search

vernesong / OpenClash

A Clash Client For OpenWrt
MIT License
17.37k stars 3.17k forks source link

[Bug] 配合tailscales共存时 端口代理失效 #2810

Closed LOVE2CMOL closed 1 year ago

LOVE2CMOL commented 1 year ago

Verify Steps

OpenClash Version

v0.45.70-beta

Bug on Environment

Official OpenWrt

Bug on Platform

Linux-amd64(x86-64)

To Reproduce

配合tailscales共存时 端口代理失效

image image

chrome使用的插件为SwitchyOmega

Describe the Bug

配合tailscales共存时 端口代理失效 image

OpenClash Log

OpenClash 调试日志

生成时间: 2022-11-12 18:38:03 插件版本: v0.45.70-beta 隐私提示: 上传此日志前请注意检查、屏蔽公网IP、节点、密码等相关敏感信息



#===================== 系统信息 =====================#

主机型号: QEMU Standard PC (i440FX + PIIX - Intel(R) Core(TM) i3-5###U CPU @ 2.00GHz : 4 Core 4 Thread
固件版本: OpenWrt SNAPSHOT r4807-665970a97
LuCI版本: git-22.211.60098-feaa27a-1
内核版本: 5.15.59
处理器架构: x86_64

#此项有值时,如不使用IPv6,建议到网络-接口-lan的设置中禁用IPV6的DHCP
IPV6-DHCP: 

#此项结果应仅有配置文件的DNS监听地址
Dnsmasq转发设置: 127.0.0.1#7874

#===================== 依赖检查 =====================#

dnsmasq-full: 已安装
coreutils: 已安装
coreutils-nohup: 已安装
bash: 已安装
curl: 已安装
ca-certificates: 已安装
ipset: 已安装
ip-full: 已安装
libcap: 已安装
libcap-bin: 已安装
ruby: 已安装
ruby-yaml: 已安装
ruby-psych: 已安装
ruby-pstore: 已安装
kmod-tun(TUN模式): 已安装
luci-compat(Luci >= 19.07): 已安装
kmod-inet-diag(PROCESS-NAME): 已安装
unzip: 已安装
iptables-mod-tproxy: 已安装
kmod-ipt-tproxy: 已安装
iptables-mod-extra: 已安装
kmod-ipt-extra: 已安装
kmod-ipt-nat: 已安装

#===================== 内核检查 =====================#

运行状态: 运行中
进程pid: 7659
运行权限: 7659: cap_dac_override,cap_net_bind_service,cap_net_admin,cap_net_raw,cap_sys_ptrace,cap_sys_resource=eip
运行用户: nobody
已选择的架构: linux-amd64

#下方无法显示内核版本号时请确认您的内核版本是否正确或者有无权限
Tun内核版本: 2022.08.26-16-gb4d832d
Tun内核文件: 存在
Tun内核运行权限: 正常

Dev内核版本: v1.11.12-1-gde264c4
Dev内核文件: 存在
Dev内核运行权限: 正常

Meta内核版本: alpha-g4c5853e
Meta内核文件: 存在
Meta内核运行权限: 正常

#===================== 插件设置 =====================#

当前配置文件: /etc/openclash/config/config.yaml
启动配置文件: /etc/openclash/config.yaml
运行模式: redir-host-mix
默认代理模式: rule
UDP流量转发(tproxy): 停用
DNS劫持: 启用
自定义DNS: 启用
IPV6代理: 停用
IPV6-DNS解析: 启用
禁用Dnsmasq缓存: 启用
自定义规则: 启用
仅允许内网: 停用
仅代理命中规则流量: 启用
仅允许常用端口流量: 启用
绕过中国大陆IP: 启用
DNS远程解析: 停用
路由本机代理: 停用

#启动异常时建议关闭此项后重试
混合节点: 停用
保留配置: 停用

#启动异常时建议关闭此项后重试
第三方规则: 启用

#===================== 自定义规则 一 =====================#
script:
##  shortcuts:
##    Notice: The core timezone is UTC
##    CST 20:00-24:00 = time.now().hour > 12 and time.now().hour < 16
##    内核时区为UTC,故以下time.now()函数的取值需要根据本地时区进行转换
##    北京时间(CST) 20:00-24:00 = time.now().hour > 12 and time.now().hour < 16
##    quic: network == 'udp' and dst_port == 443 and (geoip(resolve_ip(host)) != 'CN' or geoip(dst_ip) != 'CN')
##    time-limit: in_cidr(src_ip,'192.168.1.2/32') and time.now().hour < 20 or time.now().hour > 21
##    time-limit: src_ip == '192.168.1.2' and time.now().hour < 20 or time.now().hour > 21

##  code: |
##    def main(ctx, metadata):
##        directkeywordlist = ["baidu"]
##        for directkeyword in directkeywordlist:
##          if directkeyword in metadata["host"]:
##            ctx.log('[Script] matched keyword %s use direct' % directkeyword)
##            return "DIRECT"

rules:
##- SCRIPT,quic,REJECT #shortcuts rule
##- SCRIPT,time-limit,REJECT #shortcuts rule

##- PROCESS-NAME,curl,DIRECT #匹配路由自身进程(curl直连)
##- DOMAIN-SUFFIX,google.com,Proxy #匹配域名后缀(交由Proxy代理服务器组)
##- DOMAIN-KEYWORD,google,Proxy #匹配域名关键字(交由Proxy代理服务器组)
##- DOMAIN,google.com,Proxy #匹配域名(交由Proxy代理服务器组)
##- DOMAIN-SUFFIX,ad.com,REJECT #匹配域名后缀(拒绝)
##- IP-CIDR,127.0.0.0/8,DIRECT #匹配数据目标IP(直连)
##- SRC-IP-CIDR,192.168.1.201/32,DIRECT #匹配数据发起IP(直连)
##- DST-PORT,80,DIRECT #匹配数据目标端口(直连)
##- SRC-PORT,7777,DIRECT #匹配数据源端口(直连)

##排序在上的规则优先生效,如添加（去除规则前的#号）：
##IP段：192.168.1.2-192.168.1.200 直连
##- SRC-IP-CIDR,192.168.1.2/31,DIRECT
##- SRC-IP-CIDR,192.168.1.4/30,DIRECT
##- SRC-IP-CIDR,192.168.1.8/29,DIRECT
##- SRC-IP-CIDR,192.168.1.16/28,DIRECT
##- SRC-IP-CIDR,192.168.1.32/27,DIRECT
##- SRC-IP-CIDR,192.168.1.64/26,DIRECT
##- SRC-IP-CIDR,192.168.1.128/26,DIRECT
##- SRC-IP-CIDR,192.168.1.192/29,DIRECT
##- SRC-IP-CIDR,192.168.1.200/32,DIRECT

##IP段：192.168.1.202-192.168.1.255 直连
##- SRC-IP-CIDR,192.168.1.202/31,DIRECT
##- SRC-IP-CIDR,192.168.1.204/30,DIRECT
##- SRC-IP-CIDR,192.168.1.208/28,DIRECT
##- SRC-IP-CIDR,192.168.1.224/27,DIRECT

##此时IP为192.168.1.1和192.168.1.201的客户端流量走代理（策略），其余客户端不走代理
##因为Fake-IP模式下，IP地址为192.168.1.1的路由器自身流量可走代理（策略），所以需要排除

##仅设置路由器自身直连：
##- SRC-IP-CIDR,192.168.1.1/32,DIRECT
##- SRC-IP-CIDR,198.18.0.1/32,DIRECT

