节点正常，但一直health check

[zzz6839]

节点正常可以访问https://www.gstatic.com/generate_204 和其他墙外网站，规则也是走代理的，但一直health check，重启过进程多次都能复现这个问题,Meta内核版本: alpha-633b9c04

P.S. 我这还有内存泄漏，麻烦大佬看下配置文件有什么问题。

OpenClash 调试日志

生成时间: 2023-01-14 16:26:34
插件版本: v0.45.79-beta
隐私提示: 上传此日志前请注意检查、屏蔽公网IP、节点、密码等相关敏感信息

#===================== 系统信息 =====================#

主机型号: To be filled by O.E.M. To be filled by O.E.M.
固件版本: ImmortalWrt 21.02-SNAPSHOT r19808-849e4c7eed
LuCI版本: git-20.074.84698-ead5e81
内核版本: 5.4.225
处理器架构: 

#此项有值时,如不使用IPv6,建议到网络-接口-lan的设置中禁用IPV6的DHCP
IPV6-DHCP: server

#此项结果应仅有配置文件的DNS监听地址
Dnsmasq转发设置: 127.0.0.1#5553

#===================== 依赖检查 =====================#

dnsmasq-full: 已安装
coreutils: 已安装
coreutils-nohup: 已安装
bash: 已安装
curl: 已安装
ca-certificates: 已安装
ipset: 已安装
ip-full: 已安装
libcap: 已安装
libcap-bin: 已安装
ruby: 已安装
ruby-yaml: 已安装
ruby-psych: 已安装
ruby-pstore: 已安装
kmod-tun(TUN模式): 已安装
luci-compat(Luci >= 19.07): 已安装
kmod-inet-diag(PROCESS-NAME): 已安装
unzip: 已安装
iptables-mod-tproxy: 已安装
kmod-ipt-tproxy: 已安装
iptables-mod-extra: 已安装
kmod-ipt-extra: 已安装
kmod-ipt-nat: 已安装

#===================== 内核检查 =====================#

运行状态: 运行中
进程pid: 10388 340
运行权限: 10388: cap_dac_override,cap_net_bind_service,cap_net_admin,cap_net_raw,cap_sys_ptrace,cap_sys_resource=eip
340: =ep
运行用户: nobody
已选择的架构: linux-amd64

#下方无法显示内核版本号时请确认您的内核版本是否正确或者有无权限
Tun内核版本: 2022.11.25-12-g1fa5737
Tun内核文件: 存在
Tun内核运行权限: 正常

Dev内核版本: v1.12.0-11-g0489a73
Dev内核文件: 存在
Dev内核运行权限: 正常

Meta内核版本: alpha-g633b9c04
Meta内核文件: 存在
Meta内核运行权限: 正常

#===================== 插件设置 =====================#

当前配置文件: /etc/openclash/config/georule.yaml
启动配置文件: /etc/openclash/georule.yaml
运行模式: fake-ip-mix
默认代理模式: rule
UDP流量转发(tproxy): 停用
DNS劫持: 停用
自定义DNS: 启用
IPV6代理: 启用
IPV6-DNS解析: 启用
禁用Dnsmasq缓存: 停用
自定义规则: 停用
仅允许内网: 启用
仅代理命中规则流量: 停用
仅允许常用端口流量: 停用
绕过中国大陆IP: 停用
DNS远程解析: 启用
路由本机代理: 启用

#启动异常时建议关闭此项后重试
混合节点: 停用
保留配置: 停用

#启动异常时建议关闭此项后重试
第三方规则: 停用

#===================== 配置文件 =====================#

port: 7890
socks-port: 7891
mixed-port: 7893
redir-port: 7892
tproxy-port: 7895
authentication:
- Clash:GfWeEbwi
geodata-loader: memconservative
tcp-concurrent: true
allow-lan: true
bind-address: "*"
mode: rule
log-level: silent
ipv6: true
external-controller: 0.0.0.0:9090
profile:
  store-selected: true
  store-fake-ip: true
sniffer:
  enable: true
  sniffing:
  - tls
  - http
  ForceDnsMapping: false
  ParsePureIp: true
  force-domain:
  - "+.netflix.com"
  - "+.nflxvideo.net"
  - "+.amazonaws.com"
  - "+.media.dssott.com"
  skip-domain:
  - "+.apple.com"
  - Mijia Cloud
  - "+.jd.com"
  port-whitelist:
  - 443
  - 80
hosts:
dns:
  enable: true
  listen: 0.0.0.0:7874
  ipv6: true
  default-nameserver:
  - 119.29.29.29
  - 223.6.6.6
  - 119.28.28.28#DIRECT
  enhanced-mode: fake-ip
  fake-ip-range: 198.18.0.1/16
  use-hosts: true
  fake-ip-filter:
  - "*.lan"
  - localhost.ptlogin2.qq.com
  - "+.srv.nintendo.net"
  - "+.stun.playstation.net"
  - "+.msftconnecttest.com"
  - "+.msftncsi.com"
  - "+.xboxlive.com"
  - msftconnecttest.com
  - xbox.*.microsoft.com
  - "*.battlenet.com.cn"
  - "*.battlenet.com"
  - "*.blzstatic.cn"
  - "*.battle.net"
  - "*.wegame.com.cn"
  - "*.localdomain"
  - "*.example"
  - "*.invalid"
  - "*.localhost"
  - "*.test"
  - "*.local"
  - "*.home.arpa"
  - time.*.com
  - time.*.gov
  - time.*.edu.cn
  - time.*.apple.com
  - time-ios.apple.com
  - time1.*.com
  - time2.*.com
  - time3.*.com
  - time4.*.com
  - time5.*.com
  - time6.*.com
  - time7.*.com
  - ntp.*.com
  - ntp1.*.com
  - ntp2.*.com
  - ntp3.*.com
  - ntp4.*.com
  - ntp5.*.com
  - ntp6.*.com
  - ntp7.*.com
  - "*.time.edu.cn"
  - "*.ntp.org.cn"
  - "+.pool.ntp.org"
  - time1.cloud.tencent.com
  - music.163.com
  - "*.music.163.com"
  - "*.126.net"
  - musicapi.taihe.com
  - music.taihe.com
  - songsearch.kugou.com
  - trackercdn.kugou.com
  - "*.kuwo.cn"
  - api-jooxtt.sanook.com
  - api.joox.com
  - joox.com
  - y.qq.com
  - "*.y.qq.com"
  - streamoc.music.tc.qq.com
  - mobileoc.music.tc.qq.com
  - isure.stream.qqmusic.qq.com
  - dl.stream.qqmusic.qq.com
  - aqqmusic.tc.qq.com
  - amobile.music.tc.qq.com
  - "*.xiami.com"
  - "*.music.migu.cn"
  - music.migu.cn
  - msftncsi.com
  - localhost.sec.qq.com
  - "*.n.n.srv.nintendo.net"
  - xbox.*.*.microsoft.com
  - "*.*.xboxlive.com"
  - xnotify.xboxlive.com
  - "+.battlenet.com.cn"
  - "+.wotgame.cn"
  - "+.wggames.cn"
  - "+.wowsgame.cn"
  - "+.wargaming.net"
  - proxy.golang.org
  - stun.*.*
  - stun.*.*.*
  - "+.stun.*.*"
  - "+.stun.*.*.*"
  - "+.stun.*.*.*.*"
  - "+.stun.*.*.*.*.*"
  - heartbeat.belkin.com
  - "*.linksys.com"
  - "*.linksyssmartwifi.com"
  - "*.router.asus.com"
  - mesu.apple.com
  - swscan.apple.com
  - swquery.apple.com
  - swdownload.apple.com
  - swcdn.apple.com
  - swdist.apple.com
  - lens.l.google.com
  - stun.l.google.com
  - "+.nflxvideo.net"
  - "*.square-enix.com"
  - "*.finalfantasyxiv.com"
  - "*.ffxiv.com"
  - "*.ff14.sdo.com"
  - ff.dorado.sdo.com
  - "*.mcdn.bilivideo.cn"
  - "+.media.dssott.com"
  - shark007.net
  - Mijia Cloud
  - "+.dns.google"
  - p-bstarstatic.akamaized.net
  - p.bstarstatic.com
  - upos-bstar-mirrorakam.akamaized.net
  - upos-bstar1-mirrorakam.akamaized.net
  - upos-hz-mirrorakam.akamaized.net
  - acgvideo.com
  - bilibili.com
  - bilibili.tv
  proxy-server-nameserver:
  - tls://dns.google#✈️PROXY
  - tls://1dot1dot1dot1.cloudflare-dns.com#✈️PROXY
  nameserver:
  - 223.6.6.6
  - 119.28.28.28#DIRECT
  fallback:
  - tls://dns.google#✈️PROXY
  - tls://1dot1dot1dot1.cloudflare-dns.com#✈️PROXY
  fallback-filter:
    geosite:
    - gfw
    - "!cn"
    geoip: true
    geoip-code: CN
    ipcidr:
    - 0.0.0.0/8
    - 10.0.0.0/8
    - 100.64.0.0/10
    - 127.0.0.0/8
    - 169.254.0.0/16
    - 172.16.0.0/12
    - 192.0.0.0/24
    - 192.0.2.0/24
    - 192.88.99.0/24
    - 192.168.0.0/16
    - 198.18.0.0/15
    - 198.51.100.0/24
    - 203.0.113.0/24
    - 224.0.0.0/4
    - 240.0.0.0/4
    - 255.255.255.255/32
    domain:
    - "+.google.com"
    - "+.facebook.com"
    - "+.youtube.com"
    - "+.githubusercontent.com"
    - "+.googlevideo.com"
    - "+.msftconnecttest.com"
    - "+.msftncsi.com"
    - msftconnecttest.com
    - msftncsi.com
proxy-groups:
- name: "✈️PROXY"
  type: select
  proxies:
  - Auto
  - Manual
- name: Auto
  type: fallback
  proxies:
  - main(Auto)
  - backup(Auto)
  url: https://www.gstatic.com/generate_204
  interval: 300
- name: main(Auto)
  type: url-test
  use:
  - Airport A
  url: https://www.gstatic.com/generate_204
  interval: 300
  tolerance: 40
  filter: 香港|hk|hong
- name: backup(Auto)
  type: url-test
  use:
  - Airport B
  url: https://www.gstatic.com/generate_204
  interval: 300
  tolerance: 40
  lazy: true
  filter: 港|hk|hong
- name: Manual
  type: select
  proxies:
  - main (Manual)
  - backup (Manual)
- name: main (Manual)
  type: select
  use:
  - Airport A
- name: backup (Manual)
  type: select
  use:
  - Airport B
- name: "\U0001F1F9\U0001F1FCBaha"
  type: url-test
  use:
  - Airport A
  filter: "(?!.*(游戏)).*(台湾|taiwan|TW)"
  url: https://ani.gamer.com.tw/
  interval: 900
  tolerance: 50
- name: e-hentai
  type: select
  proxies:
  - e-hentai auto
  - Manual
- name: e-hentai auto
  type: load-balance
  strategy: round-robin
  use:
  - Airport A
  url: https://e-hentai.org
  interval: 900
  tolerance: 50
- name: javdb
  type: load-balance
  strategy: round-robin
  use:
  - Airport A
  filter: "^(?!.*(日|Japan|jp))"
  url: https://javdb.com
  interval: 900
  tolerance: 50
- name: "\U0001F1EF\U0001F1F5DMM/Mgstage/Tiktok"
  type: load-balance
  strategy: round-robin
  use:
  - Airport A
  filter: 日|Japan|jp
  url: https://dmm.co.jp
  interval: 900
  tolerance: 50
- name: Bilibili国台
  type: select
  proxies:
  - DIRECT
  use:
  - Airport A
  filter: 台湾|TW|taiwan
- name: "\U0001F3AEonline game"
  type: select
  use:
  - Airport A
  - Airport B
  filter: 游戏|game
- name: DST-PORT
  type: select
  proxies:
  - "✈️PROXY"
  - DIRECT
rule-providers:
  bt-trackers:
    type: http
    behavior: domain
    url: https://raw.githubusercontent.com/Pioooooo/clash-rules-bt/main/anime_trackers.txt
    path: "./rule_provider/bt-trackers.txt"
    interval: 86400
  domestic:
    type: http
    behavior: classical
    path: "./rule_provider/domestic.yaml"
    url: https://raw.githubusercontent.com/zzz6839/PROXY-PROVIDERS-SYNC/zzz6839-patch-1/domestic.yaml
    interval: 86400
  "\U0001F3AEonline game":
    type: http
    behavior: ipcidr
    path: "./rule_provider/onlinegame.yaml"
    url: https://raw.githubusercontent.com/zzz6839/PROXY-PROVIDERS-SYNC/zzz6839-patch-1/onlinegame.yaml
    interval: 86400
  Proxy:
    type: http
    behavior: classical
    path: "./rule_provider/Proxy.yaml"
    url: https://raw.githubusercontent.com/zzz6839/PROXY-PROVIDERS-SYNC/zzz6839-patch-1/Proxy.yaml
    interval: 86400
  Refuse:
    type: http
    behavior: classical
    path: "./rule_provider/Refuse.yaml"
    url: https://raw.githubusercontent.com/zzz6839/PROXY-PROVIDERS-SYNC/zzz6839-patch-1/refuse.yaml
    interval: 86400
  SteamCN:
    type: http
    behavior: classical
    path: "./rule_provider/SteamCN.yaml"
    url: https://raw.githubusercontent.com/zzz6839/CUSTOM_CLASH_RULESET/release/SteamCN_domain.yaml
    interval: 86400
  Steam:
    type: http
    behavior: classical
    path: "./rule_provider/Steam.yaml"
    url: https://raw.githubusercontent.com/zzz6839/CUSTOM_CLASH_RULESET/release/Steam_domain.yaml
    interval: 86400
rules:
- DST-PORT,7895,REJECT
- DST-PORT,7892,REJECT
- DOMAIN-SUFFIX,msftconnecttest.com,✈️PROXY
- GEOSITE,private,DIRECT
- GEOSITE,category-ads-all,REJECT
- RULE-SET,Refuse,REJECT
- "GEOSITE,bahamut,\U0001F1F9\U0001F1FCBaha"
- "GEOSITE,tiktok,\U0001F1EF\U0001F1F5DMM/Mgstage/Tiktok"
- "DOMAIN-SUFFIX,mgstage.com,\U0001F1EF\U0001F1F5DMM/Mgstage/Tiktok"
- "GEOSITE,dmm,\U0001F1EF\U0001F1F5DMM/Mgstage/Tiktok"
- GEOSITE,ehentai,e-hentai
- GEOSITE,javdb,javdb
- GEOSITE,bilibili,Bilibili国台
- RULE-SET,SteamCN,DIRECT
- RULE-SET,Steam,✈️PROXY
- RULE-SET,bt-trackers,DIRECT
- GEOSITE,github,✈️PROXY
- GEOSITE,gfw,✈️PROXY
- RULE-SET,Proxy,✈️PROXY
- GEOSITE,epicgames,DIRECT
- GEOSITE,rockstar,DIRECT
- GEOSITE,icloud@cn,DIRECT
- GEOSITE,apple@cn,DIRECT
- GEOSITE,apple-cn,DIRECT
- GEOSITE,microsoft@cn,DIRECT
- GEOSITE,geolocation-cn,DIRECT
- RULE-SET,domestic,DIRECT
- IP-CIDR,198.18.0.1/16,REJECT,no-resolve
- GEOIP,private,DIRECT,no-resolve
- "RULE-SET,\U0001F3AEonline game,\U0001F3AEonline game,no-resolve"
- GEOIP,telegram,✈️PROXY,no-resolve
- GEOIP,cn,DIRECT
- DST-PORT,80,DST-PORT
- DST-PORT,443,DST-PORT
- DST-PORT,22,DST-PORT
- MATCH,DIRECT
external-ui: "/usr/share/openclash/ui"
interface-name: pppoe-wan
geodata-mode: true
find-process-mode: 'off'
tun:
  enable: true
  stack: gvisor
  device: utun
  mtu: 65535
  auto-route: false
  auto-detect-interface: false
  dns-hijack:
  - tcp://any:53

