Verify Steps

[X] Tracker 我已经在 Issue Tracker 中找过我要提出的问题
[X] Latest 我已经使用最新 Dev 版本测试过，问题依旧存在
[X] Core 这是 OpenClash 存在的问题，并非我所使用的 Clash 或 Meta 等内核的特定问题
[X] Meaningful 我提交的不是无意义的催促更新或修复请求

OpenClash Version

v0.45.33-beta

Bug on Environment

Lean

Bug on Platform

Linux-amd64(x86-64)

To Reproduce

关闭clash后无法正常重启期间并未对设置/配置进行更改且所有内核均为最新版本插件日志内出现如下错误： 2022-06-29 02:40:55 错误：修改集路径失败，【undefined method `[]' for nil:NilClass】 2022-06-29 02:40:55 第三步: 修改配置文件... 2022-06-29 02:40:55 提示: 由于文件【 /etc/config/openclash 】被修改，暂停快速启动...

Describe the Bug

使用代理集无法正常启动clash

OpenClash Log

2022-06-29 02:24:12 level=fatal msg="Parse config error: yaml: unmarshal errors:\n line 10: cannot unmarshal !!str http into map[string]interface {}\n line 11: cannot unmarshal !!str https:/... into map[string]interface {}\n line 12: cannot unmarshal !!str 3600 into map[string]interface {}\n line 13: cannot unmarshal !!str ./Proxy... into map[string]interface {}" 2022-06-29 02:16:56 level=fatal msg="Parse config error: yaml: unmarshal errors:\n line 10: cannot unmarshal !!str http into map[string]interface {}\n line 11: cannot unmarshal !!str https:/... into map[string]interface {}\n line 12: cannot unmarshal !!int 3600 into map[string]interface {}\n line 13: cannot unmarshal !!str ./Proxy... into map[string]interface {}" 2022-06-29 02:14:04 level=fatal msg="Parse config error: yaml: unmarshal errors:\n line 10: cannot unmarshal !!str http into map[string]interface {}\n line 11: cannot unmarshal !!str https:/... into map[string]interface {}\n line 12: cannot unmarshal !!int 3600 into map[string]interface {}\n line 13: cannot unmarshal !!str ./Proxy... into map[string]interface {}" 2022-06-29 02:10:05 level=fatal msg="Parse config error: yaml: unmarshal errors:\n line 10: cannot unmarshal !!str http into map[string]interface {}\n line 11: cannot unmarshal !!str https:/... into map[string]interface {}\n line 12: cannot unmarshal !!int 3600 into map[string]interface {}\n line 13: cannot unmarshal !!str ./Proxy... into map[string]interface {}" 2022-06-29 02:07:41 level=fatal msg="Parse config error: yaml: unmarshal errors:\n line 10: cannot unmarshal !!str http into map[string]interface {}\n line 11: cannot unmarshal !!str https:/... into map[string]interface {}\n line 12: cannot unmarshal !!int 3600 into map[string]interface {}\n line 13: cannot unmarshal !!str ./Proxy... into map[string]interface {}"

OpenClash Config

OpenClash 调试日志

生成时间: 2022-06-29 02:48:19
插件版本: 
隐私提示: 上传此日志前请注意检查、屏蔽公网IP、节点、密码等相关敏感信息

===================== 系统信息 =====================

主机型号: VMware - Intel(R) Celeron(R) N5105 @ 2.00GHz : 1 Core 4 Thread 固件版本: OpenWrt SNAPSHOT r4520-178730014 LuCI版本: 内核版本: 5.15.41 处理器架构: x86_64

此项有值时,如不使用IPv6,建议到网络-接口-lan的设置中禁用IPV6的DHCP

IPV6-DHCP: server

此项结果应仅有配置文件的DNS监听地址

Dnsmasq转发设置:

===================== 依赖检查 =====================

dnsmasq-full: 已安装 coreutils: 已安装 coreutils-nohup: 已安装 bash: 已安装 curl: 已安装 ca-certificates: 已安装 ipset: 已安装 ip-full: 已安装 iptables-mod-tproxy: 已安装 kmod-ipt-tproxy: 已安装 iptables-mod-extra: 已安装 kmod-ipt-extra: 已安装 libcap: 已安装 libcap-bin: 已安装 ruby: 已安装 ruby-yaml: 已安装 ruby-psych: 已安装 ruby-pstore: 已安装 ruby-dbm: 未安装 kmod-tun(TUN模式): 已安装 luci-compat(Luci-19.07): 已安装 kmod-inet-diag(PROCESS-NAME): 已安装

===================== 内核检查 =====================

运行状态: 未运行已选择的架构: linux-amd64

下方无法显示内核版本号时请确认您的内核版本是否正确或者有无权限

Tun内核版本: 2022.06.19 Tun内核文件: 存在 Tun内核运行权限: 正常

Dev内核版本: v1.11.0 Dev内核文件: 存在 Dev内核运行权限: 正常

Meta内核版本: alpha-g30a0834 Meta内核文件: 存在 Meta内核运行权限: 正常

===================== 插件设置 =====================

当前配置文件: /etc/openclash/config/nexi.yaml 启动配置文件: /etc/openclash/nexi.yaml 运行模式: fake-ip-mix 默认代理模式: rule UDP流量转发(tproxy): 停用 DNS劫持: 启用自定义DNS: 启用 IPV6代理: 停用 IPV6-DNS解析: 停用禁用Dnsmasq缓存: 停用自定义规则: 停用仅允许内网: 启用仅代理命中规则流量: 停用仅允许常用端口流量: 停用绕过中国大陆IP: 停用 DNS远程解析: 启用路由本机代理: 停用

启动异常时建议关闭此项后重试

混合节点: 停用保留配置: 停用

启动异常时建议关闭此项后重试

第三方规则: 停用

===================== 配置文件 =====================

port: 7890 socks-port: 7891 allow-lan: true mode: rule log-level: silent external-controller: 0.0.0.0:9090 proxy-groups:

