search

vernesong / OpenClash

A Clash Client For OpenWrt
MIT License
16.54k stars 3.06k forks source link

[Bug] openwrt官方分支22.03，关闭opanclash需要重启防火墙才能通网 #2423

Closed AllForLandlord closed 2 years ago

AllForLandlord commented 2 years ago

Verify Steps

OpenClash Version

v0.45.22-beta

Bug on Environment

Official OpenWrt

Bug on Platform

Linux-armv8

To Reproduce

开启openclash后关闭openclash即可复现此问题。

Describe the Bug

在开启openclash后关闭openclash后网络不通，重启防火墙后才恢复。

OpenClash Log

OpenClash 调试日志

生成时间: 2022-05-28 15:15:15 插件版本: 隐私提示: 上传此日志前请注意检查、屏蔽公网IP、节点、密码等相关敏感信息



#===================== 系统信息 =====================#

主机型号: FriendlyElec NanoPi R2S
固件版本: OpenWrt 22.03.0-rc1 05.17.2022
LuCI版本: 
内核版本: 5.15.40
处理器架构: 

#此项有值时,如不使用IPv6,建议到网络-接口-lan的设置中禁用IPV6的DHCP
IPV6-DHCP: 

#此项结果应仅有配置文件的DNS监听地址
Dnsmasq转发设置: 127.0.0.1#7874

#===================== 依赖检查 =====================#

dnsmasq-full: 已安装
coreutils: 已安装
coreutils-nohup: 已安装
bash: 已安装
curl: 已安装
ca-certificates: 已安装
ipset: 已安装
ip-full: 已安装
iptables-mod-tproxy: 已安装
kmod-ipt-tproxy: 已安装
iptables-mod-extra: 已安装
kmod-ipt-extra: 已安装
libcap: 已安装
libcap-bin: 已安装
ruby: 已安装
ruby-yaml: 已安装
ruby-psych: 已安装
ruby-pstore: 已安装
ruby-dbm: 已安装
kmod-tun(TUN模式): 已安装
luci-compat(Luci-19.07): 已安装
kmod-inet-diag(PROCESS-NAME): 已安装

#===================== 内核检查 =====================#

运行状态: 运行中
进程pid: 12218 7489
运行权限: 12218: =ep
7489: cap_dac_override,cap_net_bind_service,cap_net_admin,cap_net_raw,cap_sys_ptrace,cap_sys_resource=eip
运行用户: nobody
已选择的架构: linux-armv8

#下方无法显示内核版本号时请确认您的内核版本是否正确或者有无权限
Tun内核版本: 2022.05.18
Tun内核文件: 存在
Tun内核运行权限: 正常

Dev内核版本: v1.10.6-9-g9d2fc97
Dev内核文件: 存在
Dev内核运行权限: 正常
Meta内核版本: alpha-gd0268bb
Meta内核文件: 存在
Meta内核运行权限: 正常

#===================== 插件设置 =====================#

当前配置文件: /etc/openclash/config/SoCloud.yaml
启动配置文件: /etc/openclash/SoCloud.yaml
运行模式: redir-host
默认代理模式: rule
UDP流量转发(tproxy): 停用
DNS劫持: 启用
自定义DNS: 启用
IPV6代理: 停用
IPV6-DNS解析: 停用
禁用Dnsmasq缓存: 启用
自定义规则: 启用
仅允许内网: 启用
仅代理命中规则流量: 停用
仅允许常用端口流量: 停用
绕过中国大陆IP: 停用
DNS远程解析: 启用
路由本机代理: 启用

#启动异常时建议关闭此项后重试
混合节点: 停用
保留配置: 停用

#启动异常时建议关闭此项后重试
第三方规则: 停用
#===================== 配置文件 =====================#

port: 7890
socks-port: 7891
allow-lan: true
mode: rule
log-level: silent
external-controller: 0.0.0.0:9090
proxy-groups:
rules:
redir-port: 7892
tproxy-port: 7895
mixed-port: 7893
bind-address: "*"
external-ui: "/usr/share/openclash/ui"
ipv6: false
geodata-mode: false
geodata-loader: memconservative
tcp-concurrent: true
dns:
  enable: true
  ipv6: false
  enhanced-mode: fake-ip
  fake-ip-range: 198.18.0.1/16
  listen: 0.0.0.0:7874
  nameserver:
  - 223.5.5.5
  - 223.6.6.6
  - 119.29.29.29
  - 119.28.28.28
  fake-ip-filter:
  - "+.*"
  default-nameserver:
  - 223.5.5.5
  - 223.6.6.6
  - 119.29.29.29
  - 119.28.28.28
sniffer:
  enable: true
  sniffing:
  - tls
  - http
profile:
  store-selected: true
  store-fake-ip: true

#===================== 防火墙设置 =====================#

#IPv4 NAT chain

# Generated by iptables-save v1.8.7 on Sat May 28 ********** 2022
*nat
:PREROUTING ACCEPT [97:20855]
:INPUT ACCEPT [553:34633]
:OUTPUT ACCEPT [1633:100241]
:POSTROUTING ACCEPT [148:9341]
:MINIUPNPD - [0:0]
:MINIUPNPD-POSTROUTING - [0:0]
:openclash - [0:0]
:openclash_output - [0:0]
:postrouting_docker_rule - [0:0]
:postrouting_lan_rule - [0:0]
:postrouting_rule - [0:0]
:postrouting_wan_rule - [0:0]
:prerouting_docker_rule - [0:0]
:prerouting_lan_rule - [0:0]
:prerouting_rule - [0:0]
:prerouting_wan_rule - [0:0]
:zone_docker_postrouting - [0:0]
:zone_docker_prerouting - [0:0]
:zone_lan_postrouting - [0:0]
:zone_lan_prerouting - [0:0]
:zone_wan_postrouting - [0:0]
:zone_wan_prerouting - [0:0]
-A PREROUTING -d 8.8.4.4/32 -p tcp -m comment --comment "OpenClash Google DNS Hijack" -m tcp --dport 53 -j REDIRECT --to-ports 7892
-A PREROUTING -d 8.8.8.8/32 -p tcp -m comment --comment "OpenClash Google DNS Hijack" -m tcp --dport 53 -j REDIRECT --to-ports 7892
-A PREROUTING -p tcp -m tcp --dport 53 -m comment --comment "OpenClash DNS Hijack" -j REDIRECT --to-ports 53
-A PREROUTING -p udp -m udp --dport 53 -m comment --comment "OpenClash DNS Hijack" -j REDIRECT --to-ports 53
-A PREROUTING -m comment --comment "!fw3: Custom prerouting rule chain" -j prerouting_rule
-A PREROUTING -i eth0 -m comment --comment "!fw3" -j zone_lan_prerouting
-A PREROUTING -i pppoe-wan -m comment --comment "!fw3" -j zone_wan_prerouting
-A PREROUTING -i docker0 -m comment --comment "!fw3" -j zone_docker_prerouting
-A PREROUTING -p udp -m comment --comment DNSMASQ -m udp --dport 53 -j REDIRECT --to-ports 53
-A PREROUTING -p tcp -m comment --comment DNSMASQ -m tcp --dport 53 -j REDIRECT --to-ports 53
-A PREROUTING -p tcp -j openclash
-A OUTPUT -j openclash_output
-A POSTROUTING -m comment --comment "!fw3: Custom postrouting rule chain" -j postrouting_rule
-A POSTROUTING -o eth0 -m comment --comment "!fw3" -j zone_lan_postrouting
-A POSTROUTING -o pppoe-wan -m comment --comment "!fw3" -j zone_wan_postrouting
-A POSTROUTING -o docker0 -m comment --comment "!fw3" -j zone_docker_postrouting
-A openclash -m set --match-set localnetwork dst -j RETURN
-A openclash -m set --match-set lan_ac_black_ips src -j RETURN
-A openclash -p tcp -j REDIRECT --to-ports 7892
-A openclash_output -m set --match-set localnetwork dst -j RETURN
-A openclash_output -p tcp -m owner ! --uid-owner 65534 -j REDIRECT --to-ports 7892
-A zone_docker_postrouting -m comment --comment "!fw3: Custom docker postrouting rule chain" -j postrouting_docker_rule
-A zone_docker_prerouting -m comment --comment "!fw3: Custom docker prerouting rule chain" -j prerouting_docker_rule
-A zone_lan_postrouting -m comment --comment "!fw3: Custom lan postrouting rule chain" -j postrouting_lan_rule
-A zone_lan_prerouting -m comment --comment "!fw3: Custom lan prerouting rule chain" -j prerouting_lan_rule
-A zone_wan_postrouting -j MINIUPNPD-POSTROUTING
-A zone_wan_postrouting -m comment --comment "!fw3: Custom wan postrouting rule chain" -j postrouting_wan_rule
-A zone_wan_postrouting -m comment --comment "!fw3" -j FULLCONENAT
-A zone_wan_prerouting -j MINIUPNPD
-A zone_wan_prerouting -m comment --comment "!fw3: Custom wan prerouting rule chain" -j prerouting_wan_rule
-A zone_wan_prerouting -m comment --comment "!fw3" -j FULLCONENAT
COMMIT
# Completed on Sat May 28 ********** 2022

#IPv4 Mangle chain

# Generated by iptables-save v1.8.7 on Sat May 28 ********** 2022
*mangle
:PREROUTING ACCEPT [95131:90448808]
:INPUT ACCEPT [94466:90370364]
:FORWARD ACCEPT [665:78444]
:OUTPUT ACCEPT [64395:88540110]
:POSTROUTING ACCEPT [64978:88613977]
-A FORWARD -o pppoe-wan -p tcp -m tcp --tcp-flags SYN,RST SYN -m comment --comment "!fw3: Zone wan MTU fixing" -j TCPMSS --clamp-mss-to-pmtu
-A FORWARD -i pppoe-wan -p tcp -m tcp --tcp-flags SYN,RST SYN -m comment --comment "!fw3: Zone wan MTU fixing" -j TCPMSS --clamp-mss-to-pmtu
COMMIT
# Completed on Sat May 28 ********** 2022

