OpenClash
OpenClash copied to clipboard
vernesong
[Bug] 0.46.001-beta不停还原防火墙 DNS 劫持规则
Verify Steps
- [X] Tracker 我已经在 Issue Tracker 中找过我要提出的问题
- [X] Branch 我知道 OpenClash 的 Dev 分支切换开关位于插件设置-版本更新中，或者我会手动下载并安装 Dev 分支的 OpenClash
- [X] Latest 我已经使用最新 Dev 版本测试过，问题依旧存在
- [X] Relevant 我知道 OpenClash 与 内核(Core)、控制面板(Dashboard)、在线订阅转换(Subconverter)等项目之间无直接关系，仅相互调用
- [X] Definite 这确实是 OpenClash 出现的问题
- [ ] Contributors 我有能力协助 OpenClash 开发并解决此问题
- [ ] Meaningless 我提交的是无意义的催促更新或修复请求
OpenClash Version
v0.46.001-beta
Bug on Environment
Official OpenWrt
OpenWrt Version
openwrt R22 1.1
Bug on Platform
Linux-amd64(x86-64)
Describe the Bug
从45.129更新到46.001后，日志平均一分钟出现以下提示，原版本没有问题。
2024-02-16 20:49:49 提示：检测到 Dnsmasq 正常工作，还原防火墙 DNS 劫持规则... 2024-02-16 20:48:27 提示：检测到 Dnsmasq 正常工作，还原防火墙 DNS 劫持规则... 2024-02-16 20:47:04 提示：检测到 Dnsmasq 正常工作，还原防火墙 DNS 劫持规则... 2024-02-16 20:45:41 提示：检测到 Dnsmasq 正常工作，还原防火墙 DNS 劫持规则... 2024-02-16 20:44:19 提示：检测到 Dnsmasq 正常工作，还原防火墙 DNS 劫持规则... 2024-02-16 20:42:56 提示：检测到 Dnsmasq 正常工作，还原防火墙 DNS 劫持规则... 2024-02-16 20:41:33 提示：检测到 Dnsmasq 正常工作，还原防火墙 DNS 劫持规则... 2024-02-16 20:40:08 提示：检测到 Dnsmasq 正常工作，还原防火墙 DNS 劫持规则...
暂时只有日志看着烦人，未出现断网或无法代理的情况，请问这种情况是否会影响使用，需要如何解决，谢谢。
To Reproduce
从45.129更新到46.001后即发生，内核为原内核无更新，openwrt本身也无其他更新。
OpenClash Log
无
OpenClash Config
No response
Expected Behavior
希望大大协助排查相关问题,谢谢。
Additional Context
No response
我的 v0.46.001 OK。旁路由，不做DHCP，没有wi-fi，也不拨号，默认网关指向硬路由，只做软路由代理，openwrt上只开启了openclash和依赖。
我没开绕过中国大陆IP，一开很多国内网站都上不了。
William Fang
From: super131 @.> Sent: Sunday, February 18, 2024 9:43:14 AM To: vernesong/OpenClash @.> Cc: WFANG12719 @.>; Comment @.> Subject: Re: [vernesong/OpenClash] [Bug] 0.46.001-beta不停还原防火墙 DNS 劫持规则 (Issue #3765)
我的v0.46.001 OK。旁路由，不做DHCP，没有wi-fi，也不拨号，默认网关指向硬路由，只做软路由代理，openwrt上只开启了openclash和依赖。
这是开启实验性：绕过中国大陆IP功能才会有该提示bug的
― Reply to this email directly, view it on GitHubhttps://github.com/vernesong/OpenClash/issues/3765#issuecomment-1950741217, or unsubscribehttps://github.com/notifications/unsubscribe-auth/AU4RK33FWAGKU6S2WKCR7CLYUFMDFAVCNFSM6AAAAABDL7Z7YOVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMYTSNJQG42DCMRRG4. You are receiving this because you commented.Message ID: @.***>
iptables -t nat -nL OUTPUT --line-number |grep 'OpenClash DNS Hijack'
这个命令显示什么结果
iptables -t nat -nL OUTPUT --line-number |grep 'OpenClash DNS Hijack' 这个命令显示什么结果
没反馈结果
iptables -t nat -nL OUTPUT --line-number |grep 'OpenClash DNS Hijack' 这个命令显示什么结果
没结果 +1
nslookup www.baidu.com 127.0.0.1:53 >/dev/null 2>&1 || echo $?
nslookup www.baidu.com 127.0.0.1:12353 >/dev/null 2>&1 || echo $?