##DDNS
##- DOMAIN-SUFFIX,checkip.dyndns.org,DIRECT
##- DOMAIN-SUFFIX,checkipv6.dyndns.org,DIRECT
##- DOMAIN-SUFFIX,checkip.synology.com,DIRECT
##- DOMAIN-SUFFIX,ifconfig.co,DIRECT
##- DOMAIN-SUFFIX,api.myip.com,DIRECT
##- DOMAIN-SUFFIX,ip-api.com,DIRECT
##- DOMAIN-SUFFIX,ipapi.co,DIRECT
##- DOMAIN-SUFFIX,ip6.seeip.org,DIRECT
##- DOMAIN-SUFFIX,members.3322.org,DIRECT

##在线IP段转CIDR地址：http://ip2cidr.com
#===================== 自定义规则 二 =====================#
script:
##  shortcuts:
##    common_port: dst_port not in [21, 22, 23, 53, 80, 123, 143, 194, 443, 465, 587, 853, 993, 995, 998, 2052, 2053, 2082, 2083, 2086, 2095, 2096, 5222, 5228, 5229, 5230, 8080, 8443, 8880, 8888, 8889]

##  code: |
##    def main(ctx, metadata):
##        directkeywordlist = ["baidu"]
##        for directkeyword in directkeywordlist:
##          if directkeyword in metadata["host"]:
##            ctx.log('[Script] matched keyword %s use direct' % directkeyword)
##            return "DIRECT"

rules:
##- SCRIPT,common_port,DIRECT #shortcuts rule

##- DOMAIN-SUFFIX,google.com,Proxy #匹配域名后缀(交由Proxy代理服务器组)
##- DOMAIN-KEYWORD,google,Proxy #匹配域名关键字(交由Proxy代理服务器组)
##- DOMAIN,google.com,Proxy #匹配域名(交由Proxy代理服务器组)
##- DOMAIN-SUFFIX,ad.com,REJECT #匹配域名后缀(拒绝)
##- IP-CIDR,127.0.0.0/8,DIRECT #匹配数据目标IP(直连)
##- SRC-IP-CIDR,192.168.1.201/32,DIRECT #匹配数据发起IP(直连)
##- DST-PORT,80,DIRECT #匹配数据目标端口(直连)
##- SRC-PORT,7777,DIRECT #匹配数据源端口(直连)

#===================== 配置文件 =====================#
省略
#===================== IPTABLES 防火墙设置 =====================#

#IPv4 NAT chain

# Generated by iptables-save v1.8.7 on Sat Nov 12 18:38:09 2022
*nat
:PREROUTING ACCEPT [2087:306030]
:INPUT ACCEPT [1143:79762]
:OUTPUT ACCEPT [2257:147297]
:POSTROUTING ACCEPT [4125:432128]
:MINIUPNPD - [0:0]
:MINIUPNPD-POSTROUTING - [0:0]
:openclash - [0:0]
:openclash_output - [0:0]
:postrouting_lan_rule - [0:0]
:postrouting_rule - [0:0]
:postrouting_wan_rule - [0:0]
:prerouting_lan_rule - [0:0]
:prerouting_rule - [0:0]
:prerouting_wan_rule - [0:0]
:ts-postrouting - [0:0]
:zone_lan_postrouting - [0:0]
:zone_lan_prerouting - [0:0]
:zone_wan_postrouting - [0:0]
:zone_wan_prerouting - [0:0]
-A PREROUTING -p tcp -m comment --comment "OpenClash TCP DNS Hijack" -m tcp --dport 53 -j ACCEPT
-A PREROUTING -p tcp -m tcp --dport 53 -m comment --comment "OpenClash DNS Hijack" -j REDIRECT --to-ports 53
-A PREROUTING -p udp -m udp --dport 53 -m comment --comment "OpenClash DNS Hijack" -j REDIRECT --to-ports 53
-A PREROUTING -p udp -m udp --dport 53 -j REDIRECT --to-ports 53
-A PREROUTING -p tcp -m tcp --dport 53 -j REDIRECT --to-ports 53
-A PREROUTING -m comment --comment "!fw3: Custom prerouting rule chain" -j prerouting_rule
-A PREROUTING -i br-lan -m comment --comment "!fw3" -j zone_lan_prerouting
-A PREROUTING -i tailscale0 -m comment --comment "!fw3" -j zone_lan_prerouting
-A PREROUTING -p tcp -j openclash
-A OUTPUT -j openclash_output
-A POSTROUTING -j ts-postrouting
-A POSTROUTING -o ztklhrxcej -j MASQUERADE
-A POSTROUTING -o ztyxazotnw -j MASQUERADE
-A POSTROUTING -m comment --comment "!fw3: Custom postrouting rule chain" -j postrouting_rule
-A POSTROUTING -o br-lan -m comment --comment "!fw3" -j zone_lan_postrouting
-A POSTROUTING -o tailscale0 -m comment --comment "!fw3" -j zone_lan_postrouting
-A MINIUPNPD -p udp -m udp --dport 48339 -j DNAT --to-destination 192.168.83.80:47999
-A MINIUPNPD -p udp -m udp --dport 48350 -j DNAT --to-destination 192.168.83.80:48010
-A MINIUPNPD -p udp -m udp --dport 48338 -j DNAT --to-destination 192.168.83.80:47998
-A MINIUPNPD -p udp -m udp --dport 48340 -j DNAT --to-destination 192.168.83.80:48000
-A MINIUPNPD -p udp -m udp --dport 48342 -j DNAT --to-destination 192.168.83.80:48002
-A MINIUPNPD -p tcp -m tcp --dport 53208 -j DNAT --to-destination 192.168.83.30:59019
-A MINIUPNPD -p tcp -m tcp --dport 55037 -j DNAT --to-destination 192.168.83.18:22335
-A MINIUPNPD -p tcp -m tcp --dport 23794 -j DNAT --to-destination 192.168.83.18:22335
-A MINIUPNPD -p tcp -m tcp --dport 8096 -j DNAT --to-destination 192.168.83.8:8096
