search

vernesong / OpenClash

A Clash Client For OpenWrt
MIT License
16.72k stars 3.09k forks source link

[Bug] 0.45.47版本更新后，导致代理失效 #2617

Closed ikelvingo closed 1 year ago

ikelvingo commented 2 years ago

Verify Steps

OpenClash Version

v0.45.16/v0.45.41

Bug on Environment

Lean

Bug on Platform

Linux-amd64(x86-64)

To Reproduce

升级至最新的v0.45.47版本，透明代理失效，切换redir-host/fake-ip，更换clash core均无法恢复正常。 验证v0.45.16-v0.45.41间各版本，相同配置均可正常代理。

Describe the Bug

代理失效，openclash日志及core日志均无异常抛出。

OpenClash Log

OpenClash 调试日志

OpenClash 调试日志

生成时间: 2022-08-09 03:10:11 插件版本: v0.45.47-beta 隐私提示: 上传此日志前请注意检查、屏蔽公网IP、节点、密码等相关敏感信息



#===================== 系统信息 =====================#

主机型号: Intel(R) Xeon(R) CPU E31220L @ 2.20GHz : 2 Core 4 Thread
固件版本: OpenWrt 19.07-SNAPSHOT r0-b68a895
LuCI版本: git-20.107.27810-58970bb-1
内核版本: 4.14.172
处理器架构: 

#此项有值时,如不使用IPv6,建议到网络-接口-lan的设置中禁用IPV6的DHCP
IPV6-DHCP: 

#此项结果应仅有配置文件的DNS监听地址
Dnsmasq转发设置: 127.0.0.1#7874

#===================== 依赖检查 =====================#

dnsmasq-full: 已安装
coreutils: 已安装
coreutils-nohup: 已安装
bash: 已安装
curl: 已安装
ca-certificates: 已安装
ipset: 已安装
ip-full: 已安装
iptables-mod-tproxy: 已安装
kmod-ipt-tproxy: 已安装
iptables-mod-extra: 已安装
kmod-ipt-extra: 已安装
libcap: 已安装
libcap-bin: 已安装
ruby: 已安装
ruby-yaml: 已安装
ruby-psych: 已安装
ruby-pstore: 已安装
kmod-tun(TUN模式): 已安装
luci-compat(Luci-19.07): 已安装
kmod-inet-diag(PROCESS-NAME): 已安装
unzip: 已安装

#===================== 内核检查 =====================#

运行状态: 运行中
进程pid: 32628
运行权限: 32628: cap_dac_override,cap_net_bind_service,cap_net_admin,cap_net_raw,cap_sys_ptrace,cap_sys_resource=eip
运行用户: nobody
已选择的架构: linux-amd64

#下方无法显示内核版本号时请确认您的内核版本是否正确或者有无权限
Tun内核版本: 2022.07.07-7-g56f0a92
Tun内核文件: 存在
Tun内核运行权限: 正常

Dev内核版本: v1.11.4-6-gbec4df7
Dev内核文件: 存在
Dev内核运行权限: 正常

Meta内核版本: alpha-g2899a12
Meta内核文件: 存在
Meta内核运行权限: 正常

#===================== 插件设置 =====================#

当前配置文件: /etc/openclash/config/000.yaml
启动配置文件: /etc/openclash/000.yaml
运行模式: fake-ip
默认代理模式: rule
UDP流量转发(tproxy): 启用
DNS劫持: 启用
自定义DNS: 启用
IPV6代理: 停用
IPV6-DNS解析: 停用
禁用Dnsmasq缓存: 启用
自定义规则: 停用
仅允许内网: 启用
仅代理命中规则流量: 停用
仅允许常用端口流量: 停用
绕过中国大陆IP: 停用
DNS远程解析: 停用
路由本机代理: 启用

#启动异常时建议关闭此项后重试
混合节点: 停用
保留配置: 停用

#启动异常时建议关闭此项后重试
第三方规则: 停用

#===================== 配置文件 =====================#

tproxy-port: 7895
mixed-port: 7893
bind-address: "*"
external-ui: "/usr/share/openclash/ui"
ipv6: false
geodata-mode: true
geodata-loader: standard
tcp-concurrent: true
sniffer:
  enable: true
  sniffing:
  - tls
  - http
profile:
  store-selected: true
  store-fake-ip: true
hosts:
  dms.ikelvin.space: 192.168.10.99
authentication:
- Clash:DqTHkhhM
rule-providers:
  放行规则-ConnersHua(建议置顶并直连):
    type: http
    behavior: classical
    path: "/etc/openclash/rule_provider/Unbreak.yaml"
    url: https://raw.githubusercontent.com/DivineEngine/Profiles/master/Clash/RuleSet/Unbreak.yaml
    interval: 86400
  国内IP白名单:
    type: http
    behavior: ipcidr
    path: "/etc/openclash/rule_provider/ChinaIP.yaml"
    url: https://raw.githubusercontent.com/DivineEngine/Profiles/master/Clash/RuleSet/Extra/ChinaIP.yaml
    interval: 86400
  国内域名白名单:
    type: http
    behavior: classical
    path: "/etc/openclash/rule_provider/China.yaml"
    url: https://raw.githubusercontent.com/DivineEngine/Profiles/master/Clash/RuleSet/China.yaml
    interval: 86400

