search

vernesong / OpenClash

A Clash Client For OpenWrt
MIT License
17.55k stars 3.18k forks source link

[Bug] 非常奇怪的bug，不勾选“自定义上游 DNS 服务器”的话会导致某些域名无法解析，计划任务失败 #2620

Closed a904055262 closed 2 years ago

a904055262 commented 2 years ago

Verify Steps

OpenClash Version

v0.45.47-beta

Bug on Environment

Lean

Bug on Platform

Linux-amd64(x86-64)

To Reproduce

我这边的情况： 默认不勾选“自定义上游 DNS 服务器”，会导致某些域名无法解析 比如：raw.githubusercontent.com 我直接用插件自带的调试工具会出现这样的结果：

正在收集数据...

找不到任何连接日志！

1. 可能是插件未在运行

2. 可能是缓存导致浏览直接使用 IP 地址进行访问

3. 可能是 DNS 未劫持成功，导致 Clash 无法正确反推出域名连接

4. 可能是所填地址无法进行解析和连接

实际上插件当然是打开的 此时电脑上nslookup raw.githubusercontent.com 会返回0.0.0.0的ip地址，应该是插件没把这个明显gfw里面的域名交给远程vps进行解析？？ 还会导致一个问题，就是计划任务全部会失败，这个失败就是提示网络错误，但是你直接用shell去运行计划任务的命令是可以成功更新的。

以上的问题，在勾选 “自定义上游 DNS 服务器” 后全部消失。

Describe the Bug

。

OpenClash Log

OpenClash 调试日志

生成时间: 2022-08-10 14:37:50 插件版本: v0.45.47-beta 隐私提示: 上传此日志前请注意检查、屏蔽公网IP、节点、密码等相关敏感信息



#===================== 系统信息 =====================#

主机型号: QEMU Standard PC (Q35 + ICH9 - Intel(R) Celeron(R) J4125 CPU @ 2.00GHz : 4 Core 4 Thread
固件版本: OpenWrt SNAPSHOT r4608-ddc2b246d
LuCI版本: git-22.174.19578-bdf3e99-1
内核版本: 5.15.50
处理器架构: x86_64

#此项有值时,如不使用IPv6,建议到网络-接口-lan的设置中禁用IPV6的DHCP
IPV6-DHCP: server

#此项结果应仅有配置文件的DNS监听地址
Dnsmasq转发设置: 127.0.0.1#7874

#===================== 依赖检查 =====================#

dnsmasq-full: 已安装
coreutils: 已安装
coreutils-nohup: 已安装
bash: 已安装
curl: 已安装
ca-certificates: 已安装
ipset: 已安装
ip-full: 未安装
iptables-mod-tproxy: 未安装
kmod-ipt-tproxy: 未安装
iptables-mod-extra: 未安装
kmod-ipt-extra: 未安装
libcap: 已安装
libcap-bin: 未安装
ruby: 未安装
ruby-yaml: 已安装
ruby-psych: 已安装
ruby-pstore: 已安装
kmod-tun(TUN模式): 已安装
luci-compat(Luci-19.07): 已安装
kmod-inet-diag(PROCESS-NAME): 已安装
unzip: 已安装

#===================== 内核检查 =====================#

运行状态: 运行中
进程pid: 20101
运行权限: 20101: cap_dac_override,cap_net_bind_service,cap_net_admin,cap_net_raw,cap_sys_ptrace,cap_sys_resource=eip
运行用户: nobody
已选择的架构: 未选择架构

#下方无法显示内核版本号时请确认您的内核版本是否正确或者有无权限
Tun内核版本: 
Tun内核文件: 不存在
Tun内核运行权限: 否

Dev内核版本: v1.11.4-6-gbec4df7
Dev内核文件: 存在
Dev内核运行权限: 正常

Meta内核版本: alpha-g2899a12
Meta内核文件: 存在
Meta内核运行权限: 正常

#===================== 插件设置 =====================#

当前配置文件: /etc/openclash/config/跑路云.yaml
启动配置文件: /etc/openclash/跑路云.yaml
运行模式: redir-host
默认代理模式: rule
UDP流量转发(tproxy): 停用
DNS劫持: 启用
自定义DNS: 停用
IPV6代理: 停用
IPV6-DNS解析: 停用
禁用Dnsmasq缓存: 启用
自定义规则: 启用
仅允许内网: 启用
仅代理命中规则流量: 启用
仅允许常用端口流量: 启用
绕过中国大陆IP: 停用
DNS远程解析: 启用
路由本机代理: 启用

#启动异常时建议关闭此项后重试
混合节点: 停用
保留配置: 停用

#启动异常时建议关闭此项后重试
第三方规则: 停用

#===================== 自定义规则 一 =====================#
script:
##  shortcuts:
##    Notice: The core timezone is UTC
##    CST 20:00-24:00 = time.now().hour > 12 and time.now().hour < 16
##    内核时区为UTC,故以下time.now()函数的取值需要根据本地时区进行转换
##    北京时间(CST) 20:00-24:00 = time.now().hour > 12 and time.now().hour < 16
##    quic: network == 'udp' and dst_port == 443 and (geoip(resolve_ip(host)) != 'CN' or geoip(dst_ip) != 'CN')
##    time-limit: in_cidr(src_ip,'192.168.1.2/32') and time.now().hour < 20 or time.now().hour > 21
##    time-limit: src_ip == '192.168.1.2' and time.now().hour < 20 or time.now().hour > 21

##  code: |
##    def main(ctx, metadata):
##        directkeywordlist = ["baidu"]
##        for directkeyword in directkeywordlist:
##          if directkeyword in metadata["host"]:
##            ctx.log('[Script] matched keyword %s use direct' % directkeyword)
##            return "DIRECT"

rules:
##- SCRIPT,quic,REJECT #shortcuts rule
##- SCRIPT,time-limit,REJECT #shortcuts rule

##- PROCESS-NAME,curl,DIRECT #匹配路由自身进程(curl直连)
##- DOMAIN-SUFFIX,google.com,Proxy #匹配域名后缀(交由Proxy代理服务器组)
##- DOMAIN-KEYWORD,google,Proxy #匹配域名关键字(交由Proxy代理服务器组)
##- DOMAIN,google.com,Proxy #匹配域名(交由Proxy代理服务器组)
##- DOMAIN-SUFFIX,ad.com,REJECT #匹配域名后缀(拒绝)
##- IP-CIDR,127.0.0.0/8,DIRECT #匹配数据目标IP(直连)
##- SRC-IP-CIDR,192.168.1.201/32,DIRECT #匹配数据发起IP(直连)
##- DST-PORT,80,DIRECT #匹配数据目标端口(直连)
##- SRC-PORT,7777,DIRECT #匹配数据源端口(直连)

##排序在上的规则优先生效,如添加（去除规则前的#号）：
##IP段：192.168.1.2-192.168.1.200 直连
##- SRC-IP-CIDR,192.168.1.2/31,DIRECT
##- SRC-IP-CIDR,192.168.1.4/30,DIRECT
##- SRC-IP-CIDR,192.168.1.8/29,DIRECT
##- SRC-IP-CIDR,192.168.1.16/28,DIRECT
##- SRC-IP-CIDR,192.168.1.32/27,DIRECT
##- SRC-IP-CIDR,192.168.1.64/26,DIRECT
##- SRC-IP-CIDR,192.168.1.128/26,DIRECT
##- SRC-IP-CIDR,192.168.1.192/29,DIRECT
##- SRC-IP-CIDR,192.168.1.200/32,DIRECT

##IP段：192.168.1.202-192.168.1.255 直连
##- SRC-IP-CIDR,192.168.1.202/31,DIRECT
##- SRC-IP-CIDR,192.168.1.204/30,DIRECT
##- SRC-IP-CIDR,192.168.1.208/28,DIRECT
##- SRC-IP-CIDR,192.168.1.224/27,DIRECT

##此时IP为192.168.1.1和192.168.1.201的客户端流量走代理（策略），其余客户端不走代理
##因为Fake-IP模式下，IP地址为192.168.1.1的路由器自身流量可走代理（策略），所以需要排除

##仅设置路由器自身直连：
##- SRC-IP-CIDR,192.168.1.1/32,DIRECT
##- SRC-IP-CIDR,198.18.0.1/32,DIRECT

##DDNS
##- DOMAIN-SUFFIX,checkip.dyndns.org,DIRECT
##- DOMAIN-SUFFIX,checkipv6.dyndns.org,DIRECT
##- DOMAIN-SUFFIX,checkip.synology.com,DIRECT
##- DOMAIN-SUFFIX,ifconfig.co,DIRECT
##- DOMAIN-SUFFIX,api.myip.com,DIRECT
##- DOMAIN-SUFFIX,ip-api.com,DIRECT
##- DOMAIN-SUFFIX,ipapi.co,DIRECT
##- DOMAIN-SUFFIX,ip6.seeip.org,DIRECT
##- DOMAIN-SUFFIX,members.3322.org,DIRECT

##在线IP段转CIDR地址：http://ip2cidr.com
#===================== 自定义规则 二 =====================#
script:
##  shortcuts:
##    common_port: dst_port not in [21, 22, 23, 53, 80, 123, 143, 194, 443, 465, 587, 853, 993, 995, 998, 2052, 2053, 2082, 2083, 2086, 2095, 2096, 5222, 5228, 5229, 5230, 8080, 8443, 8880, 8888, 8889]