name: Proxy type: select use:
- nexi-Sub
name: AdBlock type: select proxies:
- DIRECT
- REJECT
name: Netflix type: select proxies:
- DIRECT use:
- nexi-Sub
name: Spotify type: select proxies:
- DIRECT use:
- nexi-Sub
name: China TV type: select proxies:
- DIRECT use:
- nexi-Sub
name: Global TV type: select proxies:
- DIRECT use:
- nexi-Sub
name: Telegram type: select proxies:
- DIRECT use:
- nexi-Sub
name: Crypto type: select proxies:
- DIRECT use:
- nexi-Sub
name: Douyin type: select proxies:
- DIRECT use:
- nexi-Sub
name: Steam type: select proxies:
- DIRECT use:
- nexi-Sub
name: Speedtest type: select proxies:
- DIRECT use:
- nexi-Sub
name: Paypal type: select proxies:
- DIRECT use:
- nexi-Sub
name: Microsoft type: select proxies:
- DIRECT use:
- nexi-Sub
name: Apple type: select proxies:
- DIRECT use:
- nexi-Sub
name: Google FCM type: select proxies:
- DIRECT use:
- nexi-Sub
name: Scholar type: select proxies:
- DIRECT use:
- nexi-Sub
name: Domestic type: select proxies:
- DIRECT use:
- nexi-Sub
name: Others type: select proxies:
- DIRECT use:
- nexi-Sub rules:
DST-PORT,7895,REJECT
DST-PORT,7892,REJECT
IP-CIDR,198.18.0.1/16,REJECT,no-resolve
SRC-IP-CIDR,192.168.50.201/32,DIRECT
SRC-IP-CIDR,198.18.0.1/32,DIRECT
RULE-SET,Reject,AdBlock
RULE-SET,Special,DIRECT
RULE-SET,Netflix,Netflix
RULE-SET,Spotify,Spotify
RULE-SET,YouTube,YouTube
RULE-SET,Disney Plus,Disney
RULE-SET,Bilibili,Asian TV
RULE-SET,IQ,Asian TV
RULE-SET,IQIYI,Asian TV
RULE-SET,Letv,Asian TV
RULE-SET,Netease Music,Asian TV
RULE-SET,Tencent Video,Asian TV
RULE-SET,Youku,Asian TV
RULE-SET,WeTV,Asian TV
RULE-SET,ABC,Global TV
RULE-SET,Abema TV,Global TV
RULE-SET,Amazon,Global TV
RULE-SET,Apple News,Global TV
RULE-SET,Apple TV,Global TV
RULE-SET,Bahamut,Global TV
RULE-SET,BBC iPlayer,Global TV
RULE-SET,DAZN,Global TV
RULE-SET,Discovery Plus,Global TV
RULE-SET,encoreTVB,Global TV
RULE-SET,F1 TV,Global TV
RULE-SET,Fox Now,Global TV
RULE-SET,Fox+,Global TV
RULE-SET,HBO Go,Global TV
RULE-SET,HBO Max,Global TV
RULE-SET,Hulu Japan,Global TV
RULE-SET,Hulu,Global TV
RULE-SET,Japonx,Global TV
RULE-SET,JOOX,Global TV
RULE-SET,KKBOX,Global TV
RULE-SET,KKTV,Global TV
RULE-SET,Line TV,Global TV
RULE-SET,myTV SUPER,Global TV
RULE-SET,Pandora,Global TV
RULE-SET,PBS,Global TV
RULE-SET,Pornhub,Global TV
RULE-SET,Soundcloud,Global TV
RULE-SET,ViuTV,Global TV
RULE-SET,Telegram,Telegram
RULE-SET,Crypto,Crypto
RULE-SET,Douyin,Douyin
RULE-SET,Steam,Steam
RULE-SET,Speedtest,Speedtest
RULE-SET,PayPal,PayPal
RULE-SET,Microsoft,Microsoft
RULE-SET,Apple,Apple
RULE-SET,Google FCM,Google FCM
RULE-SET,Scholar,Scholar
RULE-SET,PROXY,Proxy
RULE-SET,Domestic,Domestic
RULE-SET,Domestic IPs,Domestic
RULE-SET,LAN,DIRECT
GEOIP,CN,Domestic
MATCH,Others script: code: | def main(ctx, metadata): ruleset_action = {"Reject": "AdBlock", "Special": "DIRECT", "Netflix": "Netflix", "Spotify": "Spotify", "YouTube": "YouTube", "Disney Plus": "Disney", "Bilibili": "Asian TV", "IQ": "Asian TV", "IQIYI": "Asian TV", "Letv": "Asian TV", "Netease Music": "Asian TV", "Tencent Video": "Asian TV", "Youku": "Asian TV", "WeTV": "Asian TV", "ABC": "Global TV", "Abema TV": "Global TV", "Amazon": "Global TV", "Apple News": "Global TV", "Apple TV": "Global TV", "Bahamut": "Global TV", "BBC iPlayer": "Global TV", "DAZN": "Global TV", "Discovery Plus": "Global TV", "encoreTVB": "Global TV", "F1 TV": "Global TV", "Fox Now": "Global TV", "Fox+": "Global TV", "HBO Go": "Global TV", "HBO Max": "Global TV", "Hulu Japan": "Global TV", "Hulu": "Global TV", "Japonx": "Global TV", "JOOX": "Global TV", "KKBOX": "Global TV", "KKTV": "Global TV", "Line TV": "Global TV", "myTV SUPER": "Global TV", "Pandora": "Global TV", "PBS": "Global TV", "Pornhub": "Global TV", "Soundcloud": "Global TV", "ViuTV": "Global TV", "Telegram": "Telegram", "Crypto": "Crypto", "Douyin": "Douyin", "Steam": "Steam", "Speedtest": "Speedtest", "PayPal": "PayPal", "Microsoft": "Microsoft", "Apple": "Apple", "Google FCM": "Google FCM", "Scholar": "Scholar", "PROXY": "Proxy", "Domestic": "Domestic", "Domestic IPs": "Domestic", "LAN": "DIRECT" }
```
port = int(metadata["dst_port"])

if metadata["network"] == "UDP":
    if port == 443:
        ctx.log('[Script] matched QUIC traffic use reject')
        return "REJECT"

port_list = [21, 22, 23, 53, 80, 123, 143, 194, 443, 465, 587, 853, 993, 995, 998, 2052, 2053, 2082, 2083, 2086, 2095, 2096, 5222, 5228, 5229, 5230, 8080, 8443, 8880, 8888, 8889]
if port not in port_list:
    ctx.log('[Script] not common port use direct')
    return "DIRECT"

if metadata["dst_ip"] == "":
    metadata["dst_ip"] = ctx.resolve_ip(metadata["host"])

for ruleset in ruleset_action:
    if ctx.rule_providers[ruleset].match(metadata):
        return ruleset_action[ruleset]

if metadata["dst_ip"] == "":
    return "DIRECT"

code = ctx.geoip(metadata["dst_ip"])
if code == "CN":
    ctx.log('[Script] Geoip CN')
    return "Domestic"

ctx.log('[Script] FINAL')
return "Others"
```
rule-providers: Reject: type: http behavior: classical url: https://dler.cloud/Rules/Clash/Provider/Reject.yaml path: "./Rules/Reject" interval: 86400 Special: type: http behavior: classical url: https://dler.cloud/Rules/Clash/Provider/Special.yaml path: "./Rules/Special" interval: 86400 Netflix: type: http behavior: classical url: https://dler.cloud/Rules/Clash/Provider/Media/Netflix.yaml path: "./Rules/Media/Netflix" interval: 86400 Spotify: type: http behavior: classical url: https://dler.cloud/Rules/Clash/Provider/Media/Spotify.yaml path: "./Rules/Media/Spotify" interval: 86400 YouTube: type: http behavior: classical url: https://dler.cloud/Rules/Clash/Provider/Media/YouTube.yaml path: "./Rules/Media/YouTube" interval: 86400 Bilibili: type: http behavior: classical url: https://dler.cloud/Rules/Clash/Provider/Media/Bilibili.yaml path: "./Rules/Media/Bilibili" interval: 86400 IQ: type: http behavior: classical url: https://dler.cloud/Rules/Clash/Provider/Media/IQ.yaml path: "./Rules/Media/IQI" interval: 86400 IQIYI: type: http behavior: classical url: https://dler.cloud/Rules/Clash/Provider/Media/IQIYI.yaml path: "./Rules/Media/IQYI" interval: 86400 Letv: type: http behavior: classical url: https://dler.cloud/Rules/Clash/Provider/Media/Letv.yaml path: "./Rules/Media/Letv" interval: 86400 Netease Music: type: http behavior: classical url: https://dler.cloud/Rules/Clash/Provider/Media/Netease%20Music.yaml path: "./Rules/Media/Netease_Music" interval: 86400 Tencent Video: type: http behavior: classical url: https://dler.cloud/Rules/Clash/Provider/Media/Tencent%20Video.yaml path: "./Rules/Media/Tencent_Video" interval: 86400 Youku: type: http behavior: classical url: https://dler.cloud/Rules/Clash/Provider/Media/Youku.yaml path: "./Rules/Media/Youku" interval: 86400 WeTV: type: http behavior: classical url: https://dler.cloud/Rules/Clash/Provider/Media/WeTV.yaml path: "./Rules/Media/WeTV" interval: 86400 ABC: type: http behavior: classical url: https://dler.cloud/Rules/Clash/Provider/Media/ABC.yaml path: "./Rules/Media/ABC" interval: 86400 Abema TV: type: http behavior: classical url: https://dler.cloud/Rules/Clash/Provider/Media/Abema%20TV.yaml path: "./Rules/Media/Abema_TV" interval: 86400 Amazon: type: http behavior: classical url: https://dler.cloud/Rules/Clash/Provider/Media/Amazon.yaml path: "./Rules/Media/Amazon" interval: 86400 Apple News: type: http behavior: classical url: https://dler.cloud/Rules/Clash/Provider/Media/Apple%20News.yaml path: "./Rules/Media/Apple_News" interval: 86400 Apple TV: type: http behavior: classical url: https://dler.cloud/Rules/Clash/Provider/Media/Apple%20TV.yaml path: "./Rules/Media/Apple_TV" interval: 86400 Bahamut: type: http behavior: classical url: https://dler.cloud/Rules/Clash/Provider/Media/Bahamut.yaml path: "./Rules/Media/Bahamut" interval: 86400 BBC iPlayer: type: http behavior: classical url: https://dler.cloud/Rules/Clash/Provider/Media/BBC%20iPlayer.yaml path: "./Rules/Media/BBC_iPlayer" interval: 86400 DAZN: type: http behavior: classical url: