :::* 11188/clash
udp 0 0 :::60514 :::* 11188/clash
udp 0 0 :::50283 :::* 11188/clash
udp 0 0 :::51335 :::* 11188/clash
udp 0 0 :::51383 :::* 11188/clash
udp 0 0 :::33988 :::* 11188/clash
udp 0 0 :::38096 :::* 11188/clash
udp 0 0 :::34055 :::* 11188/clash
udp 0 0 :::47401 :::* 11188/clash
udp 0 0 :::52525 :::* 11188/clash
udp 0 0 :::58670 :::* 11188/clash
udp 0 0 :::37188 :::* 11188/clash
udp 0 0 :::59726 :::* 11188/clash
udp 0 0 :::40276 :::* 11188/clash
udp 0 0 :::49498 :::* 11188/clash
udp 0 0 :::51559 :::* 11188/clash
udp 0 0 :::59819 :::* 11188/clash
udp 0 0 :::59837 :::* 11188/clash
udp 0 0 :::56769 :::* 11188/clash
udp 0 0 :::52684 :::* 11188/clash
udp 0 0 :::54732 :::* 11188/clash
udp 0 0 :::33260 :::* 11188/clash
udp 0 0 :::47602 :::* 11188/clash
udp 0 0 :::48649 :::* 11188/clash
udp 0 0 :::52747 :::* 11188/clash
udp 0 0 :::39437 :::* 11188/clash
udp 0 0 :::48663 :::* 11188/clash
udp 0 0 :::53789 :::* 11188/clash
udp 0 0 :::57891 :::* 11188/clash
udp 0 0 :::50769 :::* 11188/clash
udp 0 0 :::53845 :::* 11188/clash
udp 0 0 :::36459 :::* 11188/clash
udp 0 0 :::56954 :::* 11188/clash
udp 0 0 :::52872 :::* 11188/clash
udp 0 0 :::46747 :::* 11188/clash
udp 0 0 :::54948 :::* 11188/clash
udp 0 0 :::7874 :::* 11188/clash
udp 0 0 :::7891 :::* 11188/clash
udp 0 0 :::7892 :::* 11188/clash
udp 0 0 :::7893 :::* 11188/clash
udp 0 0 :::7895 :::* 11188/clash
udp 0 0 :::55010 :::* 11188/clash
udp 0 0 :::38628 :::* 11188/clash
udp 0 0 :::51951 :::* 11188/clash
udp 0 0 :::34545 :::* 11188/clash
udp 0 0 :::37629 :::* 11188/clash
udp 0 0 :::40702 :::* 11188/clash
udp 0 0 :::47888 :::* 11188/clash
udp 0 0 :::41825 :::* 11188/clash
udp 0 0 :::58213 :::* 11188/clash
#===================== 测试本机DNS查询 =====================#
Server: 127.0.0.1
Address: 127.0.0.1#53
Name: www.baidu.com
Address 1: 198.18.0.135
*** Can't find www.baidu.com: No answer
#===================== resolv.conf.d =====================#
# Interface lan
nameserver 223.5.5.5
#===================== 测试本机网络连接 =====================#
HTTP/1.1 200 OK
Accept-Ranges: bytes
Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform
Connection: keep-alive
Content-Length: 277
Content-Type: text/html
Date: Sat, 07 May 2022 00:17:41 GMT
Etag: "575e1f60-115"
Last-Modified: Mon, 13 Jun 2016 02:50:08 GMT
Pragma: no-cache
Server: bfe/1.0.8.18
#===================== 测试本机网络下载 =====================#
#===================== 最近运行日志 =====================#
2022-05-07 07:27:26 Error: Streaming DNS Prefetch Could not Work Because of Router-Self Proxy Disabled, Exiting...
2022-05-07 07:28:27 Error: Streaming DNS Prefetch Could not Work Because of Router-Self Proxy Disabled, Exiting...
2022-05-07 07:29:27 Error: Streaming DNS Prefetch Could not Work Because of Router-Self Proxy Disabled, Exiting...
2022-05-07 07:30:27 Error: Streaming DNS Prefetch Could not Work Because of Router-Self Proxy Disabled, Exiting...
2022-05-07 07:31:27 Error: Streaming DNS Prefetch Could not Work Because of Router-Self Proxy Disabled, Exiting...
2022-05-07 07:32:28 Error: Streaming DNS Prefetch Could not Work Because of Router-Self Proxy Disabled, Exiting...
2022-05-07 07:33:28 Error: Streaming DNS Prefetch Could not Work Because of Router-Self Proxy Disabled, Exiting...
2022-05-07 07:34:28 Error: Streaming DNS Prefetch Could not Work Because of Router-Self Proxy Disabled, Exiting...
2022-05-07 07:35:29 Error: Streaming DNS Prefetch Could not Work Because of Router-Self Proxy Disabled, Exiting...
2022-05-07 07:36:29 Error: Streaming DNS Prefetch Could not Work Because of Router-Self Proxy Disabled, Exiting...
2022-05-07 07:37:29 Error: Streaming DNS Prefetch Could not Work Because of Router-Self Proxy Disabled, Exiting...
2022-05-07 07:38:30 Error: Streaming DNS Prefetch Could not Work Because of Router-Self Proxy Disabled, Exiting...
2022-05-07 07:39:30 Error: Streaming DNS Prefetch Could not Work Because of Router-Self Proxy Disabled, Exiting...
2022-05-07 07:40:30 Error: Streaming DNS Prefetch Could not Work Because of Router-Self Proxy Disabled, Exiting...
