search

vernesong / OpenClash

A Clash Client For OpenWrt
MIT License
17.37k stars 3.17k forks source link

[Bug] 本地NAS出现无法用域名访问的情况，但是DNS解析地址是正确的，没有污染 #2607

Closed Se7enMuting closed 2 years ago

Se7enMuting commented 2 years ago

Verify Steps

OpenClash Version

v0.45.47-beta

Bug on Environment

Other

Bug on Platform

Linux-amd64(x86-64)

To Reproduce

某次修改访问控制规则，应用配置后出现

Describe the Bug

本地NAS出现无法用域名访问的情况，但是域名解析确实是我Wan口的IP，没有错误，见下面截图和说明。 零时解决：不修改任何配置，关闭openclash，用域名访问我本地NAS，再打开openclash，可解决此问题。

OpenClash Log

见下面截图

OpenClash Config

OpenClash 调试日志

生成时间: 2022-08-06 14:25:20
插件版本: v0.45.47-beta
隐私提示: 上传此日志前请注意检查、屏蔽公网IP、节点、密码等相关敏感信息

#===================== 系统信息 =====================#

主机型号: QEMU Standard PC (i440FX + PIIX, 1996)
固件版本: ImmortalWrt 18.06-SNAPSHOT r8179-cab1e2e283
LuCI版本: git-22.217.32692-b5c5829-1
内核版本: 4.19.246
处理器架构: x86_64

#此项有值时,如不使用IPv6,建议到网络-接口-lan的设置中禁用IPV6的DHCP
IPV6-DHCP: 

#此项结果应仅有配置文件的DNS监听地址
Dnsmasq转发设置: 127.0.0.1#7874

#===================== 依赖检查 =====================#

dnsmasq-full: 已安装
coreutils: 已安装
coreutils-nohup: 已安装
bash: 已安装
curl: 已安装
ca-certificates: 已安装
ipset: 已安装
ip-full: 已安装
iptables-mod-tproxy: 已安装
kmod-ipt-tproxy: 已安装
iptables-mod-extra: 已安装
kmod-ipt-extra: 已安装
libcap: 已安装
libcap-bin: 已安装
ruby: 已安装
ruby-yaml: 已安装
ruby-psych: 已安装
ruby-pstore: 已安装
kmod-tun(TUN模式): 已安装
luci-compat(Luci-19.07): 已安装
kmod-inet-diag(PROCESS-NAME): 已安装
unzip: 已安装

#===================== 内核检查 =====================#

运行状态: 运行中
进程pid: 11266
运行权限: 11266: cap_dac_override,cap_net_bind_service,cap_net_admin,cap_net_raw,cap_sys_ptrace,cap_sys_resource=eip
运行用户: nobody
已选择的架构: linux-amd64

#下方无法显示内核版本号时请确认您的内核版本是否正确或者有无权限
Tun内核版本: 2022.07.07-7-g56f0a92
Tun内核文件: 存在
Tun内核运行权限: 正常

Dev内核版本: v1.11.4-6-gbec4df7
Dev内核文件: 存在
Dev内核运行权限: 正常

Meta内核版本: alpha-g2899a12
Meta内核文件: 存在
Meta内核运行权限: 正常

#===================== 插件设置 =====================#

当前配置文件: /etc/openclash/config/ACL4SSR-Sen7en-TS-Or.yaml
启动配置文件: /etc/openclash/ACL4SSR-Sen7en-TS-Or.yaml
运行模式: redir-host-tun
默认代理模式: rule
UDP流量转发(tproxy): 停用
DNS劫持: 启用
自定义DNS: 启用
IPV6代理: 停用
IPV6-DNS解析: 停用
禁用Dnsmasq缓存: 停用
自定义规则: 停用
仅允许内网: 启用
仅代理命中规则流量: 停用
仅允许常用端口流量: 停用
绕过中国大陆IP: 停用
DNS远程解析: 停用
路由本机代理: 停用

#启动异常时建议关闭此项后重试
混合节点: 停用
保留配置: 停用

#启动异常时建议关闭此项后重试
第三方规则: 停用

#===================== 配置文件 =====================#

port: 7890
socks-port: 7891
allow-lan: true
mode: rule
log-level: silent
external-controller: 0.0.0.0:9090
proxy-groups:
- name: "\U0001F680 主代理"
  type: select
  proxies:
  - "♻️ 自动选择"
  - "\U0001F680 手动切换"
  - "\U0001F1ED\U0001F1F0 香港节点"
  - "\U0001F1F9\U0001F1FC 台湾节点"
  - "\U0001F1F8\U0001F1EC 新加坡节点"
  - "\U0001F1EF\U0001F1F5 日本节点"
  - "\U0001F1FA\U0001F1F8 美国节点"
  - "\U0001F1F0\U0001F1F7 韩国节点"
  - "\U0001F1E9\U0001F1EA 德国节点"
  - "\U0001F1EC\U0001F1E7 英国节点"
  - "\U0001F1F7\U0001F1FA 俄罗斯节点"
  - "\U0001F1FA\U0001F1F3 联合国节点"
  - "\U0001F579️ 游戏UDP节点"
  - "\U0001F680 手动切换备"
  - DIRECT
- name: "\U0001F680 手动切换"
  type: select
rules:
- DST-PORT,7895,REJECT
- DST-PORT,7892,REJECT
- IP-CIDR,198.18.0.1/16,REJECT,no-resolve
redir-port: 7892
tproxy-port: 7895
mixed-port: 7893
bind-address: "*"
external-ui: "/usr/share/openclash/ui"
ipv6: false
geodata-mode: false
geodata-loader: standard
tcp-concurrent: true
dns:
  enable: true
  ipv6: false
  enhanced-mode: redir-host
  listen: 0.0.0.0:7874
  nameserver:
  - 114.114.114.114
  - 119.29.29.29
  - https://doh.pub/dns-query
  - https://dns.alidns.com/dns-query
  fallback:
  - https://dns.cloudflare.com/dns-query
  - https://public.dns.iij.jp/dns-query
  - https://jp.tiar.app/dns-query
  - https://jp.tiarap.org/dns-query
  - tls://dot.tiar.app
  default-nameserver:
  - 114.114.114.114
  - 119.29.29.29
tun:
  enable: true
  stack: system
  device: utun
  auto-route: false
  auto-detect-interface: false
  dns-hijack:
  - tcp://any:53
profile:
  store-selected: true
  store-fake-ip: true

#===================== 防火墙设置 =====================#
有上传限制，后面内容无法上传

Expected Behavior

不出现这样的情况

Screenshots

image 确认上图中114.x.x.67的IP地址是我WAN口的IP，DNS解析没有错误。

Se7enMuting commented 2 years ago 
#===================== 防火墙设置 =====================#