##  code: |
##    def main(ctx, metadata):
##        directkeywordlist = ["baidu"]
##        for directkeyword in directkeywordlist:
##          if directkeyword in metadata["host"]:
##            ctx.log('[Script] matched keyword %s use direct' % directkeyword)
##            return "DIRECT"

rules:
##- SCRIPT,common_port,DIRECT #shortcuts rule

##- DOMAIN-SUFFIX,google.com,Proxy #匹配域名后缀(交由Proxy代理服务器组)
##- DOMAIN-KEYWORD,google,Proxy #匹配域名关键字(交由Proxy代理服务器组)
##- DOMAIN,google.com,Proxy #匹配域名(交由Proxy代理服务器组)
##- DOMAIN-SUFFIX,ad.com,REJECT #匹配域名后缀(拒绝)
##- IP-CIDR,127.0.0.0/8,DIRECT #匹配数据目标IP(直连)
##- SRC-IP-CIDR,192.168.1.201/32,DIRECT #匹配数据发起IP(直连)
##- DST-PORT,80,DIRECT #匹配数据目标端口(直连)
##- SRC-PORT,7777,DIRECT #匹配数据源端口(直连)

#===================== 配置文件 =====================#

port: 7890
socks-port: 7891
allow-lan: true
mode: rule
log-level: silent
external-controller: 0.0.0.0:9090
proxy-groups:
- name: "\U0001F680 节点选择"
  type: select
  proxies:
  - "♻️ 自动选择"
  - "\U0001F1ED\U0001F1F0 香港节点"
  - "\U0001F1E8\U0001F1F3 台湾节点"
  - "\U0001F1F8\U0001F1EC 狮城节点"
  - "\U0001F1EF\U0001F1F5 日本节点"
  - "\U0001F1FA\U0001F1F2 美国节点"
  - "\U0001F1F0\U0001F1F7 韩国节点"
  - "\U0001F680 手动切换"
  - DIRECT
- name: "\U0001F680 手动切换"
  type: select
  proxies:
  - GBO*俄罗斯 [0.1]
  - GBO*卢森堡BT [0.1]
  - GBO*台湾 01 [0.6]
  - GBO*台湾 02 [0.6]
  - GBO*台湾 D3 [0.6]
  - GBO*台湾 D4 [0.6]
  - GBO*新加坡 [0.6]
  - GBO*日本 [0.6]
  - GBO*美国 [0.6]
  - Z*台湾
- name: "♻️ 自动选择"
  type: url-test
  url: http://www.gstatic.com/generate_204
  interval: 300
  tolerance: 50
  proxies:
  - GBO*俄罗斯 [0.1]
  - GBO*卢森堡BT [0.1]
  - GBO*台湾 01 [0.6]
  - GBO*台湾 02 [0.6]
  - GBO*台湾 D3 [0.6]
  - GBO*台湾 D4 [0.6]
  - GBO*新加坡 [0.6]
  - GBO*日本 [0.6]
  - GBO*美国 [0.6]
  - Z*台湾
- name: "\U0001F4F2 电报消息"
  type: select
  proxies:
  - "\U0001F680 节点选择"
  - "♻️ 自动选择"
  - "\U0001F1F8\U0001F1EC 狮城节点"
  - "\U0001F1ED\U0001F1F0 香港节点"
  - "\U0001F1E8\U0001F1F3 台湾节点"
  - "\U0001F1EF\U0001F1F5 日本节点"
  - "\U0001F1FA\U0001F1F2 美国节点"
  - "\U0001F1F0\U0001F1F7 韩国节点"
  - "\U0001F680 手动切换"
  - DIRECT
- name: "\U0001F4F9 油管视频"
  type: select
  proxies:
  - "\U0001F680 节点选择"
  - "♻️ 自动选择"
  - "\U0001F1F8\U0001F1EC 狮城节点"
  - "\U0001F1ED\U0001F1F0 香港节点"
  - "\U0001F1E8\U0001F1F3 台湾节点"
  - "\U0001F1EF\U0001F1F5 日本节点"
  - "\U0001F1FA\U0001F1F2 美国节点"
  - "\U0001F1F0\U0001F1F7 韩国节点"
  - "\U0001F680 手动切换"
  - DIRECT
- name: "\U0001F3A5 奈飞视频"
  type: select
  proxies:
  - "\U0001F3A5 奈飞节点"
  - "\U0001F680 节点选择"
  - "♻️ 自动选择"
  - "\U0001F1F8\U0001F1EC 狮城节点"
  - "\U0001F1ED\U0001F1F0 香港节点"
  - "\U0001F1E8\U0001F1F3 台湾节点"
  - "\U0001F1EF\U0001F1F5 日本节点"
  - "\U0001F1FA\U0001F1F2 美国节点"
  - "\U0001F1F0\U0001F1F7 韩国节点"
  - "\U0001F680 手动切换"
  - DIRECT
- name: "\U0001F4FA 巴哈姆特"
  type: select
  proxies:
  - "\U0001F1E8\U0001F1F3 台湾节点"
  - "\U0001F680 节点选择"
  - "\U0001F680 手动切换"
  - DIRECT
- name: "\U0001F4FA 哔哩哔哩"
  type: select
  proxies:
  - "\U0001F3AF 全球直连"
  - "\U0001F1E8\U0001F1F3 台湾节点"
  - "\U0001F1ED\U0001F1F0 香港节点"
- name: "\U0001F30D 国外媒体"
  type: select
  proxies:
  - "\U0001F680 节点选择"
  - "♻️ 自动选择"
  - "\U0001F1ED\U0001F1F0 香港节点"
  - "\U0001F1E8\U0001F1F3 台湾节点"
  - "\U0001F1F8\U0001F1EC 狮城节点"
  - "\U0001F1EF\U0001F1F5 日本节点"
  - "\U0001F1FA\U0001F1F2 美国节点"
  - "\U0001F1F0\U0001F1F7 韩国节点"
  - "\U0001F680 手动切换"
  - DIRECT
- name: "\U0001F30F 国内媒体"
  type: select
  proxies:
  - DIRECT
  - "\U0001F1ED\U0001F1F0 香港节点"
  - "\U0001F1E8\U0001F1F3 台湾节点"
  - "\U0001F1F8\U0001F1EC 狮城节点"
  - "\U0001F1EF\U0001F1F5 日本节点"
  - "\U0001F680 手动切换"
- name: "\U0001F4E2 谷歌FCM"
  type: select
  proxies:
  - DIRECT
  - "\U0001F680 节点选择"
  - "\U0001F1FA\U0001F1F2 美国节点"
  - "\U0001F1ED\U0001F1F0 香港节点"
  - "\U0001F1E8\U0001F1F3 台湾节点"
  - "\U0001F1F8\U0001F1EC 狮城节点"
  - "\U0001F1EF\U0001F1F5 日本节点"
  - "\U0001F1F0\U0001F1F7 韩国节点"
  - "\U0001F680 手动切换"
- name: Ⓜ️ 微软云盘
  type: select
  proxies:
  - DIRECT
  - "\U0001F680 节点选择"
  - "\U0001F1FA\U0001F1F2 美国节点"
  - "\U0001F1ED\U0001F1F0 香港节点"
  - "\U0001F1E8\U0001F1F3 台湾节点"
  - "\U0001F1F8\U0001F1EC 狮城节点"
  - "\U0001F1EF\U0001F1F5 日本节点"
  - "\U0001F1F0\U0001F1F7 韩国节点"
  - "\U0001F680 手动切换"
- name: Ⓜ️ 微软服务
  type: select
  proxies:
  - DIRECT
  - "\U0001F680 节点选择"
  - "\U0001F1FA\U0001F1F2 美国节点"
  - "\U0001F1ED\U0001F1F0 香港节点"
  - "\U0001F1E8\U0001F1F3 台湾节点"
  - "\U0001F1F8\U0001F1EC 狮城节点"
  - "\U0001F1EF\U0001F1F5 日本节点"
  - "\U0001F1F0\U0001F1F7 韩国节点"
  - "\U0001F680 手动切换"
- name: "\U0001F34E 苹果服务"
  type: select
  proxies:
  - DIRECT
  - "\U0001F680 节点选择"
  - "\U0001F1FA\U0001F1F2 美国节点"
  - "\U0001F1ED\U0001F1F0 香港节点"
  - "\U0001F1E8\U0001F1F3 台湾节点"
  - "\U0001F1F8\U0001F1EC 狮城节点"
  - "\U0001F1EF\U0001F1F5 日本节点"
  - "\U0001F1F0\U0001F1F7 韩国节点"
  - "\U0001F680 手动切换"
- name: "\U0001F3AE 游戏平台"
  type: select
  proxies:
  - DIRECT
  - "\U0001F680 节点选择"
  - "\U0001F1FA\U0001F1F2 美国节点"
  - "\U0001F1ED\U0001F1F0 香港节点"
  - "\U0001F1E8\U0001F1F3 台湾节点"
  - "\U0001F1F8\U0001F1EC 狮城节点"
  - "\U0001F1EF\U0001F1F5 日本节点"
  - "\U0001F1F0\U0001F1F7 韩国节点"
  - "\U0001F680 手动切换"
- name: "\U0001F3B6 网易音乐"
  type: select
  proxies:
  - DIRECT
  - "\U0001F680 节点选择"
  - "♻️ 自动选择"
- name: "\U0001F3AF 全球直连"
  type: select
  proxies:
  - DIRECT
  - "\U0001F680 节点选择"
  - "♻️ 自动选择"
- name: "\U0001F6D1 广告拦截"
  type: select
  proxies:
  - REJECT
  - DIRECT
- name: "\U0001F343 应用净化"
  type: select
  proxies:
  - REJECT
  - DIRECT
- name: "\U0001F41F 漏网之鱼"
  type: select
  proxies:
  - "\U0001F680 节点选择"
  - "♻️ 自动选择"
  - DIRECT
  - "\U0001F1ED\U0001F1F0 香港节点"
  - "\U0001F1E8\U0001F1F3 台湾节点"
  - "\U0001F1F8\U0001F1EC 狮城节点"
  - "\U0001F1EF\U0001F1F5 日本节点"
  - "\U0001F1FA\U0001F1F2 美国节点"
  - "\U0001F1F0\U0001F1F7 韩国节点"
  - "\U0001F680 手动切换"
- name: "\U0001F1ED\U0001F1F0 香港节点"
  type: url-test
  url: http://www.gstatic.com/generate_204
  interval: 300
  tolerance: 50
  proxies:
  - DIRECT
- name: "\U0001F1EF\U0001F1F5 日本节点"
  type: url-test
  url: http://www.gstatic.com/generate_204
  interval: 300
  tolerance: 50
  proxies:
  - GBO*日本 [0.6]
- name: "\U0001F1FA\U0001F1F2 美国节点"
  type: url-test
  url: http://www.gstatic.com/generate_204
  interval: 300
  tolerance: 150
  proxies:
  - GBO*美国 [0.6]
- name: "\U0001F1E8\U0001F1F3 台湾节点"
  type: url-test
  url: http://www.gstatic.com/generate_204
  interval: 300
  tolerance: 50
  proxies:
  - GBO*台湾 01 [0.6]
  - GBO*台湾 02 [0.6]
  - GBO*台湾 D3 [0.6]
  - GBO*台湾 D4 [0.6]
  - Z*台湾
- name: "\U0001F1F8\U0001F1EC 狮城节点"
  type: url-test
  url: http://www.gstatic.com/generate_204
  interval: 300
  tolerance: 50
  proxies:
  - GBO*新加坡 [0.6]
- name: "\U0001F1F0\U0001F1F7 韩国节点"
  type: url-test
  url: http://www.gstatic.com/generate_204
  interval: 300
  tolerance: 50
  proxies:
  - DIRECT
- name: "\U0001F3A5 奈飞节点"
  type: select
  proxies:
  - DIRECT
redir-port: 7892
tproxy-port: 7895
mixed-port: 7893
bind-address: "*"
external-ui: "/usr/share/openclash/ui"
ipv6: false
dns:
  enable: true
  ipv6: false
  enhanced-mode: fake-ip
  fake-ip-range: 198.18.0.1/16
  listen: 0.0.0.0:7874
  nameserver:
  - 114.114.114.114
  - 119.29.29.29
  - 223.5.5.5
  - https://doh.pub/dns-query
  - https://223.5.5.5/dns-query
  fallback:
  - https://dns.cloudflare.com/dns-query
  - https://public.dns.iij.jp/dns-query
  - https://jp.tiar.app/dns-query
  - https://jp.tiarap.org/dns-query
  fake-ip-filter:
  - "+.*"
profile:
  store-selected: true
  store-fake-ip: true