2022-05-07 07:41:31 Error: Streaming DNS Prefetch Could not Work Because of Router-Self Proxy Disabled, Exiting...
2022-05-07 07:42:31 Error: Streaming DNS Prefetch Could not Work Because of Router-Self Proxy Disabled, Exiting...
2022-05-07 07:43:31 Error: Streaming DNS Prefetch Could not Work Because of Router-Self Proxy Disabled, Exiting...
2022-05-07 07:44:32 Error: Streaming DNS Prefetch Could not Work Because of Router-Self Proxy Disabled, Exiting...
2022-05-07 07:45:32 Error: Streaming DNS Prefetch Could not Work Because of Router-Self Proxy Disabled, Exiting...
2022-05-07 07:46:32 Error: Streaming DNS Prefetch Could not Work Because of Router-Self Proxy Disabled, Exiting...
2022-05-07 07:47:33 Error: Streaming DNS Prefetch Could not Work Because of Router-Self Proxy Disabled, Exiting...
2022-05-07 07:48:33 Error: Streaming DNS Prefetch Could not Work Because of Router-Self Proxy Disabled, Exiting...
2022-05-07 07:49:33 Error: Streaming DNS Prefetch Could not Work Because of Router-Self Proxy Disabled, Exiting...
2022-05-07 07:50:34 Error: Streaming DNS Prefetch Could not Work Because of Router-Self Proxy Disabled, Exiting...
2022-05-07 07:51:34 Error: Streaming DNS Prefetch Could not Work Because of Router-Self Proxy Disabled, Exiting...
2022-05-07 07:52:34 Error: Streaming DNS Prefetch Could not Work Because of Router-Self Proxy Disabled, Exiting...
2022-05-07 07:53:35 Error: Streaming DNS Prefetch Could not Work Because of Router-Self Proxy Disabled, Exiting...
2022-05-07 07:54:35 Error: Streaming DNS Prefetch Could not Work Because of Router-Self Proxy Disabled, Exiting...
2022-05-07 07:55:35 Error: Streaming DNS Prefetch Could not Work Because of Router-Self Proxy Disabled, Exiting...
2022-05-07 07:56:36 Error: Streaming DNS Prefetch Could not Work Because of Router-Self Proxy Disabled, Exiting...
2022-05-07 07:57:36 Error: Streaming DNS Prefetch Could not Work Because of Router-Self Proxy Disabled, Exiting...
2022-05-07 07:58:36 Error: Streaming DNS Prefetch Could not Work Because of Router-Self Proxy Disabled, Exiting...
2022-05-07 07:59:36 Error: Streaming DNS Prefetch Could not Work Because of Router-Self Proxy Disabled, Exiting...
2022-05-07 08:00:37 Error: Streaming DNS Prefetch Could not Work Because of Router-Self Proxy Disabled, Exiting...
2022-05-07 08:01:37 Error: Streaming DNS Prefetch Could not Work Because of Router-Self Proxy Disabled, Exiting...
2022-05-07 08:02:37 Error: Streaming DNS Prefetch Could not Work Because of Router-Self Proxy Disabled, Exiting...
2022-05-07 08:03:38 Error: Streaming DNS Prefetch Could not Work Because of Router-Self Proxy Disabled, Exiting...
2022-05-07 08:04:38 Error: Streaming DNS Prefetch Could not Work Because of Router-Self Proxy Disabled, Exiting...
2022-05-07 08:05:38 Error: Streaming DNS Prefetch Could not Work Because of Router-Self Proxy Disabled, Exiting...
2022-05-07 08:06:39 Error: Streaming DNS Prefetch Could not Work Because of Router-Self Proxy Disabled, Exiting...
2022-05-07 08:07:39 Error: Streaming DNS Prefetch Could not Work Because of Router-Self Proxy Disabled, Exiting...
2022-05-07 08:08:39 Error: Streaming DNS Prefetch Could not Work Because of Router-Self Proxy Disabled, Exiting...
2022-05-07 08:09:40 Error: Streaming DNS Prefetch Could not Work Because of Router-Self Proxy Disabled, Exiting...
2022-05-07 08:10:40 Error: Streaming DNS Prefetch Could not Work Because of Router-Self Proxy Disabled, Exiting...
2022-05-07 08:11:40 Error: Streaming DNS Prefetch Could not Work Because of Router-Self Proxy Disabled, Exiting...
2022-05-07 08:12:41 Error: Streaming DNS Prefetch Could not Work Because of Router-Self Proxy Disabled, Exiting...
2022-05-07 08:13:41 Error: Streaming DNS Prefetch Could not Work Because of Router-Self Proxy Disabled, Exiting...
2022-05-07 08:14:41 Error: Streaming DNS Prefetch Could not Work Because of Router-Self Proxy Disabled, Exiting...
2022-05-07 08:15:42 Error: Streaming DNS Prefetch Could not Work Because of Router-Self Proxy Disabled, Exiting...
2022-05-07 08:16:42 Error: Streaming DNS Prefetch Could not Work Because of Router-Self Proxy Disabled, Exiting...
#===================== 活动连接信息 =====================#
`
This issue is stale because it has been open 60 days with no activity. Remove stale label or comment or this will be closed in 5 days
![github-actions[bot] avatar](https://avatars.githubusercontent.com/in/15368?v=4 "Published by a pub.dev verified publisher"){kind=small}
This issue is stale because it has been open 60 days with no activity. Remove stale label or comment or this will be closed in 5 days