#IPv4 NAT chain

# Generated by iptables-save v1.8.7 on Sat Aug  6 14:25:21 2022
*nat
:PREROUTING ACCEPT [8518:1010912]
:INPUT ACCEPT [5417:818898]
:OUTPUT ACCEPT [2855:165254]
:POSTROUTING ACCEPT [2900:186311]
:MINIUPNPD - [0:0]
:MINIUPNPD-POSTROUTING - [0:0]
:postrouting_lan_rule - [0:0]
:postrouting_rule - [0:0]
:postrouting_wan_rule - [0:0]
:prerouting_lan_rule - [0:0]
:prerouting_rule - [0:0]
:prerouting_wan_rule - [0:0]
:zone_lan_postrouting - [0:0]
:zone_lan_prerouting - [0:0]
:zone_wan_postrouting - [0:0]
:zone_wan_prerouting - [0:0]
-A PREROUTING -p tcp -m comment --comment "OpenClash TCP DNS Hijack" -m tcp --dport 53 -j ACCEPT
-A PREROUTING -p tcp -m tcp --dport 53 -m comment --comment "OpenClash DNS Hijack" -j REDIRECT --to-ports 53
-A PREROUTING -p udp -m udp --dport 53 -m comment --comment "OpenClash DNS Hijack" -j REDIRECT --to-ports 53
-A PREROUTING -m comment --comment "!fw3: Custom prerouting rule chain" -j prerouting_rule
-A PREROUTING -i br-lan -m comment --comment "!fw3" -j zone_lan_prerouting
-A PREROUTING -i pppoe-wan -m comment --comment "!fw3" -j zone_wan_prerouting
-A POSTROUTING -m comment --comment "!fw3: Custom postrouting rule chain" -j postrouting_rule
-A POSTROUTING -o br-lan -m comment --comment "!fw3" -j zone_lan_postrouting
-A POSTROUTING -o pppoe-wan -m comment --comment "!fw3" -j zone_wan_postrouting
-A MINIUPNPD -p udp -m udp --dport 46655 -j DNAT --to-destination 192.168.1.137:46655
-A MINIUPNPD -p udp -m udp --dport 36504 -j DNAT --to-destination 192.168.1.134:36504
-A zone_lan_postrouting -m comment --comment "!fw3: Custom lan postrouting rule chain" -j postrouting_lan_rule
-A zone_lan_postrouting -s 192.168.1.0/24 -d 192.168.1.3/32 -p tcp -m tcp --dport 5001 -m comment --comment "!fw3: Forward5001 (reflection)" -j SNAT --to-source 192.168.1.1
-A zone_lan_postrouting -s 192.168.1.0/24 -d 192.168.1.3/32 -p udp -m udp --dport 5001 -m comment --comment "!fw3: Forward5001 (reflection)" -j SNAT --to-source 192.168.1.1
-A zone_lan_postrouting -s 192.168.1.0/24 -d 192.168.1.3/32 -p tcp -m tcp --dport 5000 -m comment --comment "!fw3: Forward5000 (reflection)" -j SNAT --to-source 192.168.1.1
-A zone_lan_postrouting -s 192.168.1.0/24 -d 192.168.1.3/32 -p udp -m udp --dport 5000 -m comment --comment "!fw3: Forward5000 (reflection)" -j SNAT --to-source 192.168.1.1
-A zone_lan_postrouting -s 192.168.1.0/24 -d 192.168.1.3/32 -p tcp -m tcp --dport 8011 -m comment --comment "!fw3: Forward8011 (reflection)" -j SNAT --to-source 192.168.1.1
-A zone_lan_postrouting -s 192.168.1.0/24 -d 192.168.1.3/32 -p udp -m udp --dport 8011 -m comment --comment "!fw3: Forward8011 (reflection)" -j SNAT --to-source 192.168.1.1
-A zone_lan_postrouting -s 192.168.1.0/24 -d 192.168.1.3/32 -p tcp -m tcp --dport 9090 -m comment --comment "!fw3: Forward9090 (reflection)" -j SNAT --to-source 192.168.1.1
-A zone_lan_postrouting -s 192.168.1.0/24 -d 192.168.1.3/32 -p udp -m udp --dport 9090 -m comment --comment "!fw3: Forward9090 (reflection)" -j SNAT --to-source 192.168.1.1
-A zone_lan_postrouting -s 192.168.1.0/24 -d 192.168.1.3/32 -p tcp -m tcp --dport 9091 -m comment --comment "!fw3: Forward9091 (reflection)" -j SNAT --to-source 192.168.1.1
-A zone_lan_postrouting -s 192.168.1.0/24 -d 192.168.1.3/32 -p udp -m udp --dport 9091 -m comment --comment "!fw3: Forward9091 (reflection)" -j SNAT --to-source 192.168.1.1
-A zone_lan_postrouting -s 192.168.1.0/24 -d 192.168.1.3/32 -p tcp -m tcp --dport 51413 -m comment --comment "!fw3: Forward51413 (reflection)" -j SNAT --to-source 192.168.1.1
-A zone_lan_postrouting -s 192.168.1.0/24 -d 192.168.1.3/32 -p udp -m udp --dport 51413 -m comment --comment "!fw3: Forward51413 (reflection)" -j SNAT --to-source 192.168.1.1
-A zone_lan_postrouting -s 192.168.1.0/24 -d 192.168.1.3/32 -p tcp -m tcp --dport 8112 -m comment --comment "!fw3: Forward8112 (reflection)" -j SNAT --to-source 192.168.1.1
-A zone_lan_postrouting -s 192.168.1.0/24 -d 192.168.1.3/32 -p udp -m udp --dport 8112 -m comment --comment "!fw3: Forward8112 (reflection)" -j SNAT --to-source 192.168.1.1
-A zone_lan_postrouting -s 192.168.1.0/24 -d 192.168.1.3/32 -p tcp -m tcp --dport 52236 -m comment --comment "!fw3: Forward52236 (reflection)" -j SNAT --to-source 192.168.1.1
-A zone_lan_postrouting -s 192.168.1.0/24 -d 192.168.1.3/32 -p udp -m udp --dport 52236 -m comment --comment "!fw3: Forward52236 (reflection)" -j SNAT --to-source 192.168.1.1
-A zone_lan_postrouting -s 192.168.1.0/24 -d 192.168.1.3/32 -p tcp -m tcp --dport 6690 -m comment --comment "!fw3: Drive (reflection)" -j SNAT --to-source 192.168.1.1
-A zone_lan_postrouting -s 192.168.1.0/24 -d 192.168.1.3/32 -p udp -m udp --dport 6690 -m comment --comment "!fw3: Drive (reflection)" -j SNAT --to-source 192.168.1.1
-A zone_lan_postrouting -s 192.168.1.0/24 -d 192.168.1.3/32 -p tcp -m tcp --dport 10003 -m comment --comment "!fw3: Forward10003 (reflection)" -j SNAT --to-source 192.168.1.1
-A zone_lan_postrouting -s 192.168.1.0/24 -d 192.168.1.3/32 -p udp -m udp --dport 10003 -m comment --comment "!fw3: Forward10003 (reflection)" -j SNAT --to-source 192.168.1.1
-A zone_lan_postrouting -s 192.168.1.0/24 -d 192.168.1.3/32 -p tcp -m tcp --dport 16811 -m comment --comment "!fw3: Forward16881 (reflection)" -j SNAT --to-source 192.168.1.1
-A zone_lan_postrouting -s 192.168.1.0/24 -d 192.168.1.3/32 -p udp -m udp --dport 16811 -m comment --comment "!fw3: Forward16881 (reflection)" -j SNAT --to-source 192.168.1.1
-A zone_lan_postrouting -s 192.168.1.0/24 -d 192.168.1.3/32 -p tcp -m tcp --dport 32400 -m comment --comment "!fw3: Forward32401 (reflection)" -j SNAT --to-source 192.168.1.1
-A zone_lan_postrouting -s 192.168.1.0/24 -d 192.168.1.3/32 -p udp -m udp --dport 32400 -m comment --comment "!fw3: Forward32401 (reflection)" -j SNAT --to-source 192.168.1.1
-A zone_lan_postrouting -s 192.168.1.0/24 -d 192.168.1.3/32 -p tcp -m tcp --dport 7001 -m comment --comment "!fw3: Forward7001 (reflection)" -j SNAT --to-source 192.168.1.1
-A zone_lan_postrouting -s 192.168.1.0/24 -d 192.168.1.3/32 -p udp -m udp --dport 7001 -m comment --comment "!fw3: Forward7001 (reflection)" -j SNAT --to-source 192.168.1.1
-A zone_lan_postrouting -s 192.168.1.0/24 -d 192.168.1.3/32 -p tcp -m tcp --dport 9008 -m comment --comment "!fw3: Forward9008 (reflection)" -j SNAT --to-source 192.168.1.1
-A zone_lan_postrouting -s 192.168.1.0/24 -d 192.168.1.3/32 -p udp -m udp --dport 9008 -m comment --comment "!fw3: Forward9008 (reflection)" -j SNAT --to-source 192.168.1.1
-A zone_lan_postrouting -s 192.168.1.0/24 -d 192.168.1.3/32 -p tcp -m tcp --dport 52147 -m comment --comment "!fw3: Forward (reflection)" -j SNAT --to-source 192.168.1.1
-A zone_lan_postrouting -s 192.168.1.0/24 -d 192.168.1.3/32 -p udp -m udp --dport 52147 -m comment --comment "!fw3: Forward (reflection)" -j SNAT --to-source 192.168.1.1
-A zone_lan_postrouting -s 192.168.1.0/24 -d 192.168.1.3/32 -p tcp -m tcp --dport 8089 -m comment --comment "!fw3: Forward8089 (reflection)" -j SNAT --to-source 192.168.1.1
-A zone_lan_postrouting -s 192.168.1.0/24 -d 192.168.1.3/32 -p udp -m udp --dport 8089 -m comment --comment "!fw3: Forward8089 (reflection)" -j SNAT --to-source 192.168.1.1
-A zone_lan_postrouting -s 192.168.1.0/24 -d 192.168.1.250/32 -p tcp -m tcp --dport 8006 -m comment --comment "!fw3: PVE (reflection)" -j SNAT --to-source 192.168.1.1
-A zone_lan_postrouting -s 192.168.1.0/24 -d 192.168.1.250/32 -p udp -m udp --dport 8006 -m comment --comment "!fw3: PVE (reflection)" -j SNAT --to-source 192.168.1.1
-A zone_lan_postrouting -s 192.168.1.0/24 -d 192.168.1.3/32 -p tcp -m tcp --dport 4244 -m comment --comment "!fw3: Forward4244 (reflection)" -j SNAT --to-source 192.168.1.1
-A zone_lan_postrouting -s 192.168.1.0/24 -d 192.168.1.3/32 -p udp -m udp --dport 4244 -m comment --comment "!fw3: Forward4244 (reflection)" -j SNAT --to-source 192.168.1.1
-A zone_lan_postrouting -s 192.168.1.0/24 -d 192.168.1.3/32 -p tcp -m tcp --dport 5006 -m comment --comment "!fw3: Forward5006 (reflection)" -j SNAT --to-source 192.168.1.1
-A zone_lan_postrouting -s 192.168.1.0/24 -d 192.168.1.3/32 -p udp -m udp --dport 5006 -m comment --comment "!fw3: Forward5006 (reflection)" -j SNAT --to-source 192.168.1.1
-A zone_lan_postrouting -s 192.168.1.0/24 -d 192.168.1.3/32 -p tcp -m tcp --dport 20:21 -m comment --comment "!fw3: Forward20-21 (reflection)" -j SNAT --to-source 192.168.1.1
-A zone_lan_postrouting -s 192.168.1.0/24 -d 192.168.1.3/32 -p udp -m udp --dport 20:21 -m comment --comment "!fw3: Forward20-21 (reflection)" -j SNAT --to-source 192.168.1.1
-A zone_lan_postrouting -s 192.168.1.0/24 -d 192.168.1.3/32 -p tcp -m tcp --dport 55536:55599 -m comment --comment "!fw3: Forward55536-55599 (reflection)" -j SNAT --to-source 192.168.1.1
-A zone_lan_postrouting -s 192.168.1.0/24 -d 192.168.1.3/32 -p udp -m udp --dport 55536:55599 -m comment --comment "!fw3: Forward55536-55599 (reflection)" -j SNAT --to-source 192.168.1.1
-A zone_lan_postrouting -s 192.168.1.0/24 -d 192.168.1.3/32 -p tcp -m tcp --dport 8085 -m comment --comment "!fw3: Forward8085 (reflection)" -j SNAT --to-source 192.168.1.1
-A zone_lan_postrouting -s 192.168.1.0/24 -d 192.168.1.3/32 -p udp -m udp --dport 8085 -m comment --comment "!fw3: Forward8085 (reflection)" -j SNAT --to-source 192.168.1.1
-A zone_lan_postrouting -s 192.168.1.0/24 -d 192.168.1.3/32 -p tcp -m tcp --dport 6880 -m comment --comment "!fw3: Forward6880 (reflection)" -j SNAT --to-source 192.168.1.1
-A zone_lan_postrouting -s 192.168.1.0/24 -d 192.168.1.3/32 -p udp -m udp --dport 6880 -m comment --comment "!fw3: Forward6880 (reflection)" -j SNAT --to-source 192.168.1.1
-A zone_lan_postrouting -s 192.168.1.0/24 -d 192.168.1.3/32 -p tcp -m tcp --dport 9101 -m comment --comment "!fw3: Forward (reflection)" -j SNAT --to-source 192.168.1.1
-A zone_lan_postrouting -s 192.168.1.0/24 -d 192.168.1.3/32 -p udp -m udp --dport 9101 -m comment --comment "!fw3: Forward (reflection)" -j SNAT --to-source 192.168.1.1
-A zone_lan_postrouting -s 192.168.1.0/24 -d 192.168.1.3/32 -p tcp -m tcp --dport 33396 -m comment --comment "!fw3: Forward33396 (reflection)" -j SNAT --to-source 192.168.1.1
-A zone_lan_postrouting -s 192.168.1.0/24 -d 192.168.1.3/32 -p udp -m udp --dport 33396 -m comment --comment "!fw3: Forward33396 (reflection)" -j SNAT --to-source 192.168.1.1
-A zone_lan_postrouting -s 192.168.1.0/24 -d 192.168.1.1/32 -p tcp -m tcp --dport 443 -m comment --comment "!fw3: Openwrt-https (reflection)" -j SNAT --to-source 192.168.1.1
-A zone_lan_postrouting -s 192.168.1.0/24 -d 192.168.1.1/32 -p udp -m udp --dport 443 -m comment --comment "!fw3: Openwrt-https (reflection)" -j SNAT --to-source 192.168.1.1
-A zone_lan_postrouting -s 192.168.1.0/24 -d 192.168.1.230/32 -p tcp -m tcp --dport 4343 -m comment --comment "!fw3: Aruba (reflection)" -j SNAT --to-source 192.168.1.1
-A zone_lan_postrouting -s 192.168.1.0/24 -d 192.168.1.230/32 -p udp -m udp --dport 4343 -m comment --comment "!fw3: Aruba (reflection)" -j SNAT --to-source 192.168.1.1
-A zone_lan_postrouting -s 192.168.1.0/24 -d 192.168.1.172/32 -p tcp -m tcp --dport 8920 -m comment --comment "!fw3: Emby https (reflection)" -j SNAT --to-source 192.168.1.1
-A zone_lan_postrouting -s 192.168.1.0/24 -d 192.168.1.172/32 -p udp -m udp --dport 8920 -m comment --comment "!fw3: Emby https (reflection)" -j SNAT --to-source 192.168.1.1
-A zone_lan_postrouting -s 192.168.1.0/24 -d 192.168.1.172/32 -p tcp -m tcp --dport 8096 -m comment --comment "!fw3: Emby http (reflection)" -j SNAT --to-source 192.168.1.1
-A zone_lan_postrouting -s 192.168.1.0/24 -d 192.168.1.172/32 -p udp -m udp --dport 8096 -m comment --comment "!fw3: Emby http (reflection)" -j SNAT --to-source 192.168.1.1
-A zone_lan_postrouting -s 192.168.1.0/24 -d 192.168.1.172/32 -p tcp -m tcp --dport 32400 -m comment --comment "!fw3: Plex (reflection)" -j SNAT --to-source 192.168.1.1
-A zone_lan_postrouting -s 192.168.1.0/24 -d 192.168.1.172/32 -p udp -m udp --dport 32400 -m comment --comment "!fw3: Plex (reflection)" -j SNAT --to-source 192.168.1.1
-A zone_lan_postrouting -s 192.168.1.0/24 -d 192.168.1.172/32 -p tcp -m tcp --dport 9000 -m comment --comment "!fw3: Docker-Portainer (reflection)" -j SNAT --to-source 192.168.1.1
-A zone_lan_postrouting -s 192.168.1.0/24 -d 192.168.1.172/32 -p udp -m udp --dport 9000 -m comment --comment "!fw3: Docker-Portainer (reflection)" -j SNAT --to-source 192.168.1.1
-A zone_lan_postrouting -s 192.168.1.0/24 -d 192.168.1.172/32 -p tcp -m tcp --dport 34401 -m comment --comment "!fw3: xTeve (reflection)" -j SNAT --to-source 192.168.1.1
-A zone_lan_postrouting -s 192.168.1.0/24 -d 192.168.1.172/32 -p udp -m udp --dport 34401 -m comment --comment "!fw3: xTeve (reflection)" -j SNAT --to-source 192.168.1.1
-A zone_lan_postrouting -s 192.168.1.0/24 -d 192.168.1.172/32 -p tcp -m tcp --dport 9877 -m comment --comment "!fw3: DDNS-GO (reflection)" -j SNAT --to-source 192.168.1.1
-A zone_lan_postrouting -s 192.168.1.0/24 -d 192.168.1.172/32 -p udp -m udp --dport 9877 -m comment --comment "!fw3: DDNS-GO (reflection)" -j SNAT --to-source 192.168.1.1
-A zone_lan_postrouting -s 192.168.1.0/24 -d 192.168.1.3/32 -p tcp -m tcp --dport 60654 -m comment --comment "!fw3: Forward60654 (reflection)" -j SNAT --to-source 192.168.1.1
-A zone_lan_postrouting -s 192.168.1.0/24 -d 192.168.1.3/32 -p udp -m udp --dport 60654 -m comment --comment "!fw3: Forward60654 (reflection)" -j SNAT --to-source 192.168.1.1
-A zone_lan_postrouting -s 192.168.1.0/24 -d 192.168.1.3/32 -p tcp -m tcp --dport 51423 -m comment --comment "!fw3: Forward51423 (reflection)" -j SNAT --to-source 192.168.1.1
-A zone_lan_postrouting -s 192.168.1.0/24 -d 192.168.1.3/32 -p udp -m udp --dport 51423 -m comment --comment "!fw3: Forward51423 (reflection)" -j SNAT --to-source 192.168.1.1
-A zone_lan_postrouting -s 192.168.1.0/24 -d 192.168.1.3/32 -p tcp -m tcp --dport 33496 -m comment --comment "!fw3: Forward33496 (reflection)" -j SNAT --to-source 192.168.1.1
-A zone_lan_postrouting -s 192.168.1.0/24 -d 192.168.1.3/32 -p udp -m udp --dport 33496 -m comment --comment "!fw3: Forward33496 (reflection)" -j SNAT --to-source 192.168.1.1
-A zone_lan_postrouting -s 192.168.1.0/24 -d 192.168.1.3/32 -p tcp -m tcp --dport 9010 -m comment --comment "!fw3: NAS-Portainer-ce (reflection)" -j SNAT --to-source 192.168.1.1
-A zone_lan_postrouting -s 192.168.1.0/24 -d 192.168.1.3/32 -p udp -m udp --dport 9010 -m comment --comment "!fw3: NAS-Portainer-ce (reflection)" -j SNAT --to-source 192.168.1.1
-A zone_lan_postrouting -s 192.168.1.0/24 -d 192.168.1.172/32 -p tcp -m tcp --dport 7082 -m comment --comment "!fw3: Debian-bitwarden (reflection)" -j SNAT --to-source 192.168.1.1
-A zone_lan_postrouting -s 192.168.1.0/24 -d 192.168.1.172/32 -p udp -m udp --dport 7082 -m comment --comment "!fw3: Debian-bitwarden (reflection)" -j SNAT --to-source 192.168.1.1
-A zone_lan_postrouting -s 192.168.1.0/24 -d 192.168.1.172/32 -p tcp -m tcp --dport 5778 -m comment --comment "!fw3: 青龙 (reflection)" -j SNAT --to-source 192.168.1.1
-A zone_lan_postrouting -s 192.168.1.0/24 -d 192.168.1.172/32 -p udp -m udp --dport 5778 -m comment --comment "!fw3: 青龙 (reflection)" -j SNAT --to-source 192.168.1.1
-A zone_lan_postrouting -s 192.168.1.0/24 -d 192.168.1.135/32 -p tcp -m tcp --dport 3389 -m comment --comment "!fw3: I7 7700K Remote (reflection)" -j SNAT --to-source 192.168.1.1
-A zone_lan_postrouting -s 192.168.1.0/24 -d 192.168.1.135/32 -p udp -m udp --dport 3389 -m comment --comment "!fw3: I7 7700K Remote (reflection)" -j SNAT --to-source 192.168.1.1
-A zone_lan_postrouting -s 192.168.1.0/24 -d 192.168.1.172/32 -p tcp -m tcp --dport 5768 -m comment --comment "!fw3: 青龙2 (reflection)" -j SNAT --to-source 192.168.1.1
-A zone_lan_postrouting -s 192.168.1.0/24 -d 192.168.1.172/32 -p udp -m udp --dport 5768 -m comment --comment "!fw3: 青龙2 (reflection)" -j SNAT --to-source 192.168.1.1
-A zone_lan_postrouting -s 192.168.1.0/24 -d 192.168.1.172/32 -p tcp -m tcp --dport 8200 -m comment --comment "!fw3: elecV2P (reflection)" -j SNAT --to-source 192.168.1.1
-A zone_lan_postrouting -s 192.168.1.0/24 -d 192.168.1.172/32 -p udp -m udp --dport 8200 -m comment --comment "!fw3: elecV2P (reflection)" -j SNAT --to-source 192.168.1.1
-A zone_lan_postrouting -s 192.168.1.0/24 -d 192.168.1.136/32 -p tcp -m tcp --dport 3389 -m comment --comment "!fw3: R7 4700U Remote (reflection)" -j SNAT --to-source 192.168.1.1