#===================== 防火墙设置 =====================#

#IPv4 NAT chain

# Generated by iptables-save v1.8.3 on Tue Aug  9 03:10:14 2022
*nat
:PREROUTING ACCEPT [127:10965]
:INPUT ACCEPT [219:14497]
:OUTPUT ACCEPT [846:55367]
:POSTROUTING ACCEPT [154:9917]
:MINIUPNPD - [0:0]
:MINIUPNPD-POSTROUTING - [0:0]
:PSW - [0:0]
:PSW_ACL - [0:0]
:openclash - [0:0]
:openclash_output - [0:0]
:postrouting_lan_rule - [0:0]
:postrouting_rule - [0:0]
:postrouting_wan_rule - [0:0]
:prerouting_lan_rule - [0:0]
:prerouting_rule - [0:0]
:prerouting_wan_rule - [0:0]
:zone_lan_postrouting - [0:0]
:zone_lan_prerouting - [0:0]
:zone_wan_postrouting - [0:0]
:zone_wan_prerouting - [0:0]
-A PREROUTING -d 8.8.4.4/32 -p tcp -m comment --comment "OpenClash Google DNS Hijack" -m tcp --dport 53 -j REDIRECT --to-ports 7892
-A PREROUTING -d 8.8.8.8/32 -p tcp -m comment --comment "OpenClash Google DNS Hijack" -m tcp --dport 53 -j REDIRECT --to-ports 7892
-A PREROUTING -p tcp -m tcp --dport 53 -m comment --comment "OpenClash DNS Hijack" -j REDIRECT --to-ports 53
-A PREROUTING -p udp -m udp --dport 53 -m comment --comment "OpenClash DNS Hijack" -j REDIRECT --to-ports 53
-A PREROUTING -m comment --comment "!fw3: Custom prerouting rule chain" -j prerouting_rule
-A PREROUTING -p tcp -j PSW
-A PREROUTING -i br-lan -m comment --comment "!fw3" -j zone_lan_prerouting
-A PREROUTING -i eth1 -m comment --comment "!fw3" -j zone_wan_prerouting
-A PREROUTING -p tcp -j openclash
-A OUTPUT -j openclash_output
-A POSTROUTING -m comment --comment "!fw3: Custom postrouting rule chain" -j postrouting_rule
-A POSTROUTING -o br-lan -m comment --comment "!fw3" -j zone_lan_postrouting
-A POSTROUTING -o eth1 -m comment --comment "!fw3" -j zone_wan_postrouting
-A PSW -m set --match-set laniplist dst -j RETURN
-A PSW -m set --match-set vpsiplist dst -j RETURN
-A PSW -m set --match-set whitelist dst -j RETURN
-A PSW -j PSW_ACL
-A PSW_ACL -p tcp -m comment --comment "\'默认\'" -m set --match-set blacklist dst -j REDIRECT --to-ports 1041
-A PSW_ACL -p tcp -m comment --comment "\'默认\'" -m set ! --match-set chnroute dst -j REDIRECT --to-ports 1041
-A PSW_ACL -p tcp -m comment --comment "\'默认\'" -j RETURN
-A openclash -p tcp -m tcp --sport 1688 -j RETURN
-A openclash -p tcp -m tcp --sport 5222 -j RETURN
-A openclash -m set --match-set localnetwork dst -j RETURN
-A openclash -m set --match-set wan_ac_black_ips dst -j RETURN
-A openclash -p tcp -j REDIRECT --to-ports 7892
-A openclash_output -p tcp -m tcp --sport 1688 -j RETURN
-A openclash_output -p tcp -m tcp --sport 5222 -j RETURN
-A openclash_output -s 192.168.10.99/32 -p tcp -m tcp --dport 5006 -j RETURN
-A openclash_output -s 192.168.10.99/32 -p tcp -m tcp --sport 5006 -j RETURN
-A openclash_output -s 192.168.10.99/32 -p tcp -m tcp --dport 5000:5001 -j RETURN
-A openclash_output -s 192.168.10.99/32 -p tcp -m tcp --sport 5000:5001 -j RETURN
-A openclash_output -s 192.168.10.99/32 -p tcp -m tcp --dport 443:444 -j RETURN
-A openclash_output -s 192.168.10.99/32 -p tcp -m tcp --sport 443:444 -j RETURN
-A openclash_output -s 192.168.10.99/32 -p tcp -m tcp --dport 6690 -j RETURN
-A openclash_output -s 192.168.10.99/32 -p tcp -m tcp --sport 6690 -j RETURN
-A openclash_output -s 192.168.10.1/32 -p tcp -m tcp --dport 1688 -j RETURN
-A openclash_output -s 192.168.10.1/32 -p tcp -m tcp --sport 1688 -j RETURN
-A openclash_output -s 192.168.10.13/32 -p tcp -m tcp --dport 33313 -j RETURN
-A openclash_output -s 192.168.10.13/32 -p tcp -m tcp --sport 3389 -j RETURN
-A openclash_output -s 192.168.10.19/32 -p tcp -m tcp --dport 33319 -j RETURN
-A openclash_output -s 192.168.10.19/32 -p tcp -m tcp --sport 3389 -j RETURN
-A openclash_output -s 192.168.10.17/32 -p tcp -m tcp --dport 33317 -j RETURN
-A openclash_output -s 192.168.10.17/32 -p tcp -m tcp --sport 3389 -j RETURN
-A openclash_output -s 192.168.10.15/32 -p tcp -m tcp --dport 33315 -j RETURN
-A openclash_output -s 192.168.10.15/32 -p tcp -m tcp --sport 3389 -j RETURN
-A openclash_output -s 192.168.10.2/32 -p tcp -m tcp --dport 33302 -j RETURN
-A openclash_output -s 192.168.10.2/32 -p tcp -m tcp --sport 3389 -j RETURN
-A openclash_output -s 192.168.10.1/32 -p tcp -m tcp --dport 33301 -j RETURN
-A openclash_output -s 192.168.10.1/32 -p tcp -m tcp --sport 80 -j RETURN
-A openclash_output -m set --match-set localnetwork dst -j RETURN
-A openclash_output -d 198.18.0.0/16 -p tcp -m owner ! --uid-owner 65534 -j REDIRECT --to-ports 7892
-A openclash_output -p tcp -m owner ! --uid-owner 65534 -j REDIRECT --to-ports 7892
-A zone_lan_postrouting -m comment --comment "!fw3: Custom lan postrouting rule chain" -j postrouting_lan_rule
-A zone_lan_postrouting -s 192.168.10.0/24 -d 192.168.10.1/32 -p tcp -m tcp --dport 80 -m comment --comment "!fw3: Gateway (reflection)" -j SNAT --to-source 192.168.10.1
-A zone_lan_postrouting -s 192.168.10.0/24 -d 192.168.10.2/32 -p tcp -m tcp --dport 3389 -m comment --comment "!fw3: RDP (reflection)" -j SNAT --to-source 192.168.10.1
-A zone_lan_postrouting -s 192.168.10.0/24 -d 192.168.10.15/32 -p tcp -m tcp --dport 3389 -m comment --comment "!fw3: RDP (reflection)" -j SNAT --to-source 192.168.10.1
-A zone_lan_postrouting -s 192.168.10.0/24 -d 192.168.10.17/32 -p tcp -m tcp --dport 3389 -m comment --comment "!fw3: RDP (reflection)" -j SNAT --to-source 192.168.10.1
