OpenClash
OpenClash copied to clipboard
vernesong
[Bug] 部分节点访问谷歌出现 "隐私错误"
Verify Steps
- [X] Tracker 我已经在 Issue Tracker 中找过我要提出的问题
- [X] Branch 我知道 OpenClash 的 Dev 分支切换开关位于插件设置-版本更新中，或者我会手动下载并安装 Dev 分支的 OpenClash
- [X] Latest 我已经使用最新 Dev 版本测试过，问题依旧存在
- [X] Relevant 我知道 OpenClash 与 内核(Core)、控制面板(Dashboard)、在线订阅转换(Subconverter)等项目之间无直接关系，仅相互调用
- [X] Definite 这确实是 OpenClash 出现的问题
- [ ] Contributors 我有能力协助 OpenClash 开发并解决此问题
- [ ] Meaningless 我提交的是无意义的催促更新或修复请求
OpenClash Version
v0.46.014-beta
Bug on Environment
Immortalwrt, Istoreos
OpenWrt Version
22.03.6
Bug on Platform
All
Describe the Bug
节点没问题：在手机上使用客户端同一节点可访问谷歌，使用openclash访问谷歌出现"隐私错误"，查看证书是facebook的。我也不知道是istoreOs的问题还是openclash的问题，所以先来问问openclash
To Reproduce
不需要
OpenClash Log
OpenClash 调试日志
生成时间: 2024-07-09 12:15:59
插件版本: v0.46.014-beta
隐私提示: 上传此日志前请注意检查、屏蔽公网IP、节点、密码等相关敏感信息
#===================== 系统信息 =====================#
主机型号: Techvision TVI7309X
固件版本: iStoreOS 22.03.6 2024062810
LuCI版本:
内核版本: 5.10.201
处理器架构: x86_64
#此项有值时,如不使用IPv6,建议到网络-接口-lan的设置中禁用IPV6的DHCP
IPV6-DHCP:
DNS劫持: 停用
#DNS劫持为Dnsmasq时，此项结果应仅有配置文件的DNS监听地址
Dnsmasq转发设置:
#===================== 依赖检查 =====================#
dnsmasq-full: 已安装
coreutils: 已安装
coreutils-nohup: 已安装
bash: 已安装
curl: 已安装
ca-certificates: 已安装
ipset: 已安装
ip-full: 已安装
libcap: 已安装
libcap-bin: 已安装
ruby: 已安装
ruby-yaml: 已安装
ruby-psych: 已安装
ruby-pstore: 已安装
kmod-tun(TUN模式): 已安装
luci-compat(Luci >= 19.07): 已安装
kmod-inet-diag(PROCESS-NAME): 已安装
unzip: 已安装
iptables-mod-tproxy: 已安装
kmod-ipt-tproxy: 已安装
iptables-mod-extra: 已安装
kmod-ipt-extra: 已安装
kmod-ipt-nat: 已安装
#===================== 内核检查 =====================#
运行状态: 运行中
运行内核：Meta
进程pid: 23048
运行权限: 23048: cap_dac_override,cap_net_bind_service,cap_net_admin,cap_net_raw,cap_sys_ptrace,cap_sys_resource=eip
运行用户: nobody
已选择的架构: linux-amd64
#下方无法显示内核版本号时请确认您的内核版本是否正确或者有无权限
Tun内核版本: 2023.08.17-13-gdcc8d87
Tun内核文件: 存在
Tun内核运行权限: 正常
Dev内核版本: v1.18.0-13-gd034a40
Dev内核文件: 存在
Dev内核运行权限: 正常
Meta内核版本: alpha-g0d4e57c
Meta内核文件: 存在
Meta内核运行权限: 正常
#===================== 插件设置 =====================#
当前配置文件: /etc/openclash/config/vip.yaml
启动配置文件: /etc/openclash/vip.yaml
运行模式: fake-ip-mix
默认代理模式: rule
UDP流量转发(tproxy): 停用
自定义DNS: 启用
IPV6代理: 停用
IPV6-DNS解析: 停用
禁用Dnsmasq缓存: 启用
自定义规则: 停用
仅允许内网: 停用
仅代理命中规则流量: 停用
仅允许常用端口流量: 停用
绕过中国大陆IP: 启用
路由本机代理: 启用
#启动异常时建议关闭此项后重试
混合节点: 停用
保留配置: 停用
#启动异常时建议关闭此项后重试
第三方规则: 停用
#===================== 配置文件 =====================#
port: 7890
socks-port: 7891
allow-lan: true
mode: rule
log-level: info
external-controller: 0.0.0.0:9090
dns:
enable: true
ipv6: false
listen: 0.0.0.0:7874
default-nameserver:
- 119.29.29.29
- 119.28.28.28
- 1.0.0.1
- 208.67.222.222
- 1.2.4.8
- 223.5.5.5
nameserver:
- 119.29.29.29
- 119.28.28.28
- 223.5.5.5
- https://doh.pub/dns-query
- https://dns.alidns.com/dns-query
enhanced-mode: fake-ip
fake-ip-range: 198.18.0.1/16
fallback:
- tls://dns.google:853
- tls://8.8.8.8:853
proxy-groups:
- name: "\U0001F530 节点选择"
type: select
proxies:
- "♻️ 自动选择"
- "\U0001F3AF 全球直连"
- 余额：5.67元
- 菲律宾001｜0.54元/G｜vmess｜
- 菲律宾011｜0.54元/G｜trojan｜
- 洛杉矶001｜0.51元/G｜vmess｜
- "❤️香港港002｜0.39元/G｜vmess｜"
- 台湾湾011｜0.30元/G｜vmess｜
- 东京京000｜0.11元/G｜vmess｜
- 洛杉矶000｜0.10元/G｜vmess｜
- 凤凰城001｜0.01元/G｜vmess｜
- 东京京007｜0.01元/G｜vmess｜
- 凤凰城002｜0.01元/G｜vmess｜
- 东京京006｜0.01元/G｜vmess｜
- 失联 [email protected] 邮件至｜0.01元/G｜vmess｜
- name: "♻️ 自动选择"
type: url-test
url: http://www.gstatic.com/generate_204
interval: 300
proxies:
- 余额：5.67元
- 菲律宾001｜0.54元/G｜vmess｜
- 菲律宾011｜0.54元/G｜trojan｜
- 洛杉矶001｜0.51元/G｜vmess｜
- "❤️香港港002｜0.39元/G｜vmess｜"
- 台湾湾011｜0.30元/G｜vmess｜
- 东京京000｜0.11元/G｜vmess｜
- 洛杉矶000｜0.10元/G｜vmess｜
- 凤凰城001｜0.01元/G｜vmess｜
- 东京京007｜0.01元/G｜vmess｜
- 凤凰城002｜0.01元/G｜vmess｜
- 东京京006｜0.01元/G｜vmess｜
- 失联 [email protected] 邮件至｜0.01元/G｜vmess｜
- name: "\U0001F30D 国外媒体"
type: select
proxies:
- "\U0001F530 节点选择"
- "♻️ 自动选择"
- "\U0001F3AF 全球直连"
- 余额：5.67元
- 菲律宾001｜0.54元/G｜vmess｜
- 菲律宾011｜0.54元/G｜trojan｜
- 洛杉矶001｜0.51元/G｜vmess｜
- "❤️香港港002｜0.39元/G｜vmess｜"
- 台湾湾011｜0.30元/G｜vmess｜
- 东京京000｜0.11元/G｜vmess｜
- 洛杉矶000｜0.10元/G｜vmess｜
- 凤凰城001｜0.01元/G｜vmess｜
- 东京京007｜0.01元/G｜vmess｜
- 凤凰城002｜0.01元/G｜vmess｜
- 东京京006｜0.01元/G｜vmess｜
- 失联 [email protected] 邮件至｜0.01元/G｜vmess｜
- name: "\U0001F30F 国内媒体"
type: select
proxies:
- "\U0001F3AF 全球直连"
- "❤️香港港002｜0.39元/G｜vmess｜"
- 台湾湾011｜0.30元/G｜vmess｜
- "\U0001F530 节点选择"
- name: Ⓜ️ 微软服务
type: select
proxies:
- "\U0001F3AF 全球直连"
- "\U0001F530 节点选择"
- 余额：5.67元
- 菲律宾001｜0.54元/G｜vmess｜
- 菲律宾011｜0.54元/G｜trojan｜