-A zone_lan_postrouting -s 192.168.1.0/24 -d 192.168.1.136/32 -p udp -m udp --dport 3389 -m comment --comment "!fw3: R7 4700U Remote (reflection)" -j SNAT --to-source 192.168.1.1
-A zone_lan_postrouting -s 192.168.1.0/24 -d 192.168.1.172/32 -p tcp -m tcp --dport 18378 -m comment --comment "!fw3: Forward18378 (reflection)" -j SNAT --to-source 192.168.1.1
-A zone_lan_postrouting -s 192.168.1.0/24 -d 192.168.1.172/32 -p udp -m udp --dport 18378 -m comment --comment "!fw3: Forward18378 (reflection)" -j SNAT --to-source 192.168.1.1
-A zone_lan_postrouting -s 192.168.1.0/24 -d 192.168.1.172/32 -p tcp -m tcp --dport 17070 -m comment --comment "!fw3: Forward17070 (reflection)" -j SNAT --to-source 192.168.1.1
-A zone_lan_postrouting -s 192.168.1.0/24 -d 192.168.1.172/32 -p udp -m udp --dport 17070 -m comment --comment "!fw3: Forward17070 (reflection)" -j SNAT --to-source 192.168.1.1
-A zone_lan_postrouting -s 192.168.1.0/24 -d 192.168.1.172/32 -p tcp -m tcp --dport 17501 -m comment --comment "!fw3: Forward17500 (reflection)" -j SNAT --to-source 192.168.1.1
-A zone_lan_postrouting -s 192.168.1.0/24 -d 192.168.1.172/32 -p udp -m udp --dport 17501 -m comment --comment "!fw3: Forward17500 (reflection)" -j SNAT --to-source 192.168.1.1
-A zone_lan_postrouting -s 192.168.1.0/24 -d 192.168.1.172/32 -p tcp -m tcp --dport 17071:17081 -m comment --comment "!fw3: Forward17071 (reflection)" -j SNAT --to-source 192.168.1.1
-A zone_lan_postrouting -s 192.168.1.0/24 -d 192.168.1.172/32 -p udp -m udp --dport 17071:17081 -m comment --comment "!fw3: Forward17071 (reflection)" -j SNAT --to-source 192.168.1.1
-A zone_lan_postrouting -s 192.168.1.0/24 -d 192.168.1.1/32 -p tcp -m tcp --dport 1688 -m comment --comment "!fw3: KMS (reflection)" -j SNAT --to-source 192.168.1.1
-A zone_lan_postrouting -s 192.168.1.0/24 -d 192.168.1.1/32 -p udp -m udp --dport 1688 -m comment --comment "!fw3: KMS (reflection)" -j SNAT --to-source 192.168.1.1
-A zone_lan_prerouting -m comment --comment "!fw3: Custom lan prerouting rule chain" -j prerouting_lan_rule
-A zone_lan_prerouting -s 192.168.1.0/24 -d *WAN IP*/32 -p tcp -m tcp --dport 5001 -m comment --comment "!fw3: Forward5001 (reflection)" -j DNAT --to-destination 192.168.1.3:5001
-A zone_lan_prerouting -s 192.168.1.0/24 -d *WAN IP*/32 -p udp -m udp --dport 5001 -m comment --comment "!fw3: Forward5001 (reflection)" -j DNAT --to-destination 192.168.1.3:5001
-A zone_lan_prerouting -s 192.168.1.0/24 -d *WAN IP*/32 -p tcp -m tcp --dport 5000 -m comment --comment "!fw3: Forward5000 (reflection)" -j DNAT --to-destination 192.168.1.3:5000
-A zone_lan_prerouting -s 192.168.1.0/24 -d *WAN IP*/32 -p udp -m udp --dport 5000 -m comment --comment "!fw3: Forward5000 (reflection)" -j DNAT --to-destination 192.168.1.3:5000
-A zone_lan_prerouting -s 192.168.1.0/24 -d *WAN IP*/32 -p tcp -m tcp --dport 8011 -m comment --comment "!fw3: Forward8011 (reflection)" -j DNAT --to-destination 192.168.1.3:8011
-A zone_lan_prerouting -s 192.168.1.0/24 -d *WAN IP*/32 -p udp -m udp --dport 8011 -m comment --comment "!fw3: Forward8011 (reflection)" -j DNAT --to-destination 192.168.1.3:8011
-A zone_lan_prerouting -s 192.168.1.0/24 -d *WAN IP*/32 -p tcp -m tcp --dport 9090 -m comment --comment "!fw3: Forward9090 (reflection)" -j DNAT --to-destination 192.168.1.3:9090
-A zone_lan_prerouting -s 192.168.1.0/24 -d *WAN IP*/32 -p udp -m udp --dport 9090 -m comment --comment "!fw3: Forward9090 (reflection)" -j DNAT --to-destination 192.168.1.3:9090
-A zone_lan_prerouting -s 192.168.1.0/24 -d *WAN IP*/32 -p tcp -m tcp --dport 9091 -m comment --comment "!fw3: Forward9091 (reflection)" -j DNAT --to-destination 192.168.1.3:9091
-A zone_lan_prerouting -s 192.168.1.0/24 -d *WAN IP*/32 -p udp -m udp --dport 9091 -m comment --comment "!fw3: Forward9091 (reflection)" -j DNAT --to-destination 192.168.1.3:9091
-A zone_lan_prerouting -s 192.168.1.0/24 -d *WAN IP*/32 -p tcp -m tcp --dport 51413 -m comment --comment "!fw3: Forward51413 (reflection)" -j DNAT --to-destination 192.168.1.3:51413
-A zone_lan_prerouting -s 192.168.1.0/24 -d *WAN IP*/32 -p udp -m udp --dport 51413 -m comment --comment "!fw3: Forward51413 (reflection)" -j DNAT --to-destination 192.168.1.3:51413
-A zone_lan_prerouting -s 192.168.1.0/24 -d *WAN IP*/32 -p tcp -m tcp --dport 8112 -m comment --comment "!fw3: Forward8112 (reflection)" -j DNAT --to-destination 192.168.1.3:8112
-A zone_lan_prerouting -s 192.168.1.0/24 -d *WAN IP*/32 -p udp -m udp --dport 8112 -m comment --comment "!fw3: Forward8112 (reflection)" -j DNAT --to-destination 192.168.1.3:8112
-A zone_lan_prerouting -s 192.168.1.0/24 -d *WAN IP*/32 -p tcp -m tcp --dport 52236 -m comment --comment "!fw3: Forward52236 (reflection)" -j DNAT --to-destination 192.168.1.3:52236
-A zone_lan_prerouting -s 192.168.1.0/24 -d *WAN IP*/32 -p udp -m udp --dport 52236 -m comment --comment "!fw3: Forward52236 (reflection)" -j DNAT --to-destination 192.168.1.3:52236
-A zone_lan_prerouting -s 192.168.1.0/24 -d *WAN IP*/32 -p tcp -m tcp --dport 6690 -m comment --comment "!fw3: Drive (reflection)" -j DNAT --to-destination 192.168.1.3:6690
-A zone_lan_prerouting -s 192.168.1.0/24 -d *WAN IP*/32 -p udp -m udp --dport 6690 -m comment --comment "!fw3: Drive (reflection)" -j DNAT --to-destination 192.168.1.3:6690
-A zone_lan_prerouting -s 192.168.1.0/24 -d *WAN IP*/32 -p tcp -m tcp --dport 10003 -m comment --comment "!fw3: Forward10003 (reflection)" -j DNAT --to-destination 192.168.1.3:10003
-A zone_lan_prerouting -s 192.168.1.0/24 -d *WAN IP*/32 -p udp -m udp --dport 10003 -m comment --comment "!fw3: Forward10003 (reflection)" -j DNAT --to-destination 192.168.1.3:10003
-A zone_lan_prerouting -s 192.168.1.0/24 -d *WAN IP*/32 -p tcp -m tcp --dport 16881 -m comment --comment "!fw3: Forward16881 (reflection)" -j DNAT --to-destination 192.168.1.3:16811
-A zone_lan_prerouting -s 192.168.1.0/24 -d *WAN IP*/32 -p udp -m udp --dport 16881 -m comment --comment "!fw3: Forward16881 (reflection)" -j DNAT --to-destination 192.168.1.3:16811
-A zone_lan_prerouting -s 192.168.1.0/24 -d *WAN IP*/32 -p tcp -m tcp --dport 32401 -m comment --comment "!fw3: Forward32401 (reflection)" -j DNAT --to-destination 192.168.1.3:32400
-A zone_lan_prerouting -s 192.168.1.0/24 -d *WAN IP*/32 -p udp -m udp --dport 32401 -m comment --comment "!fw3: Forward32401 (reflection)" -j DNAT --to-destination 192.168.1.3:32400
-A zone_lan_prerouting -s 192.168.1.0/24 -d *WAN IP*/32 -p tcp -m tcp --dport 7001 -m comment --comment "!fw3: Forward7001 (reflection)" -j DNAT --to-destination 192.168.1.3:7001
-A zone_lan_prerouting -s 192.168.1.0/24 -d *WAN IP*/32 -p udp -m udp --dport 7001 -m comment --comment "!fw3: Forward7001 (reflection)" -j DNAT --to-destination 192.168.1.3:7001
-A zone_lan_prerouting -s 192.168.1.0/24 -d *WAN IP*/32 -p tcp -m tcp --dport 9008 -m comment --comment "!fw3: Forward9008 (reflection)" -j DNAT --to-destination 192.168.1.3:9008
-A zone_lan_prerouting -s 192.168.1.0/24 -d *WAN IP*/32 -p udp -m udp --dport 9008 -m comment --comment "!fw3: Forward9008 (reflection)" -j DNAT --to-destination 192.168.1.3:9008
-A zone_lan_prerouting -s 192.168.1.0/24 -d *WAN IP*/32 -p tcp -m tcp --dport 52147 -m comment --comment "!fw3: Forward (reflection)" -j DNAT --to-destination 192.168.1.3:52147
-A zone_lan_prerouting -s 192.168.1.0/24 -d *WAN IP*/32 -p udp -m udp --dport 52147 -m comment --comment "!fw3: Forward (reflection)" -j DNAT --to-destination 192.168.1.3:52147
-A zone_lan_prerouting -s 192.168.1.0/24 -d *WAN IP*/32 -p tcp -m tcp --dport 8089 -m comment --comment "!fw3: Forward8089 (reflection)" -j DNAT --to-destination 192.168.1.3:8089
-A zone_lan_prerouting -s 192.168.1.0/24 -d *WAN IP*/32 -p udp -m udp --dport 8089 -m comment --comment "!fw3: Forward8089 (reflection)" -j DNAT --to-destination 192.168.1.3:8089
-A zone_lan_prerouting -s 192.168.1.0/24 -d *WAN IP*/32 -p tcp -m tcp --dport 8006 -m comment --comment "!fw3: PVE (reflection)" -j DNAT --to-destination 192.168.1.250:8006
-A zone_lan_prerouting -s 192.168.1.0/24 -d *WAN IP*/32 -p udp -m udp --dport 8006 -m comment --comment "!fw3: PVE (reflection)" -j DNAT --to-destination 192.168.1.250:8006
-A zone_lan_prerouting -s 192.168.1.0/24 -d *WAN IP*/32 -p tcp -m tcp --dport 4244 -m comment --comment "!fw3: Forward4244 (reflection)" -j DNAT --to-destination 192.168.1.3:4244
-A zone_lan_prerouting -s 192.168.1.0/24 -d *WAN IP*/32 -p udp -m udp --dport 4244 -m comment --comment "!fw3: Forward4244 (reflection)" -j DNAT --to-destination 192.168.1.3:4244
-A zone_lan_prerouting -s 192.168.1.0/24 -d *WAN IP*/32 -p tcp -m tcp --dport 5006 -m comment --comment "!fw3: Forward5006 (reflection)" -j DNAT --to-destination 192.168.1.3:5006
-A zone_lan_prerouting -s 192.168.1.0/24 -d *WAN IP*/32 -p udp -m udp --dport 5006 -m comment --comment "!fw3: Forward5006 (reflection)" -j DNAT --to-destination 192.168.1.3:5006
-A zone_lan_prerouting -s 192.168.1.0/24 -d *WAN IP*/32 -p tcp -m tcp --dport 20:21 -m comment --comment "!fw3: Forward20-21 (reflection)" -j DNAT --to-destination 192.168.1.3:20-21
-A zone_lan_prerouting -s 192.168.1.0/24 -d *WAN IP*/32 -p udp -m udp --dport 20:21 -m comment --comment "!fw3: Forward20-21 (reflection)" -j DNAT --to-destination 192.168.1.3:20-21
-A zone_lan_prerouting -s 192.168.1.0/24 -d *WAN IP*/32 -p tcp -m tcp --dport 55536:55599 -m comment --comment "!fw3: Forward55536-55599 (reflection)" -j DNAT --to-destination 192.168.1.3:55536-55599
-A zone_lan_prerouting -s 192.168.1.0/24 -d *WAN IP*/32 -p udp -m udp --dport 55536:55599 -m comment --comment "!fw3: Forward55536-55599 (reflection)" -j DNAT --to-destination 192.168.1.3:55536-55599
-A zone_lan_prerouting -s 192.168.1.0/24 -d *WAN IP*/32 -p tcp -m tcp --dport 8085 -m comment --comment "!fw3: Forward8085 (reflection)" -j DNAT --to-destination 192.168.1.3:8085
-A zone_lan_prerouting -s 192.168.1.0/24 -d *WAN IP*/32 -p udp -m udp --dport 8085 -m comment --comment "!fw3: Forward8085 (reflection)" -j DNAT --to-destination 192.168.1.3:8085
-A zone_lan_prerouting -s 192.168.1.0/24 -d *WAN IP*/32 -p tcp -m tcp --dport 6880 -m comment --comment "!fw3: Forward6880 (reflection)" -j DNAT --to-destination 192.168.1.3:6880
-A zone_lan_prerouting -s 192.168.1.0/24 -d *WAN IP*/32 -p udp -m udp --dport 6880 -m comment --comment "!fw3: Forward6880 (reflection)" -j DNAT --to-destination 192.168.1.3:6880
-A zone_lan_prerouting -s 192.168.1.0/24 -d *WAN IP*/32 -p tcp -m tcp --dport 9101 -m comment --comment "!fw3: Forward (reflection)" -j DNAT --to-destination 192.168.1.3:9101
-A zone_lan_prerouting -s 192.168.1.0/24 -d *WAN IP*/32 -p udp -m udp --dport 9101 -m comment --comment "!fw3: Forward (reflection)" -j DNAT --to-destination 192.168.1.3:9101
-A zone_lan_prerouting -s 192.168.1.0/24 -d *WAN IP*/32 -p tcp -m tcp --dport 33396 -m comment --comment "!fw3: Forward33396 (reflection)" -j DNAT --to-destination 192.168.1.3:33396
-A zone_lan_prerouting -s 192.168.1.0/24 -d *WAN IP*/32 -p udp -m udp --dport 33396 -m comment --comment "!fw3: Forward33396 (reflection)" -j DNAT --to-destination 192.168.1.3:33396
-A zone_lan_prerouting -s 192.168.1.0/24 -d *WAN IP*/32 -p tcp -m tcp --dport 7443 -m comment --comment "!fw3: Openwrt-https (reflection)" -j DNAT --to-destination 192.168.1.1:443
-A zone_lan_prerouting -s 192.168.1.0/24 -d *WAN IP*/32 -p udp -m udp --dport 7443 -m comment --comment "!fw3: Openwrt-https (reflection)" -j DNAT --to-destination 192.168.1.1:443
-A zone_lan_prerouting -s 192.168.1.0/24 -d *WAN IP*/32 -p tcp -m tcp --dport 4343 -m comment --comment "!fw3: Aruba (reflection)" -j DNAT --to-destination 192.168.1.230:4343
-A zone_lan_prerouting -s 192.168.1.0/24 -d *WAN IP*/32 -p udp -m udp --dport 4343 -m comment --comment "!fw3: Aruba (reflection)" -j DNAT --to-destination 192.168.1.230:4343
-A zone_lan_prerouting -s 192.168.1.0/24 -d *WAN IP*/32 -p tcp -m tcp --dport 8920 -m comment --comment "!fw3: Emby https (reflection)" -j DNAT --to-destination 192.168.1.172:8920
-A zone_lan_prerouting -s 192.168.1.0/24 -d *WAN IP*/32 -p udp -m udp --dport 8920 -m comment --comment "!fw3: Emby https (reflection)" -j DNAT --to-destination 192.168.1.172:8920
-A zone_lan_prerouting -s 192.168.1.0/24 -d *WAN IP*/32 -p tcp -m tcp --dport 8096 -m comment --comment "!fw3: Emby http (reflection)" -j DNAT --to-destination 192.168.1.172:8096
-A zone_lan_prerouting -s 192.168.1.0/24 -d *WAN IP*/32 -p udp -m udp --dport 8096 -m comment --comment "!fw3: Emby http (reflection)" -j DNAT --to-destination 192.168.1.172:8096
-A zone_lan_prerouting -s 192.168.1.0/24 -d *WAN IP*/32 -p tcp -m tcp --dport 42401 -m comment --comment "!fw3: Plex (reflection)" -j DNAT --to-destination 192.168.1.172:32400
-A zone_lan_prerouting -s 192.168.1.0/24 -d *WAN IP*/32 -p udp -m udp --dport 42401 -m comment --comment "!fw3: Plex (reflection)" -j DNAT --to-destination 192.168.1.172:32400
-A zone_lan_prerouting -s 192.168.1.0/24 -d *WAN IP*/32 -p tcp -m tcp --dport 9000 -m comment --comment "!fw3: Docker-Portainer (reflection)" -j DNAT --to-destination 192.168.1.172:9000
-A zone_lan_prerouting -s 192.168.1.0/24 -d *WAN IP*/32 -p udp -m udp --dport 9000 -m comment --comment "!fw3: Docker-Portainer (reflection)" -j DNAT --to-destination 192.168.1.172:9000
-A zone_lan_prerouting -s 192.168.1.0/24 -d *WAN IP*/32 -p tcp -m tcp --dport 34400 -m comment --comment "!fw3: xTeve (reflection)" -j DNAT --to-destination 192.168.1.172:34401
-A zone_lan_prerouting -s 192.168.1.0/24 -d *WAN IP*/32 -p udp -m udp --dport 34400 -m comment --comment "!fw3: xTeve (reflection)" -j DNAT --to-destination 192.168.1.172:34401
-A zone_lan_prerouting -s 192.168.1.0/24 -d *WAN IP*/32 -p tcp -m tcp --dport 9876 -m comment --comment "!fw3: DDNS-GO (reflection)" -j DNAT --to-destination 192.168.1.172:9877
-A zone_lan_prerouting -s 192.168.1.0/24 -d *WAN IP*/32 -p udp -m udp --dport 9876 -m comment --comment "!fw3: DDNS-GO (reflection)" -j DNAT --to-destination 192.168.1.172:9877
-A zone_lan_prerouting -s 192.168.1.0/24 -d *WAN IP*/32 -p tcp -m tcp --dport 60654 -m comment --comment "!fw3: Forward60654 (reflection)" -j DNAT --to-destination 192.168.1.3:60654
-A zone_lan_prerouting -s 192.168.1.0/24 -d *WAN IP*/32 -p udp -m udp --dport 60654 -m comment --comment "!fw3: Forward60654 (reflection)" -j DNAT --to-destination 192.168.1.3:60654
-A zone_lan_prerouting -s 192.168.1.0/24 -d *WAN IP*/32 -p tcp -m tcp --dport 51423 -m comment --comment "!fw3: Forward51423 (reflection)" -j DNAT --to-destination 192.168.1.3:51423
-A zone_lan_prerouting -s 192.168.1.0/24 -d *WAN IP*/32 -p udp -m udp --dport 51423 -m comment --comment "!fw3: Forward51423 (reflection)" -j DNAT --to-destination 192.168.1.3:51423
-A zone_lan_prerouting -s 192.168.1.0/24 -d *WAN IP*/32 -p tcp -m tcp --dport 33496 -m comment --comment "!fw3: Forward33496 (reflection)" -j DNAT --to-destination 192.168.1.3:33496
-A zone_lan_prerouting -s 192.168.1.0/24 -d *WAN IP*/32 -p udp -m udp --dport 33496 -m comment --comment "!fw3: Forward33496 (reflection)" -j DNAT --to-destination 192.168.1.3:33496
-A zone_lan_prerouting -s 192.168.1.0/24 -d *WAN IP*/32 -p tcp -m tcp --dport 9010 -m comment --comment "!fw3: NAS-Portainer-ce (reflection)" -j DNAT --to-destination 192.168.1.3:9010
-A zone_lan_prerouting -s 192.168.1.0/24 -d *WAN IP*/32 -p udp -m udp --dport 9010 -m comment --comment "!fw3: NAS-Portainer-ce (reflection)" -j DNAT --to-destination 192.168.1.3:9010
-A zone_lan_prerouting -s 192.168.1.0/24 -d *WAN IP*/32 -p tcp -m tcp --dport 7080 -m comment --comment "!fw3: Debian-bitwarden (reflection)" -j DNAT --to-destination 192.168.1.172:7082
-A zone_lan_prerouting -s 192.168.1.0/24 -d *WAN IP*/32 -p udp -m udp --dport 7080 -m comment --comment "!fw3: Debian-bitwarden (reflection)" -j DNAT --to-destination 192.168.1.172:7082
-A zone_lan_prerouting -s 192.168.1.0/24 -d *WAN IP*/32 -p tcp -m tcp --dport 5777 -m comment --comment "!fw3: 青龙 (reflection)" -j DNAT --to-destination 192.168.1.172:5778
-A zone_lan_prerouting -s 192.168.1.0/24 -d *WAN IP*/32 -p udp -m udp --dport 5777 -m comment --comment "!fw3: 青龙 (reflection)" -j DNAT --to-destination 192.168.1.172:5778
-A zone_lan_prerouting -s 192.168.1.0/24 -d *WAN IP*/32 -p tcp -m tcp --dport 3389 -m comment --comment "!fw3: I7 7700K Remote (reflection)" -j DNAT --to-destination 192.168.1.135:3389
