search

vernesong / OpenClash

A Clash Client For OpenWrt
MIT License
15.96k stars 2.97k forks source link

41.06版本，威联通nas无法远程连接。 #1066

Closed tangnahuaite closed 2 years ago

tangnahuaite commented 3 years ago

硬件x86-64爱快，爱快虚拟机内安装官方openwrt19.07版本设为旁路由。插件openclash41.06版本。开启openclash后无法远程连接威联通nas，但可以远程连接爱快和openwrt。内网连接威联通nas正常。关闭openclash后内外网均能连接nas。日志末尾显示防火墙每秒重置一次用于重定向。附调试日志：#===================== 系统信息 =====================# 主机型号: QEMU Standard PC (i440FX + PIIX, 1996) 固件版本: OpenWrt 19.07.4 r11208-ce6496d796 LuCI版本: git-20.334.47525-e9bfb12-1 内核版本: 4.14.195 处理器架构: x86_64

此项在使用Tun模式时应为ACCEPT

防火墙转发: ACCEPT

此项有值时建议到网络-接口-lan的设置中禁用IPV6的DHCP

IPV6-DHCP:

此项结果应仅有配置文件的DNS监听地址

Dnsmasq转发设置: 127.0.0.1#7874

===================== 依赖检查 =====================

dnsmasq-full: 已安装 coreutils: 已安装 coreutils-nohup: 已安装 bash: 已安装 curl: 已安装 jsonfilter: 已安装 ca-certificates: 已安装 ipset: 已安装 ip-full: 已安装 iptables-mod-tproxy: 已安装 iptables-mod-extra: 已安装 libcap: 已安装 libcap-bin: 已安装 ruby: 已安装 ruby-yaml: 已安装 kmod-tun(TUN模式): 已安装 luci-compat(Luci-19.07): 已安装

===================== 内核检查 =====================

运行状态: 运行中 进程pid: 11113 运行权限: 11113: cap_dac_override,cap_net_bind_service,cap_net_admin,cap_net_raw,cap_sys_resource=eip 运行用户: nobody 已选择的架构: linux-amd64

下方无法显示内核版本号时请确认您的内核版本是否正确或者有无权限

Tun内核版本: 2020.11.23.g4474306 Tun内核文件: 存在 Tun内核运行权限: 正常

Game内核版本: v0.17.0-232-ge389e33 Game内核文件: 存在 Game内核运行权限: 正常

Dev内核版本: v1.3.0-2-g994cbff Dev内核文件: 存在 Dev内核运行权限: 正常

===================== 插件设置 =====================

当前配置文件: /etc/openclash/config/zhengshiban.yaml 启动配置文件: /etc/openclash/zhengshiban.yaml 运行模式: fake-ip 默认代理模式: rule UDP流量转发: 启用 DNS劫持: 启用 自定义DNS: 启用 IPV6-DNS解析: 停用 禁用Dnsmasq缓存: 启用 自定义规则: 停用 仅允许内网: 停用 仅代理命中规则流量: 停用 绕过中国大陆IP: 停用

启动异常时建议关闭此项后重试

保留配置: 停用 第三方规则: 停用

===================== 配置文件 =====================

port: 7890 socks-port: 7891 allow-lan: true mode: rule log-level: silent external-controller: 0.0.0.0:9090 experimental: ignore-resolve-fail: true dns: enable: true ipv6: false listen: 127.0.0.1:7874 default-nameserver:

===================== 防火墙设置 =====================

NAT chain

Generated by iptables-save v1.8.3 on Tue Dec 8 09:20:46 2020

*nat :PREROUTING ACCEPT [73:16930] :INPUT ACCEPT [63:7914] :OUTPUT ACCEPT [93:6674] :POSTROUTING ACCEPT [0:0] :MINIUPNPD - [0:0] :MINIUPNPD-POSTROUTING - [0:0] :openclash - [0:0] :openclash_output - [0:0] :postrouting_lan_rule - [0:0] :postrouting_rule - [0:0] :postrouting_wan_rule - [0:0] :prerouting_lan_rule - [0:0] :prerouting_rule - [0:0] :prerouting_wan_rule - [0:0] :zone_lan_postrouting - [0:0] :zone_lan_prerouting - [0:0] :zone_wan_postrouting - [0:0] :zone_wan_prerouting - [0:0] -A PREROUTING -d 8.8.4.4/32 -p tcp -j REDIRECT --to-ports 7892 -A PREROUTING -d 8.8.8.8/32 -p tcp -j REDIRECT --to-ports 7892 -A PREROUTING -d 8.8.4.4/32 -p tcp -j REDIRECT --to-ports 7892 -A PREROUTING -d 8.8.8.8/32 -p tcp -j REDIRECT --to-ports 7892 -A PREROUTING -m comment --comment "!fw3: Custom prerouting rule chain" -j prerouting_rule -A PREROUTING -i br-lan -m comment --comment "!fw3" -j zone_lan_prerouting -A PREROUTING -p tcp -j openclash -A PREROUTING -p tcp -j openclash -A OUTPUT -j openclash_output -A OUTPUT -j openclash_output -A POSTROUTING -j MASQUERADE -A POSTROUTING -m comment --comment "!fw3: Custom postrouting rule chain" -j postrouting_rule -A POSTROUTING -o br-lan -m comment --comment "!fw3" -j zone_lan_postrouting -A MINIUPNPD -p tcp -m tcp --dport 8080 -j DNAT --to-destination 192.168.2.16:8080 -A MINIUPNPD -p tcp -m tcp --dport 1943 -j DNAT --to-destination 192.168.2.16:1943 -A MINIUPNPD -p udp -m udp --dport 1979 -j DNAT --to-destination 192.168.2.16:1979 -A openclash -m set --match-set localnetwork dst -j RETURN -A openclash -p tcp -j REDIRECT --to-ports 7892 -A openclash_output -m set --match-set localnetwork dst -j RETURN -A openclash_output -p tcp -m owner ! --uid-owner 65534 -m multiport --dports 80,443 -j REDIRECT --to-ports 7892 -A openclash_output -d 198.18.0.0/16 -p tcp -m owner ! --uid-owner 65534 -j REDIRECT --to-ports 7892 -A zone_lan_postrouting -j MINIUPNPD-POSTROUTING -A zone_lan_postrouting -m comment --comment "!fw3: Custom lan postrouting rule chain" -j postrouting_lan_rule -A zone_lan_prerouting -j MINIUPNPD -A zone_lan_prerouting -m comment --comment "!fw3: Custom lan prerouting rule chain" -j prerouting_lan_rule -A zone_wan_postrouting -m comment --comment "!fw3: Custom wan postrouting rule chain" -j postrouting_wan_rule -A zone_wan_postrouting -m comment --comment "!fw3" -j MASQUERADE -A zone_wan_prerouting -m comment --comment "!fw3: Custom wan prerouting rule chain" -j prerouting_wan_rule COMMIT

Completed on Tue Dec 8 09:20:46 2020

Mangle chain

Generated by iptables-save v1.8.3 on Tue Dec 8 09:20:46 2020

*mangle :PREROUTING ACCEPT [488798:647411271] :INPUT ACCEPT [484027:643484691] :FORWARD ACCEPT [29519:6501114] :OUTPUT ACCEPT [326683:623561680] :POSTROUTING ACCEPT [355338:629988788] :openclash - [0:0] -A PREROUTING -p udp -j openclash -A PREROUTING -p udp -j openclash -A openclash -p udp -m udp --dport 500 -j RETURN -A openclash -p udp -m udp --dport 546 -j RETURN -A openclash -p udp -m udp --dport 68 -j RETURN -A openclash -m set --match-set localnetwork dst -j RETURN -A openclash -p udp -m udp --dport 53 -j RETURN -A openclash -p udp -j TPROXY --on-port 7892 --on-ip 0.0.0.0 --tproxy-mark 0x162/0xffffffff COMMIT

Completed on Tue Dec 8 09:20:46 2020

===================== 路由表状态 =====================

route -n

Kernel IP routing table Destination Gateway Genmask Flags Metric Ref Use Iface 0.0.0.0 192.168.2.1 0.0.0.0 UG 0 0 0 br-lan 192.168.2.0 0.0.0.0 255.255.255.0 U 0 0 0 br-lan

ip route list

default via 192.168.2.1 dev br-lan proto static 192.168.2.0/24 dev br-lan proto kernel scope link src 192.168.2.251

ip rule show

0: from all lookup local 32764: from all fwmark 0x162 lookup 354 32765: from all fwmark 0x162 lookup 354 32766: from all lookup main 32767: from all lookup default