https://dler.cloud/Rules/Clash/Provider/Media/DAZN.yaml path: "./Rules/Media/DAZN" interval: 86400 Discovery Plus: type: http behavior: classical url: https://dler.cloud/Rules/Clash/Provider/Media/Discovery%20Plus.yaml path: "./Rules/Media/Discovery_Plus" interval: 86400 Disney Plus: type: http behavior: classical url: https://dler.cloud/Rules/Clash/Provider/Media/Disney%20Plus.yaml path: "./Rules/Media/Disney_Plus" interval: 86400 encoreTVB: type: http behavior: classical url: https://dler.cloud/Rules/Clash/Provider/Media/encoreTVB.yaml path: "./Rules/Media/encoreTVB" interval: 86400 F1 TV: type: http behavior: classical url: https://dler.cloud/Rules/Clash/Provider/Media/F1%20TV.yaml path: "./Rules/Media/F1_TV" interval: 86400 Fox Now: type: http behavior: classical url: https://dler.cloud/Rules/Clash/Provider/Media/Fox%20Now.yaml path: "./Rules/Media/Fox_Now" interval: 86400 Fox+: type: http behavior: classical url: https://dler.cloud/Rules/Clash/Provider/Media/Fox%2B.yaml path: "./Rules/Media/Fox+" interval: 86400 HBO Go: type: http behavior: classical url: https://dler.cloud/Rules/Clash/Provider/Media/HBO%20Go.yaml path: "./Rules/Media/HBO_Go" interval: 86400 HBO Max: type: http behavior: classical url: https://dler.cloud/Rules/Clash/Provider/Media/HBO%20Max.yaml path: "./Rules/Media/HBO_Max" interval: 86400 Hulu Japan: type: http behavior: classical url: https://dler.cloud/Rules/Clash/Provider/Media/Hulu%20Japan.yaml path: "./Rules/Media/Hulu_Japan" interval: 86400 Hulu: type: http behavior: classical url: https://dler.cloud/Rules/Clash/Provider/Media/Hulu.yaml path: "./Rules/Media/Hulu" interval: 86400 Japonx: type: http behavior: classical url: https://dler.cloud/Rules/Clash/Provider/Media/Japonx.yaml path: "./Rules/Media/Japonx" interval: 86400 JOOX: type: http behavior: classical url: https://dler.cloud/Rules/Clash/Provider/Media/JOOX.yaml path: "./Rules/Media/JOOX" interval: 86400 KKBOX: type: http behavior: classical url: https://dler.cloud/Rules/Clash/Provider/Media/KKBOX.yaml path: "./Rules/Media/KKBOX" interval: 86400 KKTV: type: http behavior: classical url: https://dler.cloud/Rules/Clash/Provider/Media/KKTV.yaml path: "./Rules/Media/KKTV" interval: 86400 Line TV: type: http behavior: classical url: https://dler.cloud/Rules/Clash/Provider/Media/Line%20TV.yaml path: "./Rules/Media/Line_TV" interval: 86400 myTV SUPER: type: http behavior: classical url: https://dler.cloud/Rules/Clash/Provider/Media/myTV%20SUPER.yaml path: "./Rules/Media/myTV_SUPER" interval: 86400 Pandora: type: http behavior: classical url: https://dler.cloud/Rules/Clash/Provider/Media/Pandora.yaml path: "./Rules/Media/Pandora" interval: 86400 PBS: type: http behavior: classical url: https://dler.cloud/Rules/Clash/Provider/Media/PBS.yaml path: "./Rules/Media/PBS" interval: 86400 Pornhub: type: http behavior: classical url: https://dler.cloud/Rules/Clash/Provider/Media/Pornhub.yaml path: "./Rules/Media/Pornhub" interval: 86400 Soundcloud: type: http behavior: classical url: https://dler.cloud/Rules/Clash/Provider/Media/Soundcloud.yaml path: "./Rules/Media/Soundcloud" interval: 86400 ViuTV: type: http behavior: classical url: https://dler.cloud/Rules/Clash/Provider/Media/ViuTV.yaml path: "./Rules/Media/ViuTV" interval: 86400 Telegram: type: http behavior: classical url: https://dler.cloud/Rules/Clash/Provider/Telegram.yaml path: "./Rules/Telegram" interval: 86400 Crypto: type: http behavior: classical url: https://dler.cloud/Rules/Clash/Provider/Crypto.yaml path: "./Rules/Crypto" interval: 86400 Douyin: type: http behavior: classical url: https://dler.cloud/Rules/Clash/Provider/Douyin.yaml path: "./Rules/Douyin" interval: 86400 Steam: type: http behavior: classical url: https://dler.cloud/Rules/Clash/Provider/Steam.yaml path: "./Rules/Steam" interval: 86400 Speedtest: type: http behavior: classical url: https://dler.cloud/Rules/Clash/Provider/Speedtest.yaml path: "./Rules/Speedtest" interval: 86400 PayPal: type: http behavior: classical url: https://dler.cloud/Rules/Clash/Provider/PayPal.yaml path: "./Rules/PayPal" interval: 86400 Microsoft: type: http behavior: classical url: https://dler.cloud/Rules/Clash/Provider/Microsoft.yaml path: "./Rules/Microsoft" interval: 86400 PROXY: type: http behavior: classical url: https://dler.cloud/Rules/Clash/Provider/Proxy.yaml path: "./Rules/Proxy" interval: 86400 Domestic: type: http behavior: classical url: https://dler.cloud/Rules/Clash/Provider/Domestic.yaml path: "./Rules/Domestic" interval: 86400 Apple: type: http behavior: classical url: https://dler.cloud/Rules/Clash/Provider/Apple.yaml path: "./Rules/Apple" interval: 86400 Google FCM: type: http behavior: classical url: https://dler.cloud/Rules/Clash/Provider/Google%20FCM.yaml path: "./Rules/Google FCM" interval: 86400 Scholar: type: http behavior: classical url: https://dler.cloud/Rules/Clash/Provider/Scholar.yaml path: "./Rules/Scholar" interval: 86400 Domestic IPs: type: http behavior: ipcidr url: https://dler.cloud/Rules/Clash/Provider/Domestic%20IPs.yaml path: "./Rules/Domestic_IPs" interval: 86400 LAN: type: http behavior: classical url: https://dler.cloud/Rules/Clash/Provider/LAN.yaml path: "./Rules/LAN" interval: 86400 redir-port: 7892 tproxy-port: 7895 mixed-port: 7893 bind-address: "*" external-ui: "/usr/share/openclash/ui" ipv6: false dns: enable: true ipv6: false enhanced-mode: fake-ip fake-ip-range: 198.18.0.1/16 listen: 0.0.0.0:7874 nameserver:
- dhcp://"pppoe-wan"
- 1.203.155.1
- 219.141.136.10
- 219.141.140.10
- https://dns.cloudflare.com/dns-query
- https://1.1.1.1/dns-query
- https://public.dns.iij.jp/dns-query
- https://jp.tiar.app/dns-query fallback:
- tls://dns.google:853
- tls://1.1.1.1:853
- tls://8.8.8.8:853
- "[2001:4860:4860::8888]:53"
- "[2001:4860:4860::8844]:53"
- "[2001:da8::666]:53"
- https://jp.tiarap.org/dns-query
- tls://jp.tiar.app
- tls://dot.tiar.app default-nameserver:
- 1.203.155.1
- 219.141.136.10
- 219.141.140.10
- "[2001:4860:4860::8888]:53"
- "[2001:4860:4860::8844]:53"
- "[2001:da8::666]:53" fake-ip-filter:
- "*.lan"
- "*.localdomain"
- "*.example"
- "*.invalid"
- "*.localhost"
- "*.test"
- "*.local"
- "*.home.arpa"
- time.*.com
- time.*.gov
- time.*.edu.cn
- time.*.apple.com
- time1.*.com
- time2.*.com
- time3.*.com
- time4.*.com
- time5.*.com
- time6.*.com
- time7.*.com
- ntp.*.com
- ntp1.*.com
- ntp2.*.com
- ntp3.*.com
- ntp4.*.com
- ntp5.*.com
- ntp6.*.com
- ntp7.*.com
- "*.time.edu.cn"
- "*.ntp.org.cn"
- "+.pool.ntp.org"
- time1.cloud.tencent.com
- music.163.com
- "*.music.163.com"
- "*.126.net"
- musicapi.taihe.com
- music.taihe.com
- songsearch.kugou.com
- trackercdn.kugou.com
- "*.kuwo.cn"
- api-jooxtt.sanook.com
- api.joox.com
- joox.com
- y.qq.com
- "*.y.qq.com"
- streamoc.music.tc.qq.com
- mobileoc.music.tc.qq.com
- isure.stream.qqmusic.qq.com
- dl.stream.qqmusic.qq.com
- aqqmusic.tc.qq.com
- amobile.music.tc.qq.com
- "*.xiami.com"
- "*.music.migu.cn"
- music.migu.cn
- "+.msftconnecttest.com"
- "+.msftncsi.com"
- msftconnecttest.com
- msftncsi.com
- localhost.ptlogin2.qq.com
- localhost.sec.qq.com
- "+.srv.nintendo.net"
- "*.n.n.srv.nintendo.net"
- "+.stun.playstation.net"
- xbox...microsoft.com
- "..xboxlive.com"
- xbox.*.microsoft.com
- xnotify.xboxlive.com
- "+.battlenet.com.cn"
- "+.wotgame.cn"
- "+.wggames.cn"
- "+.wowsgame.cn"
- "+.wargaming.net"
- proxy.golang.org
- stun..
- stun...*
- "+.stun.."
- "+.stun...*"
- "+.stun...."
- "+.stun.....*"
- heartbeat.belkin.com
- "*.linksys.com"
- "*.linksyssmartwifi.com"
- "*.router.asus.com"
- mesu.apple.com
- swscan.apple.com
- swquery.apple.com
- swdownload.apple.com
- swcdn.apple.com
- swdist.apple.com
- lens.l.google.com
- stun.l.google.com
- "+.nflxvideo.net"
- "*.square-enix.com"
- "*.finalfantasyxiv.com"
- "*.ffxiv.com"
- "*.ff14.sdo.com"
- ff.dorado.sdo.com
- "*.mcdn.bilivideo.cn"
- "+.media.dssott.com"
- shark007.net tun: enable: true stack: system auto-route: false auto-detect-interface: false dns-hijack:
- tcp://any:53 profile: store-selected: true store-fake-ip: true