-A MINIUPNPD -p tcp -m tcp --dport 8920 -j DNAT --to-destination 192.168.83.8:8920
-A MINIUPNPD -p tcp -m tcp --dport 59606 -j DNAT --to-destination 192.168.83.8:59606
-A MINIUPNPD -p udp -m udp --dport 59608 -j DNAT --to-destination 192.168.83.8:59608
-A MINIUPNPD -p tcp -m tcp --dport 59843 -j DNAT --to-destination 192.168.83.8:59843
-A MINIUPNPD -p tcp -m tcp --dport 1258 -j DNAT --to-destination 192.168.83.32:22344
-A MINIUPNPD -p tcp -m tcp --dport 11595 -j DNAT --to-destination 192.168.83.32:22342
-A MINIUPNPD -p tcp -m tcp --dport 23589 -j DNAT --to-destination 192.168.83.32:22343
-A MINIUPNPD -p tcp -m tcp --dport 47984 -j DNAT --to-destination 192.168.83.80:47984
-A MINIUPNPD -p tcp -m tcp --dport 47989 -j DNAT --to-destination 192.168.83.80:47989
-A MINIUPNPD -p tcp -m tcp --dport 48010 -j DNAT --to-destination 192.168.83.80:48010
-A MINIUPNPD -p udp -m udp --dport 47998 -j DNAT --to-destination 192.168.83.80:47998
-A MINIUPNPD -p udp -m udp --dport 47999 -j DNAT --to-destination 192.168.83.80:47999
-A MINIUPNPD -p udp -m udp --dport 48000 -j DNAT --to-destination 192.168.83.80:48000
-A MINIUPNPD -p udp -m udp --dport 48002 -j DNAT --to-destination 192.168.83.80:48002
-A MINIUPNPD -p udp -m udp --dport 48010 -j DNAT --to-destination 192.168.83.80:48010
-A MINIUPNPD-POSTROUTING -s 192.168.83.80/32 -p udp -m udp --sport 47999 -j MASQUERADE --to-ports 48339
-A MINIUPNPD-POSTROUTING -s 192.168.83.80/32 -p udp -m udp --sport 48010 -j MASQUERADE --to-ports 48350
-A MINIUPNPD-POSTROUTING -s 192.168.83.80/32 -p udp -m udp --sport 47998 -j MASQUERADE --to-ports 48338
-A MINIUPNPD-POSTROUTING -s 192.168.83.80/32 -p udp -m udp --sport 48000 -j MASQUERADE --to-ports 48340
-A MINIUPNPD-POSTROUTING -s 192.168.83.80/32 -p udp -m udp --sport 48002 -j MASQUERADE --to-ports 48342
-A MINIUPNPD-POSTROUTING -s 192.168.83.30/32 -p tcp -m tcp --sport 59019 -j MASQUERADE --to-ports 53208
-A MINIUPNPD-POSTROUTING -s 192.168.83.18/32 -p tcp -m tcp --sport 22335 -j MASQUERADE --to-ports 55037
-A MINIUPNPD-POSTROUTING -s 192.168.83.18/32 -p tcp -m tcp --sport 22335 -j MASQUERADE --to-ports 23794
-A MINIUPNPD-POSTROUTING -s 192.168.83.32/32 -p tcp -m tcp --sport 22344 -j MASQUERADE --to-ports 1258
-A MINIUPNPD-POSTROUTING -s 192.168.83.32/32 -p tcp -m tcp --sport 22342 -j MASQUERADE --to-ports 11595
-A MINIUPNPD-POSTROUTING -s 192.168.83.32/32 -p tcp -m tcp --sport 22343 -j MASQUERADE --to-ports 23589
-A openclash -p tcp -m tcp --sport 1688 -j RETURN
-A openclash -m set --match-set localnetwork dst -j RETURN
-A openclash -m set --match-set lan_ac_black_ips src -j RETURN
-A openclash -m set ! --match-set common_ports dst -j RETURN
-A openclash -m set --match-set china_ip_route dst -m set ! --match-set china_ip_route_pass dst -j RETURN
-A openclash -p tcp -j REDIRECT --to-ports 7892
-A openclash_output -p tcp -m tcp --sport 1688 -j RETURN
-A openclash_output -m set --match-set localnetwork dst -j RETURN
-A openclash_output -m owner ! --uid-owner 65534 -m set ! --match-set common_ports dst -j RETURN
-A openclash_output -m owner ! --uid-owner 65534 -m set --match-set china_ip_route dst -m set ! --match-set china_ip_route_pass dst -j RETURN
-A openclash_output -p tcp -m owner ! --uid-owner 65534 -j REDIRECT --to-ports 7892
-A ts-postrouting -m mark --mark 0x40000 -j MASQUERADE
-A zone_lan_postrouting -j MINIUPNPD-POSTROUTING
-A zone_lan_postrouting -j MINIUPNPD-POSTROUTING
-A zone_lan_postrouting -m comment --comment "!fw3: Custom lan postrouting rule chain" -j postrouting_lan_rule
-A zone_lan_prerouting -j MINIUPNPD
-A zone_lan_prerouting -j MINIUPNPD
-A zone_lan_prerouting -m comment --comment "!fw3: Custom lan prerouting rule chain" -j prerouting_lan_rule
-A zone_wan_postrouting -m comment --comment "!fw3: Custom wan postrouting rule chain" -j postrouting_wan_rule
-A zone_wan_postrouting -m comment --comment "!fw3" -j FULLCONENAT
-A zone_wan_prerouting -m comment --comment "!fw3: Custom wan prerouting rule chain" -j prerouting_wan_rule
-A zone_wan_prerouting -m comment --comment "!fw3" -j FULLCONENAT
COMMIT
# Completed on Sat Nov 12 18:38:09 2022