-A zone_lan_prerouting -s 192.168.1.0/24 -d *WAN IP*/32 -p udp -m udp --dport 3389 -m comment --comment "!fw3: I7 7700K Remote (reflection)" -j DNAT --to-destination 192.168.1.135:3389
-A zone_lan_prerouting -s 192.168.1.0/24 -d *WAN IP*/32 -p tcp -m tcp --dport 5767 -m comment --comment "!fw3: 青龙2 (reflection)" -j DNAT --to-destination 192.168.1.172:5768
-A zone_lan_prerouting -s 192.168.1.0/24 -d *WAN IP*/32 -p udp -m udp --dport 5767 -m comment --comment "!fw3: 青龙2 (reflection)" -j DNAT --to-destination 192.168.1.172:5768
-A zone_lan_prerouting -s 192.168.1.0/24 -d *WAN IP*/32 -p tcp -m tcp --dport 8200 -m comment --comment "!fw3: elecV2P (reflection)" -j DNAT --to-destination 192.168.1.172:8200
-A zone_lan_prerouting -s 192.168.1.0/24 -d *WAN IP*/32 -p udp -m udp --dport 8200 -m comment --comment "!fw3: elecV2P (reflection)" -j DNAT --to-destination 192.168.1.172:8200
-A zone_lan_prerouting -s 192.168.1.0/24 -d *WAN IP*/32 -p tcp -m tcp --dport 3489 -m comment --comment "!fw3: R7 4700U Remote (reflection)" -j DNAT --to-destination 192.168.1.136:3389
-A zone_lan_prerouting -s 192.168.1.0/24 -d *WAN IP*/32 -p udp -m udp --dport 3489 -m comment --comment "!fw3: R7 4700U Remote (reflection)" -j DNAT --to-destination 192.168.1.136:3389
-A zone_lan_prerouting -s 192.168.1.0/24 -d *WAN IP*/32 -p tcp -m tcp --dport 18378 -m comment --comment "!fw3: Forward18378 (reflection)" -j DNAT --to-destination 192.168.1.172:18378
-A zone_lan_prerouting -s 192.168.1.0/24 -d *WAN IP*/32 -p udp -m udp --dport 18378 -m comment --comment "!fw3: Forward18378 (reflection)" -j DNAT --to-destination 192.168.1.172:18378
-A zone_lan_prerouting -s 192.168.1.0/24 -d *WAN IP*/32 -p tcp -m tcp --dport 17070 -m comment --comment "!fw3: Forward17070 (reflection)" -j DNAT --to-destination 192.168.1.172:17070
-A zone_lan_prerouting -s 192.168.1.0/24 -d *WAN IP*/32 -p udp -m udp --dport 17070 -m comment --comment "!fw3: Forward17070 (reflection)" -j DNAT --to-destination 192.168.1.172:17070
-A zone_lan_prerouting -s 192.168.1.0/24 -d *WAN IP*/32 -p tcp -m tcp --dport 17501 -m comment --comment "!fw3: Forward17500 (reflection)" -j DNAT --to-destination 192.168.1.172:17501
-A zone_lan_prerouting -s 192.168.1.0/24 -d *WAN IP*/32 -p udp -m udp --dport 17501 -m comment --comment "!fw3: Forward17500 (reflection)" -j DNAT --to-destination 192.168.1.172:17501
-A zone_lan_prerouting -s 192.168.1.0/24 -d *WAN IP*/32 -p tcp -m tcp --dport 17071:17081 -m comment --comment "!fw3: Forward17071 (reflection)" -j DNAT --to-destination 192.168.1.172:17071-17081
-A zone_lan_prerouting -s 192.168.1.0/24 -d *WAN IP*/32 -p udp -m udp --dport 17071:17081 -m comment --comment "!fw3: Forward17071 (reflection)" -j DNAT --to-destination 192.168.1.172:17071-17081
-A zone_lan_prerouting -s 192.168.1.0/24 -d *WAN IP*/32 -p tcp -m tcp --dport 1688 -m comment --comment "!fw3: KMS (reflection)" -j DNAT --to-destination 192.168.1.1:1688
-A zone_lan_prerouting -s 192.168.1.0/24 -d *WAN IP*/32 -p udp -m udp --dport 1688 -m comment --comment "!fw3: KMS (reflection)" -j DNAT --to-destination 192.168.1.1:1688
-A zone_wan_postrouting -j MINIUPNPD-POSTROUTING
-A zone_wan_postrouting -m comment --comment "!fw3: Custom wan postrouting rule chain" -j postrouting_wan_rule
-A zone_wan_postrouting -m comment --comment "!fw3" -j MASQUERADE
-A zone_wan_prerouting -j MINIUPNPD
-A zone_wan_prerouting -m comment --comment "!fw3: Custom wan prerouting rule chain" -j prerouting_wan_rule
-A zone_wan_prerouting -p tcp -m tcp --dport 5001 -m comment --comment "!fw3: Forward5001" -j DNAT --to-destination 192.168.1.3:5001
-A zone_wan_prerouting -p udp -m udp --dport 5001 -m comment --comment "!fw3: Forward5001" -j DNAT --to-destination 192.168.1.3:5001
-A zone_wan_prerouting -p tcp -m tcp --dport 5000 -m comment --comment "!fw3: Forward5000" -j DNAT --to-destination 192.168.1.3:5000
-A zone_wan_prerouting -p udp -m udp --dport 5000 -m comment --comment "!fw3: Forward5000" -j DNAT --to-destination 192.168.1.3:5000
-A zone_wan_prerouting -p tcp -m tcp --dport 8011 -m comment --comment "!fw3: Forward8011" -j DNAT --to-destination 192.168.1.3:8011
-A zone_wan_prerouting -p udp -m udp --dport 8011 -m comment --comment "!fw3: Forward8011" -j DNAT --to-destination 192.168.1.3:8011
-A zone_wan_prerouting -p tcp -m tcp --dport 9090 -m comment --comment "!fw3: Forward9090" -j DNAT --to-destination 192.168.1.3:9090
-A zone_wan_prerouting -p udp -m udp --dport 9090 -m comment --comment "!fw3: Forward9090" -j DNAT --to-destination 192.168.1.3:9090
-A zone_wan_prerouting -p tcp -m tcp --dport 9091 -m comment --comment "!fw3: Forward9091" -j DNAT --to-destination 192.168.1.3:9091
-A zone_wan_prerouting -p udp -m udp --dport 9091 -m comment --comment "!fw3: Forward9091" -j DNAT --to-destination 192.168.1.3:9091
-A zone_wan_prerouting -p tcp -m tcp --dport 51413 -m comment --comment "!fw3: Forward51413" -j DNAT --to-destination 192.168.1.3:51413
-A zone_wan_prerouting -p udp -m udp --dport 51413 -m comment --comment "!fw3: Forward51413" -j DNAT --to-destination 192.168.1.3:51413
-A zone_wan_prerouting -p tcp -m tcp --dport 8112 -m comment --comment "!fw3: Forward8112" -j DNAT --to-destination 192.168.1.3:8112
-A zone_wan_prerouting -p udp -m udp --dport 8112 -m comment --comment "!fw3: Forward8112" -j DNAT --to-destination 192.168.1.3:8112
-A zone_wan_prerouting -p tcp -m tcp --dport 52236 -m comment --comment "!fw3: Forward52236" -j DNAT --to-destination 192.168.1.3:52236
-A zone_wan_prerouting -p udp -m udp --dport 52236 -m comment --comment "!fw3: Forward52236" -j DNAT --to-destination 192.168.1.3:52236
-A zone_wan_prerouting -p tcp -m tcp --dport 6690 -m comment --comment "!fw3: Drive" -j DNAT --to-destination 192.168.1.3:6690
-A zone_wan_prerouting -p udp -m udp --dport 6690 -m comment --comment "!fw3: Drive" -j DNAT --to-destination 192.168.1.3:6690
-A zone_wan_prerouting -p tcp -m tcp --dport 10003 -m comment --comment "!fw3: Forward10003" -j DNAT --to-destination 192.168.1.3:10003
-A zone_wan_prerouting -p udp -m udp --dport 10003 -m comment --comment "!fw3: Forward10003" -j DNAT --to-destination 192.168.1.3:10003
-A zone_wan_prerouting -p tcp -m tcp --dport 16881 -m comment --comment "!fw3: Forward16881" -j DNAT --to-destination 192.168.1.3:16811
-A zone_wan_prerouting -p udp -m udp --dport 16881 -m comment --comment "!fw3: Forward16881" -j DNAT --to-destination 192.168.1.3:16811
-A zone_wan_prerouting -p tcp -m tcp --dport 32401 -m comment --comment "!fw3: Forward32401" -j DNAT --to-destination 192.168.1.3:32400
-A zone_wan_prerouting -p udp -m udp --dport 32401 -m comment --comment "!fw3: Forward32401" -j DNAT --to-destination 192.168.1.3:32400
-A zone_wan_prerouting -p tcp -m tcp --dport 7001 -m comment --comment "!fw3: Forward7001" -j DNAT --to-destination 192.168.1.3:7001
-A zone_wan_prerouting -p udp -m udp --dport 7001 -m comment --comment "!fw3: Forward7001" -j DNAT --to-destination 192.168.1.3:7001
-A zone_wan_prerouting -p tcp -m tcp --dport 9008 -m comment --comment "!fw3: Forward9008" -j DNAT --to-destination 192.168.1.3:9008
-A zone_wan_prerouting -p udp -m udp --dport 9008 -m comment --comment "!fw3: Forward9008" -j DNAT --to-destination 192.168.1.3:9008
-A zone_wan_prerouting -p tcp -m tcp --dport 52147 -m comment --comment "!fw3: Forward" -j DNAT --to-destination 192.168.1.3:52147
-A zone_wan_prerouting -p udp -m udp --dport 52147 -m comment --comment "!fw3: Forward" -j DNAT --to-destination 192.168.1.3:52147
-A zone_wan_prerouting -p tcp -m tcp --dport 8089 -m comment --comment "!fw3: Forward8089" -j DNAT --to-destination 192.168.1.3:8089
-A zone_wan_prerouting -p udp -m udp --dport 8089 -m comment --comment "!fw3: Forward8089" -j DNAT --to-destination 192.168.1.3:8089
-A zone_wan_prerouting -p tcp -m tcp --dport 8006 -m comment --comment "!fw3: PVE" -j DNAT --to-destination 192.168.1.250:8006
-A zone_wan_prerouting -p udp -m udp --dport 8006 -m comment --comment "!fw3: PVE" -j DNAT --to-destination 192.168.1.250:8006
-A zone_wan_prerouting -p tcp -m tcp --dport 4244 -m comment --comment "!fw3: Forward4244" -j DNAT --to-destination 192.168.1.3:4244
-A zone_wan_prerouting -p udp -m udp --dport 4244 -m comment --comment "!fw3: Forward4244" -j DNAT --to-destination 192.168.1.3:4244
-A zone_wan_prerouting -p tcp -m tcp --dport 5006 -m comment --comment "!fw3: Forward5006" -j DNAT --to-destination 192.168.1.3:5006
-A zone_wan_prerouting -p udp -m udp --dport 5006 -m comment --comment "!fw3: Forward5006" -j DNAT --to-destination 192.168.1.3:5006
-A zone_wan_prerouting -p tcp -m tcp --dport 20:21 -m comment --comment "!fw3: Forward20-21" -j DNAT --to-destination 192.168.1.3:20-21
-A zone_wan_prerouting -p udp -m udp --dport 20:21 -m comment --comment "!fw3: Forward20-21" -j DNAT --to-destination 192.168.1.3:20-21
-A zone_wan_prerouting -p tcp -m tcp --dport 55536:55599 -m comment --comment "!fw3: Forward55536-55599" -j DNAT --to-destination 192.168.1.3:55536-55599
-A zone_wan_prerouting -p udp -m udp --dport 55536:55599 -m comment --comment "!fw3: Forward55536-55599" -j DNAT --to-destination 192.168.1.3:55536-55599
-A zone_wan_prerouting -p tcp -m tcp --dport 8085 -m comment --comment "!fw3: Forward8085" -j DNAT --to-destination 192.168.1.3:8085
-A zone_wan_prerouting -p udp -m udp --dport 8085 -m comment --comment "!fw3: Forward8085" -j DNAT --to-destination 192.168.1.3:8085
-A zone_wan_prerouting -p tcp -m tcp --dport 6880 -m comment --comment "!fw3: Forward6880" -j DNAT --to-destination 192.168.1.3:6880
-A zone_wan_prerouting -p udp -m udp --dport 6880 -m comment --comment "!fw3: Forward6880" -j DNAT --to-destination 192.168.1.3:6880
-A zone_wan_prerouting -p tcp -m tcp --dport 9101 -m comment --comment "!fw3: Forward" -j DNAT --to-destination 192.168.1.3:9101
-A zone_wan_prerouting -p udp -m udp --dport 9101 -m comment --comment "!fw3: Forward" -j DNAT --to-destination 192.168.1.3:9101
-A zone_wan_prerouting -p tcp -m tcp --dport 33396 -m comment --comment "!fw3: Forward33396" -j DNAT --to-destination 192.168.1.3:33396
-A zone_wan_prerouting -p udp -m udp --dport 33396 -m comment --comment "!fw3: Forward33396" -j DNAT --to-destination 192.168.1.3:33396
-A zone_wan_prerouting -p tcp -m tcp --dport 7443 -m comment --comment "!fw3: Openwrt-https" -j DNAT --to-destination 192.168.1.1:443
-A zone_wan_prerouting -p udp -m udp --dport 7443 -m comment --comment "!fw3: Openwrt-https" -j DNAT --to-destination 192.168.1.1:443
-A zone_wan_prerouting -p tcp -m tcp --dport 4343 -m comment --comment "!fw3: Aruba" -j DNAT --to-destination 192.168.1.230:4343
-A zone_wan_prerouting -p udp -m udp --dport 4343 -m comment --comment "!fw3: Aruba" -j DNAT --to-destination 192.168.1.230:4343
-A zone_wan_prerouting -p tcp -m tcp --dport 8920 -m comment --comment "!fw3: Emby https" -j DNAT --to-destination 192.168.1.172:8920
-A zone_wan_prerouting -p udp -m udp --dport 8920 -m comment --comment "!fw3: Emby https" -j DNAT --to-destination 192.168.1.172:8920
-A zone_wan_prerouting -p tcp -m tcp --dport 8096 -m comment --comment "!fw3: Emby http" -j DNAT --to-destination 192.168.1.172:8096
-A zone_wan_prerouting -p udp -m udp --dport 8096 -m comment --comment "!fw3: Emby http" -j DNAT --to-destination 192.168.1.172:8096
-A zone_wan_prerouting -p tcp -m tcp --dport 42401 -m comment --comment "!fw3: Plex" -j DNAT --to-destination 192.168.1.172:32400
-A zone_wan_prerouting -p udp -m udp --dport 42401 -m comment --comment "!fw3: Plex" -j DNAT --to-destination 192.168.1.172:32400
-A zone_wan_prerouting -p tcp -m tcp --dport 9000 -m comment --comment "!fw3: Docker-Portainer" -j DNAT --to-destination 192.168.1.172:9000
-A zone_wan_prerouting -p udp -m udp --dport 9000 -m comment --comment "!fw3: Docker-Portainer" -j DNAT --to-destination 192.168.1.172:9000
-A zone_wan_prerouting -p tcp -m tcp --dport 34400 -m comment --comment "!fw3: xTeve" -j DNAT --to-destination 192.168.1.172:34401
-A zone_wan_prerouting -p udp -m udp --dport 34400 -m comment --comment "!fw3: xTeve" -j DNAT --to-destination 192.168.1.172:34401
-A zone_wan_prerouting -p tcp -m tcp --dport 9876 -m comment --comment "!fw3: DDNS-GO" -j DNAT --to-destination 192.168.1.172:9877
-A zone_wan_prerouting -p udp -m udp --dport 9876 -m comment --comment "!fw3: DDNS-GO" -j DNAT --to-destination 192.168.1.172:9877
-A zone_wan_prerouting -p tcp -m tcp --dport 60654 -m comment --comment "!fw3: Forward60654" -j DNAT --to-destination 192.168.1.3:60654
-A zone_wan_prerouting -p udp -m udp --dport 60654 -m comment --comment "!fw3: Forward60654" -j DNAT --to-destination 192.168.1.3:60654
-A zone_wan_prerouting -p tcp -m tcp --dport 51423 -m comment --comment "!fw3: Forward51423" -j DNAT --to-destination 192.168.1.3:51423
-A zone_wan_prerouting -p udp -m udp --dport 51423 -m comment --comment "!fw3: Forward51423" -j DNAT --to-destination 192.168.1.3:51423
-A zone_wan_prerouting -p tcp -m tcp --dport 33496 -m comment --comment "!fw3: Forward33496" -j DNAT --to-destination 192.168.1.3:33496
-A zone_wan_prerouting -p udp -m udp --dport 33496 -m comment --comment "!fw3: Forward33496" -j DNAT --to-destination 192.168.1.3:33496
-A zone_wan_prerouting -p tcp -m tcp --dport 9010 -m comment --comment "!fw3: NAS-Portainer-ce" -j DNAT --to-destination 192.168.1.3:9010
-A zone_wan_prerouting -p udp -m udp --dport 9010 -m comment --comment "!fw3: NAS-Portainer-ce" -j DNAT --to-destination 192.168.1.3:9010
-A zone_wan_prerouting -p tcp -m tcp --dport 7080 -m comment --comment "!fw3: Debian-bitwarden" -j DNAT --to-destination 192.168.1.172:7082
-A zone_wan_prerouting -p udp -m udp --dport 7080 -m comment --comment "!fw3: Debian-bitwarden" -j DNAT --to-destination 192.168.1.172:7082
-A zone_wan_prerouting -p tcp -m tcp --dport 5777 -m comment --comment "!fw3: 青龙" -j DNAT --to-destination 192.168.1.172:5778
-A zone_wan_prerouting -p udp -m udp --dport 5777 -m comment --comment "!fw3: 青龙" -j DNAT --to-destination 192.168.1.172:5778
-A zone_wan_prerouting -p tcp -m tcp --dport 3389 -m comment --comment "!fw3: I7 7700K Remote" -j DNAT --to-destination 192.168.1.135:3389
-A zone_wan_prerouting -p udp -m udp --dport 3389 -m comment --comment "!fw3: I7 7700K Remote" -j DNAT --to-destination 192.168.1.135:3389
-A zone_wan_prerouting -p tcp -m tcp --dport 5767 -m comment --comment "!fw3: 青龙2" -j DNAT --to-destination 192.168.1.172:5768
-A zone_wan_prerouting -p udp -m udp --dport 5767 -m comment --comment "!fw3: 青龙2" -j DNAT --to-destination 192.168.1.172:5768
-A zone_wan_prerouting -p tcp -m tcp --dport 8200 -m comment --comment "!fw3: elecV2P" -j DNAT --to-destination 192.168.1.172:8200
-A zone_wan_prerouting -p udp -m udp --dport 8200 -m comment --comment "!fw3: elecV2P" -j DNAT --to-destination 192.168.1.172:8200
-A zone_wan_prerouting -p tcp -m tcp --dport 3489 -m comment --comment "!fw3: R7 4700U Remote" -j DNAT --to-destination 192.168.1.136:3389
-A zone_wan_prerouting -p udp -m udp --dport 3489 -m comment --comment "!fw3: R7 4700U Remote" -j DNAT --to-destination 192.168.1.136:3389
-A zone_wan_prerouting -p tcp -m tcp --dport 18378 -m comment --comment "!fw3: Forward18378" -j DNAT --to-destination 192.168.1.172:18378
-A zone_wan_prerouting -p udp -m udp --dport 18378 -m comment --comment "!fw3: Forward18378" -j DNAT --to-destination 192.168.1.172:18378
-A zone_wan_prerouting -p tcp -m tcp --dport 17070 -m comment --comment "!fw3: Forward17070" -j DNAT --to-destination 192.168.1.172:17070
-A zone_wan_prerouting -p udp -m udp --dport 17070 -m comment --comment "!fw3: Forward17070" -j DNAT --to-destination 192.168.1.172:17070
-A zone_wan_prerouting -p tcp -m tcp --dport 17501 -m comment --comment "!fw3: Forward17500" -j DNAT --to-destination 192.168.1.172:17501
-A zone_wan_prerouting -p udp -m udp --dport 17501 -m comment --comment "!fw3: Forward17500" -j DNAT --to-destination 192.168.1.172:17501
-A zone_wan_prerouting -p tcp -m tcp --dport 17071:17081 -m comment --comment "!fw3: Forward17071" -j DNAT --to-destination 192.168.1.172:17071-17081
-A zone_wan_prerouting -p udp -m udp --dport 17071:17081 -m comment --comment "!fw3: Forward17071" -j DNAT --to-destination 192.168.1.172:17071-17081
-A zone_wan_prerouting -p tcp -m tcp --dport 1688 -m comment --comment "!fw3: KMS" -j DNAT --to-destination 192.168.1.1:1688
-A zone_wan_prerouting -p udp -m udp --dport 1688 -m comment --comment "!fw3: KMS" -j DNAT --to-destination 192.168.1.1:1688
COMMIT
# Completed on Sat Aug  6 14:25:21 2022

