[Bug] fake-ip增强模式下，tproxy不能代理udp流量-无udp

laye0619 commented 2 years ago

Verify Steps

[X] Tracker 我已经在 Issue Tracker 中找过我要提出的问题
[X] Latest 我已经使用最新 Dev 版本测试过，问题依旧存在
[X] Core 这是 OpenClash 存在的问题，并非我所使用的 Clash 或 Meta 等内核的特定问题
[X] Meaningful 我提交的不是无意义的催促更新或修复请求

OpenClash Version

v0.45.33-beta

Bug on Environment

Official OpenWrt, Docker

Bug on Platform

Linux-amd64(x86-64)

To Reproduce

官方原版openwrt 22.03编译，只加入了openclash和ddns（我另外还试过编译immortalwrt等流行的openwrt，同样没有udp流量；唯一的是使用kiddin9的定制固件，是有udp流量的，可以看到tproxy（udp）） fake-ip模式下，redir-host模式下，完全没有任何的udp流量，启动ms team等也没有udp流量，switch nat是F 换成tun，或者fake-ip，就有udp流量tun（udp）<- 但是这个tun模式又不能外网访问小米摄像机：（

我特意另外编译了passwall，就有tproxy的udp流量……

我在想是不是我编译的时候有什么没有选择，特意看过tproxy相关组件，都选上了，从下面日志里面也能看出来tproxy是正常的，也没有安装多拨等组件

Describe the Bug

同上

OpenClash Log

OpenClash 调试日志

生成时间: 2022-06-22 11:48:43 插件版本: 隐私提示: 上传此日志前请注意检查、屏蔽公网IP、节点、密码等相关敏感信息


#===================== 系统信息 =====================#

主机型号: Apple Inc. MacBookPro15,1
固件版本: OpenWrt 22.03.0-rc4 r19426-2b1941e47d
LuCI版本: git-20.074.84698-ead5e81
内核版本: 5.17.1-t2
处理器架构: x86_64

#此项有值时,如不使用IPv6,建议到网络-接口-lan的设置中禁用IPV6的DHCP
IPV6-DHCP: 

#此项结果应仅有配置文件的DNS监听地址
Dnsmasq转发设置: 

#===================== 依赖检查 =====================#

dnsmasq-full: 已安装
coreutils: 已安装
coreutils-nohup: 已安装
bash: 已安装
curl: 已安装
ca-certificates: 已安装
ipset: 已安装
ip-full: 已安装
iptables-mod-tproxy: 已安装
kmod-ipt-tproxy: 已安装
iptables-mod-extra: 已安装
kmod-ipt-extra: 已安装
libcap: 已安装
libcap-bin: 已安装
ruby: 已安装
ruby-yaml: 已安装
ruby-psych: 已安装
ruby-pstore: 已安装
ruby-dbm: 已安装
kmod-tun(TUN模式): 已安装
luci-compat(Luci-19.07): 已安装
kmod-inet-diag(PROCESS-NAME): 已安装

#===================== 内核检查 =====================#

运行状态: 运行中
进程pid: 22381
运行权限: 22381: cap_dac_override,cap_net_bind_service,cap_net_admin,cap_net_raw,cap_sys_ptrace,cap_sys_resource=eip
运行用户: nobody
已选择的架构: linux-amd64

#下方无法显示内核版本号时请确认您的内核版本是否正确或者有无权限
Tun内核版本: 2022.06.19
Tun内核文件: 存在
Tun内核运行权限: 正常

Dev内核版本: v1.11.0
Dev内核文件: 存在
Dev内核运行权限: 正常

Meta内核版本: alpha-g30a0834
Meta内核文件: 存在
Meta内核运行权限: 正常

#===================== 插件设置 =====================#

当前配置文件: /etc/openclash/config/config_20220611.yaml
启动配置文件: /etc/openclash/config_20220611.yaml
运行模式: fake-ip
默认代理模式: rule
UDP流量转发(tproxy): 启用
DNS劫持: 启用
自定义DNS: 停用
IPV6代理: 停用
IPV6-DNS解析: 停用
禁用Dnsmasq缓存: 启用
自定义规则: 停用
仅允许内网: 启用
仅代理命中规则流量: 停用
仅允许常用端口流量: 停用
绕过中国大陆IP: 停用
DNS远程解析: 停用
路由本机代理: 启用

