search

vernesong / OpenClash

A Clash Client For OpenWrt
MIT License
16.64k stars 3.07k forks source link

[Bug] 启用`实验性：绕过中国大陆 IP`后所有域名均无法解析 #2834

Closed ishkong closed 1 year ago

ishkong commented 1 year ago

Verify Steps

OpenClash Version

v0.45.72-beta

Bug on Environment

Lean

Bug on Platform

Linux-arm64

To Reproduce

手动关闭实验性：绕过中国大陆 IP再打开实验性：绕过中国大陆 IP，待openclash提示检测到dnsmasq正常工作，还原DNS劫持后

Describe the Bug

开机自动启动Openclash 且 启用了实验性：绕过中国大陆 IP 所有域名被劫持 手动关开 实验性：绕过中国大陆 IP 设置 所有域名均无法解析 关闭实验性：绕过中国大陆 IP后正常劫持

OpenClash Log

OpenClash 调试日志

生成时间: 2022-11-21 20:03:54 插件版本: v0.45.72-beta 隐私提示: 上传此日志前请注意检查、屏蔽公网IP、节点、密码等相关敏感信息


#===================== 系统信息 =====================#

主机型号: Xiaomi Redmi Router AX5_JDC IPQ6018/AP-CP03-C1
固件版本: 
LuCI版本: git-22.320.39121-bb86b4e-1
内核版本: 4.4.60
处理器架构: 

#此项有值时,如不使用IPv6,建议到网络-接口-lan的设置中禁用IPV6的DHCP
IPV6-DHCP: server

#此项结果应仅有配置文件的DNS监听地址
Dnsmasq转发设置: 127.0.0.1#7874

#===================== 依赖检查 =====================#

dnsmasq-full: 已安装
coreutils: 已安装
coreutils-nohup: 已安装
bash: 已安装
curl: 已安装
ca-certificates: 已安装
ipset: 已安装
ip-full: 已安装
libcap: 已安装
libcap-bin: 已安装
ruby: 已安装
ruby-yaml: 已安装
ruby-psych: 已安装
ruby-pstore: 已安装
kmod-tun(TUN模式): 已安装
luci-compat(Luci >= 19.07): 未安装
kmod-inet-diag(PROCESS-NAME): 已安装
unzip: 已安装
iptables-mod-tproxy: 已安装
kmod-ipt-tproxy: 已安装
iptables-mod-extra: 已安装
kmod-ipt-extra: 已安装
kmod-ipt-nat: 已安装

#===================== 内核检查 =====================#

运行状态: 运行中
进程pid: 24597
运行权限: 24597: cap_dac_override,cap_net_bind_service,cap_net_admin,cap_net_raw,cap_sys_ptrace,cap_sys_resource=eip
运行用户: nobody
已选择的架构: linux-arm64

#下方无法显示内核版本号时请确认您的内核版本是否正确或者有无权限
Tun内核版本: 2022.08.26-3-ge16bdd2
Tun内核文件: 存在
Tun内核运行权限: 正常

Dev内核版本: v1.11.8-3-g4f291fa
Dev内核文件: 存在
Dev内核运行权限: 正常

Meta内核版本: 
Meta内核文件: 不存在
Meta内核运行权限: 否

#===================== 插件设置 =====================#

当前配置文件: /etc/openclash/config/*******.yaml
启动配置文件: /etc/openclash/*******.yaml
运行模式: fake-ip
默认代理模式: rule
UDP流量转发(tproxy): 启用
DNS劫持: 启用
自定义DNS: 停用
IPV6代理: 启用
IPV6-DNS解析: 启用
禁用Dnsmasq缓存: 启用
自定义规则: 停用
仅允许内网: 启用
仅代理命中规则流量: 停用
仅允许常用端口流量: 停用
绕过中国大陆IP: 停用
DNS远程解析: 启用
路由本机代理: 启用