#IPv4 Filter chain

# Generated by iptables-save v1.8.7 on Sat May 28 ********** 2022
*filter
:INPUT ACCEPT [0:0]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [0:0]
:MINIUPNPD - [0:0]
:forwarding_docker_rule - [0:0]
:forwarding_lan_rule - [0:0]
:forwarding_rule - [0:0]
:forwarding_wan_rule - [0:0]
:input_docker_rule - [0:0]
:input_lan_rule - [0:0]
:input_rule - [0:0]
:input_wan_rule - [0:0]
:openclash_wan_input - [0:0]
:output_docker_rule - [0:0]
:output_lan_rule - [0:0]
:output_rule - [0:0]
:output_wan_rule - [0:0]
:reject - [0:0]
:syn_flood - [0:0]
:zone_docker_dest_ACCEPT - [0:0]
:zone_docker_forward - [0:0]
:zone_docker_input - [0:0]
:zone_docker_output - [0:0]
:zone_docker_src_ACCEPT - [0:0]
:zone_lan_dest_ACCEPT - [0:0]
:zone_lan_forward - [0:0]
:zone_lan_input - [0:0]
:zone_lan_output - [0:0]
:zone_lan_src_ACCEPT - [0:0]
:zone_wan_dest_ACCEPT - [0:0]
:zone_wan_dest_REJECT - [0:0]
:zone_wan_forward - [0:0]
:zone_wan_input - [0:0]
:zone_wan_output - [0:0]
:zone_wan_src_REJECT - [0:0]
-A INPUT -i pppoe-wan -j openclash_wan_input
-A INPUT -i lo -m comment --comment "!fw3" -j ACCEPT
-A INPUT -m comment --comment "!fw3: Custom input rule chain" -j input_rule
-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment "!fw3" -j ACCEPT
-A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -m comment --comment "!fw3" -j syn_flood
-A INPUT -i eth0 -m comment --comment "!fw3" -j zone_lan_input
-A INPUT -i pppoe-wan -m comment --comment "!fw3" -j zone_wan_input
-A INPUT -i docker0 -m comment --comment "!fw3" -j zone_docker_input
-A FORWARD -m comment --comment "!fw3: Custom forwarding rule chain" -j forwarding_rule
-A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment "!fw3" -j ACCEPT
-A FORWARD -i eth0 -m comment --comment "!fw3" -j zone_lan_forward
-A FORWARD -i pppoe-wan -m comment --comment "!fw3" -j zone_wan_forward
-A FORWARD -i docker0 -m comment --comment "!fw3" -j zone_docker_forward
-A FORWARD -m comment --comment "!fw3" -j reject
-A OUTPUT -o lo -m comment --comment "!fw3" -j ACCEPT
-A OUTPUT -m comment --comment "!fw3: Custom output rule chain" -j output_rule
-A OUTPUT -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment "!fw3" -j ACCEPT
-A OUTPUT -o eth0 -m comment --comment "!fw3" -j zone_lan_output
-A OUTPUT -o pppoe-wan -m comment --comment "!fw3" -j zone_wan_output
-A OUTPUT -o docker0 -m comment --comment "!fw3" -j zone_docker_output
-A openclash_wan_input -p udp -m multiport --dports 7892,7895,9090,7890,7891,7893,7874 -j REJECT --reject-with icmp-port-unreachable
-A openclash_wan_input -p tcp -m multiport --dports 7892,7895,9090,7890,7891,7893,7874 -j REJECT --reject-with icmp-port-unreachable
-A reject -p tcp -m comment --comment "!fw3" -j REJECT --reject-with tcp-reset
-A reject -m comment --comment "!fw3" -j REJECT --reject-with icmp-port-unreachable
-A syn_flood -m limit --limit 25/sec --limit-burst 50 -m comment --comment "!fw3" -j RETURN
-A syn_flood -m comment --comment "!fw3" -j DROP
-A zone_docker_dest_ACCEPT -o docker0 -m comment --comment "!fw3" -j ACCEPT
-A zone_docker_forward -m comment --comment "!fw3: Custom docker forwarding rule chain" -j forwarding_docker_rule
-A zone_docker_forward -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port forwards" -j ACCEPT
-A zone_docker_forward -m comment --comment "!fw3" -j zone_docker_dest_ACCEPT
-A zone_docker_input -m comment --comment "!fw3: Custom docker input rule chain" -j input_docker_rule
-A zone_docker_input -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port redirections" -j ACCEPT
-A zone_docker_input -m comment --comment "!fw3" -j zone_docker_src_ACCEPT
-A zone_docker_output -m comment --comment "!fw3: Custom docker output rule chain" -j output_docker_rule
-A zone_docker_output -m comment --comment "!fw3" -j zone_docker_dest_ACCEPT
-A zone_docker_src_ACCEPT -i docker0 -m conntrack --ctstate NEW,UNTRACKED -m comment --comment "!fw3" -j ACCEPT
-A zone_lan_dest_ACCEPT -o eth0 -m comment --comment "!fw3" -j ACCEPT
-A zone_lan_forward -m comment --comment "!fw3: Custom lan forwarding rule chain" -j forwarding_lan_rule
-A zone_lan_forward -m comment --comment "!fw3: Zone lan to wan forwarding policy" -j zone_wan_dest_ACCEPT
-A zone_lan_forward -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port forwards" -j ACCEPT
-A zone_lan_forward -m comment --comment "!fw3" -j zone_lan_dest_ACCEPT
-A zone_lan_input -m comment --comment "!fw3: Custom lan input rule chain" -j input_lan_rule
-A zone_lan_input -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port redirections" -j ACCEPT
-A zone_lan_input -m comment --comment "!fw3" -j zone_lan_src_ACCEPT
-A zone_lan_output -m comment --comment "!fw3: Custom lan output rule chain" -j output_lan_rule
-A zone_lan_output -m comment --comment "!fw3" -j zone_lan_dest_ACCEPT
-A zone_lan_src_ACCEPT -i eth0 -m conntrack --ctstate NEW,UNTRACKED -m comment --comment "!fw3" -j ACCEPT
-A zone_wan_dest_ACCEPT -o pppoe-wan -m conntrack --ctstate INVALID -m comment --comment "!fw3: Prevent NAT leakage" -j DROP
-A zone_wan_dest_ACCEPT -o pppoe-wan -m comment --comment "!fw3" -j ACCEPT
-A zone_wan_dest_REJECT -o pppoe-wan -m comment --comment "!fw3" -j reject
-A zone_wan_forward -j MINIUPNPD
-A zone_wan_forward -m comment --comment "!fw3: Custom wan forwarding rule chain" -j forwarding_wan_rule
-A zone_wan_forward -p esp -m comment --comment "!fw3: Allow-IPSec-ESP" -j zone_lan_dest_ACCEPT
-A zone_wan_forward -p udp -m udp --dport 500 -m comment --comment "!fw3: Allow-ISAKMP" -j zone_lan_dest_ACCEPT
-A zone_wan_forward -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port forwards" -j ACCEPT
-A zone_wan_forward -m comment --comment "!fw3" -j zone_wan_dest_REJECT
-A zone_wan_input -m comment --comment "!fw3: Custom wan input rule chain" -j input_wan_rule
-A zone_wan_input -p udp -m udp --dport 68 -m comment --comment "!fw3: Allow-DHCP-Renew" -j ACCEPT
-A zone_wan_input -p icmp -m icmp --icmp-type 8 -m comment --comment "!fw3: Allow-Ping" -j ACCEPT
-A zone_wan_input -p igmp -m comment --comment "!fw3: Allow-IGMP" -j ACCEPT
-A zone_wan_input -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port redirections" -j ACCEPT
-A zone_wan_input -m comment --comment "!fw3" -j zone_wan_src_REJECT
-A zone_wan_output -m comment --comment "!fw3: Custom wan output rule chain" -j output_wan_rule
-A zone_wan_output -m comment --comment "!fw3" -j zone_wan_dest_ACCEPT
-A zone_wan_src_REJECT -i pppoe-wan -m comment --comment "!fw3" -j reject
COMMIT
# Completed on Sat May 28 *******      

#IPv6 NAT chain

# Generated by ip6tables-save v1.8.7 on Sat May 28 *******      
*nat
:PREROUTING ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:OUTPUT ACCEPT [5:399]
:POSTROUTING ACCEPT [5:399]
-A PREROUTING -p udp -m comment --comment DNSMASQ -m udp --dport 53 -j REDIRECT --to-ports 53
-A PREROUTING -p tcp -m comment --comment DNSMASQ -m tcp --dport 53 -j REDIRECT --to-ports 53
COMMIT
# Completed on Sat May 28 ********** 2022

#IPv6 Mangle chain

# Generated by ip6tables-save v1.8.7 on Sat May 28 ********** 2022
*mangle
:PREROUTING ACCEPT [49:4718]
:INPUT ACCEPT [49:4718]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [49:4718]
:POSTROUTING ACCEPT [49:4718]
-A FORWARD -o pppoe-wan -p tcp -m tcp --tcp-flags SYN,RST SYN -m comment --comment "!fw3: Zone wan MTU fixing" -j TCPMSS --clamp-mss-to-pmtu
-A FORWARD -i pppoe-wan -p tcp -m tcp --tcp-flags SYN,RST SYN -m comment --comment "!fw3: Zone wan MTU fixing" -j TCPMSS --clamp-mss-to-pmtu
COMMIT
# Completed on Sat May 28 ********** 2022

#IPv6 Filter chain

# Generated by ip6tables-save v1.8.7 on Sat May 28 ********** 2022
*filter
:INPUT ACCEPT [0:0]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [0:0]
:MINIUPNPD - [0:0]
:forwarding_docker_rule - [0:0]
:forwarding_lan_rule - [0:0]
:forwarding_rule - [0:0]
:forwarding_wan_rule - [0:0]
:input_docker_rule - [0:0]
:input_lan_rule - [0:0]
:input_rule - [0:0]
:input_wan_rule - [0:0]
:output_docker_rule - [0:0]
:output_lan_rule - [0:0]
:output_rule - [0:0]
:output_wan_rule - [0:0]
:reject - [0:0]
:syn_flood - [0:0]
:zone_docker_dest_ACCEPT - [0:0]
:zone_docker_forward - [0:0]
:zone_docker_input - [0:0]
:zone_docker_output - [0:0]
:zone_docker_src_ACCEPT - [0:0]
:zone_lan_dest_ACCEPT - [0:0]
:zone_lan_forward - [0:0]
:zone_lan_input - [0:0]
:zone_lan_output - [0:0]
:zone_lan_src_ACCEPT - [0:0]
:zone_wan_dest_ACCEPT - [0:0]
:zone_wan_dest_REJECT - [0:0]
:zone_wan_forward - [0:0]
:zone_wan_input - [0:0]
:zone_wan_output - [0:0]
:zone_wan_src_REJECT - [0:0]
-A INPUT -i lo -m comment --comment "!fw3" -j ACCEPT
-A INPUT -m comment --comment "!fw3: Custom input rule chain" -j input_rule
-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment "!fw3" -j ACCEPT
-A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -m comment --comment "!fw3" -j syn_flood
-A INPUT -i eth0 -m comment --comment "!fw3" -j zone_lan_input
-A INPUT -i pppoe-wan -m comment --comment "!fw3" -j zone_wan_input
-A INPUT -i docker0 -m comment --comment "!fw3" -j zone_docker_input
-A FORWARD -m comment --comment "!fw3: Custom forwarding rule chain" -j forwarding_rule
-A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment "!fw3" -j ACCEPT
-A FORWARD -i eth0 -m comment --comment "!fw3" -j zone_lan_forward
-A FORWARD -i pppoe-wan -m comment --comment "!fw3" -j zone_wan_forward
-A FORWARD -i docker0 -m comment --comment "!fw3" -j zone_docker_forward
-A FORWARD -m comment --comment "!fw3" -j reject
-A OUTPUT -o lo -m comment --comment "!fw3" -j ACCEPT
-A OUTPUT -m comment --comment "!fw3: Custom output rule chain" -j output_rule
-A OUTPUT -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment "!fw3" -j ACCEPT
-A OUTPUT -o eth0 -m comment --comment "!fw3" -j zone_lan_output
-A OUTPUT -o pppoe-wan -m comment --comment "!fw3" -j zone_wan_output
-A OUTPUT -o docker0 -m comment --comment "!fw3" -j zone_docker_output
-A reject -p tcp -m comment --comment "!fw3" -j REJECT --reject-with tcp-reset
-A reject -m comment --comment "!fw3" -j REJECT --reject-with icmp6-port-unreachable
-A syn_flood -m limit --limit 25/sec --limit-burst 50 -m comment --comment "!fw3" -j RETURN
-A syn_flood -m comment --comment "!fw3" -j DROP
-A zone_docker_dest_ACCEPT -o docker0 -m comment --comment "!fw3" -j ACCEPT
-A zone_docker_forward -m comment --comment "!fw3: Custom docker forwarding rule chain" -j forwarding_docker_rule
-A zone_docker_forward -m comment --comment "!fw3" -j zone_docker_dest_ACCEPT
-A zone_docker_input -m comment --comment "!fw3: Custom docker input rule chain" -j input_docker_rule
-A zone_docker_input -m comment --comment "!fw3" -j zone_docker_src_ACCEPT
-A zone_docker_output -m comment --comment "!fw3: Custom docker output rule chain" -j output_docker_rule
-A zone_docker_output -m comment --comment "!fw3" -j zone_docker_dest_ACCEPT
-A zone_docker_src_ACCEPT -i docker0 -m conntrack --ctstate NEW,UNTRACKED -m comment --comment "!fw3" -j ACCEPT
-A zone_lan_dest_ACCEPT -o eth0 -m comment --comment "!fw3" -j ACCEPT
-A zone_lan_forward -m comment --comment "!fw3: Custom lan forwarding rule chain" -j forwarding_lan_rule
-A zone_lan_forward -m comment --comment "!fw3: Zone lan to wan forwarding policy" -j zone_wan_dest_ACCEPT
-A zone_lan_forward -m comment --comment "!fw3" -j zone_lan_dest_ACCEPT
-A zone_lan_input -m comment --comment "!fw3: Custom lan input rule chain" -j input_lan_rule
-A zone_lan_input -m comment --comment "!fw3" -j zone_lan_src_ACCEPT
-A zone_lan_output -m comment --comment "!fw3: Custom lan output rule chain" -j output_lan_rule
-A zone_lan_output -m comment --comment "!fw3" -j zone_lan_dest_ACCEPT
-A zone_lan_src_ACCEPT -i eth0 -m conntrack --ctstate NEW,UNTRACKED -m comment --comment "!fw3" -j ACCEPT
-A zone_wan_dest_ACCEPT -o pppoe-wan -m conntrack --ctstate INVALID -m comment --comment "!fw3: Prevent NAT leakage" -j DROP
-A zone_wan_dest_ACCEPT -o pppoe-wan -m comment --comment "!fw3" -j ACCEPT
-A zone_wan_dest_REJECT -o pppoe-wan -m comment --comment "!fw3" -j reject
-A zone_wan_forward -j MINIUPNPD
-A zone_wan_forward -m comment --comment "!fw3: Custom wan forwarding rule chain" -j forwarding_wan_rule
-A zone_wan_forward -p ipv6-icmp -m icmp6 --icmpv6-type 128 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Forward" -j ACCEPT
-A zone_wan_forward -p ipv6-icmp -m icmp6 --icmpv6-type 129 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Forward" -j ACCEPT
-A zone_wan_forward -p ipv6-icmp -m icmp6 --icmpv6-type 1 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Forward" -j ACCEPT
-A zone_wan_forward -p ipv6-icmp -m icmp6 --icmpv6-type 2 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Forward" -j ACCEPT
-A zone_wan_forward -p ipv6-icmp -m icmp6 --icmpv6-type 3 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Forward" -j ACCEPT
-A zone_wan_forward -p ipv6-icmp -m icmp6 --icmpv6-type 4/0 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Forward" -j ACCEPT
-A zone_wan_forward -p ipv6-icmp -m icmp6 --icmpv6-type 4/1 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Forward" -j ACCEPT
-A zone_wan_forward -p esp -m comment --comment "!fw3: Allow-IPSec-ESP" -j zone_lan_dest_ACCEPT
-A zone_wan_forward -p udp -m udp --dport 500 -m comment --comment "!fw3: Allow-ISAKMP" -j zone_lan_dest_ACCEPT
-A zone_wan_forward -m comment --comment "!fw3" -j zone_wan_dest_REJECT
-A zone_wan_input -m comment --comment "!fw3: Custom wan input rule chain" -j input_wan_rule
-A zone_wan_input -s fc00::/6 -d fc00::/6 -p udp -m udp --dport 546 -m comment --comment "!fw3: Allow-DHCPv6" -j ACCEPT
-A zone_wan_input -s fe80::/10 -p ipv6-icmp -m icmp6 --icmpv6-type 130/0 -m comment --comment "!fw3: Allow-MLD" -j ACCEPT
-A zone_wan_input -s fe80::/10 -p ipv6-icmp -m icmp6 --icmpv6-type 131/0 -m comment --comment "!fw3: Allow-MLD" -j ACCEPT
-A zone_wan_input -s fe80::/10 -p ipv6-icmp -m icmp6 --icmpv6-type 132/0 -m comment --comment "!fw3: Allow-MLD" -j ACCEPT
-A zone_wan_input -s fe80::/10 -p ipv6-icmp -m icmp6 --icmpv6-type 143/0 -m comment --comment "!fw3: Allow-MLD" -j ACCEPT
-A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 128 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT
-A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 129 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT
-A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 1 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT
-A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 2 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT
-A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 3 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT
-A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 4/0 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT
-A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 4/1 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT
-A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 133 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT
-A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 135 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT
-A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 134 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT
-A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 136 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT
-A zone_wan_input -m comment --comment "!fw3" -j zone_wan_src_REJECT
-A zone_wan_output -m comment --comment "!fw3: Custom wan output rule chain" -j output_wan_rule
-A zone_wan_output -m comment --comment "!fw3" -j zone_wan_dest_ACCEPT
-A zone_wan_src_REJECT -i pppoe-wan -m comment --comment "!fw3" -j reject
COMMIT
# Completed on Sat May 28 ********** 2022