- 洛杉矶001｜0.51元/G｜vmess｜
- "❤️香港港002｜0.39元/G｜vmess｜"
- 台湾湾011｜0.30元/G｜vmess｜
- 东京京000｜0.11元/G｜vmess｜
- 洛杉矶000｜0.10元/G｜vmess｜
- 凤凰城001｜0.01元/G｜vmess｜
- 东京京007｜0.01元/G｜vmess｜
- 凤凰城002｜0.01元/G｜vmess｜
- 东京京006｜0.01元/G｜vmess｜
- 失联 [email protected] 邮件至｜0.01元/G｜vmess｜
- name: "\U0001F4F2 电报信息"
type: select
proxies:
- "\U0001F530 节点选择"
- "\U0001F3AF 全球直连"
- 余额：5.67元
- 菲律宾001｜0.54元/G｜vmess｜
- 菲律宾011｜0.54元/G｜trojan｜
- 洛杉矶001｜0.51元/G｜vmess｜
- "❤️香港港002｜0.39元/G｜vmess｜"
- 台湾湾011｜0.30元/G｜vmess｜
- 东京京000｜0.11元/G｜vmess｜
- 洛杉矶000｜0.10元/G｜vmess｜
- 凤凰城001｜0.01元/G｜vmess｜
- 东京京007｜0.01元/G｜vmess｜
- 凤凰城002｜0.01元/G｜vmess｜
- 东京京006｜0.01元/G｜vmess｜
- 失联 [email protected] 邮件至｜0.01元/G｜vmess｜
- name: "\U0001F34E 苹果服务"
type: select
proxies:
- "\U0001F530 节点选择"
- "\U0001F3AF 全球直连"
- "♻️ 自动选择"
- 余额：5.67元
- 菲律宾001｜0.54元/G｜vmess｜
- 菲律宾011｜0.54元/G｜trojan｜
- 洛杉矶001｜0.51元/G｜vmess｜
- "❤️香港港002｜0.39元/G｜vmess｜"
- 台湾湾011｜0.30元/G｜vmess｜
- 东京京000｜0.11元/G｜vmess｜
- 洛杉矶000｜0.10元/G｜vmess｜
- 凤凰城001｜0.01元/G｜vmess｜
- 东京京007｜0.01元/G｜vmess｜
- 凤凰城002｜0.01元/G｜vmess｜
- 东京京006｜0.01元/G｜vmess｜
- 失联 [email protected] 邮件至｜0.01元/G｜vmess｜
- name: "\U0001F3AF 全球直连"
type: select
proxies:
- DIRECT
- name: "\U0001F6D1 全球拦截"
type: select
proxies:
- REJECT
- DIRECT
- name: "\U0001F41F 漏网之鱼"
type: select
proxies:
- "\U0001F530 节点选择"
- "\U0001F3AF 全球直连"
- "♻️ 自动选择"
- 余额：5.67元
- 菲律宾001｜0.54元/G｜vmess｜
- 菲律宾011｜0.54元/G｜trojan｜
- 洛杉矶001｜0.51元/G｜vmess｜
- "❤️香港港002｜0.39元/G｜vmess｜"
- 台湾湾011｜0.30元/G｜vmess｜
- 东京京000｜0.11元/G｜vmess｜
- 洛杉矶000｜0.10元/G｜vmess｜
- 凤凰城001｜0.01元/G｜vmess｜
- 东京京007｜0.01元/G｜vmess｜
- 凤凰城002｜0.01元/G｜vmess｜
- 东京京006｜0.01元/G｜vmess｜
- 失联 [email protected] 邮件至｜0.01元/G｜vmess｜
rules:
删除了部分规则
- "DOMAIN-KEYWORD,XLLiveUD,\U0001F3AF 全球直连"
- "GEOIP,CN,\U0001F3AF 全球直连"
- "MATCH,\U0001F41F 漏网之鱼"
redir-port: 7892
tproxy-port: 7895
mixed-port: 7893
bind-address: "*"
external-ui: "/usr/share/openclash/ui"
ipv6: false
geodata-loader: standard
tcp-concurrent: true
sniffer:
enable: true
parse-pure-ip: true
tun:
enable: true
stack: mixed
device: utun
auto-route: false
auto-detect-interface: false
dns-hijack:
- tcp://any:53
profile:
store-selected: true
store-fake-ip: true
#===================== 自定义覆写设置 =====================#
#!/bin/sh
. /usr/share/openclash/ruby.sh
. /usr/share/openclash/log.sh
. /lib/functions.sh
# This script is called by /etc/init.d/openclash
# Add your custom overwrite scripts here, they will be take effict after the OpenClash own srcipts
LOG_OUT "Tip: Start Running Custom Overwrite Scripts..."
LOGTIME=$(echo $(date "+%Y-%m-%d %H:%M:%S"))
LOG_FILE="/tmp/openclash.log"
CONFIG_FILE="$1" #config path
#Simple Demo:
#General Demo
#1--config path
#2--key name
#3--value
#ruby_edit "$CONFIG_FILE" "['redir-port']" "7892"
#ruby_edit "$CONFIG_FILE" "['secret']" "123456"
#ruby_edit "$CONFIG_FILE" "['dns']['enable']" "true"
#Hash Demo
#1--config path
#2--key name
#3--hash type value
#ruby_edit "$CONFIG_FILE" "['experimental']" "{'sniff-tls-sni'=>true}"
#ruby_edit "$CONFIG_FILE" "['sniffer']" "{'sniffing'=>['tls','http']}"
#Array Demo:
#1--config path
#2--key name
#3--position(start from 0, end with -1)
#4--value
#ruby_arr_insert "$CONFIG_FILE" "['dns']['nameserver']" "0" "114.114.114.114"
#Array Add From Yaml File Demo:
#1--config path
#2--key name
#3--position(start from 0, end with -1)
#4--value file path
#5--value key name in #4 file
#ruby_arr_add_file "$CONFIG_FILE" "['dns']['fallback-filter']['ipcidr']" "0" "/etc/openclash/custom/openclash_custom_fallback_filter.yaml" "['fallback-filter']['ipcidr']"
#Ruby Script Demo:
#ruby -ryaml -rYAML -I "/usr/share/openclash" -E UTF-8 -e "
# begin
# Value = YAML.load_file('$CONFIG_FILE');
# rescue Exception => e
# puts '${LOGTIME} Error: Load File Failed,【' + e.message + '】';
# end;
#General
# begin
# Thread.new{
# Value['redir-port']=7892;
# Value['tproxy-port']=7895;
# Value['port']=7890;
# Value['socks-port']=7891;
# Value['mixed-port']=7893;
# }.join;
# rescue Exception => e
# puts '${LOGTIME} Error: Set General Failed,【' + e.message + '】';
# ensure
# File.open('$CONFIG_FILE','w') {|f| YAML.dump(Value, f)};
# end" 2>/dev/null >> $LOG_FILE
exit 0
#===================== 自定义防火墙设置 =====================#
#!/bin/sh
. /usr/share/openclash/log.sh
. /lib/functions.sh
# This script is called by /etc/init.d/openclash
# Add your custom firewall rules here, they will be added after the end of the OpenClash iptables rules
LOG_OUT "Tip: Start Add Custom Firewall Rules..."