#启动异常时建议关闭此项后重试
混合节点: 停用
保留配置: 停用

#启动异常时建议关闭此项后重试
第三方规则: 停用

#===================== 配置文件 =====================#

port: 7890
socks-port: 7891
redir-port: 7892
tproxy-port: 7895
allow-lan: true
bind-address: "*"
mode: rule
log-level: silent
external-controller: 0.0.0.0:9090
hosts:
dns:
  enable: true
  listen: 0.0.0.0:7874
  ipv6: false
  default-nameserver:
  - 223.5.5.5
  - 114.114.114.114
  - 119.29.29.29
  - 8.8.4.4
  - 192.168.1.1
  enhanced-mode: fake-ip
  fake-ip-range: 198.18.0.1/16
  fake-ip-filter:
  - "*.lan"
  - "*.localdomain"
  - "*.example"
  - "*.invalid"
  - "*.localhost"
  - "*.test"
  - "*.local"
  - "*.home.arpa"
  - time.*.com
  - time.*.gov
  - time.*.edu.cn
  - time.*.apple.com
  - time1.*.com
  - time2.*.com
  - time3.*.com
  - time4.*.com
  - time5.*.com
  - time6.*.com
  - time7.*.com
  - ntp.*.com
  - ntp1.*.com
  - ntp2.*.com
  - ntp3.*.com
  - ntp4.*.com
  - ntp5.*.com
  - ntp6.*.com
  - ntp7.*.com
  - "*.time.edu.cn"
  - "*.ntp.org.cn"
  - "+.pool.ntp.org"
  - time1.cloud.tencent.com
  - music.163.com
  - "*.music.163.com"
  - "*.126.net"
  - musicapi.taihe.com
  - music.taihe.com
  - songsearch.kugou.com
  - trackercdn.kugou.com
  - "*.kuwo.cn"
  - api-jooxtt.sanook.com
  - api.joox.com
  - joox.com
  - y.qq.com
  - "*.y.qq.com"
  - streamoc.music.tc.qq.com
  - mobileoc.music.tc.qq.com
  - isure.stream.qqmusic.qq.com
  - dl.stream.qqmusic.qq.com
  - aqqmusic.tc.qq.com
  - amobile.music.tc.qq.com
  - "*.xiami.com"
  - "*.music.migu.cn"
  - music.migu.cn
  - "*.msftconnecttest.com"
  - "*.msftncsi.com"
  - msftconnecttest.com
  - msftncsi.com
  - localhost.ptlogin2.qq.com
  - localhost.sec.qq.com
  - "+.srv.nintendo.net"
  - "+.stun.playstation.net"
  - xbox.*.microsoft.com
  - xnotify.xboxlive.com
  - "+.battlenet.com.cn"
  - "+.wotgame.cn"
  - "+.wggames.cn"
  - "+.wowsgame.cn"
  - "+.wargaming.net"
  - proxy.golang.org
  - stun.*.*
  - stun.*.*.*
  - "+.stun.*.*"
  - "+.stun.*.*.*"
  - "+.stun.*.*.*.*"
  - heartbeat.belkin.com
  - "*.linksys.com"
  - "*.linksyssmartwifi.com"
  - "*.router.asus.com"
  - mesu.apple.com
  - swscan.apple.com
  - swquery.apple.com
  - swdownload.apple.com
  - swcdn.apple.com
  - swdist.apple.com
  - lens.l.google.com
  - stun.l.google.com
  - "+.nflxvideo.net"
  - "*.square-enix.com"
  - "*.finalfantasyxiv.com"
  - "*.ffxiv.com"
  - "*.mcdn.bilivideo.cn"
  - time-ios.apple.com
  - "+.msftconnecttest.com"
  - "+.msftncsi.com"
  - "*.n.n.srv.nintendo.net"
  - xbox.*.*.microsoft.com
  - "*.*.xboxlive.com"
  - "+.stun.*.*.*.*.*"
  - "*.ff14.sdo.com"
  - ff.dorado.sdo.com
  - "+.media.dssott.com"
  - shark007.net
  - "+.mi.com"
  nameserver:
  - 223.5.5.5
  - 119.29.29.29
  - 8.8.4.4
  - 192.168.1.1
  - 114.114.114.114
  - https://doh.pub/dns-query
  - https://dns.alidns.com/dns-query
  fallback-filter:
    geoip: false
    ipcidr:
    - 0.0.0.0/8
    - 10.0.0.0/8
    - 100.64.0.0/10
    - 127.0.0.0/8
    - 169.254.0.0/16
    - 172.16.0.0/12
    - 192.0.0.0/24
    - 192.0.2.0/24
    - 192.88.99.0/24
    - 192.168.0.0/16
    - 198.18.0.0/15
    - 198.51.100.0/24
    - 203.0.113.0/24
    - 224.0.0.0/4
    - 240.0.0.0/4
    - 255.255.255.255/32
    domain:
    - "+.google.com"
    - "+.facebook.com"
    - "+.youtube.com"
    - "+.githubusercontent.com"
    - "+.googlevideo.com"
  fallback:
  - https://dns.cloudflare.com/dns-query
  - https://public.dns.iij.jp/dns-query
  - https://jp.tiar.app/dns-query
  - https://jp.tiarap.org/dns-query
  - tls://dot.tiar.app
proxy-groups:
- name: Proxy
  type: select
  proxies:
  - ss-aws-lightsail
  - trojan-aws-lightsail
  - trojan-xtls
rule-providers:
  reject:
    type: http
    behavior: domain
    url: https://raw.githubusercontent.com/Loyalsoldier/clash-rules/release/reject.txt
    path: "./rule_provider/reject.yaml"
    interval: 86400
  icloud:
    type: http
    behavior: domain