-A zone_lan_postrouting -s 192.168.10.0/24 -d 192.168.10.19/32 -p tcp -m tcp --dport 3389 -m comment --comment "!fw3: RDP (reflection)" -j SNAT --to-source 192.168.10.1
-A zone_lan_postrouting -s 192.168.10.0/24 -d 192.168.10.13/32 -p tcp -m tcp --dport 3389 -m comment --comment "!fw3: RDP (reflection)" -j SNAT --to-source 192.168.10.1
-A zone_lan_postrouting -s 192.168.10.0/24 -d 192.168.10.1/32 -p tcp -m tcp --dport 1688 -m comment --comment "!fw3: KMS (reflection)" -j SNAT --to-source 192.168.10.1
-A zone_lan_postrouting -s 192.168.10.0/24 -d 192.168.10.99/32 -p tcp -m tcp --dport 6690 -m comment --comment "!fw3: DSM-CS (reflection)" -j SNAT --to-source 192.168.10.1
-A zone_lan_postrouting -s 192.168.10.0/24 -d 192.168.10.99/32 -p tcp -m tcp --dport 443:444 -m comment --comment "!fw3: DSM-HTTPS (reflection)" -j SNAT --to-source 192.168.10.1
-A zone_lan_postrouting -s 192.168.10.0/24 -d 192.168.10.99/32 -p tcp -m tcp --dport 5000:5001 -m comment --comment "!fw3: DSM-HOME (reflection)" -j SNAT --to-source 192.168.10.1
-A zone_lan_postrouting -s 192.168.10.0/24 -d 192.168.10.99/32 -p tcp -m tcp --dport 5006 -m comment --comment "!fw3: DSM-WEBDAV (reflection)" -j SNAT --to-source 192.168.10.1
-A zone_lan_prerouting -m comment --comment "!fw3: Custom lan prerouting rule chain" -j prerouting_lan_rule
-A zone_lan_prerouting -s 192.168.10.0/24 -d 192.168.1.100/32 -p tcp -m tcp --dport 33301 -m comment --comment "!fw3: Gateway (reflection)" -j DNAT --to-destination 192.168.10.1:80
-A zone_lan_prerouting -s 192.168.10.0/24 -d 192.168.1.100/32 -p tcp -m tcp --dport 33302 -m comment --comment "!fw3: RDP (reflection)" -j DNAT --to-destination 192.168.10.2:3389
-A zone_lan_prerouting -s 192.168.10.0/24 -d 192.168.1.100/32 -p tcp -m tcp --dport 33315 -m comment --comment "!fw3: RDP (reflection)" -j DNAT --to-destination 192.168.10.15:3389
-A zone_lan_prerouting -s 192.168.10.0/24 -d 192.168.1.100/32 -p tcp -m tcp --dport 33317 -m comment --comment "!fw3: RDP (reflection)" -j DNAT --to-destination 192.168.10.17:3389
-A zone_lan_prerouting -s 192.168.10.0/24 -d 192.168.1.100/32 -p tcp -m tcp --dport 33319 -m comment --comment "!fw3: RDP (reflection)" -j DNAT --to-destination 192.168.10.19:3389
-A zone_lan_prerouting -s 192.168.10.0/24 -d 192.168.1.100/32 -p tcp -m tcp --dport 33313 -m comment --comment "!fw3: RDP (reflection)" -j DNAT --to-destination 192.168.10.13:3389
-A zone_lan_prerouting -s 192.168.10.0/24 -d 192.168.1.100/32 -p tcp -m tcp --dport 1688 -m comment --comment "!fw3: KMS (reflection)" -j DNAT --to-destination 192.168.10.1:1688
-A zone_lan_prerouting -s 192.168.10.0/24 -d 192.168.1.100/32 -p tcp -m tcp --dport 6690 -m comment --comment "!fw3: DSM-CS (reflection)" -j DNAT --to-destination 192.168.10.99:6690
-A zone_lan_prerouting -s 192.168.10.0/24 -d 192.168.1.100/32 -p tcp -m tcp --dport 443:444 -m comment --comment "!fw3: DSM-HTTPS (reflection)" -j DNAT --to-destination 192.168.10.99:443-444
-A zone_lan_prerouting -s 192.168.10.0/24 -d 192.168.1.100/32 -p tcp -m tcp --dport 5000:5001 -m comment --comment "!fw3: DSM-HOME (reflection)" -j DNAT --to-destination 192.168.10.99:5000-5001
-A zone_lan_prerouting -s 192.168.10.0/24 -d 192.168.1.100/32 -p tcp -m tcp --dport 5006 -m comment --comment "!fw3: DSM-WEBDAV (reflection)" -j DNAT --to-destination 192.168.10.99:5006
-A zone_wan_postrouting -m comment --comment "!fw3: Custom wan postrouting rule chain" -j postrouting_wan_rule
-A zone_wan_postrouting -j MINIUPNPD-POSTROUTING
-A zone_wan_postrouting -m comment --comment "!fw3" -j FULLCONENAT
-A zone_wan_prerouting -m comment --comment "!fw3: Custom wan prerouting rule chain" -j prerouting_wan_rule
-A zone_wan_prerouting -p tcp -m tcp --dport 33301 -m comment --comment "!fw3: Gateway" -j DNAT --to-destination 192.168.10.1:80
-A zone_wan_prerouting -p tcp -m tcp --dport 33302 -m comment --comment "!fw3: RDP" -j DNAT --to-destination 192.168.10.2:3389
-A zone_wan_prerouting -p tcp -m tcp --dport 33315 -m comment --comment "!fw3: RDP" -j DNAT --to-destination 192.168.10.15:3389
-A zone_wan_prerouting -p tcp -m tcp --dport 33317 -m comment --comment "!fw3: RDP" -j DNAT --to-destination 192.168.10.17:3389
-A zone_wan_prerouting -p tcp -m tcp --dport 33319 -m comment --comment "!fw3: RDP" -j DNAT --to-destination 192.168.10.19:3389
-A zone_wan_prerouting -p tcp -m tcp --dport 33313 -m comment --comment "!fw3: RDP" -j DNAT --to-destination 192.168.10.13:3389
-A zone_wan_prerouting -p tcp -m tcp --dport 1688 -m comment --comment "!fw3: KMS" -j DNAT --to-destination 192.168.10.1:1688
-A zone_wan_prerouting -p tcp -m tcp --dport 6690 -m comment --comment "!fw3: DSM-CS" -j DNAT --to-destination 192.168.10.99:6690
-A zone_wan_prerouting -p tcp -m tcp --dport 443:444 -m comment --comment "!fw3: DSM-HTTPS" -j DNAT --to-destination 192.168.10.99:443-444
-A zone_wan_prerouting -p tcp -m tcp --dport 5000:5001 -m comment --comment "!fw3: DSM-HOME" -j DNAT --to-destination 192.168.10.99:5000-5001
-A zone_wan_prerouting -p tcp -m tcp --dport 5006 -m comment --comment "!fw3: DSM-WEBDAV" -j DNAT --to-destination 192.168.10.99:5006
-A zone_wan_prerouting -m comment --comment "!fw3" -j FULLCONENAT
-A zone_wan_prerouting -j MINIUPNPD
COMMIT
# Completed on Tue Aug  9 03:10:14 2022