===================== 防火墙设置 =====================

IPv4 NAT chain

Generated by iptables-save v1.8.7 on Wed Jun 29 02:48:21 2022

nat :PREROUTING ACCEPT [109:10724] :INPUT ACCEPT [6:410] :OUTPUT ACCEPT [31:1968] :POSTROUTING ACCEPT [64:8036] :MINIUPNPD - [0:0] :MINIUPNPD-POSTROUTING - [0:0] :postrouting_VPN_rule - [0:0] :postrouting_lan_rule - [0:0] :postrouting_rule - [0:0] :postrouting_wan_rule - [0:0] :prerouting_VPN_rule - [0:0] :prerouting_lan_rule - [0:0] :prerouting_rule - [0:0] :prerouting_wan_rule - [0:0] :zone_VPN_postrouting - [0:0] :zone_VPN_prerouting - [0:0] :zone_lan_postrouting - [0:0] :zone_lan_prerouting - [0:0] :zone_wan_postrouting - [0:0] :zone_wan_prerouting - [0:0] -A PREROUTING -p udp -m udp --dport 53 -j REDIRECT --to-ports 53 -A PREROUTING -p tcp -m tcp --dport 53 -j REDIRECT --to-ports 53 -A PREROUTING -m comment --comment "!fw3: Custom prerouting rule chain" -j prerouting_rule -A PREROUTING -i br-lan -m comment --comment "!fw3" -j zone_lan_prerouting -A PREROUTING -i pppoe-wan -m comment --comment "!fw3" -j zone_wan_prerouting -A PREROUTING -i ipsec0 -m comment --comment "!fw3" -j zone_VPN_prerouting -A POSTROUTING -m comment --comment "!fw3: Custom postrouting rule chain" -j postrouting_rule -A POSTROUTING -o br-lan -m comment --comment "!fw3" -j zone_lan_postrouting -A POSTROUTING -o pppoe-wan -m comment --comment "!fw3" -j zone_wan_postrouting -A POSTROUTING -o ipsec0 -m comment --comment "!fw3" -j zone_VPN_postrouting -A zone_VPN_postrouting -m comment --comment "!fw3: Custom VPN postrouting rule chain" -j postrouting_VPN_rule -A zone_VPN_prerouting -m comment --comment "!fw3: Custom VPN prerouting rule chain" -j prerouting_VPN_rule -A zone_lan_postrouting -m comment --comment "!fw3: Custom lan postrouting rule chain" -j postrouting_lan_rule -A zone_lan_postrouting -s 192.168.50.0/24 -d 192.168.50.150/32 -p tcp -m comment --comment "!fw3: nas (reflection)" -j SNAT --to-source 192.168.50.201 -A zone_lan_postrouting -s 192.168.50.0/24 -d 192.168.50.150/32 -p udp -m comment --comment "!fw3: nas (reflection)" -j SNAT --to-source 192.168.50.201 -A zone_lan_postrouting -s 192.168.50.0/24 -d 192.168.50.150/32 -p tcp -m tcp --dport 30033 -m comment --comment "!fw3: ts-file (reflection)" -j SNAT --to-source 192.168.50.201 -A zone_lan_postrouting -s 192.168.50.0/24 -d 192.168.50.150/32 -p udp -m udp --dport 30033 -m comment --comment "!fw3: ts-file (reflection)" -j SNAT --to-source 192.168.50.201 -A zone_lan_postrouting -s 192.168.50.0/24 -d 192.168.50.150/32 -p tcp -m tcp --dport 5000 -m comment --comment "!fw3: web (reflection)" -j SNAT --to-source 192.168.50.201 -A zone_lan_postrouting -s 192.168.50.0/24 -d 192.168.50.150/32 -p udp -m udp --dport 5000 -m comment --comment "!fw3: web (reflection)" -j SNAT --to-source 192.168.50.201 -A zone_lan_postrouting -s 192.168.50.0/24 -d 192.168.50.150/32 -m comment --comment "!fw3: nasDMZ (reflection)" -j SNAT --to-source 192.168.50.201 -A zone_lan_prerouting -m comment --comment "!fw3: Custom lan prerouting rule chain" -j prerouting_lan_rule -A zone_lan_prerouting -s 192.168.50.0/24 -d WAN IP/32 -p tcp -m comment --comment "!fw3: nas (reflection)" -j DNAT --to-destination 192.168.50.150 -A zone_lan_prerouting -s 192.168.50.0/24 -d WAN IP/32 -p udp -m comment --comment "!fw3: nas (reflection)" -j DNAT --to-destination 192.168.50.150 -A zone_lan_prerouting -s 192.168.50.0/24 -d WAN IP/32 -p tcp -m tcp --dport 30033 -m comment --comment "!fw3: ts-file (reflection)" -j DNAT --to-destination 192.168.50.150:30033 -A zone_lan_prerouting -s 192.168.50.0/24 -d WAN IP/32 -p udp -m udp --dport 30033 -m comment --comment "!fw3: ts-file (reflection)" -j DNAT --to-destination 192.168.50.150:30033 -A zone_lan_prerouting -s 192.168.50.0/24 -d WAN IP/32 -p tcp -m tcp --dport 5000 -m comment --comment "!fw3: web (reflection)" -j DNAT --to-destination 192.168.50.150:5000 -A zone_lan_prerouting -s 192.168.50.0/24 -d WAN IP/32 -p udp -m udp --dport 5000 -m comment --comment "!fw3: web (reflection)" -j DNAT --to-destination 192.168.50.150:5000 -A zone_lan_prerouting -s 192.168.50.0/24 -d WAN IP*/32 -m comment --comment "!fw3: nasDMZ (reflection)" -j DNAT --to-destination 192.168.50.150 -A zone_wan_postrouting -j MINIUPNPD-POSTROUTING -A zone_wan_postrouting -j MINIUPNPD-POSTROUTING -A zone_wan_postrouting -m comment --comment "!fw3: Custom wan postrouting rule chain" -j postrouting_wan_rule -A zone_wan_postrouting -m comment --comment "!fw3" -j FULLCONENAT -A zone_wan_prerouting -j MINIUPNPD -A zone_wan_prerouting -j MINIUPNPD -A zone_wan_prerouting -m comment --comment "!fw3: Custom wan prerouting rule chain" -j prerouting_wan_rule -A zone_wan_prerouting -p tcp -m comment --comment "!fw3: nas" -j DNAT --to-destination 192.168.50.150 -A zone_wan_prerouting -p udp -m comment --comment "!fw3: nas" -j DNAT --to-destination 192.168.50.150 -A zone_wan_prerouting -p tcp -m tcp --dport 9987 -m comment --comment "!fw3: ts" -j DNAT --to-destination 192.168.50.150:9987 -A zone_wan_prerouting -p udp -m udp --dport 9987 -m comment --comment "!fw3: ts" -j DNAT --to-destination 192.168.50.150:9987 -A zone_wan_prerouting -p tcp -m tcp --dport 30033 -m comment --comment "!fw3: ts-file" -j DNAT --to-destination 192.168.50.150:30033 -A zone_wan_prerouting -p udp -m udp --dport 30033 -m comment --comment "!fw3: ts-file" -j DNAT --to-destination 192.168.50.150:30033 -A zone_wan_prerouting -p tcp -m tcp --dport 5000 -m comment --comment "!fw3: web" -j DNAT --to-destination 192.168.50.150:5000 -A zone_wan_prerouting -p udp -m udp --dport 5000 -m comment --comment "!fw3: web" -j DNAT --to-destination 192.168.50.150:5000 -A zone_wan_prerouting -m comment --comment "!fw3: nasDMZ" -j DNAT --to-destination 192.168.50.150 -A zone_wan_prerouting -m comment --comment "!fw3" -j FULLCONENAT COMMIT