exit 0
#===================== IPTABLES 防火墙设置 =====================#
#IPv4 NAT chain
# Generated by iptables-save v1.8.7 on Tue Jul 9 12:16:01 2024
*nat
:PREROUTING ACCEPT [1634:256541]
:INPUT ACCEPT [848:89185]
:OUTPUT ACCEPT [1026:65415]
:POSTROUTING ACCEPT [1801:132299]
:MINIUPNPD - [0:0]
:MINIUPNPD-POSTROUTING - [0:0]
:openclash - [0:0]
:openclash_output - [0:0]
:postrouting_docker_rule - [0:0]
:postrouting_lan_rule - [0:0]
:postrouting_rule - [0:0]
:postrouting_wan_rule - [0:0]
:prerouting_docker_rule - [0:0]
:prerouting_lan_rule - [0:0]
:prerouting_rule - [0:0]
:prerouting_wan_rule - [0:0]
:zone_docker_postrouting - [0:0]
:zone_docker_prerouting - [0:0]
:zone_lan_postrouting - [0:0]
:zone_lan_prerouting - [0:0]
:zone_wan_postrouting - [0:0]
:zone_wan_prerouting - [0:0]
-A PREROUTING -m comment --comment "!fw3: Custom prerouting rule chain" -j prerouting_rule
-A PREROUTING -i br-lan -m comment --comment "!fw3" -j zone_lan_prerouting
-A PREROUTING -i eth2 -m comment --comment "!fw3" -j zone_wan_prerouting
-A PREROUTING -i eth0 -m comment --comment "!fw3" -j zone_wan_prerouting
-A PREROUTING -i docker0 -m comment --comment "!fw3" -j zone_docker_prerouting
-A PREROUTING -p tcp -j openclash
-A OUTPUT -j openclash_output
-A POSTROUTING -o utun -m comment --comment "OpenClash TUN Postrouting" -j RETURN
-A POSTROUTING -m comment --comment "!fw3: Custom postrouting rule chain" -j postrouting_rule
-A POSTROUTING -o br-lan -m comment --comment "!fw3" -j zone_lan_postrouting
-A POSTROUTING -o eth2 -m comment --comment "!fw3" -j zone_wan_postrouting
-A POSTROUTING -o eth0 -m comment --comment "!fw3" -j zone_wan_postrouting
-A POSTROUTING -o docker0 -m comment --comment "!fw3" -j zone_docker_postrouting
-A openclash -p tcp -m tcp --sport 8897 -j RETURN
-A openclash -m set --match-set localnetwork dst -j RETURN
-A openclash -m set --match-set china_ip_route dst -m set ! --match-set china_ip_route_pass dst -j RETURN
-A openclash -p tcp -j REDIRECT --to-ports 7892
-A openclash_output -p tcp -m tcp --sport 8897 -j RETURN
-A openclash_output -d 198.18.0.0/16 -p tcp -m owner ! --uid-owner 65534 -j REDIRECT --to-ports 7892
-A openclash_output -m set --match-set localnetwork dst -j RETURN
-A openclash_output -m owner ! --uid-owner 65534 -m set --match-set china_ip_route dst -m set ! --match-set china_ip_route_pass dst -j RETURN
-A openclash_output -p tcp -m owner ! --uid-owner 65534 -j REDIRECT --to-ports 7892
-A zone_docker_postrouting -m comment --comment "!fw3: Custom docker postrouting rule chain" -j postrouting_docker_rule
-A zone_docker_prerouting -m comment --comment "!fw3: Custom docker prerouting rule chain" -j prerouting_docker_rule
-A zone_lan_postrouting -m comment --comment "!fw3: Custom lan postrouting rule chain" -j postrouting_lan_rule
-A zone_lan_postrouting -j MINIUPNPD-POSTROUTING
-A zone_lan_postrouting -i docker0 -m comment --comment "!fw3: DockerNAT" -j MASQUERADE
-A zone_lan_prerouting -m comment --comment "!fw3: Custom lan prerouting rule chain" -j prerouting_lan_rule
-A zone_lan_prerouting -j MINIUPNPD
-A zone_wan_postrouting -m comment --comment "!fw3: Custom wan postrouting rule chain" -j postrouting_wan_rule
-A zone_wan_postrouting -m comment --comment "!fw3" -j FULLCONENAT
-A zone_wan_prerouting -m comment --comment "!fw3: Custom wan prerouting rule chain" -j prerouting_wan_rule
-A zone_wan_prerouting -m comment --comment "!fw3" -j FULLCONENAT
COMMIT
# Completed on Tue Jul 9 12:16:01 2024
#IPv4 Mangle chain
# Generated by iptables-save v1.8.7 on Tue Jul 9 12:16:01 2024
*mangle
:PREROUTING ACCEPT [65038:14495139]
:INPUT ACCEPT [36810:12169180]
:FORWARD ACCEPT [27961:2208379]
:OUTPUT ACCEPT [40722:32548609]
:POSTROUTING ACCEPT [69101:34868252]
:openclash - [0:0]
:openclash_dns_hijack - [0:0]
:openclash_output - [0:0]
:openclash_upnp - [0:0]
-A PREROUTING -p udp -j openclash
-A FORWARD -o eth2 -p tcp -m tcp --tcp-flags SYN,RST SYN -m comment --comment "!fw3: Zone wan MTU fixing" -j TCPMSS --clamp-mss-to-pmtu
-A FORWARD -i eth2 -p tcp -m tcp --tcp-flags SYN,RST SYN -m comment --comment "!fw3: Zone wan MTU fixing" -j TCPMSS --clamp-mss-to-pmtu
-A FORWARD -o eth0 -p tcp -m tcp --tcp-flags SYN,RST SYN -m comment --comment "!fw3: Zone wan MTU fixing" -j TCPMSS --clamp-mss-to-pmtu
-A FORWARD -i eth0 -p tcp -m tcp --tcp-flags SYN,RST SYN -m comment --comment "!fw3: Zone wan MTU fixing" -j TCPMSS --clamp-mss-to-pmtu
-A OUTPUT -j openclash_output
-A openclash -p udp -m udp --sport 500 -j RETURN
-A openclash -p udp -m udp --sport 68 -j RETURN
-A openclash -i utun -j RETURN
-A openclash -m set --match-set localnetwork dst -j RETURN
-A openclash -m set --match-set china_ip_route dst -m set ! --match-set china_ip_route_pass dst -j RETURN
-A openclash -p udp -j openclash_upnp
-A openclash -j MARK --set-xmark 0x162/0xffffffff
-A openclash_output -p udp -m udp --sport 500 -j RETURN
-A openclash_output -p udp -m udp --sport 68 -j RETURN
-A openclash_output -m set --match-set localnetwork dst -j RETURN
-A openclash_output -d 198.18.0.0/16 -p udp -m owner ! --uid-owner 65534 -j MARK --set-xmark 0x162/0xffffffff
COMMIT
# Completed on Tue Jul 9 12:16:01 2024
#IPv4 Filter chain
# Generated by iptables-save v1.8.7 on Tue Jul 9 12:16:01 2024
*filter
:INPUT ACCEPT [4:160]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [2:661]
:MINIUPNPD - [0:0]
:forwarding_docker_rule - [0:0]
:forwarding_lan_rule - [0:0]
:forwarding_rule - [0:0]
:forwarding_wan_rule - [0:0]
:input_docker_rule - [0:0]
:input_lan_rule - [0:0]
:input_rule - [0:0]
:input_wan_rule - [0:0]
:output_docker_rule - [0:0]
:output_lan_rule - [0:0]
:output_rule - [0:0]
:output_wan_rule - [0:0]
:reject - [0:0]
:syn_flood - [0:0]
:zone_docker_dest_ACCEPT - [0:0]