#IPv4 Mangle chain

# Generated by iptables-save v1.8.3 on Tue Aug  9 03:10:14 2022
*mangle
:PREROUTING ACCEPT [91728:97158743]
:INPUT ACCEPT [185339:103678840]
:FORWARD ACCEPT [10:1079]
:OUTPUT ACCEPT [182297:103875625]
:POSTROUTING ACCEPT [182312:103877227]
:PSW - [0:0]
:PSW_ACL - [0:0]
:PSW_OUTPUT - [0:0]
:openclash - [0:0]
-A PREROUTING -j PSW
-A PREROUTING -p udp -j openclash
-A FORWARD -o eth1 -p tcp -m tcp --tcp-flags SYN,RST SYN -m comment --comment "!fw3: Zone wan MTU fixing" -j TCPMSS --clamp-mss-to-pmtu
-A OUTPUT -p udp -j PSW_OUTPUT
-A PSW -m set --match-set laniplist dst -j RETURN
-A PSW -m set --match-set vpsiplist dst -j RETURN
-A PSW -m set --match-set whitelist dst -j RETURN
-A PSW -j PSW_ACL
-A PSW_ACL -p udp -m comment --comment "\'默认\'" -m set --match-set blacklist dst -j TPROXY --on-port 1051 --on-ip 0.0.0.0 --tproxy-mark 0x1/0x1
-A PSW_ACL -p udp -m comment --comment "\'默认\'" -m set ! --match-set chnroute dst -j TPROXY --on-port 1051 --on-ip 0.0.0.0 --tproxy-mark 0x1/0x1
-A PSW_ACL -p udp -m comment --comment "\'默认\'" -j RETURN
-A PSW_OUTPUT -m set --match-set laniplist dst -j RETURN
-A PSW_OUTPUT -d 198.18.0.67/32 -p udp -m udp --dport 29863 -m comment --comment "\'iepl.hk.b22f.6in4.dev:29863\'" -j RETURN
-A PSW_OUTPUT -m set --match-set vpsiplist dst -j RETURN
-A PSW_OUTPUT -m set --match-set whitelist dst -j RETURN
-A PSW_OUTPUT -p udp -m set --match-set blacklist dst -j MARK --set-xmark 0x1/0xffffffff
-A PSW_OUTPUT -p udp -m set ! --match-set chnroute dst -j MARK --set-xmark 0x1/0xffffffff
-A openclash -p udp -m udp --sport 500 -j RETURN
-A openclash -p udp -m udp --sport 68 -j RETURN
-A openclash -m set --match-set localnetwork dst -j RETURN
-A openclash -m set --match-set wan_ac_black_ips dst -j RETURN
-A openclash -p udp -m udp --dport 53 -j RETURN
-A openclash -p udp -j TPROXY --on-port 7895 --on-ip 0.0.0.0 --tproxy-mark 0x162/0xffffffff
COMMIT
# Completed on Tue Aug  9 03:10:14 2022