#===================== 防火墙设置 =====================#

#IPv4 NAT chain

# Generated by iptables-save v1.8.7 on Wed Aug 10 14:37:52 2022
*nat
:PREROUTING ACCEPT [70:5801]
:INPUT ACCEPT [211:15233]
:OUTPUT ACCEPT [890:58453]
:POSTROUTING ACCEPT [271:19353]
:MINIUPNPD - [0:0]
:MINIUPNPD-POSTROUTING - [0:0]
:openclash - [0:0]
:openclash_output - [0:0]
:postrouting_VPN_rule - [0:0]
:postrouting_lan_rule - [0:0]
:postrouting_rule - [0:0]
:postrouting_vpn_rule - [0:0]
:postrouting_wan_rule - [0:0]
:prerouting_VPN_rule - [0:0]
:prerouting_lan_rule - [0:0]
:prerouting_rule - [0:0]
:prerouting_vpn_rule - [0:0]
:prerouting_wan_rule - [0:0]
:zone_VPN_postrouting - [0:0]
:zone_VPN_prerouting - [0:0]
:zone_lan_postrouting - [0:0]
:zone_lan_prerouting - [0:0]
:zone_vpn_postrouting - [0:0]
:zone_vpn_prerouting - [0:0]
:zone_wan_postrouting - [0:0]
:zone_wan_prerouting - [0:0]
-A PREROUTING -d 8.8.4.4/32 -p tcp -m comment --comment "OpenClash Google DNS Hijack" -m tcp --dport 53 -j REDIRECT --to-ports 7892
-A PREROUTING -d 8.8.8.8/32 -p tcp -m comment --comment "OpenClash Google DNS Hijack" -m tcp --dport 53 -j REDIRECT --to-ports 7892
-A PREROUTING -p tcp -m tcp --dport 53 -m comment --comment "OpenClash DNS Hijack" -j REDIRECT --to-ports 53
-A PREROUTING -p udp -m udp --dport 53 -m comment --comment "OpenClash DNS Hijack" -j REDIRECT --to-ports 53
-A PREROUTING -m comment --comment "!fw3: Custom prerouting rule chain" -j prerouting_rule
-A PREROUTING -i eth0 -m comment --comment "!fw3" -j zone_lan_prerouting
-A PREROUTING -i pppoe-wan -m comment --comment "!fw3" -j zone_wan_prerouting
-A PREROUTING -i eth1 -m comment --comment "!fw3" -j zone_wan_prerouting
-A PREROUTING -i ipsec0 -m comment --comment "!fw3" -j zone_VPN_prerouting
-A PREROUTING -i tun0 -m comment --comment "!fw3" -j zone_vpn_prerouting
-A PREROUTING -i wg -m comment --comment "!fw3" -j zone_vpn_prerouting
-A PREROUTING -p tcp -j openclash
-A OUTPUT -j openclash_output
-A POSTROUTING -m comment --comment "!fw3: Custom postrouting rule chain" -j postrouting_rule
-A POSTROUTING -o eth0 -m comment --comment "!fw3" -j zone_lan_postrouting
-A POSTROUTING -o pppoe-wan -m comment --comment "!fw3" -j zone_wan_postrouting
-A POSTROUTING -o eth1 -m comment --comment "!fw3" -j zone_wan_postrouting
-A POSTROUTING -o ipsec0 -m comment --comment "!fw3" -j zone_VPN_postrouting
-A POSTROUTING -o tun0 -m comment --comment "!fw3" -j zone_vpn_postrouting
-A POSTROUTING -o wg -m comment --comment "!fw3" -j zone_vpn_postrouting
-A MINIUPNPD -p tcp -m tcp --dport 24537 -j DNAT --to-destination 192.168.6.3:22000
-A MINIUPNPD -p tcp -m tcp --dport 59620 -j DNAT --to-destination 192.168.6.3:22000
-A MINIUPNPD-POSTROUTING -s 192.168.6.3/32 -p tcp -m tcp --sport 22000 -j MASQUERADE --to-ports 24537
-A MINIUPNPD-POSTROUTING -s 192.168.6.3/32 -p tcp -m tcp --sport 22000 -j MASQUERADE --to-ports 59620
-A openclash -p tcp -m tcp --sport 1688 -j RETURN
-A openclash -p tcp -m tcp --sport 1194 -j RETURN
-A openclash -m set --match-set localnetwork dst -j RETURN
-A openclash -m set ! --match-set common_ports dst -j RETURN
-A openclash -p tcp -j REDIRECT --to-ports 7892
-A openclash_output -p tcp -m tcp --sport 1688 -j RETURN
-A openclash_output -p tcp -m tcp --sport 1194 -j RETURN
-A openclash_output -m set --match-set localnetwork dst -j RETURN
-A openclash_output -m owner ! --uid-owner 65534 -m set ! --match-set common_ports dst -j RETURN
-A openclash_output -p tcp -m owner ! --uid-owner 65534 -j REDIRECT --to-ports 7892
-A zone_VPN_postrouting -m comment --comment "!fw3: Custom VPN postrouting rule chain" -j postrouting_VPN_rule
-A zone_VPN_prerouting -m comment --comment "!fw3: Custom VPN prerouting rule chain" -j prerouting_VPN_rule
-A zone_lan_postrouting -m comment --comment "!fw3: Custom lan postrouting rule chain" -j postrouting_lan_rule
-A zone_lan_prerouting -m comment --comment "!fw3: Custom lan prerouting rule chain" -j prerouting_lan_rule
-A zone_vpn_postrouting -m comment --comment "!fw3: Custom vpn postrouting rule chain" -j postrouting_vpn_rule
-A zone_vpn_postrouting -m comment --comment "!fw3" -j MASQUERADE
-A zone_vpn_prerouting -m comment --comment "!fw3: Custom vpn prerouting rule chain" -j prerouting_vpn_rule
-A zone_wan_postrouting -j MINIUPNPD-POSTROUTING
-A zone_wan_postrouting -j MINIUPNPD-POSTROUTING
-A zone_wan_postrouting -m comment --comment "!fw3: Custom wan postrouting rule chain" -j postrouting_wan_rule
-A zone_wan_postrouting -m comment --comment "!fw3" -j MASQUERADE
-A zone_wan_prerouting -j MINIUPNPD
-A zone_wan_prerouting -j MINIUPNPD
-A zone_wan_prerouting -m comment --comment "!fw3: Custom wan prerouting rule chain" -j prerouting_wan_rule
COMMIT
# Completed on Wed Aug 10 14:37:52 2022