:zone_docker_forward - [0:0]
:zone_docker_input - [0:0]
:zone_docker_output - [0:0]
:zone_docker_src_ACCEPT - [0:0]
:zone_lan_dest_ACCEPT - [0:0]
:zone_lan_forward - [0:0]
:zone_lan_input - [0:0]
:zone_lan_output - [0:0]
:zone_lan_src_ACCEPT - [0:0]
:zone_wan_dest_ACCEPT - [0:0]
:zone_wan_dest_REJECT - [0:0]
:zone_wan_forward - [0:0]
:zone_wan_input - [0:0]
:zone_wan_output - [0:0]
:zone_wan_src_REJECT - [0:0]
-A INPUT -i utun -m comment --comment "OpenClash TUN Input" -j ACCEPT
-A INPUT -i lo -m comment --comment "!fw3" -j ACCEPT
-A INPUT -m comment --comment "!fw3: Custom input rule chain" -j input_rule
-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment "!fw3" -j ACCEPT
-A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -m comment --comment "!fw3" -j syn_flood
-A INPUT -i br-lan -m comment --comment "!fw3" -j zone_lan_input
-A INPUT -i eth2 -m comment --comment "!fw3" -j zone_wan_input
-A INPUT -i eth0 -m comment --comment "!fw3" -j zone_wan_input
-A INPUT -i docker0 -m comment --comment "!fw3" -j zone_docker_input
-A FORWARD -o utun -p udp -m udp --dport 443 -m comment --comment "OpenClash QUIC REJECT" -m set ! --match-set china_ip_route dst -j REJECT --reject-with icmp-port-unreachable
-A FORWARD -i utun -m comment --comment "OpenClash TUN Forward" -j ACCEPT
-A FORWARD -o utun -m comment --comment "OpenClash TUN Forward" -j ACCEPT
-A FORWARD -o sb-tun+ -j ACCEPT
-A FORWARD -m comment --comment "!fw3: Custom forwarding rule chain" -j forwarding_rule
-A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment "!fw3" -j ACCEPT
-A FORWARD -i br-lan -m comment --comment "!fw3" -j zone_lan_forward
-A FORWARD -i eth2 -m comment --comment "!fw3" -j zone_wan_forward
-A FORWARD -i eth0 -m comment --comment "!fw3" -j zone_wan_forward
-A FORWARD -i docker0 -m comment --comment "!fw3" -j zone_docker_forward
-A FORWARD -m comment --comment "!fw3" -j reject
-A OUTPUT -o lo -m comment --comment "!fw3" -j ACCEPT
-A OUTPUT -m comment --comment "!fw3: Custom output rule chain" -j output_rule
-A OUTPUT -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment "!fw3" -j ACCEPT
-A OUTPUT -o br-lan -m comment --comment "!fw3" -j zone_lan_output
-A OUTPUT -o eth2 -m comment --comment "!fw3" -j zone_wan_output
-A OUTPUT -o eth0 -m comment --comment "!fw3" -j zone_wan_output
-A OUTPUT -o docker0 -m comment --comment "!fw3" -j zone_docker_output
-A reject -p tcp -m comment --comment "!fw3" -j REJECT --reject-with tcp-reset
-A reject -m comment --comment "!fw3" -j REJECT --reject-with icmp-port-unreachable
-A syn_flood -m limit --limit 25/sec --limit-burst 50 -m comment --comment "!fw3" -j RETURN
-A syn_flood -m comment --comment "!fw3" -j DROP
-A zone_docker_dest_ACCEPT -o docker0 -m comment --comment "!fw3" -j ACCEPT
-A zone_docker_forward -m comment --comment "!fw3: Custom docker forwarding rule chain" -j forwarding_docker_rule
-A zone_docker_forward -m comment --comment "!fw3: Zone docker to wan forwarding policy" -j zone_wan_dest_ACCEPT
-A zone_docker_forward -m comment --comment "!fw3: Zone docker to lan forwarding policy" -j zone_lan_dest_ACCEPT
-A zone_docker_forward -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port forwards" -j ACCEPT
-A zone_docker_forward -m comment --comment "!fw3" -j zone_docker_dest_ACCEPT
-A zone_docker_input -m comment --comment "!fw3: Custom docker input rule chain" -j input_docker_rule
-A zone_docker_input -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port redirections" -j ACCEPT
-A zone_docker_input -m comment --comment "!fw3" -j zone_docker_src_ACCEPT
-A zone_docker_output -m comment --comment "!fw3: Custom docker output rule chain" -j output_docker_rule
-A zone_docker_output -m comment --comment "!fw3" -j zone_docker_dest_ACCEPT
-A zone_docker_src_ACCEPT -i docker0 -m conntrack --ctstate NEW,UNTRACKED -m comment --comment "!fw3" -j ACCEPT
-A zone_lan_dest_ACCEPT -o br-lan -m comment --comment "!fw3" -j ACCEPT
-A zone_lan_forward -m comment --comment "!fw3: Custom lan forwarding rule chain" -j forwarding_lan_rule
-A zone_lan_forward -m comment --comment "!fw3: Zone lan to wan forwarding policy" -j zone_wan_dest_ACCEPT
-A zone_lan_forward -m comment --comment "!fw3: Zone lan to docker forwarding policy" -j zone_docker_dest_ACCEPT
-A zone_lan_forward -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port forwards" -j ACCEPT
-A zone_lan_forward -j MINIUPNPD
-A zone_lan_forward -m comment --comment "!fw3" -j zone_lan_dest_ACCEPT
-A zone_lan_input -m comment --comment "!fw3: Custom lan input rule chain" -j input_lan_rule
-A zone_lan_input -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port redirections" -j ACCEPT
-A zone_lan_input -j MINIUPNPD
-A zone_lan_input -m comment --comment "!fw3" -j zone_lan_src_ACCEPT
-A zone_lan_output -m comment --comment "!fw3: Custom lan output rule chain" -j output_lan_rule
-A zone_lan_output -m comment --comment "!fw3" -j zone_lan_dest_ACCEPT
-A zone_lan_src_ACCEPT -i br-lan -m conntrack --ctstate NEW,UNTRACKED -m comment --comment "!fw3" -j ACCEPT
-A zone_wan_dest_ACCEPT -o eth2 -m conntrack --ctstate INVALID -m comment --comment "!fw3: Prevent NAT leakage" -j DROP
-A zone_wan_dest_ACCEPT -o eth2 -m comment --comment "!fw3" -j ACCEPT
-A zone_wan_dest_ACCEPT -o eth0 -m conntrack --ctstate INVALID -m comment --comment "!fw3: Prevent NAT leakage" -j DROP
-A zone_wan_dest_ACCEPT -o eth0 -m comment --comment "!fw3" -j ACCEPT
-A zone_wan_dest_REJECT -o eth2 -m comment --comment "!fw3" -j reject
-A zone_wan_dest_REJECT -o eth0 -m comment --comment "!fw3" -j reject
-A zone_wan_forward -m comment --comment "!fw3: Custom wan forwarding rule chain" -j forwarding_wan_rule
-A zone_wan_forward -p esp -m comment --comment "!fw3: Allow-IPSec-ESP" -j zone_lan_dest_ACCEPT