#启动异常时建议关闭此项后重试
混合节点: 停用
保留配置: 停用

#启动异常时建议关闭此项后重试
第三方规则: 停用

#===================== 配置文件 =====================#

mixed-port: 7893
allow-lan: true
bind-address: "*"
mode: rule
log-level: silent
external-controller: 0.0.0.0:9090
dns:
  enable: true
  ipv6: true
  default-nameserver:
  - 223.5.5.5
  - 119.29.29.29
  - ***公网网关已隐藏***
  - "[fe80::4e09:b4ff:fe19:ff02]:53"
  - 59.49.49.49
  - 219.149.135.188
  - "[240e:44:c001::]:53"
  - "[240e:44:c002::]:53"
  - 114.114.114.114
  enhanced-mode: fake-ip
  fake-ip-range: 198.18.0.1/16
  use-hosts: true
  nameserver:
  - https://doh.pub/dns-query
  - https://dns.alidns.com/dns-query
  - dhcp://"pppoe-wan"
  - ***公网网关已隐藏***
  - "[fe80::4e09:b4ff:fe19:ff02]:53"
  - 59.49.49.49
  - 219.149.135.188
  - "[240e:44:c001::]:53"
  - "[240e:44:c002::]:53"
  - 114.114.114.114
  - 119.29.29.29
  fallback:
  - https://doh.dns.sb/dns-query
  - https://dns.cloudflare.com/dns-query
  - https://dns.twnic.tw/dns-query
  - tls://8.8.4.4:853
  fallback-filter:
    geoip: true
    ipcidr:
    - 240.0.0.0/4
    - 0.0.0.0/32
  listen: 0.0.0.0:7874
  fake-ip-filter:
  - "*.lan"
  - "*.localdomain"
  - "*.example"
  - "*.invalid"
  - "*.localhost"
  - "*.test"
  - "*.local"
  - "*.home.arpa"
  - time.*.com
  - time.*.gov
  - time.*.edu.cn
  - time.*.apple.com
  - time-ios.apple.com
  - time1.*.com
  - time2.*.com
  - time3.*.com
  - time4.*.com
  - time5.*.com
  - time6.*.com
  - time7.*.com
  - ntp.*.com
  - ntp1.*.com
  - ntp2.*.com
  - ntp3.*.com
  - ntp4.*.com
  - ntp5.*.com
  - ntp6.*.com
  - ntp7.*.com
  - "*.time.edu.cn"
  - "*.ntp.org.cn"
  - "+.pool.ntp.org"
  - time1.cloud.tencent.com
  - music.163.com
  - "*.music.163.com"
  - "*.126.net"
  - musicapi.taihe.com
  - music.taihe.com
  - songsearch.kugou.com
  - trackercdn.kugou.com
  - "*.kuwo.cn"
  - api-jooxtt.sanook.com
  - api.joox.com
  - joox.com
  - y.qq.com
  - "*.y.qq.com"
  - streamoc.music.tc.qq.com
  - mobileoc.music.tc.qq.com
  - isure.stream.qqmusic.qq.com
  - dl.stream.qqmusic.qq.com
  - aqqmusic.tc.qq.com
  - amobile.music.tc.qq.com
  - "*.xiami.com"
  - "*.music.migu.cn"
  - music.migu.cn
  - "+.msftconnecttest.com"
  - "+.msftncsi.com"
  - msftconnecttest.com
  - msftncsi.com
  - localhost.ptlogin2.qq.com
  - localhost.sec.qq.com
  - "+.srv.nintendo.net"
  - "*.n.n.srv.nintendo.net"
  - "+.stun.playstation.net"
  - xbox.*.*.microsoft.com
  - "*.*.xboxlive.com"
  - xbox.*.microsoft.com
  - xnotify.xboxlive.com
  - "+.battlenet.com.cn"
  - "+.wotgame.cn"
  - "+.wggames.cn"
  - "+.wowsgame.cn"
  - "+.wargaming.net"
  - proxy.golang.org
  - stun.*.*
  - stun.*.*.*
  - "+.stun.*.*"
  - "+.stun.*.*.*"
  - "+.stun.*.*.*.*"
  - "+.stun.*.*.*.*.*"
  - heartbeat.belkin.com
  - "*.linksys.com"
  - "*.linksyssmartwifi.com"
  - "*.router.asus.com"
  - mesu.apple.com
  - swscan.apple.com
  - swquery.apple.com
  - swdownload.apple.com
  - swcdn.apple.com
  - swdist.apple.com
  - lens.l.google.com
  - stun.l.google.com
  - "+.nflxvideo.net"
  - "*.square-enix.com"
  - "*.finalfantasyxiv.com"
  - "*.ffxiv.com"
  - "*.ff14.sdo.com"
  - ff.dorado.sdo.com
  - "*.mcdn.bilivideo.cn"
  - "+.media.dssott.com"
  - shark007.net
  - Mijia Cloud
  - "+.dns.google"
proxy-groups:
***已隐藏***
rule-providers:
  reject:
    type: http
    behavior: domain
    url: https://ghproxy.com/https://raw.githubusercontent.com/Loyalsoldier/clash-rules/release/reject.txt
    path: "./rule_provider/reject.yaml"
    interval: 86400
  google:
    type: http
    behavior: domain
    url: https://ghproxy.com/https://raw.githubusercontent.com/Loyalsoldier/clash-rules/release/google.txt
    path: "./rule_provider/google.yaml"
    interval: 86400
  icloud:
    type: http
    behavior: domain
    url: https://ghproxy.com/https://raw.githubusercontent.com/Loyalsoldier/clash-rules/release/icloud.txt
    path: "./rule_provider/icloud.yaml"
    interval: 86400
  apple:
    type: http
    behavior: domain
    url: https://ghproxy.com/https://raw.githubusercontent.com/Loyalsoldier/clash-rules/release/apple.txt
    path: "./rule_provider/apple.yaml"
    interval: 86400
  proxy:
    type: http
    behavior: domain
    url: https://ghproxy.com/https://raw.githubusercontent.com/Loyalsoldier/clash-rules/release/proxy.txt
    path: "./rule_provider/proxy.yaml"
    interval: 86400
  direct:
    type: http
    behavior: domain
    url: https://ghproxy.com/https://raw.githubusercontent.com/Loyalsoldier/clash-rules/release/direct.txt
    path: "./rule_provider/direct.yaml"
    interval: 86400
  private:
    type: http
    behavior: domain
    url: https://ghproxy.com/https://raw.githubusercontent.com/Loyalsoldier/clash-rules/release/private.txt
    path: "./rule_provider/private.yaml"
    interval: 86400
  gfw:
    type: http
    behavior: domain
    url: https://ghproxy.com/https://raw.githubusercontent.com/Loyalsoldier/clash-rules/release/gfw.txt
    path: "./rule_provider/gfw.yaml"
    interval: 86400
  greatfire:
    type: http
    behavior: domain
    url: https://ghproxy.com/https://raw.githubusercontent.com/Loyalsoldier/clash-rules/release/greatfire.txt
    path: "./rule_provider/greatfire.yaml"
    interval: 86400
  tld-not-cn:
    type: http
    behavior: domain
    url: https://ghproxy.com/https://raw.githubusercontent.com/Loyalsoldier/clash-rules/release/tld-not-cn.txt
    path: "./rule_provider/tld-not-cn.yaml"
    interval: 86400
  telegramcidr:
    type: http
    behavior: ipcidr
    url: https://ghproxy.com/https://raw.githubusercontent.com/Loyalsoldier/clash-rules/release/telegramcidr.txt
    path: "./rule_provider/telegramcidr.yaml"
    interval: 86400
  cncidr:
    type: http
    behavior: ipcidr
    url: https://ghproxy.com/https://raw.githubusercontent.com/Loyalsoldier/clash-rules/release/cncidr.txt
    path: "./rule_provider/cncidr.yaml"
    interval: 86400
  lancidr:
    type: http
    behavior: ipcidr
    url: https://ghproxy.com/https://raw.githubusercontent.com/Loyalsoldier/clash-rules/release/lancidr.txt
    path: "./rule_provider/lancidr.yaml"
    interval: 86400
  applications:
    type: http
    behavior: classical
    url: https://ghproxy.com/https://raw.githubusercontent.com/Loyalsoldier/clash-rules/release/applications.txt
    path: "./rule_provider/applications.yaml"
    interval: 86400
rules:
- DST-PORT,7895,REJECT
- DST-PORT,7892,REJECT
- IP-CIDR,198.18.0.1/16,REJECT,no-resolve
***已隐藏***
- DOMAIN-SUFFIX,126.com,DIRECT
- DOMAIN-SUFFIX,126.net,DIRECT
- DOMAIN-SUFFIX,127.net,DIRECT
- DOMAIN-SUFFIX,163.com,DIRECT
- DOMAIN-SUFFIX,360buyimg.com,DIRECT
- DOMAIN-SUFFIX,36kr.com,DIRECT
- DOMAIN-SUFFIX,acfun.tv,DIRECT
- DOMAIN-SUFFIX,air-matters.com,DIRECT
- DOMAIN-SUFFIX,aixifan.com,DIRECT
- DOMAIN-KEYWORD,alicdn,DIRECT
- DOMAIN-KEYWORD,alipay,DIRECT
- DOMAIN-KEYWORD,taobao,DIRECT
- DOMAIN-SUFFIX,amap.com,DIRECT
- DOMAIN-SUFFIX,autonavi.com,DIRECT
- DOMAIN-KEYWORD,baidu,DIRECT
- DOMAIN-SUFFIX,bdimg.com,DIRECT
- DOMAIN-SUFFIX,bdstatic.com,DIRECT
- DOMAIN-SUFFIX,bilibili.com,DIRECT
- DOMAIN-SUFFIX,bilivideo.com,DIRECT
- DOMAIN-SUFFIX,caiyunapp.com,DIRECT
- DOMAIN-SUFFIX,clouddn.com,DIRECT
- DOMAIN-SUFFIX,cnbeta.com,DIRECT
- DOMAIN-SUFFIX,cnbetacdn.com,DIRECT
- DOMAIN-SUFFIX,cootekservice.com,DIRECT
- DOMAIN-SUFFIX,csdn.net,DIRECT
- DOMAIN-SUFFIX,ctrip.com,DIRECT
- DOMAIN-SUFFIX,dgtle.com,DIRECT
- DOMAIN-SUFFIX,dianping.com,DIRECT
- DOMAIN-SUFFIX,douban.com,DIRECT
- DOMAIN-SUFFIX,doubanio.com,DIRECT
- DOMAIN-SUFFIX,duokan.com,DIRECT
- DOMAIN-SUFFIX,easou.com,DIRECT
- DOMAIN-SUFFIX,ele.me,DIRECT
- DOMAIN-SUFFIX,feng.com,DIRECT
- DOMAIN-SUFFIX,fir.im,DIRECT
- DOMAIN-SUFFIX,frdic.com,DIRECT
- DOMAIN-SUFFIX,g-cores.com,DIRECT
- DOMAIN-SUFFIX,godic.net,DIRECT
- DOMAIN-SUFFIX,gtimg.com,DIRECT
- DOMAIN,cdn.hockeyapp.net,DIRECT
- DOMAIN-SUFFIX,hongxiu.com,DIRECT