    url: https://raw.githubusercontent.com/Loyalsoldier/clash-rules/release/icloud.txt
    path: "./rule_provider/icloud.yaml"
    interval: 86400
  apple:
    type: http
    behavior: domain
    url: https://raw.githubusercontent.com/Loyalsoldier/clash-rules/release/apple.txt
    path: "./rule_provider/apple.yaml"
    interval: 86400
  google:
    type: http
    behavior: domain
    url: https://raw.githubusercontent.com/Loyalsoldier/clash-rules/release/google.txt
    path: "./rule_provider/google.yaml"
    interval: 86400
  proxy:
    type: http
    behavior: domain
    url: https://raw.githubusercontent.com/Loyalsoldier/clash-rules/release/proxy.txt
    path: "./rule_provider/proxy.yaml"
    interval: 86400
  direct:
    type: http
    behavior: domain
    url: https://raw.githubusercontent.com/Loyalsoldier/clash-rules/release/direct.txt
    path: "./rule_provider/direct.yaml"
    interval: 86400
  private:
    type: http
    behavior: domain
    url: https://raw.githubusercontent.com/Loyalsoldier/clash-rules/release/private.txt
    path: "./rule_provider/private.yaml"
    interval: 86400
  gfw:
    type: http
    behavior: domain
    url: https://raw.githubusercontent.com/Loyalsoldier/clash-rules/release/gfw.txt
    path: "./rule_provider/gfw.yaml"
    interval: 86400
  greatfire:
    type: http
    behavior: domain
    url: https://raw.githubusercontent.com/Loyalsoldier/clash-rules/release/greatfire.txt
    path: "./rule_provider/greatfire.yaml"
    interval: 86400
  tld-not-cn:
    type: http
    behavior: domain
    url: https://raw.githubusercontent.com/Loyalsoldier/clash-rules/release/tld-not-cn.txt
    path: "./rule_provider/tld-not-cn.yaml"
    interval: 86400
  telegramcidr:
    type: http
    behavior: ipcidr
    url: https://raw.githubusercontent.com/Loyalsoldier/clash-rules/release/telegramcidr.txt
    path: "./rule_provider/telegramcidr.yaml"
    interval: 86400
  cncidr:
    type: http
    behavior: ipcidr
    url: https://raw.githubusercontent.com/Loyalsoldier/clash-rules/release/cncidr.txt
    path: "./rule_provider/cncidr.yaml"
    interval: 86400
  lancidr:
    type: http
    behavior: ipcidr
    url: https://raw.githubusercontent.com/Loyalsoldier/clash-rules/release/lancidr.txt
    path: "./rule_provider/lancidr.yaml"
    interval: 86400
  applications:
    type: http
    behavior: classical
    url: https://raw.githubusercontent.com/Loyalsoldier/clash-rules/release/applications.txt
    path: "./rule_provider/applications.yaml"
    interval: 86400
  my_rule_direct:
    type: http
    behavior: classical
    url: https://raw.githubusercontent.com/laye0619/ImageBuilder-Docker-OpenWRT/main/clash_rule/my_rule_direct.yaml
    path: "./rule_provider/my_rule_direct.yaml"
    interval: 3600
  my_rule_proxy:
    type: http
    behavior: classical
    url: https://raw.githubusercontent.com/laye0619/ImageBuilder-Docker-OpenWRT/main/clash_rule/my_rule_proxy.yaml
    path: "./rule_provider/my_rule_proxy.yaml"
    interval: 3600
rules:
- DST-PORT,7895,REJECT
- DST-PORT,7892,REJECT
- IP-CIDR,198.18.0.1/16,REJECT,no-resolve
- IP-CIDR,52.112.0.0/14,DIRECT
- RULE-SET,my_rule_proxy,Proxy
- RULE-SET,my_rule_direct,DIRECT
- RULE-SET,applications,DIRECT
- DOMAIN,clash.razord.top,DIRECT
- DOMAIN,yacd.haishan.me,DIRECT
- RULE-SET,private,DIRECT
- RULE-SET,reject,REJECT
- RULE-SET,icloud,DIRECT
- RULE-SET,apple,DIRECT
- RULE-SET,google,DIRECT
- RULE-SET,proxy,Proxy
- RULE-SET,direct,DIRECT
- RULE-SET,lancidr,DIRECT
- RULE-SET,cncidr,DIRECT
- RULE-SET,telegramcidr,Proxy
- GEOIP,LAN,DIRECT
- GEOIP,CN,DIRECT
- MATCH,Proxy
mixed-port: 7893
external-ui: "/usr/share/openclash/ui"
ipv6: false
geodata-mode: false
geodata-loader: memconservative
tcp-concurrent: true
sniffer:
  enable: true
  sniffing:
  - tls
  - http
profile:
  store-selected: true
  store-fake-ip: true