-A zone_wan_forward -p udp -m udp --dport 500 -m comment --comment "!fw3: Allow-ISAKMP" -j zone_lan_dest_ACCEPT
-A zone_wan_forward -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port forwards" -j ACCEPT
-A zone_wan_forward -m comment --comment "!fw3" -j zone_wan_dest_REJECT
-A zone_wan_input -m comment --comment "!fw3: Custom wan input rule chain" -j input_wan_rule
-A zone_wan_input -p udp -m udp --dport 68 -m comment --comment "!fw3: Allow-DHCP-Renew" -j ACCEPT
-A zone_wan_input -p icmp -m icmp --icmp-type 8 -m comment --comment "!fw3: Allow-Ping" -j ACCEPT
-A zone_wan_input -p igmp -m comment --comment "!fw3: Allow-IGMP" -j ACCEPT
-A zone_wan_input -p tcp -m tcp --dport 8897 -m comment --comment "!fw3: linkease" -j ACCEPT
-A zone_wan_input -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port redirections" -j ACCEPT
-A zone_wan_input -m comment --comment "!fw3" -j zone_wan_src_REJECT
-A zone_wan_output -m comment --comment "!fw3: Custom wan output rule chain" -j output_wan_rule
-A zone_wan_output -m comment --comment "!fw3" -j zone_wan_dest_ACCEPT
-A zone_wan_src_REJECT -i eth2 -m comment --comment "!fw3" -j reject
-A zone_wan_src_REJECT -i eth0 -m comment --comment "!fw3" -j reject
COMMIT
# Completed on Tue Jul 9 12:16:01 2024
#IPv6 NAT chain
# Generated by ip6tables-save v1.8.7 on Tue Jul 9 12:16:01 2024
*nat
:PREROUTING ACCEPT [42117:3868840]
:INPUT ACCEPT [41343:3746937]
:OUTPUT ACCEPT [1622:234073]
:POSTROUTING ACCEPT [1622:234073]
COMMIT
# Completed on Tue Jul 9 12:16:01 2024
#IPv6 Mangle chain
# Generated by ip6tables-save v1.8.7 on Tue Jul 9 12:16:01 2024
*mangle
:PREROUTING ACCEPT [242992:24107971]
:INPUT ACCEPT [225151:22714413]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [7539:1136015]
:POSTROUTING ACCEPT [8105:1308468]
-A FORWARD -o eth2 -p tcp -m tcp --tcp-flags SYN,RST SYN -m comment --comment "!fw3: Zone wan MTU fixing" -j TCPMSS --clamp-mss-to-pmtu
-A FORWARD -i eth2 -p tcp -m tcp --tcp-flags SYN,RST SYN -m comment --comment "!fw3: Zone wan MTU fixing" -j TCPMSS --clamp-mss-to-pmtu
-A FORWARD -o eth0 -p tcp -m tcp --tcp-flags SYN,RST SYN -m comment --comment "!fw3: Zone wan MTU fixing" -j TCPMSS --clamp-mss-to-pmtu
-A FORWARD -i eth0 -p tcp -m tcp --tcp-flags SYN,RST SYN -m comment --comment "!fw3: Zone wan MTU fixing" -j TCPMSS --clamp-mss-to-pmtu
COMMIT
# Completed on Tue Jul 9 12:16:01 2024
#IPv6 Filter chain
# Generated by ip6tables-save v1.8.7 on Tue Jul 9 12:16:01 2024
*filter
:INPUT ACCEPT [1062:329646]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [770:186587]
:MINIUPNPD - [0:0]
:forwarding_docker_rule - [0:0]
:forwarding_lan_rule - [0:0]
:forwarding_rule - [0:0]
:forwarding_wan_rule - [0:0]
:input_docker_rule - [0:0]
:input_lan_rule - [0:0]
:input_rule - [0:0]
:input_wan_rule - [0:0]
:output_docker_rule - [0:0]
:output_lan_rule - [0:0]
:output_rule - [0:0]
:output_wan_rule - [0:0]
:reject - [0:0]
:syn_flood - [0:0]
:zone_docker_dest_ACCEPT - [0:0]
:zone_docker_forward - [0:0]
:zone_docker_input - [0:0]
:zone_docker_output - [0:0]
:zone_docker_src_ACCEPT - [0:0]
:zone_lan_dest_ACCEPT - [0:0]
:zone_lan_forward - [0:0]
:zone_lan_input - [0:0]
:zone_lan_output - [0:0]
:zone_lan_src_ACCEPT - [0:0]
:zone_wan_dest_ACCEPT - [0:0]
:zone_wan_dest_REJECT - [0:0]
:zone_wan_forward - [0:0]
:zone_wan_input - [0:0]
:zone_wan_output - [0:0]
:zone_wan_src_REJECT - [0:0]
-A INPUT -i lo -m comment --comment "!fw3" -j ACCEPT
-A INPUT -m comment --comment "!fw3: Custom input rule chain" -j input_rule
-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment "!fw3" -j ACCEPT
-A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -m comment --comment "!fw3" -j syn_flood
-A INPUT -i br-lan -m comment --comment "!fw3" -j zone_lan_input
-A INPUT -i eth2 -m comment --comment "!fw3" -j zone_wan_input
-A INPUT -i eth0 -m comment --comment "!fw3" -j zone_wan_input
-A INPUT -i docker0 -m comment --comment "!fw3" -j zone_docker_input
-A FORWARD -m comment --comment "!fw3: Custom forwarding rule chain" -j forwarding_rule
-A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment "!fw3" -j ACCEPT
-A FORWARD -i br-lan -m comment --comment "!fw3" -j zone_lan_forward
-A FORWARD -i eth2 -m comment --comment "!fw3" -j zone_wan_forward
-A FORWARD -i eth0 -m comment --comment "!fw3" -j zone_wan_forward
-A FORWARD -i docker0 -m comment --comment "!fw3" -j zone_docker_forward
-A FORWARD -m comment --comment "!fw3" -j reject
-A OUTPUT -o lo -m comment --comment "!fw3" -j ACCEPT
-A OUTPUT -m comment --comment "!fw3: Custom output rule chain" -j output_rule
-A OUTPUT -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment "!fw3" -j ACCEPT
-A OUTPUT -o br-lan -m comment --comment "!fw3" -j zone_lan_output
-A OUTPUT -o eth2 -m comment --comment "!fw3" -j zone_wan_output
-A OUTPUT -o eth0 -m comment --comment "!fw3" -j zone_wan_output
-A OUTPUT -o docker0 -m comment --comment "!fw3" -j zone_docker_output
-A reject -p tcp -m comment --comment "!fw3" -j REJECT --reject-with tcp-reset
-A reject -m comment --comment "!fw3" -j REJECT --reject-with icmp6-port-unreachable
-A syn_flood -m limit --limit 25/sec --limit-burst 50 -m comment --comment "!fw3" -j RETURN
-A syn_flood -m comment --comment "!fw3" -j DROP
-A zone_docker_dest_ACCEPT -o docker0 -m comment --comment "!fw3" -j ACCEPT
-A zone_docker_forward -m comment --comment "!fw3: Custom docker forwarding rule chain" -j forwarding_docker_rule
-A zone_docker_forward -m comment --comment "!fw3: Zone docker to wan forwarding policy" -j zone_wan_dest_ACCEPT
-A zone_docker_forward -m comment --comment "!fw3: Zone docker to lan forwarding policy" -j zone_lan_dest_ACCEPT