- DOMAIN-SUFFIX,hxcdn.net,DIRECT
- DOMAIN-SUFFIX,iciba.com,DIRECT
- DOMAIN-SUFFIX,ifeng.com,DIRECT
- DOMAIN-SUFFIX,ifengimg.com,DIRECT
- DOMAIN-SUFFIX,ipip.net,DIRECT
- DOMAIN-SUFFIX,iqiyi.com,DIRECT
- DOMAIN-SUFFIX,jd.com,DIRECT
- DOMAIN-SUFFIX,jianshu.com,DIRECT
- DOMAIN-SUFFIX,knewone.com,DIRECT
- DOMAIN-SUFFIX,le.com,DIRECT
- DOMAIN-SUFFIX,lecloud.com,DIRECT
- DOMAIN-SUFFIX,lemicp.com,DIRECT
- DOMAIN-SUFFIX,licdn.com,DIRECT
- DOMAIN-SUFFIX,luoo.net,DIRECT
- DOMAIN-SUFFIX,meituan.com,DIRECT
- DOMAIN-SUFFIX,meituan.net,DIRECT
- DOMAIN-SUFFIX,mi.com,DIRECT
- DOMAIN-SUFFIX,miaopai.com,DIRECT
- DOMAIN-SUFFIX,microsoft.com,DIRECT
- DOMAIN-SUFFIX,microsoftonline.com,DIRECT
- DOMAIN-SUFFIX,miui.com,DIRECT
- DOMAIN-SUFFIX,miwifi.com,DIRECT
- DOMAIN-SUFFIX,mob.com,DIRECT
- DOMAIN-SUFFIX,netease.com,DIRECT
- DOMAIN-SUFFIX,office.com,DIRECT
- DOMAIN-SUFFIX,office365.com,DIRECT
- DOMAIN-KEYWORD,officecdn,DIRECT
- DOMAIN-SUFFIX,oschina.net,DIRECT
- DOMAIN-SUFFIX,ppsimg.com,DIRECT
- DOMAIN-SUFFIX,pstatp.com,DIRECT
- DOMAIN-SUFFIX,qcloud.com,DIRECT
- DOMAIN-SUFFIX,qdaily.com,DIRECT
- DOMAIN-SUFFIX,qdmm.com,DIRECT
- DOMAIN-SUFFIX,qhimg.com,DIRECT
- DOMAIN-SUFFIX,qhres.com,DIRECT
- DOMAIN-SUFFIX,qidian.com,DIRECT
- DOMAIN-SUFFIX,qihucdn.com,DIRECT
- DOMAIN-SUFFIX,qiniu.com,DIRECT
- DOMAIN-SUFFIX,qiniucdn.com,DIRECT
- DOMAIN-SUFFIX,qiyipic.com,DIRECT
- DOMAIN-SUFFIX,qq.com,DIRECT
- DOMAIN-SUFFIX,qqurl.com,DIRECT
- DOMAIN-SUFFIX,rarbg.to,DIRECT
- DOMAIN-SUFFIX,ruguoapp.com,DIRECT
- DOMAIN-SUFFIX,segmentfault.com,DIRECT
- DOMAIN-SUFFIX,sinaapp.com,DIRECT
- DOMAIN-SUFFIX,smzdm.com,DIRECT
- DOMAIN-SUFFIX,snapdrop.net,DIRECT
- DOMAIN-SUFFIX,sogou.com,DIRECT
- DOMAIN-SUFFIX,sogoucdn.com,DIRECT
- DOMAIN-SUFFIX,sohu.com,DIRECT
- DOMAIN-SUFFIX,soku.com,DIRECT
- DOMAIN-SUFFIX,speedtest.net,DIRECT
- DOMAIN-SUFFIX,sspai.com,DIRECT
- DOMAIN-SUFFIX,suning.com,DIRECT
- DOMAIN-SUFFIX,taobao.com,DIRECT
- DOMAIN-SUFFIX,tencent.com,DIRECT
- DOMAIN-SUFFIX,tenpay.com,DIRECT
- DOMAIN-SUFFIX,tianyancha.com,DIRECT
- DOMAIN-SUFFIX,tmall.com,DIRECT
- DOMAIN-SUFFIX,tudou.com,DIRECT
- DOMAIN-SUFFIX,umetrip.com,DIRECT
- DOMAIN-SUFFIX,upaiyun.com,DIRECT
- DOMAIN-SUFFIX,upyun.com,DIRECT
- DOMAIN-SUFFIX,veryzhun.com,DIRECT
- DOMAIN-SUFFIX,weather.com,DIRECT
- DOMAIN-SUFFIX,weibo.com,DIRECT
- DOMAIN-SUFFIX,xiami.com,DIRECT
- DOMAIN-SUFFIX,xiami.net,DIRECT
- DOMAIN-SUFFIX,xiaomicp.com,DIRECT
- DOMAIN-SUFFIX,ximalaya.com,DIRECT
- DOMAIN-SUFFIX,xmcdn.com,DIRECT
- DOMAIN-SUFFIX,xunlei.com,DIRECT
- DOMAIN-SUFFIX,yhd.com,DIRECT
- DOMAIN-SUFFIX,yihaodianimg.com,DIRECT
- DOMAIN-SUFFIX,yinxiang.com,DIRECT
- DOMAIN-SUFFIX,ykimg.com,DIRECT
- DOMAIN-SUFFIX,youdao.com,DIRECT
- DOMAIN-SUFFIX,youku.com,DIRECT
- DOMAIN-SUFFIX,zealer.com,DIRECT
- DOMAIN-SUFFIX,zhihu.com,DIRECT
- DOMAIN-SUFFIX,zhimg.com,DIRECT
- DOMAIN-SUFFIX,zimuzu.tv,DIRECT
- DOMAIN-SUFFIX,zoho.com,DIRECT
- RULE-SET,direct,DIRECT
- DOMAIN-KEYWORD,amazon,*******
- DOMAIN-KEYWORD,google,*******
- DOMAIN-KEYWORD,gmail,*******
- DOMAIN-KEYWORD,youtube,*******
- DOMAIN-KEYWORD,facebook,*******
- DOMAIN-SUFFIX,fb.me,*******
- DOMAIN-SUFFIX,fbcdn.net,*******
- DOMAIN-KEYWORD,twitter,*******
- DOMAIN-KEYWORD,instagram,*******
- DOMAIN-KEYWORD,dropbox,*******
- DOMAIN-SUFFIX,twimg.com,*******
- DOMAIN-KEYWORD,blogspot,*******
- DOMAIN-SUFFIX,youtu.be,*******
- DOMAIN-KEYWORD,whatsapp,*******
- DOMAIN-KEYWORD,admarvel,REJECT
- DOMAIN-KEYWORD,admaster,REJECT
- DOMAIN-KEYWORD,adsage,REJECT
- DOMAIN-KEYWORD,adsmogo,REJECT
- DOMAIN-KEYWORD,adsrvmedia,REJECT
- DOMAIN-KEYWORD,adwords,REJECT
- DOMAIN-KEYWORD,adservice,REJECT
- DOMAIN-SUFFIX,appsflyer.com,REJECT
- DOMAIN-KEYWORD,domob,REJECT
- DOMAIN-SUFFIX,doubleclick.net,REJECT
- DOMAIN-KEYWORD,duomeng,REJECT
- DOMAIN-KEYWORD,dwtrack,REJECT
- DOMAIN-KEYWORD,guanggao,REJECT
- DOMAIN-KEYWORD,lianmeng,REJECT
- DOMAIN-SUFFIX,mmstat.com,REJECT
- DOMAIN-KEYWORD,mopub,REJECT
- DOMAIN-KEYWORD,omgmta,REJECT
- DOMAIN-KEYWORD,openx,REJECT
- DOMAIN-KEYWORD,partnerad,REJECT
- DOMAIN-KEYWORD,pingfore,REJECT
- DOMAIN-KEYWORD,supersonicads,REJECT
- DOMAIN-KEYWORD,uedas,REJECT
- DOMAIN-KEYWORD,umeng,REJECT
- DOMAIN-KEYWORD,usage,REJECT
- DOMAIN-SUFFIX,vungle.com,REJECT
- DOMAIN-KEYWORD,wlmonitor,REJECT
- DOMAIN-KEYWORD,zjtoolbar,REJECT
- DOMAIN-SUFFIX,9to5mac.com,*******
- DOMAIN-SUFFIX,abpchina.org,*******
- DOMAIN-SUFFIX,adblockplus.org,*******
- DOMAIN-SUFFIX,adobe.com,*******
- DOMAIN-SUFFIX,akamaized.net,*******
- DOMAIN-SUFFIX,alfredapp.com,*******
- DOMAIN-SUFFIX,amplitude.com,*******
- DOMAIN-SUFFIX,ampproject.org,*******
- DOMAIN-SUFFIX,android.com,*******
- DOMAIN-SUFFIX,angularjs.org,*******
- DOMAIN-SUFFIX,aolcdn.com,*******
- DOMAIN-SUFFIX,apkpure.com,*******
- DOMAIN-SUFFIX,appledaily.com,*******
- DOMAIN-SUFFIX,appshopper.com,*******
- DOMAIN-SUFFIX,appspot.com,*******
- DOMAIN-SUFFIX,arcgis.com,*******
- DOMAIN-SUFFIX,archive.org,*******
- DOMAIN-SUFFIX,armorgames.com,*******
- DOMAIN-SUFFIX,aspnetcdn.com,*******
- DOMAIN-SUFFIX,att.com,*******
- DOMAIN-SUFFIX,awsstatic.com,*******
- DOMAIN-SUFFIX,azureedge.net,*******
- DOMAIN-SUFFIX,azurewebsites.net,*******
- DOMAIN-SUFFIX,bing.com,*******
- DOMAIN-SUFFIX,bintray.com,*******
- DOMAIN-SUFFIX,bit.com,*******
- DOMAIN-SUFFIX,bit.ly,*******
- DOMAIN-SUFFIX,bitbucket.org,*******
- DOMAIN-SUFFIX,bjango.com,*******
- DOMAIN-SUFFIX,bkrtx.com,*******
- DOMAIN-SUFFIX,blog.com,*******
- DOMAIN-SUFFIX,blogcdn.com,*******
- DOMAIN-SUFFIX,blogger.com,*******
- DOMAIN-SUFFIX,blogsmithmedia.com,*******
- DOMAIN-SUFFIX,blogspot.com,*******
- DOMAIN-SUFFIX,blogspot.hk,*******
- DOMAIN-SUFFIX,bloomberg.com,*******
- DOMAIN-SUFFIX,box.com,*******
- DOMAIN-SUFFIX,box.net,*******
- DOMAIN-SUFFIX,cachefly.net,*******
- DOMAIN-SUFFIX,chromium.org,*******
- DOMAIN-SUFFIX,cl.ly,*******
- DOMAIN-SUFFIX,cloudflare.com,*******
- DOMAIN-SUFFIX,cloudfront.net,*******
- DOMAIN-SUFFIX,cloudmagic.com,*******
- DOMAIN-SUFFIX,cmail19.com,*******
- DOMAIN-SUFFIX,cnet.com,*******
- DOMAIN-SUFFIX,cocoapods.org,*******
- DOMAIN-SUFFIX,comodoca.com,*******
- DOMAIN-SUFFIX,crashlytics.com,*******
- DOMAIN-SUFFIX,culturedcode.com,*******
- DOMAIN-SUFFIX,d.pr,*******
- DOMAIN-SUFFIX,danilo.to,*******
- DOMAIN-SUFFIX,dayone.me,*******
- DOMAIN-SUFFIX,db.tt,*******
- DOMAIN-SUFFIX,deskconnect.com,*******
- DOMAIN-SUFFIX,disq.us,*******
- DOMAIN-SUFFIX,disqus.com,*******
- DOMAIN-SUFFIX,disquscdn.com,*******
- DOMAIN-SUFFIX,dnsimple.com,*******
- DOMAIN-SUFFIX,docker.com,*******
- DOMAIN-SUFFIX,dribbble.com,*******
- DOMAIN-SUFFIX,droplr.com,*******
- DOMAIN-SUFFIX,duckduckgo.com,*******
- DOMAIN-SUFFIX,dueapp.com,*******
- DOMAIN-SUFFIX,dytt8.net,*******
- DOMAIN-SUFFIX,edgecastcdn.net,*******
- DOMAIN-SUFFIX,edgekey.net,*******
- DOMAIN-SUFFIX,edgesuite.net,*******
- DOMAIN-SUFFIX,engadget.com,*******
- DOMAIN-SUFFIX,entrust.net,*******
- DOMAIN-SUFFIX,eurekavpt.com,*******
- DOMAIN-SUFFIX,evernote.com,*******
- DOMAIN-SUFFIX,fabric.io,*******
- DOMAIN-SUFFIX,fast.com,*******
- DOMAIN-SUFFIX,fastly.net,*******
- DOMAIN-SUFFIX,fc2.com,*******
- DOMAIN-SUFFIX,feedburner.com,*******
- DOMAIN-SUFFIX,feedly.com,*******
- DOMAIN-SUFFIX,feedsportal.com,*******
- DOMAIN-SUFFIX,fiftythree.com,*******
- DOMAIN-SUFFIX,firebaseio.com,*******
- DOMAIN-SUFFIX,flexibits.com,*******
- DOMAIN-SUFFIX,flickr.com,*******
- DOMAIN-SUFFIX,flipboard.com,*******
- DOMAIN-SUFFIX,g.co,*******
- DOMAIN-SUFFIX,gabia.net,*******
- DOMAIN-SUFFIX,geni.us,*******
- DOMAIN-SUFFIX,gfx.ms,*******
- DOMAIN-SUFFIX,ggpht.com,*******
- DOMAIN-SUFFIX,ghostnoteapp.com,*******
- DOMAIN-SUFFIX,git.io,*******
- DOMAIN-KEYWORD,github,*******
- DOMAIN-SUFFIX,globalsign.com,*******
- DOMAIN-SUFFIX,gmodules.com,*******
- DOMAIN-SUFFIX,godaddy.com,*******