#===================== 防火墙设置 =====================#

#IPv4 NAT chain

# Generated by iptables-save v1.8.7 on Wed Jun 22 11:48:44 2022
*nat
:PREROUTING ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
:DOCKER_OUTPUT - [0:0]
:DOCKER_POSTROUTING - [0:0]
:openclash - [0:0]
:openclash_output - [0:0]
:postrouting_lan_rule - [0:0]
:postrouting_rule - [0:0]
:postrouting_wan_rule - [0:0]
:prerouting_lan_rule - [0:0]
:prerouting_rule - [0:0]
:prerouting_wan_rule - [0:0]
:zone_lan_postrouting - [0:0]
:zone_lan_prerouting - [0:0]
:zone_wan_postrouting - [0:0]
:zone_wan_prerouting - [0:0]
-A PREROUTING -d 8.8.4.4/32 -p tcp -m comment --comment "OpenClash Google DNS Hijack" -m tcp --dport 53 -j REDIRECT --to-ports 7892
-A PREROUTING -d 8.8.8.8/32 -p tcp -m comment --comment "OpenClash Google DNS Hijack" -m tcp --dport 53 -j REDIRECT --to-ports 7892
-A PREROUTING -p tcp -m tcp --dport 53 -m comment --comment "OpenClash DNS Hijack" -j REDIRECT --to-ports 53
-A PREROUTING -p udp -m udp --dport 53 -m comment --comment "OpenClash DNS Hijack" -j REDIRECT --to-ports 53
-A PREROUTING -m comment --comment "!fw3: Custom prerouting rule chain" -j prerouting_rule
-A PREROUTING -i br-lan -m comment --comment "!fw3" -j zone_lan_prerouting
-A PREROUTING -p tcp -j openclash
-A OUTPUT -d 127.0.0.11/32 -j DOCKER_OUTPUT
-A OUTPUT -j openclash_output
-A POSTROUTING -d 127.0.0.11/32 -j DOCKER_POSTROUTING
-A POSTROUTING -m comment --comment "!fw3: Custom postrouting rule chain" -j postrouting_rule
-A POSTROUTING -o br-lan -m comment --comment "!fw3" -j zone_lan_postrouting
-A DOCKER_OUTPUT -d 127.0.0.11/32 -p tcp -m tcp --dport 53 -j DNAT --to-destination 127.0.0.11:32991
-A DOCKER_OUTPUT -d 127.0.0.11/32 -p udp -m udp --dport 53 -j DNAT --to-destination 127.0.0.11:47316
-A DOCKER_POSTROUTING -s 127.0.0.11/32 -p tcp -m tcp --sport 32991 -j SNAT --to-source :53
-A DOCKER_POSTROUTING -s 127.0.0.11/32 -p udp -m udp --sport 47316 -j SNAT --to-source :53
-A openclash -m set --match-set localnetwork dst -j RETURN
-A openclash -p tcp -j REDIRECT --to-ports 7892
-A openclash_output -m set --match-set localnetwork dst -j RETURN
-A openclash_output -d 198.18.0.0/16 -p tcp -m owner ! --uid-owner 65534 -j REDIRECT --to-ports 7892
-A openclash_output -p tcp -m owner ! --uid-owner 65534 -j REDIRECT --to-ports 7892
-A zone_lan_postrouting -m comment --comment "!fw3: Custom lan postrouting rule chain" -j postrouting_lan_rule
-A zone_lan_prerouting -m comment --comment "!fw3: Custom lan prerouting rule chain" -j prerouting_lan_rule
-A zone_wan_postrouting -m comment --comment "!fw3: Custom wan postrouting rule chain" -j postrouting_wan_rule
-A zone_wan_postrouting -m comment --comment "!fw3" -j MASQUERADE
-A zone_wan_prerouting -m comment --comment "!fw3: Custom wan prerouting rule chain" -j prerouting_wan_rule
COMMIT
# Completed on Wed Jun 22 11:48:44 2022