#===================== IPSET状态 =====================#

Name: china_ip_route
Name: lan_ac_black_ips
Name: lan_ac_black_ipv6s
Name: localnetwork
Name: china

#===================== 路由表状态 =====================#

#route -n
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         *******         0.0.0.0         UG    0      0        0 pppoe-wan
*******         0.0.0.0         255.255.255.255 UH    0      0        0 pppoe-wan
*******         0.0.0.0         255.255.0.0     U     0      0        0 docker0
*******         0.0.0.0         255.255.255.0   U     0      0        0 eth0
#ip route list
default via 116.232.160.1 dev pppoe-wan proto static 
*******       dev pppoe-wan proto kernel scope link src *WAN IP* 
*******/16 dev docker0 proto kernel scope link src *******
192.168.2.0/24 dev eth0 proto kernel scope link src 192.168.2.1 
#ip rule show
0:  from all lookup local
32766:  from all lookup main
32767:  from all lookup default

#===================== 端口占用状态 =====================#

tcp        0      0 :::7890                 :::*                    LISTEN      7489/clash
tcp        0      0 :::7891                 :::*                    LISTEN      7489/clash
tcp        0      0 :::7892                 :::*                    LISTEN      7489/clash
tcp        0      0 :::7893                 :::*                    LISTEN      7489/clash
tcp        0      0 :::7895                 :::*                    LISTEN      7489/clash
tcp        0      0 :::9090                 :::*                    LISTEN      7489/clash
udp        0      0 :::7874                 :::*                                7489/clash
udp        0      0 :::7891                 :::*                                7489/clash
udp        0      0 :::7892                 :::*                                7489/clash
udp        0      0 :::7893                 :::*                                7489/clash
udp        0      0 :::7895                 :::*                                7489/clash

#===================== 测试本机DNS查询 =====================#

Server:     127.0.0.1
Address:    127.0.0.1:53

www.baidu.com   canonical name = www.a.shifen.com
Name:   www.a.shifen.com
Address: 180.101.49.11
Name:   www.a.shifen.com
Address: 180.101.49.12

#===================== resolv.conf.d =====================#

# Interface wan
nameserver 180.168.255.118
nameserver 116.228.111.18

#===================== 测试本机网络连接 =====================#

HTTP/1.1 200 OK
Accept-Ranges: bytes
Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform
Connection: keep-alive
Content-Length: 277
Content-Type: text/html
Date: Sat, 28 May 2022 07:15:21 GMT
Etag: "575e1f60-115"
Last-Modified: Mon, 13 Jun 2016 02:50:08 GMT
Pragma: no-cache
Server: bfe/1.0.8.18

#===================== 测试本机网络下载 =====================#

HTTP/2 200 
cache-control: max-age=300
content-security-policy: default-src 'none'; style-src 'unsafe-inline'; sandbox
content-type: text/plain; charset=utf-8
etag: "7454d24b4da496745bb088bba9f9900d8c0ab5b45c1af1677f49d7262484b70d"
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
x-frame-options: deny
x-xss-protection: 1; mode=block
x-github-request-id: F6CA:783E:9EA89:12F05A:62919A39
accept-ranges: bytes
date: Sat, 28 May 2022 07:15:22 GMT
via: 1.1 varnish
x-served-by: cache-qpg1260-QPG
x-cache: HIT
x-cache-hits: 1
x-timer: S1653722122.493031,VS0,VE1
vary: Authorization,Accept-Encoding,Origin
access-control-allow-origin: *
x-fastly-request-id: 1da141226ed5beb02bf754d2ffa944d78616c7ee
expires: Sat, 28 May 2022 07:20:22 GMT
source-age: 268
content-length: 80

#===================== 最近运行日志 =====================#

2022-05-28 15:10:22 OpenClash Stoping...
2022-05-28 15:10:22 Step 1: Backup The Current Groups State...
2022-05-28 15:10:22 Step 2: Delete OpenClash Firewall Rules...
2022-05-28 15:10:23 Step 3: Close The OpenClash Daemons...
2022-05-28 15:10:23 Step 4: Close The Clash Core Process...
2022-05-28 15:10:23 Step 5: Restart Dnsmasq...
2022-05-28 15:10:24 Step 6: Delete OpenClash Residue File...
2022-05-28 15:10:24 OpenClash Start Running...
2022-05-28 15:10:24 Step 1: Get The Configuration...
2022-05-28 15:10:24 Step 2: Check The Components...
2022-05-28 15:10:24 Step 3: Modify The Config File...
2022-05-28 15:10:27 Step 4: Start Running The Clash Core...
2022-05-28 15:10:27 Tip: Detected The Exclusive Function of The Meta Core, Use Meta Core to Start...
2022-05-28 15:10:29 Step 5: Check The Core Status...
time="2022-05-28T07:10:29Z" level=info msg="Start initial configuration in progress"
time="2022-05-28T07:10:30Z" level=info msg="Geodata Loader mode: memconservative"
time="2022-05-28T07:10:30Z" level=info msg="Initial configuration complete, total time: 30ms"
time="2022-05-28T07:10:30Z" level=info msg="Sniffer is loaded and working"
time="2022-05-28T07:10:30Z" level=info msg="DNS server listening at: [::]:7874"
2022-05-28 15:10:32 Step 6: Wait For The File Downloading...
2022-05-28 15:10:32 Step 7: Set Firewall Rules...
2022-05-28 15:10:32 Step 8: Restart Dnsmasq...
2022-05-28 15:10:33 Step 9: Add Cron Rules, Start Daemons...
2022-05-28 15:10:33 OpenClash Start Successful!
2022-05-28 15:11:33 Watchdog: Reset Firewall For Enabling Redirect...

### Expected Behavior

能够关闭openclash后不需要重启防火墙就能通网。

### Screenshots

_No response_
laye0619 commented 2 years ago

我也是一样的问题……

hpqqph commented 2 years ago

一样的问题。

vernesong commented 2 years ago

官方的bug，你可以在脚本里面加一句重启防火墙

AllForLandlord commented 2 years ago

原来是这样啊，谢谢回复！

vernesong commented 2 years ago

更新dev

AllForLandlord commented 2 years ago

更新dev

谢谢，但似乎更新了dev还是关闭后没有网络...

vernesong commented 2 years ago

断网状况的防火墙看下

AllForLandlord commented 2 years ago

断网状况的防火墙看下

===================== 防火墙设置 =====================

IPv4 NAT chain

Generated by iptables-save v1.8.7 on Wed Jun 1 20:36:05 2022

*nat :PREROUTING ACCEPT [8:645] :INPUT ACCEPT [329:17370] :OUTPUT ACCEPT [29:1896] :POSTROUTING ACCEPT [11:710] :DOCKER - [0:0] :MINIUPNPD - [0:0] :MINIUPNPD-POSTROUTING - [0:0] :openclash - [0:0] :openclash_output - [0:0] :postrouting_docker_rule - [0:0] :postrouting_lan_rule - [0:0] :postrouting_rule - [0:0] :postrouting_wan_rule - [0:0] :prerouting_docker_rule - [0:0] :prerouting_lan_rule - [0:0] :prerouting_rule - [0:0] :prerouting_wan_rule - [0:0] :zone_docker_postrouting - [0:0] :zone_docker_prerouting - [0:0] :zone_lan_postrouting - [0:0] :zone_lan_prerouting - [0:0] :zone_wan_postrouting - [0:0] :zone_wan_prerouting - [0:0] -A PREROUTING -d 8.8.4.4/32 -p tcp -m comment --comment "OpenClash Google DNS Hijack" -m tcp --dport 53 -j REDIRECT --to-ports 7892 -A PREROUTING -d 8.8.8.8/32 -p tcp -m comment --comment "OpenClash Google DNS Hijack" -m tcp --dport 53 -j REDIRECT --to-ports 7892 -A PREROUTING -p tcp -m tcp --dport 53 -m comment --comment "OpenClash DNS Hijack" -j REDIRECT --to-ports 53 -A PREROUTING -p udp -m udp --dport 53 -m comment --comment "OpenClash DNS Hijack" -j REDIRECT --to-ports 53 -A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER -A PREROUTING -m comment --comment "!fw3: Custom prerouting rule chain" -j prerouting_rule -A PREROUTING -i eth0 -m comment --comment "!fw3" -j zone_lan_prerouting -A PREROUTING -i pppoe-wan -m comment --comment "!fw3" -j zone_wan_prerouting -A PREROUTING -i docker0 -m comment --comment "!fw3" -j zone_docker_prerouting -A PREROUTING -p tcp -j openclash -A PREROUTING -p udp -m comment --comment DNSMASQ -m udp --dport 53 -j REDIRECT --to-ports 53 -A PREROUTING -p tcp -m comment --comment DNSMASQ -m tcp --dport 53 -j REDIRECT --to-ports 53 -A PREROUTING -p udp -m comment --comment DNSMASQ -m udp --dport 53 -j REDIRECT --to-ports 53 -A PREROUTING -p tcp -m comment --comment DNSMASQ -m tcp --dport 53 -j REDIRECT --to-ports 53 -A OUTPUT ! -d 127.0.0.0/8 -m addrtype --dst-type LOCAL -j DOCKER -A OUTPUT -j openclash_output -A POSTROUTING -s 172.17.0.0/16 ! -o docker0 -j MASQUERADE -A POSTROUTING -s 172.17.0.2/32 -d 172.17.0.2/32 -p tcp -m tcp --dport 5700 -j MASQUERADE -A POSTROUTING -m comment --comment "!fw3: Custom postrouting rule chain" -j postrouting_rule -A POSTROUTING -o eth0 -m comment --comment "!fw3" -j zone_lan_postrouting -A POSTROUTING -o pppoe-wan -m comment --comment "!fw3" -j zone_wan_postrouting -A POSTROUTING -o docker0 -m comment --comment "!fw3" -j zone_docker_postrouting -A DOCKER -i docker0 -j RETURN -A DOCKER ! -i docker0 -p tcp -m tcp --dport 5700 -j DNAT --to-destination 172.17.0.2:5700 -A MINIUPNPD -p tcp -m tcp --dport 26804 -j DNAT --to-destination 192.168.2.148:26804 -A MINIUPNPD -p udp -m udp --dport 26804 -j DNAT --to-destination 192.168.2.148:26804 -A openclash -m set --match-set localnetwork dst -j RETURN -A openclash -m set --match-set lan_ac_black_ips src -j RETURN -A openclash -p tcp -j REDIRECT --to-ports 7892 -A openclash_output -m set --match-set localnetwork dst -j RETURN -A openclash_output -p tcp -m owner ! --uid-owner 65534 -j REDIRECT --to-ports 7892 -A zone_docker_postrouting -m comment --comment "!fw3: Custom docker postrouting rule chain" -j postrouting_docker_rule -A zone_docker_prerouting -m comment --comment "!fw3: Custom docker prerouting rule chain" -j prerouting_docker_rule -A zone_lan_postrouting -m comment --comment "!fw3: Custom lan postrouting rule chain" -j postrouting_lan_rule -A zone_lan_prerouting -m comment --comment "!fw3: Custom lan prerouting rule chain" -j prerouting_lan_rule -A zone_wan_postrouting -j MINIUPNPD-POSTROUTING -A zone_wan_postrouting -m comment --comment "!fw3: Custom wan postrouting rule chain" -j postrouting_wan_rule -A zone_wan_postrouting -m comment --comment "!fw3" -j FULLCONENAT -A zone_wan_prerouting -j MINIUPNPD -A zone_wan_prerouting -m comment --comment "!fw3: Custom wan prerouting rule chain" -j prerouting_wan_rule -A zone_wan_prerouting -m comment --comment "!fw3" -j FULLCONENAT COMMIT