- DOMAIN-SUFFIX,golang.org,*******
- DOMAIN-SUFFIX,gongm.in,*******
- DOMAIN-SUFFIX,goo.gl,*******
- DOMAIN-SUFFIX,goodreaders.com,*******
- DOMAIN-SUFFIX,goodreads.com,*******
- DOMAIN-SUFFIX,gravatar.com,*******
- DOMAIN-SUFFIX,gstatic.com,*******
- DOMAIN-SUFFIX,gvt0.com,*******
- DOMAIN-SUFFIX,hockeyapp.net,*******
- DOMAIN-SUFFIX,hotmail.com,*******
- DOMAIN-SUFFIX,icons8.com,*******
- DOMAIN-SUFFIX,ifixit.com,*******
- DOMAIN-SUFFIX,ift.tt,*******
- DOMAIN-SUFFIX,ifttt.com,*******
- DOMAIN-SUFFIX,iherb.com,*******
- DOMAIN-SUFFIX,imageshack.us,*******
- DOMAIN-SUFFIX,img.ly,*******
- DOMAIN-SUFFIX,imgur.com,*******
- DOMAIN-SUFFIX,imore.com,*******
- DOMAIN-SUFFIX,instapaper.com,*******
- DOMAIN-SUFFIX,ipn.li,*******
- DOMAIN-SUFFIX,is.gd,*******
- DOMAIN-SUFFIX,issuu.com,*******
- DOMAIN-SUFFIX,itgonglun.com,*******
- DOMAIN-SUFFIX,itun.es,*******
- DOMAIN-SUFFIX,ixquick.com,*******
- DOMAIN-SUFFIX,j.mp,*******
- DOMAIN-SUFFIX,js.revsci.net,*******
- DOMAIN-SUFFIX,jshint.com,*******
- DOMAIN-SUFFIX,jtvnw.net,*******
- DOMAIN-SUFFIX,justgetflux.com,*******
- DOMAIN-SUFFIX,kat.cr,*******
- DOMAIN-SUFFIX,klip.me,*******
- DOMAIN-SUFFIX,libsyn.com,*******
- DOMAIN-SUFFIX,linkedin.com,*******
- DOMAIN-SUFFIX,line-apps.com,*******
- DOMAIN-SUFFIX,linode.com,*******
- DOMAIN-SUFFIX,lithium.com,*******
- DOMAIN-SUFFIX,littlehj.com,*******
- DOMAIN-SUFFIX,live.com,*******
- DOMAIN-SUFFIX,live.net,*******
- DOMAIN-SUFFIX,livefilestore.com,*******
- DOMAIN-SUFFIX,llnwd.net,*******
- DOMAIN-SUFFIX,macid.co,*******
- DOMAIN-SUFFIX,macromedia.com,*******
- DOMAIN-SUFFIX,macrumors.com,*******
- DOMAIN-SUFFIX,mashable.com,*******
- DOMAIN-SUFFIX,mathjax.org,*******
- DOMAIN-SUFFIX,medium.com,*******
- DOMAIN-SUFFIX,mega.co.nz,*******
- DOMAIN-SUFFIX,mega.nz,*******
- DOMAIN-SUFFIX,megaupload.com,*******
- DOMAIN-SUFFIX,microsofttranslator.com,*******
- DOMAIN-SUFFIX,mindnode.com,*******
- DOMAIN-SUFFIX,mobile01.com,*******
- DOMAIN-SUFFIX,modmyi.com,*******
- DOMAIN-SUFFIX,msedge.net,*******
- DOMAIN-SUFFIX,myfontastic.com,*******
- DOMAIN-SUFFIX,name.com,*******
- DOMAIN-SUFFIX,nextmedia.com,*******
- DOMAIN-SUFFIX,nsstatic.net,*******
- DOMAIN-SUFFIX,nssurge.com,*******
- DOMAIN-SUFFIX,nyt.com,*******
- DOMAIN-SUFFIX,nytimes.com,*******
- DOMAIN-SUFFIX,omnigroup.com,*******
- DOMAIN-SUFFIX,onedrive.com,*******
- DOMAIN-SUFFIX,onenote.com,*******
- DOMAIN-SUFFIX,ooyala.com,*******
- DOMAIN-SUFFIX,openvpn.net,*******
- DOMAIN-SUFFIX,openwrt.org,*******
- DOMAIN-SUFFIX,orkut.com,*******
- DOMAIN-SUFFIX,osxdaily.com,*******
- DOMAIN-SUFFIX,outlook.com,*******
- DOMAIN-SUFFIX,ow.ly,*******
- DOMAIN-SUFFIX,paddleapi.com,*******
- DOMAIN-SUFFIX,parallels.com,*******
- DOMAIN-SUFFIX,parse.com,*******
- DOMAIN-SUFFIX,pdfexpert.com,*******
- DOMAIN-SUFFIX,periscope.tv,*******
- DOMAIN-SUFFIX,pinboard.in,*******
- DOMAIN-SUFFIX,pinterest.com,*******
- DOMAIN-SUFFIX,pixelmator.com,*******
- DOMAIN-SUFFIX,pixiv.net,*******
- DOMAIN-SUFFIX,playpcesor.com,*******
- DOMAIN-SUFFIX,playstation.com,*******
- DOMAIN-SUFFIX,playstation.com.hk,*******
- DOMAIN-SUFFIX,playstation.net,*******
- DOMAIN-SUFFIX,playstationnetwork.com,*******
- DOMAIN-SUFFIX,pushwoosh.com,*******
- DOMAIN-SUFFIX,rime.im,*******
- DOMAIN-SUFFIX,servebom.com,*******
- DOMAIN-SUFFIX,sfx.ms,*******
- DOMAIN-SUFFIX,shadowsocks.org,*******
- DOMAIN-SUFFIX,sharethis.com,*******
- DOMAIN-SUFFIX,shazam.com,*******
- DOMAIN-SUFFIX,skype.com,*******
- DOMAIN-SUFFIX,smartdns*******.com,*******
- DOMAIN-SUFFIX,smartmailcloud.com,*******
- DOMAIN-SUFFIX,sndcdn.com,*******
- DOMAIN-SUFFIX,sony.com,*******
- DOMAIN-SUFFIX,soundcloud.com,*******
- DOMAIN-SUFFIX,sourceforge.net,*******
- DOMAIN-SUFFIX,spotify.com,*******
- DOMAIN-SUFFIX,squarespace.com,*******
- DOMAIN-SUFFIX,sstatic.net,*******
- DOMAIN-SUFFIX,st.luluku.pw,*******
- DOMAIN-SUFFIX,stackoverflow.com,*******
- DOMAIN-SUFFIX,startpage.com,*******
- DOMAIN-SUFFIX,staticflickr.com,*******
- DOMAIN-SUFFIX,steamcommunity.com,*******
- DOMAIN-SUFFIX,symauth.com,*******
- DOMAIN-SUFFIX,symcb.com,*******
- DOMAIN-SUFFIX,symcd.com,*******
- DOMAIN-SUFFIX,tapbots.com,*******
- DOMAIN-SUFFIX,tapbots.net,*******
- DOMAIN-SUFFIX,tdesktop.com,*******
- DOMAIN-SUFFIX,techcrunch.com,*******
- DOMAIN-SUFFIX,techsmith.com,*******
- DOMAIN-SUFFIX,thepiratebay.org,*******
- DOMAIN-SUFFIX,theverge.com,*******
- DOMAIN-SUFFIX,time.com,*******
- DOMAIN-SUFFIX,timeinc.net,*******
- DOMAIN-SUFFIX,tiny.cc,*******
- DOMAIN-SUFFIX,tinypic.com,*******
- DOMAIN-SUFFIX,tmblr.co,*******
- DOMAIN-SUFFIX,todoist.com,*******
- DOMAIN-SUFFIX,trello.com,*******
- DOMAIN-SUFFIX,trustasiassl.com,*******
- DOMAIN-SUFFIX,tumblr.co,*******
- DOMAIN-SUFFIX,tumblr.com,*******
- DOMAIN-SUFFIX,tweetdeck.com,*******
- DOMAIN-SUFFIX,tweetmarker.net,*******
- DOMAIN-SUFFIX,twitch.tv,*******
- DOMAIN-SUFFIX,txmblr.com,*******
- DOMAIN-SUFFIX,typekit.net,*******
- DOMAIN-SUFFIX,ubertags.com,*******
- DOMAIN-SUFFIX,ublock.org,*******
- DOMAIN-SUFFIX,ubnt.com,*******
- DOMAIN-SUFFIX,ulyssesapp.com,*******
- DOMAIN-SUFFIX,urchin.com,*******
- DOMAIN-SUFFIX,usertrust.com,*******
- DOMAIN-SUFFIX,v.gd,*******
- DOMAIN-SUFFIX,v2ex.com,*******
- DOMAIN-SUFFIX,vimeo.com,*******
- DOMAIN-SUFFIX,vimeocdn.com,*******
- DOMAIN-SUFFIX,vine.co,*******
- DOMAIN-SUFFIX,vivaldi.com,*******
- DOMAIN-SUFFIX,vox-cdn.com,*******
- DOMAIN-SUFFIX,vsco.co,*******
- DOMAIN-SUFFIX,vultr.com,*******
- DOMAIN-SUFFIX,w.org,*******
- DOMAIN-SUFFIX,w3schools.com,*******
- DOMAIN-SUFFIX,webtype.com,*******
- DOMAIN-SUFFIX,wikiwand.com,*******
- DOMAIN-SUFFIX,wikileaks.org,*******
- DOMAIN-SUFFIX,wikimedia.org,*******
- DOMAIN-SUFFIX,wikipedia.com,*******
- DOMAIN-SUFFIX,wikipedia.org,*******
- DOMAIN-SUFFIX,windows.com,*******
- DOMAIN-SUFFIX,windows.net,*******
- DOMAIN-SUFFIX,wire.com,*******
- DOMAIN-SUFFIX,wordpress.com,*******
- DOMAIN-SUFFIX,workflowy.com,*******
- DOMAIN-SUFFIX,wp.com,*******
- DOMAIN-SUFFIX,wsj.com,*******
- DOMAIN-SUFFIX,wsj.net,*******
- DOMAIN-SUFFIX,xda-developers.com,*******
- DOMAIN-SUFFIX,xeeno.com,*******
- DOMAIN-SUFFIX,xiti.com,*******
- DOMAIN-SUFFIX,yahoo.com,*******
- DOMAIN-SUFFIX,yimg.com,*******
- DOMAIN-SUFFIX,ying.com,*******
- DOMAIN-SUFFIX,yoyo.org,*******
- DOMAIN-SUFFIX,ytimg.com,*******
- DOMAIN-SUFFIX,telegra.ph,*******
- DOMAIN-SUFFIX,telegram.org,*******
- RULE-SET,telegramcidr,*******
- IP-CIDR,120.232.181.162/32,*******,no-resolve
- IP-CIDR,120.241.147.226/32,*******,no-resolve
- IP-CIDR,120.253.253.226/32,*******,no-resolve
- IP-CIDR,120.253.255.162/32,*******,no-resolve
- IP-CIDR,120.253.255.34/32,*******,no-resolve
- IP-CIDR,120.253.255.98/32,*******,no-resolve
- IP-CIDR,180.163.150.162/32,*******,no-resolve
- IP-CIDR,180.163.150.34/32,*******,no-resolve
- IP-CIDR,180.163.151.162/32,*******,no-resolve
- IP-CIDR,180.163.151.34/32,*******,no-resolve
- IP-CIDR,203.208.39.0/24,*******,no-resolve
- IP-CIDR,203.208.40.0/24,*******,no-resolve
- IP-CIDR,203.208.41.0/24,*******,no-resolve
- IP-CIDR,203.208.43.0/24,*******,no-resolve
- IP-CIDR,203.208.50.0/24,*******,no-resolve
- IP-CIDR,220.181.174.162/32,*******,no-resolve
- IP-CIDR,220.181.174.226/32,*******,no-resolve
- IP-CIDR,220.181.174.34/32,*******,no-resolve
- DOMAIN,injections.adguard.org,DIRECT
- DOMAIN,local.adguard.org,DIRECT
- DOMAIN-SUFFIX,local,DIRECT
- RULE-SET,lancidr,DIRECT
- DOMAIN-SUFFIX,cn,DIRECT
- DOMAIN-KEYWORD,-cn,DIRECT
- RULE-SET,gfw,*******
- RULE-SET,greatfire,*******
- GEOIP,CN,DIRECT
- RULE-SET,tld-not-cn,*******
- MATCH,DIRECT
redir-port: 7892
tproxy-port: 7895
port: 7890
socks-port: 7891
external-ui: "/usr/share/openclash/ui"
ipv6: true
experimental:
  sniff-tls-sni: true
profile:
  store-selected: true
  store-fake-ip: true
authentication:
- Clash:Lbt8c7GA