#IPv4 Mangle chain

# Generated by iptables-save v1.8.7 on Sat Nov 12 18:38:09 2022
*mangle
:PREROUTING ACCEPT [5500:8813539]
:INPUT ACCEPT [1073:408715]
:FORWARD ACCEPT [4427:8404824]
:OUTPUT ACCEPT [1154:484247]
:POSTROUTING ACCEPT [5581:8889071]
:RRDIPT_FORWARD - [0:0]
:RRDIPT_INPUT - [0:0]
:RRDIPT_OUTPUT - [0:0]
:openclash - [0:0]
:openclash_dns_hijack - [0:0]
-A PREROUTING -p udp -j openclash
-A PREROUTING -p tcp -m tcp --dport 53 -j openclash_dns_hijack
-A INPUT -j RRDIPT_INPUT
-A FORWARD -j RRDIPT_FORWARD
-A OUTPUT -j RRDIPT_OUTPUT
-A RRDIPT_FORWARD -s 192.168.83.1/32 -j RETURN
-A RRDIPT_FORWARD -d 192.168.83.1/32 -j RETURN
-A RRDIPT_FORWARD -s 192.168.83.8/32 -j RETURN
-A RRDIPT_FORWARD -d 192.168.83.8/32 -j RETURN
-A RRDIPT_FORWARD -s 192.168.83.10/32 -j RETURN
-A RRDIPT_FORWARD -d 192.168.83.10/32 -j RETURN
-A RRDIPT_FORWARD -s 192.168.83.11/32 -j RETURN
-A RRDIPT_FORWARD -d 192.168.83.11/32 -j RETURN
-A RRDIPT_FORWARD -s 192.168.83.12/32 -j RETURN
-A RRDIPT_FORWARD -d 192.168.83.12/32 -j RETURN
-A RRDIPT_FORWARD -s 192.168.83.100/32 -j RETURN
-A RRDIPT_FORWARD -d 192.168.83.100/32 -j RETURN
-A RRDIPT_FORWARD -s 192.168.83.30/32 -j RETURN
-A RRDIPT_FORWARD -d 192.168.83.30/32 -j RETURN
-A RRDIPT_FORWARD -s 192.168.83.31/32 -j RETURN
-A RRDIPT_FORWARD -d 192.168.83.31/32 -j RETURN
-A RRDIPT_FORWARD -s 192.168.83.32/32 -j RETURN
-A RRDIPT_FORWARD -d 192.168.83.32/32 -j RETURN
-A RRDIPT_FORWARD -s 192.168.83.50/32 -j RETURN
-A RRDIPT_FORWARD -d 192.168.83.50/32 -j RETURN
-A RRDIPT_FORWARD -s 192.168.83.18/32 -j RETURN
-A RRDIPT_FORWARD -d 192.168.83.18/32 -j RETURN
-A RRDIPT_FORWARD -s 192.168.83.51/32 -j RETURN
-A RRDIPT_FORWARD -d 192.168.83.51/32 -j RETURN
-A RRDIPT_FORWARD -s 192.168.83.52/32 -j RETURN
-A RRDIPT_FORWARD -d 192.168.83.52/32 -j RETURN
-A RRDIPT_FORWARD -s 192.168.83.150/32 -j RETURN
-A RRDIPT_FORWARD -d 192.168.83.150/32 -j RETURN
-A RRDIPT_FORWARD -s 192.168.83.151/32 -j RETURN
-A RRDIPT_FORWARD -d 192.168.83.151/32 -j RETURN
-A RRDIPT_FORWARD -s 192.168.83.80/32 -j RETURN
-A RRDIPT_FORWARD -d 192.168.83.80/32 -j RETURN
-A RRDIPT_FORWARD -s 192.168.83.81/32 -j RETURN
-A RRDIPT_FORWARD -d 192.168.83.81/32 -j RETURN
-A RRDIPT_FORWARD -s 192.168.83.155/32 -j RETURN
-A RRDIPT_FORWARD -d 192.168.83.155/32 -j RETURN
-A RRDIPT_FORWARD -s 192.168.83.6/32 -j RETURN
-A RRDIPT_FORWARD -d 192.168.83.6/32 -j RETURN
-A RRDIPT_FORWARD -s 192.168.83.7/32 -j RETURN
-A RRDIPT_FORWARD -d 192.168.83.7/32 -j RETURN
-A RRDIPT_FORWARD -s 192.168.83.152/32 -j RETURN
-A RRDIPT_FORWARD -d 192.168.83.152/32 -j RETURN
-A RRDIPT_FORWARD -s 192.168.83.153/32 -j RETURN
-A RRDIPT_FORWARD -d 192.168.83.153/32 -j RETURN
-A RRDIPT_FORWARD -s 192.168.83.5/32 -j RETURN
-A RRDIPT_FORWARD -d 192.168.83.5/32 -j RETURN
-A RRDIPT_FORWARD -s 192.168.83.40/32 -j RETURN
-A RRDIPT_FORWARD -d 192.168.83.40/32 -j RETURN
-A RRDIPT_FORWARD -s 192.168.83.101/32 -j RETURN
-A RRDIPT_FORWARD -d 192.168.83.101/32 -j RETURN
-A RRDIPT_FORWARD -s 192.168.83.82/32 -j RETURN
-A RRDIPT_FORWARD -d 192.168.83.82/32 -j RETURN
-A RRDIPT_INPUT -i eth0 -j RETURN
-A RRDIPT_INPUT -i br-lan -j RETURN
-A RRDIPT_OUTPUT -o eth0 -j RETURN
-A RRDIPT_OUTPUT -o br-lan -j RETURN
-A openclash -p udp -m udp --sport 500 -j RETURN
-A openclash -p udp -m udp --sport 68 -j RETURN
-A openclash -m set --match-set localnetwork dst -j RETURN
-A openclash -m set --match-set lan_ac_black_ips src -j RETURN
-A openclash -m set ! --match-set common_ports dst -j RETURN
-A openclash -m set --match-set china_ip_route dst -m set ! --match-set china_ip_route_pass dst -j RETURN
-A openclash -j MARK --set-xmark 0x162/0xffffffff
-A openclash_dns_hijack -p tcp -m comment --comment "OpenClash TCP DNS Hijack" -m tcp --dport 53 -j MARK --set-xmark 0x162/0xffffffff
COMMIT
# Completed on Sat Nov 12 18:38:09 2022