#IPv4 Mangle chain

# Generated by iptables-save v1.8.7 on Wed Aug 10 14:37:52 2022
*mangle
:PREROUTING ACCEPT [1339:1105748]
:INPUT ACCEPT [1287:1098176]
:FORWARD ACCEPT [52:7572]
:OUTPUT ACCEPT [1587:1467799]
:POSTROUTING ACCEPT [1639:1475371]
:RRDIPT_FORWARD - [0:0]
:RRDIPT_INPUT - [0:0]
:RRDIPT_OUTPUT - [0:0]
-A INPUT -j RRDIPT_INPUT
-A FORWARD -j RRDIPT_FORWARD
-A FORWARD -o pppoe-wan -p tcp -m tcp --tcp-flags SYN,RST SYN -m comment --comment "!fw3: Zone wan MTU fixing" -j TCPMSS --clamp-mss-to-pmtu
-A FORWARD -i pppoe-wan -p tcp -m tcp --tcp-flags SYN,RST SYN -m comment --comment "!fw3: Zone wan MTU fixing" -j TCPMSS --clamp-mss-to-pmtu
-A FORWARD -o eth1 -p tcp -m tcp --tcp-flags SYN,RST SYN -m comment --comment "!fw3: Zone wan MTU fixing" -j TCPMSS --clamp-mss-to-pmtu
-A FORWARD -i eth1 -p tcp -m tcp --tcp-flags SYN,RST SYN -m comment --comment "!fw3: Zone wan MTU fixing" -j TCPMSS --clamp-mss-to-pmtu
-A OUTPUT -j RRDIPT_OUTPUT
-A RRDIPT_FORWARD -s 192.168.6.106/32 -j RETURN
-A RRDIPT_FORWARD -d 192.168.6.106/32 -j RETURN
-A RRDIPT_FORWARD -s 192.168.6.107/32 -j RETURN
-A RRDIPT_FORWARD -d 192.168.6.107/32 -j RETURN
-A RRDIPT_FORWARD -s 192.168.6.109/32 -j RETURN
-A RRDIPT_FORWARD -d 192.168.6.109/32 -j RETURN
-A RRDIPT_FORWARD -s 192.168.6.128/32 -j RETURN
-A RRDIPT_FORWARD -d 192.168.6.128/32 -j RETURN
-A RRDIPT_FORWARD -s 192.168.6.226/32 -j RETURN
-A RRDIPT_FORWARD -d 192.168.6.226/32 -j RETURN
-A RRDIPT_FORWARD -s 192.168.6.148/32 -j RETURN
-A RRDIPT_FORWARD -d 192.168.6.148/32 -j RETURN
-A RRDIPT_FORWARD -s 192.168.6.3/32 -j RETURN
-A RRDIPT_FORWARD -d 192.168.6.3/32 -j RETURN
-A RRDIPT_FORWARD -s 192.168.6.6/32 -j RETURN
-A RRDIPT_FORWARD -d 192.168.6.6/32 -j RETURN
-A RRDIPT_FORWARD -s 192.168.6.108/32 -j RETURN
-A RRDIPT_FORWARD -d 192.168.6.108/32 -j RETURN
-A RRDIPT_FORWARD -s 192.168.6.11/32 -j RETURN
-A RRDIPT_FORWARD -d 192.168.6.11/32 -j RETURN
-A RRDIPT_FORWARD -s 192.168.6.238/32 -j RETURN
-A RRDIPT_FORWARD -d 192.168.6.238/32 -j RETURN
-A RRDIPT_FORWARD -s 192.168.6.221/32 -j RETURN
-A RRDIPT_FORWARD -d 192.168.6.221/32 -j RETURN
-A RRDIPT_FORWARD -s 192.168.6.188/32 -j RETURN
-A RRDIPT_FORWARD -d 192.168.6.188/32 -j RETURN
-A RRDIPT_INPUT -i eth0 -j RETURN
-A RRDIPT_INPUT -i tun0 -j RETURN
-A RRDIPT_INPUT -i pppoe-wan -j RETURN
-A RRDIPT_OUTPUT -o eth0 -j RETURN
-A RRDIPT_OUTPUT -o tun0 -j RETURN
-A RRDIPT_OUTPUT -o pppoe-wan -j RETURN
COMMIT
# Completed on Wed Aug 10 14:37:52 2022