#===================== IPTABLES 防火墙设置 =====================#

#IPv4 NAT chain

# Generated by iptables-save v1.4.21 on Mon Nov 21 20:03:56 2022
*nat
:PREROUTING ACCEPT [28:1205]
:INPUT ACCEPT [21:1092]
:OUTPUT ACCEPT [98:5960]
:POSTROUTING ACCEPT [21:1367]
:MINIUPNPD - [0:0]
:MINIUPNPD-POSTROUTING - [0:0]
:openclash - [0:0]
:openclash_output - [0:0]
:postrouting_ipsecserver_rule - [0:0]
:postrouting_lan_rule - [0:0]
:postrouting_rule - [0:0]
:postrouting_vpn_rule - [0:0]
:postrouting_wan_rule - [0:0]
:prerouting_ipsecserver_rule - [0:0]
:prerouting_lan_rule - [0:0]
:prerouting_rule - [0:0]
:prerouting_vpn_rule - [0:0]
:prerouting_wan_rule - [0:0]
:zone_ipsecserver_postrouting - [0:0]
:zone_ipsecserver_prerouting - [0:0]
:zone_lan_postrouting - [0:0]
:zone_lan_prerouting - [0:0]
:zone_vpn_postrouting - [0:0]
:zone_vpn_prerouting - [0:0]
:zone_wan_postrouting - [0:0]
:zone_wan_prerouting - [0:0]
-A PREROUTING -d 8.8.4.4/32 -p tcp -m comment --comment "OpenClash Google DNS Hijack" -m tcp --dport 53 -j REDIRECT --to-ports 7892
-A PREROUTING -d 8.8.8.8/32 -p tcp -m comment --comment "OpenClash Google DNS Hijack" -m tcp --dport 53 -j REDIRECT --to-ports 7892
-A PREROUTING -p tcp -m tcp --dport 53 -m comment --comment "OpenClash DNS Hijack" -j REDIRECT --to-ports 53
-A PREROUTING -p udp -m udp --dport 53 -m comment --comment "OpenClash DNS Hijack" -j REDIRECT --to-ports 53
-A PREROUTING -p udp -m udp --dport 53 -j REDIRECT --to-ports 53
-A PREROUTING -p tcp -m tcp --dport 53 -j REDIRECT --to-ports 53
-A PREROUTING -m comment --comment "!fw3: Custom prerouting rule chain" -j prerouting_rule
-A PREROUTING -i br-lan -m comment --comment "!fw3" -j zone_lan_prerouting
-A PREROUTING -i eth3 -m comment --comment "!fw3" -j zone_wan_prerouting
-A PREROUTING -i pppoe-wan -m comment --comment "!fw3" -j zone_wan_prerouting
-A PREROUTING -i tun0 -m comment --comment "!fw3" -j zone_vpn_prerouting
-A PREROUTING -i ipsec0 -m comment --comment "!fw3" -j zone_ipsecserver_prerouting
-A PREROUTING -p tcp -j openclash
-A OUTPUT -j openclash_output
-A POSTROUTING -m comment --comment "!fw3: Custom postrouting rule chain" -j postrouting_rule
-A POSTROUTING -o br-lan -m comment --comment "!fw3" -j zone_lan_postrouting
-A POSTROUTING -o eth3 -m comment --comment "!fw3" -j zone_wan_postrouting
-A POSTROUTING -o pppoe-wan -m comment --comment "!fw3" -j zone_wan_postrouting
-A POSTROUTING -o tun0 -m comment --comment "!fw3" -j zone_vpn_postrouting
-A POSTROUTING -o ipsec0 -m comment --comment "!fw3" -j zone_ipsecserver_postrouting
-A openclash -p tcp -m tcp --sport 1688 -j RETURN
-A openclash -p tcp -m tcp --sport 1194 -j RETURN
-A openclash -m set --match-set localnetwork dst -j RETURN
-A openclash -d 198.18.0.0/16 -p tcp -j REDIRECT --to-ports 7892
-A openclash -p tcp -j REDIRECT --to-ports 7892
-A openclash_output -p tcp -m tcp --sport 1688 -j RETURN
-A openclash_output -p tcp -m tcp --sport 1194 -j RETURN
-A openclash_output -d 198.18.0.0/16 -p tcp -m owner ! --uid-owner 65534 -j REDIRECT --to-ports 7892
-A openclash_output -m set --match-set localnetwork dst -j RETURN
-A openclash_output -p tcp -m owner ! --uid-owner 65534 -j REDIRECT --to-ports 7892
-A zone_ipsecserver_postrouting -m comment --comment "!fw3: Custom ipsecserver postrouting rule chain" -j postrouting_ipsecserver_rule
-A zone_ipsecserver_prerouting -m comment --comment "!fw3: Custom ipsecserver prerouting rule chain" -j prerouting_ipsecserver_rule
-A zone_lan_postrouting -m comment --comment "!fw3: Custom lan postrouting rule chain" -j postrouting_lan_rule
-A zone_lan_prerouting -m comment --comment "!fw3: Custom lan prerouting rule chain" -j prerouting_lan_rule
-A zone_vpn_postrouting -m comment --comment "!fw3: Custom vpn postrouting rule chain" -j postrouting_vpn_rule
-A zone_vpn_postrouting -m comment --comment "!fw3" -j FULLCONENAT
-A zone_vpn_prerouting -m comment --comment "!fw3: Custom vpn prerouting rule chain" -j prerouting_vpn_rule
-A zone_vpn_prerouting -m comment --comment "!fw3" -j FULLCONENAT
-A zone_wan_postrouting -j MINIUPNPD-POSTROUTING
-A zone_wan_postrouting -j MINIUPNPD-POSTROUTING
-A zone_wan_postrouting -m comment --comment "!fw3: Custom wan postrouting rule chain" -j postrouting_wan_rule
-A zone_wan_postrouting -m comment --comment "!fw3" -j FULLCONENAT
-A zone_wan_prerouting -j MINIUPNPD
-A zone_wan_prerouting -j MINIUPNPD
-A zone_wan_prerouting -m comment --comment "!fw3: Custom wan prerouting rule chain" -j prerouting_wan_rule
-A zone_wan_prerouting -m comment --comment "!fw3" -j FULLCONENAT
COMMIT
# Completed on Mon Nov 21 20:03:56 2022

#IPv4 Mangle chain

# Generated by iptables-save v1.4.21 on Mon Nov 21 20:03:56 2022
*mangle
:PREROUTING ACCEPT [1249:266418]
:INPUT ACCEPT [1192:226490]
:FORWARD ACCEPT [40:39257]
:OUTPUT ACCEPT [1527:647893]
:POSTROUTING ACCEPT [1568:687930]
:openclash - [0:0]
-A PREROUTING -p udp -j openclash
-A FORWARD -o br-lan -p tcp -m tcp --tcp-flags SYN,RST SYN -m comment --comment "!fw3: Zone lan MTU fixing" -j TCPMSS --clamp-mss-to-pmtu
-A FORWARD -o eth3 -p tcp -m tcp --tcp-flags SYN,RST SYN -m comment --comment "!fw3: Zone wan MTU fixing" -j TCPMSS --clamp-mss-to-pmtu
-A FORWARD -o pppoe-wan -p tcp -m tcp --tcp-flags SYN,RST SYN -m comment --comment "!fw3: Zone wan MTU fixing" -j TCPMSS --clamp-mss-to-pmtu
-A openclash -p udp -m udp --sport 1194 -j RETURN
-A openclash -p udp -m udp --sport 500 -j RETURN
-A openclash -p udp -m udp --sport 68 -j RETURN
-A openclash -m set --match-set localnetwork dst -j RETURN
-A openclash -p udp -m udp --dport 53 -j RETURN
-A openclash -d 198.18.0.0/16 -p udp -j TPROXY --on-port 7895 --on-ip 0.0.0.0 --tproxy-mark 0x162/0xffffffff
-A openclash -p udp -j TPROXY --on-port 7895 --on-ip 0.0.0.0 --tproxy-mark 0x162/0xffffffff
COMMIT
# Completed on Mon Nov 21 20:03:56 2022