#IPv4 Filter chain

# Generated by iptables-save v1.8.3 on Tue Aug  9 03:10:14 2022
*filter
:INPUT ACCEPT [7:280]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:MINIUPNPD - [0:0]
:forwarding_lan_rule - [0:0]
:forwarding_rule - [0:0]
:forwarding_wan_rule - [0:0]
:input_lan_rule - [0:0]
:input_rule - [0:0]
:input_wan_rule - [0:0]
:openclash_wan_input - [0:0]
:output_lan_rule - [0:0]
:output_rule - [0:0]
:output_wan_rule - [0:0]
:reject - [0:0]
:zone_lan_dest_ACCEPT - [0:0]
:zone_lan_forward - [0:0]
:zone_lan_input - [0:0]
:zone_lan_output - [0:0]
:zone_lan_src_ACCEPT - [0:0]
:zone_wan_dest_ACCEPT - [0:0]
:zone_wan_dest_REJECT - [0:0]
:zone_wan_forward - [0:0]
:zone_wan_input - [0:0]
:zone_wan_output - [0:0]
:zone_wan_src_REJECT - [0:0]
-A INPUT -i eth1 -m set ! --match-set localnetwork src -j openclash_wan_input
-A INPUT -s 127.0.0.1/32 -d 127.0.0.1/32 -i lo -p tcp -m tcp --dport 55929 -j DROP
-A INPUT -i br-lan -p tcp -m tcp --dport 16363 -j ACCEPT
-A INPUT -i lo -m comment --comment "!fw3" -j ACCEPT
-A INPUT -m comment --comment "!fw3: Custom input rule chain" -j input_rule
-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment "!fw3" -j ACCEPT
-A INPUT -i br-lan -m comment --comment "!fw3" -j zone_lan_input
-A INPUT -i eth1 -m comment --comment "!fw3" -j zone_wan_input
-A FORWARD -m comment --comment "!fw3: Custom forwarding rule chain" -j forwarding_rule
-A FORWARD -m comment --comment "!fw3: Traffic offloading" -m conntrack --ctstate RELATED,ESTABLISHED -j FLOWOFFLOAD --hw
-A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment "!fw3" -j ACCEPT
-A FORWARD -i br-lan -m comment --comment "!fw3" -j zone_lan_forward
-A FORWARD -i eth1 -m comment --comment "!fw3" -j zone_wan_forward
-A OUTPUT -o lo -m comment --comment "!fw3" -j ACCEPT
-A OUTPUT -m comment --comment "!fw3: Custom output rule chain" -j output_rule
-A OUTPUT -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment "!fw3" -j ACCEPT
-A OUTPUT -o br-lan -m comment --comment "!fw3" -j zone_lan_output
-A OUTPUT -o eth1 -m comment --comment "!fw3" -j zone_wan_output
-A openclash_wan_input -p udp -m multiport --dports 7892,7895,9090,7890,7891,7893,7874 -j REJECT --reject-with icmp-port-unreachable
-A openclash_wan_input -p tcp -m multiport --dports 7892,7895,9090,7890,7891,7893,7874 -j REJECT --reject-with icmp-port-unreachable
-A reject -p tcp -m comment --comment "!fw3" -j REJECT --reject-with tcp-reset
-A reject -m comment --comment "!fw3" -j REJECT --reject-with icmp-port-unreachable
-A zone_lan_dest_ACCEPT -o br-lan -m comment --comment "!fw3" -j ACCEPT
-A zone_lan_forward -m comment --comment "!fw3: Custom lan forwarding rule chain" -j forwarding_lan_rule
-A zone_lan_forward -s 192.168.10.77/32 -p tcp -m tcp --dport 5222 -m mac --mac-source 3C:2A:F4:07:26:80 -m comment --comment "!fw3: Google Cloud Print" -j zone_wan_dest_ACCEPT
-A zone_lan_forward -m comment --comment "!fw3: Zone lan to wan forwarding policy" -j zone_wan_dest_ACCEPT
-A zone_lan_forward -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port forwards" -j ACCEPT
-A zone_lan_forward -m comment --comment "!fw3" -j zone_lan_dest_ACCEPT
-A zone_lan_input -m comment --comment "!fw3: Custom lan input rule chain" -j input_lan_rule
-A zone_lan_input -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port redirections" -j ACCEPT
-A zone_lan_input -m comment --comment "!fw3" -j zone_lan_src_ACCEPT
-A zone_lan_output -m comment --comment "!fw3: Custom lan output rule chain" -j output_lan_rule
-A zone_lan_output -m comment --comment "!fw3" -j zone_lan_dest_ACCEPT
-A zone_lan_src_ACCEPT -i br-lan -m conntrack --ctstate NEW,UNTRACKED -m comment --comment "!fw3" -j ACCEPT
-A zone_wan_dest_ACCEPT -o eth1 -m conntrack --ctstate INVALID -m comment --comment "!fw3: Prevent NAT leakage" -j DROP
-A zone_wan_dest_ACCEPT -o eth1 -m comment --comment "!fw3" -j ACCEPT
-A zone_wan_dest_REJECT -o eth1 -m comment --comment "!fw3" -j reject
-A zone_wan_forward -m comment --comment "!fw3: Custom wan forwarding rule chain" -j forwarding_wan_rule
-A zone_wan_forward -p esp -m comment --comment "!fw3: Allow-IPSec-ESP" -j zone_lan_dest_ACCEPT
-A zone_wan_forward -p udp -m udp --dport 500 -m comment --comment "!fw3: Allow-ISAKMP" -j zone_lan_dest_ACCEPT
-A zone_wan_forward -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port forwards" -j ACCEPT
-A zone_wan_forward -j MINIUPNPD
-A zone_wan_forward -m comment --comment "!fw3" -j zone_wan_dest_REJECT
-A zone_wan_input -m comment --comment "!fw3: Custom wan input rule chain" -j input_wan_rule
-A zone_wan_input -p udp -m udp --dport 68 -m comment --comment "!fw3: Allow-DHCP-Renew" -j ACCEPT
-A zone_wan_input -p icmp -m icmp --icmp-type 8 -m comment --comment "!fw3: Allow-Ping" -j ACCEPT
-A zone_wan_input -p igmp -m comment --comment "!fw3: Allow-IGMP" -j ACCEPT
-A zone_wan_input -p tcp -m tcp --dport 8118 -m comment --comment "!fw3: adblock" -j DROP
-A zone_wan_input -p tcp -m tcp --dport 1688 -m comment --comment "!fw3: kms" -j ACCEPT
-A zone_wan_input -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port redirections" -j ACCEPT
-A zone_wan_input -m comment --comment "!fw3" -j zone_wan_src_REJECT
-A zone_wan_output -m comment --comment "!fw3: Custom wan output rule chain" -j output_wan_rule
-A zone_wan_output -m comment --comment "!fw3" -j zone_wan_dest_ACCEPT
-A zone_wan_src_REJECT -i eth1 -m comment --comment "!fw3" -j reject
COMMIT
# Completed on Tue Aug  9 03:10:14 2022