#IPv4 Filter chain

# Generated by iptables-save v1.8.7 on Wed Aug 10 14:37:52 2022
*filter
:INPUT ACCEPT [0:0]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [0:0]
:MINIUPNPD - [0:0]
:SOCAT - [0:0]
:forwarding_VPN_rule - [0:0]
:forwarding_lan_rule - [0:0]
:forwarding_rule - [0:0]
:forwarding_vpn_rule - [0:0]
:forwarding_wan_rule - [0:0]
:input_VPN_rule - [0:0]
:input_lan_rule - [0:0]
:input_rule - [0:0]
:input_vpn_rule - [0:0]
:input_wan_rule - [0:0]
:openclash_wan_input - [0:0]
:output_VPN_rule - [0:0]
:output_lan_rule - [0:0]
:output_rule - [0:0]
:output_vpn_rule - [0:0]
:output_wan_rule - [0:0]
:reject - [0:0]
:syn_flood - [0:0]
:zone_VPN_dest_ACCEPT - [0:0]
:zone_VPN_forward - [0:0]
:zone_VPN_input - [0:0]
:zone_VPN_output - [0:0]
:zone_VPN_src_ACCEPT - [0:0]
:zone_lan_dest_ACCEPT - [0:0]
:zone_lan_forward - [0:0]
:zone_lan_input - [0:0]
:zone_lan_output - [0:0]
:zone_lan_src_ACCEPT - [0:0]
:zone_vpn_dest_ACCEPT - [0:0]
:zone_vpn_forward - [0:0]
:zone_vpn_input - [0:0]
:zone_vpn_output - [0:0]
:zone_vpn_src_ACCEPT - [0:0]
:zone_wan_dest_ACCEPT - [0:0]
:zone_wan_dest_REJECT - [0:0]
:zone_wan_forward - [0:0]
:zone_wan_input - [0:0]
:zone_wan_output - [0:0]
:zone_wan_src_REJECT - [0:0]
-A INPUT -i eth1 -m set ! --match-set localnetwork src -j openclash_wan_input
-A INPUT -i pppoe-wan -m set ! --match-set localnetwork src -j openclash_wan_input
-A INPUT -j SOCAT
-A INPUT -m policy --dir in --pol ipsec --proto esp -j ACCEPT
-A INPUT -i lo -m comment --comment "!fw3" -j ACCEPT
-A INPUT -m comment --comment "!fw3: Custom input rule chain" -j input_rule
-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment "!fw3" -j ACCEPT
-A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -m comment --comment "!fw3" -j syn_flood
-A INPUT -i eth0 -m comment --comment "!fw3" -j zone_lan_input
-A INPUT -i pppoe-wan -m comment --comment "!fw3" -j zone_wan_input
-A INPUT -i eth1 -m comment --comment "!fw3" -j zone_wan_input
-A INPUT -i ipsec0 -m comment --comment "!fw3" -j zone_VPN_input
-A INPUT -i tun0 -m comment --comment "!fw3" -j zone_vpn_input
-A INPUT -i wg -m comment --comment "!fw3" -j zone_vpn_input
-A FORWARD -m policy --dir out --pol ipsec --proto esp -j ACCEPT
-A FORWARD -m policy --dir in --pol ipsec --proto esp -j ACCEPT
-A FORWARD -m comment --comment "!fw3: Custom forwarding rule chain" -j forwarding_rule
-A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment "!fw3" -j ACCEPT
-A FORWARD -i eth0 -m comment --comment "!fw3" -j zone_lan_forward
-A FORWARD -i pppoe-wan -m comment --comment "!fw3" -j zone_wan_forward
-A FORWARD -i eth1 -m comment --comment "!fw3" -j zone_wan_forward
-A FORWARD -i ipsec0 -m comment --comment "!fw3" -j zone_VPN_forward
-A FORWARD -i tun0 -m comment --comment "!fw3" -j zone_vpn_forward
-A FORWARD -i wg -m comment --comment "!fw3" -j zone_vpn_forward
-A FORWARD -m comment --comment "!fw3" -j reject
-A OUTPUT -m policy --dir out --pol ipsec --proto esp -j ACCEPT
-A OUTPUT -o lo -m comment --comment "!fw3" -j ACCEPT
-A OUTPUT -m comment --comment "!fw3: Custom output rule chain" -j output_rule
-A OUTPUT -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment "!fw3" -j ACCEPT
-A OUTPUT -o eth0 -m comment --comment "!fw3" -j zone_lan_output
-A OUTPUT -o pppoe-wan -m comment --comment "!fw3" -j zone_wan_output
-A OUTPUT -o eth1 -m comment --comment "!fw3" -j zone_wan_output
-A OUTPUT -o ipsec0 -m comment --comment "!fw3" -j zone_VPN_output
-A OUTPUT -o tun0 -m comment --comment "!fw3" -j zone_vpn_output
-A OUTPUT -o wg -m comment --comment "!fw3" -j zone_vpn_output
-A MINIUPNPD -d 192.168.6.3/32 -p tcp -m tcp --dport 22000 -j ACCEPT
-A MINIUPNPD -d 192.168.6.3/32 -p tcp -m tcp --dport 22000 -j ACCEPT
-A openclash_wan_input -p udp -m multiport --dports 7892,7895,9090,7890,7891,7893,7874 -j REJECT --reject-with icmp-port-unreachable
-A openclash_wan_input -p tcp -m multiport --dports 7892,7895,9090,7890,7891,7893,7874 -j REJECT --reject-with icmp-port-unreachable
-A reject -p tcp -m comment --comment "!fw3" -j REJECT --reject-with tcp-reset
-A reject -m comment --comment "!fw3" -j REJECT --reject-with icmp-port-unreachable
-A syn_flood -m limit --limit 25/sec --limit-burst 50 -m comment --comment "!fw3" -j RETURN
-A syn_flood -m comment --comment "!fw3" -j DROP
-A zone_VPN_dest_ACCEPT -o ipsec0 -m comment --comment "!fw3" -j ACCEPT
-A zone_VPN_forward -m comment --comment "!fw3: Custom VPN forwarding rule chain" -j forwarding_VPN_rule
-A zone_VPN_forward -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port forwards" -j ACCEPT
-A zone_VPN_forward -m comment --comment "!fw3" -j zone_VPN_dest_ACCEPT
-A zone_VPN_input -m comment --comment "!fw3: Custom VPN input rule chain" -j input_VPN_rule
-A zone_VPN_input -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port redirections" -j ACCEPT
-A zone_VPN_input -m comment --comment "!fw3" -j zone_VPN_src_ACCEPT
-A zone_VPN_output -m comment --comment "!fw3: Custom VPN output rule chain" -j output_VPN_rule
-A zone_VPN_output -m comment --comment "!fw3" -j zone_VPN_dest_ACCEPT
-A zone_VPN_src_ACCEPT -i ipsec0 -m conntrack --ctstate NEW,UNTRACKED -m comment --comment "!fw3" -j ACCEPT
-A zone_lan_dest_ACCEPT -o eth0 -m comment --comment "!fw3" -j ACCEPT
-A zone_lan_forward -m comment --comment "!fw3: Custom lan forwarding rule chain" -j forwarding_lan_rule
-A zone_lan_forward -m comment --comment "!fw3: Zone lan to wan forwarding policy" -j zone_wan_dest_ACCEPT
-A zone_lan_forward -m comment --comment "!fw3: Zone lan to vpn forwarding policy" -j zone_vpn_dest_ACCEPT
-A zone_lan_forward -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port forwards" -j ACCEPT
-A zone_lan_forward -m comment --comment "!fw3" -j zone_lan_dest_ACCEPT
-A zone_lan_input -m comment --comment "!fw3: Custom lan input rule chain" -j input_lan_rule
-A zone_lan_input -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port redirections" -j ACCEPT
-A zone_lan_input -m comment --comment "!fw3" -j zone_lan_src_ACCEPT
-A zone_lan_output -m comment --comment "!fw3: Custom lan output rule chain" -j output_lan_rule
-A zone_lan_output -m comment --comment "!fw3" -j zone_lan_dest_ACCEPT
-A zone_lan_src_ACCEPT -i eth0 -m conntrack --ctstate NEW,UNTRACKED -m comment --comment "!fw3" -j ACCEPT
-A zone_vpn_dest_ACCEPT -o tun0 -m conntrack --ctstate INVALID -m comment --comment "!fw3: Prevent NAT leakage" -j DROP
-A zone_vpn_dest_ACCEPT -o tun0 -m comment --comment "!fw3" -j ACCEPT
-A zone_vpn_dest_ACCEPT -o wg -m conntrack --ctstate INVALID -m comment --comment "!fw3: Prevent NAT leakage" -j DROP
-A zone_vpn_dest_ACCEPT -o wg -m comment --comment "!fw3" -j ACCEPT
-A zone_vpn_forward -m comment --comment "!fw3: Custom vpn forwarding rule chain" -j forwarding_vpn_rule
-A zone_vpn_forward -m comment --comment "!fw3: Zone vpn to wan forwarding policy" -j zone_wan_dest_ACCEPT
-A zone_vpn_forward -m comment --comment "!fw3: Zone vpn to lan forwarding policy" -j zone_lan_dest_ACCEPT
-A zone_vpn_forward -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port forwards" -j ACCEPT
-A zone_vpn_forward -m comment --comment "!fw3" -j zone_vpn_dest_ACCEPT
-A zone_vpn_input -m comment --comment "!fw3: Custom vpn input rule chain" -j input_vpn_rule
-A zone_vpn_input -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port redirections" -j ACCEPT
-A zone_vpn_input -m comment --comment "!fw3" -j zone_vpn_src_ACCEPT
-A zone_vpn_output -m comment --comment "!fw3: Custom vpn output rule chain" -j output_vpn_rule
-A zone_vpn_output -m comment --comment "!fw3" -j zone_vpn_dest_ACCEPT
-A zone_vpn_src_ACCEPT -i tun0 -m conntrack --ctstate NEW,UNTRACKED -m comment --comment "!fw3" -j ACCEPT
-A zone_vpn_src_ACCEPT -i wg -m conntrack --ctstate NEW,UNTRACKED -m comment --comment "!fw3" -j ACCEPT
-A zone_wan_dest_ACCEPT -o pppoe-wan -m conntrack --ctstate INVALID -m comment --comment "!fw3: Prevent NAT leakage" -j DROP
-A zone_wan_dest_ACCEPT -o pppoe-wan -m comment --comment "!fw3" -j ACCEPT
-A zone_wan_dest_ACCEPT -o eth1 -m conntrack --ctstate INVALID -m comment --comment "!fw3: Prevent NAT leakage" -j DROP
-A zone_wan_dest_ACCEPT -o eth1 -m comment --comment "!fw3" -j ACCEPT
-A zone_wan_dest_REJECT -o pppoe-wan -m comment --comment "!fw3" -j reject
-A zone_wan_dest_REJECT -o eth1 -m comment --comment "!fw3" -j reject
-A zone_wan_forward -j MINIUPNPD
-A zone_wan_forward -j MINIUPNPD
-A zone_wan_forward -m comment --comment "!fw3: Custom wan forwarding rule chain" -j forwarding_wan_rule
-A zone_wan_forward -p esp -m comment --comment "!fw3: Allow-IPSec-ESP" -j zone_lan_dest_ACCEPT
-A zone_wan_forward -p udp -m udp --dport 500 -m comment --comment "!fw3: Allow-ISAKMP" -j zone_lan_dest_ACCEPT
-A zone_wan_forward -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port forwards" -j ACCEPT
-A zone_wan_forward -m comment --comment "!fw3" -j zone_wan_dest_REJECT
-A zone_wan_input -m comment --comment "!fw3: Custom wan input rule chain" -j input_wan_rule
-A zone_wan_input -p udp -m udp --dport 68 -m comment --comment "!fw3: Allow-DHCP-Renew" -j ACCEPT
-A zone_wan_input -p icmp -m icmp --icmp-type 8 -m comment --comment "!fw3: Allow-Ping" -j ACCEPT
-A zone_wan_input -p igmp -m comment --comment "!fw3: Allow-IGMP" -j ACCEPT
-A zone_wan_input -p udp -m udp --dport 500 -m comment --comment "!fw3: ike" -j ACCEPT
-A zone_wan_input -p udp -m udp --dport 4500 -m comment --comment "!fw3: ipsec" -j ACCEPT
-A zone_wan_input -p ah -m comment --comment "!fw3: ah" -j ACCEPT
-A zone_wan_input -p esp -m comment --comment "!fw3: esp" -j ACCEPT
-A zone_wan_input -p tcp -m tcp --dport 1194 -m comment --comment "!fw3: openvpn" -j ACCEPT
-A zone_wan_input -p udp -m udp --dport 1194 -m comment --comment "!fw3: openvpn" -j ACCEPT
-A zone_wan_input -p tcp -m tcp --dport 1688 -m comment --comment "!fw3: kms" -j ACCEPT
-A zone_wan_input -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port redirections" -j ACCEPT
-A zone_wan_input -m comment --comment "!fw3" -j zone_wan_src_REJECT
-A zone_wan_output -m comment --comment "!fw3: Custom wan output rule chain" -j output_wan_rule
-A zone_wan_output -m comment --comment "!fw3" -j zone_wan_dest_ACCEPT
-A zone_wan_src_REJECT -i pppoe-wan -m comment --comment "!fw3" -j reject
-A zone_wan_src_REJECT -i eth1 -m comment --comment "!fw3" -j reject
COMMIT
# Completed on Wed Aug 10 14:37:52 2022