#===================== IPTABLES 防火墙设置 =====================#

#IPv4 NAT chain

# Generated by iptables-save v1.8.7 on Sat Jan 14 16:26:37 2023
*nat
:PREROUTING ACCEPT [530:43032]
:INPUT ACCEPT [1238:66811]
:OUTPUT ACCEPT [9143:666931]
:POSTROUTING ACCEPT [2003:164214]
:DOCKER - [0:0]
:clash - [0:0]
:netease_cloud_music - [0:0]
:openclash - [0:0]
:openclash_output - [0:0]
:postrouting_docker_rule - [0:0]
:postrouting_lan_rule - [0:0]
:postrouting_rule - [0:0]
:postrouting_wan_rule - [0:0]
:prerouting_docker_rule - [0:0]
:prerouting_lan_rule - [0:0]
:prerouting_rule - [0:0]
:prerouting_wan_rule - [0:0]
:zone_docker_postrouting - [0:0]
:zone_docker_prerouting - [0:0]
:zone_lan_postrouting - [0:0]
:zone_lan_prerouting - [0:0]
:zone_wan_postrouting - [0:0]
:zone_wan_prerouting - [0:0]
-A PREROUTING -p tcp -m comment --comment "OpenClash TCP DNS Hijack" -m tcp --dport 53 -j ACCEPT
-A PREROUTING -p tcp -m set --match-set neteasemusic dst -j netease_cloud_music
-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER
-A PREROUTING -m comment --comment "!fw3: Custom prerouting rule chain" -j prerouting_rule
-A PREROUTING -i br-lan -m comment --comment "!fw3" -j zone_lan_prerouting
-A PREROUTING -i pppoe-wan -m comment --comment "!fw3" -j zone_wan_prerouting
-A PREROUTING -i eth3 -m comment --comment "!fw3" -j zone_wan_prerouting
-A PREROUTING -i docker0 -m comment --comment "!fw3" -j zone_docker_prerouting
-A PREROUTING -p tcp -m multiport --dports 22,53,123,587,465,995,993,143,80,443,8080 -j clash
-A PREROUTING -p tcp -j openclash
-A OUTPUT ! -d 127.0.0.0/8 -m addrtype --dst-type LOCAL -j DOCKER
-A OUTPUT -j openclash_output
-A POSTROUTING -s 172.17.0.0/16 ! -o docker0 -j MASQUERADE
-A POSTROUTING -m comment --comment "!fw3: Custom postrouting rule chain" -j postrouting_rule
-A POSTROUTING -o br-lan -m comment --comment "!fw3" -j zone_lan_postrouting
-A POSTROUTING -o pppoe-wan -m comment --comment "!fw3" -j zone_wan_postrouting
-A POSTROUTING -o eth3 -m comment --comment "!fw3" -j zone_wan_postrouting
-A POSTROUTING -o docker0 -m comment --comment "!fw3" -j zone_docker_postrouting
-A DOCKER -i docker0 -j RETURN
-A netease_cloud_music -d 0.0.0.0/8 -j RETURN
-A netease_cloud_music -d 10.0.0.0/8 -j RETURN
-A netease_cloud_music -d 127.0.0.0/8 -j RETURN
-A netease_cloud_music -d 169.254.0.0/16 -j RETURN
-A netease_cloud_music -d 172.16.0.0/12 -j RETURN
-A netease_cloud_music -d 192.168.0.0/16 -j RETURN
-A netease_cloud_music -d 224.0.0.0/4 -j RETURN
-A netease_cloud_music -d 240.0.0.0/4 -j RETURN
-A netease_cloud_music -p tcp -m set ! --match-set acl_neteasemusic_http src -m tcp --dport 80 -j REDIRECT --to-ports 5200
-A netease_cloud_music -p tcp -m set ! --match-set acl_neteasemusic_https src -m tcp --dport 443 -j REDIRECT --to-ports 5202
-A openclash -m set --match-set localnetwork dst -j RETURN
-A openclash -p tcp -j REDIRECT --to-ports 7892
-A openclash_output -m set --match-set localnetwork dst -j RETURN
-A openclash_output -p tcp -m owner ! --uid-owner 65534 -j REDIRECT --to-ports 7892
-A zone_docker_postrouting -m comment --comment "!fw3: Custom docker postrouting rule chain" -j postrouting_docker_rule
-A zone_docker_prerouting -m comment --comment "!fw3: Custom docker prerouting rule chain" -j prerouting_docker_rule
-A zone_lan_postrouting -m comment --comment "!fw3: Custom lan postrouting rule chain" -j postrouting_lan_rule
-A zone_lan_prerouting -m comment --comment "!fw3: Custom lan prerouting rule chain" -j prerouting_lan_rule
-A zone_wan_postrouting -m comment --comment "!fw3: Custom wan postrouting rule chain" -j postrouting_wan_rule
-A zone_wan_postrouting -m comment --comment "!fw3" -j FULLCONENAT
-A zone_wan_prerouting -m comment --comment "!fw3: Custom wan prerouting rule chain" -j prerouting_wan_rule
-A zone_wan_prerouting -m comment --comment "!fw3" -j FULLCONENAT
COMMIT
# Completed on Sat Jan 14 16:26:37 2023