-A zone_docker_forward -m comment --comment "!fw3" -j zone_docker_dest_ACCEPT
-A zone_docker_input -m comment --comment "!fw3: Custom docker input rule chain" -j input_docker_rule
-A zone_docker_input -m comment --comment "!fw3" -j zone_docker_src_ACCEPT
-A zone_docker_output -m comment --comment "!fw3: Custom docker output rule chain" -j output_docker_rule
-A zone_docker_output -m comment --comment "!fw3" -j zone_docker_dest_ACCEPT
-A zone_docker_src_ACCEPT -i docker0 -m conntrack --ctstate NEW,UNTRACKED -m comment --comment "!fw3" -j ACCEPT
-A zone_lan_dest_ACCEPT -o br-lan -m comment --comment "!fw3" -j ACCEPT
-A zone_lan_forward -m comment --comment "!fw3: Custom lan forwarding rule chain" -j forwarding_lan_rule
-A zone_lan_forward -m comment --comment "!fw3: Zone lan to wan forwarding policy" -j zone_wan_dest_ACCEPT
-A zone_lan_forward -m comment --comment "!fw3: Zone lan to docker forwarding policy" -j zone_docker_dest_ACCEPT
-A zone_lan_forward -j MINIUPNPD
-A zone_lan_forward -m comment --comment "!fw3" -j zone_lan_dest_ACCEPT
-A zone_lan_input -m comment --comment "!fw3: Custom lan input rule chain" -j input_lan_rule
-A zone_lan_input -j MINIUPNPD
-A zone_lan_input -m comment --comment "!fw3" -j zone_lan_src_ACCEPT
-A zone_lan_output -m comment --comment "!fw3: Custom lan output rule chain" -j output_lan_rule
-A zone_lan_output -m comment --comment "!fw3" -j zone_lan_dest_ACCEPT
-A zone_lan_src_ACCEPT -i br-lan -m conntrack --ctstate NEW,UNTRACKED -m comment --comment "!fw3" -j ACCEPT
-A zone_wan_dest_ACCEPT -o eth2 -m conntrack --ctstate INVALID -m comment --comment "!fw3: Prevent NAT leakage" -j DROP
-A zone_wan_dest_ACCEPT -o eth2 -m comment --comment "!fw3" -j ACCEPT
-A zone_wan_dest_ACCEPT -o eth0 -m conntrack --ctstate INVALID -m comment --comment "!fw3: Prevent NAT leakage" -j DROP
-A zone_wan_dest_ACCEPT -o eth0 -m comment --comment "!fw3" -j ACCEPT
-A zone_wan_dest_REJECT -o eth2 -m comment --comment "!fw3" -j reject
-A zone_wan_dest_REJECT -o eth0 -m comment --comment "!fw3" -j reject
-A zone_wan_forward -m comment --comment "!fw3: Custom wan forwarding rule chain" -j forwarding_wan_rule
-A zone_wan_forward -p ipv6-icmp -m icmp6 --icmpv6-type 128 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Forward" -j ACCEPT
-A zone_wan_forward -p ipv6-icmp -m icmp6 --icmpv6-type 129 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Forward" -j ACCEPT
-A zone_wan_forward -p ipv6-icmp -m icmp6 --icmpv6-type 1 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Forward" -j ACCEPT
-A zone_wan_forward -p ipv6-icmp -m icmp6 --icmpv6-type 2 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Forward" -j ACCEPT
-A zone_wan_forward -p ipv6-icmp -m icmp6 --icmpv6-type 3 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Forward" -j ACCEPT
-A zone_wan_forward -p ipv6-icmp -m icmp6 --icmpv6-type 4/0 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Forward" -j ACCEPT
-A zone_wan_forward -p ipv6-icmp -m icmp6 --icmpv6-type 4/1 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Forward" -j ACCEPT
-A zone_wan_forward -p esp -m comment --comment "!fw3: Allow-IPSec-ESP" -j zone_lan_dest_ACCEPT
-A zone_wan_forward -p udp -m udp --dport 500 -m comment --comment "!fw3: Allow-ISAKMP" -j zone_lan_dest_ACCEPT
-A zone_wan_forward -m comment --comment "!fw3" -j zone_wan_dest_REJECT
-A zone_wan_input -m comment --comment "!fw3: Custom wan input rule chain" -j input_wan_rule
-A zone_wan_input -p udp -m udp --dport 546 -m comment --comment "!fw3: Allow-DHCPv6" -j ACCEPT
-A zone_wan_input -s fe80::/10 -p ipv6-icmp -m icmp6 --icmpv6-type 130/0 -m comment --comment "!fw3: Allow-MLD" -j ACCEPT
-A zone_wan_input -s fe80::/10 -p ipv6-icmp -m icmp6 --icmpv6-type 131/0 -m comment --comment "!fw3: Allow-MLD" -j ACCEPT
-A zone_wan_input -s fe80::/10 -p ipv6-icmp -m icmp6 --icmpv6-type 132/0 -m comment --comment "!fw3: Allow-MLD" -j ACCEPT
-A zone_wan_input -s fe80::/10 -p ipv6-icmp -m icmp6 --icmpv6-type 143/0 -m comment --comment "!fw3: Allow-MLD" -j ACCEPT
-A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 128 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT
-A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 129 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT
-A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 1 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT
-A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 2 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT
-A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 3 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT
-A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 4/0 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT
-A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 4/1 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT
-A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 133 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT
-A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 135 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT
-A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 134 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT
-A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 136 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT
-A zone_wan_input -p tcp -m tcp --dport 8897 -m comment --comment "!fw3: linkease" -j ACCEPT
-A zone_wan_input -m comment --comment "!fw3" -j zone_wan_src_REJECT
-A zone_wan_output -m comment --comment "!fw3: Custom wan output rule chain" -j output_wan_rule
-A zone_wan_output -m comment --comment "!fw3" -j zone_wan_dest_ACCEPT
-A zone_wan_src_REJECT -i eth2 -m comment --comment "!fw3" -j reject
-A zone_wan_src_REJECT -i eth0 -m comment --comment "!fw3" -j reject