#IPv6 NAT chain

# Generated by ip6tables-save v1.8.7 on Wed Aug 10 14:37:52 2022
*nat
:PREROUTING ACCEPT [4522:869814]
:INPUT ACCEPT [3657:331164]
:OUTPUT ACCEPT [458:42856]
:POSTROUTING ACCEPT [825:150210]
COMMIT
# Completed on Wed Aug 10 14:37:52 2022

#IPv6 Mangle chain

# Generated by ip6tables-save v1.8.7 on Wed Aug 10 14:37:52 2022
*mangle
:PREROUTING ACCEPT [21338:9603920]
:INPUT ACCEPT [11909:4928152]
:FORWARD ACCEPT [8910:4242876]
:OUTPUT ACCEPT [11314:1657157]
:POSTROUTING ACCEPT [20209:5892567]
-A FORWARD -o pppoe-wan -p tcp -m tcp --tcp-flags SYN,RST SYN -m comment --comment "!fw3: Zone wan MTU fixing" -j TCPMSS --clamp-mss-to-pmtu
-A FORWARD -i pppoe-wan -p tcp -m tcp --tcp-flags SYN,RST SYN -m comment --comment "!fw3: Zone wan MTU fixing" -j TCPMSS --clamp-mss-to-pmtu
-A FORWARD -o eth1 -p tcp -m tcp --tcp-flags SYN,RST SYN -m comment --comment "!fw3: Zone wan MTU fixing" -j TCPMSS --clamp-mss-to-pmtu
-A FORWARD -i eth1 -p tcp -m tcp --tcp-flags SYN,RST SYN -m comment --comment "!fw3: Zone wan MTU fixing" -j TCPMSS --clamp-mss-to-pmtu
COMMIT
# Completed on Wed Aug 10 14:37:52 2022

#IPv6 Filter chain

# Generated by ip6tables-save v1.8.7 on Wed Aug 10 14:37:52 2022
*filter
:INPUT ACCEPT [0:0]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [0:0]
:MINIUPNPD - [0:0]
:SOCAT - [0:0]
:forwarding_VPN_rule - [0:0]
:forwarding_lan_rule - [0:0]
:forwarding_rule - [0:0]
:forwarding_vpn_rule - [0:0]
:forwarding_wan_rule - [0:0]
:input_VPN_rule - [0:0]
:input_lan_rule - [0:0]
:input_rule - [0:0]
:input_vpn_rule - [0:0]
:input_wan_rule - [0:0]
:output_VPN_rule - [0:0]
:output_lan_rule - [0:0]
:output_rule - [0:0]
:output_vpn_rule - [0:0]
:output_wan_rule - [0:0]
:reject - [0:0]
:syn_flood - [0:0]
:zone_VPN_dest_ACCEPT - [0:0]
:zone_VPN_forward - [0:0]
:zone_VPN_input - [0:0]
:zone_VPN_output - [0:0]
:zone_VPN_src_ACCEPT - [0:0]
:zone_lan_dest_ACCEPT - [0:0]
:zone_lan_forward - [0:0]
:zone_lan_input - [0:0]
:zone_lan_output - [0:0]
:zone_lan_src_ACCEPT - [0:0]
:zone_vpn_dest_ACCEPT - [0:0]
:zone_vpn_forward - [0:0]
:zone_vpn_input - [0:0]
:zone_vpn_output - [0:0]
:zone_vpn_src_ACCEPT - [0:0]
:zone_wan_dest_ACCEPT - [0:0]
:zone_wan_dest_REJECT - [0:0]
:zone_wan_forward - [0:0]
:zone_wan_input - [0:0]
:zone_wan_output - [0:0]
:zone_wan_src_REJECT - [0:0]
-A INPUT -j SOCAT
-A INPUT -i lo -m comment --comment "!fw3" -j ACCEPT
-A INPUT -m comment --comment "!fw3: Custom input rule chain" -j input_rule
-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment "!fw3" -j ACCEPT
-A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -m comment --comment "!fw3" -j syn_flood
-A INPUT -i eth0 -m comment --comment "!fw3" -j zone_lan_input
-A INPUT -i pppoe-wan -m comment --comment "!fw3" -j zone_wan_input
-A INPUT -i eth1 -m comment --comment "!fw3" -j zone_wan_input
-A INPUT -i ipsec0 -m comment --comment "!fw3" -j zone_VPN_input
-A INPUT -i tun0 -m comment --comment "!fw3" -j zone_vpn_input
-A INPUT -i wg -m comment --comment "!fw3" -j zone_vpn_input
-A FORWARD -m comment --comment "!fw3: Custom forwarding rule chain" -j forwarding_rule
-A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment "!fw3" -j ACCEPT
-A FORWARD -i eth0 -m comment --comment "!fw3" -j zone_lan_forward
-A FORWARD -i pppoe-wan -m comment --comment "!fw3" -j zone_wan_forward
-A FORWARD -i eth1 -m comment --comment "!fw3" -j zone_wan_forward
-A FORWARD -i ipsec0 -m comment --comment "!fw3" -j zone_VPN_forward
-A FORWARD -i tun0 -m comment --comment "!fw3" -j zone_vpn_forward
-A FORWARD -i wg -m comment --comment "!fw3" -j zone_vpn_forward
-A FORWARD -m comment --comment "!fw3" -j reject
-A OUTPUT -o lo -m comment --comment "!fw3" -j ACCEPT
-A OUTPUT -m comment --comment "!fw3: Custom output rule chain" -j output_rule
-A OUTPUT -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment "!fw3" -j ACCEPT
-A OUTPUT -o eth0 -m comment --comment "!fw3" -j zone_lan_output
-A OUTPUT -o pppoe-wan -m comment --comment "!fw3" -j zone_wan_output
-A OUTPUT -o eth1 -m comment --comment "!fw3" -j zone_wan_output
-A OUTPUT -o ipsec0 -m comment --comment "!fw3" -j zone_VPN_output
-A OUTPUT -o tun0 -m comment --comment "!fw3" -j zone_vpn_output
-A OUTPUT -o wg -m comment --comment "!fw3" -j zone_vpn_output
-A reject -p tcp -m comment --comment "!fw3" -j REJECT --reject-with tcp-reset
-A reject -m comment --comment "!fw3" -j REJECT --reject-with icmp6-port-unreachable
-A syn_flood -m limit --limit 25/sec --limit-burst 50 -m comment --comment "!fw3" -j RETURN
-A syn_flood -m comment --comment "!fw3" -j DROP
-A zone_VPN_dest_ACCEPT -o ipsec0 -m comment --comment "!fw3" -j ACCEPT
-A zone_VPN_forward -m comment --comment "!fw3: Custom VPN forwarding rule chain" -j forwarding_VPN_rule
-A zone_VPN_forward -m comment --comment "!fw3" -j zone_VPN_dest_ACCEPT
-A zone_VPN_input -m comment --comment "!fw3: Custom VPN input rule chain" -j input_VPN_rule
-A zone_VPN_input -m comment --comment "!fw3" -j zone_VPN_src_ACCEPT
-A zone_VPN_output -m comment --comment "!fw3: Custom VPN output rule chain" -j output_VPN_rule
-A zone_VPN_output -m comment --comment "!fw3" -j zone_VPN_dest_ACCEPT
-A zone_VPN_src_ACCEPT -i ipsec0 -m conntrack --ctstate NEW,UNTRACKED -m comment --comment "!fw3" -j ACCEPT
-A zone_lan_dest_ACCEPT -o eth0 -m comment --comment "!fw3" -j ACCEPT
-A zone_lan_forward -m comment --comment "!fw3: Custom lan forwarding rule chain" -j forwarding_lan_rule
-A zone_lan_forward -m comment --comment "!fw3: Zone lan to wan forwarding policy" -j zone_wan_dest_ACCEPT
-A zone_lan_forward -m comment --comment "!fw3: Zone lan to vpn forwarding policy" -j zone_vpn_dest_ACCEPT
-A zone_lan_forward -m comment --comment "!fw3" -j zone_lan_dest_ACCEPT
-A zone_lan_input -m comment --comment "!fw3: Custom lan input rule chain" -j input_lan_rule
-A zone_lan_input -m comment --comment "!fw3" -j zone_lan_src_ACCEPT
-A zone_lan_output -m comment --comment "!fw3: Custom lan output rule chain" -j output_lan_rule
-A zone_lan_output -m comment --comment "!fw3" -j zone_lan_dest_ACCEPT
-A zone_lan_src_ACCEPT -i eth0 -m conntrack --ctstate NEW,UNTRACKED -m comment --comment "!fw3" -j ACCEPT
-A zone_vpn_dest_ACCEPT -o tun0 -m conntrack --ctstate INVALID -m comment --comment "!fw3: Prevent NAT leakage" -j DROP
-A zone_vpn_dest_ACCEPT -o tun0 -m comment --comment "!fw3" -j ACCEPT
-A zone_vpn_dest_ACCEPT -o wg -m conntrack --ctstate INVALID -m comment --comment "!fw3: Prevent NAT leakage" -j DROP
-A zone_vpn_dest_ACCEPT -o wg -m comment --comment "!fw3" -j ACCEPT
-A zone_vpn_forward -m comment --comment "!fw3: Custom vpn forwarding rule chain" -j forwarding_vpn_rule
-A zone_vpn_forward -m comment --comment "!fw3: Zone vpn to wan forwarding policy" -j zone_wan_dest_ACCEPT
-A zone_vpn_forward -m comment --comment "!fw3: Zone vpn to lan forwarding policy" -j zone_lan_dest_ACCEPT
-A zone_vpn_forward -m comment --comment "!fw3" -j zone_vpn_dest_ACCEPT
-A zone_vpn_input -m comment --comment "!fw3: Custom vpn input rule chain" -j input_vpn_rule
-A zone_vpn_input -m comment --comment "!fw3" -j zone_vpn_src_ACCEPT
-A zone_vpn_output -m comment --comment "!fw3: Custom vpn output rule chain" -j output_vpn_rule
-A zone_vpn_output -m comment --comment "!fw3" -j zone_vpn_dest_ACCEPT
-A zone_vpn_src_ACCEPT -i tun0 -m conntrack --ctstate NEW,UNTRACKED -m comment --comment "!fw3" -j ACCEPT
-A zone_vpn_src_ACCEPT -i wg -m conntrack --ctstate NEW,UNTRACKED -m comment --comment "!fw3" -j ACCEPT
-A zone_wan_dest_ACCEPT -o pppoe-wan -m conntrack --ctstate INVALID -m comment --comment "!fw3: Prevent NAT leakage" -j DROP
-A zone_wan_dest_ACCEPT -o pppoe-wan -m comment --comment "!fw3" -j ACCEPT
-A zone_wan_dest_ACCEPT -o eth1 -m conntrack --ctstate INVALID -m comment --comment "!fw3: Prevent NAT leakage" -j DROP
-A zone_wan_dest_ACCEPT -o eth1 -m comment --comment "!fw3" -j ACCEPT
-A zone_wan_dest_REJECT -o pppoe-wan -m comment --comment "!fw3" -j reject
-A zone_wan_dest_REJECT -o eth1 -m comment --comment "!fw3" -j reject
-A zone_wan_forward -j MINIUPNPD
-A zone_wan_forward -j MINIUPNPD
-A zone_wan_forward -m comment --comment "!fw3: Custom wan forwarding rule chain" -j forwarding_wan_rule
-A zone_wan_forward -p ipv6-icmp -m icmp6 --icmpv6-type 128 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Forward" -j ACCEPT
-A zone_wan_forward -p ipv6-icmp -m icmp6 --icmpv6-type 129 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Forward" -j ACCEPT
-A zone_wan_forward -p ipv6-icmp -m icmp6 --icmpv6-type 1 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Forward" -j ACCEPT
-A zone_wan_forward -p ipv6-icmp -m icmp6 --icmpv6-type 2 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Forward" -j ACCEPT
-A zone_wan_forward -p ipv6-icmp -m icmp6 --icmpv6-type 3 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Forward" -j ACCEPT
-A zone_wan_forward -p ipv6-icmp -m icmp6 --icmpv6-type 4/0 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Forward" -j ACCEPT
-A zone_wan_forward -p ipv6-icmp -m icmp6 --icmpv6-type 4/1 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Forward" -j ACCEPT
-A zone_wan_forward -p esp -m comment --comment "!fw3: Allow-IPSec-ESP" -j zone_lan_dest_ACCEPT
-A zone_wan_forward -p udp -m udp --dport 500 -m comment --comment "!fw3: Allow-ISAKMP" -j zone_lan_dest_ACCEPT
-A zone_wan_forward -d ::c683:4fff:fe16:2a02/::ffff:ffff:ffff:ffff -p tcp -m tcp --dport 2222 -m comment --comment "!fw3: omv-sftp-2222" -j zone_lan_dest_ACCEPT
-A zone_wan_forward -m comment --comment "!fw3" -j zone_wan_dest_REJECT
-A zone_wan_input -m comment --comment "!fw3: Custom wan input rule chain" -j input_wan_rule
-A zone_wan_input -s fc00::/6 -d fc00::/6 -p udp -m udp --dport 546 -m comment --comment "!fw3: Allow-DHCPv6" -j ACCEPT
-A zone_wan_input -s fe80::/10 -p ipv6-icmp -m icmp6 --icmpv6-type 130/0 -m comment --comment "!fw3: Allow-MLD" -j ACCEPT
-A zone_wan_input -s fe80::/10 -p ipv6-icmp -m icmp6 --icmpv6-type 131/0 -m comment --comment "!fw3: Allow-MLD" -j ACCEPT
-A zone_wan_input -s fe80::/10 -p ipv6-icmp -m icmp6 --icmpv6-type 132/0 -m comment --comment "!fw3: Allow-MLD" -j ACCEPT
-A zone_wan_input -s fe80::/10 -p ipv6-icmp -m icmp6 --icmpv6-type 143/0 -m comment --comment "!fw3: Allow-MLD" -j ACCEPT
-A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 128 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT
-A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 129 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT
-A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 1 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT
-A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 2 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT
-A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 3 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT
-A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 4/0 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT
-A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 4/1 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT
-A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 133 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT
-A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 135 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT
-A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 134 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT
-A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 136 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT
-A zone_wan_input -p udp -m udp --dport 500 -m comment --comment "!fw3: ike" -j ACCEPT
-A zone_wan_input -p udp -m udp --dport 4500 -m comment --comment "!fw3: ipsec" -j ACCEPT
-A zone_wan_input -p ah -m comment --comment "!fw3: ah" -j ACCEPT
-A zone_wan_input -p esp -m comment --comment "!fw3: esp" -j ACCEPT
-A zone_wan_input -p tcp -m tcp --dport 1194 -m comment --comment "!fw3: openvpn" -j ACCEPT
-A zone_wan_input -p udp -m udp --dport 1194 -m comment --comment "!fw3: openvpn" -j ACCEPT
-A zone_wan_input -p tcp -m tcp --dport 1688 -m comment --comment "!fw3: kms" -j ACCEPT
-A zone_wan_input -p udp -m comment --comment "!fw3: Open19888" -j ACCEPT
-A zone_wan_input -m comment --comment "!fw3" -j zone_wan_src_REJECT
-A zone_wan_output -m comment --comment "!fw3: Custom wan output rule chain" -j output_wan_rule
-A zone_wan_output -m comment --comment "!fw3" -j zone_wan_dest_ACCEPT
-A zone_wan_src_REJECT -i pppoe-wan -m comment --comment "!fw3" -j reject
-A zone_wan_src_REJECT -i eth1 -m comment --comment "!fw3" -j reject
COMMIT
# Completed on Wed Aug 10 14:37:52 2022