#IPv4 Mangle chain

# Generated by iptables-save v1.8.7 on Sat Jan 14 16:26:37 2023
*mangle
:PREROUTING ACCEPT [423877:434726716]
:INPUT ACCEPT [421890:434347930]
:FORWARD ACCEPT [2609:496957]
:OUTPUT ACCEPT [324506:447063768]
:POSTROUTING ACCEPT [327015:447554882]
:clash - [0:0]
:openclash - [0:0]
:openclash_dns_hijack - [0:0]
:openclash_output - [0:0]
-A PREROUTING -p udp -j openclash
-A PREROUTING -p tcp -m tcp --dport 53 -j openclash_dns_hijack
-A PREROUTING -p udp -m multiport --dports 22,53,123,587,465,995,993,143,80,443,8080 -j clash
-A FORWARD -o pppoe-wan -p tcp -m tcp --tcp-flags SYN,RST SYN -m comment --comment "!fw3: Zone wan MTU fixing" -j TCPMSS --clamp-mss-to-pmtu
-A FORWARD -i pppoe-wan -p tcp -m tcp --tcp-flags SYN,RST SYN -m comment --comment "!fw3: Zone wan MTU fixing" -j TCPMSS --clamp-mss-to-pmtu
-A FORWARD -o eth3 -p tcp -m tcp --tcp-flags SYN,RST SYN -m comment --comment "!fw3: Zone wan MTU fixing" -j TCPMSS --clamp-mss-to-pmtu
-A FORWARD -i eth3 -p tcp -m tcp --tcp-flags SYN,RST SYN -m comment --comment "!fw3: Zone wan MTU fixing" -j TCPMSS --clamp-mss-to-pmtu
-A OUTPUT -j openclash_output
-A openclash -p udp -m udp --sport 500 -j RETURN
-A openclash -p udp -m udp --sport 68 -j RETURN
-A openclash -i utun -j RETURN
-A openclash -m set --match-set localnetwork dst -j RETURN
-A openclash -j MARK --set-xmark 0x162/0xffffffff
-A openclash_dns_hijack -p tcp -m comment --comment "OpenClash TCP DNS Hijack" -m tcp --dport 53 -j MARK --set-xmark 0x162/0xffffffff
-A openclash_output -p udp -m udp --sport 500 -j RETURN
-A openclash_output -p udp -m udp --sport 68 -j RETURN
-A openclash_output -m set --match-set localnetwork dst -j RETURN
-A openclash_output -d 198.18.0.0/16 -p udp -m owner ! --uid-owner 65534 -j MARK --set-xmark 0x162/0xffffffff
COMMIT
# Completed on Sat Jan 14 16:26:37 2023

#IPv4 Filter chain

# Generated by iptables-save v1.8.7 on Sat Jan 14 16:26:37 2023
*filter
:INPUT ACCEPT [41:8859]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [0:0]
:DOCKER - [0:0]
:DOCKER-ISOLATION-STAGE-1 - [0:0]
:DOCKER-ISOLATION-STAGE-2 - [0:0]
:DOCKER-USER - [0:0]
:forwarding_docker_rule - [0:0]
:forwarding_lan_rule - [0:0]
:forwarding_rule - [0:0]
:forwarding_wan_rule - [0:0]
:input_docker_rule - [0:0]
:input_lan_rule - [0:0]
:input_rule - [0:0]
:input_wan_rule - [0:0]
:openclash_wan_input - [0:0]
:output_docker_rule - [0:0]
:output_lan_rule - [0:0]
:output_rule - [0:0]
:output_wan_rule - [0:0]
:reject - [0:0]
:syn_flood - [0:0]
:zone_docker_dest_ACCEPT - [0:0]
:zone_docker_forward - [0:0]
:zone_docker_input - [0:0]
:zone_docker_output - [0:0]
:zone_docker_src_ACCEPT - [0:0]
:zone_lan_dest_ACCEPT - [0:0]
:zone_lan_forward - [0:0]
:zone_lan_input - [0:0]
:zone_lan_output - [0:0]
:zone_lan_src_ACCEPT - [0:0]
:zone_wan_dest_ACCEPT - [0:0]
:zone_wan_dest_REJECT - [0:0]
:zone_wan_forward - [0:0]
:zone_wan_input - [0:0]
:zone_wan_output - [0:0]
:zone_wan_src_REJECT - [0:0]
-A INPUT -i eth3 -m set ! --match-set localnetwork src -j openclash_wan_input
-A INPUT -i pppoe-wan -m set ! --match-set localnetwork src -j openclash_wan_input
-A INPUT -i lo -m comment --comment "!fw3" -j ACCEPT
-A INPUT -m comment --comment "!fw3: Custom input rule chain" -j input_rule
-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment "!fw3" -j ACCEPT
-A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -m comment --comment "!fw3" -j syn_flood
-A INPUT -i br-lan -m comment --comment "!fw3" -j zone_lan_input
-A INPUT -i pppoe-wan -m comment --comment "!fw3" -j zone_wan_input
-A INPUT -i eth3 -m comment --comment "!fw3" -j zone_wan_input
-A INPUT -i docker0 -m comment --comment "!fw3" -j zone_docker_input
-A FORWARD -o utun -p udp -m udp --dport 443 -m comment --comment "OpenClash QUIC REJECT" -m set ! --match-set china_ip_route dst -j REJECT --reject-with icmp-port-unreachable
-A FORWARD -o utun -m comment --comment "OpenClash TUN Forward" -j ACCEPT
-A FORWARD -j DOCKER-USER
-A FORWARD -j DOCKER-ISOLATION-STAGE-1
-A FORWARD -o docker0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -o docker0 -j DOCKER
-A FORWARD -i docker0 ! -o docker0 -j ACCEPT
-A FORWARD -i docker0 -o docker0 -j ACCEPT
-A FORWARD -m comment --comment "!fw3: Custom forwarding rule chain" -j forwarding_rule
-A FORWARD -m comment --comment "!fw3: Traffic offloading" -m conntrack --ctstate RELATED,ESTABLISHED -j FLOWOFFLOAD
-A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment "!fw3" -j ACCEPT
-A FORWARD -i br-lan -m comment --comment "!fw3" -j zone_lan_forward
-A FORWARD -i pppoe-wan -m comment --comment "!fw3" -j zone_wan_forward
-A FORWARD -i eth3 -m comment --comment "!fw3" -j zone_wan_forward
-A FORWARD -i docker0 -m comment --comment "!fw3" -j zone_docker_forward
-A FORWARD -m comment --comment "!fw3" -j reject
-A OUTPUT -o lo -m comment --comment "!fw3" -j ACCEPT
-A OUTPUT -m comment --comment "!fw3: Custom output rule chain" -j output_rule
-A OUTPUT -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment "!fw3" -j ACCEPT
-A OUTPUT -o br-lan -m comment --comment "!fw3" -j zone_lan_output
-A OUTPUT -o pppoe-wan -m comment --comment "!fw3" -j zone_wan_output
-A OUTPUT -o eth3 -m comment --comment "!fw3" -j zone_wan_output
-A OUTPUT -o docker0 -m comment --comment "!fw3" -j zone_docker_output
-A DOCKER-ISOLATION-STAGE-1 -i docker0 ! -o docker0 -j DOCKER-ISOLATION-STAGE-2
-A DOCKER-ISOLATION-STAGE-1 -j RETURN
-A DOCKER-ISOLATION-STAGE-2 -o docker0 -j DROP
-A DOCKER-ISOLATION-STAGE-2 -j RETURN
-A DOCKER-USER -i eth3 -o docker0 -j REJECT --reject-with icmp-port-unreachable
-A DOCKER-USER -j RETURN
-A openclash_wan_input -p udp -m multiport --dports 7892,7895,9090,7890,7891,7893,7874 -j REJECT --reject-with icmp-port-unreachable
-A openclash_wan_input -p tcp -m multiport --dports 7892,7895,9090,7890,7891,7893,7874 -j REJECT --reject-with icmp-port-unreachable
-A reject -p tcp -m comment --comment "!fw3" -j REJECT --reject-with tcp-reset
-A reject -m comment --comment "!fw3" -j REJECT --reject-with icmp-port-unreachable
-A syn_flood -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -m limit --limit 25/sec --limit-burst 50 -m comment --comment "!fw3" -j RETURN
-A syn_flood -m comment --comment "!fw3" -j DROP
-A zone_docker_dest_ACCEPT -o docker0 -m comment --comment "!fw3" -j ACCEPT
-A zone_docker_forward -m comment --comment "!fw3: Custom docker forwarding rule chain" -j forwarding_docker_rule
-A zone_docker_forward -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port forwards" -j ACCEPT
-A zone_docker_forward -m comment --comment "!fw3" -j zone_docker_dest_ACCEPT
-A zone_docker_input -m comment --comment "!fw3: Custom docker input rule chain" -j input_docker_rule
-A zone_docker_input -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port redirections" -j ACCEPT
-A zone_docker_input -m comment --comment "!fw3" -j zone_docker_src_ACCEPT
-A zone_docker_output -m comment --comment "!fw3: Custom docker output rule chain" -j output_docker_rule
-A zone_docker_output -m comment --comment "!fw3" -j zone_docker_dest_ACCEPT
-A zone_docker_src_ACCEPT -i docker0 -m conntrack --ctstate NEW,UNTRACKED -m comment --comment "!fw3" -j ACCEPT
-A zone_lan_dest_ACCEPT -o br-lan -m comment --comment "!fw3" -j ACCEPT
-A zone_lan_forward -m comment --comment "!fw3: Custom lan forwarding rule chain" -j forwarding_lan_rule
-A zone_lan_forward -m comment --comment "!fw3: Zone lan to wan forwarding policy" -j zone_wan_dest_ACCEPT
-A zone_lan_forward -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port forwards" -j ACCEPT
-A zone_lan_forward -m comment --comment "!fw3" -j zone_lan_dest_ACCEPT
-A zone_lan_input -m comment --comment "!fw3: Custom lan input rule chain" -j input_lan_rule
-A zone_lan_input -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port redirections" -j ACCEPT
-A zone_lan_input -m comment --comment "!fw3" -j zone_lan_src_ACCEPT
-A zone_lan_output -m comment --comment "!fw3: Custom lan output rule chain" -j output_lan_rule
-A zone_lan_output -m comment --comment "!fw3" -j zone_lan_dest_ACCEPT
-A zone_lan_src_ACCEPT -i br-lan -m conntrack --ctstate NEW,UNTRACKED -m comment --comment "!fw3" -j ACCEPT
-A zone_wan_dest_ACCEPT -o pppoe-wan -m conntrack --ctstate INVALID -m comment --comment "!fw3: Prevent NAT leakage" -j DROP
-A zone_wan_dest_ACCEPT -o pppoe-wan -m comment --comment "!fw3" -j ACCEPT
-A zone_wan_dest_ACCEPT -o eth3 -m conntrack --ctstate INVALID -m comment --comment "!fw3: Prevent NAT leakage" -j DROP
-A zone_wan_dest_ACCEPT -o eth3 -m comment --comment "!fw3" -j ACCEPT
-A zone_wan_dest_REJECT -o pppoe-wan -m comment --comment "!fw3" -j reject
-A zone_wan_dest_REJECT -o eth3 -m comment --comment "!fw3" -j reject
-A zone_wan_forward -m comment --comment "!fw3: Custom wan forwarding rule chain" -j forwarding_wan_rule
-A zone_wan_forward -p esp -m comment --comment "!fw3: Allow-IPSec-ESP" -j zone_lan_dest_ACCEPT
-A zone_wan_forward -p udp -m udp --dport 500 -m comment --comment "!fw3: Allow-ISAKMP" -j zone_lan_dest_ACCEPT
-A zone_wan_forward -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port forwards" -j ACCEPT
-A zone_wan_forward -m comment --comment "!fw3" -j zone_wan_dest_REJECT
-A zone_wan_input -m comment --comment "!fw3: Custom wan input rule chain" -j input_wan_rule
-A zone_wan_input -p udp -m udp --dport 68 -m comment --comment "!fw3: Allow-DHCP-Renew" -j ACCEPT
-A zone_wan_input -p icmp -m icmp --icmp-type 8 -m comment --comment "!fw3: Allow-Ping" -j ACCEPT
-A zone_wan_input -p igmp -m comment --comment "!fw3: Allow-IGMP" -j ACCEPT
-A zone_wan_input -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port redirections" -j ACCEPT
-A zone_wan_input -m comment --comment "!fw3" -j zone_wan_src_REJECT
-A zone_wan_output -m comment --comment "!fw3: Custom wan output rule chain" -j output_wan_rule
-A zone_wan_output -m comment --comment "!fw3" -j zone_wan_dest_ACCEPT
-A zone_wan_src_REJECT -i pppoe-wan -m comment --comment "!fw3" -j reject
-A zone_wan_src_REJECT -i eth3 -m comment --comment "!fw3" -j reject
COMMIT
# Completed on Sat Jan 14 16:26:37 2023