Completed on Wed Jun 29 02:48:21 2022

IPv4 Mangle chain

Generated by iptables-save v1.8.7 on Wed Jun 29 02:48:21 2022

*mangle :PREROUTING ACCEPT [2079:251743] :INPUT ACCEPT [759:94126] :FORWARD ACCEPT [1375:174518] :OUTPUT ACCEPT [960:821808] :POSTROUTING ACCEPT [2335:996326] :RRDIPT_FORWARD - [0:0] :RRDIPT_INPUT - [0:0] :RRDIPT_OUTPUT - [0:0] -A INPUT -j RRDIPT_INPUT -A FORWARD -j RRDIPT_FORWARD -A FORWARD -o pppoe-wan -p tcp -m tcp --tcp-flags SYN,RST SYN -m comment --comment "!fw3: Zone wan MTU fixing" -j TCPMSS --clamp-mss-to-pmtu -A FORWARD -i pppoe-wan -p tcp -m tcp --tcp-flags SYN,RST SYN -m comment --comment "!fw3: Zone wan MTU fixing" -j TCPMSS --clamp-mss-to-pmtu -A OUTPUT -j RRDIPT_OUTPUT -A RRDIPT_FORWARD -s 192.168.50.100/32 -j RETURN -A RRDIPT_FORWARD -d 192.168.50.100/32 -j RETURN -A RRDIPT_FORWARD -s 192.168.50.101/32 -j RETURN -A RRDIPT_FORWARD -d 192.168.50.101/32 -j RETURN -A RRDIPT_FORWARD -s 192.168.50.123/32 -j RETURN -A RRDIPT_FORWARD -d 192.168.50.123/32 -j RETURN -A RRDIPT_FORWARD -s 192.168.50.150/32 -j RETURN -A RRDIPT_FORWARD -d 192.168.50.150/32 -j RETURN -A RRDIPT_FORWARD -s 192.168.50.160/32 -j RETURN -A RRDIPT_FORWARD -d 192.168.50.160/32 -j RETURN -A RRDIPT_FORWARD -s 192.168.50.184/32 -j RETURN -A RRDIPT_FORWARD -d 192.168.50.184/32 -j RETURN -A RRDIPT_FORWARD -s 192.168.50.176/32 -j RETURN -A RRDIPT_FORWARD -d 192.168.50.176/32 -j RETURN -A RRDIPT_FORWARD -s 169.254.4.113/32 -j RETURN -A RRDIPT_FORWARD -d 169.254.4.113/32 -j RETURN -A RRDIPT_FORWARD -s 169.254.114.247/32 -j RETURN -A RRDIPT_FORWARD -d 169.254.114.247/32 -j RETURN -A RRDIPT_FORWARD -s 169.254.222.14/32 -j RETURN -A RRDIPT_FORWARD -d 169.254.222.14/32 -j RETURN -A RRDIPT_INPUT -i eth0 -j RETURN -A RRDIPT_INPUT -i pppoe-wan -j RETURN -A RRDIPT_OUTPUT -o eth0 -j RETURN -A RRDIPT_OUTPUT -o pppoe-wan -j RETURN COMMIT

Completed on Wed Jun 29 02:48:21 2022

IPv4 Filter chain

Generated by iptables-save v1.8.7 on Wed Jun 29 02:48:21 2022

*filter :INPUT ACCEPT [2:80] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [0:0] :DOCKER-MAN - [0:0] :MINIUPNPD - [0:0] :forwarding_VPN_rule - [0:0] :forwarding_lan_rule - [0:0] :forwarding_rule - [0:0] :forwarding_wan_rule - [0:0] :input_VPN_rule - [0:0] :input_lan_rule - [0:0] :input_rule - [0:0] :input_wan_rule - [0:0] :output_VPN_rule - [0:0] :output_lan_rule - [0:0] :output_rule - [0:0] :output_wan_rule - [0:0] :reject - [0:0] :syn_flood - [0:0] :zone_VPN_dest_ACCEPT - [0:0] :zone_VPN_forward - [0:0] :zone_VPN_input - [0:0] :zone_VPN_output - [0:0] :zone_VPN_src_ACCEPT - [0:0] :zone_lan_dest_ACCEPT - [0:0] :zone_lan_forward - [0:0] :zone_lan_input - [0:0] :zone_lan_output - [0:0] :zone_lan_src_ACCEPT - [0:0] :zone_wan_dest_ACCEPT - [0:0] :zone_wan_forward - [0:0] :zone_wan_input - [0:0] :zone_wan_output - [0:0] :zone_wan_src_ACCEPT - [0:0] -A INPUT -m policy --dir in --pol ipsec --proto esp -j ACCEPT -A INPUT -i lo -m comment --comment "!fw3" -j ACCEPT -A INPUT -m comment --comment "!fw3: Custom input rule chain" -j input_rule -A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment "!fw3" -j ACCEPT -A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -m comment --comment "!fw3" -j syn_flood -A INPUT -i br-lan -m comment --comment "!fw3" -j zone_lan_input -A INPUT -i pppoe-wan -m comment --comment "!fw3" -j zone_wan_input -A INPUT -i ipsec0 -m comment --comment "!fw3" -j zone_VPN_input -A FORWARD -m policy --dir out --pol ipsec --proto esp -j ACCEPT -A FORWARD -m policy --dir in --pol ipsec --proto esp -j ACCEPT -A FORWARD -m comment --comment "!fw3: Custom forwarding rule chain" -j forwarding_rule -A FORWARD -m comment --comment "!fw3: Traffic offloading" -m conntrack --ctstate RELATED,ESTABLISHED -j FLOWOFFLOAD --hw -A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment "!fw3" -j ACCEPT -A FORWARD -i br-lan -m comment --comment "!fw3" -j zone_lan_forward -A FORWARD -i pppoe-wan -m comment --comment "!fw3" -j zone_wan_forward -A FORWARD -i ipsec0 -m comment --comment "!fw3" -j zone_VPN_forward -A OUTPUT -m policy --dir out --pol ipsec --proto esp -j ACCEPT -A OUTPUT -o lo -m comment --comment "!fw3" -j ACCEPT -A OUTPUT -m comment --comment "!fw3: Custom output rule chain" -j output_rule -A OUTPUT -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment "!fw3" -j ACCEPT -A OUTPUT -o br-lan -m comment --comment "!fw3" -j zone_lan_output -A OUTPUT -o pppoe-wan -m comment --comment "!fw3" -j zone_wan_output -A OUTPUT -o ipsec0 -m comment --comment "!fw3" -j zone_VPN_output -A DOCKER-MAN -i br-lan -o docker0 -j RETURN -A DOCKER-MAN -o docker0 -m conntrack --ctstate RELATED,ESTABLISHED -j RETURN -A DOCKER-MAN -o docker0 -m conntrack --ctstate INVALID,NEW -j DROP -A DOCKER-MAN -j RETURN -A reject -p tcp -m comment --comment "!fw3" -j REJECT --reject-with tcp-reset -A reject -m comment --comment "!fw3" -j REJECT --reject-with icmp-port-unreachable -A syn_flood -m limit --limit 25/sec --limit-burst 50 -m comment --comment "!fw3" -j RETURN -A syn_flood -m comment --comment "!fw3" -j DROP -A zone_VPN_dest_ACCEPT -o ipsec0 -m comment --comment "!fw3" -j ACCEPT -A zone_VPN_forward -m comment --comment "!fw3: Custom VPN forwarding rule chain" -j forwarding_VPN_rule -A zone_VPN_forward -m comment --comment "!fw3: Zone VPN to wan forwarding policy" -j zone_wan_dest_ACCEPT -A zone_VPN_forward -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port forwards" -j ACCEPT -A zone_VPN_forward -m comment --comment "!fw3" -j zone_VPN_dest_ACCEPT -A zone_VPN_input -m comment --comment "!fw3: Custom VPN input rule chain" -j input_VPN_rule -A zone_VPN_input -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port redirections" -j ACCEPT -A zone_VPN_input -m comment --comment "!fw3" -j zone_VPN_src_ACCEPT -A zone_VPN_output -m comment --comment "!fw3: Custom VPN output rule chain" -j output_VPN_rule -A zone_VPN_output -m comment --comment "!fw3" -j zone_VPN_dest_ACCEPT -A zone_VPN_src_ACCEPT -i ipsec0 -m conntrack --ctstate NEW,UNTRACKED -m comment --comment "!fw3" -j ACCEPT -A zone_lan_dest_ACCEPT -o br-lan -m comment --comment "!fw3" -j ACCEPT -A zone_lan_forward -m comment --comment "!fw3: Custom lan forwarding rule chain" -j forwarding_lan_rule -A zone_lan_forward -m comment --comment "!fw3: Zone lan to wan forwarding policy" -j zone_wan_dest_ACCEPT -A zone_lan_forward -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port forwards" -j ACCEPT -A zone_lan_forward -m comment --comment "!fw3" -j zone_lan_dest_ACCEPT -A zone_lan_input -m comment --comment "!fw3: Custom lan input rule chain" -j input_lan_rule -A zone_lan_input -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port redirections" -j ACCEPT -A zone_lan_input -m comment --comment "!fw3" -j zone_lan_src_ACCEPT -A zone_lan_output -m comment --comment "!fw3: Custom lan output rule chain" -j output_lan_rule -A zone_lan_output -m comment --comment "!fw3" -j zone_lan_dest_ACCEPT -A zone_lan_src_ACCEPT -i br-lan -m conntrack --ctstate NEW,UNTRACKED -m comment --comment "!fw3" -j ACCEPT -A zone_wan_dest_ACCEPT -o pppoe-wan -m conntrack --ctstate INVALID -m comment --comment "!fw3: Prevent NAT leakage" -j DROP -A zone_wan_dest_ACCEPT -o pppoe-wan -m comment --comment "!fw3" -j ACCEPT -A zone_wan_forward -j MINIUPNPD -A zone_wan_forward -j MINIUPNPD -A zone_wan_forward -m comment --comment "!fw3: Custom wan forwarding rule chain" -j forwarding_wan_rule -A zone_wan_forward -p esp -m comment --comment "!fw3: Allow-IPSec-ESP" -j zone_lan_dest_ACCEPT -A zone_wan_forward -p udp -m udp --dport 500 -m comment --comment "!fw3: Allow-ISAKMP" -j zone_lan_dest_ACCEPT -A zone_wan_forward -d 192.168.50.150/32 -p tcp -m comment --comment "!fw3: nas" -j zone_lan_dest_ACCEPT -A zone_wan_forward -d 192.168.50.150/32 -p udp -m comment --comment "!fw3: nas" -j zone_lan_dest_ACCEPT -A zone_wan_forward -m comment --comment "!fw3: Zone wan to VPN forwarding policy" -j zone_VPN_dest_ACCEPT -A zone_wan_forward -m comment --comment "!fw3: Zone wan to lan forwarding policy" -j zone_lan_dest_ACCEPT -A zone_wan_forward -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port forwards" -j ACCEPT -A zone_wan_forward -m comment --comment "!fw3" -j zone_wan_dest_ACCEPT -A zone_wan_input -m comment --comment "!fw3: Custom wan input rule chain" -j input_wan_rule -A zone_wan_input -p udp -m udp --dport 68 -m comment --comment "!fw3: Allow-DHCP-Renew" -j ACCEPT -A zone_wan_input -p icmp -m icmp --icmp-type 8 -m comment --comment "!fw3: Allow-Ping" -j ACCEPT -A zone_wan_input -p igmp -m comment --comment "!fw3: Allow-IGMP" -j ACCEPT -A zone_wan_input -p tcp -m tcp --dport 8118 -m comment --comment "!fw3: adblock" -j DROP -A zone_wan_input -p udp -m udp --dport 500 -m comment --comment "!fw3: ike" -j ACCEPT -A zone_wan_input -p udp -m udp --dport 4500 -m comment --comment "!fw3: ipsec" -j ACCEPT -A zone_wan_input -p ah -m comment --comment "!fw3: ah" -j ACCEPT -A zone_wan_input -p esp -m comment --comment "!fw3: esp" -j ACCEPT -A zone_wan_input -p tcp -m tcp --dport 1688 -m comment --comment "!fw3: kms" -j ACCEPT -A zone_wan_input -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port redirections" -j ACCEPT -A zone_wan_input -m comment --comment "!fw3" -j zone_wan_src_ACCEPT -A zone_wan_output -m comment --comment "!fw3: Custom wan output rule chain" -j output_wan_rule -A zone_wan_output -m comment --comment "!fw3" -j zone_wan_dest_ACCEPT -A zone_wan_src_ACCEPT -i pppoe-wan -m conntrack --ctstate NEW,UNTRACKED -m comment --comment "!fw3" -j ACCEPT COMMIT