#IPv4 Filter chain

# Generated by iptables-save v1.4.21 on Mon Nov 21 20:03:56 2022
*filter
:INPUT ACCEPT [0:0]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [0:0]
:MINIUPNPD - [0:0]
:forwarding_ipsecserver_rule - [0:0]
:forwarding_lan_rule - [0:0]
:forwarding_rule - [0:0]
:forwarding_vpn_rule - [0:0]
:forwarding_wan_rule - [0:0]
:input_ipsecserver_rule - [0:0]
:input_lan_rule - [0:0]
:input_rule - [0:0]
:input_vpn_rule - [0:0]
:input_wan_rule - [0:0]
:openclash_wan_input - [0:0]
:output_ipsecserver_rule - [0:0]
:output_lan_rule - [0:0]
:output_rule - [0:0]
:output_vpn_rule - [0:0]
:output_wan_rule - [0:0]
:reject - [0:0]
:syn_flood - [0:0]
:zone_ipsecserver_dest_ACCEPT - [0:0]
:zone_ipsecserver_forward - [0:0]
:zone_ipsecserver_input - [0:0]
:zone_ipsecserver_output - [0:0]
:zone_ipsecserver_src_ACCEPT - [0:0]
:zone_lan_dest_ACCEPT - [0:0]
:zone_lan_forward - [0:0]
:zone_lan_input - [0:0]
:zone_lan_output - [0:0]
:zone_lan_src_ACCEPT - [0:0]
:zone_vpn_dest_ACCEPT - [0:0]
:zone_vpn_forward - [0:0]
:zone_vpn_input - [0:0]
:zone_vpn_output - [0:0]
:zone_vpn_src_ACCEPT - [0:0]
:zone_wan_dest_ACCEPT - [0:0]
:zone_wan_dest_REJECT - [0:0]
:zone_wan_forward - [0:0]
:zone_wan_input - [0:0]
:zone_wan_output - [0:0]
:zone_wan_src_REJECT - [0:0]
-A INPUT -p udp -m udp --dport 443 -m comment --comment "OpenClash QUIC REJECT" -m set ! --match-set china_ip_route dst -j REJECT --reject-with icmp-port-unreachable
-A INPUT -i pppoe-wan -m set ! --match-set localnetwork src -j openclash_wan_input
-A INPUT -i eth3 -m set ! --match-set localnetwork src -j openclash_wan_input
-A INPUT -i lo -m comment --comment "!fw3" -j ACCEPT
-A INPUT -m comment --comment "!fw3: Custom input rule chain" -j input_rule
-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment "!fw3" -j ACCEPT
-A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -m comment --comment "!fw3" -j syn_flood
-A INPUT -i br-lan -m comment --comment "!fw3" -j zone_lan_input
-A INPUT -i eth3 -m comment --comment "!fw3" -j zone_wan_input
-A INPUT -i pppoe-wan -m comment --comment "!fw3" -j zone_wan_input
-A INPUT -i tun0 -m comment --comment "!fw3" -j zone_vpn_input
-A INPUT -i ipsec0 -m comment --comment "!fw3" -j zone_ipsecserver_input
-A FORWARD -m comment --comment "!fw3: Custom forwarding rule chain" -j forwarding_rule
-A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment "!fw3" -j ACCEPT
-A FORWARD -i br-lan -m comment --comment "!fw3" -j zone_lan_forward
-A FORWARD -i eth3 -m comment --comment "!fw3" -j zone_wan_forward
-A FORWARD -i pppoe-wan -m comment --comment "!fw3" -j zone_wan_forward
-A FORWARD -i tun0 -m comment --comment "!fw3" -j zone_vpn_forward
-A FORWARD -i ipsec0 -m comment --comment "!fw3" -j zone_ipsecserver_forward
-A FORWARD -m comment --comment "!fw3" -j reject
-A OUTPUT -o lo -m comment --comment "!fw3" -j ACCEPT
-A OUTPUT -m comment --comment "!fw3: Custom output rule chain" -j output_rule
-A OUTPUT -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment "!fw3" -j ACCEPT
-A OUTPUT -o br-lan -m comment --comment "!fw3" -j zone_lan_output
-A OUTPUT -o eth3 -m comment --comment "!fw3" -j zone_wan_output
-A OUTPUT -o pppoe-wan -m comment --comment "!fw3" -j zone_wan_output
-A OUTPUT -o tun0 -m comment --comment "!fw3" -j zone_vpn_output
-A OUTPUT -o ipsec0 -m comment --comment "!fw3" -j zone_ipsecserver_output
-A openclash_wan_input -p udp -m multiport --dports 7892,7895,9090,7890,7891,7893,7874 -j REJECT --reject-with icmp-port-unreachable
-A openclash_wan_input -p tcp -m multiport --dports 7892,7895,9090,7890,7891,7893,7874 -j REJECT --reject-with icmp-port-unreachable
-A reject -p tcp -m comment --comment "!fw3" -j REJECT --reject-with tcp-reset
-A reject -m comment --comment "!fw3" -j REJECT --reject-with icmp-port-unreachable
-A syn_flood -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -m limit --limit 25/sec --limit-burst 50 -m comment --comment "!fw3" -j RETURN
-A syn_flood -m comment --comment "!fw3" -j DROP
-A zone_ipsecserver_dest_ACCEPT -o ipsec0 -m comment --comment "!fw3" -j ACCEPT
-A zone_ipsecserver_forward -m comment --comment "!fw3: Custom ipsecserver forwarding rule chain" -j forwarding_ipsecserver_rule
-A zone_ipsecserver_forward -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port forwards" -j ACCEPT
-A zone_ipsecserver_forward -m comment --comment "!fw3" -j zone_ipsecserver_dest_ACCEPT
-A zone_ipsecserver_input -m comment --comment "!fw3: Custom ipsecserver input rule chain" -j input_ipsecserver_rule
-A zone_ipsecserver_input -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port redirections" -j ACCEPT
-A zone_ipsecserver_input -m comment --comment "!fw3" -j zone_ipsecserver_src_ACCEPT
-A zone_ipsecserver_output -m comment --comment "!fw3: Custom ipsecserver output rule chain" -j output_ipsecserver_rule
-A zone_ipsecserver_output -m comment --comment "!fw3" -j zone_ipsecserver_dest_ACCEPT
-A zone_ipsecserver_src_ACCEPT -i ipsec0 -m conntrack --ctstate NEW,UNTRACKED -m comment --comment "!fw3" -j ACCEPT
-A zone_lan_dest_ACCEPT -o br-lan -m comment --comment "!fw3" -j ACCEPT
-A zone_lan_forward -m comment --comment "!fw3: Custom lan forwarding rule chain" -j forwarding_lan_rule
-A zone_lan_forward -m comment --comment "!fw3: Zone lan to wan forwarding policy" -j zone_wan_dest_ACCEPT
-A zone_lan_forward -m comment --comment "!fw3: Zone lan to vpn forwarding policy" -j zone_vpn_dest_ACCEPT
-A zone_lan_forward -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port forwards" -j ACCEPT
-A zone_lan_forward -m comment --comment "!fw3" -j zone_lan_dest_ACCEPT
-A zone_lan_input -m comment --comment "!fw3: Custom lan input rule chain" -j input_lan_rule
-A zone_lan_input -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port redirections" -j ACCEPT
-A zone_lan_input -m comment --comment "!fw3" -j zone_lan_src_ACCEPT
-A zone_lan_output -m comment --comment "!fw3: Custom lan output rule chain" -j output_lan_rule
-A zone_lan_output -m comment --comment "!fw3" -j zone_lan_dest_ACCEPT
-A zone_lan_src_ACCEPT -i br-lan -m conntrack --ctstate NEW,UNTRACKED -m comment --comment "!fw3" -j ACCEPT
-A zone_vpn_dest_ACCEPT -o tun0 -m conntrack --ctstate INVALID -m comment --comment "!fw3: Prevent NAT leakage" -j DROP
-A zone_vpn_dest_ACCEPT -o tun0 -m comment --comment "!fw3" -j ACCEPT
-A zone_vpn_forward -m comment --comment "!fw3: Custom vpn forwarding rule chain" -j forwarding_vpn_rule
-A zone_vpn_forward -m comment --comment "!fw3: Zone vpn to wan forwarding policy" -j zone_wan_dest_ACCEPT
-A zone_vpn_forward -m comment --comment "!fw3: Zone vpn to lan forwarding policy" -j zone_lan_dest_ACCEPT
-A zone_vpn_forward -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port forwards" -j ACCEPT
-A zone_vpn_forward -m comment --comment "!fw3" -j zone_vpn_dest_ACCEPT
-A zone_vpn_input -m comment --comment "!fw3: Custom vpn input rule chain" -j input_vpn_rule
-A zone_vpn_input -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port redirections" -j ACCEPT
-A zone_vpn_input -m comment --comment "!fw3" -j zone_vpn_src_ACCEPT
-A zone_vpn_output -m comment --comment "!fw3: Custom vpn output rule chain" -j output_vpn_rule
-A zone_vpn_output -m comment --comment "!fw3" -j zone_vpn_dest_ACCEPT
-A zone_vpn_src_ACCEPT -i tun0 -m conntrack --ctstate NEW,UNTRACKED -m comment --comment "!fw3" -j ACCEPT
-A zone_wan_dest_ACCEPT -o eth3 -m conntrack --ctstate INVALID -m comment --comment "!fw3: Prevent NAT leakage" -j DROP
-A zone_wan_dest_ACCEPT -o eth3 -m comment --comment "!fw3" -j ACCEPT
-A zone_wan_dest_ACCEPT -o pppoe-wan -m conntrack --ctstate INVALID -m comment --comment "!fw3: Prevent NAT leakage" -j DROP
-A zone_wan_dest_ACCEPT -o pppoe-wan -m comment --comment "!fw3" -j ACCEPT
-A zone_wan_dest_REJECT -o eth3 -m comment --comment "!fw3" -j reject
-A zone_wan_dest_REJECT -o pppoe-wan -m comment --comment "!fw3" -j reject
-A zone_wan_forward -j MINIUPNPD
-A zone_wan_forward -j MINIUPNPD
-A zone_wan_forward -m comment --comment "!fw3: Custom wan forwarding rule chain" -j forwarding_wan_rule
-A zone_wan_forward -p esp -m comment --comment "!fw3: Allow-IPSec-ESP" -j zone_lan_dest_ACCEPT
-A zone_wan_forward -p udp -m udp --dport 500 -m comment --comment "!fw3: Allow-ISAKMP" -j zone_lan_dest_ACCEPT
-A zone_wan_forward -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port forwards" -j ACCEPT
-A zone_wan_forward -m comment --comment "!fw3" -j zone_wan_dest_REJECT
-A zone_wan_input -m comment --comment "!fw3: Custom wan input rule chain" -j input_wan_rule
-A zone_wan_input -p udp -m udp --dport 68 -m comment --comment "!fw3: Allow-DHCP-Renew" -j ACCEPT
-A zone_wan_input -p icmp -m icmp --icmp-type 8 -m comment --comment "!fw3: Allow-Ping" -j ACCEPT
-A zone_wan_input -p igmp -m comment --comment "!fw3: Allow-IGMP" -j ACCEPT
-A zone_wan_input -p tcp -m tcp --dport 8118 -m comment --comment "!fw3: adblock" -j DROP
-A zone_wan_input -p tcp -m tcp --dport 1194 -m comment --comment "!fw3: openvpn" -j ACCEPT
-A zone_wan_input -p udp -m udp --dport 1194 -m comment --comment "!fw3: openvpn" -j ACCEPT
-A zone_wan_input -p tcp -m tcp --dport 1688 -m comment --comment "!fw3: kms" -j ACCEPT
-A zone_wan_input -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port redirections" -j ACCEPT
-A zone_wan_input -m comment --comment "!fw3" -j zone_wan_src_REJECT
-A zone_wan_output -m comment --comment "!fw3: Custom wan output rule chain" -j output_wan_rule
-A zone_wan_output -m comment --comment "!fw3" -j zone_wan_dest_ACCEPT
-A zone_wan_src_REJECT -i eth3 -m comment --comment "!fw3" -j reject
-A zone_wan_src_REJECT -i pppoe-wan -m comment --comment "!fw3" -j reject
COMMIT
# Completed on Mon Nov 21 20:03:56 2022