#IPv6 NAT chain

# Generated by ip6tables-save v1.8.7 on Sat Jan 14 16:26:37 2023
*nat
:PREROUTING ACCEPT [295:29273]
:INPUT ACCEPT [268:25111]
:OUTPUT ACCEPT [375:29990]
:POSTROUTING ACCEPT [401:34000]
:clashv6_dns - [0:0]
-A PREROUTING -d 2001:4860:4860::8844/128 -p tcp -m comment --comment "OpenClash Google DNS Hijack" -m tcp --dport 53 -j ACCEPT
-A PREROUTING -d 2001:4860:4860::8888/128 -p tcp -m comment --comment "OpenClash Google DNS Hijack" -m tcp --dport 53 -j ACCEPT
-A PREROUTING -p udp -m udp --dport 53 -j clashv6_dns
-A PREROUTING -p udp -m udp --dport 53 -j clashv6_dns
-A PREROUTING -p udp -m udp --dport 53 -j clashv6_dns
-A PREROUTING -p udp -m udp --dport 53 -j clashv6_dns
-A PREROUTING -p udp -m udp --dport 53 -j clashv6_dns
-A PREROUTING -p udp -m udp --dport 53 -j clashv6_dns
-A PREROUTING -p udp -m udp --dport 53 -j clashv6_dns
-A PREROUTING -p udp -m udp --dport 53 -j clashv6_dns
-A PREROUTING -p udp -m udp --dport 53 -j clashv6_dns
COMMIT
# Completed on Sat Jan 14 16:26:37 2023

#IPv6 Mangle chain

# Generated by ip6tables-save v1.8.7 on Sat Jan 14 16:26:37 2023
*mangle
:PREROUTING ACCEPT [1557:313065]
:INPUT ACCEPT [1450:238942]
:FORWARD ACCEPT [787:217481]
:OUTPUT ACCEPT [2255:210151]
:POSTROUTING ACCEPT [3039:427360]
:clashv6 - [0:0]
:openclash - [0:0]
:openclash_output - [0:0]
-A PREROUTING -p udp -m multiport --dports 22,53,123,587,465,995,993,143,80,443,8080 -j clashv6
-A PREROUTING -j openclash
-A FORWARD -o pppoe-wan -p tcp -m tcp --tcp-flags SYN,RST SYN -m comment --comment "!fw3: Zone wan MTU fixing" -j TCPMSS --clamp-mss-to-pmtu
-A FORWARD -i pppoe-wan -p tcp -m tcp --tcp-flags SYN,RST SYN -m comment --comment "!fw3: Zone wan MTU fixing" -j TCPMSS --clamp-mss-to-pmtu
-A FORWARD -o eth3 -p tcp -m tcp --tcp-flags SYN,RST SYN -m comment --comment "!fw3: Zone wan MTU fixing" -j TCPMSS --clamp-mss-to-pmtu
-A FORWARD -i eth3 -p tcp -m tcp --tcp-flags SYN,RST SYN -m comment --comment "!fw3: Zone wan MTU fixing" -j TCPMSS --clamp-mss-to-pmtu
-A OUTPUT -j openclash_output
-A openclash -p udp -m udp --sport 500 -j RETURN
-A openclash -p udp -m udp --sport 546 -j RETURN
-A openclash -m set --match-set localnetwork6 dst -j RETURN
-A openclash -p udp -m udp --dport 53 -j RETURN
-A openclash -p tcp -m comment --comment "OpenClash TCP Tproxy" -j TPROXY --on-port 7895 --on-ip :: --tproxy-mark 0x162/0xffffffff
-A openclash -p udp -m comment --comment "OpenClash UDP Tproxy" -j TPROXY --on-port 7895 --on-ip :: --tproxy-mark 0x162/0xffffffff
-A openclash_output -p udp -m udp --sport 500 -j RETURN
-A openclash_output -p udp -m udp --sport 546 -j RETURN
-A openclash_output -m set --match-set localnetwork6 dst -j RETURN
-A openclash_output -p tcp -m owner ! --uid-owner 65534 -j MARK --set-xmark 0x162/0xffffffff
COMMIT
# Completed on Sat Jan 14 16:26:37 2023