Completed on Wed Jun 29 02:48:21 2022

IPv6 NAT chain

Generated by ip6tables-save v1.8.7 on Wed Jun 29 02:48:21 2022

*nat :PREROUTING ACCEPT [371960:30351069] :INPUT ACCEPT [16532:1427642] :OUTPUT ACCEPT [6380:904783] :POSTROUTING ACCEPT [168097:16140290] -A PREROUTING -p udp -m udp --dport 53 -j REDIRECT --to-ports 53 -A PREROUTING -p tcp -m tcp --dport 53 -j REDIRECT --to-ports 53 COMMIT

Completed on Wed Jun 29 02:48:21 2022

IPv6 Mangle chain

Generated by ip6tables-save v1.8.7 on Wed Jun 29 02:48:21 2022

*mangle :PREROUTING ACCEPT [12789650:4738961219] :INPUT ACCEPT [279964:22911575] :FORWARD ACCEPT [12313718:4699989811] :OUTPUT ACCEPT [482187:48136788] :POSTROUTING ACCEPT [12790372:4747774143] -A FORWARD -o pppoe-wan -p tcp -m tcp --tcp-flags SYN,RST SYN -m comment --comment "!fw3: Zone wan MTU fixing" -j TCPMSS --clamp-mss-to-pmtu -A FORWARD -i pppoe-wan -p tcp -m tcp --tcp-flags SYN,RST SYN -m comment --comment "!fw3: Zone wan MTU fixing" -j TCPMSS --clamp-mss-to-pmtu COMMIT