COMMIT
# Completed on Tue Jul 9 12:16:01 2024
#===================== IPSET状态 =====================#
Name: localnetwork
Type: hash:net
Revision: 6
Header: family inet hashsize 1024 maxelem 65536
Size in memory: 2048
References: 4
Number of entries: 25
Name: china_ip_route
Type: hash:net
Revision: 6
Header: family inet hashsize 2048 maxelem 1000000
Size in memory: 186712
References: 4
Number of entries: 8659
Name: china_ip_route_pass
Type: hash:net
Revision: 6
Header: family inet hashsize 1024 maxelem 1000000
Size in memory: 448
References: 3
Number of entries: 0
#===================== 路由表状态 =====================#
#IPv4
#route -n
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
0.0.0.0 192.168.100.1 0.0.0.0 UG 0 0 0 br-lan
172.17.0.0 0.0.0.0 255.255.0.0 U 0 0 0 docker0
172.18.0.0 0.0.0.0 255.255.0.0 U 0 0 0 br-cd467a1f9aaf
192.168.100.0 0.0.0.0 255.255.255.0 U 0 0 0 br-lan
198.18.0.0 0.0.0.0 255.255.255.252 U 0 0 0 utun
#ip route list
default via 192.168.100.1 dev br-lan proto static
172.17.0.0/16 dev docker0 proto kernel scope link src 172.17.0.1 linkdown
172.18.0.0/16 dev br-cd467a1f9aaf proto kernel scope link src 172.18.0.1 linkdown
192.168.100.0/24 dev br-lan proto kernel scope link src 192.168.100.254
198.18.0.0/30 dev utun proto kernel scope link src 198.18.0.1
#ip rule show
0: from all lookup local
32765: from all fwmark 0x162 lookup 354
32766: from all lookup main
32767: from all lookup default
#IPv6
#route -A inet6
Kernel IPv6 routing table
Destination Next Hop Flags Metric Ref Use Iface
fdd8:16fb:c547::/48 :: !n 2147483647 2 0 lo
fe80::/64 :: U 256 5 0 br-lan
fe80::/64 :: U 256 1 0 docker0
fe80::/64 :: U 256 1 0 utun
::/0 :: !n -1 1 0 lo
::1/128 :: Un 0 6 0 lo
fe80::/128 :: Un 0 7 0 br-lan
fe80::/128 :: Un 0 3 0 docker0
fe80::/128 :: Un 0 3 0 utun
fe80::42:68ff:fe40:c20b/128 :: Un 0 2 0 docker0
fe80::62be:b4ff:fe12:cd3b/128 :: Un 0 4 0 br-lan
fe80::dc22:17c2:7b7b:5acb/128 :: Un 0 2 0 utun
ff00::/8 :: U 256 5 0 br-lan
ff00::/8 :: U 256 3 0 docker0
ff00::/8 :: U 256 5 0 utun
::/0 :: !n -1 1 0 lo
#ip -6 route list
unreachable fdd8:16fb:c547::/48 dev lo proto static metric 2147483647 pref medium
fe80::/64 dev br-lan proto kernel metric 256 pref medium
fe80::/64 dev docker0 proto kernel metric 256 linkdown pref medium
fe80::/64 dev utun proto kernel metric 256 pref medium
#ip -6 rule show
0: from all lookup local
32766: from all lookup main
#===================== Tun设备状态 =====================#
utun: tun
#===================== 端口占用状态 =====================#
tcp 0 0 198.18.0.1:36351 0.0.0.0:* LISTEN 23048/clash
tcp 0 0 :::9090 :::* LISTEN 23048/clash
tcp 0 0 :::7890 :::* LISTEN 23048/clash
tcp 0 0 :::7891 :::* LISTEN 23048/clash
tcp 0 0 :::7892 :::* LISTEN 23048/clash
tcp 0 0 :::7893 :::* LISTEN 23048/clash
tcp 0 0 :::7895 :::* LISTEN 23048/clash
udp 0 0 :::7874 :::* 23048/clash
udp 0 0 :::7891 :::* 23048/clash
udp 0 0 :::7892 :::* 23048/clash
udp 0 0 :::7893 :::* 23048/clash
udp 0 0 :::7895 :::* 23048/clash
#===================== 测试本机DNS查询(www.baidu.com) =====================#
Server: 127.0.0.1
Address: 127.0.0.1:53
Non-authoritative answer:
www.baidu.com canonical name = www.a.shifen.com
Non-authoritative answer:
www.baidu.com canonical name = www.a.shifen.com
Name: www.a.shifen.com
Address: 183.2.172.42
Name: www.a.shifen.com
Address: 183.2.172.185
#===================== 测试内核DNS查询(www.instagram.com) =====================#
Status: 0
TC: false
RD: true
RA: true
AD: false
CD: false
Question:
Name: www.instagram.com.
Qtype: 1
Qclass: 1
Answer:
TTL: 235
data: 162.125.18.129
name: www.instagram.com.
type: 1
Status: 0
TC: false
RD: true
RA: true
AD: false
CD: false
Question:
Name: www.instagram.com.
Qtype: 28
Qclass: 1
Answer:
TTL: 1
data: 2a03:2880:f112:83:face:b00c:0:25de
name: www.instagram.com.
type: 28
Dnsmasq 当前默认 resolv 文件：/tmp/resolv.conf.d/resolv.conf.auto
#===================== /tmp/resolv.conf.d/resolv.conf.auto =====================#
# Interface lan
nameserver 119.29.29.29
nameserver 8.8.8.8
#===================== 测试本机网络连接(www.baidu.com) =====================#
HTTP/1.1 200 OK
Accept-Ranges: bytes
Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform
Connection: keep-alive
Content-Length: 277
Content-Type: text/html
Date: Tue, 09 Jul 2024 04:16:02 GMT
Etag: "575e1f71-115"
Last-Modified: Mon, 13 Jun 2016 02:50:25 GMT
Pragma: no-cache
Server: bfe/1.0.8.18
#===================== 测试本机网络下载(raw.githubusercontent.com) =====================#
HTTP/2 404
content-security-policy: default-src 'none'; style-src 'unsafe-inline'; sandbox
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
x-frame-options: deny
x-xss-protection: 1; mode=block
content-type: text/plain; charset=utf-8
x-github-request-id: 28E6:25FCF7:25DE55:2DED28:668CB982
accept-ranges: bytes
date: Tue, 09 Jul 2024 04:16:02 GMT
via: 1.1 varnish
x-served-by: cache-hkg17934-HKG
x-cache: MISS
x-cache-hits: 0
x-timer: S1720498562.300558,VS0,VE321
vary: Authorization,Accept-Encoding,Origin
access-control-allow-origin: *
cross-origin-resource-policy: cross-origin
x-fastly-request-id: 224f2f15845d75e1f645b0878f478740d1bf5f3d
expires: Tue, 09 Jul 2024 04:21:02 GMT
source-age: 0
content-length: 14
#===================== 最近运行日志(自动切换为Debug模式) =====================#
time="2024-07-09T04:06:47.227764978Z" level=info msg="[TCP] 192.168.100.5:52118 --> 34.120.195.249:443 match Match using 🐟 漏网之鱼[❤️香港港002｜0.39元/G｜vmess｜]"
time="2024-07-09T04:16:02.225431335Z" level=info msg="[TCP] 192.168.100.254:56188(curl) --> 185.199.111.133:443 match Match using 🐟 漏网之鱼[❤️香港港002｜0.39元/G｜vmess｜]"
time="2024-07-09T04:16:04.064447765Z" level=debug msg="[Rule] use default rules"
time="2024-07-09T04:16:04.065578254Z" level=debug msg="[Process] find process 34.120.195.249 error: process not found"