Completed on Wed Jun 1 20:36:05 2022

IPv4 Mangle chain

Generated by iptables-save v1.8.7 on Wed Jun 1 20:36:05 2022

*mangle :PREROUTING ACCEPT [20202498:20972436447] :INPUT ACCEPT [19876420:20932997361] :FORWARD ACCEPT [325723:39417092] :OUTPUT ACCEPT [9906818:20398193698] :POSTROUTING ACCEPT [10202629:20436301420] -A FORWARD -o pppoe-wan -p tcp -m tcp --tcp-flags SYN,RST SYN -m comment --comment "!fw3: Zone wan MTU fixing" -j TCPMSS --clamp-mss-to-pmtu -A FORWARD -i pppoe-wan -p tcp -m tcp --tcp-flags SYN,RST SYN -m comment --comment "!fw3: Zone wan MTU fixing" -j TCPMSS --clamp-mss-to-pmtu COMMIT

Completed on Wed Jun 1 20:36:05 2022

IPv4 Filter chain

Generated by iptables-save v1.8.7 on Wed Jun 1 20:36:05 2022

*filter :INPUT ACCEPT [0:0] :FORWARD DROP [0:0] :OUTPUT ACCEPT [0:0] :DOCKER - [0:0] :DOCKER-ISOLATION-STAGE-1 - [0:0] :DOCKER-ISOLATION-STAGE-2 - [0:0] :DOCKER-MAN - [0:0] :DOCKER-USER - [0:0] :MINIUPNPD - [0:0] :forwarding_docker_rule - [0:0] :forwarding_lan_rule - [0:0] :forwarding_rule - [0:0] :forwarding_wan_rule - [0:0] :input_docker_rule - [0:0] :input_lan_rule - [0:0] :input_rule - [0:0] :input_wan_rule - [0:0] :openclash_wan_input - [0:0] :output_docker_rule - [0:0] :output_lan_rule - [0:0] :output_rule - [0:0] :output_wan_rule - [0:0] :reject - [0:0] :syn_flood - [0:0] :zone_docker_dest_ACCEPT - [0:0] :zone_docker_forward - [0:0] :zone_docker_input - [0:0] :zone_docker_output - [0:0] :zone_docker_src_ACCEPT - [0:0] :zone_lan_dest_ACCEPT - [0:0] :zone_lan_forward - [0:0] :zone_lan_input - [0:0] :zone_lan_output - [0:0] :zone_lan_src_ACCEPT - [0:0] :zone_wan_dest_ACCEPT - [0:0] :zone_wan_dest_REJECT - [0:0] :zone_wan_forward - [0:0] :zone_wan_input - [0:0] :zone_wan_output - [0:0] :zone_wan_src_REJECT - [0:0] -A INPUT -i pppoe-wan -j openclash_wan_input -A INPUT -i lo -m comment --comment "!fw3" -j ACCEPT -A INPUT -m comment --comment "!fw3: Custom input rule chain" -j input_rule -A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment "!fw3" -j ACCEPT -A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -m comment --comment "!fw3" -j syn_flood -A INPUT -i eth0 -m comment --comment "!fw3" -j zone_lan_input -A INPUT -i pppoe-wan -m comment --comment "!fw3" -j zone_wan_input -A INPUT -i docker0 -m comment --comment "!fw3" -j zone_docker_input -A FORWARD -j DOCKER-USER -A FORWARD -j DOCKER-ISOLATION-STAGE-1 -A FORWARD -o docker0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT -A FORWARD -o docker0 -j DOCKER -A FORWARD -i docker0 ! -o docker0 -j ACCEPT -A FORWARD -i docker0 -o docker0 -j ACCEPT -A FORWARD -m comment --comment "!fw3: Custom forwarding rule chain" -j forwarding_rule -A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment "!fw3" -j ACCEPT -A FORWARD -i eth0 -m comment --comment "!fw3" -j zone_lan_forward -A FORWARD -i pppoe-wan -m comment --comment "!fw3" -j zone_wan_forward -A FORWARD -i docker0 -m comment --comment "!fw3" -j zone_docker_forward -A FORWARD -m comment --comment "!fw3" -j reject -A OUTPUT -o lo -m comment --comment "!fw3" -j ACCEPT -A OUTPUT -m comment --comment "!fw3: Custom output rule chain" -j output_rule -A OUTPUT -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment "!fw3" -j ACCEPT -A OUTPUT -o eth0 -m comment --comment "!fw3" -j zone_lan_output -A OUTPUT -o pppoe-wan -m comment --comment "!fw3" -j zone_wan_output -A OUTPUT -o docker0 -m comment --comment "!fw3" -j zone_docker_output -A DOCKER -d 172.17.0.2/32 ! -i docker0 -o docker0 -p tcp -m tcp --dport 5700 -j ACCEPT -A DOCKER-ISOLATION-STAGE-1 -i docker0 ! -o docker0 -j DOCKER-ISOLATION-STAGE-2 -A DOCKER-ISOLATION-STAGE-1 -j RETURN -A DOCKER-ISOLATION-STAGE-2 -o docker0 -j DROP -A DOCKER-ISOLATION-STAGE-2 -j RETURN -A DOCKER-MAN -i eth0 -o docker0 -j RETURN -A DOCKER-MAN -o docker0 -m conntrack --ctstate RELATED,ESTABLISHED -j RETURN -A DOCKER-MAN -o docker0 -m conntrack --ctstate INVALID,NEW -j DROP -A DOCKER-MAN -j RETURN -A DOCKER-USER -j DOCKER-MAN -A DOCKER-USER -j RETURN -A MINIUPNPD -d 192.168.2.148/32 -p tcp -m tcp --dport 26804 -j ACCEPT -A MINIUPNPD -d 192.168.2.148/32 -p udp -m udp --dport 26804 -j ACCEPT -A openclash_wan_input -p udp -m multiport --dports 7892,7895,9090,7890,7891,7893,7874 -j REJECT --reject-with icmp-port-unreachable -A openclash_wan_input -p tcp -m multiport --dports 7892,7895,9090,7890,7891,7893,7874 -j REJECT --reject-with icmp-port-unreachable -A reject -p tcp -m comment --comment "!fw3" -j REJECT --reject-with tcp-reset -A reject -m comment --comment "!fw3" -j REJECT --reject-with icmp-port-unreachable -A syn_flood -m limit --limit 25/sec --limit-burst 50 -m comment --comment "!fw3" -j RETURN -A syn_flood -m comment --comment "!fw3" -j DROP -A zone_docker_dest_ACCEPT -o docker0 -m comment --comment "!fw3" -j ACCEPT -A zone_docker_forward -m comment --comment "!fw3: Custom docker forwarding rule chain" -j forwarding_docker_rule -A zone_docker_forward -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port forwards" -j ACCEPT -A zone_docker_forward -m comment --comment "!fw3" -j zone_docker_dest_ACCEPT -A zone_docker_input -m comment --comment "!fw3: Custom docker input rule chain" -j input_docker_rule -A zone_docker_input -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port redirections" -j ACCEPT -A zone_docker_input -m comment --comment "!fw3" -j zone_docker_src_ACCEPT -A zone_docker_output -m comment --comment "!fw3: Custom docker output rule chain" -j output_docker_rule -A zone_docker_output -m comment --comment "!fw3" -j zone_docker_dest_ACCEPT -A zone_docker_src_ACCEPT -i docker0 -m conntrack --ctstate NEW,UNTRACKED -m comment --comment "!fw3" -j ACCEPT -A zone_lan_dest_ACCEPT -o eth0 -m comment --comment "!fw3" -j ACCEPT -A zone_lan_forward -m comment --comment "!fw3: Custom lan forwarding rule chain" -j forwarding_lan_rule -A zone_lan_forward -m comment --comment "!fw3: Zone lan to wan forwarding policy" -j zone_wan_dest_ACCEPT -A zone_lan_forward -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port forwards" -j ACCEPT -A zone_lan_forward -m comment --comment "!fw3" -j zone_lan_dest_ACCEPT -A zone_lan_input -m comment --comment "!fw3: Custom lan input rule chain" -j input_lan_rule -A zone_lan_input -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port redirections" -j ACCEPT -A zone_lan_input -m comment --comment "!fw3" -j zone_lan_src_ACCEPT -A zone_lan_output -m comment --comment "!fw3: Custom lan output rule chain" -j output_lan_rule -A zone_lan_output -m comment --comment "!fw3" -j zone_lan_dest_ACCEPT -A zone_lan_src_ACCEPT -i eth0 -m conntrack --ctstate NEW,UNTRACKED -m comment --comment "!fw3" -j ACCEPT -A zone_wan_dest_ACCEPT -o pppoe-wan -m conntrack --ctstate INVALID -m comment --comment "!fw3: Prevent NAT leakage" -j DROP -A zone_wan_dest_ACCEPT -o pppoe-wan -m comment --comment "!fw3" -j ACCEPT -A zone_wan_dest_REJECT -o pppoe-wan -m comment --comment "!fw3" -j reject -A zone_wan_forward -j MINIUPNPD -A zone_wan_forward -m comment --comment "!fw3: Custom wan forwarding rule chain" -j forwarding_wan_rule -A zone_wan_forward -p esp -m comment --comment "!fw3: Allow-IPSec-ESP" -j zone_lan_dest_ACCEPT -A zone_wan_forward -p udp -m udp --dport 500 -m comment --comment "!fw3: Allow-ISAKMP" -j zone_lan_dest_ACCEPT -A zone_wan_forward -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port forwards" -j ACCEPT -A zone_wan_forward -m comment --comment "!fw3" -j zone_wan_dest_REJECT -A zone_wan_input -m comment --comment "!fw3: Custom wan input rule chain" -j input_wan_rule -A zone_wan_input -p udp -m udp --dport 68 -m comment --comment "!fw3: Allow-DHCP-Renew" -j ACCEPT -A zone_wan_input -p icmp -m icmp --icmp-type 8 -m comment --comment "!fw3: Allow-Ping" -j ACCEPT -A zone_wan_input -p igmp -m comment --comment "!fw3: Allow-IGMP" -j ACCEPT -A zone_wan_input -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port redirections" -j ACCEPT -A zone_wan_input -m comment --comment "!fw3" -j zone_wan_src_REJECT -A zone_wan_output -m comment --comment "!fw3: Custom wan output rule chain" -j output_wan_rule -A zone_wan_output -m comment --comment "!fw3" -j zone_wan_dest_ACCEPT -A zone_wan_src_REJECT -i pppoe-wan -m comment --comment "!fw3" -j reject COMMIT

Completed on Wed Jun 1 20:36:05 2022

IPv6 NAT chain

Generated by ip6tables-save v1.8.7 on Wed Jun 1 20:36:05 2022

*nat :PREROUTING ACCEPT [0:0] :INPUT ACCEPT [0:0] :OUTPUT ACCEPT [4:370] :POSTROUTING ACCEPT [4:370] -A PREROUTING -p udp -m comment --comment DNSMASQ -m udp --dport 53 -j REDIRECT --to-ports 53 -A PREROUTING -p tcp -m comment --comment DNSMASQ -m tcp --dport 53 -j REDIRECT --to-ports 53 -A PREROUTING -p udp -m comment --comment DNSMASQ -m udp --dport 53 -j REDIRECT --to-ports 53 -A PREROUTING -p tcp -m comment --comment DNSMASQ -m tcp --dport 53 -j REDIRECT --to-ports 53 COMMIT