#IPv4 Filter chain

# Generated by iptables-save v1.8.7 on Sat Nov 12 18:38:09 2022
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:MINIUPNPD - [0:0]
:forwarding_lan_rule - [0:0]
:forwarding_rule - [0:0]
:forwarding_wan_rule - [0:0]
:input_lan_rule - [0:0]
:input_rule - [0:0]
:input_wan_rule - [0:0]
:output_lan_rule - [0:0]
:output_rule - [0:0]
:output_wan_rule - [0:0]
:reject - [0:0]
:syn_flood - [0:0]
:ts-forward - [0:0]
:ts-input - [0:0]
:zone_lan_dest_ACCEPT - [0:0]
:zone_lan_forward - [0:0]
:zone_lan_input - [0:0]
:zone_lan_output - [0:0]
:zone_lan_src_ACCEPT - [0:0]
:zone_wan_dest_ACCEPT - [0:0]
:zone_wan_dest_REJECT - [0:0]
:zone_wan_forward - [0:0]
:zone_wan_input - [0:0]
:zone_wan_output - [0:0]
:zone_wan_src_REJECT - [0:0]
-A INPUT -j ts-input
-A INPUT -i lo -m comment --comment "!fw3" -j ACCEPT
-A INPUT -m comment --comment "!fw3: Custom input rule chain" -j input_rule
-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment "!fw3" -j ACCEPT
-A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -m comment --comment "!fw3" -j syn_flood
-A INPUT -i br-lan -m comment --comment "!fw3" -j zone_lan_input
-A INPUT -i tailscale0 -m comment --comment "!fw3" -j zone_lan_input
-A FORWARD -o utun -m comment --comment "OpenClash TUN Forward" -j ACCEPT
-A FORWARD -j ts-forward
-A FORWARD -o ztklhrxcej -j ACCEPT
-A FORWARD -i ztklhrxcej -j ACCEPT
-A FORWARD -o ztyxazotnw -j ACCEPT
-A FORWARD -i ztyxazotnw -j ACCEPT
-A FORWARD -m comment --comment "!fw3: Custom forwarding rule chain" -j forwarding_rule
-A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment "!fw3" -j ACCEPT
-A FORWARD -i br-lan -m comment --comment "!fw3" -j zone_lan_forward
-A FORWARD -i tailscale0 -m comment --comment "!fw3" -j zone_lan_forward
-A OUTPUT -o lo -m comment --comment "!fw3" -j ACCEPT
-A OUTPUT -m comment --comment "!fw3: Custom output rule chain" -j output_rule
-A OUTPUT -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment "!fw3" -j ACCEPT
-A OUTPUT -o br-lan -m comment --comment "!fw3" -j zone_lan_output
-A OUTPUT -o tailscale0 -m comment --comment "!fw3" -j zone_lan_output
-A MINIUPNPD -d 192.168.83.30/32 -p tcp -m tcp --dport 59019 -j ACCEPT
-A MINIUPNPD -d 192.168.83.18/32 -p tcp -m tcp --dport 22335 -j ACCEPT
-A MINIUPNPD -d 192.168.83.18/32 -p tcp -m tcp --dport 22335 -j ACCEPT
-A MINIUPNPD -d 192.168.83.8/32 -p tcp -m tcp --dport 8096 -j ACCEPT
-A MINIUPNPD -d 192.168.83.8/32 -p tcp -m tcp --dport 8920 -j ACCEPT
-A MINIUPNPD -d 192.168.83.8/32 -p tcp -m tcp --dport 59606 -j ACCEPT
-A MINIUPNPD -d 192.168.83.8/32 -p udp -m udp --dport 59608 -j ACCEPT
-A MINIUPNPD -d 192.168.83.8/32 -p tcp -m tcp --dport 59843 -j ACCEPT
-A MINIUPNPD -d 192.168.83.32/32 -p tcp -m tcp --dport 22344 -j ACCEPT
-A MINIUPNPD -d 192.168.83.32/32 -p tcp -m tcp --dport 22342 -j ACCEPT
-A MINIUPNPD -d 192.168.83.32/32 -p tcp -m tcp --dport 22343 -j ACCEPT
-A MINIUPNPD -d 192.168.83.80/32 -p udp -m udp --dport 47998 -j ACCEPT
-A MINIUPNPD -d 192.168.83.80/32 -p udp -m udp --dport 47999 -j ACCEPT
-A MINIUPNPD -d 192.168.83.80/32 -p udp -m udp --dport 48000 -j ACCEPT
-A MINIUPNPD -d 192.168.83.80/32 -p udp -m udp --dport 48002 -j ACCEPT
-A MINIUPNPD -d 192.168.83.80/32 -p udp -m udp --dport 48010 -j ACCEPT
-A MINIUPNPD -d 192.168.83.80/32 -p tcp -m tcp --dport 47984 -j ACCEPT
-A MINIUPNPD -d 192.168.83.80/32 -p tcp -m tcp --dport 47989 -j ACCEPT
-A MINIUPNPD -d 192.168.83.80/32 -p tcp -m tcp --dport 48010 -j ACCEPT
-A MINIUPNPD -d 192.168.83.80/32 -p udp -m udp --dport 47998 -j ACCEPT
-A MINIUPNPD -d 192.168.83.80/32 -p udp -m udp --dport 47999 -j ACCEPT
-A MINIUPNPD -d 192.168.83.80/32 -p udp -m udp --dport 48000 -j ACCEPT
-A MINIUPNPD -d 192.168.83.80/32 -p udp -m udp --dport 48002 -j ACCEPT
-A MINIUPNPD -d 192.168.83.80/32 -p udp -m udp --dport 48010 -j ACCEPT
-A reject -p tcp -m comment --comment "!fw3" -j REJECT --reject-with tcp-reset
-A reject -m comment --comment "!fw3" -j REJECT --reject-with icmp-port-unreachable
-A syn_flood -m limit --limit 25/sec --limit-burst 50 -m comment --comment "!fw3" -j RETURN
-A syn_flood -m comment --comment "!fw3" -j DROP
-A ts-forward -i tailscale0 -j MARK --set-xmark 0x40000/0xffffffff
-A ts-forward -m mark --mark 0x40000 -j ACCEPT
-A ts-forward -s 100.64.0.0/10 -o tailscale0 -j DROP
-A ts-forward -o tailscale0 -j ACCEPT
-A ts-input -s 100.120.6.73/32 -i lo -j ACCEPT
-A ts-input -s 100.115.92.0/23 ! -i tailscale0 -j RETURN
-A ts-input -s 100.64.0.0/10 ! -i tailscale0 -j DROP
-A zone_lan_dest_ACCEPT -o br-lan -m comment --comment "!fw3" -j ACCEPT
-A zone_lan_dest_ACCEPT -o tailscale0 -m comment --comment "!fw3" -j ACCEPT
-A zone_lan_forward -j MINIUPNPD
-A zone_lan_forward -j MINIUPNPD
-A zone_lan_forward -m comment --comment "!fw3: Custom lan forwarding rule chain" -j forwarding_lan_rule
-A zone_lan_forward -m comment --comment "!fw3: Zone lan to wan forwarding policy" -j zone_wan_dest_ACCEPT
-A zone_lan_forward -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port forwards" -j ACCEPT
-A zone_lan_forward -m comment --comment "!fw3" -j zone_lan_dest_ACCEPT
-A zone_lan_input -m comment --comment "!fw3: Custom lan input rule chain" -j input_lan_rule
-A zone_lan_input -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port redirections" -j ACCEPT
-A zone_lan_input -m comment --comment "!fw3" -j zone_lan_src_ACCEPT
-A zone_lan_output -m comment --comment "!fw3: Custom lan output rule chain" -j output_lan_rule
-A zone_lan_output -m comment --comment "!fw3" -j zone_lan_dest_ACCEPT
-A zone_lan_src_ACCEPT -i br-lan -m conntrack --ctstate NEW,UNTRACKED -m comment --comment "!fw3" -j ACCEPT
-A zone_lan_src_ACCEPT -i tailscale0 -m conntrack --ctstate NEW,UNTRACKED -m comment --comment "!fw3" -j ACCEPT
-A zone_wan_forward -m comment --comment "!fw3: Custom wan forwarding rule chain" -j forwarding_wan_rule
-A zone_wan_forward -p esp -m comment --comment "!fw3: Allow-IPSec-ESP" -j zone_lan_dest_ACCEPT
-A zone_wan_forward -p udp -m udp --dport 500 -m comment --comment "!fw3: Allow-ISAKMP" -j zone_lan_dest_ACCEPT
-A zone_wan_forward -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port forwards" -j ACCEPT
-A zone_wan_forward -m comment --comment "!fw3" -j zone_wan_dest_REJECT
-A zone_wan_input -m comment --comment "!fw3: Custom wan input rule chain" -j input_wan_rule
-A zone_wan_input -p udp -m udp --dport 68 -m comment --comment "!fw3: Allow-DHCP-Renew" -j ACCEPT
-A zone_wan_input -p icmp -m icmp --icmp-type 8 -m comment --comment "!fw3: Allow-Ping" -j ACCEPT
-A zone_wan_input -p igmp -m comment --comment "!fw3: Allow-IGMP" -j ACCEPT
-A zone_wan_input -p tcp -m tcp --dport 1688 -m comment --comment "!fw3: kms" -j ACCEPT
-A zone_wan_input -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port redirections" -j ACCEPT
-A zone_wan_input -m comment --comment "!fw3" -j zone_wan_src_REJECT
-A zone_wan_output -m comment --comment "!fw3: Custom wan output rule chain" -j output_wan_rule
-A zone_wan_output -m comment --comment "!fw3" -j zone_wan_dest_ACCEPT
COMMIT
# Completed on Sat Nov 12 18:38:09 2022

#IPv6 NAT chain

# Generated by ip6tables-save v1.8.7 on Sat Nov 12 18:38:09 2022
*nat
:PREROUTING ACCEPT [79:17905]
:INPUT ACCEPT [826:82750]
:OUTPUT ACCEPT [372:36005]
:POSTROUTING ACCEPT [372:36005]
:ts-postrouting - [0:0]
-A PREROUTING -p udp -m udp --dport 53 -j REDIRECT --to-ports 53
-A PREROUTING -p tcp -m tcp --dport 53 -j REDIRECT --to-ports 53
-A POSTROUTING -j ts-postrouting
-A POSTROUTING -o ztklhrxcej -j MASQUERADE
-A POSTROUTING -o ztyxazotnw -j MASQUERADE
-A ts-postrouting -m mark --mark 0x40000 -j MASQUERADE
COMMIT
# Completed on Sat Nov 12 18:38:09 2022

#IPv6 Mangle chain

# Generated by ip6tables-save v1.8.7 on Sat Nov 12 18:38:09 2022
*mangle
:PREROUTING ACCEPT [5652:3454116]
:INPUT ACCEPT [5511:3441020]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [4602:1640070]
:POSTROUTING ACCEPT [4651:1643598]
COMMIT
# Completed on Sat Nov 12 18:38:09 2022