time="2024-07-09T04:16:04.065643758Z" level=debug msg="[DNS] cache hit for hk-002.xiaoxiaobujidao.xyz., expire at 2024-07-09 04:17:02"
time="2024-07-09T04:16:04.159930142Z" level=info msg="[TCP] 192.168.100.5:45430 --> 34.120.195.249:443 match Match using 🐟 漏网之鱼[❤️香港港002｜0.39元/G｜vmess｜]"
time="2024-07-09T04:16:05.124927019Z" level=debug msg="[Rule] use default rules"
time="2024-07-09T04:16:05.12602072Z" level=debug msg="[Process] find process 34.120.195.249 error: process not found"
time="2024-07-09T04:16:05.126080836Z" level=debug msg="[DNS] cache hit for hk-002.xiaoxiaobujidao.xyz., expire at 2024-07-09 04:17:02"
time="2024-07-09T04:16:05.222289827Z" level=info msg="[TCP] 192.168.100.5:45440 --> 34.120.195.249:443 match Match using 🐟 漏网之鱼[❤️香港港002｜0.39元/G｜vmess｜]"
time="2024-07-09T04:16:05.628390877Z" level=debug msg="Skip once health check because we are lazy"
#===================== 最近运行日志获取完成(自动切换为silent模式) =====================#
#===================== 活动连接信息 =====================#
1. SourceIP:【192.168.100.4】 - Host:【Empty】 - DestinationIP:【185.199.109.133】 - Network:【tcp】 - RulePayload:【】 - Lastchain:【❤️香港港002｜0.39元/G｜vmess｜】
### OpenClash Config
```shell
---
port: 7890
socks-port: 7891
allow-lan: true
mode: rule
log-level: info
external-controller: 0.0.0.0:9090
dns:
enable: true
ipv6: false
listen: 0.0.0.0:7874
default-nameserver:
- 119.29.29.29
- 119.28.28.28
- 1.0.0.1
- 208.67.222.222
- 1.2.4.8
- 223.5.5.5
nameserver:
- 119.29.29.29
- 119.28.28.28
- 223.5.5.5
- https://doh.pub/dns-query
- https://dns.alidns.com/dns-query
enhanced-mode: fake-ip
fake-ip-range: 198.18.0.1/16
fallback:
- tls://dns.google:853
- tls://8.8.8.8:853
proxies:
节点信息已删除
proxy-groups:
- name: "\U0001F530 节点选择"
type: select
proxies:
- "♻️ 自动选择"
- "\U0001F3AF 全球直连"
- 余额：5.67元
- 菲律宾001｜0.54元/G｜vmess｜
- 菲律宾011｜0.54元/G｜trojan｜
- 洛杉矶001｜0.51元/G｜vmess｜
- "❤️香港港002｜0.39元/G｜vmess｜"
- 台湾湾011｜0.30元/G｜vmess｜
- 东京京000｜0.11元/G｜vmess｜
- 洛杉矶000｜0.10元/G｜vmess｜
- 凤凰城001｜0.01元/G｜vmess｜
- 东京京007｜0.01元/G｜vmess｜
- 凤凰城002｜0.01元/G｜vmess｜
- 东京京006｜0.01元/G｜vmess｜
- 失联 [email protected] 邮件至｜0.01元/G｜vmess｜
- name: "♻️ 自动选择"
type: url-test
url: http://www.gstatic.com/generate_204
interval: 300
proxies:
- 余额：5.67元
- 菲律宾001｜0.54元/G｜vmess｜
- 菲律宾011｜0.54元/G｜trojan｜
- 洛杉矶001｜0.51元/G｜vmess｜
- "❤️香港港002｜0.39元/G｜vmess｜"
- 台湾湾011｜0.30元/G｜vmess｜
- 东京京000｜0.11元/G｜vmess｜
- 洛杉矶000｜0.10元/G｜vmess｜
- 凤凰城001｜0.01元/G｜vmess｜
- 东京京007｜0.01元/G｜vmess｜
- 凤凰城002｜0.01元/G｜vmess｜
- 东京京006｜0.01元/G｜vmess｜
- 失联 [email protected] 邮件至｜0.01元/G｜vmess｜
- name: "\U0001F30D 国外媒体"
type: select
proxies:
- "\U0001F530 节点选择"
- "♻️ 自动选择"
- "\U0001F3AF 全球直连"
- 余额：5.67元
- 菲律宾001｜0.54元/G｜vmess｜
- 菲律宾011｜0.54元/G｜trojan｜
- 洛杉矶001｜0.51元/G｜vmess｜
- "❤️香港港002｜0.39元/G｜vmess｜"
- 台湾湾011｜0.30元/G｜vmess｜
- 东京京000｜0.11元/G｜vmess｜
- 洛杉矶000｜0.10元/G｜vmess｜
- 凤凰城001｜0.01元/G｜vmess｜
- 东京京007｜0.01元/G｜vmess｜
- 凤凰城002｜0.01元/G｜vmess｜
- 东京京006｜0.01元/G｜vmess｜
- 失联 [email protected] 邮件至｜0.01元/G｜vmess｜
- name: "\U0001F30F 国内媒体"
type: select
proxies:
- "\U0001F3AF 全球直连"
- "❤️香港港002｜0.39元/G｜vmess｜"
- 台湾湾011｜0.30元/G｜vmess｜
- "\U0001F530 节点选择"
- name: Ⓜ️ 微软服务
type: select
proxies:
- "\U0001F3AF 全球直连"
- "\U0001F530 节点选择"
- 余额：5.67元
- 菲律宾001｜0.54元/G｜vmess｜
- 菲律宾011｜0.54元/G｜trojan｜
- 洛杉矶001｜0.51元/G｜vmess｜
- "❤️香港港002｜0.39元/G｜vmess｜"
- 台湾湾011｜0.30元/G｜vmess｜
- 东京京000｜0.11元/G｜vmess｜
- 洛杉矶000｜0.10元/G｜vmess｜
- 凤凰城001｜0.01元/G｜vmess｜
- 东京京007｜0.01元/G｜vmess｜
- 凤凰城002｜0.01元/G｜vmess｜
- 东京京006｜0.01元/G｜vmess｜
- 失联 [email protected] 邮件至｜0.01元/G｜vmess｜
- name: "\U0001F4F2 电报信息"
type: select
proxies:
- "\U0001F530 节点选择"
- "\U0001F3AF 全球直连"
- 余额：5.67元
- 菲律宾001｜0.54元/G｜vmess｜
- 菲律宾011｜0.54元/G｜trojan｜
- 洛杉矶001｜0.51元/G｜vmess｜
- "❤️香港港002｜0.39元/G｜vmess｜"
- 台湾湾011｜0.30元/G｜vmess｜
- 东京京000｜0.11元/G｜vmess｜
- 洛杉矶000｜0.10元/G｜vmess｜
- 凤凰城001｜0.01元/G｜vmess｜
- 东京京007｜0.01元/G｜vmess｜
- 凤凰城002｜0.01元/G｜vmess｜
- 东京京006｜0.01元/G｜vmess｜
- 失联 [email protected] 邮件至｜0.01元/G｜vmess｜
- name: "\U0001F34E 苹果服务"
type: select
proxies:
- "\U0001F530 节点选择"
- "\U0001F3AF 全球直连"
- "♻️ 自动选择"
- 余额：5.67元
- 菲律宾001｜0.54元/G｜vmess｜
- 菲律宾011｜0.54元/G｜trojan｜
- 洛杉矶001｜0.51元/G｜vmess｜
- "❤️香港港002｜0.39元/G｜vmess｜"
- 台湾湾011｜0.30元/G｜vmess｜
- 东京京000｜0.11元/G｜vmess｜
- 洛杉矶000｜0.10元/G｜vmess｜
- 凤凰城001｜0.01元/G｜vmess｜
- 东京京007｜0.01元/G｜vmess｜
- 凤凰城002｜0.01元/G｜vmess｜
- 东京京006｜0.01元/G｜vmess｜
- 失联 [email protected] 邮件至｜0.01元/G｜vmess｜
- name: "\U0001F3AF 全球直连"
type: select
proxies:
- DIRECT
- name: "\U0001F6D1 全球拦截"
type: select
proxies:
- REJECT
- DIRECT
- name: "\U0001F41F 漏网之鱼"
type: select
proxies:
- "\U0001F530 节点选择"
- "\U0001F3AF 全球直连"
- "♻️ 自动选择"
- 余额：5.67元
- 菲律宾001｜0.54元/G｜vmess｜
- 菲律宾011｜0.54元/G｜trojan｜
- 洛杉矶001｜0.51元/G｜vmess｜
- "❤️香港港002｜0.39元/G｜vmess｜"
- 台湾湾011｜0.30元/G｜vmess｜
- 东京京000｜0.11元/G｜vmess｜
- 洛杉矶000｜0.10元/G｜vmess｜
- 凤凰城001｜0.01元/G｜vmess｜
- 东京京007｜0.01元/G｜vmess｜
- 凤凰城002｜0.01元/G｜vmess｜
- 东京京006｜0.01元/G｜vmess｜
- 失联 [email protected] 邮件至｜0.01元/G｜vmess｜
rules:
- "DOMAIN-KEYWORD,XLLiveUD,\U0001F3AF 全球直连"
- "GEOIP,CN,\U0001F3AF 全球直连"
- "MATCH,\U0001F41F 漏网之鱼"
redir-port: 7892
tproxy-port: 7895
mixed-port: 7893
secret: '123456'
bind-address: "*"
external-ui: "/usr/share/openclash/ui"
ipv6: false
geodata-loader: standard
tcp-concurrent: true
sniffer:
enable: true
parse-pure-ip: true
tun:
enable: true
stack: mixed
device: utun
auto-route: false
auto-detect-interface: false
dns-hijack:
- tcp://any:53
profile:
store-selected: true
store-fake-ip: true
Expected Behavior
系统能正常使用
Additional Context
This issue is stale because it has been open 60 days with no activity. Remove stale label or comment or this will be closed in 5 days
![github-actions[bot] avatar](https://avatars.githubusercontent.com/in/15368?v=4 "Published by a pub.dev verified publisher"){kind=small}