Completed on Wed Jun 1 20:36:05 2022

IPv6 Mangle chain

Generated by ip6tables-save v1.8.7 on Wed Jun 1 20:36:05 2022

*mangle :PREROUTING ACCEPT [1270:132706] :INPUT ACCEPT [1270:132706] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [923:104786] :POSTROUTING ACCEPT [923:104786] -A FORWARD -o pppoe-wan -p tcp -m tcp --tcp-flags SYN,RST SYN -m comment --comment "!fw3: Zone wan MTU fixing" -j TCPMSS --clamp-mss-to-pmtu -A FORWARD -i pppoe-wan -p tcp -m tcp --tcp-flags SYN,RST SYN -m comment --comment "!fw3: Zone wan MTU fixing" -j TCPMSS --clamp-mss-to-pmtu COMMIT

Completed on Wed Jun 1 20:36:05 2022

IPv6 Filter chain

Generated by ip6tables-save v1.8.7 on Wed Jun 1 20:36:05 2022

*filter :INPUT ACCEPT [0:0] :FORWARD DROP [0:0] :OUTPUT ACCEPT [7:648] :MINIUPNPD - [0:0] :forwarding_docker_rule - [0:0] :forwarding_lan_rule - [0:0] :forwarding_rule - [0:0] :forwarding_wan_rule - [0:0] :input_docker_rule - [0:0] :input_lan_rule - [0:0] :input_rule - [0:0] :input_wan_rule - [0:0] :output_docker_rule - [0:0] :output_lan_rule - [0:0] :output_rule - [0:0] :output_wan_rule - [0:0] :reject - [0:0] :syn_flood - [0:0] :zone_docker_dest_ACCEPT - [0:0] :zone_docker_forward - [0:0] :zone_docker_input - [0:0] :zone_docker_output - [0:0] :zone_docker_src_ACCEPT - [0:0] :zone_lan_dest_ACCEPT - [0:0] :zone_lan_forward - [0:0] :zone_lan_input - [0:0] :zone_lan_output - [0:0] :zone_lan_src_ACCEPT - [0:0] :zone_wan_dest_ACCEPT - [0:0] :zone_wan_dest_REJECT - [0:0] :zone_wan_forward - [0:0] :zone_wan_input - [0:0] :zone_wan_output - [0:0] :zone_wan_src_REJECT - [0:0] -A INPUT -i lo -m comment --comment "!fw3" -j ACCEPT -A INPUT -m comment --comment "!fw3: Custom input rule chain" -j input_rule -A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment "!fw3" -j ACCEPT -A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -m comment --comment "!fw3" -j syn_flood -A INPUT -i eth0 -m comment --comment "!fw3" -j zone_lan_input -A INPUT -i pppoe-wan -m comment --comment "!fw3" -j zone_wan_input -A INPUT -i docker0 -m comment --comment "!fw3" -j zone_docker_input -A FORWARD -m comment --comment "!fw3: Custom forwarding rule chain" -j forwarding_rule -A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment "!fw3" -j ACCEPT -A FORWARD -i eth0 -m comment --comment "!fw3" -j zone_lan_forward -A FORWARD -i pppoe-wan -m comment --comment "!fw3" -j zone_wan_forward -A FORWARD -i docker0 -m comment --comment "!fw3" -j zone_docker_forward -A FORWARD -m comment --comment "!fw3" -j reject -A OUTPUT -o lo -m comment --comment "!fw3" -j ACCEPT -A OUTPUT -m comment --comment "!fw3: Custom output rule chain" -j output_rule -A OUTPUT -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment "!fw3" -j ACCEPT -A OUTPUT -o eth0 -m comment --comment "!fw3" -j zone_lan_output -A OUTPUT -o pppoe-wan -m comment --comment "!fw3" -j zone_wan_output -A OUTPUT -o docker0 -m comment --comment "!fw3" -j zone_docker_output -A reject -p tcp -m comment --comment "!fw3" -j REJECT --reject-with tcp-reset -A reject -m comment --comment "!fw3" -j REJECT --reject-with icmp6-port-unreachable -A syn_flood -m limit --limit 25/sec --limit-burst 50 -m comment --comment "!fw3" -j RETURN -A syn_flood -m comment --comment "!fw3" -j DROP -A zone_docker_dest_ACCEPT -o docker0 -m comment --comment "!fw3" -j ACCEPT -A zone_docker_forward -m comment --comment "!fw3: Custom docker forwarding rule chain" -j forwarding_docker_rule -A zone_docker_forward -m comment --comment "!fw3" -j zone_docker_dest_ACCEPT -A zone_docker_input -m comment --comment "!fw3: Custom docker input rule chain" -j input_docker_rule -A zone_docker_input -m comment --comment "!fw3" -j zone_docker_src_ACCEPT -A zone_docker_output -m comment --comment "!fw3: Custom docker output rule chain" -j output_docker_rule -A zone_docker_output -m comment --comment "!fw3" -j zone_docker_dest_ACCEPT -A zone_docker_src_ACCEPT -i docker0 -m conntrack --ctstate NEW,UNTRACKED -m comment --comment "!fw3" -j ACCEPT -A zone_lan_dest_ACCEPT -o eth0 -m comment --comment "!fw3" -j ACCEPT -A zone_lan_forward -m comment --comment "!fw3: Custom lan forwarding rule chain" -j forwarding_lan_rule -A zone_lan_forward -m comment --comment "!fw3: Zone lan to wan forwarding policy" -j zone_wan_dest_ACCEPT -A zone_lan_forward -m comment --comment "!fw3" -j zone_lan_dest_ACCEPT -A zone_lan_input -m comment --comment "!fw3: Custom lan input rule chain" -j input_lan_rule -A zone_lan_input -m comment --comment "!fw3" -j zone_lan_src_ACCEPT -A zone_lan_output -m comment --comment "!fw3: Custom lan output rule chain" -j output_lan_rule -A zone_lan_output -m comment --comment "!fw3" -j zone_lan_dest_ACCEPT -A zone_lan_src_ACCEPT -i eth0 -m conntrack --ctstate NEW,UNTRACKED -m comment --comment "!fw3" -j ACCEPT -A zone_wan_dest_ACCEPT -o pppoe-wan -m conntrack --ctstate INVALID -m comment --comment "!fw3: Prevent NAT leakage" -j DROP -A zone_wan_dest_ACCEPT -o pppoe-wan -m comment --comment "!fw3" -j ACCEPT -A zone_wan_dest_REJECT -o pppoe-wan -m comment --comment "!fw3" -j reject -A zone_wan_forward -j MINIUPNPD -A zone_wan_forward -m comment --comment "!fw3: Custom wan forwarding rule chain" -j forwarding_wan_rule -A zone_wan_forward -p ipv6-icmp -m icmp6 --icmpv6-type 128 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Forward" -j ACCEPT -A zone_wan_forward -p ipv6-icmp -m icmp6 --icmpv6-type 129 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Forward" -j ACCEPT -A zone_wan_forward -p ipv6-icmp -m icmp6 --icmpv6-type 1 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Forward" -j ACCEPT -A zone_wan_forward -p ipv6-icmp -m icmp6 --icmpv6-type 2 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Forward" -j ACCEPT -A zone_wan_forward -p ipv6-icmp -m icmp6 --icmpv6-type 3 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Forward" -j ACCEPT -A zone_wan_forward -p ipv6-icmp -m icmp6 --icmpv6-type 4/0 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Forward" -j ACCEPT -A zone_wan_forward -p ipv6-icmp -m icmp6 --icmpv6-type 4/1 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Forward" -j ACCEPT -A zone_wan_forward -p esp -m comment --comment "!fw3: Allow-IPSec-ESP" -j zone_lan_dest_ACCEPT -A zone_wan_forward -p udp -m udp --dport 500 -m comment --comment "!fw3: Allow-ISAKMP" -j zone_lan_dest_ACCEPT -A zone_wan_forward -m comment --comment "!fw3" -j zone_wan_dest_REJECT -A zone_wan_input -m comment --comment "!fw3: Custom wan input rule chain" -j input_wan_rule -A zone_wan_input -s fc00::/6 -d fc00::/6 -p udp -m udp --dport 546 -m comment --comment "!fw3: Allow-DHCPv6" -j ACCEPT -A zone_wan_input -s fe80::/10 -p ipv6-icmp -m icmp6 --icmpv6-type 130/0 -m comment --comment "!fw3: Allow-MLD" -j ACCEPT -A zone_wan_input -s fe80::/10 -p ipv6-icmp -m icmp6 --icmpv6-type 131/0 -m comment --comment "!fw3: Allow-MLD" -j ACCEPT -A zone_wan_input -s fe80::/10 -p ipv6-icmp -m icmp6 --icmpv6-type 132/0 -m comment --comment "!fw3: Allow-MLD" -j ACCEPT -A zone_wan_input -s fe80::/10 -p ipv6-icmp -m icmp6 --icmpv6-type 143/0 -m comment --comment "!fw3: Allow-MLD" -j ACCEPT -A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 128 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT -A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 129 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT -A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 1 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT -A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 2 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT -A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 3 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT -A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 4/0 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT -A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 4/1 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT -A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 133 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT -A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 135 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT -A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 134 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT -A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 136 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT -A zone_wan_input -m comment --comment "!fw3" -j zone_wan_src_REJECT -A zone_wan_output -m comment --comment "!fw3: Custom wan output rule chain" -j output_wan_rule -A zone_wan_output -m comment --comment "!fw3" -j zone_wan_dest_ACCEPT -A zone_wan_src_REJECT -i pppoe-wan -m comment --comment "!fw3" -j reject COMMIT

Completed on Wed Jun 1 20:36:05 2022

msylgj commented 2 years ago

@AllForLandlord 界面上点击关闭openclash之后 ssh登录后台输入iptables-save 把输出的结果贴一下看看. 上面的防火墙结果是在openclash显示未运行的情况下点调试日志生成的?

AllForLandlord commented 2 years ago

@AllForLandlord 界面上点击关闭openclash之后 ssh登录后台输入iptables-save 把输出的结果贴一下看看. 上面的防火墙结果是在openclash显示未运行的情况下点调试日志生成的?