这两个呢
nslookup www.baidu.com 127.0.0.1:53 >/dev/null 2>&1 || echo $? nslookup www.baidu.com 127.0.0.1:12353 >/dev/null 2>&1 || echo $? 这两个呢
这两个命令都返回“1”
我的用着正常，iptables grep 'OpenClash DNS Hijack' 也没有结果，nslookup查也返回1, dig port 53可以
➜ ~ iptables -t nat -nL OUTPUT --line-number |grep 'OpenClash DNS Hijack' ➜ ~ iptables -t nat -nL OUTPUT --line-number |grep -i 'OpenClash DNS Hijack' ➜ ~ iptables -t nat -nL OUTPUT --line-number |grep 'OpenClash DNS Hijack' ➜ ~ nslookup www.baidu.com 127.0.0.1:53 >/dev/null 2>&1 || echo $? 1 ➜ ~ nslookup www.baidu.com 127.0.0.1:12353 >/dev/null 2>&1 || echo $? 1 ➜ ~ dig @127.0.0.1 -p 53 +short www.baidu.com 198.18.0.11 ➜ ~ dig @127.0.0.1 -p 12353 +short www.baidu.com ;; communications error to 127.0.0.1#12353: connection refused ;; communications error to 127.0.0.1#12353: connection refused ;; communications error to 127.0.0.1#12353: connection refused ;; no servers could be reached
➜ ~ nslookup www.baidu.com 127.0.0.1:53 ;; communications error to 198.18.0.150#53: timed out ;; communications error to 198.18.0.150#53: timed out ;; communications error to 198.18.0.150#53: timed out ;; no servers could be reached
➜ ~ dig @127.0.0.1 -p 53 +short www.baidu.com 198.18.0.11
貌似nslookup把127.0.0.1也转做fake IP地址了
➜ ~ netstat -an | grep ".1:53" tcp 0 0 127.0.0.1:53 0.0.0.0:* LISTEN tcp 0 0 198.18.0.1:53 0.0.0.0:* LISTEN tcp 0 0 ::1:53 :::* LISTEN udp 0 0 127.0.0.1:53 0.0.0.0:* udp 0 0 198.18.0.1:53 0.0.0.0:* udp 0 0 ::1:53 :::*
nslookup www.baidu.com 127.0.0.1:53 >/dev/null 2>&1 || echo $?
应该没有结果，返回1就是dnsmasq的53监听有问题
nslookup www.baidu.com 127.0.0.1:53 >/dev/null 2>&1 || echo $?
应该没有结果，返回1就是dnsmasq的53监听有问题
openclash不停的重置防火墙，dnsmasq也会不停的重启，所以53才会有问题
openclash插件日志： 2024-02-21 11:34:06 提示：开始添加自定义防火墙规则... 2024-02-21 11:34:06 提示：正在根据防火墙端口转发和防火墙通信规则添加端口绕过规则... 2024-02-21 11:34:05 提示：DNS 劫持模式为 Dnsmasq 转发... 2024-02-21 11:34:03 重置 OpenClash 防火墙规则... 2024-02-21 11:33:58 提示：开始添加自定义防火墙规则... 2024-02-21 11:33:58 提示：正在根据防火墙端口转发和防火墙通信规则添加端口绕过规则... 2024-02-21 11:33:57 提示：DNS 劫持模式为 Dnsmasq 转发... 2024-02-21 11:33:55 重置 OpenClash 防火墙规则...