#IPv4 Mangle chain

# Generated by iptables-save v1.8.7 on Wed Jun 22 11:48:44 2022
*mangle
:PREROUTING ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
:openclash - [0:0]
-A PREROUTING -p udp -j openclash
-A openclash -m set --match-set localnetwork dst -j RETURN
-A openclash -p udp -m udp --dport 53 -j RETURN
-A openclash -p udp -j TPROXY --on-port 7892 --on-ip 0.0.0.0 --tproxy-mark 0x162/0xffffffff
COMMIT
# Completed on Wed Jun 22 11:48:44 2022

#IPv4 Filter chain

# Generated by iptables-save v1.8.7 on Wed Jun 22 11:48:44 2022
*filter
:INPUT ACCEPT [0:0]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [0:0]
:forwarding_lan_rule - [0:0]
:forwarding_rule - [0:0]
:forwarding_wan_rule - [0:0]
:input_lan_rule - [0:0]
:input_rule - [0:0]
:input_wan_rule - [0:0]
:output_lan_rule - [0:0]
:output_rule - [0:0]
:output_wan_rule - [0:0]
:reject - [0:0]
:zone_lan_dest_ACCEPT - [0:0]
:zone_lan_forward - [0:0]
:zone_lan_input - [0:0]
:zone_lan_output - [0:0]
:zone_lan_src_ACCEPT - [0:0]
:zone_wan_dest_ACCEPT - [0:0]
:zone_wan_dest_REJECT - [0:0]
:zone_wan_forward - [0:0]
:zone_wan_input - [0:0]
:zone_wan_output - [0:0]
:zone_wan_src_REJECT - [0:0]
-A INPUT -p udp -m udp --dport 443 -m comment --comment "OpenClash QUIC REJECT" -m set ! --match-set china_ip_route dst -j REJECT --reject-with icmp-port-unreachable
-A INPUT -i lo -m comment --comment "!fw3" -j ACCEPT
-A INPUT -m comment --comment "!fw3: Custom input rule chain" -j input_rule
-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment "!fw3" -j ACCEPT
-A INPUT -i br-lan -m comment --comment "!fw3" -j zone_lan_input
-A FORWARD -m comment --comment "!fw3: Custom forwarding rule chain" -j forwarding_rule
-A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment "!fw3" -j ACCEPT
-A FORWARD -i br-lan -m comment --comment "!fw3" -j zone_lan_forward
-A FORWARD -m comment --comment "!fw3" -j reject
-A OUTPUT -o lo -m comment --comment "!fw3" -j ACCEPT
-A OUTPUT -m comment --comment "!fw3: Custom output rule chain" -j output_rule
-A OUTPUT -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment "!fw3" -j ACCEPT
-A OUTPUT -o br-lan -m comment --comment "!fw3" -j zone_lan_output
-A reject -p tcp -m comment --comment "!fw3" -j REJECT --reject-with tcp-reset
-A reject -m comment --comment "!fw3" -j REJECT --reject-with icmp-port-unreachable
-A zone_lan_dest_ACCEPT -o br-lan -m comment --comment "!fw3" -j ACCEPT
-A zone_lan_forward -m comment --comment "!fw3: Custom lan forwarding rule chain" -j forwarding_lan_rule
-A zone_lan_forward -m comment --comment "!fw3: Zone lan to wan forwarding policy" -j zone_wan_dest_ACCEPT