是的。下面的是按照您说的日志：

Generated by iptables-save v1.8.7 on Thu Jun 2 11:14:36 2022

*nat :PREROUTING ACCEPT [9:452] :INPUT ACCEPT [935:51434] :OUTPUT ACCEPT [86:5730] :POSTROUTING ACCEPT [0:0] :DOCKER - [0:0] :MINIUPNPD - [0:0] :MINIUPNPD-POSTROUTING - [0:0] :openclash - [0:0] :openclash_output - [0:0] :postrouting_docker_rule - [0:0] :postrouting_lan_rule - [0:0] :postrouting_rule - [0:0] :postrouting_wan_rule - [0:0] :prerouting_docker_rule - [0:0] :prerouting_lan_rule - [0:0] :prerouting_rule - [0:0] :prerouting_wan_rule - [0:0] :zone_docker_postrouting - [0:0] :zone_docker_prerouting - [0:0] :zone_lan_postrouting - [0:0] :zone_lan_prerouting - [0:0] :zone_wan_postrouting - [0:0] :zone_wan_prerouting - [0:0] -A PREROUTING -d 8.8.4.4/32 -p tcp -m comment --comment "OpenClash Google DNS Hijack" -m tcp --dport 53 -j REDIRECT --to-ports 7892 -A PREROUTING -d 8.8.8.8/32 -p tcp -m comment --comment "OpenClash Google DNS Hijack" -m tcp --dport 53 -j REDIRECT --to-ports 7892 -A PREROUTING -p tcp -m tcp --dport 53 -m comment --comment "OpenClash DNS Hijack" -j REDIRECT --to-ports 53 -A PREROUTING -p udp -m udp --dport 53 -m comment --comment "OpenClash DNS Hijack" -j REDIRECT --to-ports 53 -A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER -A PREROUTING -m comment --comment "!fw3: Custom prerouting rule chain" -j prerouting_rule -A PREROUTING -i eth0 -m comment --comment "!fw3" -j zone_lan_prerouting -A PREROUTING -i pppoe-wan -m comment --comment "!fw3" -j zone_wan_prerouting -A PREROUTING -i docker0 -m comment --comment "!fw3" -j zone_docker_prerouting -A PREROUTING -p tcp -j openclash -A PREROUTING -p udp -m comment --comment DNSMASQ -m udp --dport 53 -j REDIRECT --to-ports 53 -A PREROUTING -p tcp -m comment --comment DNSMASQ -m tcp --dport 53 -j REDIRECT --to-ports 53 -A PREROUTING -p udp -m comment --comment DNSMASQ -m udp --dport 53 -j REDIRECT --to-ports 53 -A PREROUTING -p tcp -m comment --comment DNSMASQ -m tcp --dport 53 -j REDIRECT --to-ports 53 -A OUTPUT ! -d 127.0.0.0/8 -m addrtype --dst-type LOCAL -j DOCKER -A OUTPUT -j openclash_output -A POSTROUTING -s 172.17.0.0/16 ! -o docker0 -j MASQUERADE -A POSTROUTING -s 172.17.0.2/32 -d 172.17.0.2/32 -p tcp -m tcp --dport 5700 -j MASQUERADE -A POSTROUTING -m comment --comment "!fw3: Custom postrouting rule chain" -j postrouting_rule -A POSTROUTING -o eth0 -m comment --comment "!fw3" -j zone_lan_postrouting -A POSTROUTING -o pppoe-wan -m comment --comment "!fw3" -j zone_wan_postrouting -A POSTROUTING -o docker0 -m comment --comment "!fw3" -j zone_docker_postrouting -A DOCKER -i docker0 -j RETURN -A DOCKER ! -i docker0 -p tcp -m tcp --dport 5700 -j DNAT --to-destination 172.17.0.2:5700 -A MINIUPNPD -p tcp -m tcp --dport 26804 -j DNAT --to-destination 192.168.2.148:26804 -A MINIUPNPD -p udp -m udp --dport 26804 -j DNAT --to-destination 192.168.2.148:26804 -A openclash -m set --match-set localnetwork dst -j RETURN -A openclash -m set --match-set lan_ac_black_ips src -j RETURN -A openclash -p tcp -j REDIRECT --to-ports 7892 -A openclash_output -m set --match-set localnetwork dst -j RETURN -A openclash_output -p tcp -m owner ! --uid-owner 65534 -j REDIRECT --to-ports 7892 -A zone_docker_postrouting -m comment --comment "!fw3: Custom docker postrouting rule chain" -j postrouting_docker_rule -A zone_docker_prerouting -m comment --comment "!fw3: Custom docker prerouting rule chain" -j prerouting_docker_rule -A zone_lan_postrouting -m comment --comment "!fw3: Custom lan postrouting rule chain" -j postrouting_lan_rule -A zone_lan_prerouting -m comment --comment "!fw3: Custom lan prerouting rule chain" -j prerouting_lan_rule -A zone_wan_postrouting -j MINIUPNPD-POSTROUTING -A zone_wan_postrouting -m comment --comment "!fw3: Custom wan postrouting rule chain" -j postrouting_wan_rule -A zone_wan_postrouting -m comment --comment "!fw3" -j FULLCONENAT -A zone_wan_prerouting -j MINIUPNPD -A zone_wan_prerouting -m comment --comment "!fw3: Custom wan prerouting rule chain" -j prerouting_wan_rule -A zone_wan_prerouting -m comment --comment "!fw3" -j FULLCONENAT COMMIT

Completed on Thu Jun 2 11:14:36 2022

Generated by iptables-save v1.8.7 on Thu Jun 2 11:14:36 2022

*mangle :PREROUTING ACCEPT [25727776:26186071711] :INPUT ACCEPT [25340048:26139387936] :FORWARD ACCEPT [387274:46656297] :OUTPUT ACCEPT [12857189:25491040148] :POSTROUTING ACCEPT [13203124:25535904935] -A FORWARD -o pppoe-wan -p tcp -m tcp --tcp-flags SYN,RST SYN -m comment --comment "!fw3: Zone wan MTU fixing" -j TCPMSS --clamp-mss-to-pmtu -A FORWARD -i pppoe-wan -p tcp -m tcp --tcp-flags SYN,RST SYN -m comment --comment "!fw3: Zone wan MTU fixing" -j TCPMSS --clamp-mss-to-pmtu COMMIT

Completed on Thu Jun 2 11:14:36 2022

Generated by iptables-save v1.8.7 on Thu Jun 2 11:14:36 2022

*filter :INPUT ACCEPT [0:0] :FORWARD DROP [0:0] :OUTPUT ACCEPT [0:0] :DOCKER - [0:0] :DOCKER-ISOLATION-STAGE-1 - [0:0] :DOCKER-ISOLATION-STAGE-2 - [0:0] :DOCKER-MAN - [0:0] :DOCKER-USER - [0:0] :MINIUPNPD - [0:0] :forwarding_docker_rule - [0:0] :forwarding_lan_rule - [0:0] :forwarding_rule - [0:0] :forwarding_wan_rule - [0:0] :input_docker_rule - [0:0] :input_lan_rule - [0:0] :input_rule - [0:0] :input_wan_rule - [0:0] :openclash_wan_input - [0:0] :output_docker_rule - [0:0] :output_lan_rule - [0:0] :output_rule - [0:0] :output_wan_rule - [0:0] :reject - [0:0] :syn_flood - [0:0] :zone_docker_dest_ACCEPT - [0:0] :zone_docker_forward - [0:0] :zone_docker_input - [0:0] :zone_docker_output - [0:0] :zone_docker_src_ACCEPT - [0:0] :zone_lan_dest_ACCEPT - [0:0] :zone_lan_forward - [0:0] :zone_lan_input - [0:0] :zone_lan_output - [0:0] :zone_lan_src_ACCEPT - [0:0] :zone_wan_dest_ACCEPT - [0:0] :zone_wan_dest_REJECT - [0:0] :zone_wan_forward - [0:0] :zone_wan_input - [0:0] :zone_wan_output - [0:0] :zone_wan_src_REJECT - [0:0] -A INPUT -i pppoe-wan -j openclash_wan_input -A INPUT -i lo -m comment --comment "!fw3" -j ACCEPT -A INPUT -m comment --comment "!fw3: Custom input rule chain" -j input_rule -A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment "!fw3" -j ACCEPT -A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -m comment --comment "!fw3" -j syn_flood -A INPUT -i eth0 -m comment --comment "!fw3" -j zone_lan_input -A INPUT -i pppoe-wan -m comment --comment "!fw3" -j zone_wan_input -A INPUT -i docker0 -m comment --comment "!fw3" -j zone_docker_input -A FORWARD -j DOCKER-USER -A FORWARD -j DOCKER-ISOLATION-STAGE-1 -A FORWARD -o docker0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT -A FORWARD -o docker0 -j DOCKER -A FORWARD -i docker0 ! -o docker0 -j ACCEPT -A FORWARD -i docker0 -o docker0 -j ACCEPT -A FORWARD -m comment --comment "!fw3: Custom forwarding rule chain" -j forwarding_rule -A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment "!fw3" -j ACCEPT -A FORWARD -i eth0 -m comment --comment "!fw3" -j zone_lan_forward -A FORWARD -i pppoe-wan -m comment --comment "!fw3" -j zone_wan_forward -A FORWARD -i docker0 -m comment --comment "!fw3" -j zone_docker_forward -A FORWARD -m comment --comment "!fw3" -j reject -A OUTPUT -o lo -m comment --comment "!fw3" -j ACCEPT -A OUTPUT -m comment --comment "!fw3: Custom output rule chain" -j output_rule -A OUTPUT -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment "!fw3" -j ACCEPT -A OUTPUT -o eth0 -m comment --comment "!fw3" -j zone_lan_output -A OUTPUT -o pppoe-wan -m comment --comment "!fw3" -j zone_wan_output -A OUTPUT -o docker0 -m comment --comment "!fw3" -j zone_docker_output -A DOCKER -d 172.17.0.2/32 ! -i docker0 -o docker0 -p tcp -m tcp --dport 5700 -j ACCEPT -A DOCKER-ISOLATION-STAGE-1 -i docker0 ! -o docker0 -j DOCKER-ISOLATION-STAGE-2 -A DOCKER-ISOLATION-STAGE-1 -j RETURN -A DOCKER-ISOLATION-STAGE-2 -o docker0 -j DROP -A DOCKER-ISOLATION-STAGE-2 -j RETURN -A DOCKER-MAN -i eth0 -o docker0 -j RETURN -A DOCKER-MAN -o docker0 -m conntrack --ctstate RELATED,ESTABLISHED -j RETURN -A DOCKER-MAN -o docker0 -m conntrack --ctstate INVALID,NEW -j DROP -A DOCKER-MAN -j RETURN -A DOCKER-USER -j DOCKER-MAN -A DOCKER-USER -j RETURN -A MINIUPNPD -d 192.168.2.148/32 -p tcp -m tcp --dport 26804 -j ACCEPT -A MINIUPNPD -d 192.168.2.148/32 -p udp -m udp --dport 26804 -j ACCEPT -A openclash_wan_input -p udp -m multiport --dports 7892,7895,9090,7890,7891,7893,7874 -j REJECT --reject-with icmp-port-unreachable -A openclash_wan_input -p tcp -m multiport --dports 7892,7895,9090,7890,7891,7893,7874 -j REJECT --reject-with icmp-port-unreachable -A reject -p tcp -m comment --comment "!fw3" -j REJECT --reject-with tcp-reset -A reject -m comment --comment "!fw3" -j REJECT --reject-with icmp-port-unreachable -A syn_flood -m limit --limit 25/sec --limit-burst 50 -m comment --comment "!fw3" -j RETURN -A syn_flood -m comment --comment "!fw3" -j DROP -A zone_docker_dest_ACCEPT -o docker0 -m comment --comment "!fw3" -j ACCEPT -A zone_docker_forward -m comment --comment "!fw3: Custom docker forwarding rule chain" -j forwarding_docker_rule -A zone_docker_forward -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port forwards" -j ACCEPT -A zone_docker_forward -m comment --comment "!fw3" -j zone_docker_dest_ACCEPT -A zone_docker_input -m comment --comment "!fw3: Custom docker input rule chain" -j input_docker_rule -A zone_docker_input -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port redirections" -j ACCEPT -A zone_docker_input -m comment --comment "!fw3" -j zone_docker_src_ACCEPT -A zone_docker_output -m comment --comment "!fw3: Custom docker output rule chain" -j output_docker_rule -A zone_docker_output -m comment --comment "!fw3" -j zone_docker_dest_ACCEPT -A zone_docker_src_ACCEPT -i docker0 -m conntrack --ctstate NEW,UNTRACKED -m comment --comment "!fw3" -j ACCEPT -A zone_lan_dest_ACCEPT -o eth0 -m comment --comment "!fw3" -j ACCEPT -A zone_lan_forward -m comment --comment "!fw3: Custom lan forwarding rule chain" -j forwarding_lan_rule -A zone_lan_forward -m comment --comment "!fw3: Zone lan to wan forwarding policy" -j zone_wan_dest_ACCEPT -A zone_lan_forward -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port forwards" -j ACCEPT -A zone_lan_forward -m comment --comment "!fw3" -j zone_lan_dest_ACCEPT -A zone_lan_input -m comment --comment "!fw3: Custom lan input rule chain" -j input_lan_rule -A zone_lan_input -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port redirections" -j ACCEPT -A zone_lan_input -m comment --comment "!fw3" -j zone_lan_src_ACCEPT -A zone_lan_output -m comment --comment "!fw3: Custom lan output rule chain" -j output_lan_rule -A zone_lan_output -m comment --comment "!fw3" -j zone_lan_dest_ACCEPT -A zone_lan_src_ACCEPT -i eth0 -m conntrack --ctstate NEW,UNTRACKED -m comment --comment "!fw3" -j ACCEPT -A zone_wan_dest_ACCEPT -o pppoe-wan -m conntrack --ctstate INVALID -m comment --comment "!fw3: Prevent NAT leakage" -j DROP -A zone_wan_dest_ACCEPT -o pppoe-wan -m comment --comment "!fw3" -j ACCEPT -A zone_wan_dest_REJECT -o pppoe-wan -m comment --comment "!fw3" -j reject -A zone_wan_forward -j MINIUPNPD -A zone_wan_forward -m comment --comment "!fw3: Custom wan forwarding rule chain" -j forwarding_wan_rule -A zone_wan_forward -p esp -m comment --comment "!fw3: Allow-IPSec-ESP" -j zone_lan_dest_ACCEPT -A zone_wan_forward -p udp -m udp --dport 500 -m comment --comment "!fw3: Allow-ISAKMP" -j zone_lan_dest_ACCEPT -A zone_wan_forward -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port forwards" -j ACCEPT -A zone_wan_forward -m comment --comment "!fw3" -j zone_wan_dest_REJECT -A zone_wan_input -m comment --comment "!fw3: Custom wan input rule chain" -j input_wan_rule -A zone_wan_input -p udp -m udp --dport 68 -m comment --comment "!fw3: Allow-DHCP-Renew" -j ACCEPT -A zone_wan_input -p icmp -m icmp --icmp-type 8 -m comment --comment "!fw3: Allow-Ping" -j ACCEPT -A zone_wan_input -p igmp -m comment --comment "!fw3: Allow-IGMP" -j ACCEPT -A zone_wan_input -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port redirections" -j ACCEPT -A zone_wan_input -m comment --comment "!fw3" -j zone_wan_src_REJECT -A zone_wan_output -m comment --comment "!fw3: Custom wan output rule chain" -j output_wan_rule -A zone_wan_output -m comment --comment "!fw3" -j zone_wan_dest_ACCEPT -A zone_wan_src_REJECT -i pppoe-wan -m comment --comment "!fw3" -j reject COMMIT