#IPv6 Filter chain

# Generated by ip6tables-save v1.8.7 on Sat Nov 12 18:38:09 2022
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [4:304]
:MINIUPNPD - [0:0]
:forwarding_lan_rule - [0:0]
:forwarding_rule - [0:0]
:forwarding_wan_rule - [0:0]
:input_lan_rule - [0:0]
:input_rule - [0:0]
:input_wan_rule - [0:0]
:output_lan_rule - [0:0]
:output_rule - [0:0]
:output_wan_rule - [0:0]
:reject - [0:0]
:syn_flood - [0:0]
:ts-forward - [0:0]
:ts-input - [0:0]
:zone_lan_dest_ACCEPT - [0:0]
:zone_lan_forward - [0:0]
:zone_lan_input - [0:0]
:zone_lan_output - [0:0]
:zone_lan_src_ACCEPT - [0:0]
:zone_wan_dest_ACCEPT - [0:0]
:zone_wan_dest_REJECT - [0:0]
:zone_wan_forward - [0:0]
:zone_wan_input - [0:0]
:zone_wan_output - [0:0]
:zone_wan_src_REJECT - [0:0]
-A INPUT -j ts-input
-A INPUT -i lo -m comment --comment "!fw3" -j ACCEPT
-A INPUT -m comment --comment "!fw3: Custom input rule chain" -j input_rule
-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment "!fw3" -j ACCEPT
-A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -m comment --comment "!fw3" -j syn_flood
-A INPUT -i br-lan -m comment --comment "!fw3" -j zone_lan_input
-A INPUT -i tailscale0 -m comment --comment "!fw3" -j zone_lan_input
-A FORWARD -j ts-forward
-A FORWARD -o ztklhrxcej -j ACCEPT
-A FORWARD -i ztklhrxcej -j ACCEPT
-A FORWARD -o ztyxazotnw -j ACCEPT
-A FORWARD -i ztyxazotnw -j ACCEPT
-A FORWARD -m comment --comment "!fw3: Custom forwarding rule chain" -j forwarding_rule
-A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment "!fw3" -j ACCEPT
-A FORWARD -i br-lan -m comment --comment "!fw3" -j zone_lan_forward
-A FORWARD -i tailscale0 -m comment --comment "!fw3" -j zone_lan_forward
-A OUTPUT -o lo -m comment --comment "!fw3" -j ACCEPT
-A OUTPUT -m comment --comment "!fw3: Custom output rule chain" -j output_rule
-A OUTPUT -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment "!fw3" -j ACCEPT
-A OUTPUT -o br-lan -m comment --comment "!fw3" -j zone_lan_output
-A OUTPUT -o tailscale0 -m comment --comment "!fw3" -j zone_lan_output
-A reject -p tcp -m comment --comment "!fw3" -j REJECT --reject-with tcp-reset
-A reject -m comment --comment "!fw3" -j REJECT --reject-with icmp6-port-unreachable
-A syn_flood -m limit --limit 25/sec --limit-burst 50 -m comment --comment "!fw3" -j RETURN
-A syn_flood -m comment --comment "!fw3" -j DROP
-A ts-forward -i tailscale0 -j MARK --set-xmark 0x40000/0xffffffff
-A ts-forward -m mark --mark 0x40000 -j ACCEPT
-A ts-forward -o tailscale0 -j ACCEPT
-A ts-input -s fd7a:115c:a1e0:ab12:4843:cd96:6278:649/128 -i lo -j ACCEPT
-A zone_lan_dest_ACCEPT -o br-lan -m comment --comment "!fw3" -j ACCEPT
-A zone_lan_dest_ACCEPT -o tailscale0 -m comment --comment "!fw3" -j ACCEPT
-A zone_lan_forward -j MINIUPNPD
-A zone_lan_forward -j MINIUPNPD
-A zone_lan_forward -m comment --comment "!fw3: Custom lan forwarding rule chain" -j forwarding_lan_rule
-A zone_lan_forward -m comment --comment "!fw3: Zone lan to wan forwarding policy" -j zone_wan_dest_ACCEPT
-A zone_lan_forward -m comment --comment "!fw3" -j zone_lan_dest_ACCEPT
-A zone_lan_input -m comment --comment "!fw3: Custom lan input rule chain" -j input_lan_rule
-A zone_lan_input -m comment --comment "!fw3" -j zone_lan_src_ACCEPT
-A zone_lan_output -m comment --comment "!fw3: Custom lan output rule chain" -j output_lan_rule
-A zone_lan_output -m comment --comment "!fw3" -j zone_lan_dest_ACCEPT
-A zone_lan_src_ACCEPT -i br-lan -m conntrack --ctstate NEW,UNTRACKED -m comment --comment "!fw3" -j ACCEPT
-A zone_lan_src_ACCEPT -i tailscale0 -m conntrack --ctstate NEW,UNTRACKED -m comment --comment "!fw3" -j ACCEPT
-A zone_wan_forward -m comment --comment "!fw3: Custom wan forwarding rule chain" -j forwarding_wan_rule
-A zone_wan_forward -p ipv6-icmp -m icmp6 --icmpv6-type 128 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Forward" -j ACCEPT
-A zone_wan_forward -p ipv6-icmp -m icmp6 --icmpv6-type 129 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Forward" -j ACCEPT
-A zone_wan_forward -p ipv6-icmp -m icmp6 --icmpv6-type 1 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Forward" -j ACCEPT
-A zone_wan_forward -p ipv6-icmp -m icmp6 --icmpv6-type 2 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Forward" -j ACCEPT
-A zone_wan_forward -p ipv6-icmp -m icmp6 --icmpv6-type 3 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Forward" -j ACCEPT
-A zone_wan_forward -p ipv6-icmp -m icmp6 --icmpv6-type 4/0 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Forward" -j ACCEPT
-A zone_wan_forward -p ipv6-icmp -m icmp6 --icmpv6-type 4/1 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Forward" -j ACCEPT
-A zone_wan_forward -p esp -m comment --comment "!fw3: Allow-IPSec-ESP" -j zone_lan_dest_ACCEPT
-A zone_wan_forward -p udp -m udp --dport 500 -m comment --comment "!fw3: Allow-ISAKMP" -j zone_lan_dest_ACCEPT
-A zone_wan_forward -m comment --comment "!fw3" -j zone_wan_dest_REJECT
-A zone_wan_input -m comment --comment "!fw3: Custom wan input rule chain" -j input_wan_rule
-A zone_wan_input -s fc00::/6 -d fc00::/6 -p udp -m udp --dport 546 -m comment --comment "!fw3: Allow-DHCPv6" -j ACCEPT
-A zone_wan_input -s fe80::/10 -p ipv6-icmp -m icmp6 --icmpv6-type 130/0 -m comment --comment "!fw3: Allow-MLD" -j ACCEPT
-A zone_wan_input -s fe80::/10 -p ipv6-icmp -m icmp6 --icmpv6-type 131/0 -m comment --comment "!fw3: Allow-MLD" -j ACCEPT
-A zone_wan_input -s fe80::/10 -p ipv6-icmp -m icmp6 --icmpv6-type 132/0 -m comment --comment "!fw3: Allow-MLD" -j ACCEPT
-A zone_wan_input -s fe80::/10 -p ipv6-icmp -m icmp6 --icmpv6-type 143/0 -m comment --comment "!fw3: Allow-MLD" -j ACCEPT
-A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 128 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT
-A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 129 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT
-A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 1 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT
-A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 2 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT
-A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 3 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT
-A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 4/0 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT
-A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 4/1 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT
-A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 133 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT
-A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 135 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT
-A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 134 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT
-A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 136 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT
-A zone_wan_input -p tcp -m tcp --dport 1688 -m comment --comment "!fw3: kms" -j ACCEPT
-A zone_wan_input -m comment --comment "!fw3" -j zone_wan_src_REJECT
-A zone_wan_output -m comment --comment "!fw3: Custom wan output rule chain" -j output_wan_rule
-A zone_wan_output -m comment --comment "!fw3" -j zone_wan_dest_ACCEPT
COMMIT
# Completed on Sat Nov 12 18:38:09 2022

#===================== IPSET状态 =====================#

Name: cn
Name: ct
Name: cnc
Name: cmcc
Name: crtc
Name: cernet
Name: gwbn
Name: othernet
Name: music
Name: mwan3_connected_v4
Name: mwan3_connected_v6
Name: mwan3_source_v6
Name: mwan3_dynamic_v4
Name: mwan3_dynamic_v6
Name: mwan3_custom_v4
Name: mwan3_custom_v6
Name: china_ip_route
Name: china_ip_route_pass
Name: lan_ac_black_ips
Name: lan_ac_black_ipv6s
Name: localnetwork
Name: common_ports
Name: mwan3_connected