-A zone_lan_forward -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port forwards" -j ACCEPT
-A zone_lan_forward -m comment --comment "!fw3" -j zone_lan_dest_ACCEPT
-A zone_lan_input -m comment --comment "!fw3: Custom lan input rule chain" -j input_lan_rule
-A zone_lan_input -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port redirections" -j ACCEPT
-A zone_lan_input -m comment --comment "!fw3" -j zone_lan_src_ACCEPT
-A zone_lan_output -m comment --comment "!fw3: Custom lan output rule chain" -j output_lan_rule
-A zone_lan_output -m comment --comment "!fw3" -j zone_lan_dest_ACCEPT
-A zone_lan_src_ACCEPT -i br-lan -m conntrack --ctstate NEW,UNTRACKED -m comment --comment "!fw3" -j ACCEPT
-A zone_wan_forward -m comment --comment "!fw3: Custom wan forwarding rule chain" -j forwarding_wan_rule
-A zone_wan_forward -p esp -m comment --comment "!fw3: Allow-IPSec-ESP" -j zone_lan_dest_ACCEPT
-A zone_wan_forward -p udp -m udp --dport 500 -m comment --comment "!fw3: Allow-ISAKMP" -j zone_lan_dest_ACCEPT
-A zone_wan_forward -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port forwards" -j ACCEPT
-A zone_wan_forward -m comment --comment "!fw3" -j zone_wan_dest_REJECT
-A zone_wan_input -m comment --comment "!fw3: Custom wan input rule chain" -j input_wan_rule
-A zone_wan_input -p udp -m udp --dport 68 -m comment --comment "!fw3: Allow-DHCP-Renew" -j ACCEPT
-A zone_wan_input -p icmp -m icmp --icmp-type 8 -m comment --comment "!fw3: Allow-Ping" -j ACCEPT
-A zone_wan_input -p igmp -m comment --comment "!fw3: Allow-IGMP" -j ACCEPT
-A zone_wan_input -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port redirections" -j ACCEPT
-A zone_wan_input -m comment --comment "!fw3" -j zone_wan_src_REJECT
-A zone_wan_output -m comment --comment "!fw3: Custom wan output rule chain" -j output_wan_rule
-A zone_wan_output -m comment --comment "!fw3" -j zone_wan_dest_ACCEPT
COMMIT
# Completed on Wed Jun 22 11:48:44 2022

#IPv6 NAT chain

#IPv6 Mangle chain

#IPv6 Filter chain

#===================== IPSET状态 =====================#

Name: china_ip_route
Name: localnetwork

#===================== 路由表状态 =====================#

#route -n
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         192.168.1.1     0.0.0.0         UG    0      0        0 br-lan
192.168.1.0     0.0.0.0         255.255.255.0   U     0      0        0 br-lan
#ip route list
default via 192.168.1.1 dev br-lan proto static 
192.168.1.0/24 dev br-lan proto kernel scope link src 192.168.1.2 
#ip rule show
0:  from all lookup local
32765:  from all fwmark 0x162 lookup 354
32766:  from all lookup main
32767:  from all lookup default