#IPv6 NAT chain

# Generated by ip6tables-save v1.8.3 on Tue Aug  9 03:10:14 2022
*nat
:PREROUTING ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:OUTPUT ACCEPT [2346:187680]
:POSTROUTING ACCEPT [2346:187680]
COMMIT
# Completed on Tue Aug  9 03:10:14 2022

#IPv6 Mangle chain

# Generated by ip6tables-save v1.8.3 on Tue Aug  9 03:10:14 2022
*mangle
:PREROUTING ACCEPT [21666:2597238]
:INPUT ACCEPT [21651:2596158]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [21666:2597582]
:POSTROUTING ACCEPT [21658:2596894]
-A FORWARD -o eth1 -p tcp -m tcp --tcp-flags SYN,RST SYN -m comment --comment "!fw3: Zone wan MTU fixing" -j TCPMSS --clamp-mss-to-pmtu
COMMIT
# Completed on Tue Aug  9 03:10:14 2022

#IPv6 Filter chain

# Generated by ip6tables-save v1.8.3 on Tue Aug  9 03:10:14 2022
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [4:384]
:MINIUPNPD - [0:0]
:forwarding_lan_rule - [0:0]
:forwarding_rule - [0:0]
:forwarding_wan_rule - [0:0]
:input_lan_rule - [0:0]
:input_rule - [0:0]
:input_wan_rule - [0:0]
:output_lan_rule - [0:0]
:output_rule - [0:0]
:output_wan_rule - [0:0]
:reject - [0:0]
:zone_lan_dest_ACCEPT - [0:0]
:zone_lan_forward - [0:0]
:zone_lan_input - [0:0]
:zone_lan_output - [0:0]
:zone_lan_src_ACCEPT - [0:0]
:zone_wan_dest_ACCEPT - [0:0]
:zone_wan_dest_REJECT - [0:0]
:zone_wan_forward - [0:0]
:zone_wan_input - [0:0]
:zone_wan_output - [0:0]
:zone_wan_src_REJECT - [0:0]
-A INPUT -i lo -m comment --comment "!fw3" -j ACCEPT
-A INPUT -m comment --comment "!fw3: Custom input rule chain" -j input_rule
-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment "!fw3" -j ACCEPT
-A INPUT -i br-lan -m comment --comment "!fw3" -j zone_lan_input
-A INPUT -i eth1 -m comment --comment "!fw3" -j zone_wan_input
-A FORWARD -m comment --comment "!fw3: Custom forwarding rule chain" -j forwarding_rule
-A FORWARD -m comment --comment "!fw3: Traffic offloading" -m conntrack --ctstate RELATED,ESTABLISHED -j FLOWOFFLOAD --hw
-A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment "!fw3" -j ACCEPT
-A FORWARD -i br-lan -m comment --comment "!fw3" -j zone_lan_forward
-A FORWARD -i eth1 -m comment --comment "!fw3" -j zone_wan_forward
-A OUTPUT -o lo -m comment --comment "!fw3" -j ACCEPT
-A OUTPUT -m comment --comment "!fw3: Custom output rule chain" -j output_rule
-A OUTPUT -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment "!fw3" -j ACCEPT
-A OUTPUT -o br-lan -m comment --comment "!fw3" -j zone_lan_output
-A OUTPUT -o eth1 -m comment --comment "!fw3" -j zone_wan_output
-A reject -p tcp -m comment --comment "!fw3" -j REJECT --reject-with tcp-reset
-A reject -m comment --comment "!fw3" -j REJECT --reject-with icmp6-port-unreachable
-A zone_lan_dest_ACCEPT -o br-lan -m comment --comment "!fw3" -j ACCEPT
-A zone_lan_forward -m comment --comment "!fw3: Custom lan forwarding rule chain" -j forwarding_lan_rule
-A zone_lan_forward -m comment --comment "!fw3: Zone lan to wan forwarding policy" -j zone_wan_dest_ACCEPT
-A zone_lan_forward -m comment --comment "!fw3" -j zone_lan_dest_ACCEPT
-A zone_lan_input -m comment --comment "!fw3: Custom lan input rule chain" -j input_lan_rule
-A zone_lan_input -m comment --comment "!fw3" -j zone_lan_src_ACCEPT
-A zone_lan_output -m comment --comment "!fw3: Custom lan output rule chain" -j output_lan_rule
-A zone_lan_output -m comment --comment "!fw3" -j zone_lan_dest_ACCEPT
-A zone_lan_src_ACCEPT -i br-lan -m conntrack --ctstate NEW,UNTRACKED -m comment --comment "!fw3" -j ACCEPT
-A zone_wan_dest_ACCEPT -o eth1 -m conntrack --ctstate INVALID -m comment --comment "!fw3: Prevent NAT leakage" -j DROP
-A zone_wan_dest_ACCEPT -o eth1 -m comment --comment "!fw3" -j ACCEPT
-A zone_wan_dest_REJECT -o eth1 -m comment --comment "!fw3" -j reject
-A zone_wan_forward -m comment --comment "!fw3: Custom wan forwarding rule chain" -j forwarding_wan_rule
-A zone_wan_forward -p esp -m comment --comment "!fw3: Allow-IPSec-ESP" -j zone_lan_dest_ACCEPT
-A zone_wan_forward -p udp -m udp --dport 500 -m comment --comment "!fw3: Allow-ISAKMP" -j zone_lan_dest_ACCEPT
-A zone_wan_forward -j MINIUPNPD
-A zone_wan_forward -m comment --comment "!fw3" -j zone_wan_dest_REJECT
-A zone_wan_input -m comment --comment "!fw3: Custom wan input rule chain" -j input_wan_rule
-A zone_wan_input -s fe80::/10 -p ipv6-icmp -m icmp6 --icmpv6-type 130/0 -m comment --comment "!fw3: Allow-MLD" -j ACCEPT
-A zone_wan_input -s fe80::/10 -p ipv6-icmp -m icmp6 --icmpv6-type 131/0 -m comment --comment "!fw3: Allow-MLD" -j ACCEPT
-A zone_wan_input -s fe80::/10 -p ipv6-icmp -m icmp6 --icmpv6-type 132/0 -m comment --comment "!fw3: Allow-MLD" -j ACCEPT
-A zone_wan_input -s fe80::/10 -p ipv6-icmp -m icmp6 --icmpv6-type 143/0 -m comment --comment "!fw3: Allow-MLD" -j ACCEPT
-A zone_wan_input -p tcp -m tcp --dport 8118 -m comment --comment "!fw3: adblock" -j DROP
-A zone_wan_input -p tcp -m tcp --dport 1688 -m comment --comment "!fw3: kms" -j ACCEPT
-A zone_wan_input -m comment --comment "!fw3" -j zone_wan_src_REJECT
-A zone_wan_output -m comment --comment "!fw3: Custom wan output rule chain" -j output_wan_rule
-A zone_wan_output -m comment --comment "!fw3" -j zone_wan_dest_ACCEPT
-A zone_wan_src_REJECT -i eth1 -m comment --comment "!fw3" -j reject
COMMIT
# Completed on Tue Aug  9 03:10:14 2022