openwrt系统日志： Wed Feb 21 11:35:08 2024 user.notice root: lan error, restart lan! Wed Feb 21 11:35:08 2024 daemon.notice netifd: Interface 'lan' is now down Wed Feb 21 11:35:08 2024 daemon.notice ttyd[16686]: rops_handle_POLLIN_netlink: DELADDR Wed Feb 21 11:35:08 2024 daemon.info avahi-daemon[8297]: Withdrawing address record for 192.168.0.2 on eth1. Wed Feb 21 11:35:08 2024 daemon.info avahi-daemon[8297]: Leaving mDNS multicast group on interface eth1.IPv4 with address 192.168.0.2. Wed Feb 21 11:35:08 2024 daemon.info avahi-daemon[8297]: Interface eth1.IPv4 no longer relevant for mDNS. Wed Feb 21 11:35:08 2024 daemon.info avahi-daemon[8297]: Interface eth1.IPv6 no longer relevant for mDNS. Wed Feb 21 11:35:08 2024 daemon.info avahi-daemon[8297]: Leaving mDNS multicast group on interface eth1.IPv6 with address fe80:::153f. Wed Feb 21 11:35:08 2024 daemon.notice ttyd[16686]: rops_handle_POLLIN_netlink: DELADDR Wed Feb 21 11:35:08 2024 daemon.info avahi-daemon[8297]: Withdrawing address record for fe80::153f on eth1. Wed Feb 21 11:35:08 2024 daemon.notice netifd: Interface 'lan' is disabled Wed Feb 21 11:35:08 2024 daemon.notice netifd: Network device 'eth1' link is down Wed Feb 21 11:35:08 2024 daemon.notice netifd: Interface 'lan' has link connectivity loss Wed Feb 21 11:35:08 2024 daemon.notice netifd: Interface 'lan' is enabled Wed Feb 21 11:35:08 2024 daemon.notice netifd: Interface 'lan' is setting up now Wed Feb 21 11:35:08 2024 daemon.info avahi-daemon[8297]: Joining mDNS multicast group on interface eth1.IPv4 with address 192.168.0.2. Wed Feb 21 11:35:08 2024 daemon.info avahi-daemon[8297]: New relevant interface eth1.IPv4 for mDNS. Wed Feb 21 11:35:08 2024 daemon.info avahi-daemon[8297]: Registering new address record for 192.168.0.2 on eth1.IPv4. Wed Feb 21 11:35:08 2024 daemon.notice netifd: Interface 'lan' is now up Wed Feb 21 11:35:08 2024 user.notice firewall: Reloading firewall due to ifup of lan (eth1) Wed Feb 21 11:35:09 2024 daemon.info samba4-server: io_uring module found, enabling VFS io_uring. (also needs Kernel 5.4+ Support) Wed Feb 21 11:35:09 2024 daemon.info dnsmasq[1]: read /etc/hosts - 14 names Wed Feb 21 11:35:09 2024 daemon.info dnsmasq[1]: read /tmp/hosts/dhcp.cfg01411c - 5 names Wed Feb 21 11:35:09 2024 daemon.info dnsmasq-dhcp[1]: read /etc/ethers - 0 addresses Wed Feb 21 11:35:09 2024 daemon.info dnsmasq[1]: using nameserver 127.0.0.1#7874 Wed Feb 21 11:35:09 2024 daemon.info dnsmasq[1]: using nameserver 223.5.5.5#53 for domain inn.c Wed Feb 21 11:35:09 2024 daemon.info dnsmasq[1]: using only locally-known addresses for test Wed Feb 21 11:35:09 2024 daemon.info dnsmasq[1]: using only locally-known addresses for onion Wed Feb 21 11:35:09 2024 daemon.info dnsmasq[1]: using only locally-known addresses for localhost Wed Feb 21 11:35:09 2024 daemon.info dnsmasq[1]: using only locally-known addresses for local Wed Feb 21 11:35:09 2024 daemon.info dnsmasq[1]: using only locally-known addresses for invalid Wed Feb 21 11:35:09 2024 daemon.info dnsmasq[1]: using only locally-known addresses for bind Wed Feb 21 11:35:09 2024 daemon.info dnsmasq[1]: using only locally-known addresses for lan Wed Feb 21 11:35:09 2024 daemon.info dnsmasq[1]: using nameserver 127.0.0.1#7874 Wed Feb 21 11:35:09 2024 daemon.info dnsmasq[1]: using nameserver 223.5.5.5#53 for domain in*****.c** Wed Feb 21 11:35:09 2024 daemon.info dnsmasq[1]: using only locally-known addresses for test Wed Feb 21 11:35:09 2024 daemon.info dnsmasq[1]: using only locally-known addresses for onion Wed Feb 21 11:35:09 2024 daemon.info dnsmasq[1]: using only locally-known addresses for localhost