#===================== 路由表状态 =====================#

#route -n
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         192.168.83.1    0.0.0.0         UG    0      0        0 br-lan
100.0.0.0       0.0.0.0         255.0.0.0       U     0      0        0 tailscale0
192.168.83.0    0.0.0.0         255.255.255.0   U     0      0        0 br-lan
198.18.0.0      0.0.0.0         255.255.255.252 U     0      0        0 utun
#ip route list
default via 192.168.83.1 dev br-lan proto static 
100.0.0.0/8 dev tailscale0 proto kernel scope link src 100.120.6.73 
192.168.83.0/24 dev br-lan proto kernel scope link src 192.168.83.2 
198.18.0.0/30 dev utun proto kernel scope link src 198.18.0.1 
#ip rule show
0:  from all lookup local
5209:   from all fwmark 0x162 lookup 354
5210:   from all fwmark 0x80000 lookup main
5230:   from all fwmark 0x80000 lookup default
5250:   from all fwmark 0x80000 unreachable
5270:   from all lookup 52
32766:  from all lookup main
32767:  from all lookup default

#===================== Tun设备状态 =====================#

tailscale0: tun pi filter
utun: tun

#===================== 端口占用状态 =====================#

tcp        0      0 198.18.0.1:39111        0.0.0.0:*               LISTEN      7659/clash
tcp        0      0 fdfe:dcba:9876::1:34283 :::*                    LISTEN      7659/clash
tcp        0      0 :::7893                 :::*                    LISTEN      7659/clash
tcp        0      0 :::7892                 :::*                    LISTEN      7659/clash
tcp        0      0 :::7895                 :::*                    LISTEN      7659/clash
tcp        0      0 :::7891                 :::*                    LISTEN      7659/clash
tcp        0      0 :::7890                 :::*                    LISTEN      7659/clash
tcp        0      0 :::9090                 :::*                    LISTEN      7659/clash
udp        0      0 :::46534                :::*                                7659/clash
udp        0      0 :::7874                 :::*                                7659/clash
udp        0      0 :::7891                 :::*                                7659/clash
udp        0      0 :::7892                 :::*                                7659/clash
udp        0      0 :::7893                 :::*                                7659/clash
udp        0      0 :::7895                 :::*                                7659/clash

#===================== 测试本机DNS查询 =====================#

Server:     100.100.100.100
Address:    100.100.100.100:53

www.baidu.com   canonical name = www.a.shifen.com
Name:   www.a.shifen.com
Address: 14.215.177.38
Name:   www.a.shifen.com
Address: 14.215.177.39

www.baidu.com   canonical name = www.a.shifen.com
www.a.shifen.com    canonical name = www.wshifen.com

#===================== resolv.conf.d =====================#

# Interface LAN6
nameserver fe80::64a3:2ff:fee1:7085%br-lan
# Interface lan
nameserver 192.168.83.1

#===================== 测试本机网络连接 =====================#

HTTP/1.1 200 OK
Accept-Ranges: bytes
Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform
Connection: keep-alive
Content-Length: 277
Content-Type: text/html
Date: Sat, 12 Nov 2022 10:38:14 GMT
Etag: "575e1f6d-115"
Last-Modified: Mon, 13 Jun 2016 02:50:21 GMT
Pragma: no-cache
Server: bfe/1.0.8.18

#===================== 测试本机网络下载 =====================#

HTTP/1.1 200 OK
Connection: keep-alive
Content-Length: 80
Cache-Control: max-age=300
Content-Security-Policy: default-src 'none'; style-src 'unsafe-inline'; sandbox
Content-Type: text/plain; charset=utf-8
ETag: "f9b464e93b2bdfda94b649d5d067b155764d97951465058cb1643f9ffc3c6e51"
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
X-Frame-Options: deny
X-XSS-Protection: 1; mode=block
X-GitHub-Request-Id: 883E:46EC:1B2372:247144:6366AE42
Accept-Ranges: bytes
Date: Sat, 12 Nov 2022 10:38:15 GMT
Via: 1.1 varnish
X-Served-By: cache-tyo11943-TYO
X-Cache: HIT
X-Cache-Hits: 1
X-Timer: S1668249495.108694,VS0,VE1
Vary: Authorization,Accept-Encoding,Origin
Access-Control-Allow-Origin: *
X-Fastly-Request-ID: f5322f157d7c5399d6b57cd95c5c543a730eeb84
Expires: Sat, 12 Nov 2022 10:43:15 GMT
Source-Age: 38