#IPv4 Mangle chain

# Generated by iptables-save v1.8.7 on Sat Aug  6 14:25:21 2022
*mangle
:PREROUTING ACCEPT [24053:5459962]
:INPUT ACCEPT [5853:1800460]
:FORWARD ACCEPT [18188:3658376]
:OUTPUT ACCEPT [5716:2907263]
:POSTROUTING ACCEPT [23855:6563374]
:RRDIPT_FORWARD - [0:0]
:RRDIPT_INPUT - [0:0]
:RRDIPT_OUTPUT - [0:0]
:openclash - [0:0]
:openclash_dns_hijack - [0:0]
:openclash_output - [0:0]
-A PREROUTING -j openclash
-A INPUT -j RRDIPT_INPUT
-A FORWARD -j RRDIPT_FORWARD
-A FORWARD -o pppoe-wan -p tcp -m tcp --tcp-flags SYN,RST SYN -m comment --comment "!fw3: Zone wan MTU fixing" -j TCPMSS --clamp-mss-to-pmtu
-A FORWARD -i pppoe-wan -p tcp -m tcp --tcp-flags SYN,RST SYN -m comment --comment "!fw3: Zone wan MTU fixing" -j TCPMSS --clamp-mss-to-pmtu
-A OUTPUT -j RRDIPT_OUTPUT
-A OUTPUT -j openclash_output
-A RRDIPT_FORWARD -s 192.168.1.205/32 -j RETURN
-A RRDIPT_FORWARD -d 192.168.1.205/32 -j RETURN
-A RRDIPT_FORWARD -s 192.168.1.150/32 -j RETURN
-A RRDIPT_FORWARD -d 192.168.1.150/32 -j RETURN
-A RRDIPT_FORWARD -s 192.168.1.135/32 -j RETURN
-A RRDIPT_FORWARD -d 192.168.1.135/32 -j RETURN
-A RRDIPT_FORWARD -s 192.168.1.3/32 -j RETURN
-A RRDIPT_FORWARD -d 192.168.1.3/32 -j RETURN
-A RRDIPT_FORWARD -s 192.168.1.219/32 -j RETURN
-A RRDIPT_FORWARD -d 192.168.1.219/32 -j RETURN
-A RRDIPT_FORWARD -s 192.168.1.172/32 -j RETURN
-A RRDIPT_FORWARD -d 192.168.1.172/32 -j RETURN
-A RRDIPT_FORWARD -s 192.168.1.149/32 -j RETURN
-A RRDIPT_FORWARD -d 192.168.1.149/32 -j RETURN
-A RRDIPT_FORWARD -s 192.168.1.248/32 -j RETURN
-A RRDIPT_FORWARD -d 192.168.1.248/32 -j RETURN
-A RRDIPT_FORWARD -s 192.168.1.142/32 -j RETURN
-A RRDIPT_FORWARD -d 192.168.1.142/32 -j RETURN
-A RRDIPT_FORWARD -s 192.168.1.250/32 -j RETURN
-A RRDIPT_FORWARD -d 192.168.1.250/32 -j RETURN
-A RRDIPT_FORWARD -s 192.168.1.202/32 -j RETURN
-A RRDIPT_FORWARD -d 192.168.1.202/32 -j RETURN
-A RRDIPT_FORWARD -s 192.168.1.115/32 -j RETURN
-A RRDIPT_FORWARD -d 192.168.1.115/32 -j RETURN
-A RRDIPT_FORWARD -s 192.168.1.230/32 -j RETURN
-A RRDIPT_FORWARD -d 192.168.1.230/32 -j RETURN
-A RRDIPT_FORWARD -s 192.168.1.225/32 -j RETURN
-A RRDIPT_FORWARD -d 192.168.1.225/32 -j RETURN
-A RRDIPT_FORWARD -s 192.168.1.233/32 -j RETURN
-A RRDIPT_FORWARD -d 192.168.1.233/32 -j RETURN
-A RRDIPT_FORWARD -s 192.168.1.110/32 -j RETURN
-A RRDIPT_FORWARD -d 192.168.1.110/32 -j RETURN
-A RRDIPT_FORWARD -s 192.168.1.231/32 -j RETURN
-A RRDIPT_FORWARD -d 192.168.1.231/32 -j RETURN
-A RRDIPT_FORWARD -s 192.168.1.208/32 -j RETURN
-A RRDIPT_FORWARD -d 192.168.1.208/32 -j RETURN
-A RRDIPT_FORWARD -s 192.168.1.217/32 -j RETURN
-A RRDIPT_FORWARD -d 192.168.1.217/32 -j RETURN
-A RRDIPT_FORWARD -s 192.168.1.193/32 -j RETURN
-A RRDIPT_FORWARD -d 192.168.1.193/32 -j RETURN
-A RRDIPT_FORWARD -s 192.168.1.113/32 -j RETURN
-A RRDIPT_FORWARD -d 192.168.1.113/32 -j RETURN
-A RRDIPT_FORWARD -s 192.168.1.160/32 -j RETURN
-A RRDIPT_FORWARD -d 192.168.1.160/32 -j RETURN
-A RRDIPT_FORWARD -s 192.168.1.245/32 -j RETURN
-A RRDIPT_FORWARD -d 192.168.1.245/32 -j RETURN
-A RRDIPT_FORWARD -s 192.168.1.183/32 -j RETURN
-A RRDIPT_FORWARD -d 192.168.1.183/32 -j RETURN
-A RRDIPT_FORWARD -s 192.168.1.203/32 -j RETURN
-A RRDIPT_FORWARD -d 192.168.1.203/32 -j RETURN
-A RRDIPT_FORWARD -s 192.168.1.134/32 -j RETURN
-A RRDIPT_FORWARD -d 192.168.1.134/32 -j RETURN
-A RRDIPT_FORWARD -s 192.168.1.192/32 -j RETURN
-A RRDIPT_FORWARD -d 192.168.1.192/32 -j RETURN
-A RRDIPT_INPUT -i eth0 -j RETURN
-A RRDIPT_INPUT -i br-lan -j RETURN
-A RRDIPT_INPUT -i pppoe-wan -j RETURN
-A RRDIPT_OUTPUT -o eth0 -j RETURN
-A RRDIPT_OUTPUT -o br-lan -j RETURN
-A RRDIPT_OUTPUT -o pppoe-wan -j RETURN
-A openclash -p tcp -m tcp --sport 1688 -j RETURN
-A openclash -p udp -m udp --sport 500 -j RETURN
-A openclash -p udp -m udp --sport 68 -j RETURN
-A openclash -s 192.168.1.1/32 -p udp -m udp --sport 1688 -j RETURN
-A openclash -s 192.168.1.1/32 -p udp -m udp --dport 1688 -j RETURN
-A openclash -s 192.168.1.1/32 -p tcp -m tcp --sport 1688 -j RETURN
-A openclash -s 192.168.1.1/32 -p tcp -m tcp --dport 1688 -j RETURN
-A openclash -s 192.168.1.172/32 -p udp -m udp --sport 17071:17081 -j RETURN
-A openclash -s 192.168.1.172/32 -p udp -m udp --dport 17071:17081 -j RETURN
-A openclash -s 192.168.1.172/32 -p tcp -m tcp --sport 17071:17081 -j RETURN
-A openclash -s 192.168.1.172/32 -p tcp -m tcp --dport 17071:17081 -j RETURN
-A openclash -s 192.168.1.172/32 -p udp -m udp --sport 17501 -j RETURN
-A openclash -s 192.168.1.172/32 -p udp -m udp --dport 17501 -j RETURN
-A openclash -s 192.168.1.172/32 -p tcp -m tcp --sport 17501 -j RETURN
-A openclash -s 192.168.1.172/32 -p tcp -m tcp --dport 17501 -j RETURN
-A openclash -s 192.168.1.172/32 -p udp -m udp --sport 17070 -j RETURN
-A openclash -s 192.168.1.172/32 -p udp -m udp --dport 17070 -j RETURN
-A openclash -s 192.168.1.172/32 -p tcp -m tcp --sport 17070 -j RETURN
-A openclash -s 192.168.1.172/32 -p tcp -m tcp --dport 17070 -j RETURN
-A openclash -s 192.168.1.172/32 -p udp -m udp --sport 18378 -j RETURN
-A openclash -s 192.168.1.172/32 -p udp -m udp --dport 18378 -j RETURN
-A openclash -s 192.168.1.172/32 -p tcp -m tcp --sport 18378 -j RETURN
-A openclash -s 192.168.1.172/32 -p tcp -m tcp --dport 18378 -j RETURN
-A openclash -s 192.168.1.136/32 -p udp -m udp --sport 3389 -j RETURN
-A openclash -s 192.168.1.136/32 -p udp -m udp --dport 3489 -j RETURN
-A openclash -s 192.168.1.136/32 -p tcp -m tcp --sport 3389 -j RETURN
-A openclash -s 192.168.1.136/32 -p tcp -m tcp --dport 3489 -j RETURN
-A openclash -s 192.168.1.172/32 -p udp -m udp --sport 8200 -j RETURN
-A openclash -s 192.168.1.172/32 -p udp -m udp --dport 8200 -j RETURN
-A openclash -s 192.168.1.172/32 -p tcp -m tcp --sport 8200 -j RETURN
-A openclash -s 192.168.1.172/32 -p tcp -m tcp --dport 8200 -j RETURN
-A openclash -s 192.168.1.172/32 -p udp -m udp --sport 5768 -j RETURN
-A openclash -s 192.168.1.172/32 -p udp -m udp --dport 5767 -j RETURN
-A openclash -s 192.168.1.172/32 -p tcp -m tcp --sport 5768 -j RETURN
-A openclash -s 192.168.1.172/32 -p tcp -m tcp --dport 5767 -j RETURN
-A openclash -s 192.168.1.135/32 -p udp -m udp --sport 3389 -j RETURN
-A openclash -s 192.168.1.135/32 -p udp -m udp --dport 3389 -j RETURN
-A openclash -s 192.168.1.135/32 -p tcp -m tcp --sport 3389 -j RETURN
-A openclash -s 192.168.1.135/32 -p tcp -m tcp --dport 3389 -j RETURN
-A openclash -s 192.168.1.172/32 -p udp -m udp --sport 5778 -j RETURN
-A openclash -s 192.168.1.172/32 -p udp -m udp --dport 5777 -j RETURN
-A openclash -s 192.168.1.172/32 -p tcp -m tcp --sport 5778 -j RETURN
-A openclash -s 192.168.1.172/32 -p tcp -m tcp --dport 5777 -j RETURN
-A openclash -s 192.168.1.172/32 -p udp -m udp --sport 7082 -j RETURN
-A openclash -s 192.168.1.172/32 -p udp -m udp --dport 7080 -j RETURN
-A openclash -s 192.168.1.172/32 -p tcp -m tcp --sport 7082 -j RETURN
-A openclash -s 192.168.1.172/32 -p tcp -m tcp --dport 7080 -j RETURN
-A openclash -s 192.168.1.3/32 -p udp -m udp --sport 9010 -j RETURN
-A openclash -s 192.168.1.3/32 -p udp -m udp --dport 9010 -j RETURN
-A openclash -s 192.168.1.3/32 -p tcp -m tcp --sport 9010 -j RETURN
-A openclash -s 192.168.1.3/32 -p tcp -m tcp --dport 9010 -j RETURN
-A openclash -s 192.168.1.3/32 -p udp -m udp --sport 33496 -j RETURN
-A openclash -s 192.168.1.3/32 -p udp -m udp --dport 33496 -j RETURN
-A openclash -s 192.168.1.3/32 -p tcp -m tcp --sport 33496 -j RETURN
-A openclash -s 192.168.1.3/32 -p tcp -m tcp --dport 33496 -j RETURN
-A openclash -s 192.168.1.3/32 -p udp -m udp --sport 51423 -j RETURN
-A openclash -s 192.168.1.3/32 -p udp -m udp --dport 51423 -j RETURN
-A openclash -s 192.168.1.3/32 -p tcp -m tcp --sport 51423 -j RETURN
-A openclash -s 192.168.1.3/32 -p tcp -m tcp --dport 51423 -j RETURN
-A openclash -s 192.168.1.3/32 -p udp -m udp --sport 60654 -j RETURN
-A openclash -s 192.168.1.3/32 -p udp -m udp --dport 60654 -j RETURN
-A openclash -s 192.168.1.3/32 -p tcp -m tcp --sport 60654 -j RETURN
-A openclash -s 192.168.1.3/32 -p tcp -m tcp --dport 60654 -j RETURN
-A openclash -s 192.168.1.172/32 -p udp -m udp --sport 9877 -j RETURN
-A openclash -s 192.168.1.172/32 -p udp -m udp --dport 9876 -j RETURN
-A openclash -s 192.168.1.172/32 -p tcp -m tcp --sport 9877 -j RETURN
-A openclash -s 192.168.1.172/32 -p tcp -m tcp --dport 9876 -j RETURN
-A openclash -s 192.168.1.172/32 -p udp -m udp --sport 34401 -j RETURN
-A openclash -s 192.168.1.172/32 -p udp -m udp --dport 34400 -j RETURN
-A openclash -s 192.168.1.172/32 -p tcp -m tcp --sport 34401 -j RETURN
-A openclash -s 192.168.1.172/32 -p tcp -m tcp --dport 34400 -j RETURN
-A openclash -s 192.168.1.172/32 -p udp -m udp --sport 9000 -j RETURN
-A openclash -s 192.168.1.172/32 -p udp -m udp --dport 9000 -j RETURN
-A openclash -s 192.168.1.172/32 -p tcp -m tcp --sport 9000 -j RETURN
-A openclash -s 192.168.1.172/32 -p tcp -m tcp --dport 9000 -j RETURN
-A openclash -s 192.168.1.172/32 -p udp -m udp --sport 32400 -j RETURN
-A openclash -s 192.168.1.172/32 -p udp -m udp --dport 42401 -j RETURN
-A openclash -s 192.168.1.172/32 -p tcp -m tcp --sport 32400 -j RETURN
-A openclash -s 192.168.1.172/32 -p tcp -m tcp --dport 42401 -j RETURN
-A openclash -s 192.168.1.172/32 -p udp -m udp --sport 8096 -j RETURN
-A openclash -s 192.168.1.172/32 -p udp -m udp --dport 8096 -j RETURN
-A openclash -s 192.168.1.172/32 -p tcp -m tcp --sport 8096 -j RETURN
-A openclash -s 192.168.1.172/32 -p tcp -m tcp --dport 8096 -j RETURN
-A openclash -s 192.168.1.172/32 -p udp -m udp --sport 8920 -j RETURN
-A openclash -s 192.168.1.172/32 -p udp -m udp --dport 8920 -j RETURN
-A openclash -s 192.168.1.172/32 -p tcp -m tcp --sport 8920 -j RETURN
-A openclash -s 192.168.1.172/32 -p tcp -m tcp --dport 8920 -j RETURN
-A openclash -s 192.168.1.230/32 -p udp -m udp --sport 4343 -j RETURN
-A openclash -s 192.168.1.230/32 -p udp -m udp --dport 4343 -j RETURN
-A openclash -s 192.168.1.230/32 -p tcp -m tcp --sport 4343 -j RETURN
-A openclash -s 192.168.1.230/32 -p tcp -m tcp --dport 4343 -j RETURN
-A openclash -s 192.168.1.1/32 -p udp -m udp --sport 443 -j RETURN
-A openclash -s 192.168.1.1/32 -p udp -m udp --dport 7443 -j RETURN
-A openclash -s 192.168.1.1/32 -p tcp -m tcp --sport 443 -j RETURN
-A openclash -s 192.168.1.1/32 -p tcp -m tcp --dport 7443 -j RETURN
-A openclash -s 192.168.1.3/32 -p udp -m udp --sport 33396 -j RETURN
-A openclash -s 192.168.1.3/32 -p udp -m udp --dport 33396 -j RETURN
-A openclash -s 192.168.1.3/32 -p tcp -m tcp --sport 33396 -j RETURN
-A openclash -s 192.168.1.3/32 -p tcp -m tcp --dport 33396 -j RETURN
-A openclash -s 192.168.1.3/32 -p udp -m udp --sport 9101 -j RETURN
-A openclash -s 192.168.1.3/32 -p udp -m udp --dport 9101 -j RETURN
-A openclash -s 192.168.1.3/32 -p tcp -m tcp --sport 9101 -j RETURN
-A openclash -s 192.168.1.3/32 -p tcp -m tcp --dport 9101 -j RETURN
-A openclash -s 192.168.1.3/32 -p udp -m udp --sport 6880 -j RETURN
-A openclash -s 192.168.1.3/32 -p udp -m udp --dport 6880 -j RETURN
-A openclash -s 192.168.1.3/32 -p tcp -m tcp --sport 6880 -j RETURN
-A openclash -s 192.168.1.3/32 -p tcp -m tcp --dport 6880 -j RETURN
-A openclash -s 192.168.1.3/32 -p udp -m udp --sport 8085 -j RETURN
-A openclash -s 192.168.1.3/32 -p udp -m udp --dport 8085 -j RETURN
-A openclash -s 192.168.1.3/32 -p tcp -m tcp --sport 8085 -j RETURN
-A openclash -s 192.168.1.3/32 -p tcp -m tcp --dport 8085 -j RETURN
-A openclash -s 192.168.1.3/32 -p udp -m udp --sport 55536:55599 -j RETURN
-A openclash -s 192.168.1.3/32 -p udp -m udp --dport 55536:55599 -j RETURN
-A openclash -s 192.168.1.3/32 -p tcp -m tcp --sport 55536:55599 -j RETURN
-A openclash -s 192.168.1.3/32 -p tcp -m tcp --dport 55536:55599 -j RETURN
-A openclash -s 192.168.1.3/32 -p udp -m udp --sport 20:21 -j RETURN
-A openclash -s 192.168.1.3/32 -p udp -m udp --dport 20:21 -j RETURN
-A openclash -s 192.168.1.3/32 -p tcp -m tcp --sport 20:21 -j RETURN
-A openclash -s 192.168.1.3/32 -p tcp -m tcp --dport 20:21 -j RETURN
-A openclash -s 192.168.1.3/32 -p udp -m udp --sport 5006 -j RETURN
-A openclash -s 192.168.1.3/32 -p udp -m udp --dport 5006 -j RETURN
-A openclash -s 192.168.1.3/32 -p tcp -m tcp --sport 5006 -j RETURN
-A openclash -s 192.168.1.3/32 -p tcp -m tcp --dport 5006 -j RETURN
-A openclash -s 192.168.1.3/32 -p udp -m udp --sport 4244 -j RETURN
-A openclash -s 192.168.1.3/32 -p udp -m udp --dport 4244 -j RETURN
-A openclash -s 192.168.1.3/32 -p tcp -m tcp --sport 4244 -j RETURN
-A openclash -s 192.168.1.3/32 -p tcp -m tcp --dport 4244 -j RETURN
-A openclash -s 192.168.1.250/32 -p udp -m udp --sport 8006 -j RETURN
-A openclash -s 192.168.1.250/32 -p udp -m udp --dport 8006 -j RETURN
-A openclash -s 192.168.1.250/32 -p tcp -m tcp --sport 8006 -j RETURN
-A openclash -s 192.168.1.250/32 -p tcp -m tcp --dport 8006 -j RETURN
-A openclash -s 192.168.1.3/32 -p udp -m udp --sport 8089 -j RETURN
-A openclash -s 192.168.1.3/32 -p udp -m udp --dport 8089 -j RETURN
-A openclash -s 192.168.1.3/32 -p tcp -m tcp --sport 8089 -j RETURN
-A openclash -s 192.168.1.3/32 -p tcp -m tcp --dport 8089 -j RETURN
-A openclash -s 192.168.1.3/32 -p udp -m udp --sport 52147 -j RETURN
-A openclash -s 192.168.1.3/32 -p udp -m udp --dport 52147 -j RETURN
-A openclash -s 192.168.1.3/32 -p tcp -m tcp --sport 52147 -j RETURN
-A openclash -s 192.168.1.3/32 -p tcp -m tcp --dport 52147 -j RETURN
-A openclash -s 192.168.1.3/32 -p udp -m udp --sport 9008 -j RETURN
-A openclash -s 192.168.1.3/32 -p udp -m udp --dport 9008 -j RETURN
-A openclash -s 192.168.1.3/32 -p tcp -m tcp --sport 9008 -j RETURN
-A openclash -s 192.168.1.3/32 -p tcp -m tcp --dport 9008 -j RETURN
-A openclash -s 192.168.1.3/32 -p udp -m udp --sport 7001 -j RETURN
-A openclash -s 192.168.1.3/32 -p udp -m udp --dport 7001 -j RETURN
-A openclash -s 192.168.1.3/32 -p tcp -m tcp --sport 7001 -j RETURN
-A openclash -s 192.168.1.3/32 -p tcp -m tcp --dport 7001 -j RETURN
-A openclash -s 192.168.1.3/32 -p udp -m udp --sport 32400 -j RETURN
-A openclash -s 192.168.1.3/32 -p udp -m udp --dport 32401 -j RETURN
-A openclash -s 192.168.1.3/32 -p tcp -m tcp --sport 32400 -j RETURN
-A openclash -s 192.168.1.3/32 -p tcp -m tcp --dport 32401 -j RETURN
-A openclash -s 192.168.1.3/32 -p udp -m udp --sport 16811 -j RETURN
-A openclash -s 192.168.1.3/32 -p udp -m udp --dport 16881 -j RETURN
-A openclash -s 192.168.1.3/32 -p tcp -m tcp --sport 16811 -j RETURN
-A openclash -s 192.168.1.3/32 -p tcp -m tcp --dport 16881 -j RETURN
-A openclash -s 192.168.1.3/32 -p udp -m udp --sport 10003 -j RETURN
-A openclash -s 192.168.1.3/32 -p udp -m udp --dport 10003 -j RETURN
-A openclash -s 192.168.1.3/32 -p tcp -m tcp --sport 10003 -j RETURN
-A openclash -s 192.168.1.3/32 -p tcp -m tcp --dport 10003 -j RETURN
-A openclash -s 192.168.1.3/32 -p udp -m udp --sport 6690 -j RETURN
-A openclash -s 192.168.1.3/32 -p udp -m udp --dport 6690 -j RETURN
-A openclash -s 192.168.1.3/32 -p tcp -m tcp --sport 6690 -j RETURN
-A openclash -s 192.168.1.3/32 -p tcp -m tcp --dport 6690 -j RETURN
-A openclash -s 192.168.1.3/32 -p udp -m udp --sport 52236 -j RETURN
-A openclash -s 192.168.1.3/32 -p udp -m udp --dport 52236 -j RETURN
-A openclash -s 192.168.1.3/32 -p tcp -m tcp --sport 52236 -j RETURN
-A openclash -s 192.168.1.3/32 -p tcp -m tcp --dport 52236 -j RETURN
-A openclash -s 192.168.1.3/32 -p udp -m udp --sport 8112 -j RETURN
-A openclash -s 192.168.1.3/32 -p udp -m udp --dport 8112 -j RETURN
-A openclash -s 192.168.1.3/32 -p tcp -m tcp --sport 8112 -j RETURN
-A openclash -s 192.168.1.3/32 -p tcp -m tcp --dport 8112 -j RETURN
-A openclash -s 192.168.1.3/32 -p udp -m udp --sport 51413 -j RETURN
-A openclash -s 192.168.1.3/32 -p udp -m udp --dport 51413 -j RETURN
-A openclash -s 192.168.1.3/32 -p tcp -m tcp --sport 51413 -j RETURN
-A openclash -s 192.168.1.3/32 -p tcp -m tcp --dport 51413 -j RETURN
-A openclash -s 192.168.1.3/32 -p udp -m udp --sport 9091 -j RETURN
-A openclash -s 192.168.1.3/32 -p udp -m udp --dport 9091 -j RETURN
-A openclash -s 192.168.1.3/32 -p tcp -m tcp --sport 9091 -j RETURN
-A openclash -s 192.168.1.3/32 -p tcp -m tcp --dport 9091 -j RETURN
-A openclash -s 192.168.1.3/32 -p udp -m udp --sport 9090 -j RETURN
-A openclash -s 192.168.1.3/32 -p udp -m udp --dport 9090 -j RETURN
-A openclash -s 192.168.1.3/32 -p tcp -m tcp --sport 9090 -j RETURN
-A openclash -s 192.168.1.3/32 -p tcp -m tcp --dport 9090 -j RETURN