#===================== IPSET状态 =====================#

Name: china
Name: china_ip_route
Name: china_ip_route_pass
Name: localnetwork
Name: common_ports

#===================== 路由表状态 =====================#

#route -n
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         100.67.192.1    0.0.0.0         UG    40     0        0 pppoe-wan
10.8.0.0        0.0.0.0         255.255.255.0   U     0      0        0 tun0
100.67.192.1    0.0.0.0         255.255.255.255 UH    0      0        0 pppoe-wan
192.168.1.0     0.0.0.0         255.255.255.0   U     0      0        0 eth1
192.168.6.0     0.0.0.0         255.255.255.0   U     0      0        0 eth0
192.168.9.0     0.0.0.0         255.255.255.0   U     0      0        0 wg
#ip route list
default via 100.67.192.1 dev pppoe-wan proto static metric 40 
10.8.0.0/24 dev tun0 proto kernel scope link src 10.8.0.1 
100.67.192.1 dev pppoe-wan proto kernel scope link src *WAN IP* 
192.168.1.0/24 dev eth1 proto kernel scope link src 192.168.1.11 
192.168.6.0/24 dev eth0 proto kernel scope link src 192.168.6.2 
192.168.9.0/24 dev wg proto kernel scope link src 192.168.9.1 
#ip rule show
0:  from all lookup local
32766:  from all lookup main
32767:  from all lookup default

#===================== 端口占用状态 =====================#

tcp        0      0 :::9090                 :::*                    LISTEN      20101/clash
tcp        0      0 :::7895                 :::*                    LISTEN      20101/clash
tcp        0      0 :::7893                 :::*                    LISTEN      20101/clash
tcp        0      0 :::7892                 :::*                    LISTEN      20101/clash
tcp        0      0 :::7891                 :::*                    LISTEN      20101/clash
tcp        0      0 :::7890                 :::*                    LISTEN      20101/clash
udp        0      0 :::7874                 :::*                                20101/clash
udp        0      0 :::7891                 :::*                                20101/clash
udp        0      0 :::7892                 :::*                                20101/clash
udp        0      0 :::7893                 :::*                                20101/clash
udp        0      0 :::7895                 :::*                                20101/clash

#===================== 测试本机DNS查询 =====================#

Server:     127.0.0.1
Address:    127.0.0.1:53

www.baidu.com   canonical name = www.a.shifen.com
Name:   www.a.shifen.com
Address: 14.215.177.38
Name:   www.a.shifen.com
Address: 14.215.177.39