#===================== 端口占用状态 =====================#

tcp        0      0 :::9090                 :::*                    LISTEN      22381/clash
tcp        0      0 :::7892                 :::*                    LISTEN      22381/clash
tcp        0      0 :::7893                 :::*                    LISTEN      22381/clash
tcp        0      0 :::7895                 :::*                    LISTEN      22381/clash
tcp        0      0 :::7890                 :::*                    LISTEN      22381/clash
tcp        0      0 :::7891                 :::*                    LISTEN      22381/clash
udp        0      0 :::7874                 :::*                                22381/clash
udp        0      0 :::7891                 :::*                                22381/clash
udp        0      0 :::7892                 :::*                                22381/clash
udp        0      0 :::7893                 :::*                                22381/clash
udp        0      0 :::7895                 :::*                                22381/clash

#===================== 测试本机DNS查询 =====================#

Server:     127.0.0.11
Address:    127.0.0.11:53

Non-authoritative answer:
www.baidu.com   canonical name = www.a.shifen.com

Non-authoritative answer:
www.baidu.com   canonical name = www.a.shifen.com
Name:   www.a.shifen.com
Address: 110.242.68.4
Name:   www.a.shifen.com
Address: 110.242.68.3

#===================== resolv.conf.d =====================#

# Interface lan
nameserver 223.5.5.5
nameserver 119.29.29.29
nameserver 8.8.4.4

#===================== 测试本机网络连接 =====================#

HTTP/1.1 200 OK
Accept-Ranges: bytes
Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform
Connection: keep-alive
Content-Length: 277
Content-Type: text/html
Date: Wed, 22 Jun 2022 11:48:47 GMT
Etag: "575e1f59-115"
Last-Modified: Mon, 13 Jun 2016 02:50:01 GMT
Pragma: no-cache
Server: bfe/1.0.8.18

#===================== 测试本机网络下载 =====================#

#===================== 最近运行日志 =====================#

2022-06-22 11:47:51 Step 6: Wait For The File Downloading...
2022-06-22 11:47:51 Step 7: Set Firewall Rules...
2022-06-22 11:47:51 Step 8: Restart Dnsmasq...
2022-06-22 11:47:55 Step 9: Add Cron Rules, Start Daemons...
2022-06-22 11:47:55 OpenClash Start Successful!
2022-06-22 11:48:36 OpenClash Stoping...
2022-06-22 11:48:36 Step 1: Backup The Current Groups State...
2022-06-22 11:48:36 Step 2: Delete OpenClash Firewall Rules...
2022-06-22 11:48:37 Step 3: Close The OpenClash Daemons...
2022-06-22 11:48:37 Step 4: Close The Clash Core Process...
2022-06-22 11:48:37 Step 5: Restart Dnsmasq...
2022-06-22 11:48:40 Step 6: Delete OpenClash Residue File...
2022-06-22 11:48:40 OpenClash Start Running...
2022-06-22 11:48:40 Step 1: Get The Configuration...
2022-06-22 11:48:40 Step 2: Check The Components...
2022-06-22 11:48:40 Tip: Because of the file【 /etc/config/openclash 】modificated, Pause quick start...
2022-06-22 11:48:40 Step 3: Modify The Config File...
2022-06-22 11:48:40 Setting Secondary DNS Server List...
2022-06-22 11:48:40 Step 4: Start Running The Clash Core...
2022-06-22 11:48:40 Tip: Detected The Exclusive Function of The Meta Core, Use Meta Core to Start...
2022-06-22 11:48:41 Step 5: Check The Core Status...
time="2022-06-22T11:48:41Z" level=info msg="Start initial configuration in progress"
time="2022-06-22T11:48:41Z" level=info msg="Geodata Loader mode: memconservative"
time="2022-06-22T11:48:41Z" level=info msg="Initial configuration complete, total time: 2ms"
time="2022-06-22T11:48:41Z" level=info msg="Sniffer is loaded and working"
time="2022-06-22T11:48:41Z" level=info msg="DNS server listening at: [::]:7874"
time="2022-06-22T11:48:41Z" level=info msg="Start initial compatible provider default"
time="2022-06-22T11:48:41Z" level=info msg="Start initial compatible provider Proxy"
time="2022-06-22T11:48:41Z" level=info msg="Start initial provider proxy"
time="2022-06-22T11:48:41Z" level=info msg="Start initial provider gfw"
time="2022-06-22T11:48:41Z" level=info msg="RESTful API listening at: [::]:9090"
time="2022-06-22T11:48:41Z" level=info msg="Start initial provider applications"
time="2022-06-22T11:48:41Z" level=info msg="Start initial provider cncidr"
time="2022-06-22T11:48:41Z" level=info msg="Start initial provider lancidr"
time="2022-06-22T11:48:41Z" level=info msg="Start initial provider tld-not-cn"
time="2022-06-22T11:48:41Z" level=info msg="Start initial provider apple"
time="2022-06-22T11:48:41Z" level=info msg="Start initial provider my_rule_direct"
time="2022-06-22T11:48:41Z" level=info msg="Start initial provider google"
time="2022-06-22T11:48:41Z" level=info msg="Start initial provider direct"
time="2022-06-22T11:48:41Z" level=info msg="Start initial provider telegramcidr"
time="2022-06-22T11:48:41Z" level=info msg="Start initial provider my_rule_proxy"
time="2022-06-22T11:48:41Z" level=info msg="Start initial provider icloud"
time="2022-06-22T11:48:41Z" level=info msg="Start initial provider private"
time="2022-06-22T11:48:41Z" level=info msg="Start initial provider greatfire"
time="2022-06-22T11:48:41Z" level=info msg="Start initial provider reject"
2022-06-22 11:48:44 Step 6: Wait For The File Downloading...
2022-06-22 11:48:44 Step 7: Set Firewall Rules...
2022-06-22 11:48:44 Step 8: Restart Dnsmasq...
2022-06-22 11:48:47 Step 9: Add Cron Rules, Start Daemons...
2022-06-22 11:48:47 OpenClash Start Successful!