#===================== IPSET状态 =====================#

Name: cn
Name: ct
Name: cnc
Name: cmcc
Name: crtc
Name: cernet
Name: gwbn
Name: othernet
Name: gfwlist
Name: mwan3_connected_v4
Name: mwan3_connected_v6
Name: mwan3_dynamic_v4
Name: mwan3_dynamic_v6
Name: mwan3_custom_v4
Name: mwan3_custom_v6
Name: laniplist
Name: vpsiplist
Name: chnroute
Name: blacklist
Name: whitelist
Name: wan_ac_black_ips
Name: wan_ac_black_ipv6s
Name: localnetwork
Name: mwan3_connected

#===================== 路由表状态 =====================#

#route -n
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         192.168.1.1     0.0.0.0         UG    0      0        0 eth1
192.168.1.0     0.0.0.0         255.255.255.0   U     0      0        0 eth1
192.168.10.0    0.0.0.0         255.255.255.0   U     0      0        0 br-lan
#ip route list
default via 192.168.1.1 dev eth1 proto static 
192.168.1.0/24 dev eth1 proto kernel scope link src 192.168.1.100 
192.168.10.0/24 dev br-lan proto kernel scope link src 192.168.10.1 
#ip rule show
0:  from all lookup local 
32763:  from all fwmark 0x162 lookup 354 
32764:  from all fwmark 0x1 lookup 100 
32766:  from all lookup main 
32767:  from all lookup default 

#===================== 端口占用状态 =====================#

tcp        0      0 :::7895                 :::*                    LISTEN      32628/clash
tcp        0      0 :::9090                 :::*                    LISTEN      32628/clash
tcp        0      0 :::7890                 :::*                    LISTEN      32628/clash
tcp        0      0 :::7891                 :::*                    LISTEN      32628/clash
tcp        0      0 :::7892                 :::*                    LISTEN      32628/clash
tcp        0      0 :::7893                 :::*                    LISTEN      32628/clash
udp        0      0 0.0.0.0:45858           0.0.0.0:*                           32628/clash
udp        0      0 0.0.0.0:46268           0.0.0.0:*                           32628/clash
udp        0      0 0.0.0.0:52434           0.0.0.0:*                           32628/clash
udp        0      0 0.0.0.0:58587           0.0.0.0:*                           32628/clash
udp        0      0 0.0.0.0:45524           0.0.0.0:*                           32628/clash
udp        0      0 :::7874                 :::*                                32628/clash
udp        0      0 :::7891                 :::*                                32628/clash
udp        0      0 :::7892                 :::*                                32628/clash
udp        0      0 :::7893                 :::*                                32628/clash
udp        0      0 :::7895                 :::*                                32628/clash

#===================== 测试本机DNS查询 =====================#

Server:     127.0.0.1
Address:    127.0.0.1#53

Name:      www.baidu.com
www.baidu.com   canonical name = www.a.shifen.com
Name:      www.a.shifen.com
Address 1: 180.101.49.12
Address 2: 180.101.49.11
*** Can't find www.baidu.com: No answer

#===================== resolv.conf.auto =====================#

# Interface lan
nameserver 114.114.114.114
nameserver 119.29.29.29
nameserver 117.50.11.11
nameserver 223.5.5.5
nameserver 192.168.1.1

#===================== 测试本机网络连接 =====================#

HTTP/1.1 200 OK
Accept-Ranges: bytes
Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform
Connection: keep-alive
Content-Length: 277
Content-Type: text/html
Date: Mon, 08 Aug 2022 19:10:34 GMT
Etag: "575e1f60-115"
Last-Modified: Mon, 13 Jun 2016 02:50:08 GMT
Pragma: no-cache
Server: bfe/1.0.8.18

#===================== 测试本机网络下载 =====================#

HTTP/1.1 200 OK
Connection: keep-alive
Content-Length: 80
Cache-Control: max-age=300
Content-Security-Policy: default-src 'none'; style-src 'unsafe-inline'; sandbox
Content-Type: text/plain; charset=utf-8
ETag: "8c9c2724dbecd721d24a35117a8c4e28d61e5a152a6107e6a8242986b9ec1eba"
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
X-Frame-Options: deny
X-XSS-Protection: 1; mode=block
X-GitHub-Request-Id: 90FE:2730:2FD474:4A4DC1:62ECD3C3
Accept-Ranges: bytes
Date: Mon, 08 Aug 2022 19:10:34 GMT
Via: 1.1 varnish
X-Served-By: cache-qpg1236-QPG
X-Cache: HIT
X-Cache-Hits: 2
X-Timer: S1659985835.651812,VS0,VE0
Vary: Authorization,Accept-Encoding,Origin
Access-Control-Allow-Origin: *
X-Fastly-Request-ID: 362a41ee3e975925bfee1fe88da3cbbab54c1d5a
Expires: Mon, 08 Aug 2022 19:15:34 GMT
Source-Age: 276