#IPv6 Filter chain

# Generated by ip6tables-save v1.8.7 on Sat Jan 14 16:26:37 2023
*filter
:INPUT ACCEPT [0:0]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [0:0]
:forwarding_docker_rule - [0:0]
:forwarding_lan_rule - [0:0]
:forwarding_rule - [0:0]
:forwarding_wan_rule - [0:0]
:input_docker_rule - [0:0]
:input_lan_rule - [0:0]
:input_rule - [0:0]
:input_wan_rule - [0:0]
:openclash_wan_input - [0:0]
:output_docker_rule - [0:0]
:output_lan_rule - [0:0]
:output_rule - [0:0]
:output_wan_rule - [0:0]
:reject - [0:0]
:syn_flood - [0:0]
:zone_docker_dest_ACCEPT - [0:0]
:zone_docker_forward - [0:0]
:zone_docker_input - [0:0]
:zone_docker_output - [0:0]
:zone_docker_src_ACCEPT - [0:0]
:zone_lan_dest_ACCEPT - [0:0]
:zone_lan_forward - [0:0]
:zone_lan_input - [0:0]
:zone_lan_output - [0:0]
:zone_lan_src_ACCEPT - [0:0]
:zone_wan_dest_ACCEPT - [0:0]
:zone_wan_dest_REJECT - [0:0]
:zone_wan_forward - [0:0]
:zone_wan_input - [0:0]
:zone_wan_output - [0:0]
:zone_wan_src_REJECT - [0:0]
-A INPUT -i eth3 -m set --match-set localnetwork6 src -j openclash_wan_input
-A INPUT -i eth3 -m set --match-set localnetwork6 src -j openclash_wan_input
-A INPUT -p udp -m udp --dport 443 -m comment --comment "OpenClash QUIC REJECT" -m set ! --match-set china_ip6_route dst -j REJECT --reject-with icmp6-port-unreachable
-A INPUT -i lo -m comment --comment "!fw3" -j ACCEPT
-A INPUT -m comment --comment "!fw3: Custom input rule chain" -j input_rule
-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment "!fw3" -j ACCEPT
-A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -m comment --comment "!fw3" -j syn_flood
-A INPUT -i br-lan -m comment --comment "!fw3" -j zone_lan_input
-A INPUT -i pppoe-wan -m comment --comment "!fw3" -j zone_wan_input
-A INPUT -i eth3 -m comment --comment "!fw3" -j zone_wan_input
-A INPUT -i docker0 -m comment --comment "!fw3" -j zone_docker_input
-A FORWARD -o utun -p udp -m udp --dport 443 -m comment --comment ShellClash-QUIC-REJECT -j REJECT --reject-with icmp6-port-unreachable
-A FORWARD -o utun -p udp -m udp --dport 443 -m comment --comment ShellClash-QUIC-REJECT -j REJECT --reject-with icmp6-port-unreachable
-A FORWARD -o utun -p udp -m udp --dport 443 -m comment --comment ShellClash-QUIC-REJECT -j REJECT --reject-with icmp6-port-unreachable
-A FORWARD -o utun -p udp -m udp --dport 443 -m comment --comment ShellClash-QUIC-REJECT -j REJECT --reject-with icmp6-port-unreachable
-A FORWARD -o utun -p udp -m udp --dport 443 -m comment --comment ShellClash-QUIC-REJECT -j REJECT --reject-with icmp6-port-unreachable
-A FORWARD -o utun -p udp -m udp --dport 443 -m comment --comment ShellClash-QUIC-REJECT -j REJECT --reject-with icmp6-port-unreachable
-A FORWARD -o utun -p udp -m udp --dport 443 -m comment --comment ShellClash-QUIC-REJECT -j REJECT --reject-with icmp6-port-unreachable
-A FORWARD -o utun -p udp -m udp --dport 443 -m comment --comment ShellClash-QUIC-REJECT -j REJECT --reject-with icmp6-port-unreachable
-A FORWARD -o utun -p udp -m udp --dport 443 -m comment --comment ShellClash-QUIC-REJECT -j REJECT --reject-with icmp6-port-unreachable
-A FORWARD -o utun -p udp -m udp --dport 443 -m comment --comment ShellClash-QUIC-REJECT -j REJECT --reject-with icmp6-port-unreachable
-A FORWARD -o utun -p udp -m udp --dport 443 -m comment --comment ShellClash-QUIC-REJECT -j REJECT --reject-with icmp6-port-unreachable
-A FORWARD -o utun -p udp -m udp --dport 443 -m comment --comment ShellClash-QUIC-REJECT -j REJECT --reject-with icmp6-port-unreachable
-A FORWARD -o utun -p udp -m udp --dport 443 -m comment --comment ShellClash-QUIC-REJECT -j REJECT --reject-with icmp6-port-unreachable
-A FORWARD -o utun -p udp -m udp --dport 443 -m comment --comment ShellClash-QUIC-REJECT -j REJECT --reject-with icmp6-port-unreachable
-A FORWARD -o utun -p udp -m udp --dport 443 -m comment --comment ShellClash-QUIC-REJECT -j REJECT --reject-with icmp6-port-unreachable
-A FORWARD -o utun -p udp -m udp --dport 443 -m comment --comment ShellClash-QUIC-REJECT -j REJECT --reject-with icmp6-port-unreachable
-A FORWARD -o utun -p udp -m udp --dport 443 -m comment --comment ShellClash-QUIC-REJECT -j REJECT --reject-with icmp6-port-unreachable
-A FORWARD -o utun -p udp -m udp --dport 443 -m comment --comment ShellClash-QUIC-REJECT -j REJECT --reject-with icmp6-port-unreachable
-A FORWARD -o utun -p udp -m udp --dport 443 -m comment --comment ShellClash-QUIC-REJECT -j REJECT --reject-with icmp6-port-unreachable
-A FORWARD -o utun -p udp -m udp --dport 443 -m comment --comment ShellClash-QUIC-REJECT -j REJECT --reject-with icmp6-port-unreachable
-A FORWARD -o utun -p udp -m udp --dport 443 -m comment --comment ShellClash-QUIC-REJECT -j REJECT --reject-with icmp6-port-unreachable
-A FORWARD -o utun -p udp -m udp --dport 443 -m comment --comment ShellClash-QUIC-REJECT -j REJECT --reject-with icmp6-port-unreachable
-A FORWARD -o utun -p udp -m udp --dport 443 -m comment --comment ShellClash-QUIC-REJECT -j REJECT --reject-with icmp6-port-unreachable
-A FORWARD -o utun -p udp -m udp --dport 443 -m comment --comment ShellClash-QUIC-REJECT -j REJECT --reject-with icmp6-port-unreachable
-A FORWARD -o utun -p udp -m udp --dport 443 -m comment --comment ShellClash-QUIC-REJECT -j REJECT --reject-with icmp6-port-unreachable
-A FORWARD -o utun -p udp -m udp --dport 443 -m comment --comment ShellClash-QUIC-REJECT -j REJECT --reject-with icmp6-port-unreachable
-A FORWARD -o utun -p udp -m udp --dport 443 -m comment --comment ShellClash-QUIC-REJECT -j REJECT --reject-with icmp6-port-unreachable
-A FORWARD -o utun -p udp -m udp --dport 443 -m comment --comment ShellClash-QUIC-REJECT -j REJECT --reject-with icmp6-port-unreachable
-A FORWARD -o utun -p udp -m udp --dport 443 -m comment --comment ShellClash-QUIC-REJECT -j REJECT --reject-with icmp6-port-unreachable
-A FORWARD -o utun -p udp -m udp --dport 443 -m comment --comment ShellClash-QUIC-REJECT -j REJECT --reject-with icmp6-port-unreachable
-A FORWARD -o utun -p udp -m udp --dport 443 -m comment --comment ShellClash-QUIC-REJECT -j REJECT --reject-with icmp6-port-unreachable
-A FORWARD -o utun -p udp -m udp --dport 443 -m comment --comment ShellClash-QUIC-REJECT -j REJECT --reject-with icmp6-port-unreachable
-A FORWARD -o utun -p udp -m udp --dport 443 -m comment --comment ShellClash-QUIC-REJECT -j REJECT --reject-with icmp6-port-unreachable
-A FORWARD -o utun -p udp -m udp --dport 443 -m comment --comment ShellClash-QUIC-REJECT -j REJECT --reject-with icmp6-port-unreachable
-A FORWARD -m comment --comment "!fw3: Custom forwarding rule chain" -j forwarding_rule
-A FORWARD -m comment --comment "!fw3: Traffic offloading" -m conntrack --ctstate RELATED,ESTABLISHED -j FLOWOFFLOAD
-A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment "!fw3" -j ACCEPT
-A FORWARD -i br-lan -m comment --comment "!fw3" -j zone_lan_forward
-A FORWARD -i pppoe-wan -m comment --comment "!fw3" -j zone_wan_forward
-A FORWARD -i eth3 -m comment --comment "!fw3" -j zone_wan_forward
-A FORWARD -i docker0 -m comment --comment "!fw3" -j zone_docker_forward
-A FORWARD -m comment --comment "!fw3" -j reject
-A OUTPUT -o lo -m comment --comment "!fw3" -j ACCEPT
-A OUTPUT -m comment --comment "!fw3: Custom output rule chain" -j output_rule
-A OUTPUT -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment "!fw3" -j ACCEPT
-A OUTPUT -o br-lan -m comment --comment "!fw3" -j zone_lan_output
-A OUTPUT -o pppoe-wan -m comment --comment "!fw3" -j zone_wan_output
-A OUTPUT -o eth3 -m comment --comment "!fw3" -j zone_wan_output
-A OUTPUT -o docker0 -m comment --comment "!fw3" -j zone_docker_output
-A openclash_wan_input -p udp -m multiport --dports 7892,7895,9090,7890,7891,7893,7874 -j REJECT --reject-with icmp6-port-unreachable
-A openclash_wan_input -p tcp -m multiport --dports 7892,7895,9090,7890,7891,7893,7874 -j REJECT --reject-with icmp6-port-unreachable
-A reject -p tcp -m comment --comment "!fw3" -j REJECT --reject-with tcp-reset
-A reject -m comment --comment "!fw3" -j REJECT --reject-with icmp6-port-unreachable
-A syn_flood -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -m limit --limit 25/sec --limit-burst 50 -m comment --comment "!fw3" -j RETURN
-A syn_flood -m comment --comment "!fw3" -j DROP
-A zone_docker_dest_ACCEPT -o docker0 -m comment --comment "!fw3" -j ACCEPT
-A zone_docker_forward -m comment --comment "!fw3: Custom docker forwarding rule chain" -j forwarding_docker_rule
-A zone_docker_forward -m comment --comment "!fw3" -j zone_docker_dest_ACCEPT
-A zone_docker_input -m comment --comment "!fw3: Custom docker input rule chain" -j input_docker_rule
-A zone_docker_input -m comment --comment "!fw3" -j zone_docker_src_ACCEPT
-A zone_docker_output -m comment --comment "!fw3: Custom docker output rule chain" -j output_docker_rule
-A zone_docker_output -m comment --comment "!fw3" -j zone_docker_dest_ACCEPT
-A zone_docker_src_ACCEPT -i docker0 -m conntrack --ctstate NEW,UNTRACKED -m comment --comment "!fw3" -j ACCEPT
-A zone_lan_dest_ACCEPT -o br-lan -m comment --comment "!fw3" -j ACCEPT
-A zone_lan_forward -m comment --comment "!fw3: Custom lan forwarding rule chain" -j forwarding_lan_rule
-A zone_lan_forward -m comment --comment "!fw3: Zone lan to wan forwarding policy" -j zone_wan_dest_ACCEPT
-A zone_lan_forward -m comment --comment "!fw3" -j zone_lan_dest_ACCEPT
-A zone_lan_input -m comment --comment "!fw3: Custom lan input rule chain" -j input_lan_rule
-A zone_lan_input -m comment --comment "!fw3" -j zone_lan_src_ACCEPT
-A zone_lan_output -m comment --comment "!fw3: Custom lan output rule chain" -j output_lan_rule
-A zone_lan_output -m comment --comment "!fw3" -j zone_lan_dest_ACCEPT
-A zone_lan_src_ACCEPT -i br-lan -m conntrack --ctstate NEW,UNTRACKED -m comment --comment "!fw3" -j ACCEPT
-A zone_wan_dest_ACCEPT -o pppoe-wan -m conntrack --ctstate INVALID -m comment --comment "!fw3: Prevent NAT leakage" -j DROP
-A zone_wan_dest_ACCEPT -o pppoe-wan -m comment --comment "!fw3" -j ACCEPT
-A zone_wan_dest_ACCEPT -o eth3 -m conntrack --ctstate INVALID -m comment --comment "!fw3: Prevent NAT leakage" -j DROP
-A zone_wan_dest_ACCEPT -o eth3 -m comment --comment "!fw3" -j ACCEPT
-A zone_wan_dest_REJECT -o pppoe-wan -m comment --comment "!fw3" -j reject
-A zone_wan_dest_REJECT -o eth3 -m comment --comment "!fw3" -j reject
-A zone_wan_forward -m comment --comment "!fw3: Custom wan forwarding rule chain" -j forwarding_wan_rule
-A zone_wan_forward -p ipv6-icmp -m icmp6 --icmpv6-type 128 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Forward" -j ACCEPT
-A zone_wan_forward -p ipv6-icmp -m icmp6 --icmpv6-type 129 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Forward" -j ACCEPT
-A zone_wan_forward -p ipv6-icmp -m icmp6 --icmpv6-type 1 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Forward" -j ACCEPT
-A zone_wan_forward -p ipv6-icmp -m icmp6 --icmpv6-type 2 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Forward" -j ACCEPT
-A zone_wan_forward -p ipv6-icmp -m icmp6 --icmpv6-type 3 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Forward" -j ACCEPT
-A zone_wan_forward -p ipv6-icmp -m icmp6 --icmpv6-type 4/0 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Forward" -j ACCEPT
-A zone_wan_forward -p ipv6-icmp -m icmp6 --icmpv6-type 4/1 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Forward" -j ACCEPT
-A zone_wan_forward -p esp -m comment --comment "!fw3: Allow-IPSec-ESP" -j zone_lan_dest_ACCEPT
-A zone_wan_forward -p udp -m udp --dport 500 -m comment --comment "!fw3: Allow-ISAKMP" -j zone_lan_dest_ACCEPT
-A zone_wan_forward -m comment --comment "!fw3" -j zone_wan_dest_REJECT
-A zone_wan_input -m comment --comment "!fw3: Custom wan input rule chain" -j input_wan_rule
-A zone_wan_input -p udp -m udp --dport 546 -m comment --comment "!fw3: Allow-DHCPv6" -j ACCEPT
-A zone_wan_input -s fe80::/10 -p ipv6-icmp -m icmp6 --icmpv6-type 130/0 -m comment --comment "!fw3: Allow-MLD" -j ACCEPT
-A zone_wan_input -s fe80::/10 -p ipv6-icmp -m icmp6 --icmpv6-type 131/0 -m comment --comment "!fw3: Allow-MLD" -j ACCEPT
-A zone_wan_input -s fe80::/10 -p ipv6-icmp -m icmp6 --icmpv6-type 132/0 -m comment --comment "!fw3: Allow-MLD" -j ACCEPT
-A zone_wan_input -s fe80::/10 -p ipv6-icmp -m icmp6 --icmpv6-type 143/0 -m comment --comment "!fw3: Allow-MLD" -j ACCEPT
-A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 128 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT
-A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 129 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT
-A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 1 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT
-A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 2 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT
-A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 3 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT
-A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 4/0 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT
-A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 4/1 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT
-A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 133 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT
-A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 135 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT
-A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 134 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT
-A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 136 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT
-A zone_wan_input -m comment --comment "!fw3" -j zone_wan_src_REJECT
-A zone_wan_output -m comment --comment "!fw3: Custom wan output rule chain" -j output_wan_rule
-A zone_wan_output -m comment --comment "!fw3" -j zone_wan_dest_ACCEPT
-A zone_wan_src_REJECT -i pppoe-wan -m comment --comment "!fw3" -j reject
-A zone_wan_src_REJECT -i eth3 -m comment --comment "!fw3" -j reject
COMMIT
# Completed on Sat Jan 14 16:26:37 2023