Completed on Wed Jun 29 02:48:21 2022

IPv6 Filter chain

Generated by ip6tables-save v1.8.7 on Wed Jun 29 02:48:21 2022

*filter :INPUT ACCEPT [0:0] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [12:912] :MINIUPNPD - [0:0] :forwarding_VPN_rule - [0:0] :forwarding_lan_rule - [0:0] :forwarding_rule - [0:0] :forwarding_wan_rule - [0:0] :input_VPN_rule - [0:0] :input_lan_rule - [0:0] :input_rule - [0:0] :input_wan_rule - [0:0] :output_VPN_rule - [0:0] :output_lan_rule - [0:0] :output_rule - [0:0] :output_wan_rule - [0:0] :reject - [0:0] :syn_flood - [0:0] :zone_VPN_dest_ACCEPT - [0:0] :zone_VPN_forward - [0:0] :zone_VPN_input - [0:0] :zone_VPN_output - [0:0] :zone_VPN_src_ACCEPT - [0:0] :zone_lan_dest_ACCEPT - [0:0] :zone_lan_forward - [0:0] :zone_lan_input - [0:0] :zone_lan_output - [0:0] :zone_lan_src_ACCEPT - [0:0] :zone_wan_dest_ACCEPT - [0:0] :zone_wan_forward - [0:0] :zone_wan_input - [0:0] :zone_wan_output - [0:0] :zone_wan_src_ACCEPT - [0:0] -A INPUT -i lo -m comment --comment "!fw3" -j ACCEPT -A INPUT -m comment --comment "!fw3: Custom input rule chain" -j input_rule -A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment "!fw3" -j ACCEPT -A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -m comment --comment "!fw3" -j syn_flood -A INPUT -i br-lan -m comment --comment "!fw3" -j zone_lan_input -A INPUT -i pppoe-wan -m comment --comment "!fw3" -j zone_wan_input -A INPUT -i ipsec0 -m comment --comment "!fw3" -j zone_VPN_input -A FORWARD -m comment --comment "!fw3: Custom forwarding rule chain" -j forwarding_rule -A FORWARD -m comment --comment "!fw3: Traffic offloading" -m conntrack --ctstate RELATED,ESTABLISHED -j FLOWOFFLOAD --hw -A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment "!fw3" -j ACCEPT -A FORWARD -i br-lan -m comment --comment "!fw3" -j zone_lan_forward -A FORWARD -i pppoe-wan -m comment --comment "!fw3" -j zone_wan_forward -A FORWARD -i ipsec0 -m comment --comment "!fw3" -j zone_VPN_forward -A OUTPUT -o lo -m comment --comment "!fw3" -j ACCEPT -A OUTPUT -m comment --comment "!fw3: Custom output rule chain" -j output_rule -A OUTPUT -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment "!fw3" -j ACCEPT -A OUTPUT -o br-lan -m comment --comment "!fw3" -j zone_lan_output -A OUTPUT -o pppoe-wan -m comment --comment "!fw3" -j zone_wan_output -A OUTPUT -o ipsec0 -m comment --comment "!fw3" -j zone_VPN_output -A reject -p tcp -m comment --comment "!fw3" -j REJECT --reject-with tcp-reset -A reject -m comment --comment "!fw3" -j REJECT --reject-with icmp6-port-unreachable -A syn_flood -m limit --limit 25/sec --limit-burst 50 -m comment --comment "!fw3" -j RETURN -A syn_flood -m comment --comment "!fw3" -j DROP -A zone_VPN_dest_ACCEPT -o ipsec0 -m comment --comment "!fw3" -j ACCEPT -A zone_VPN_forward -m comment --comment "!fw3: Custom VPN forwarding rule chain" -j forwarding_VPN_rule -A zone_VPN_forward -m comment --comment "!fw3: Zone VPN to wan forwarding policy" -j zone_wan_dest_ACCEPT -A zone_VPN_forward -m comment --comment "!fw3" -j zone_VPN_dest_ACCEPT -A zone_VPN_input -m comment --comment "!fw3: Custom VPN input rule chain" -j input_VPN_rule -A zone_VPN_input -m comment --comment "!fw3" -j zone_VPN_src_ACCEPT -A zone_VPN_output -m comment --comment "!fw3: Custom VPN output rule chain" -j output_VPN_rule -A zone_VPN_output -m comment --comment "!fw3" -j zone_VPN_dest_ACCEPT -A zone_VPN_src_ACCEPT -i ipsec0 -m conntrack --ctstate NEW,UNTRACKED -m comment --comment "!fw3" -j ACCEPT -A zone_lan_dest_ACCEPT -o br-lan -m comment --comment "!fw3" -j ACCEPT -A zone_lan_forward -m comment --comment "!fw3: Custom lan forwarding rule chain" -j forwarding_lan_rule -A zone_lan_forward -m comment --comment "!fw3: Zone lan to wan forwarding policy" -j zone_wan_dest_ACCEPT -A zone_lan_forward -m comment --comment "!fw3" -j zone_lan_dest_ACCEPT -A zone_lan_input -m comment --comment "!fw3: Custom lan input rule chain" -j input_lan_rule -A zone_lan_input -m comment --comment "!fw3" -j zone_lan_src_ACCEPT -A zone_lan_output -m comment --comment "!fw3: Custom lan output rule chain" -j output_lan_rule -A zone_lan_output -m comment --comment "!fw3" -j zone_lan_dest_ACCEPT -A zone_lan_src_ACCEPT -i br-lan -m conntrack --ctstate NEW,UNTRACKED -m comment --comment "!fw3" -j ACCEPT -A zone_wan_dest_ACCEPT -o pppoe-wan -m conntrack --ctstate INVALID -m comment --comment "!fw3: Prevent NAT leakage" -j DROP -A zone_wan_dest_ACCEPT -o pppoe-wan -m comment --comment "!fw3" -j ACCEPT -A zone_wan_forward -j MINIUPNPD -A zone_wan_forward -j MINIUPNPD -A zone_wan_forward -m comment --comment "!fw3: Custom wan forwarding rule chain" -j forwarding_wan_rule -A zone_wan_forward -p ipv6-icmp -m icmp6 --icmpv6-type 128 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Forward" -j ACCEPT -A zone_wan_forward -p ipv6-icmp -m icmp6 --icmpv6-type 129 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Forward" -j ACCEPT -A zone_wan_forward -p ipv6-icmp -m icmp6 --icmpv6-type 1 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Forward" -j ACCEPT -A zone_wan_forward -p ipv6-icmp -m icmp6 --icmpv6-type 2 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Forward" -j ACCEPT -A zone_wan_forward -p ipv6-icmp -m icmp6 --icmpv6-type 3 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Forward" -j ACCEPT -A zone_wan_forward -p ipv6-icmp -m icmp6 --icmpv6-type 4/0 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Forward" -j ACCEPT -A zone_wan_forward -p ipv6-icmp -m icmp6 --icmpv6-type 4/1 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Forward" -j ACCEPT -A zone_wan_forward -p esp -m comment --comment "!fw3: Allow-IPSec-ESP" -j zone_lan_dest_ACCEPT -A zone_wan_forward -p udp -m udp --dport 500 -m comment --comment "!fw3: Allow-ISAKMP" -j zone_lan_dest_ACCEPT -A zone_wan_forward -m comment --comment "!fw3: Zone wan to VPN forwarding policy" -j zone_VPN_dest_ACCEPT -A zone_wan_forward -m comment --comment "!fw3: Zone wan to lan forwarding policy" -j zone_lan_dest_ACCEPT -A zone_wan_forward -m comment --comment "!fw3" -j zone_wan_dest_ACCEPT -A zone_wan_input -m comment --comment "!fw3: Custom wan input rule chain" -j input_wan_rule -A zone_wan_input -s fc00::/6 -d fc00::/6 -p udp -m udp --dport 546 -m comment --comment "!fw3: Allow-DHCPv6" -j ACCEPT -A zone_wan_input -s fe80::/10 -p ipv6-icmp -m icmp6 --icmpv6-type 130/0 -m comment --comment "!fw3: Allow-MLD" -j ACCEPT -A zone_wan_input -s fe80::/10 -p ipv6-icmp -m icmp6 --icmpv6-type 131/0 -m comment --comment "!fw3: Allow-MLD" -j ACCEPT -A zone_wan_input -s fe80::/10 -p ipv6-icmp -m icmp6 --icmpv6-type 132/0 -m comment --comment "!fw3: Allow-MLD" -j ACCEPT -A zone_wan_input -s fe80::/10 -p ipv6-icmp -m icmp6 --icmpv6-type 143/0 -m comment --comment "!fw3: Allow-MLD" -j ACCEPT -A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 128 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT -A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 129 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT -A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 1 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT -A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 2 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT -A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 3 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT -A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 4/0 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT -A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 4/1 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT -A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 133 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT -A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 135 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT -A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 134 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT -A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 136 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT -A zone_wan_input -p tcp -m tcp --dport 8118 -m comment --comment "!fw3: adblock" -j DROP -A zone_wan_input -p udp -m udp --dport 500 -m comment --comment "!fw3: ike" -j ACCEPT -A zone_wan_input -p udp -m udp --dport 4500 -m comment --comment "!fw3: ipsec" -j ACCEPT -A zone_wan_input -p ah -m comment --comment "!fw3: ah" -j ACCEPT -A zone_wan_input -p esp -m comment --comment "!fw3: esp" -j ACCEPT -A zone_wan_input -p tcp -m tcp --dport 1688 -m comment --comment "!fw3: kms" -j ACCEPT -A zone_wan_input -m comment --comment "!fw3" -j zone_wan_src_ACCEPT -A zone_wan_output -m comment --comment "!fw3: Custom wan output rule chain" -j output_wan_rule -A zone_wan_output -m comment --comment "!fw3" -j zone_wan_dest_ACCEPT -A zone_wan_src_ACCEPT -i pppoe-wan -m conntrack --ctstate NEW,UNTRACKED -m comment --comment "!fw3" -j ACCEPT COMMIT

Completed on Wed Jun 29 02:48:21 2022

===================== IPSET状态 =====================

Name: music Name: mwan3_connected_v4 Name: mwan3_connected_v6 Name: mwan3_source_v6 Name: mwan3_dynamic_v4 Name: mwan3_dynamic_v6 Name: mwan3_custom_v4 Name: mwan3_custom_v6 Name: mwan3_connected

===================== 路由表状态 =====================

route -n

Kernel IP routing table Destination Gateway Genmask Flags Metric Ref Use Iface 0.0.0.0 1.203.155.1 0.0.0.0 UG 0 0 0 pppoe-wan xxx.xxx.xxx.xxx 0.0.0.0 255.255.255.255 UH 0 0 0 pppoe-wan 172.17.0.0 0.0.0.0 255.255.0.0 U 0 0 0 docker0 192.168.50.0 0.0.0.0 255.255.255.0 U 0 0 0 br-lan

ip route list

default via xxx.xxx.xxx.xxx dev pppoe-wan proto static xxx.xxx.xxx.xxx dev pppoe-wan proto kernel scope link src WAN IP 172.17.0.0/16 dev docker0 proto kernel scope link src 172.17.0.1 linkdown 192.168.50.0/24 dev br-lan proto kernel scope link src 192.168.50.201

ip rule show

0: from all lookup local 32766: from all lookup main 32767: from all lookup default