-A openclash -s 192.168.1.3/32 -p udp -m udp --sport 8011 -j RETURN
-A openclash -s 192.168.1.3/32 -p udp -m udp --dport 8011 -j RETURN
-A openclash -s 192.168.1.3/32 -p tcp -m tcp --sport 8011 -j RETURN
-A openclash -s 192.168.1.3/32 -p tcp -m tcp --dport 8011 -j RETURN
-A openclash -s 192.168.1.3/32 -p udp -m udp --sport 5000 -j RETURN
-A openclash -s 192.168.1.3/32 -p udp -m udp --dport 5000 -j RETURN
-A openclash -s 192.168.1.3/32 -p tcp -m tcp --sport 5000 -j RETURN
-A openclash -s 192.168.1.3/32 -p tcp -m tcp --dport 5000 -j RETURN
-A openclash -s 192.168.1.3/32 -p udp -m udp --sport 5001 -j RETURN
-A openclash -s 192.168.1.3/32 -p udp -m udp --dport 5001 -j RETURN
-A openclash -s 192.168.1.3/32 -p tcp -m tcp --sport 5001 -j RETURN
-A openclash -s 192.168.1.3/32 -p tcp -m tcp --dport 5001 -j RETURN
-A openclash -m set --match-set localnetwork dst -j RETURN
-A openclash -m set --match-set localnetwork src -m set --match-set lan_ac_black_ports src -j RETURN
-A openclash -m set --match-set lan_ac_black_ips src -j RETURN
-A openclash -m set --match-set lan_ac_black_macs src -j RETURN
-A openclash -j MARK --set-xmark 0x162/0xffffffff
-A openclash_output -p tcp -m tcp --sport 1688 -j RETURN
-A openclash_output -p udp -m udp --sport 500 -j RETURN
-A openclash_output -p udp -m udp --sport 68 -j RETURN
-A openclash_output -s 192.168.1.1/32 -p udp -m udp --dport 1688 -j RETURN
-A openclash_output -s 192.168.1.1/32 -p udp -m udp --sport 1688 -j RETURN
-A openclash_output -s 192.168.1.1/32 -p tcp -m tcp --dport 1688 -j RETURN
-A openclash_output -s 192.168.1.1/32 -p tcp -m tcp --sport 1688 -j RETURN
-A openclash_output -s 192.168.1.172/32 -p udp -m udp --dport 17071:17081 -j RETURN
-A openclash_output -s 192.168.1.172/32 -p udp -m udp --sport 17071:17081 -j RETURN
-A openclash_output -s 192.168.1.172/32 -p tcp -m tcp --dport 17071:17081 -j RETURN
-A openclash_output -s 192.168.1.172/32 -p tcp -m tcp --sport 17071:17081 -j RETURN
-A openclash_output -s 192.168.1.172/32 -p udp -m udp --dport 17501 -j RETURN
-A openclash_output -s 192.168.1.172/32 -p udp -m udp --sport 17501 -j RETURN
-A openclash_output -s 192.168.1.172/32 -p tcp -m tcp --dport 17501 -j RETURN
-A openclash_output -s 192.168.1.172/32 -p tcp -m tcp --sport 17501 -j RETURN
-A openclash_output -s 192.168.1.172/32 -p udp -m udp --dport 17070 -j RETURN
-A openclash_output -s 192.168.1.172/32 -p udp -m udp --sport 17070 -j RETURN
-A openclash_output -s 192.168.1.172/32 -p tcp -m tcp --dport 17070 -j RETURN
-A openclash_output -s 192.168.1.172/32 -p tcp -m tcp --sport 17070 -j RETURN
-A openclash_output -s 192.168.1.172/32 -p udp -m udp --dport 18378 -j RETURN
-A openclash_output -s 192.168.1.172/32 -p udp -m udp --sport 18378 -j RETURN
-A openclash_output -s 192.168.1.172/32 -p tcp -m tcp --dport 18378 -j RETURN
-A openclash_output -s 192.168.1.172/32 -p tcp -m tcp --sport 18378 -j RETURN
-A openclash_output -s 192.168.1.136/32 -p udp -m udp --dport 3489 -j RETURN
-A openclash_output -s 192.168.1.136/32 -p udp -m udp --sport 3389 -j RETURN
-A openclash_output -s 192.168.1.136/32 -p tcp -m tcp --dport 3489 -j RETURN
-A openclash_output -s 192.168.1.136/32 -p tcp -m tcp --sport 3389 -j RETURN
-A openclash_output -s 192.168.1.172/32 -p udp -m udp --dport 8200 -j RETURN
-A openclash_output -s 192.168.1.172/32 -p udp -m udp --sport 8200 -j RETURN
-A openclash_output -s 192.168.1.172/32 -p tcp -m tcp --dport 8200 -j RETURN
-A openclash_output -s 192.168.1.172/32 -p tcp -m tcp --sport 8200 -j RETURN
-A openclash_output -s 192.168.1.172/32 -p udp -m udp --dport 5767 -j RETURN
-A openclash_output -s 192.168.1.172/32 -p udp -m udp --sport 5768 -j RETURN
-A openclash_output -s 192.168.1.172/32 -p tcp -m tcp --dport 5767 -j RETURN
-A openclash_output -s 192.168.1.172/32 -p tcp -m tcp --sport 5768 -j RETURN
-A openclash_output -s 192.168.1.135/32 -p udp -m udp --dport 3389 -j RETURN
-A openclash_output -s 192.168.1.135/32 -p udp -m udp --sport 3389 -j RETURN
-A openclash_output -s 192.168.1.135/32 -p tcp -m tcp --dport 3389 -j RETURN
-A openclash_output -s 192.168.1.135/32 -p tcp -m tcp --sport 3389 -j RETURN
-A openclash_output -s 192.168.1.172/32 -p udp -m udp --dport 5777 -j RETURN
-A openclash_output -s 192.168.1.172/32 -p udp -m udp --sport 5778 -j RETURN
-A openclash_output -s 192.168.1.172/32 -p tcp -m tcp --dport 5777 -j RETURN
-A openclash_output -s 192.168.1.172/32 -p tcp -m tcp --sport 5778 -j RETURN
-A openclash_output -s 192.168.1.172/32 -p udp -m udp --dport 7080 -j RETURN
-A openclash_output -s 192.168.1.172/32 -p udp -m udp --sport 7082 -j RETURN
-A openclash_output -s 192.168.1.172/32 -p tcp -m tcp --dport 7080 -j RETURN
-A openclash_output -s 192.168.1.172/32 -p tcp -m tcp --sport 7082 -j RETURN
-A openclash_output -s 192.168.1.3/32 -p udp -m udp --dport 9010 -j RETURN
-A openclash_output -s 192.168.1.3/32 -p udp -m udp --sport 9010 -j RETURN
-A openclash_output -s 192.168.1.3/32 -p tcp -m tcp --dport 9010 -j RETURN
-A openclash_output -s 192.168.1.3/32 -p tcp -m tcp --sport 9010 -j RETURN
-A openclash_output -s 192.168.1.3/32 -p udp -m udp --dport 33496 -j RETURN
-A openclash_output -s 192.168.1.3/32 -p udp -m udp --sport 33496 -j RETURN
-A openclash_output -s 192.168.1.3/32 -p tcp -m tcp --dport 33496 -j RETURN
-A openclash_output -s 192.168.1.3/32 -p tcp -m tcp --sport 33496 -j RETURN
-A openclash_output -s 192.168.1.3/32 -p udp -m udp --dport 51423 -j RETURN
-A openclash_output -s 192.168.1.3/32 -p udp -m udp --sport 51423 -j RETURN
-A openclash_output -s 192.168.1.3/32 -p tcp -m tcp --dport 51423 -j RETURN
-A openclash_output -s 192.168.1.3/32 -p tcp -m tcp --sport 51423 -j RETURN
-A openclash_output -s 192.168.1.3/32 -p udp -m udp --dport 60654 -j RETURN
-A openclash_output -s 192.168.1.3/32 -p udp -m udp --sport 60654 -j RETURN
-A openclash_output -s 192.168.1.3/32 -p tcp -m tcp --dport 60654 -j RETURN
-A openclash_output -s 192.168.1.3/32 -p tcp -m tcp --sport 60654 -j RETURN
-A openclash_output -s 192.168.1.172/32 -p udp -m udp --dport 9876 -j RETURN
-A openclash_output -s 192.168.1.172/32 -p udp -m udp --sport 9877 -j RETURN
-A openclash_output -s 192.168.1.172/32 -p tcp -m tcp --dport 9876 -j RETURN
-A openclash_output -s 192.168.1.172/32 -p tcp -m tcp --sport 9877 -j RETURN
-A openclash_output -s 192.168.1.172/32 -p udp -m udp --dport 34400 -j RETURN
-A openclash_output -s 192.168.1.172/32 -p udp -m udp --sport 34401 -j RETURN
-A openclash_output -s 192.168.1.172/32 -p tcp -m tcp --dport 34400 -j RETURN
-A openclash_output -s 192.168.1.172/32 -p tcp -m tcp --sport 34401 -j RETURN
-A openclash_output -s 192.168.1.172/32 -p udp -m udp --dport 9000 -j RETURN
-A openclash_output -s 192.168.1.172/32 -p udp -m udp --sport 9000 -j RETURN
-A openclash_output -s 192.168.1.172/32 -p tcp -m tcp --dport 9000 -j RETURN
-A openclash_output -s 192.168.1.172/32 -p tcp -m tcp --sport 9000 -j RETURN
-A openclash_output -s 192.168.1.172/32 -p udp -m udp --dport 42401 -j RETURN
-A openclash_output -s 192.168.1.172/32 -p udp -m udp --sport 32400 -j RETURN
-A openclash_output -s 192.168.1.172/32 -p tcp -m tcp --dport 42401 -j RETURN
-A openclash_output -s 192.168.1.172/32 -p tcp -m tcp --sport 32400 -j RETURN
-A openclash_output -s 192.168.1.172/32 -p udp -m udp --dport 8096 -j RETURN
-A openclash_output -s 192.168.1.172/32 -p udp -m udp --sport 8096 -j RETURN
-A openclash_output -s 192.168.1.172/32 -p tcp -m tcp --dport 8096 -j RETURN
-A openclash_output -s 192.168.1.172/32 -p tcp -m tcp --sport 8096 -j RETURN
-A openclash_output -s 192.168.1.172/32 -p udp -m udp --dport 8920 -j RETURN
-A openclash_output -s 192.168.1.172/32 -p udp -m udp --sport 8920 -j RETURN
-A openclash_output -s 192.168.1.172/32 -p tcp -m tcp --dport 8920 -j RETURN
-A openclash_output -s 192.168.1.172/32 -p tcp -m tcp --sport 8920 -j RETURN
-A openclash_output -s 192.168.1.230/32 -p udp -m udp --dport 4343 -j RETURN
-A openclash_output -s 192.168.1.230/32 -p udp -m udp --sport 4343 -j RETURN
-A openclash_output -s 192.168.1.230/32 -p tcp -m tcp --dport 4343 -j RETURN
-A openclash_output -s 192.168.1.230/32 -p tcp -m tcp --sport 4343 -j RETURN
-A openclash_output -s 192.168.1.1/32 -p udp -m udp --dport 7443 -j RETURN
-A openclash_output -s 192.168.1.1/32 -p udp -m udp --sport 443 -j RETURN
-A openclash_output -s 192.168.1.1/32 -p tcp -m tcp --dport 7443 -j RETURN
-A openclash_output -s 192.168.1.1/32 -p tcp -m tcp --sport 443 -j RETURN
-A openclash_output -s 192.168.1.3/32 -p udp -m udp --dport 33396 -j RETURN
-A openclash_output -s 192.168.1.3/32 -p udp -m udp --sport 33396 -j RETURN
-A openclash_output -s 192.168.1.3/32 -p tcp -m tcp --dport 33396 -j RETURN
-A openclash_output -s 192.168.1.3/32 -p tcp -m tcp --sport 33396 -j RETURN
-A openclash_output -s 192.168.1.3/32 -p udp -m udp --dport 9101 -j RETURN
-A openclash_output -s 192.168.1.3/32 -p udp -m udp --sport 9101 -j RETURN
-A openclash_output -s 192.168.1.3/32 -p tcp -m tcp --dport 9101 -j RETURN
-A openclash_output -s 192.168.1.3/32 -p tcp -m tcp --sport 9101 -j RETURN
-A openclash_output -s 192.168.1.3/32 -p udp -m udp --dport 6880 -j RETURN
-A openclash_output -s 192.168.1.3/32 -p udp -m udp --sport 6880 -j RETURN
-A openclash_output -s 192.168.1.3/32 -p tcp -m tcp --dport 6880 -j RETURN
-A openclash_output -s 192.168.1.3/32 -p tcp -m tcp --sport 6880 -j RETURN
-A openclash_output -s 192.168.1.3/32 -p udp -m udp --dport 8085 -j RETURN
-A openclash_output -s 192.168.1.3/32 -p udp -m udp --sport 8085 -j RETURN
-A openclash_output -s 192.168.1.3/32 -p tcp -m tcp --dport 8085 -j RETURN
-A openclash_output -s 192.168.1.3/32 -p tcp -m tcp --sport 8085 -j RETURN
-A openclash_output -s 192.168.1.3/32 -p udp -m udp --dport 55536:55599 -j RETURN
-A openclash_output -s 192.168.1.3/32 -p udp -m udp --sport 55536:55599 -j RETURN
-A openclash_output -s 192.168.1.3/32 -p tcp -m tcp --dport 55536:55599 -j RETURN
-A openclash_output -s 192.168.1.3/32 -p tcp -m tcp --sport 55536:55599 -j RETURN
-A openclash_output -s 192.168.1.3/32 -p udp -m udp --dport 20:21 -j RETURN
-A openclash_output -s 192.168.1.3/32 -p udp -m udp --sport 20:21 -j RETURN
-A openclash_output -s 192.168.1.3/32 -p tcp -m tcp --dport 20:21 -j RETURN
-A openclash_output -s 192.168.1.3/32 -p tcp -m tcp --sport 20:21 -j RETURN
-A openclash_output -s 192.168.1.3/32 -p udp -m udp --dport 5006 -j RETURN
-A openclash_output -s 192.168.1.3/32 -p udp -m udp --sport 5006 -j RETURN
-A openclash_output -s 192.168.1.3/32 -p tcp -m tcp --dport 5006 -j RETURN
-A openclash_output -s 192.168.1.3/32 -p tcp -m tcp --sport 5006 -j RETURN
-A openclash_output -s 192.168.1.3/32 -p udp -m udp --dport 4244 -j RETURN
-A openclash_output -s 192.168.1.3/32 -p udp -m udp --sport 4244 -j RETURN
-A openclash_output -s 192.168.1.3/32 -p tcp -m tcp --dport 4244 -j RETURN
-A openclash_output -s 192.168.1.3/32 -p tcp -m tcp --sport 4244 -j RETURN
-A openclash_output -s 192.168.1.250/32 -p udp -m udp --dport 8006 -j RETURN
-A openclash_output -s 192.168.1.250/32 -p udp -m udp --sport 8006 -j RETURN
-A openclash_output -s 192.168.1.250/32 -p tcp -m tcp --dport 8006 -j RETURN
-A openclash_output -s 192.168.1.250/32 -p tcp -m tcp --sport 8006 -j RETURN
-A openclash_output -s 192.168.1.3/32 -p udp -m udp --dport 8089 -j RETURN
-A openclash_output -s 192.168.1.3/32 -p udp -m udp --sport 8089 -j RETURN
-A openclash_output -s 192.168.1.3/32 -p tcp -m tcp --dport 8089 -j RETURN
-A openclash_output -s 192.168.1.3/32 -p tcp -m tcp --sport 8089 -j RETURN
-A openclash_output -s 192.168.1.3/32 -p udp -m udp --dport 52147 -j RETURN
-A openclash_output -s 192.168.1.3/32 -p udp -m udp --sport 52147 -j RETURN
-A openclash_output -s 192.168.1.3/32 -p tcp -m tcp --dport 52147 -j RETURN
-A openclash_output -s 192.168.1.3/32 -p tcp -m tcp --sport 52147 -j RETURN
-A openclash_output -s 192.168.1.3/32 -p udp -m udp --dport 9008 -j RETURN
-A openclash_output -s 192.168.1.3/32 -p udp -m udp --sport 9008 -j RETURN
-A openclash_output -s 192.168.1.3/32 -p tcp -m tcp --dport 9008 -j RETURN
-A openclash_output -s 192.168.1.3/32 -p tcp -m tcp --sport 9008 -j RETURN
-A openclash_output -s 192.168.1.3/32 -p udp -m udp --dport 7001 -j RETURN
-A openclash_output -s 192.168.1.3/32 -p udp -m udp --sport 7001 -j RETURN
-A openclash_output -s 192.168.1.3/32 -p tcp -m tcp --dport 7001 -j RETURN
-A openclash_output -s 192.168.1.3/32 -p tcp -m tcp --sport 7001 -j RETURN
-A openclash_output -s 192.168.1.3/32 -p udp -m udp --dport 32401 -j RETURN
-A openclash_output -s 192.168.1.3/32 -p udp -m udp --sport 32400 -j RETURN
-A openclash_output -s 192.168.1.3/32 -p tcp -m tcp --dport 32401 -j RETURN
-A openclash_output -s 192.168.1.3/32 -p tcp -m tcp --sport 32400 -j RETURN
-A openclash_output -s 192.168.1.3/32 -p udp -m udp --dport 16881 -j RETURN
-A openclash_output -s 192.168.1.3/32 -p udp -m udp --sport 16811 -j RETURN
-A openclash_output -s 192.168.1.3/32 -p tcp -m tcp --dport 16881 -j RETURN
-A openclash_output -s 192.168.1.3/32 -p tcp -m tcp --sport 16811 -j RETURN
-A openclash_output -s 192.168.1.3/32 -p udp -m udp --dport 10003 -j RETURN
-A openclash_output -s 192.168.1.3/32 -p udp -m udp --sport 10003 -j RETURN
-A openclash_output -s 192.168.1.3/32 -p tcp -m tcp --dport 10003 -j RETURN
-A openclash_output -s 192.168.1.3/32 -p tcp -m tcp --sport 10003 -j RETURN
-A openclash_output -s 192.168.1.3/32 -p udp -m udp --dport 6690 -j RETURN
-A openclash_output -s 192.168.1.3/32 -p udp -m udp --sport 6690 -j RETURN
-A openclash_output -s 192.168.1.3/32 -p tcp -m tcp --dport 6690 -j RETURN
-A openclash_output -s 192.168.1.3/32 -p tcp -m tcp --sport 6690 -j RETURN
-A openclash_output -s 192.168.1.3/32 -p udp -m udp --dport 52236 -j RETURN
-A openclash_output -s 192.168.1.3/32 -p udp -m udp --sport 52236 -j RETURN
-A openclash_output -s 192.168.1.3/32 -p tcp -m tcp --dport 52236 -j RETURN
-A openclash_output -s 192.168.1.3/32 -p tcp -m tcp --sport 52236 -j RETURN
-A openclash_output -s 192.168.1.3/32 -p udp -m udp --dport 8112 -j RETURN
-A openclash_output -s 192.168.1.3/32 -p udp -m udp --sport 8112 -j RETURN
-A openclash_output -s 192.168.1.3/32 -p tcp -m tcp --dport 8112 -j RETURN
-A openclash_output -s 192.168.1.3/32 -p tcp -m tcp --sport 8112 -j RETURN
-A openclash_output -s 192.168.1.3/32 -p udp -m udp --dport 51413 -j RETURN
-A openclash_output -s 192.168.1.3/32 -p udp -m udp --sport 51413 -j RETURN
-A openclash_output -s 192.168.1.3/32 -p tcp -m tcp --dport 51413 -j RETURN
-A openclash_output -s 192.168.1.3/32 -p tcp -m tcp --sport 51413 -j RETURN
-A openclash_output -s 192.168.1.3/32 -p udp -m udp --dport 9091 -j RETURN
-A openclash_output -s 192.168.1.3/32 -p udp -m udp --sport 9091 -j RETURN
-A openclash_output -s 192.168.1.3/32 -p tcp -m tcp --dport 9091 -j RETURN
-A openclash_output -s 192.168.1.3/32 -p tcp -m tcp --sport 9091 -j RETURN
-A openclash_output -s 192.168.1.3/32 -p udp -m udp --dport 9090 -j RETURN
-A openclash_output -s 192.168.1.3/32 -p udp -m udp --sport 9090 -j RETURN
-A openclash_output -s 192.168.1.3/32 -p tcp -m tcp --dport 9090 -j RETURN
-A openclash_output -s 192.168.1.3/32 -p tcp -m tcp --sport 9090 -j RETURN
-A openclash_output -s 192.168.1.3/32 -p udp -m udp --dport 8011 -j RETURN
-A openclash_output -s 192.168.1.3/32 -p udp -m udp --sport 8011 -j RETURN
-A openclash_output -s 192.168.1.3/32 -p tcp -m tcp --dport 8011 -j RETURN
-A openclash_output -s 192.168.1.3/32 -p tcp -m tcp --sport 8011 -j RETURN
-A openclash_output -s 192.168.1.3/32 -p udp -m udp --dport 5000 -j RETURN
-A openclash_output -s 192.168.1.3/32 -p udp -m udp --sport 5000 -j RETURN
-A openclash_output -s 192.168.1.3/32 -p tcp -m tcp --dport 5000 -j RETURN
-A openclash_output -s 192.168.1.3/32 -p tcp -m tcp --sport 5000 -j RETURN
-A openclash_output -s 192.168.1.3/32 -p udp -m udp --dport 5001 -j RETURN
-A openclash_output -s 192.168.1.3/32 -p udp -m udp --sport 5001 -j RETURN
-A openclash_output -s 192.168.1.3/32 -p tcp -m tcp --dport 5001 -j RETURN
-A openclash_output -s 192.168.1.3/32 -p tcp -m tcp --sport 5001 -j RETURN
-A openclash_output -m set --match-set localnetwork dst -j RETURN
-A openclash_output -m set --match-set localnetwork src -m set --match-set lan_ac_black_ports src -j RETURN
-A openclash_output -p tcp -m owner ! --uid-owner 65534 -j MARK --set-xmark 0x162/0xffffffff
COMMIT
# Completed on Sat Aug  6 14:25:21 2022