Completed on Thu Jun 2 11:14:36 2022

msylgj commented 2 years ago

openclash.zip 先正常启动openclash, 然后用压缩包中的文件替换/etc/init.d/中的同名文件. 然后在界面点击关闭openclash. 之后在/tmp/目录下找到oc.log文件, 里面的内容发出来

@AllForLandlord

AllForLandlord commented 2 years ago

wow，按照您说的把文件替换之后我关闭openclash以后就能直接通网了！ 下面是oc.log的内容： Thu Jun 2 12:31:50 CST 2022 Enter stop Thu Jun 2 12:31:50 CST 2022 Enter revert_firewall Thu Jun 2 12:31:50 CST 2022 clean route Thu Jun 2 12:31:50 CST 2022 iptables -D INPUT 1 Thu Jun 2 12:31:50 CST 2022 iptables -t nat -D OUTPUT 2 Thu Jun 2 12:31:51 CST 2022 iptables -t nat -D PREROUTING 14 Thu Jun 2 12:31:51 CST 2022 iptables -t nat -D PREROUTING 4 Thu Jun 2 12:31:51 CST 2022 iptables -t nat -D PREROUTING 3 Thu Jun 2 12:31:51 CST 2022 iptables -t nat -D PREROUTING 2 Thu Jun 2 12:31:51 CST 2022 iptables -t nat -D PREROUTING 1 Thu Jun 2 12:31:51 CST 2022 clean rules Thu Jun 2 12:31:51 CST 2022 clean chain Thu Jun 2 12:31:51 CST 2022 Enter reload Thu Jun 2 12:31:52 CST 2022 clean ipset Thu Jun 2 12:31:53 CST 2022 do killclash Thu Jun 2 12:31:53 CST 2022 do delete

msylgj commented 2 years ago

wow，按照您说的把文件替换之后我关闭openclash以后就能直接通网了！ 下面是oc.log的内容： Thu Jun 2 12:31:50 CST 2022 Enter stop Thu Jun 2 12:31:50 CST 2022 Enter revert_firewall Thu Jun 2 12:31:50 CST 2022 clean route Thu Jun 2 12:31:50 CST 2022 iptables -D INPUT 1 Thu Jun 2 12:31:50 CST 2022 iptables -t nat -D OUTPUT 2 Thu Jun 2 12:31:51 CST 2022 iptables -t nat -D PREROUTING 14 Thu Jun 2 12:31:51 CST 2022 iptables -t nat -D PREROUTING 4 Thu Jun 2 12:31:51 CST 2022 iptables -t nat -D PREROUTING 3 Thu Jun 2 12:31:51 CST 2022 iptables -t nat -D PREROUTING 2 Thu Jun 2 12:31:51 CST 2022 iptables -t nat -D PREROUTING 1 Thu Jun 2 12:31:51 CST 2022 clean rules Thu Jun 2 12:31:51 CST 2022 clean chain Thu Jun 2 12:31:51 CST 2022 Enter reload Thu Jun 2 12:31:52 CST 2022 clean ipset Thu Jun 2 12:31:53 CST 2022 do killclash Thu Jun 2 12:31:53 CST 2022 do delete

西巴! 你绝对没有更新的到dev分支的最新版本....重新更新一次, 确保openclash版本>v0.45.25

AllForLandlord commented 2 years ago

wow，按照您说的把文件替换之后我关闭openclash以后就能直接通网了！ 下面是oc.log的内容： Thu Jun 2 12:31:50 CST 2022 Enter stop Thu Jun 2 12:31:50 CST 2022 Enter revert_firewall Thu Jun 2 12:31:50 CST 2022 clean route Thu Jun 2 12:31:50 CST 2022 iptables -D INPUT 1 Thu Jun 2 12:31:50 CST 2022 iptables -t nat -D OUTPUT 2 Thu Jun 2 12:31:51 CST 2022 iptables -t nat -D PREROUTING 14 Thu Jun 2 12:31:51 CST 2022 iptables -t nat -D PREROUTING 4 Thu Jun 2 12:31:51 CST 2022 iptables -t nat -D PREROUTING 3 Thu Jun 2 12:31:51 CST 2022 iptables -t nat -D PREROUTING 2 Thu Jun 2 12:31:51 CST 2022 iptables -t nat -D PREROUTING 1 Thu Jun 2 12:31:51 CST 2022 clean rules Thu Jun 2 12:31:51 CST 2022 clean chain Thu Jun 2 12:31:51 CST 2022 Enter reload Thu Jun 2 12:31:52 CST 2022 clean ipset Thu Jun 2 12:31:53 CST 2022 do killclash Thu Jun 2 12:31:53 CST 2022 do delete

西巴! 你绝对没有更新的到dev分支的最新版本....重新更新一次, 确保openclash版本>v0.45.25

哦哦！不好意思，我更新的是master版本的，抱歉理解错了，我还以为是说dev内核更新到最新，谢谢！我待会儿更新一下！

AllForLandlord commented 2 years ago

您好，更新好了，现在是0.45.26版本，一切正常了！谢谢您的帮助！ Thu Jun 2 12:31:50 CST 2022 Enter stop Thu Jun 2 12:31:50 CST 2022 Enter revert_firewall Thu Jun 2 12:31:50 CST 2022 clean route Thu Jun 2 12:31:50 CST 2022 iptables -D INPUT 1 Thu Jun 2 12:31:50 CST 2022 iptables -t nat -D OUTPUT 2 Thu Jun 2 12:31:51 CST 2022 iptables -t nat -D PREROUTING 14 Thu Jun 2 12:31:51 CST 2022 iptables -t nat -D PREROUTING 4 Thu Jun 2 12:31:51 CST 2022 iptables -t nat -D PREROUTING 3 Thu Jun 2 12:31:51 CST 2022 iptables -t nat -D PREROUTING 2 Thu Jun 2 12:31:51 CST 2022 iptables -t nat -D PREROUTING 1 Thu Jun 2 12:31:51 CST 2022 clean rules Thu Jun 2 12:31:51 CST 2022 clean chain Thu Jun 2 12:31:51 CST 2022 Enter reload Thu Jun 2 12:31:52 CST 2022 clean ipset Thu Jun 2 12:31:53 CST 2022 do killclash Thu Jun 2 12:31:53 CST 2022 do delete Thu Jun 2 12:32:49 CST 2022 Enter restart Thu Jun 2 12:32:49 CST 2022 Enter stop Thu Jun 2 12:32:49 CST 2022 Enter revert_firewall Thu Jun 2 12:32:49 CST 2022 clean route Thu Jun 2 12:32:50 CST 2022 clean rules Thu Jun 2 12:32:50 CST 2022 clean chain Thu Jun 2 12:32:50 CST 2022 Enter reload Thu Jun 2 12:32:51 CST 2022 clean ipset Thu Jun 2 12:32:51 CST 2022 Enter start Thu Jun 2 12:32:51 CST 2022 do start Thu Jun 2 13:06:00 CST 2022 Enter reload Thu Jun 2 13:06:16 CST 2022 Enter reload Thu Jun 2 13:06:17 CST 2022 Enter restart Thu Jun 2 13:06:17 CST 2022 Enter stop Thu Jun 2 13:06:17 CST 2022 Enter revert_firewall Thu Jun 2 13:06:17 CST 2022 clean route Thu Jun 2 13:06:17 CST 2022 iptables -D INPUT 1 Thu Jun 2 13:06:17 CST 2022 iptables -t nat -D OUTPUT 2 Thu Jun 2 13:06:17 CST 2022 iptables -t nat -D PREROUTING 14 Thu Jun 2 13:06:18 CST 2022 iptables -t nat -D PREROUTING 4 Thu Jun 2 13:06:18 CST 2022 iptables -t nat -D PREROUTING 3 Thu Jun 2 13:06:18 CST 2022 iptables -t nat -D PREROUTING 2 Thu Jun 2 13:06:18 CST 2022 iptables -t nat -D PREROUTING 1 Thu Jun 2 13:06:18 CST 2022 clean rules Thu Jun 2 13:06:18 CST 2022 clean chain Thu Jun 2 13:06:19 CST 2022 clean ipset Thu Jun 2 13:06:19 CST 2022 Enter start Thu Jun 2 13:06:19 CST 2022 do start Thu Jun 2 13:07:09 CST 2022 Enter stop Thu Jun 2 13:07:09 CST 2022 Enter revert_firewall Thu Jun 2 13:07:09 CST 2022 clean route Thu Jun 2 13:07:09 CST 2022 iptables -D INPUT 1 Thu Jun 2 13:07:09 CST 2022 iptables -t nat -D OUTPUT 2 Thu Jun 2 13:07:09 CST 2022 iptables -t nat -D PREROUTING 12 Thu Jun 2 13:07:09 CST 2022 iptables -t nat -D PREROUTING 4 Thu Jun 2 13:07:09 CST 2022 iptables -t nat -D PREROUTING 3 Thu Jun 2 13:07:09 CST 2022 iptables -t nat -D PREROUTING 2 Thu Jun 2 13:07:09 CST 2022 iptables -t nat -D PREROUTING 1 Thu Jun 2 13:07:09 CST 2022 clean rules Thu Jun 2 13:07:10 CST 2022 clean chain Thu Jun 2 13:07:10 CST 2022 Enter reload Thu Jun 2 13:07:10 CST 2022 clean ipset Thu Jun 2 13:07:12 CST 2022 do killclash Thu Jun 2 13:07:12 CST 2022 do delete