Wed Feb 21 11:35:09 2024 daemon.info dnsmasq[1]: using only locally-known addresses for local Wed Feb 21 11:35:09 2024 daemon.info dnsmasq[1]: using only locally-known addresses for invalid Wed Feb 21 11:35:09 2024 daemon.info dnsmasq[1]: using only locally-known addresses for bind Wed Feb 21 11:35:09 2024 daemon.info dnsmasq[1]: using only locally-known addresses for lan Wed Feb 21 11:35:10 2024 daemon.info dnsmasq[1]: exiting on receipt of SIGTERM Wed Feb 21 11:35:10 2024 daemon.info dnsmasq[1]: started, version 2.89 cache disabled Wed Feb 21 11:35:10 2024 daemon.info dnsmasq[1]: compile time options: IPv6 GNU-getopt no-DBus UBus no-i18n no-IDN DHCP DHCPv6 no-Lua TFTP conntrack ipset no-nftset auth cryptohash DNSSEC no-ID loop-detect inotify dumpfile Wed Feb 21 11:35:10 2024 daemon.info dnsmasq[1]: UBus support enabled: connected to system bus Wed Feb 21 11:35:10 2024 daemon.info dnsmasq-dhcp[1]: DHCP, IP range 192.168.0.100 -- 192.168.0.249, lease time 2h Wed Feb 21 11:35:10 2024 daemon.info dnsmasq[1]: using nameserver 127.0.0.1#7874 Wed Feb 21 11:35:10 2024 daemon.info dnsmasq[1]: using only locally-known addresses for test Wed Feb 21 11:35:10 2024 daemon.info dnsmasq[1]: using only locally-known addresses for onion Wed Feb 21 11:35:10 2024 daemon.info dnsmasq[1]: using only locally-known addresses for localhost Wed Feb 21 11:35:10 2024 daemon.info dnsmasq[1]: using only locally-known addresses for local Wed Feb 21 11:35:10 2024 daemon.info dnsmasq[1]: using only locally-known addresses for invalid Wed Feb 21 11:35:10 2024 daemon.info dnsmasq[1]: using only locally-known addresses for bind Wed Feb 21 11:35:10 2024 daemon.info dnsmasq[1]: using only locally-known addresses for lan Wed Feb 21 11:35:10 2024 daemon.info dnsmasq[1]: read /etc/hosts - 14 names Wed Feb 21 11:35:10 2024 daemon.info dnsmasq[1]: read /tmp/hosts/dhcp.cfg01411c - 5 names Wed Feb 21 11:35:10 2024 daemon.info dnsmasq-dhcp[1]: read /etc/ethers - 0 addresses Wed Feb 21 11:35:10 2024 daemon.info dnsmasq[1]: using nameserver 127.0.0.1#7874 Wed Feb 21 11:35:10 2024 daemon.info dnsmasq[1]: using nameserver 223.5.5.5#53 for domain in*****.c** Wed Feb 21 11:35:10 2024 daemon.info dnsmasq[1]: using only locally-known addresses for test Wed Feb 21 11:35:10 2024 daemon.info dnsmasq[1]: using only locally-known addresses for onion Wed Feb 21 11:35:10 2024 daemon.info dnsmasq[1]: using only locally-known addresses for localhost Wed Feb 21 11:35:10 2024 daemon.info dnsmasq[1]: using only locally-known addresses for local Wed Feb 21 11:35:10 2024 daemon.info dnsmasq[1]: using only locally-known addresses for invalid Wed Feb 21 11:35:10 2024 daemon.info dnsmasq[1]: using only locally-known addresses for bind Wed Feb 21 11:35:10 2024 daemon.info dnsmasq[1]: using only locally-known addresses for lan Wed Feb 21 11:35:10 2024 daemon.info dnsmasq[1]: using nameserver 127.0.0.1#7874 Wed Feb 21 11:35:10 2024 daemon.info dnsmasq[1]: using nameserver 223.5.5.5#53 for domain in*****.c** Wed Feb 21 11:35:10 2024 daemon.info dnsmasq[1]: using only locally-known addresses for test Wed Feb 21 11:35:10 2024 daemon.info dnsmasq[1]: using only locally-known addresses for onion Wed Feb 21 11:35:10 2024 daemon.info dnsmasq[1]: using only locally-known addresses for localhost Wed Feb 21 11:35:10 2024 daemon.info dnsmasq[1]: using only locally-known addresses for local Wed Feb 21 11:35:10 2024 daemon.info dnsmasq[1]: using only locally-known addresses for invalid Wed Feb 21 11:35:10 2024 daemon.info dnsmasq[1]: using only locally-known addresses for bind Wed Feb 21 11:35:10 2024 daemon.info dnsmasq[1]: using only locally-known