#===================== IPSET状态 =====================#

Name: china_ip_route
Name: localnetwork
Name: china_ip6_route
Name: localnetwork6
Name: acl_neteasemusic_http
Name: acl_neteasemusic_https
Name: neteasemusic

#===================== 路由表状态 =====================#

#route -n
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         115.192.184.1   0.0.0.0         UG    0      0        0 pppoe-wan
115.192.184.1   0.0.0.0         255.255.255.255 UH    0      0        0 pppoe-wan
172.17.0.0      0.0.0.0         255.255.0.0     U     0      0        0 docker0
192.168.1.0     0.0.0.0         255.255.255.0   U     0      0        0 br-lan
198.18.0.0      0.0.0.0         255.255.255.252 U     0      0        0 utun
#ip route list
default via 115.192.184.1 dev pppoe-wan proto static 
115.192.184.1 dev pppoe-wan proto kernel scope link src *WAN IP*.69 
172.17.0.0/16 dev docker0 proto kernel scope link src 172.17.0.1 linkdown 
192.168.1.0/24 dev br-lan proto kernel scope link src 192.168.1.1 
198.18.0.0/30 dev utun proto kernel scope link src 198.18.0.1 
#ip rule show
0:  from all lookup local
32765:  from all fwmark 0x162 lookup 354
32766:  from all lookup main
32767:  from all lookup default

#===================== Tun设备状态 =====================#

utun: tun

#===================== 端口占用状态 =====================#

tcp        0      0 :::9090                 :::*                    LISTEN      10388/clash
tcp        0      0 :::7890                 :::*                    LISTEN      10388/clash
tcp        0      0 :::7891                 :::*                    LISTEN      10388/clash
tcp        0      0 :::7892                 :::*                    LISTEN      10388/clash
tcp        0      0 :::7893                 :::*                    LISTEN      10388/clash
tcp        0      0 :::7895                 :::*                    LISTEN      10388/clash
udp        0      0 :::48202                :::*                                10388/clash
udp        0      0 :::58979                :::*                                10388/clash
udp        0      0 :::7874                 :::*                                10388/clash
udp        0      0 :::7891                 :::*                                10388/clash
udp        0      0 :::7892                 :::*                                10388/clash
udp        0      0 :::7893                 :::*                                10388/clash
udp        0      0 :::7895                 :::*                                10388/clash
udp        0      0 :::37606                :::*                                10388/clash
udp        0      0 :::44779                :::*                                10388/clash

#===================== 测试本机DNS查询 =====================#

Server:     127.0.0.1
Address:    127.0.0.1#53

Name:      www.baidu.com
Address 1: 198.18.0.54
*** Can't find www.baidu.com: No answer

#===================== resolv.conf.auto =====================#

# Interface wan
nameserver 223.6.6.6
nameserver 223.5.5.5
# Interface wan6
nameserver 2400:3200::1
nameserver 2400:3200:baba::1
# Interface wan_6

#===================== resolv.conf.d =====================#

# Interface wan
nameserver 223.6.6.6
nameserver 223.5.5.5
# Interface wan6
nameserver 2400:3200::1
nameserver 2400:3200:baba::1
# Interface wan_6

#===================== 测试本机网络连接 =====================#

HTTP/1.1 200 OK
Accept-Ranges: bytes
Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform
Connection: keep-alive
Content-Length: 277
Content-Type: text/html
Date: Sat, 14 Jan 2023 08:26:38 GMT
Etag: "575e1f60-115"
Last-Modified: Mon, 13 Jun 2016 02:50:08 GMT
Pragma: no-cache
Server: bfe/1.0.8.18

#===================== 测试本机网络下载 =====================#

HTTP/2 200 
cache-control: max-age=300
content-security-policy: default-src 'none'; style-src 'unsafe-inline'; sandbox
content-type: text/plain; charset=utf-8
etag: "99593e4235822e9fb3fd0060c09aa3aa61d3844bbd6a1fe4bf92b0469522b25f"
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
x-frame-options: deny
x-xss-protection: 1; mode=block
x-github-request-id: 25CA:47CE:23CAE:3C572:63BF20EA
accept-ranges: bytes
date: Sat, 14 Jan 2023 08:26:38 GMT
via: 1.1 varnish
x-served-by: cache-hkg17932-HKG
x-cache: HIT
x-cache-hits: 1
x-timer: S1673684799.758711,VS0,VE1
vary: Authorization,Accept-Encoding,Origin
access-control-allow-origin: *
x-fastly-request-id: 2e41cd12b97a7952e42bd022d592075a4f73b89b
expires: Sat, 14 Jan 2023 08:31:38 GMT
source-age: 36
content-length: 80