===================== Tun设备状态 =====================

===================== 端口占用状态 =====================

===================== 测试本机DNS查询 =====================

Server: 127.0.0.1 Address: 127.0.0.1:53

Non-authoritative answer: www.baidu.com canonical name = www.a.shifen.com Name: www.a.shifen.com Address: 220.181.38.149 Name: www.a.shifen.com Address: 220.181.38.150

Non-authoritative answer: www.baidu.com canonical name = www.a.shifen.com

===================== resolv.conf.d =====================

Interface wan

nameserver 219.141.136.10 nameserver 219.141.140.10

Interface wan_6

nameserver 240e:40:8000::10 nameserver 240e:40:8000::11

===================== 测试本机网络连接 =====================

HTTP/1.1 200 OK Accept-Ranges: bytes Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Connection: keep-alive Content-Length: 277 Content-Type: text/html Date: Tue, 28 Jun 2022 18:48:21 GMT Etag: "575e1f60-115" Last-Modified: Mon, 13 Jun 2016 02:50:08 GMT Pragma: no-cache Server: bfe/1.0.8.18

===================== 测试本机网络下载 =====================

===================== 最近运行日志 =====================

2022-06-29 02:41:19 Tip: Detected The Exclusive Function of The TUN Core, Use TUN Core to Start... 2022-06-29 02:41:20 Step 5: Check The Core Status... time="2022-06-28T18:41:21Z" level=info msg="Start initial compatible provider Netease Music" time="2022-06-28T18:41:21Z" level=info msg="Start initial compatible provider GlobalTV" time="2022-06-28T18:41:21Z" level=info msg="Start initial compatible provider AdBlock" time="2022-06-28T18:41:21Z" level=info msg="Start initial compatible provider Spotify" time="2022-06-28T18:41:21Z" level=info msg="Start initial compatible provider Steam" time="2022-06-28T18:41:21Z" level=info msg="Start initial compatible provider AsianTV" time="2022-06-28T18:41:21Z" level=info msg="Start initial compatible provider Others" time="2022-06-28T18:41:21Z" level=info msg="Start initial compatible provider Google FCM" time="2022-06-28T18:41:21Z" level=info msg="Start initial compatible provider YouTube" time="2022-06-28T18:41:21Z" level=info msg="Start initial compatible provider Disney Plus" time="2022-06-28T18:41:21Z" level=info msg="Start initial compatible provider Speedtest" time="2022-06-28T18:41:21Z" level=info msg="Start initial compatible provider Telegram" time="2022-06-28T18:41:21Z" level=info msg="Start initial compatible provider Auto - UrlTest" time="2022-06-28T18:41:21Z" level=info msg="Start initial compatible provider Domestic" time="2022-06-28T18:41:21Z" level=info msg="Start initial compatible provider Crypto" time="2022-06-28T18:41:21Z" level=info msg="Start initial compatible provider Bilibili" time="2022-06-28T18:41:21Z" level=info msg="Start initial compatible provider Scholar" time="2022-06-28T18:41:21Z" level=info msg="Start initial compatible provider PayPal" time="2022-06-28T18:41:21Z" level=info msg="Start initial compatible provider Proxies" time="2022-06-28T18:41:21Z" level=info msg="Start initial compatible provider Apple" time="2022-06-28T18:41:21Z" level=info msg="Start initial compatible provider Bahamut" time="2022-06-28T18:41:21Z" level=info msg="Start initial compatible provider Microsoft" time="2022-06-28T18:41:21Z" level=info msg="Start initial compatible provider Netflix" time="2022-06-28T18:41:21Z" level=info msg="DNS server listening at: [::]:7874" 2022-06-29 02:41:23 Step 6: Wait For The File Downloading... 2022-06-29 02:41:24 Step 7: Set Firewall Rules... 2022-06-29 02:41:24 Step 8: Restart Dnsmasq... 2022-06-29 02:41:26 Step 9: Add Cron Rules, Start Daemons... 2022-06-29 02:41:26 Warning: OpenClash Start Successful, Please Note That Network May Abnormal With IPv6's DHCP Server 2022-06-29 02:48:09 OpenClash Stoping... 2022-06-29 02:48:09 Step 1: Backup The Current Groups State... 2022-06-29 02:48:09 Step 2: Delete OpenClash Firewall Rules... 2022-06-29 02:48:09 Step 3: Close The OpenClash Daemons... 2022-06-29 02:48:09 Step 4: Close The Clash Core Process... 2022-06-29 02:48:09 Step 5: Restart Dnsmasq... 2022-06-29 02:48:11 Step 6: Delete OpenClash Residue File... 2022-06-29 02:48:11 OpenClash Start Running... 2022-06-29 02:48:11 Step 1: Get The Configuration... 2022-06-29 02:48:12 Step 2: Check The Components... 2022-06-29 02:48:12 Tip: Because of the file【 /etc/config/openclash 】modificated, Pause quick start... 2022-06-29 02:48:12 Step 3: Modify The Config File... 2022-06-29 02:48:12 Error: Edit Provider Path Failed,【undefined method []' for nil:NilClass】 2022-06-29 02:48:12 Step 4: Start Running The Clash Core... 2022-06-29 02:48:12 Tip: Detected The Exclusive Function of The TUN Core, Use TUN Core to Start... 2022-06-29 02:48:13 Step 5: Check The Core Status... time="2022-06-28T18:48:14Z" level=fatal msg="Parse config error: yaml: unmarshal errors:\n line 10: cannot unmarshal !!strhttpinto map[string]interface {}\n line 11: cannot unmarshal !!strhttps:/...into map[string]interface {}\n line 12: cannot unmarshal !!int3600into map[string]interface {}\n line 13: cannot unmarshal !!str./Proxy...` into map[string]interface {}" 2022-06-29 02:48:17 Step 6: Wait For The File Downloading... 2022-06-29 02:48:17 Error: Failed To Download Rule-providers, Please Check The Log Page For Detailed error information!

vernesong / OpenClash

[Bug] 出现错误Parse config error: yaml: unmarshal errors并无法正常启动clash #2516

Verify Steps

OpenClash Version

Bug on Environment

Bug on Platform

To Reproduce

Describe the Bug

OpenClash Log

OpenClash Config

===================== 系统信息 =====================

此项有值时,如不使用IPv6,建议到网络-接口-lan的设置中禁用IPV6的DHCP

此项结果应仅有配置文件的DNS监听地址

===================== 依赖检查 =====================

===================== 内核检查 =====================

下方无法显示内核版本号时请确认您的内核版本是否正确或者有无权限

===================== 插件设置 =====================

启动异常时建议关闭此项后重试

启动异常时建议关闭此项后重试

===================== 配置文件 =====================

===================== 防火墙设置 =====================

IPv4 NAT chain

Generated by iptables-save v1.8.7 on Wed Jun 29 02:48:21 2022

Completed on Wed Jun 29 02:48:21 2022

IPv4 Mangle chain

Generated by iptables-save v1.8.7 on Wed Jun 29 02:48:21 2022

Completed on Wed Jun 29 02:48:21 2022

IPv4 Filter chain

Generated by iptables-save v1.8.7 on Wed Jun 29 02:48:21 2022

Completed on Wed Jun 29 02:48:21 2022

IPv6 NAT chain

Generated by ip6tables-save v1.8.7 on Wed Jun 29 02:48:21 2022

Completed on Wed Jun 29 02:48:21 2022

IPv6 Mangle chain

Generated by ip6tables-save v1.8.7 on Wed Jun 29 02:48:21 2022

Completed on Wed Jun 29 02:48:21 2022

IPv6 Filter chain

Generated by ip6tables-save v1.8.7 on Wed Jun 29 02:48:21 2022

Completed on Wed Jun 29 02:48:21 2022

===================== IPSET状态 =====================

===================== 路由表状态 =====================

route -n

ip route list

ip rule show

===================== Tun设备状态 =====================

===================== 端口占用状态 =====================

===================== 测试本机DNS查询 =====================

===================== resolv.conf.d =====================

Interface wan

Interface wan_6

===================== 测试本机网络连接 =====================

===================== 测试本机网络下载 =====================

===================== 最近运行日志 =====================

===================== 活动连接信息 =====================

Expected Behavior

Screenshots