===================== 端口占用状态 =====================

tcp 0 0 :::9090 ::: LISTEN 11113/clash tcp 0 0 :::7890 ::: LISTEN 11113/clash tcp 0 0 :::7891 ::: LISTEN 11113/clash tcp 0 0 :::7892 ::: LISTEN 11113/clash tcp 0 0 :::7893 ::: LISTEN 11113/clash udp 0 0 127.0.0.1:7874 0.0.0.0: 11113/clash udp 0 0 :::7891 ::: 11113/clash udp 0 0 :::7892 ::: 11113/clash udp 0 0 :::7893 ::: 11113/clash udp 0 0 :::54237 ::: 11113/clash udp 0 0 :::50910 ::: 11113/clash udp 0 0 :::59110 ::: 11113/clash udp 0 0 :::43774 ::: 11113/clash udp 0 0 :::41219 ::: 11113/clash udp 0 0 :::38443 ::: 11113/clash udp 0 0 :::56365 ::: 11113/clash udp 0 0 :::56145 ::: 11113/clash udp 0 0 :::48987 ::: 11113/clash udp 0 0 :::38516 ::: 11113/clash udp 0 0 :::44170 ::: 11113/clash udp 0 0 :::47265 :::* 11113/clash

===================== 测试本机DNS查询 =====================

Server: 127.0.0.1 Address: 127.0.0.1#53

Name: www.baidu.com Address 1: 198.18.0.6 *** Can't find www.baidu.com: No answer

===================== resolv.conf.auto =====================

Interface lan

nameserver 223.5.5.5

===================== 测试本机网络连接 =====================

HTTP/1.1 200 OK Accept-Ranges: bytes Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Connection: keep-alive Content-Length: 277 Content-Type: text/html Date: Tue, 08 Dec 2020 09:20:46 GMT Etag: "575e1f59-115" Last-Modified: Mon, 13 Jun 2016 02:50:01 GMT Pragma: no-cache Server: bfe/1.0.8.18

===================== 测试本机网络下载 =====================

HTTP/1.1 200 OK Connection: keep-alive Content-Length: 80 Cache-Control: max-age=300 Content-Security-Policy: default-src 'none'; style-src 'unsafe-inline'; sandbox Content-Type: text/plain; charset=utf-8 ETag: "37c90545872644d531698407d8d115d7dd22e029a208ca661b2fc863eb54b67b" Strict-Transport-Security: max-age=31536000 X-Content-Type-Options: nosniff X-Frame-Options: deny X-XSS-Protection: 1; mode=block Via: 1.1 varnish (Varnish/6.0), 1.1 varnish X-GitHub-Request-Id: B08A:2C8B:5C61CC:6C4BCB:5FCF453F Accept-Ranges: bytes Date: Tue, 08 Dec 2020 09:20:47 GMT X-Served-By: cache-sjc10020-SJC X-Cache: HFM, HIT X-Cache-Hits: 0, 1 X-Timer: S1607419248.727337,VS0,VE1 Vary: Authorization,Accept-Encoding Access-Control-Allow-Origin: * X-Fastly-Request-ID: 56ab58925f1496a8fc118fc975e6539119a549a6 Expires: Tue, 08 Dec 2020 09:25:47 GMT Source-Age: 46