#===================== 最近运行日志 =====================#

time="2023-01-14T08:17:37Z" level=info msg="Initial configuration complete, total time: 1459ms"
time="2023-01-14T08:17:37Z" level=info msg="Authentication of local server updated"
time="2023-01-14T08:17:37Z" level=info msg="Sniffer is loaded and working"
time="2023-01-14T08:17:37Z" level=info msg="DNS server listening at: [::]:7874"
time="2023-01-14T08:17:37Z" level=info msg="Start initial compatible provider Manual"
time="2023-01-14T08:17:37Z" level=info msg="Start initial compatible provider e-hentai"
time="2023-01-14T08:17:37Z" level=info msg="Start initial compatible provider Auto"
time="2023-01-14T08:17:37Z" level=info msg="Start initial compatible provider DST-PORT"
time="2023-01-14T08:17:37Z" level=info msg="RESTful API listening at: [::]:9090"
time="2023-01-14T08:17:37Z" level=info msg="Start initial provider Airport A"
time="2023-01-14T08:17:37Z" level=info msg="Start initial provider Airport B"
time="2023-01-14T08:17:37Z" level=info msg="Start initial compatible provider ✈️PROXY"
time="2023-01-14T08:17:37Z" level=info msg="Start initial compatible provider Bilibili国台"
time="2023-01-14T08:17:37Z" level=info msg="Start initial compatible provider default"
time="2023-01-14T08:17:37Z" level=info msg="Start initial provider Proxy"
time="2023-01-14T08:17:37Z" level=info msg="Start initial provider 🎮online game"
time="2023-01-14T08:17:37Z" level=info msg="[Provider] 🎮online game not updated for a long time, force refresh"
time="2023-01-14T08:17:37Z" level=info msg="Start initial provider bt-trackers"
time="2023-01-14T08:17:37Z" level=info msg="[Provider] bt-trackers not updated for a long time, force refresh"
time="2023-01-14T08:17:37Z" level=info msg="Start initial provider domestic"
time="2023-01-14T08:17:37Z" level=info msg="Start initial provider Steam"
time="2023-01-14T08:17:37Z" level=info msg="Start initial provider Refuse"
time="2023-01-14T08:17:37Z" level=info msg="[Provider] Steam not updated for a long time, force refresh"
time="2023-01-14T08:17:37Z" level=info msg="Start initial provider SteamCN"
time="2023-01-14T08:17:37Z" level=info msg="[Provider] domestic not updated for a long time, force refresh"
time="2023-01-14T08:17:37Z" level=info msg="[Provider] SteamCN not updated for a long time, force refresh"
time="2023-01-14T08:17:37Z" level=warning msg="because Auto failed multiple times, active health check"
time="2023-01-14T08:17:37Z" level=info msg="[TCP] [Clash.Meta] --> :443 match RuleSet(Proxy) using ✈️PROXY[COMPATIBLE]"
2023-01-14 16:17:37 Step 6: Wait For The File Downloading...
2023-01-14 16:17:37 Step 7: Set Firewall Rules...
2023-01-14 16:17:38 Tip: Waiting for TUN Interface Start...
2023-01-14 16:17:31【/tmp/openclash_last_version】Download Failed:【curl: (28) Connection timeout after 10000 ms】
time="2023-01-14T08:17:42Z" level=warning msg="[TCP] dial ✈️PROXY (match GeoSite/github) invalid IP: --> raw.githubusercontent.com:443 error: dual stack dial failed:context deadline exceeded"
time="2023-01-14T08:17:42Z" level=warning msg="[TCP] dial ✈️PROXY (match GeoSite/github) invalid IP: --> raw.githubusercontent.com:443 error: all DNS requests failed, first error: read tcp4 *WAN IP*.69:42734->1.1.1.1:853: read: connection reset by peer"
time="2023-01-14T08:17:42Z" level=warning msg="[TCP] dial ✈️PROXY (match GeoSite/github) invalid IP: --> raw.githubusercontent.com:443 error: all DNS requests failed, first error: read tcp4 *WAN IP*.69:42734->1.1.1.1:853: read: connection reset by peer"
time="2023-01-14T08:17:42Z" level=warning msg="[TCP] dial ✈️PROXY (match GeoSite/github) invalid IP: --> raw.githubusercontent.com:443 error: all DNS requests failed, first error: read tcp4 *WAN IP*.69:42734->1.1.1.1:853: read: connection reset by peer"
time="2023-01-14T08:17:42Z" level=warning msg="[TCP] dial ✈️PROXY (match GeoSite/github) invalid IP: --> raw.githubusercontent.com:443 error: all DNS requests failed, first error: read tcp4 *WAN IP*.69:42734->1.1.1.1:853: read: connection reset by peer"
time="2023-01-14T08:17:42Z" level=info msg="Use IPv6"
time="2023-01-14T08:17:42Z" level=info msg="Use tcp concurrent"
time="2023-01-14T08:17:42Z" level=info msg="Use interface name: pppoe-wan"
time="2023-01-14T08:17:42Z" level=info msg="HTTP proxy listening at: [::]:7890"
time="2023-01-14T08:17:42Z" level=info msg="SOCKS proxy listening at: [::]:7891"
time="2023-01-14T08:17:42Z" level=info msg="Redirect proxy listening at: [::]:7892"
time="2023-01-14T08:17:42Z" level=info msg="TProxy server listening at: [::]:7895"
time="2023-01-14T08:17:42Z" level=info msg="Mixed(http+socks) proxy listening at: [::]:7893"
time="2023-01-14T08:17:42Z" level=info msg="[TUN] Tun adapter listening at: utun([198.18.0.1/30],[          /126]), mtu: 65535, auto route: false, ip stack: gVisor"
2023-01-14 16:17:31【/tmp/openclash_last_version】Download Failed:【curl: (35) OpenSSL SSL_connect: SSL_ERROR_SYSCALL in connection to raw.githubusercontent.com:443 】
2023-01-14 16:17:52 Step 8: Restart Dnsmasq...
2023-01-14 16:17:52 Step 9: Add Cron Rules, Start Daemons...
2023-01-14 16:17:52 OpenClash Start Successful!