msylgj commented 2 years ago

您好，更新好了，现在是0.45.26版本，一切正常了！谢谢您的帮助！

Thu Jun 2 12:31:50 CST 2022 Enter stop

Thu Jun 2 12:31:50 CST 2022 Enter revert_firewall

Thu Jun 2 12:31:50 CST 2022 clean route

Thu Jun 2 12:31:50 CST 2022 iptables -D INPUT 1

Thu Jun 2 12:31:50 CST 2022 iptables -t nat -D OUTPUT 2

Thu Jun 2 12:31:51 CST 2022 iptables -t nat -D PREROUTING 14

Thu Jun 2 12:31:51 CST 2022 iptables -t nat -D PREROUTING 4

Thu Jun 2 12:31:51 CST 2022 iptables -t nat -D PREROUTING 3

Thu Jun 2 12:31:51 CST 2022 iptables -t nat -D PREROUTING 2

Thu Jun 2 12:31:51 CST 2022 iptables -t nat -D PREROUTING 1

Thu Jun 2 12:31:51 CST 2022 clean rules

Thu Jun 2 12:31:51 CST 2022 clean chain

Thu Jun 2 12:31:51 CST 2022 Enter reload

Thu Jun 2 12:31:52 CST 2022 clean ipset

Thu Jun 2 12:31:53 CST 2022 do killclash

Thu Jun 2 12:31:53 CST 2022 do delete

Thu Jun 2 12:32:49 CST 2022 Enter restart

Thu Jun 2 12:32:49 CST 2022 Enter stop

Thu Jun 2 12:32:49 CST 2022 Enter revert_firewall

Thu Jun 2 12:32:49 CST 2022 clean route

Thu Jun 2 12:32:50 CST 2022 clean rules

Thu Jun 2 12:32:50 CST 2022 clean chain

Thu Jun 2 12:32:50 CST 2022 Enter reload

Thu Jun 2 12:32:51 CST 2022 clean ipset

Thu Jun 2 12:32:51 CST 2022 Enter start

Thu Jun 2 12:32:51 CST 2022 do start

Thu Jun 2 13:06:00 CST 2022 Enter reload

Thu Jun 2 13:06:16 CST 2022 Enter reload

Thu Jun 2 13:06:17 CST 2022 Enter restart

Thu Jun 2 13:06:17 CST 2022 Enter stop

Thu Jun 2 13:06:17 CST 2022 Enter revert_firewall

Thu Jun 2 13:06:17 CST 2022 clean route

Thu Jun 2 13:06:17 CST 2022 iptables -D INPUT 1

Thu Jun 2 13:06:17 CST 2022 iptables -t nat -D OUTPUT 2

Thu Jun 2 13:06:17 CST 2022 iptables -t nat -D PREROUTING 14

Thu Jun 2 13:06:18 CST 2022 iptables -t nat -D PREROUTING 4

Thu Jun 2 13:06:18 CST 2022 iptables -t nat -D PREROUTING 3

Thu Jun 2 13:06:18 CST 2022 iptables -t nat -D PREROUTING 2

Thu Jun 2 13:06:18 CST 2022 iptables -t nat -D PREROUTING 1

Thu Jun 2 13:06:18 CST 2022 clean rules

Thu Jun 2 13:06:18 CST 2022 clean chain

Thu Jun 2 13:06:19 CST 2022 clean ipset

Thu Jun 2 13:06:19 CST 2022 Enter start

Thu Jun 2 13:06:19 CST 2022 do start

Thu Jun 2 13:07:09 CST 2022 Enter stop

Thu Jun 2 13:07:09 CST 2022 Enter revert_firewall

Thu Jun 2 13:07:09 CST 2022 clean route

Thu Jun 2 13:07:09 CST 2022 iptables -D INPUT 1

Thu Jun 2 13:07:09 CST 2022 iptables -t nat -D OUTPUT 2

Thu Jun 2 13:07:09 CST 2022 iptables -t nat -D PREROUTING 12

Thu Jun 2 13:07:09 CST 2022 iptables -t nat -D PREROUTING 4

Thu Jun 2 13:07:09 CST 2022 iptables -t nat -D PREROUTING 3

Thu Jun 2 13:07:09 CST 2022 iptables -t nat -D PREROUTING 2

Thu Jun 2 13:07:09 CST 2022 iptables -t nat -D PREROUTING 1

Thu Jun 2 13:07:09 CST 2022 clean rules

Thu Jun 2 13:07:10 CST 2022 clean chain

Thu Jun 2 13:07:10 CST 2022 Enter reload

Thu Jun 2 13:07:10 CST 2022 clean ipset

Thu Jun 2 13:07:12 CST 2022 do killclash

Thu Jun 2 13:07:12 CST 2022 do delete

那就不用替换了…换回去吧…这个只是用来看log的 issue可以关了

AllForLandlord commented 2 years ago

您好，更新好了，现在是0.45.26版本，一切正常了！谢谢您的帮助！ Thu Jun 2 12:31:50 CST 2022 Enter stop Thu Jun 2 12:31:50 CST 2022 Enter revert_firewall Thu Jun 2 12:31:50 CST 2022 clean route Thu Jun 2 12:31:50 CST 2022 iptables -D INPUT 1 Thu Jun 2 12:31:50 CST 2022 iptables -t nat -D OUTPUT 2 Thu Jun 2 12:31:51 CST 2022 iptables -t nat -D PREROUTING 14 Thu Jun 2 12:31:51 CST 2022 iptables -t nat -D PREROUTING 4 Thu Jun 2 12:31:51 CST 2022 iptables -t nat -D PREROUTING 3 Thu Jun 2 12:31:51 CST 2022 iptables -t nat -D PREROUTING 2 Thu Jun 2 12:31:51 CST 2022 iptables -t nat -D PREROUTING 1 Thu Jun 2 12:31:51 CST 2022 clean rules Thu Jun 2 12:31:51 CST 2022 clean chain Thu Jun 2 12:31:51 CST 2022 Enter reload Thu Jun 2 12:31:52 CST 2022 clean ipset Thu Jun 2 12:31:53 CST 2022 do killclash Thu Jun 2 12:31:53 CST 2022 do delete Thu Jun 2 12:32:49 CST 2022 Enter restart Thu Jun 2 12:32:49 CST 2022 Enter stop Thu Jun 2 12:32:49 CST 2022 Enter revert_firewall Thu Jun 2 12:32:49 CST 2022 clean route Thu Jun 2 12:32:50 CST 2022 clean rules Thu Jun 2 12:32:50 CST 2022 clean chain Thu Jun 2 12:32:50 CST 2022 Enter reload Thu Jun 2 12:32:51 CST 2022 clean ipset Thu Jun 2 12:32:51 CST 2022 Enter start Thu Jun 2 12:32:51 CST 2022 do start Thu Jun 2 13:06:00 CST 2022 Enter reload Thu Jun 2 13:06:16 CST 2022 Enter reload Thu Jun 2 13:06:17 CST 2022 Enter restart Thu Jun 2 13:06:17 CST 2022 Enter stop Thu Jun 2 13:06:17 CST 2022 Enter revert_firewall Thu Jun 2 13:06:17 CST 2022 clean route Thu Jun 2 13:06:17 CST 2022 iptables -D INPUT 1 Thu Jun 2 13:06:17 CST 2022 iptables -t nat -D OUTPUT 2 Thu Jun 2 13:06:17 CST 2022 iptables -t nat -D PREROUTING 14 Thu Jun 2 13:06:18 CST 2022 iptables -t nat -D PREROUTING 4 Thu Jun 2 13:06:18 CST 2022 iptables -t nat -D PREROUTING 3 Thu Jun 2 13:06:18 CST 2022 iptables -t nat -D PREROUTING 2 Thu Jun 2 13:06:18 CST 2022 iptables -t nat -D PREROUTING 1 Thu Jun 2 13:06:18 CST 2022 clean rules Thu Jun 2 13:06:18 CST 2022 clean chain Thu Jun 2 13:06:19 CST 2022 clean ipset Thu Jun 2 13:06:19 CST 2022 Enter start Thu Jun 2 13:06:19 CST 2022 do start Thu Jun 2 13:07:09 CST 2022 Enter stop Thu Jun 2 13:07:09 CST 2022 Enter revert_firewall Thu Jun 2 13:07:09 CST 2022 clean route Thu Jun 2 13:07:09 CST 2022 iptables -D INPUT 1 Thu Jun 2 13:07:09 CST 2022 iptables -t nat -D OUTPUT 2 Thu Jun 2 13:07:09 CST 2022 iptables -t nat -D PREROUTING 12 Thu Jun 2 13:07:09 CST 2022 iptables -t nat -D PREROUTING 4 Thu Jun 2 13:07:09 CST 2022 iptables -t nat -D PREROUTING 3 Thu Jun 2 13:07:09 CST 2022 iptables -t nat -D PREROUTING 2 Thu Jun 2 13:07:09 CST 2022 iptables -t nat -D PREROUTING 1 Thu Jun 2 13:07:09 CST 2022 clean rules Thu Jun 2 13:07:10 CST 2022 clean chain Thu Jun 2 13:07:10 CST 2022 Enter reload Thu Jun 2 13:07:10 CST 2022 clean ipset Thu Jun 2 13:07:12 CST 2022 do killclash Thu Jun 2 13:07:12 CST 2022 do delete

那就不用替换了…换回去吧…这个只是用来看log的 issue可以关了

额，刚刚我更新了客户端但其实没更新成功，还是0.45.22，我手动上传更新了下，下面是日志。请问您说的换回去是什么意思？把您发我的那个文件换回去吗？那个原来的文件我没做备份诶 Thu Jun 2 12:31:50 CST 2022 Enter stop Thu Jun 2 12:31:50 CST 2022 Enter revert_firewall Thu Jun 2 12:31:50 CST 2022 clean route Thu Jun 2 12:31:50 CST 2022 iptables -D INPUT 1 Thu Jun 2 12:31:50 CST 2022 iptables -t nat -D OUTPUT 2 Thu Jun 2 12:31:51 CST 2022 iptables -t nat -D PREROUTING 14 Thu Jun 2 12:31:51 CST 2022 iptables -t nat -D PREROUTING 4 Thu Jun 2 12:31:51 CST 2022 iptables -t nat -D PREROUTING 3 Thu Jun 2 12:31:51 CST 2022 iptables -t nat -D PREROUTING 2 Thu Jun 2 12:31:51 CST 2022 iptables -t nat -D PREROUTING 1 Thu Jun 2 12:31:51 CST 2022 clean rules Thu Jun 2 12:31:51 CST 2022 clean chain Thu Jun 2 12:31:51 CST 2022 Enter reload Thu Jun 2 12:31:52 CST 2022 clean ipset Thu Jun 2 12:31:53 CST 2022 do killclash Thu Jun 2 12:31:53 CST 2022 do delete Thu Jun 2 12:32:49 CST 2022 Enter restart Thu Jun 2 12:32:49 CST 2022 Enter stop Thu Jun 2 12:32:49 CST 2022 Enter revert_firewall Thu Jun 2 12:32:49 CST 2022 clean route Thu Jun 2 12:32:50 CST 2022 clean rules Thu Jun 2 12:32:50 CST 2022 clean chain Thu Jun 2 12:32:50 CST 2022 Enter reload Thu Jun 2 12:32:51 CST 2022 clean ipset Thu Jun 2 12:32:51 CST 2022 Enter start Thu Jun 2 12:32:51 CST 2022 do start Thu Jun 2 13:06:00 CST 2022 Enter reload Thu Jun 2 13:06:16 CST 2022 Enter reload Thu Jun 2 13:06:17 CST 2022 Enter restart Thu Jun 2 13:06:17 CST 2022 Enter stop Thu Jun 2 13:06:17 CST 2022 Enter revert_firewall Thu Jun 2 13:06:17 CST 2022 clean route Thu Jun 2 13:06:17 CST 2022 iptables -D INPUT 1 Thu Jun 2 13:06:17 CST 2022 iptables -t nat -D OUTPUT 2 Thu Jun 2 13:06:17 CST 2022 iptables -t nat -D PREROUTING 14 Thu Jun 2 13:06:18 CST 2022 iptables -t nat -D PREROUTING 4 Thu Jun 2 13:06:18 CST 2022 iptables -t nat -D PREROUTING 3 Thu Jun 2 13:06:18 CST 2022 iptables -t nat -D PREROUTING 2 Thu Jun 2 13:06:18 CST 2022 iptables -t nat -D PREROUTING 1 Thu Jun 2 13:06:18 CST 2022 clean rules Thu Jun 2 13:06:18 CST 2022 clean chain Thu Jun 2 13:06:19 CST 2022 clean ipset Thu Jun 2 13:06:19 CST 2022 Enter start Thu Jun 2 13:06:19 CST 2022 do start Thu Jun 2 13:07:09 CST 2022 Enter stop Thu Jun 2 13:07:09 CST 2022 Enter revert_firewall Thu Jun 2 13:07:09 CST 2022 clean route Thu Jun 2 13:07:09 CST 2022 iptables -D INPUT 1 Thu Jun 2 13:07:09 CST 2022 iptables -t nat -D OUTPUT 2 Thu Jun 2 13:07:09 CST 2022 iptables -t nat -D PREROUTING 12 Thu Jun 2 13:07:09 CST 2022 iptables -t nat -D PREROUTING 4 Thu Jun 2 13:07:09 CST 2022 iptables -t nat -D PREROUTING 3 Thu Jun 2 13:07:09 CST 2022 iptables -t nat -D PREROUTING 2 Thu Jun 2 13:07:09 CST 2022 iptables -t nat -D PREROUTING 1 Thu Jun 2 13:07:09 CST 2022 clean rules Thu Jun 2 13:07:10 CST 2022 clean chain Thu Jun 2 13:07:10 CST 2022 Enter reload Thu Jun 2 13:07:10 CST 2022 clean ipset Thu Jun 2 13:07:12 CST 2022 do killclash Thu Jun 2 13:07:12 CST 2022 do delete Thu Jun 2 13:07:47 CST 2022 Enter restart Thu Jun 2 13:07:47 CST 2022 Enter stop Thu Jun 2 13:07:47 CST 2022 Enter revert_firewall Thu Jun 2 13:07:48 CST 2022 clean route Thu Jun 2 13:07:48 CST 2022 clean rules Thu Jun 2 13:07:48 CST 2022 clean chain Thu Jun 2 13:07:48 CST 2022 Enter reload Thu Jun 2 13:07:49 CST 2022 clean ipset Thu Jun 2 13:07:50 CST 2022 Enter start Thu Jun 2 13:07:50 CST 2022 do start Thu Jun 2 13:51:35 CST 2022 Enter reload Thu Jun 2 13:51:49 CST 2022 Enter reload Thu Jun 2 13:55:32 CST 2022 Enter stop Thu Jun 2 13:55:32 CST 2022 Enter revert_firewall Thu Jun 2 13:55:32 CST 2022 clean route Thu Jun 2 13:55:32 CST 2022 iptables -D INPUT 1 Thu Jun 2 13:55:32 CST 2022 iptables -t nat -D OUTPUT 2 Thu Jun 2 13:55:32 CST 2022 iptables -t nat -D PREROUTING 14 Thu Jun 2 13:55:32 CST 2022 iptables -t nat -D PREROUTING 4 Thu Jun 2 13:55:32 CST 2022 iptables -t nat -D PREROUTING 3 Thu Jun 2 13:55:32 CST 2022 iptables -t nat -D PREROUTING 2 Thu Jun 2 13:55:32 CST 2022 iptables -t nat -D PREROUTING 1 Thu Jun 2 13:55:33 CST 2022 clean rules Thu Jun 2 13:55:33 CST 2022 clean chain Thu Jun 2 13:55:34 CST 2022 clean ipset Thu Jun 2 13:55:35 CST 2022 do killclash Thu Jun 2 13:55:35 CST 2022 do delete

NV3S commented 2 years ago

和https://github.com/vernesong/OpenClash/issues/2390#issue-1239608748 有点像？