===================== 最近运行日志 =====================

2020-12-08 08:31:10 Watchdog: Reset Firewall For Enabling Redirect. 2020-12-08 08:32:10 Watchdog: Reset Firewall For Enabling Redirect. 2020-12-08 08:33:10 Watchdog: Reset Firewall For Enabling Redirect. 2020-12-08 08:34:10 Watchdog: Reset Firewall For Enabling Redirect. 2020-12-08 08:35:10 Watchdog: Reset Firewall For Enabling Redirect. 2020-12-08 08:36:10 Watchdog: Reset Firewall For Enabling Redirect. 2020-12-08 08:37:11 Watchdog: Reset Firewall For Enabling Redirect. 2020-12-08 08:38:11 Watchdog: Reset Firewall For Enabling Redirect. 2020-12-08 08:39:11 Watchdog: Reset Firewall For Enabling Redirect. 2020-12-08 08:40:11 Watchdog: Reset Firewall For Enabling Redirect. 2020-12-08 08:41:11 Watchdog: Reset Firewall For Enabling Redirect. 2020-12-08 08:42:11 Watchdog: Reset Firewall For Enabling Redirect. 2020-12-08 08:43:11 Watchdog: Reset Firewall For Enabling Redirect. 2020-12-08 08:44:11 Watchdog: Reset Firewall For Enabling Redirect. 2020-12-08 08:45:11 Watchdog: Reset Firewall For Enabling Redirect. 2020-12-08 08:46:11 Watchdog: Reset Firewall For Enabling Redirect. 2020-12-08 08:47:11 Watchdog: Reset Firewall For Enabling Redirect. 2020-12-08 08:48:11 Watchdog: Reset Firewall For Enabling Redirect. 2020-12-08 08:49:11 Watchdog: Reset Firewall For Enabling Redirect. 2020-12-08 08:50:11 Watchdog: Reset Firewall For Enabling Redirect. 2020-12-08 08:51:11 Watchdog: Reset Firewall For Enabling Redirect. 2020-12-08 08:52:11 Watchdog: Reset Firewall For Enabling Redirect. 2020-12-08 08:53:11 Watchdog: Reset Firewall For Enabling Redirect. 2020-12-08 08:54:12 Watchdog: Reset Firewall For Enabling Redirect. 2020-12-08 08:55:12 Watchdog: Reset Firewall For Enabling Redirect. 2020-12-08 08:56:12 Watchdog: Reset Firewall For Enabling Redirect. 2020-12-08 08:57:12 Watchdog: Reset Firewall For Enabling Redirect. 2020-12-08 08:58:12 Watchdog: Reset Firewall For Enabling Redirect. 2020-12-08 08:59:12 Watchdog: Reset Firewall For Enabling Redirect. 2020-12-08 09:00:12 Watchdog: Reset Firewall For Enabling Redirect. 2020-12-08 09:01:12 Watchdog: Reset Firewall For Enabling Redirect. 2020-12-08 09:02:12 Watchdog: Reset Firewall For Enabling Redirect. 2020-12-08 09:03:12 Watchdog: Reset Firewall For Enabling Redirect. 2020-12-08 09:04:12 Watchdog: Reset Firewall For Enabling Redirect. 2020-12-08 09:05:12 Watchdog: Reset Firewall For Enabling Redirect. 2020-12-08 09:06:12 Watchdog: Reset Firewall For Enabling Redirect. 2020-12-08 09:07:12 Watchdog: Reset Firewall For Enabling Redirect. 2020-12-08 09:08:12 Watchdog: Reset Firewall For Enabling Redirect. 2020-12-08 09:09:12 Watchdog: Reset Firewall For Enabling Redirect. 2020-12-08 09:10:12 Watchdog: Reset Firewall For Enabling Redirect. 2020-12-08 09:11:12 Watchdog: Reset Firewall For Enabling Redirect. 2020-12-08 09:12:13 Watchdog: Reset Firewall For Enabling Redirect. 2020-12-08 09:13:13 Watchdog: Reset Firewall For Enabling Redirect. 2020-12-08 09:14:13 Watchdog: Reset Firewall For Enabling Redirect. 2020-12-08 09:15:13 Watchdog: Reset Firewall For Enabling Redirect. 2020-12-08 09:16:13 Watchdog: Reset Firewall For Enabling Redirect. 2020-12-08 09:17:13 Watchdog: Reset Firewall For Enabling Redirect. 2020-12-08 09:18:13 Watchdog: Reset Firewall For Enabling Redirect. 2020-12-08 09:19:13 Watchdog: Reset Firewall For Enabling Redirect. 2020-12-08 09:20:13 Watchdog: Reset Firewall For Enabling Redirect.

vernesong commented 3 years ago

nas的ddns获取域名可能有问题，用redir模式或者fakeip模式下在dns高级设置添加fakeip黑名单。 另外防火墙规则重复了，插件多关闭几次清理一下规则

tangnahuaite commented 3 years ago

nas的ddns获取域名可能有问题，用redir模式或者fakeip模式下在dns高级设置添加fakeip黑名单。 另外防火墙规则重复了，插件多关闭几次清理一下规则

发现外网无法访问nas的情况后，已经第一时间查询了nas的ddns，确认获取ip正常（我的网络是公网ip）。用ip和域名均无法连接nas，无论是redir模式或者fakeip模式。今天把openclash插件重启了几次，那个防火墙频繁重定向的bug没有了。但还是无法外网远程连接nas。现在想要远程外网连接nas我只能用一个费劲的方法，1、远程进入openwrt关掉openclash插件。2、连接nas存取档案资料。3、nas不用后，再进入openwrt开启openclash插件以提供出国功能。先这么将就着用，等新版修复。

vernesong commented 3 years ago

端口转发是怎么设置的？

tangnahuaite commented 3 years ago

端口转发是怎么设置的？

试过openwrt设置映射nas主机，但一样没用。只要一开openclash必定无法外网连接nas。

tangnahuaite commented 3 years ago

仔细排查了openclash和威联通nas的日志，初步判定应该是openclash UDP转发的问题。望在后续版本中增加自定义排除转发某个UDP端口的选项。

vernesong commented 3 years ago

如果流量通过了clash，你可以自己写规则直连

github-actions[bot] commented 2 years ago

This issue is stale because it has been open 60 days with no activity. Remove stale label or comment or this will be closed in 5 days