#IPv6 NAT chain

# Generated by ip6tables-save v1.4.21 on Mon Nov 21 20:03:56 2022
*nat
:PREROUTING ACCEPT [3:216]
:INPUT ACCEPT [8:662]
:OUTPUT ACCEPT [54:4493]
:POSTROUTING ACCEPT [54:4493]
-A PREROUTING -d 2001:4860:4860::8844/128 -p tcp -m comment --comment "OpenClash Google DNS Hijack" -m tcp --dport 53 -j ACCEPT
-A PREROUTING -d 2001:4860:4860::8888/128 -p tcp -m comment --comment "OpenClash Google DNS Hijack" -m tcp --dport 53 -j ACCEPT
-A PREROUTING -p tcp -m tcp --dport 53 -m comment --comment "OpenClash DNS Hijack" -j REDIRECT --to-ports 53
-A PREROUTING -p udp -m udp --dport 53 -m comment --comment "OpenClash DNS Hijack" -j REDIRECT --to-ports 53
-A PREROUTING -p udp -m udp --dport 53 -j REDIRECT --to-ports 53
-A PREROUTING -p tcp -m tcp --dport 53 -j REDIRECT --to-ports 53
COMMIT
# Completed on Mon Nov 21 20:03:56 2022

#IPv6 Mangle chain

# Generated by ip6tables-save v1.4.21 on Mon Nov 21 20:03:56 2022
*mangle
:PREROUTING ACCEPT [40:8317]
:INPUT ACCEPT [48:10237]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [93:8644]
:POSTROUTING ACCEPT [93:8644]
:openclash - [0:0]
:openclash_output - [0:0]
-A PREROUTING -j openclash
-A FORWARD -o br-lan -p tcp -m tcp --tcp-flags SYN,RST SYN -m comment --comment "!fw3: Zone lan MTU fixing" -j TCPMSS --clamp-mss-to-pmtu
-A FORWARD -o eth3 -p tcp -m tcp --tcp-flags SYN,RST SYN -m comment --comment "!fw3: Zone wan MTU fixing" -j TCPMSS --clamp-mss-to-pmtu
-A FORWARD -o pppoe-wan -p tcp -m tcp --tcp-flags SYN,RST SYN -m comment --comment "!fw3: Zone wan MTU fixing" -j TCPMSS --clamp-mss-to-pmtu
-A OUTPUT -j openclash_output
-A openclash -p tcp -m tcp --sport 1688 -j RETURN
-A openclash -p udp -m udp --sport 1194 -j RETURN
-A openclash -p tcp -m tcp --sport 1194 -j RETURN
-A openclash -p udp -m udp --sport 500 -j RETURN
-A openclash -s fc00::/6 -p udp -m udp --sport 546 -j RETURN
-A openclash -m set --match-set localnetwork6 dst -j RETURN
-A openclash -p udp -m udp --dport 53 -j RETURN
-A openclash -m set --match-set china_ip6_route dst -m set ! --match-set china_ip6_route_pass dst -j RETURN
-A openclash -p tcp -m comment --comment "OpenClash TCP Tproxy" -j TPROXY --on-port 7895 --on-ip :: --tproxy-mark 0x162/0xffffffff
-A openclash -p udp -m comment --comment "OpenClash UDP Tproxy" -j TPROXY --on-port 7895 --on-ip :: --tproxy-mark 0x162/0xffffffff
-A openclash_output -p tcp -m tcp --sport 1688 -j RETURN
-A openclash_output -p udp -m udp --sport 1194 -j RETURN
-A openclash_output -p tcp -m tcp --sport 1194 -j RETURN
-A openclash_output -p udp -m udp --sport 500 -j RETURN
-A openclash_output -p udp -m udp --sport 546 -j RETURN
-A openclash_output -m set --match-set localnetwork6 dst -j RETURN
-A openclash_output -m owner ! --uid-owner 65534 -m set --match-set china_ip6_route dst -m set ! --match-set china_ip6_route_pass dst -j RETURN
-A openclash_output -p tcp -m owner ! --uid-owner 65534 -j MARK --set-xmark 0x162/0xffffffff
COMMIT
# Completed on Mon Nov 21 20:03:57 2022