#===================== resolv.conf.d =====================#

# Interface wan
nameserver 202.101.224.69
nameserver 202.101.226.69

#===================== 测试本机网络连接 =====================#

HTTP/1.1 200 OK
Accept-Ranges: bytes
Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform
Connection: keep-alive
Content-Length: 277
Content-Type: text/html
Date: Wed, 10 Aug 2022 06:37:52 GMT
Etag: "575e1f72-115"
Last-Modified: Mon, 13 Jun 2016 02:50:26 GMT
Pragma: no-cache
Server: bfe/1.0.8.18

#===================== 测试本机网络下载 =====================#

HTTP/1.1 200 OK
Connection: keep-alive
Content-Length: 80
Cache-Control: max-age=300
Content-Security-Policy: default-src 'none'; style-src 'unsafe-inline'; sandbox
Content-Type: text/plain; charset=utf-8
ETag: "8c9c2724dbecd721d24a35117a8c4e28d61e5a152a6107e6a8242986b9ec1eba"
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
X-Frame-Options: deny
X-XSS-Protection: 1; mode=block
X-GitHub-Request-Id: 90FE:2730:2FD474:4A4DC1:62ECD3C3
Accept-Ranges: bytes
Date: Wed, 10 Aug 2022 06:37:53 GMT
Via: 1.1 varnish
X-Served-By: cache-qpg1244-QPG
X-Cache: HIT
X-Cache-Hits: 1
X-Timer: S1660113474.961926,VS0,VE1
Vary: Authorization,Accept-Encoding,Origin
Access-Control-Allow-Origin: *
X-Fastly-Request-ID: 2af1bfbabdb5d2631fba148755a8b848ec2bac31
Expires: Wed, 10 Aug 2022 06:42:53 GMT
Source-Age: 47

#===================== 最近运行日志 =====================#

2022-08-10 14:29:34 Step 9: Add Cron Rules, Start Daemons...
2022-08-10 14:29:34 Warning: OpenClash Start Successful, Please Note That Network May Abnormal With IPv6's DHCP Server
2022-08-10 14:30:17 OpenClash Stoping...
2022-08-10 14:30:17 Step 1: Backup The Current Groups State...
2022-08-10 14:30:17 Step 2: Delete OpenClash Firewall Rules...
2022-08-10 14:30:18 Step 3: Close The OpenClash Daemons...
2022-08-10 14:30:18 Step 4: Close The Clash Core Process...
2022-08-10 14:30:18 Step 5: Restart Dnsmasq...
2022-08-10 14:30:20 Step 6: Delete OpenClash Residue File...
2022-08-10 14:30:20 OpenClash Start Running...
2022-08-10 14:30:20 Step 1: Get The Configuration...
2022-08-10 14:30:20 Step 2: Check The Components...
2022-08-10 14:30:21 Tip: Because of the file【 /etc/config/openclash 】modificated, Pause quick start...
2022-08-10 14:30:21 Step 3: Modify The Config File...
2022-08-10 14:30:21 Detected That The nameserver DNS Option Has No Server Set, Starting To Complete...
2022-08-10 14:30:23 Step 4: Start Running The Clash Core...
2022-08-10 14:30:23 Tip: No Special Configuration Detected, Use Dev Core to Start...
2022-08-10 14:30:24 Step 5: Check The Core Status...
time="2022-08-10T06:30:24Z" level=info msg="Start initial compatible provider 📢 谷歌FCM"
time="2022-08-10T06:30:24Z" level=info msg="Start initial compatible provider 📲 电报消息"
time="2022-08-10T06:30:24Z" level=info msg="Start initial compatible provider Ⓜ️ 微软云盘"
time="2022-08-10T06:30:24Z" level=info msg="Start initial compatible provider 🇸🇬 狮城节点"
time="2022-08-10T06:30:24Z" level=info msg="Start initial compatible provider 🍃 应用净化"
time="2022-08-10T06:30:24Z" level=info msg="Start initial compatible provider 🎥 奈飞视频"
time="2022-08-10T06:30:24Z" level=info msg="Start initial compatible provider 📺 哔哩哔哩"
time="2022-08-10T06:30:24Z" level=info msg="Start initial compatible provider 🇰🇷 韩国节点"
time="2022-08-10T06:30:24Z" level=info msg="Start initial compatible provider 🐟 漏网之鱼"
time="2022-08-10T06:30:24Z" level=info msg="Start initial compatible provider 📹 油管视频"
time="2022-08-10T06:30:24Z" level=info msg="Start initial compatible provider 🇺🇲 美国节点"
time="2022-08-10T06:30:24Z" level=info msg="Start initial compatible provider 🇯🇵 日本节点"
time="2022-08-10T06:30:24Z" level=info msg="Start initial compatible provider 🚀 节点选择"
time="2022-08-10T06:30:24Z" level=info msg="Start initial compatible provider 🎶 网易音乐"
time="2022-08-10T06:30:24Z" level=info msg="Start initial compatible provider 🚀 手动切换"
time="2022-08-10T06:30:24Z" level=info msg="Start initial compatible provider 🛑 广告拦截"
time="2022-08-10T06:30:24Z" level=info msg="Start initial compatible provider 🌍 国外媒体"
time="2022-08-10T06:30:24Z" level=info msg="Start initial compatible provider 📺 巴哈姆特"
time="2022-08-10T06:30:24Z" level=info msg="Start initial compatible provider 🇭🇰 香港节点"
time="2022-08-10T06:30:24Z" level=info msg="Start initial compatible provider 🎥 奈飞节点"
time="2022-08-10T06:30:24Z" level=info msg="Start initial compatible provider 🌏 国内媒体"
time="2022-08-10T06:30:24Z" level=info msg="Start initial compatible provider 🇨🇳 台湾节点"
time="2022-08-10T06:30:24Z" level=info msg="Start initial compatible provider 🎯 全球直连"
time="2022-08-10T06:30:24Z" level=info msg="Start initial compatible provider 🍎 苹果服务"
time="2022-08-10T06:30:24Z" level=info msg="Start initial compatible provider Ⓜ️ 微软服务"
time="2022-08-10T06:30:24Z" level=info msg="Start initial compatible provider ♻️ 自动选择"
time="2022-08-10T06:30:24Z" level=info msg="Start initial compatible provider 🎮 游戏平台"
2022-08-10 14:30:27 Step 6: Wait For The File Downloading...
2022-08-10 14:30:27 Step 7: Set Firewall Rules...
2022-08-10 14:30:27 Step 8: Restart Dnsmasq...
2022-08-10 14:30:30 Step 9: Add Cron Rules, Start Daemons...
2022-08-10 14:30:30 Warning: OpenClash Start Successful, Please Note That Network May Abnormal With IPv6's DHCP Server

### OpenClash Config

_No response_

### Expected Behavior

。

### Screenshots

_No response_
Review977 commented 2 years ago

遇到同样的问题了，回41版本正常。

vernesong commented 2 years ago

不勾选控制面板连接日志提示什么错误？

a904055262 commented 2 years ago

不勾选控制面板连接日志提示什么错误？

2022-08-16 00:04:59 错误：【超级跑车】下载失败，请检查网络或稍后再试... 2022-08-16 00:03:57 错误：配置文件【超级跑车】订阅失败，尝试不使用代理下载配置文件... 2022-08-16 00:03:06 开始更新配置文件【超级跑车】... 2022-08-16 00:03:03 错误：【超级跑车x1】下载失败，请检查网络或稍后再试... 2022-08-16 00:02:02 错误：配置文件【超级跑车x1】订阅失败，尝试不使用代理下载配置文件... 2022-08-16 00:01:30 开始更新配置文件【超级跑车x1】... 2022-08-16 00:01:26 错误：【跑路云】下载失败，请检查网络或稍后再试... 2022-08-16 00:00:24 错误：配置文件【跑路云】订阅失败，尝试不使用代理下载配置文件... 2022-08-16 00:00:00 开始更新配置文件【跑路云】...

勾上自定义DNS还是计划任务失败，但是手动执行计划任务的shell命令是可以成功执行的，或者点击更新订阅也是可以正常更新的。

还有就是不勾选返回0.0.0.0ip的问题，控制面板看不到任何相关的域名的日志。

vernesong commented 2 years ago

不勾选下的调试日志

a904055262 commented 2 years ago

不勾选下的调试日志

新建 文本文档.txt

a904055262 commented 2 years ago

不勾选下的调试日志

你那边不能重现么？我取消勾选“自定义上游DNS服务器” 就100%重现

a904055262 commented 2 years ago

不勾选下的调试日志

老版本``

不勾选下的调试日志

刚看到楼上说的41版本正常，我用opkg install --force-downgrade 41.apk后发现的确正常了。

gzw13999 commented 2 years ago

确实会有问题，自定义上游 DNS 服务器 取消后部分DNS无法解析。

vernesong commented 2 years ago

你只写了nameserver，返回的0.0.0.0在没写filter的情况下会认为是无污染IP，所以必须写fallback和filter

a904055262 commented 2 years ago

你只写了nameserver，返回的0.0.0.0在没写filter的情况下会认为是无污染IP，所以必须写fallback和filter

那计划任务更新配置文件失败怎么解决

vernesong commented 2 years ago

换个时间更新，这是网络问题

fayelove521 commented 2 years ago

我也遇到了。开了mosdns，解决了。

github-actions[bot] commented 2 years ago

This issue is stale because it has been open 60 days with no activity. Remove stale label or comment or this will be closed in 5 days