#===================== 最近运行日志 =====================#

2022-08-09 03:08:54 Installing The New Version, Please Do Not Refresh The Page or Do Other Operations...
2022-08-09 03:09:06 Warning: OpenClash Now Disabled, Need Start From Luci Page, Exit...
2022-08-09 03:08:54 OpenClash Update Successful, About To Restart!
2022-08-09 03:09:10 OpenClash Stoping...
2022-08-09 03:09:10 Step 1: Backup The Current Groups State...
2022-08-09 03:09:10 Step 2: Delete OpenClash Firewall Rules...
2022-08-09 03:09:11 Step 3: Close The OpenClash Daemons...
2022-08-09 03:09:11 Step 4: Close The Clash Core Process...
2022-08-09 03:09:11 Step 5: Restart Dnsmasq...
2022-08-09 03:09:14 Step 6: Delete OpenClash Residue File...
2022-08-09 03:09:14 OpenClash Start Running...
2022-08-09 03:09:14 Step 1: Get The Configuration...
2022-08-09 03:09:14 Step 2: Check The Components...
2022-08-09 03:09:14 Step 3: Modify The Config File...
2022-08-09 03:09:14 Warning: You May Need to Turn off The Rebinding Protection Option of Dnsmasq When Hosts Has Set a Reserved Address
2022-08-09 03:09:15 Step 4: Start Running The Clash Core...
2022-08-09 03:09:15 Tip: Detected The Exclusive Function of The Meta Core, Use Meta Core to Start...
2022-08-09 03:09:16 Step 5: Check The Core Status...
time="2022-08-09T03:09:17+08:00" level=info msg="Start initial configuration in progress"
time="2022-08-09T03:09:17+08:00" level=info msg="Geodata Loader mode: standard"
time="2022-08-09T03:09:18+08:00" level=info msg="Start initial GeoIP rule CN => Domestic, records: 10363"
time="2022-08-09T03:09:18+08:00" level=info msg="Initial configuration complete, total time: 551ms"
time="2022-08-09T03:09:18+08:00" level=info msg="Authentication of local server updated"
time="2022-08-09T03:09:18+08:00" level=info msg="Sniffer is loaded and working"
time="2022-08-09T03:09:18+08:00" level=info msg="DNS server listening at: [::]:7874"
time="2022-08-09T03:09:18+08:00" level=info msg="Start initial compatible provider Apple"
time="2022-08-09T03:09:18+08:00" level=info msg="Start initial compatible provider Domestic"
time="2022-08-09T03:09:18+08:00" level=info msg="Start initial compatible provider URLTest 自动选择"
time="2022-08-09T03:09:18+08:00" level=info msg="Start initial compatible provider Final"
time="2022-08-09T03:09:18+08:00" level=info msg="Start initial compatible provider default"
time="2022-08-09T03:09:18+08:00" level=info msg="Start initial compatible provider Fallback 故障转移"
time="2022-08-09T03:09:18+08:00" level=info msg="RESTful API listening at: [::]:9090"
time="2022-08-09T03:09:18+08:00" level=info msg="Start initial compatible provider GlobalMedia"
time="2022-08-09T03:09:18+08:00" level=info msg="Start initial compatible provider PROXY"
time="2022-08-09T03:09:18+08:00" level=info msg="Start initial compatible provider Ads"
time="2022-08-09T03:09:18+08:00" level=info msg="Start initial compatible provider HKMTMedia"
time="2022-08-09T03:09:18+08:00" level=info msg="Start initial provider 国内IP白名单"
time="2022-08-09T03:09:18+08:00" level=info msg="Start initial provider 放行规则-ConnersHua(建议置顶并直连)"
time="2022-08-09T03:09:18+08:00" level=info msg="Start initial provider 国内域名白名单"
time="2022-08-09T03:09:18+08:00" level=info msg="Use tcp concurrent"
time="2022-08-09T03:09:18+08:00" level=info msg="HTTP proxy listening at: [::]:7890"
time="2022-08-09T03:09:18+08:00" level=info msg="SOCKS proxy listening at: [::]:7891"
time="2022-08-09T03:09:18+08:00" level=info msg="Redirect proxy listening at: [::]:7892"
time="2022-08-09T03:09:18+08:00" level=info msg="TProxy server listening at: [::]:7895"
time="2022-08-09T03:09:18+08:00" level=info msg="Mixed(http+socks) proxy listening at: [::]:7893"
2022-08-09 03:09:19 Step 6: Wait For The File Downloading...
2022-08-09 03:09:19 Step 7: Set Firewall Rules...
2022-08-09 03:09:20 Step 8: Restart Dnsmasq...
2022-08-09 03:09:23 Step 9: Add Cron Rules, Start Daemons...
2022-08-09 03:09:23 OpenClash Start Successful!

### OpenClash Config

_No response_

### Expected Behavior

更新后，可以正常使用。

### Screenshots

_No response_
vernesong commented 2 years ago

加了auth验证，账号密码在全局设置页面的下面

EkkoG commented 2 years ago

加了auth验证，账号密码在全局设置页面的下面

建议更新的时候不要加这种默认配置吧，本来在用这个功能的突然不能用了

建议可以加默认值，但是不要默认打开

yeliex commented 2 years ago

@vernesong 删除auth后每次更新都会重新添加auth

EkkoG commented 2 years ago

我觉得更新时尽量不要改配置文件比较好，特别是已有功能的配置，这种新安装时可以默认打开，但是升级时就不要动了

yeliex commented 1 year ago

@vernesong would this update plz? or accept pr

vernesong commented 1 year ago

改了

InoruYang commented 1 year ago

才发现自动加了SOCKS5/HTTP(S) 认证信息，但是试了默认加的账号密码和自己新增的账号密码，发现都auth fail，后面只好不打开认证就行了

github-actions[bot] commented 1 year ago

This issue is stale because it has been open 60 days with no activity. Remove stale label or comment or this will be closed in 5 days