#===================== 活动连接信息 =====================#

1. SourceIP:【192.168.1.244】 - Host:【gateway.facebook.com】 - DestinationIP:【】 - Network:【tcp】 - RulePayload:【gfw】 - Lastchain:【中国-香港 IEPL Equinix HK2 A 01 1Gbps HBO TVB】
2. SourceIP:【192.168.1.243】 - Host:【time.g.aaplimg.com】 - DestinationIP:【17.253.84.123】 - Network:【udp】 - RulePayload:【】 - Lastchain:【DIRECT】
3. SourceIP:【192.168.1.154】 - Host:【api.infinitynewtab.com】 - DestinationIP:【】 - Network:【tcp】 - RulePayload:【geolocation-cn】 - Lastchain:【DIRECT】
4. SourceIP:【192.168.1.154】 - Host:【Empty】 - DestinationIP:【91.108.56.170】 - Network:【tcp】 - RulePayload:【telegram】 - Lastchain:【深港专线8[倍率:2.5]】
5. SourceIP:【*WAN IP*.69】 - Host:【Empty】 - DestinationIP:【58.211.227.45】 - Network:【udp】 - RulePayload:【cn】 - Lastchain:【DIRECT】
6. SourceIP:【192.168.1.154】 - Host:【alive.github.com】 - DestinationIP:【】 - Network:【tcp】 - RulePayload:【github】 - Lastchain:【中国-香港 IEPL Equinix HK2 A 09 1Gbps HBO TVB】
7. SourceIP:【192.168.1.243】 - Host:【10-courier.push.apple.com】 - DestinationIP:【17.57.145.169】 - Network:【tcp】 - RulePayload:【】 - Lastchain:【DIRECT】
8. SourceIP:【192.168.1.154】 - Host:【github.com】 - DestinationIP:【】 - Network:【tcp】 - RulePayload:【github】 - Lastchain:【深港专线8[倍率:2.5]】
9. SourceIP:【192.168.1.243】 - Host:【time.g.aaplimg.com】 - DestinationIP:【17.253.116.125】 - Network:【udp】 - RulePayload:【】 - Lastchain:【DIRECT】
10. SourceIP:【192.168.1.154】 - Host:【ext2-tyo2.steamserver.net】 - DestinationIP:【】 - Network:【tcp】 - RulePayload:【SteamCN】 - Lastchain:【DIRECT】
11. SourceIP:【192.168.1.154】 - Host:【www.baidu.com】 - DestinationIP:【】 - Network:【tcp】 - RulePayload:【geolocation-cn】 - Lastchain:【DIRECT】
12. SourceIP:【192.168.1.154】 - Host:【i0.hdslb.com】 - DestinationIP:【】 - Network:【tcp】 - RulePayload:【bilibili】 - Lastchain:【DIRECT】
13. SourceIP:【192.168.1.154】 - Host:【www.ithome.com】 - DestinationIP:【】 - Network:【tcp】 - RulePayload:【geolocation-cn】 - Lastchain:【DIRECT】
14. SourceIP:【192.168.1.154】 - Host:【web.push.126.net】 - DestinationIP:【】 - Network:【tcp】 - RulePayload:【geolocation-cn】 - Lastchain:【DIRECT】
15. SourceIP:【192.168.1.243】 - Host:【time.g.aaplimg.com】 - DestinationIP:【17.253.84.123】 - Network:【udp】 - RulePayload:【】 - Lastchain:【DIRECT】
16. SourceIP:【192.168.1.154】 - Host:【hw-sh-live-comet-01.chat.bilibili.com】 - DestinationIP:【】 - Network:【tcp】 - RulePayload:【bilibili】 - Lastchain:【DIRECT】
17. SourceIP:【192.168.1.244】 - Host:【graph.oculus.com】 - DestinationIP:【】 - Network:【tcp】 - RulePayload:【gfw】 - Lastchain:【中国-香港 IEPL Equinix HK2 A 09 1Gbps HBO TVB】
18. SourceIP:【192.168.1.154】 - Host:【whois.pconline.com.cn】 - DestinationIP:【47.112.160.50】 - Network:【tcp】 - RulePayload:【cn】 - Lastchain:【DIRECT】
19. SourceIP:【192.168.1.154】 - Host:【broadcast2.distill.io】 - DestinationIP:【172.67.72.160】 - Network:【tcp】 - RulePayload:【443】 - Lastchain:【COMPATIBLE】
20. SourceIP:【192.168.1.154】 - Host:【api-ipv4.ip.sb】 - DestinationIP:【】 - Network:【tcp】 - RulePayload:【443】 - Lastchain:【中国-香港 IEPL Equinix HK2 A 01 1Gbps HBO TVB】
21. SourceIP:【192.168.1.154】 - Host:【api.vc.bilibili.com】 - DestinationIP:【】 - Network:【tcp】 - RulePayload:【bilibili】 - Lastchain:【DIRECT】
22. SourceIP:【192.168.1.154】 - Host:【www.gamersky.com】 - DestinationIP:【】 - Network:【tcp】 - RulePayload:【geolocation-cn】 - Lastchain:【DIRECT】
23. SourceIP:【192.168.1.154】 - Host:【www.javbus.com】 - DestinationIP:【】 - Network:【tcp】 - RulePayload:【gfw】 - Lastchain:【深港专线8[倍率:2.5]】
24. SourceIP:【192.168.1.154】 - Host:【config.edge.skype.com】 - DestinationIP:【2620:1ec:21::16】 - Network:【tcp】 - RulePayload:【443】 - Lastchain:【中国-香港 IEPL Equinix HK2 A 09 1Gbps HBO TVB】
25. SourceIP:【192.168.1.154】 - Host:【www.taobao.com】 - DestinationIP:【】 - Network:【tcp】 - RulePayload:【geolocation-cn】 - Lastchain:【DIRECT】
26. SourceIP:【192.168.1.154】 - Host:【xy115x223x28x163xy.mcdn.bilivideo.cn】 - DestinationIP:【】 - Network:【tcp】 - RulePayload:【bilibili】 - Lastchain:【DIRECT】
27. SourceIP:【192.168.1.154】 - Host:【vcb-s.com】 - DestinationIP:【】 - Network:【tcp】 - RulePayload:【443】 - Lastchain:【中国-香港 IEPL Equinix HK2 A 09 1Gbps HBO TVB】
28. SourceIP:【192.168.1.154】 - Host:【capi.grammarly.com】 - DestinationIP:【99.83.135.170】 - Network:【tcp】 - RulePayload:【443】 - Lastchain:【中国-香港 IEPL Equinix HK2 A 09 1Gbps HBO TVB】
29. SourceIP:【192.168.1.154】 - Host:【raw.githubusercontent.com】 - DestinationIP:【】 - Network:【tcp】 - RulePayload:【github】 - Lastchain:【中国-香港 IEPL Equinix HK2 A 09 1Gbps HBO TVB】
30. SourceIP:【192.168.1.154】 - Host:【rsshub.app】 - DestinationIP:【】 - Network:【tcp】 - RulePayload:【gfw】 - Lastchain:【中国-香港 IEPL Equinix HK2 A 09 1Gbps HBO TVB】
31. SourceIP:【192.168.1.244】 - Host:【gateway.facebook.com】 - DestinationIP:【】 - Network:【tcp】 - RulePayload:【gfw】 - Lastchain:【中国-香港 IEPL Equinix HK2 A 09 1Gbps HBO TVB】
32. SourceIP:【192.168.1.154】 - Host:【d27xxe7juh1us6.cloudfront.net】 - DestinationIP:【13.225.95.67】 - Network:【tcp】 - RulePayload:【443】 - Lastchain:【中国-香港 IEPL Equinix HK2 A 09 1Gbps HBO TVB】
33. SourceIP:【192.168.1.219】 - Host:【broadcast2.distill.io】 - DestinationIP:【104.26.2.204】 - Network:【tcp】 - RulePayload:【443】 - Lastchain:【COMPATIBLE】
34. SourceIP:【192.168.1.154】 - Host:【camo.githubusercontent.com】 - DestinationIP:【】 - Network:【tcp】 - RulePayload:【github】 - Lastchain:【中国-香港 IEPL Equinix HK2 A 09 1Gbps HBO TVB】
35. SourceIP:【192.168.1.154】 - Host:【nleditor.osi.office.net】 - DestinationIP:【52.109.124.182】 - Network:【tcp】 - RulePayload:【443】 - Lastchain:【中国-香港 IEPL Equinix HK2 A 09 1Gbps HBO TVB】
36. SourceIP:【192.168.1.154】 - Host:【kessel-ws.parsec.app】 - DestinationIP:【】 - Network:【tcp】 - RulePayload:【domestic】 - Lastchain:【DIRECT】
37. SourceIP:【192.168.1.244】 - Host:【edge-mqtt.facebook.com】 - DestinationIP:【】 - Network:【tcp】 - RulePayload:【gfw】 - Lastchain:【中国-香港 IEPL Equinix HK2 A 01 1Gbps HBO TVB】
38. SourceIP:【192.168.1.154】 - Host:【github.githubassets.com】 - DestinationIP:【】 - Network:【tcp】 - RulePayload:【github】 - Lastchain:【中国-香港 IEPL Equinix HK2 A 09 1Gbps HBO TVB】
39. SourceIP:【192.168.1.154】 - Host:【Empty】 - DestinationIP:【91.108.56.170】 - Network:【tcp】 - RulePayload:【telegram】 - Lastchain:【深港专线8[倍率:2.5]】
40. SourceIP:【192.168.1.154】 - Host:【www.duyaoss.com】 - DestinationIP:【】 - Network:【tcp】 - RulePayload:【gfw】 - Lastchain:【中国-香港 IEPL Equinix HK2 A 09 1Gbps HBO TVB】
41. SourceIP:【192.168.1.219】 - Host:【Empty】 - DestinationIP:【91.108.56.104】 - Network:【tcp】 - RulePayload:【telegram】 - Lastchain:【深港专线8[倍率:2.5]】
42. SourceIP:【192.168.1.154】 - Host:【msgstore.www.notion.so】 - DestinationIP:【2606:4700::6812:6b7】 - Network:【tcp】 - RulePayload:【443】 - Lastchain:【深港专线8[倍率:2.5]】
43. SourceIP:【192.168.1.154】 - Host:【a.nel.cloudflare.com】 - DestinationIP:【35.190.80.1】 - Network:【tcp】 - RulePayload:【443】 - Lastchain:【中国-香港 IEPL Equinix HK2 A 01 1Gbps HBO TVB】
44. SourceIP:【192.168.1.154】 - Host:【functional.events.data.microsoft.com】 - DestinationIP:【】 - Network:【tcp】 - RulePayload:【443】 - Lastchain:【深港专线8[倍率:2.5]】
45. SourceIP:【192.168.1.154】 - Host:【www.youtube.com】 - DestinationIP:【】 - Network:【tcp】 - RulePayload:【gfw】 - Lastchain:【深港专线8[倍率:2.5]】
46. SourceIP:【192.168.1.154】 - Host:【github.githubassets.com】 - DestinationIP:【】 - Network:【tcp】 - RulePayload:【github】 - Lastchain:【中国-香港 IEPL Equinix HK2 A 09 1Gbps HBO TVB】
47. SourceIP:【192.168.1.244】 - Host:【mqtt-mini.facebook.com】 - DestinationIP:【】 - Network:【tcp】 - RulePayload:【gfw】 - Lastchain:【中国-香港 IEPL Equinix HK2 A 09 1Gbps HBO TVB】
48. SourceIP:【192.168.1.154】 - Host:【extensions-auth.uc.r.appspot.com】 - DestinationIP:【】 - Network:【tcp】 - RulePayload:【gfw】 - Lastchain:【中国-香港 IEPL Equinix HK2 A 09 1Gbps HBO TVB】
49. SourceIP:【192.168.1.154】 - Host:【api.twitter.com】 - DestinationIP:【】 - Network:【tcp】 - RulePayload:【gfw】 - Lastchain:【中国-香港 IEPL Equinix HK2 A 09 1Gbps HBO TVB】
50. SourceIP:【192.168.1.154】 - Host:【sb.adtidy.org】 - DestinationIP:【2606:4700:10::6816:42db】 - Network:【tcp】 - RulePayload:【443】 - Lastchain:【中国-香港 IEPL Equinix HK2 A 09 1Gbps HBO TVB】
51. SourceIP:【192.168.1.154】 - Host:【s1.music.126.net】 - DestinationIP:【】 - Network:【tcp】 - RulePayload:【geolocation-cn】 - Lastchain:【DIRECT】
52. SourceIP:【192.168.1.154】 - Host:【vscode-sync.trafficmanager.net】 - DestinationIP:【】 - Network:【tcp】 - RulePayload:【443】 - Lastchain:【中国-香港 IEPL Equinix HK2 A 09 1Gbps HBO TVB】
53. SourceIP:【192.168.1.154】 - Host:【client.wns.windows.com】 - DestinationIP:【40.115.3.253】 - Network:【tcp】 - RulePayload:【443】 - Lastchain:【COMPATIBLE】
54. SourceIP:【192.168.1.154】 - Host:【qqwry.api.skk.moe】 - DestinationIP:【104.21.39.212】 - Network:【tcp】 - RulePayload:【443】 - Lastchain:【中国-香港 IEPL Equinix HK2 A 09 1Gbps HBO TVB】
55. SourceIP:【192.168.1.154】 - Host:【avatars.githubusercontent.com】 - DestinationIP:【】 - Network:【tcp】 - RulePayload:【github】 - Lastchain:【中国-香港 IEPL Equinix HK2 A 09 1Gbps HBO TVB】

[vierzhuzhe]

我碰到跟你类似的问题。用的自建的trojan节点。每次这个情况都发生在Dashboard下proxy选择了自建节点，并且重启了openclash。 然后日志就会出现大量connect error: dns resolve failed: context deadline exceeded，且无法访问国外任何地址。 但是机场的节点用的也是域名，就很正常，没问题。 最后解决的方案是，在openclash的覆写设置->dns设置下添加host，'域名':IP，加上去就完全正常了

[itiao]

我也遇到了同样情况，我的问题是我有ABC3个机场，然后B一直正常，AC一直如上问题。