#===================== 活动连接信息 =====================#

1. SourceIP:【192.168.1.191】 - Host:【p211-caldav.icloud.com.cn】 - DestinationIP:【111.206.109.120】 - Network:【tcp】 - RulePayload:【icloud】 - Lastchain:【DIRECT】
2. SourceIP:【192.168.1.105】 - Host:【Empty】 - DestinationIP:【123.125.46.76】 - Network:【tcp】 - RulePayload:【cncidr】 - Lastchain:【DIRECT】

OpenClash Config

No response

Expected Behavior

系统fake-ip增强模式可以代理udp流量，连接中可以看到tproxy(udp)

Screenshots

No response

A-Cepheus commented 2 years ago

我也遇到这个问题我是redir模式下 dev和tun内核都无法通过tproxy代理UDP 可以使用tun meta内核则正常工作

liouxy commented 2 years ago

我也是，退回到openclash 客户端v0.45.22-beta， core v1.10.6-9-g9d2fc97后正常了，在新版下nat类型为F，回退后是A

A-Cepheus commented 2 years ago

我也是，退回到openclash 客户端v0.45.22-beta， core v1.10.6-9-g9d2fc97后正常了，在新版下nat类型为F，回退后是A

前面有个issue提过了手动将dev core回退到v1.10.6-12-g09d49ba版本及以前就可以了 openclash版本不限

laye0619 commented 2 years ago

不是这个问题我回滚了版本也不行用koolcenter的openwrt 或者kiddin9的固件就可以其他固件包括我自己编译的官方固件都不行好奇怪

A-Cepheus commented 2 years ago

不是这个问题我回滚了版本也不行用koolcenter的openwrt 或者kiddin9的固件就可以其他固件包括我自己编译的官方固件都不行好奇怪

那你和我们就不是一个问题你的问题类似于固件tproxy用不了

laye0619 commented 2 years ago

我找到解决方法了，但是求教大神为什么这么设置就好了？ https://github.com/xiaorouji/openwrt-passwall/issues/1320

/etc/sysctl.d/sysctl-br-netfilter-ip.conf 设置为

net.bridge.bridge-nf-call-ip6tables=0 net.bridge.bridge-nf-call-iptables=0

warcns commented 2 years ago

是的v0.45.33-beta tproxy udp直连可以用，但是走节点就没有数据无法使用了。换tun模式udp走节点就正常了。在上个版本的openclash上没有这个问题，tproxy udp无论直连还是代理都很正常。

warcns commented 2 years ago

v0.45.35 的tproxy udp已经正常。

github-actions[bot] commented 2 years ago

This issue is stale because it has been open 60 days with no activity. Remove stale label or comment or this will be closed in 5 days

jearton commented 7 months ago

fake-ip增强模式，udp直连正常，走节点就不通，怎么解决？

vernesong / OpenClash