addresses for lan Wed Feb 21 11:35:11 2024 kern.info kernel: [ 7823.653125] igc 0000:05:00.0 eth1: NIC Link is Up 1000 Mbps Full Duplex, Flow Control: RX/TX Wed Feb 21 11:35:11 2024 daemon.notice netifd: Network device 'eth1' link is up Wed Feb 21 11:35:11 2024 daemon.notice netifd: Interface 'lan' has link connectivity Wed Feb 21 11:35:11 2024 kern.info kernel: [ 7823.772895] IPv6: ADDRCONF(NETDEV_CHANGE): eth1: link becomes ready Wed Feb 21 11:35:12 2024 daemon.info dnsmasq[1]: read /etc/hosts - 14 names Wed Feb 21 11:35:12 2024 daemon.info dnsmasq[1]: read /tmp/hosts/dhcp.cfg01411c - 5 names Wed Feb 21 11:35:12 2024 daemon.info dnsmasq-dhcp[1]: read /etc/ethers - 0 addresses Wed Feb 21 11:35:12 2024 daemon.info dnsmasq[1]: using nameserver 127.0.0.1#7874 Wed Feb 21 11:35:12 2024 daemon.info dnsmasq[1]: using nameserver 223.5.5.5#53 for domain in.c** Wed Feb 21 11:35:12 2024 daemon.info dnsmasq[1]: using only locally-known addresses for test Wed Feb 21 11:35:12 2024 daemon.info dnsmasq[1]: using only locally-known addresses for onion Wed Feb 21 11:35:12 2024 daemon.info dnsmasq[1]: using only locally-known addresses for localhost Wed Feb 21 11:35:12 2024 daemon.info dnsmasq[1]: using only locally-known addresses for local Wed Feb 21 11:35:12 2024 daemon.info dnsmasq[1]: using only locally-known addresses for invalid Wed Feb 21 11:35:12 2024 daemon.info dnsmasq[1]: using only locally-known addresses for bind Wed Feb 21 11:35:12 2024 daemon.info dnsmasq[1]: using only locally-known addresses for lan Wed Feb 21 11:35:12 2024 daemon.info dnsmasq[1]: using nameserver 127.0.0.1#7874 Wed Feb 21 11:35:12 2024 daemon.info dnsmasq[1]: using nameserver 223.5.5.5#53 for domain in.c** Wed Feb 21 11:35:12 2024 daemon.info dnsmasq[1]: using only locally-known addresses for test Wed Feb 21 11:35:12 2024 daemon.info dnsmasq[1]: using only locally-known addresses for onion Wed Feb 21 11:35:12 2024 daemon.info dnsmasq[1]: using only locally-known addresses for localhost Wed Feb 21 11:35:12 2024 daemon.info dnsmasq[1]: using only locally-known addresses for local Wed Feb 21 11:35:12 2024 daemon.info dnsmasq[1]: using only locally-known addresses for invalid Wed Feb 21 11:35:12 2024 daemon.info dnsmasq[1]: using only locally-known addresses for bind Wed Feb 21 11:35:12 2024 daemon.info dnsmasq[1]: using only locally-known addresses for lan Wed Feb 21 11:35:12 2024 daemon.info samba4-server: io_uring module found, enabling VFS io_uring. (also needs Kernel 5.4+ Support) Wed Feb 21 11:35:13 2024 daemon.info avahi-daemon[8297]: Joining mDNS multicast group on interface eth1.IPv6 with address fe80::********153f. Wed Feb 21 11:35:13 2024 daemon.info avahi-daemon[8297]: New relevant interface eth1.IPv6 for mDNS. Wed Feb 21 11:35:13 2024 daemon.info avahi-daemon[8297]: Registering new address record for fe80:********153f on eth1..
破案了，是因为openwrt系统Dnsmasq或者防火墙频繁重启，导致openclash不停的重置防火墙规则，我是之前写过断流自动重启lan口的脚本，把脚本停了之后目前没出现这个问题。
破案了，是因为openwrt系统Dnsmasq或者防火墙频繁重启，导致openclash不停的重置防火墙规则，我是之前写过断流自动重启lan口的脚本，把脚本停了之后目前没出现这个问题。
我没用过脚本，也同样有这个问题，升级成46.001版本后
有问题的都反馈下以下命令的结果
nslookup www.baidu.com 127.0.0.1:53
关闭openclash劫持的情况下还是会被劫持
有问题的都反馈下以下命令的结果
nslookup www.baidu.com 127.0.0.1:53
v0.46.001-beta 运行时，分别执行的
尝试以下命令
uci set dhcp.@dnsmasq[0].localuse="1"
uci commit dhcp
/etc/init.d/dnsmasq restart
尝试以下命令
uci set dhcp.@dnsmasq[0].localuse="1" uci commit dhcp /etc/init.d/dnsmasq restart
运行和关闭状态，分别尝试，得到还是同样的结果
iptables -t nat -I OUTPUT -p udp --dport 53 -m owner ! --uid-owner 65534 -j REDIRECT --to-ports 53
加这个呢
iptables -t nat -I OUTPUT -p udp --dport 53 -m owner ! --uid-owner 65534 -j REDIRECT --to-ports 53 加这个呢
加上貌似是正常了？