#===================== 最近运行日志 =====================#

time="2022-11-12T18:27:30+08:00" level=error msg="[Sniffer] [168.119.33.53] may not have any sent data, Consider adding skip"
time="2022-11-12T18:27:35+08:00" level=warning msg="[TCP] dial DIRECT (match RuleSet(whiteList)) to signaling-1.verysync.cn:443 error: dual stack tcp shake hands failed"
time="2022-11-12T18:27:35+08:00" level=warning msg="[TCP] dial DIRECT (match RuleSet(whiteList)) to signaling-1.verysync.cn:443 error: dual stack tcp shake hands failed"
time="2022-11-12T18:27:53+08:00" level=error msg="[Sniffer] [168.119.33.53] may not have any sent data, Consider adding skip"
time="2022-11-12T18:28:00+08:00" level=warning msg="[TCP] dial DIRECT (match RuleSet(whiteList)) to signaling-1.verysync.cn:443 error: dual stack tcp shake hands failed"
time="2022-11-12T18:28:01+08:00" level=warning msg="[TCP] dial Ⓜ️ 微软服务 (match DomainKeyword(microsoft)) to v10.events.data.microsoft.com:443 error: dual stack tcp shake hands failed"
time="2022-11-12T18:28:16+08:00" level=warning msg="[TCP] dial Ⓜ️ 微软服务 (match DomainKeyword(microsoft)) to v10.events.data.microsoft.com:443 error: dual stack tcp shake hands failed"
time="2022-11-12T18:28:17+08:00" level=error msg="[Sniffer] [168.119.33.53] may not have any sent data, Consider adding skip"
time="2022-11-12T18:28:52+08:00" level=warning msg="[TCP] dial Ⓜ️ 微软服务 (match DomainKeyword(microsoft)) to v10.events.data.microsoft.com:443 error: dual stack tcp shake hands failed"
time="2022-11-12T18:28:55+08:00" level=warning msg="[TCP] dial DIRECT (match RuleSet(whiteList)) to signaling-1.verysync.cn:443 error: dual stack tcp shake hands failed"
time="2022-11-12T18:29:50+08:00" level=warning msg="[TCP] dial DIRECT (match RuleSet(whiteList)) to signaling-1.verysync.cn:443 error: dual stack tcp shake hands failed"
time="2022-11-12T18:30:07+08:00" level=warning msg="[TCP] dial DIRECT (match RuleSet(whiteList)) to signaling-1.verysync.cn:443 error: dual stack tcp shake hands failed"
time="2022-11-12T18:30:08+08:00" level=error msg="[Sniffer] [168.119.33.53] may not have any sent data, Consider adding skip"
time="2022-11-12T18:30:31+08:00" level=error msg="[Sniffer] [168.119.33.53] may not have any sent data, Consider adding skip"
time="2022-11-12T18:30:42+08:00" level=warning msg="[TCP] dial Ⓜ️ 微软服务 (match DomainKeyword(microsoft)) to fe3cr.delivery.mp.microsoft.com:443 error: dual stack tcp shake hands failed"
time="2022-11-12T18:30:54+08:00" level=error msg="[Sniffer] [168.119.33.53] may not have any sent data, Consider adding skip"
time="2022-11-12T18:30:55+08:00" level=warning msg="[TCP] dial DIRECT (match RuleSet(whiteList)) to signaling-1.verysync.cn:443 error: dual stack tcp shake hands failed"
time="2022-11-12T18:30:55+08:00" level=warning msg="[TCP] dial Ⓜ️ 微软服务 (match DomainKeyword(microsoft)) to fe3cr.delivery.mp.microsoft.com:443 error: dual stack tcp shake hands failed"
time="2022-11-12T18:30:57+08:00" level=warning msg="[TCP] dial Ⓜ️ 微软服务 (match DomainKeyword(microsoft)) to fe3cr.delivery.mp.microsoft.com:443 error: dual stack tcp shake hands failed"
time="2022-11-12T18:30:58+08:00" level=warning msg="[TCP] dial Ⓜ️ 微软服务 (match DomainKeyword(microsoft)) to fe3cr.delivery.mp.microsoft.com:443 error: dual stack tcp shake hands failed"
time="2022-11-12T18:31:00+08:00" level=warning msg="[TCP] dial DIRECT (match RuleSet(whiteList)) to signaling-1.verysync.cn:443 error: dial tcp4 168.119.33.53:443: i/o timeout"
time="2022-11-12T18:31:02+08:00" level=warning msg="[TCP] dial Ⓜ️ 微软服务 (match DomainKeyword(microsoft)) to fe3cr.delivery.mp.microsoft.com:443 error: dual stack tcp shake hands failed"
time="2022-11-12T18:31:02+08:00" level=warning msg="[TCP] dial Ⓜ️ 微软服务 (match DomainKeyword(microsoft)) to fe3cr.delivery.mp.microsoft.com:443 error: dual stack tcp shake hands failed"
time="2022-11-12T18:31:03+08:00" level=warning msg="[TCP] dial Ⓜ️ 微软服务 (match DomainKeyword(microsoft)) to fe3cr.delivery.mp.microsoft.com:443 error: dual stack tcp shake hands failed"
time="2022-11-12T18:31:09+08:00" level=warning msg="[TCP] dial Ⓜ️ 微软服务 (match DomainKeyword(microsoft)) to fe3cr.delivery.mp.microsoft.com:443 error: dual stack tcp shake hands failed"
time="2022-11-12T18:31:10+08:00" level=warning msg="[TCP] dial Ⓜ️ 微软服务 (match DomainKeyword(microsoft)) to fe3cr.delivery.mp.microsoft.com:443 error: dual stack tcp shake hands failed"
time="2022-11-12T18:31:11+08:00" level=warning msg="[TCP] dial Ⓜ️ 微软服务 (match DomainKeyword(microsoft)) to settings-win.data.microsoft.com:443 error: dual stack tcp shake hands failed"
time="2022-11-12T18:31:17+08:00" level=warning msg="[TCP] dial Ⓜ️ 微软服务 (match DomainKeyword(microsoft)) to fe3cr.delivery.mp.microsoft.com:443 error: dual stack tcp shake hands failed"
time="2022-11-12T18:31:18+08:00" level=warning msg="[TCP] dial 🐟 漏网之鱼 (match DstPort(443)) to bStats.org:443 error: dual stack tcp shake hands failed"
time="2022-11-12T18:31:46+08:00" level=warning msg="[TCP] dial DIRECT (match RuleSet(whiteList)) to signaling-1.verysync.cn:443 error: dual stack tcp shake hands failed"
time="2022-11-12T18:31:49+08:00" level=warning msg="[TCP] dial Ⓜ️ 微软服务 (match DomainSuffix(windows.com)) to client.wns.windows.com:443 error: dual stack tcp shake hands failed"
time="2022-11-12T18:31:49+08:00" level=warning msg="[TCP] dial DIRECT (match RuleSet(whiteList)) to signaling-1.verysync.cn:443 error: dual stack tcp shake hands failed"
time="2022-11-12T18:32:14+08:00" level=warning msg="[TCP] dial DIRECT (match RuleSet(whiteList)) to signaling-1.verysync.cn:443 error: dual stack tcp shake hands failed"
time="2022-11-12T18:32:38+08:00" level=warning msg="[TCP] dial DIRECT (match RuleSet(whiteList)) to signaling-1.verysync.cn:443 error: dual stack tcp shake hands failed"
time="2022-11-12T18:32:43+08:00" level=warning msg="[TCP] dial Ⓜ️ 微软服务 (match DomainKeyword(microsoft)) to v20.events.data.microsoft.com:443 error: dual stack tcp shake hands failed"
time="2022-11-12T18:33:03+08:00" level=warning msg="[TCP] dial DIRECT (match RuleSet(whiteList)) to signaling-1.verysync.cn:443 error: dual stack tcp shake hands failed"
time="2022-11-12T18:33:06+08:00" level=warning msg="[TCP] dial 🐟 漏网之鱼 (match DstPort(443)) to bStats.org:443 error: dual stack tcp shake hands failed"
time="2022-11-12T18:33:18+08:00" level=warning msg="[TCP] dial DIRECT (match RuleSet(whiteList)) to signaling-1.verysync.cn:443 error: dual stack tcp shake hands failed"
time="2022-11-12T18:34:36+08:00" level=warning msg="[TCP] dial DIRECT (match RuleSet(whiteList)) to signaling-1.verysync.cn:443 error: dual stack tcp shake hands failed"
time="2022-11-12T18:34:53+08:00" level=error msg="[Sniffer] [168.119.33.53] may not have any sent data, Consider adding skip"
time="2022-11-12T18:35:01+08:00" level=warning msg="[TCP] dial DIRECT (match RuleSet(whiteList)) to signaling-1.verysync.cn:443 error: dual stack tcp shake hands failed"
time="2022-11-12T18:35:17+08:00" level=error msg="[Sniffer] [168.119.33.53] may not have any sent data, Consider adding skip"
time="2022-11-12T18:35:28+08:00" level=warning msg="[TCP] dial Ⓜ️ 微软服务 (match DomainKeyword(microsoft)) to fe3cr.delivery.mp.microsoft.com:443 error: dual stack tcp shake hands failed"
time="2022-11-12T18:35:40+08:00" level=error msg="[Sniffer] [168.119.33.53] may not have any sent data, Consider adding skip"
time="2022-11-12T18:36:03+08:00" level=error msg="[Sniffer] [168.119.33.53] may not have any sent data, Consider adding skip"
time="2022-11-12T18:36:28+08:00" level=warning msg="[TCP] dial Ⓜ️ 微软服务 (match DomainKeyword(microsoft)) to fe3cr.delivery.mp.microsoft.com:443 error: dual stack tcp shake hands failed"
time="2022-11-12T18:36:34+08:00" level=warning msg="[TCP] dial Ⓜ️ 微软服务 (match DomainKeyword(microsoft)) to fe3cr.delivery.mp.microsoft.com:443 error: dual stack tcp shake hands failed"
time="2022-11-12T18:36:40+08:00" level=error msg="[Sniffer] [52.167.249.196] may not have any sent data, Consider adding skip"
time="2022-11-12T18:37:32+08:00" level=error msg="[Sniffer] [168.119.33.53] may not have any sent data, Consider adding skip"
time="2022-11-12T18:38:02+08:00" level=error msg="[Sniffer] [168.119.33.53] may not have any sent data, Consider adding skip"

### OpenClash Config

_No response_

### Expected Behavior

能进行端口代理 或者 能有一个解决方案 感谢

### Screenshots

_No response_
LOVE2CMOL commented 1 year ago

浏览器的问题..... 坑爹了 貌似是缓存了一个空密码 然后直接给提交过去了