#IPv4 Filter chain

# Generated by iptables-save v1.8.7 on Sat Aug  6 14:25:21 2022
*filter
:INPUT ACCEPT [2290:142174]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [1:40]
:MINIUPNPD - [0:0]
:forwarding_lan_rule - [0:0]
:forwarding_rule - [0:0]
:forwarding_wan_rule - [0:0]
:input_lan_rule - [0:0]
:input_rule - [0:0]
:input_wan_rule - [0:0]
:openclash_wan_input - [0:0]
:output_lan_rule - [0:0]
:output_rule - [0:0]
:output_wan_rule - [0:0]
:reject - [0:0]
:zone_lan_dest_ACCEPT - [0:0]
:zone_lan_forward - [0:0]
:zone_lan_input - [0:0]
:zone_lan_output - [0:0]
:zone_lan_src_ACCEPT - [0:0]
:zone_wan_dest_ACCEPT - [0:0]
:zone_wan_forward - [0:0]
:zone_wan_input - [0:0]
:zone_wan_output - [0:0]
:zone_wan_src_ACCEPT - [0:0]
-A INPUT -i pppoe-wan -m set ! --match-set localnetwork src -j openclash_wan_input
-A INPUT -i lo -m comment --comment "!fw3" -j ACCEPT
-A INPUT -m comment --comment "!fw3: Custom input rule chain" -j input_rule
-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment "!fw3" -j ACCEPT
-A INPUT -i br-lan -m comment --comment "!fw3" -j zone_lan_input
-A INPUT -i pppoe-wan -m comment --comment "!fw3" -j zone_wan_input
-A FORWARD -o utun -m comment --comment "OpenClash TUN Forward" -j ACCEPT
-A FORWARD -m comment --comment "!fw3: Custom forwarding rule chain" -j forwarding_rule
-A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment "!fw3" -j ACCEPT
-A FORWARD -i br-lan -m comment --comment "!fw3" -j zone_lan_forward
-A FORWARD -i pppoe-wan -m comment --comment "!fw3" -j zone_wan_forward
-A OUTPUT -o lo -m comment --comment "!fw3" -j ACCEPT
-A OUTPUT -m comment --comment "!fw3: Custom output rule chain" -j output_rule
-A OUTPUT -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment "!fw3" -j ACCEPT
-A OUTPUT -o br-lan -m comment --comment "!fw3" -j zone_lan_output
-A OUTPUT -o pppoe-wan -m comment --comment "!fw3" -j zone_wan_output
-A MINIUPNPD -d 192.168.1.137/32 -p udp -m udp --dport 46655 -j ACCEPT
-A MINIUPNPD -d 192.168.1.134/32 -p udp -m udp --dport 36504 -j ACCEPT
-A openclash_wan_input -p udp -m multiport --dports 7892,7895,9090,7890,7891,7893,7874 -j REJECT --reject-with icmp-port-unreachable
-A openclash_wan_input -p tcp -m multiport --dports 7892,7895,9090,7890,7891,7893,7874 -j REJECT --reject-with icmp-port-unreachable
-A reject -p tcp -m comment --comment "!fw3" -j REJECT --reject-with tcp-reset
-A reject -m comment --comment "!fw3" -j REJECT --reject-with icmp-port-unreachable
-A zone_lan_dest_ACCEPT -o br-lan -m comment --comment "!fw3" -j ACCEPT
-A zone_lan_forward -m comment --comment "!fw3: Custom lan forwarding rule chain" -j forwarding_lan_rule
-A zone_lan_forward -m comment --comment "!fw3: Zone lan to wan forwarding policy" -j zone_wan_dest_ACCEPT
-A zone_lan_forward -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port forwards" -j ACCEPT
-A zone_lan_forward -m comment --comment "!fw3" -j zone_lan_dest_ACCEPT
-A zone_lan_input -m comment --comment "!fw3: Custom lan input rule chain" -j input_lan_rule
-A zone_lan_input -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port redirections" -j ACCEPT
-A zone_lan_input -m comment --comment "!fw3" -j zone_lan_src_ACCEPT
-A zone_lan_output -m comment --comment "!fw3: Custom lan output rule chain" -j output_lan_rule
-A zone_lan_output -m comment --comment "!fw3" -j zone_lan_dest_ACCEPT
-A zone_lan_src_ACCEPT -i br-lan -m conntrack --ctstate NEW,UNTRACKED -m comment --comment "!fw3" -j ACCEPT
-A zone_wan_dest_ACCEPT -o pppoe-wan -m conntrack --ctstate INVALID -m comment --comment "!fw3: Prevent NAT leakage" -j DROP
-A zone_wan_dest_ACCEPT -o pppoe-wan -m comment --comment "!fw3" -j ACCEPT
-A zone_wan_forward -j MINIUPNPD
-A zone_wan_forward -m comment --comment "!fw3: Custom wan forwarding rule chain" -j forwarding_wan_rule
-A zone_wan_forward -p esp -m comment --comment "!fw3: Allow-IPSec-ESP" -j zone_lan_dest_ACCEPT
-A zone_wan_forward -p udp -m udp --dport 500 -m comment --comment "!fw3: Allow-ISAKMP" -j zone_lan_dest_ACCEPT
-A zone_wan_forward -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port forwards" -j ACCEPT
-A zone_wan_forward -m comment --comment "!fw3" -j zone_wan_dest_ACCEPT
-A zone_wan_input -m comment --comment "!fw3: Custom wan input rule chain" -j input_wan_rule
-A zone_wan_input -p udp -m udp --dport 68 -m comment --comment "!fw3: Allow-DHCP-Renew" -j ACCEPT
-A zone_wan_input -p icmp -m icmp --icmp-type 8 -m comment --comment "!fw3: Allow-Ping" -j ACCEPT
-A zone_wan_input -p igmp -m comment --comment "!fw3: Allow-IGMP" -j ACCEPT
-A zone_wan_input -p tcp -m tcp --dport 8118 -m comment --comment "!fw3: adblock" -j DROP
-A zone_wan_input -p tcp -m tcp --dport 1688 -m comment --comment "!fw3: kms" -j ACCEPT
-A zone_wan_input -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port redirections" -j ACCEPT
-A zone_wan_input -m comment --comment "!fw3" -j zone_wan_src_ACCEPT
-A zone_wan_output -m comment --comment "!fw3: Custom wan output rule chain" -j output_wan_rule
-A zone_wan_output -m comment --comment "!fw3" -j zone_wan_dest_ACCEPT
-A zone_wan_src_ACCEPT -i pppoe-wan -m conntrack --ctstate NEW,UNTRACKED -m comment --comment "!fw3" -j ACCEPT
COMMIT
# Completed on Sat Aug  6 14:25:21 2022

#IPv6 NAT chain

# Generated by ip6tables-save v1.8.7 on Sat Aug  6 14:25:21 2022
*nat
:PREROUTING ACCEPT [373698:31934530]
:INPUT ACCEPT [62:5234]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
COMMIT
# Completed on Sat Aug  6 14:25:21 2022

#IPv6 Mangle chain

# Generated by ip6tables-save v1.8.7 on Sat Aug  6 14:25:21 2022
*mangle
:PREROUTING ACCEPT [29:2710]
:INPUT ACCEPT [1:64]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [21:2632]
:POSTROUTING ACCEPT [21:2632]
:RRDIPT_FORWARD - [0:0]
:RRDIPT_INPUT - [0:0]
:RRDIPT_OUTPUT - [0:0]
-A INPUT -j RRDIPT_INPUT
-A FORWARD -j RRDIPT_FORWARD
-A FORWARD -o pppoe-wan -p tcp -m tcp --tcp-flags SYN,RST SYN -m comment --comment "!fw3: Zone wan MTU fixing" -j TCPMSS --clamp-mss-to-pmtu
-A FORWARD -i pppoe-wan -p tcp -m tcp --tcp-flags SYN,RST SYN -m comment --comment "!fw3: Zone wan MTU fixing" -j TCPMSS --clamp-mss-to-pmtu
-A OUTPUT -j RRDIPT_OUTPUT
-A RRDIPT_FORWARD -s fda4:2767:47b6::119/128 -j RETURN
-A RRDIPT_FORWARD -d fda4:2767:47b6::119/128 -j RETURN
-A RRDIPT_FORWARD -s fe80::f790:2d25:8dde:d793/128 -j RETURN
-A RRDIPT_FORWARD -d fe80::f790:2d25:8dde:d793/128 -j RETURN
-A RRDIPT_FORWARD -s fe80::211:32ff:fe41:7eca/128 -j RETURN
-A RRDIPT_FORWARD -d fe80::211:32ff:fe41:7eca/128 -j RETURN
-A RRDIPT_FORWARD -s fe80::6cf:8cff:fe12:746b/128 -j RETURN
-A RRDIPT_FORWARD -d fe80::6cf:8cff:fe12:746b/128 -j RETURN
-A RRDIPT_FORWARD -s fe80::5577:e5c0:c87d:f950/128 -j RETURN
-A RRDIPT_FORWARD -d fe80::5577:e5c0:c87d:f950/128 -j RETURN
-A RRDIPT_FORWARD -s fe80::4231:3cff:fe50:cf59/128 -j RETURN
-A RRDIPT_FORWARD -d fe80::4231:3cff:fe50:cf59/128 -j RETURN
-A RRDIPT_FORWARD -s fe80::c207:69f9:f6a9:116d/128 -j RETURN
-A RRDIPT_FORWARD -d fe80::c207:69f9:f6a9:116d/128 -j RETURN
-A RRDIPT_FORWARD -s fe80::1cdb:11a2:69b:ab2c/128 -j RETURN
-A RRDIPT_FORWARD -d fe80::1cdb:11a2:69b:ab2c/128 -j RETURN
-A RRDIPT_FORWARD -s fe80::1400:46bd:9df2:49f5/128 -j RETURN
-A RRDIPT_FORWARD -d fe80::1400:46bd:9df2:49f5/128 -j RETURN
-A RRDIPT_FORWARD -s fe80::5ab6:23ff:fe28:ea0a/128 -j RETURN
-A RRDIPT_FORWARD -d fe80::5ab6:23ff:fe28:ea0a/128 -j RETURN
-A RRDIPT_FORWARD -s fe80::5b:5b4a:669e:40cc/128 -j RETURN
-A RRDIPT_FORWARD -d fe80::5b:5b4a:669e:40cc/128 -j RETURN
-A RRDIPT_FORWARD -s fe80::b090:3de3:f318:8910/128 -j RETURN
-A RRDIPT_FORWARD -d fe80::b090:3de3:f318:8910/128 -j RETURN
-A RRDIPT_INPUT -i eth0 -j RETURN
-A RRDIPT_INPUT -i br-lan -j RETURN
-A RRDIPT_INPUT -i pppoe-wan -j RETURN
-A RRDIPT_OUTPUT -o eth0 -j RETURN
-A RRDIPT_OUTPUT -o br-lan -j RETURN
-A RRDIPT_OUTPUT -o pppoe-wan -j RETURN
COMMIT
# Completed on Sat Aug  6 14:25:21 2022

#IPv6 Filter chain

# Generated by ip6tables-save v1.8.7 on Sat Aug  6 14:25:21 2022
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [24:1824]
:MINIUPNPD - [0:0]
:forwarding_lan_rule - [0:0]
:forwarding_rule - [0:0]
:forwarding_wan_rule - [0:0]
:input_lan_rule - [0:0]
:input_rule - [0:0]
:input_wan_rule - [0:0]
:output_lan_rule - [0:0]
:output_rule - [0:0]
:output_wan_rule - [0:0]
:reject - [0:0]
:zone_lan_dest_ACCEPT - [0:0]
:zone_lan_forward - [0:0]
:zone_lan_input - [0:0]
:zone_lan_output - [0:0]
:zone_lan_src_ACCEPT - [0:0]
:zone_wan_dest_ACCEPT - [0:0]
:zone_wan_forward - [0:0]
:zone_wan_input - [0:0]
:zone_wan_output - [0:0]
:zone_wan_src_ACCEPT - [0:0]
-A INPUT -i lo -m comment --comment "!fw3" -j ACCEPT
-A INPUT -m comment --comment "!fw3: Custom input rule chain" -j input_rule
-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment "!fw3" -j ACCEPT
-A INPUT -i br-lan -m comment --comment "!fw3" -j zone_lan_input
-A INPUT -i pppoe-wan -m comment --comment "!fw3" -j zone_wan_input
-A FORWARD -m comment --comment "!fw3: Custom forwarding rule chain" -j forwarding_rule
-A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment "!fw3" -j ACCEPT
-A FORWARD -i br-lan -m comment --comment "!fw3" -j zone_lan_forward
-A FORWARD -i pppoe-wan -m comment --comment "!fw3" -j zone_wan_forward
-A OUTPUT -o lo -m comment --comment "!fw3" -j ACCEPT
-A OUTPUT -m comment --comment "!fw3: Custom output rule chain" -j output_rule
-A OUTPUT -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment "!fw3" -j ACCEPT
-A OUTPUT -o br-lan -m comment --comment "!fw3" -j zone_lan_output
-A OUTPUT -o pppoe-wan -m comment --comment "!fw3" -j zone_wan_output
-A reject -p tcp -m comment --comment "!fw3" -j REJECT --reject-with tcp-reset
-A reject -m comment --comment "!fw3" -j REJECT --reject-with icmp6-port-unreachable
-A zone_lan_dest_ACCEPT -o br-lan -m comment --comment "!fw3" -j ACCEPT
-A zone_lan_forward -m comment --comment "!fw3: Custom lan forwarding rule chain" -j forwarding_lan_rule
-A zone_lan_forward -m comment --comment "!fw3: Zone lan to wan forwarding policy" -j zone_wan_dest_ACCEPT
-A zone_lan_forward -m comment --comment "!fw3" -j zone_lan_dest_ACCEPT
-A zone_lan_input -m comment --comment "!fw3: Custom lan input rule chain" -j input_lan_rule
-A zone_lan_input -m comment --comment "!fw3" -j zone_lan_src_ACCEPT
-A zone_lan_output -m comment --comment "!fw3: Custom lan output rule chain" -j output_lan_rule
-A zone_lan_output -m comment --comment "!fw3" -j zone_lan_dest_ACCEPT
-A zone_lan_src_ACCEPT -i br-lan -m conntrack --ctstate NEW,UNTRACKED -m comment --comment "!fw3" -j ACCEPT
-A zone_wan_dest_ACCEPT -o pppoe-wan -m conntrack --ctstate INVALID -m comment --comment "!fw3: Prevent NAT leakage" -j DROP
-A zone_wan_dest_ACCEPT -o pppoe-wan -m comment --comment "!fw3" -j ACCEPT
-A zone_wan_forward -j MINIUPNPD
-A zone_wan_forward -m comment --comment "!fw3: Custom wan forwarding rule chain" -j forwarding_wan_rule
-A zone_wan_forward -p ipv6-icmp -m icmp6 --icmpv6-type 128 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Forward" -j ACCEPT
-A zone_wan_forward -p ipv6-icmp -m icmp6 --icmpv6-type 129 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Forward" -j ACCEPT
-A zone_wan_forward -p ipv6-icmp -m icmp6 --icmpv6-type 1 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Forward" -j ACCEPT
-A zone_wan_forward -p ipv6-icmp -m icmp6 --icmpv6-type 2 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Forward" -j ACCEPT
-A zone_wan_forward -p ipv6-icmp -m icmp6 --icmpv6-type 3 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Forward" -j ACCEPT
-A zone_wan_forward -p ipv6-icmp -m icmp6 --icmpv6-type 4/0 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Forward" -j ACCEPT
-A zone_wan_forward -p ipv6-icmp -m icmp6 --icmpv6-type 4/1 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Forward" -j ACCEPT
-A zone_wan_forward -p esp -m comment --comment "!fw3: Allow-IPSec-ESP" -j zone_lan_dest_ACCEPT
-A zone_wan_forward -p udp -m udp --dport 500 -m comment --comment "!fw3: Allow-ISAKMP" -j zone_lan_dest_ACCEPT
-A zone_wan_forward -m comment --comment "!fw3" -j zone_wan_dest_ACCEPT
-A zone_wan_input -m comment --comment "!fw3: Custom wan input rule chain" -j input_wan_rule
-A zone_wan_input -s fc00::/6 -d fc00::/6 -p udp -m udp --dport 546 -m comment --comment "!fw3: Allow-DHCPv6" -j ACCEPT
-A zone_wan_input -s fe80::/10 -p ipv6-icmp -m icmp6 --icmpv6-type 130/0 -m comment --comment "!fw3: Allow-MLD" -j ACCEPT
-A zone_wan_input -s fe80::/10 -p ipv6-icmp -m icmp6 --icmpv6-type 131/0 -m comment --comment "!fw3: Allow-MLD" -j ACCEPT
-A zone_wan_input -s fe80::/10 -p ipv6-icmp -m icmp6 --icmpv6-type 132/0 -m comment --comment "!fw3: Allow-MLD" -j ACCEPT
-A zone_wan_input -s fe80::/10 -p ipv6-icmp -m icmp6 --icmpv6-type 143/0 -m comment --comment "!fw3: Allow-MLD" -j ACCEPT
-A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 128 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT
-A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 129 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT
-A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 1 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT
-A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 2 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT
-A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 3 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT
-A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 4/0 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT
-A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 4/1 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT
-A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 133 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT
-A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 135 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT
-A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 134 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT
-A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 136 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT
-A zone_wan_input -p tcp -m tcp --dport 8118 -m comment --comment "!fw3: adblock" -j DROP
-A zone_wan_input -p tcp -m tcp --dport 1688 -m comment --comment "!fw3: kms" -j ACCEPT
-A zone_wan_input -m comment --comment "!fw3" -j zone_wan_src_ACCEPT
-A zone_wan_output -m comment --comment "!fw3: Custom wan output rule chain" -j output_wan_rule
-A zone_wan_output -m comment --comment "!fw3" -j zone_wan_dest_ACCEPT
-A zone_wan_src_ACCEPT -i pppoe-wan -m conntrack --ctstate NEW,UNTRACKED -m comment --comment "!fw3" -j ACCEPT
COMMIT
# Completed on Sat Aug  6 14:25:21 2022

#===================== IPSET状态 =====================#

Name: lan_ac_black_ips
Name: lan_ac_black_ipv6s
Name: lan_ac_black_macs
Name: lan_ac_black_ports
Name: localnetwork

#===================== 路由表状态 =====================#

#route -n
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         114.88.160.1    0.0.0.0         UG    0      0        0 pppoe-wan
114.88.160.1    0.0.0.0         255.255.255.255 UH    0      0        0 pppoe-wan
192.168.1.0     0.0.0.0         255.255.255.0   U     0      0        0 br-lan
198.18.0.0      0.0.0.0         255.255.0.0     U     0      0        0 utun
#ip route list
default via 114.88.160.1 dev pppoe-wan proto static 
114.88.160.1 dev pppoe-wan proto kernel scope link src *WAN IP* 
192.168.1.0/24 dev br-lan proto kernel scope link src 192.168.1.1 
198.18.0.0/16 dev utun proto kernel scope link src 198.18.0.1 
#ip rule show
0:  from all lookup local
32765:  from all fwmark 0x162 lookup 354
32766:  from all lookup main
32767:  from all lookup default

#===================== Tun设备状态 =====================#

utun: tun

#===================== 端口占用状态 =====================#

tcp        0      0 0.0.0.0:32953           0.0.0.0:*               LISTEN      11266/clash
tcp        0      0 :::7890                 :::*                    LISTEN      11266/clash
tcp        0      0 :::7891                 :::*                    LISTEN      11266/clash
tcp        0      0 :::7892                 :::*                    LISTEN      11266/clash
tcp        0      0 :::7893                 :::*                    LISTEN      11266/clash
tcp        0      0 :::7895                 :::*                    LISTEN      11266/clash
tcp        0      0 :::9090                 :::*                    LISTEN      11266/clash
udp        0      0 0.0.0.0:59269           0.0.0.0:*                           11266/clash
udp        0      0 0.0.0.0:41094           0.0.0.0:*                           11266/clash
udp        0      0 0.0.0.0:37158           0.0.0.0:*                           11266/clash
udp        0      0 :::7874                 :::*                                11266/clash
udp        0      0 :::7891                 :::*                                11266/clash
udp        0      0 :::7892                 :::*                                11266/clash
udp        0      0 :::7893                 :::*                                11266/clash
udp        0      0 :::7895                 :::*                                11266/clash

#===================== 测试本机DNS查询 =====================#

Server:     127.0.0.1
Address:    127.0.0.1:53

Non-authoritative answer:
www.baidu.com   canonical name = www.a.shifen.com
Name:   www.a.shifen.com
Address: 180.101.49.11
Name:   www.a.shifen.com
Address: 180.101.49.12

#===================== resolv.conf.auto =====================#

# Interface wan
nameserver 114.114.114.114
nameserver 119.29.29.29

#===================== resolv.conf.d =====================#

# Interface wan
nameserver 114.114.114.114
nameserver 119.29.29.29

#===================== 测试本机网络连接 =====================#

HTTP/1.1 200 OK
Accept-Ranges: bytes
Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform
Connection: keep-alive
Content-Length: 277
Content-Type: text/html
Date: Sat, 06 Aug 2022 06:25:21 GMT
Etag: "575e1f60-115"
Last-Modified: Mon, 13 Jun 2016 02:50:08 GMT
Pragma: no-cache
Server: bfe/1.0.8.18

#===================== 测试本机网络下载 =====================#

HTTP/2 200 
cache-control: max-age=300
content-security-policy: default-src 'none'; style-src 'unsafe-inline'; sandbox
content-type: text/plain; charset=utf-8
etag: "8c9c2724dbecd721d24a35117a8c4e28d61e5a152a6107e6a8242986b9ec1eba"
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
x-frame-options: deny
x-xss-protection: 1; mode=block
x-github-request-id: 8952:4ADD:162DB:27114:62ED7572
accept-ranges: bytes
date: Sat, 06 Aug 2022 06:46:05 GMT
via: 1.1 varnish
x-served-by: cache-hkg17931-HKG
x-cache: HIT
x-cache-hits: 4
x-timer: S1659768365.217442,VS0,VE0
vary: Authorization,Accept-Encoding,Origin
access-control-allow-origin: *
x-fastly-request-id: 99dccee7d074800a2d9219bb072dea5c8beedbc1
expires: Sat, 06 Aug 2022 06:51:05 GMT
source-age: 120
content-length: 80
vernesong commented 2 years ago

ipset list localnetwork 有没有wan的ip

或者把5001加到访问控制里去，绕过核心

Se7enMuting commented 2 years ago

ipset list localnetwork 有没有wan的ip

这个我不知道具体哪里看？我在openclash生成的调试日志里搜索我的wan口ip，是没有的。

我NAS有很多端口应用，不止5001一个，有没有办法指定 域名 绕过核心。。。

vernesong commented 2 years ago

ssh命令

Se7enMuting commented 2 years ago

哦，ipset list 里看到了，现在是有我wan的IP的，但现在暂时没有这个问题了，当时报错的时候什么情况不清楚了