#IPv6 Filter chain

# Generated by ip6tables-save v1.4.21 on Mon Nov 21 20:03:57 2022
*filter
:INPUT ACCEPT [0:0]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [0:0]
:MINIUPNPD - [0:0]
:forwarding_ipsecserver_rule - [0:0]
:forwarding_lan_rule - [0:0]
:forwarding_rule - [0:0]
:forwarding_vpn_rule - [0:0]
:forwarding_wan_rule - [0:0]
:input_ipsecserver_rule - [0:0]
:input_lan_rule - [0:0]
:input_rule - [0:0]
:input_vpn_rule - [0:0]
:input_wan_rule - [0:0]
:openclash_wan_input - [0:0]
:output_ipsecserver_rule - [0:0]
:output_lan_rule - [0:0]
:output_rule - [0:0]
:output_vpn_rule - [0:0]
:output_wan_rule - [0:0]
:reject - [0:0]
:syn_flood - [0:0]
:zone_ipsecserver_dest_ACCEPT - [0:0]
:zone_ipsecserver_forward - [0:0]
:zone_ipsecserver_input - [0:0]
:zone_ipsecserver_output - [0:0]
:zone_ipsecserver_src_ACCEPT - [0:0]
:zone_lan_dest_ACCEPT - [0:0]
:zone_lan_forward - [0:0]
:zone_lan_input - [0:0]
:zone_lan_output - [0:0]
:zone_lan_src_ACCEPT - [0:0]
:zone_vpn_dest_ACCEPT - [0:0]
:zone_vpn_forward - [0:0]
:zone_vpn_input - [0:0]
:zone_vpn_output - [0:0]
:zone_vpn_src_ACCEPT - [0:0]
:zone_wan_dest_ACCEPT - [0:0]
:zone_wan_dest_REJECT - [0:0]
:zone_wan_forward - [0:0]
:zone_wan_input - [0:0]
:zone_wan_output - [0:0]
:zone_wan_src_REJECT - [0:0]
-A INPUT -i pppoe-wan -m set --match-set localnetwork6 src -j openclash_wan_input
-A INPUT -i pppoe-wan -m set --match-set localnetwork6 src -j openclash_wan_input
-A INPUT -p udp -m udp --dport 443 -m comment --comment "OpenClash QUIC REJECT" -m set ! --match-set china_ip6_route dst -j REJECT --reject-with icmp6-port-unreachable
-A INPUT -i lo -m comment --comment "!fw3" -j ACCEPT
-A INPUT -m comment --comment "!fw3: Custom input rule chain" -j input_rule
-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment "!fw3" -j ACCEPT
-A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -m comment --comment "!fw3" -j syn_flood
-A INPUT -i br-lan -m comment --comment "!fw3" -j zone_lan_input
-A INPUT -i eth3 -m comment --comment "!fw3" -j zone_wan_input
-A INPUT -i pppoe-wan -m comment --comment "!fw3" -j zone_wan_input
-A INPUT -i tun0 -m comment --comment "!fw3" -j zone_vpn_input
-A INPUT -i ipsec0 -m comment --comment "!fw3" -j zone_ipsecserver_input
-A FORWARD -m comment --comment "!fw3: Custom forwarding rule chain" -j forwarding_rule
-A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment "!fw3" -j ACCEPT
-A FORWARD -i br-lan -m comment --comment "!fw3" -j zone_lan_forward
-A FORWARD -i eth3 -m comment --comment "!fw3" -j zone_wan_forward
-A FORWARD -i pppoe-wan -m comment --comment "!fw3" -j zone_wan_forward
-A FORWARD -i tun0 -m comment --comment "!fw3" -j zone_vpn_forward
-A FORWARD -i ipsec0 -m comment --comment "!fw3" -j zone_ipsecserver_forward
-A FORWARD -m comment --comment "!fw3" -j reject
-A OUTPUT -o lo -m comment --comment "!fw3" -j ACCEPT
-A OUTPUT -m comment --comment "!fw3: Custom output rule chain" -j output_rule
-A OUTPUT -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment "!fw3" -j ACCEPT
-A OUTPUT -o br-lan -m comment --comment "!fw3" -j zone_lan_output
-A OUTPUT -o eth3 -m comment --comment "!fw3" -j zone_wan_output
-A OUTPUT -o pppoe-wan -m comment --comment "!fw3" -j zone_wan_output
-A OUTPUT -o tun0 -m comment --comment "!fw3" -j zone_vpn_output
-A OUTPUT -o ipsec0 -m comment --comment "!fw3" -j zone_ipsecserver_output
-A openclash_wan_input -p udp -m multiport --dports 7892,7895,9090,7890,7891,7893,7874 -j REJECT --reject-with icmp6-port-unreachable
-A openclash_wan_input -p tcp -m multiport --dports 7892,7895,9090,7890,7891,7893,7874 -j REJECT --reject-with icmp6-port-unreachable
-A reject -p tcp -m comment --comment "!fw3" -j REJECT --reject-with tcp-reset
-A reject -m comment --comment "!fw3" -j REJECT --reject-with icmp6-port-unreachable
-A syn_flood -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -m limit --limit 25/sec --limit-burst 50 -m comment --comment "!fw3" -j RETURN
-A syn_flood -m comment --comment "!fw3" -j DROP
-A zone_ipsecserver_dest_ACCEPT -o ipsec0 -m comment --comment "!fw3" -j ACCEPT
-A zone_ipsecserver_forward -m comment --comment "!fw3: Custom ipsecserver forwarding rule chain" -j forwarding_ipsecserver_rule
-A zone_ipsecserver_forward -m comment --comment "!fw3" -j zone_ipsecserver_dest_ACCEPT
-A zone_ipsecserver_input -m comment --comment "!fw3: Custom ipsecserver input rule chain" -j input_ipsecserver_rule
-A zone_ipsecserver_input -m comment --comment "!fw3" -j zone_ipsecserver_src_ACCEPT
-A zone_ipsecserver_output -m comment --comment "!fw3: Custom ipsecserver output rule chain" -j output_ipsecserver_rule
-A zone_ipsecserver_output -m comment --comment "!fw3" -j zone_ipsecserver_dest_ACCEPT
-A zone_ipsecserver_src_ACCEPT -i ipsec0 -m conntrack --ctstate NEW,UNTRACKED -m comment --comment "!fw3" -j ACCEPT
-A zone_lan_dest_ACCEPT -o br-lan -m comment --comment "!fw3" -j ACCEPT
-A zone_lan_forward -m comment --comment "!fw3: Custom lan forwarding rule chain" -j forwarding_lan_rule
-A zone_lan_forward -m comment --comment "!fw3: Zone lan to wan forwarding policy" -j zone_wan_dest_ACCEPT
-A zone_lan_forward -m comment --comment "!fw3: Zone lan to vpn forwarding policy" -j zone_vpn_dest_ACCEPT
-A zone_lan_forward -m comment --comment "!fw3" -j zone_lan_dest_ACCEPT
-A zone_lan_input -m comment --comment "!fw3: Custom lan input rule chain" -j input_lan_rule
-A zone_lan_input -m comment --comment "!fw3" -j zone_lan_src_ACCEPT
-A zone_lan_output -m comment --comment "!fw3: Custom lan output rule chain" -j output_lan_rule
-A zone_lan_output -m comment --comment "!fw3" -j zone_lan_dest_ACCEPT
-A zone_lan_src_ACCEPT -i br-lan -m conntrack --ctstate NEW,UNTRACKED -m comment --comment "!fw3" -j ACCEPT
-A zone_vpn_dest_ACCEPT -o tun0 -m conntrack --ctstate INVALID -m comment --comment "!fw3: Prevent NAT leakage" -j DROP
-A zone_vpn_dest_ACCEPT -o tun0 -m comment --comment "!fw3" -j ACCEPT
-A zone_vpn_forward -m comment --comment "!fw3: Custom vpn forwarding rule chain" -j forwarding_vpn_rule
-A zone_vpn_forward -m comment --comment "!fw3: Zone vpn to wan forwarding policy" -j zone_wan_dest_ACCEPT
-A zone_vpn_forward -m comment --comment "!fw3: Zone vpn to lan forwarding policy" -j zone_lan_dest_ACCEPT
-A zone_vpn_forward -m comment --comment "!fw3" -j zone_vpn_dest_ACCEPT
-A zone_vpn_input -m comment --comment "!fw3: Custom vpn input rule chain" -j input_vpn_rule
-A zone_vpn_input -m comment --comment "!fw3" -j zone_vpn_src_ACCEPT
-A zone_vpn_output -m comment --comment "!fw3: Custom vpn output rule chain" -j output_vpn_rule
-A zone_vpn_output -m comment --comment "!fw3" -j zone_vpn_dest_ACCEPT
-A zone_vpn_src_ACCEPT -i tun0 -m conntrack --ctstate NEW,UNTRACKED -m comment --comment "!fw3" -j ACCEPT
-A zone_wan_dest_ACCEPT -o eth3 -m conntrack --ctstate INVALID -m comment --comment "!fw3: Prevent NAT leakage" -j DROP
-A zone_wan_dest_ACCEPT -o eth3 -m comment --comment "!fw3" -j ACCEPT
-A zone_wan_dest_ACCEPT -o pppoe-wan -m conntrack --ctstate INVALID -m comment --comment "!fw3: Prevent NAT leakage" -j DROP
-A zone_wan_dest_ACCEPT -o pppoe-wan -m comment --comment "!fw3" -j ACCEPT
-A zone_wan_dest_REJECT -o eth3 -m comment --comment "!fw3" -j reject
-A zone_wan_dest_REJECT -o pppoe-wan -m comment --comment "!fw3" -j reject
-A zone_wan_forward -j MINIUPNPD
-A zone_wan_forward -j MINIUPNPD
-A zone_wan_forward -m comment --comment "!fw3: Custom wan forwarding rule chain" -j forwarding_wan_rule
-A zone_wan_forward -p ipv6-icmp -m icmp6 --icmpv6-type 128 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Forward" -j ACCEPT
-A zone_wan_forward -p ipv6-icmp -m icmp6 --icmpv6-type 129 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Forward" -j ACCEPT
-A zone_wan_forward -p ipv6-icmp -m icmp6 --icmpv6-type 1 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Forward" -j ACCEPT
-A zone_wan_forward -p ipv6-icmp -m icmp6 --icmpv6-type 2 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Forward" -j ACCEPT
-A zone_wan_forward -p ipv6-icmp -m icmp6 --icmpv6-type 3 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Forward" -j ACCEPT
-A zone_wan_forward -p ipv6-icmp -m icmp6 --icmpv6-type 4/0 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Forward" -j ACCEPT
-A zone_wan_forward -p ipv6-icmp -m icmp6 --icmpv6-type 4/1 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Forward" -j ACCEPT
-A zone_wan_forward -p esp -m comment --comment "!fw3: Allow-IPSec-ESP" -j zone_lan_dest_ACCEPT
-A zone_wan_forward -p udp -m udp --dport 500 -m comment --comment "!fw3: Allow-ISAKMP" -j zone_lan_dest_ACCEPT
-A zone_wan_forward -m comment --comment "!fw3" -j zone_wan_dest_REJECT
-A zone_wan_input -m comment --comment "!fw3: Custom wan input rule chain" -j input_wan_rule
-A zone_wan_input -s fc00::/6 -d fc00::/6 -p udp -m udp --dport 546 -m comment --comment "!fw3: Allow-DHCPv6" -j ACCEPT
-A zone_wan_input -s fe80::/10 -p ipv6-icmp -m icmp6 --icmpv6-type 130/0 -m comment --comment "!fw3: Allow-MLD" -j ACCEPT
-A zone_wan_input -s fe80::/10 -p ipv6-icmp -m icmp6 --icmpv6-type 131/0 -m comment --comment "!fw3: Allow-MLD" -j ACCEPT
-A zone_wan_input -s fe80::/10 -p ipv6-icmp -m icmp6 --icmpv6-type 132/0 -m comment --comment "!fw3: Allow-MLD" -j ACCEPT
-A zone_wan_input -s fe80::/10 -p ipv6-icmp -m icmp6 --icmpv6-type 143/0 -m comment --comment "!fw3: Allow-MLD" -j ACCEPT
-A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 128 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT
-A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 129 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT
-A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 1 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT
-A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 2 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT
-A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 3 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT
-A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 4/0 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT
-A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 4/1 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT
-A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 133 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT
-A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 135 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT
-A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 134 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT
-A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 136 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT
-A zone_wan_input -p tcp -m tcp --dport 8118 -m comment --comment "!fw3: adblock" -j DROP
-A zone_wan_input -p tcp -m tcp --dport 1194 -m comment --comment "!fw3: openvpn" -j ACCEPT
-A zone_wan_input -p udp -m udp --dport 1194 -m comment --comment "!fw3: openvpn" -j ACCEPT
-A zone_wan_input -p tcp -m tcp --dport 1688 -m comment --comment "!fw3: kms" -j ACCEPT
-A zone_wan_input -m comment --comment "!fw3" -j zone_wan_src_REJECT
-A zone_wan_output -m comment --comment "!fw3: Custom wan output rule chain" -j output_wan_rule
-A zone_wan_output -m comment --comment "!fw3" -j zone_wan_dest_ACCEPT
-A zone_wan_src_REJECT -i eth3 -m comment --comment "!fw3" -j reject
-A zone_wan_src_REJECT -i pppoe-wan -m comment --comment "!fw3" -j reject
COMMIT
# Completed on Mon Nov 21 20:03:57 2022

#===================== IPSET状态 =====================#

Name: music
Name: china_ip_route
Name: china_ip_route_pass
Name: localnetwork
Name: china_ip6_route
Name: china_ip6_route_pass
Name: localnetwork6

#===================== 路由表状态 =====================#

#route -n
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         ***公网网关已隐藏***   0.0.0.0         UG    0      0        0 pppoe-wan
***公网网关已隐藏***   0.0.0.0         255.255.255.255 UH    0      0        0 pppoe-wan
192.168.17.0    0.0.0.0         255.255.255.0   U     0      0        0 br-lan
#ip route list
default via ***公网网关已隐藏*** dev pppoe-wan 
***公网网关已隐藏*** dev pppoe-wan scope link  src *WAN IP* 
192.168.17.0/24 dev br-lan scope link  src 192.168.17.1 
#ip rule show
0:  from all lookup local 
32765:  from all fwmark 0x162 lookup 354 
32766:  from all lookup main 
32767:  from all lookup default 

#===================== 端口占用状态 =====================#

tcp        0      0 :::9090                 :::*                    LISTEN      24597/clash
tcp        0      0 :::7890                 :::*                    LISTEN      24597/clash
tcp        0      0 :::7891                 :::*                    LISTEN      24597/clash
tcp        0      0 :::7892                 :::*                    LISTEN      24597/clash
tcp        0      0 :::7893                 :::*                    LISTEN      24597/clash
tcp        0      0 :::7895                 :::*                    LISTEN      24597/clash
udp        0      0 :::33319                :::*                                24597/clash
udp        0      0 :::7874                 :::*                                24597/clash
udp        0      0 :::7891                 :::*                                24597/clash
udp        0      0 :::7892                 :::*                                24597/clash
udp        0      0 :::7893                 :::*                                24597/clash
udp        0      0 :::7895                 :::*                                24597/clash

#===================== 测试本机DNS查询 =====================#

Server:     127.0.0.1
Address:    127.0.0.1#53

Name:      www.baidu.com
Address 1: 198.18.19.68
*** Can't find www.baidu.com: No answer

#===================== resolv.conf.auto =====================#

# Interface wan
nameserver 59.49.49.49
nameserver 219.149.135.188
# Interface wan6
nameserver fe80::1%eth3
# Interface wan_6
nameserver 240e:44:c001::
nameserver 240e:44:c002::

#===================== resolv.conf.d =====================#

# Interface wan
nameserver 59.49.49.49
nameserver 219.149.135.188
# Interface wan6
nameserver fe80::1%eth3
# Interface wan_6
nameserver 240e:44:c001::
nameserver 240e:44:c002::

#===================== 测试本机网络连接 =====================#

HTTP/1.1 200 OK
Accept-Ranges: bytes
Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform
Connection: keep-alive
Content-Length: 277
Content-Type: text/html
Date: Mon, 21 Nov 2022 12:03:57 GMT
Etag: "575e1f60-115"
Last-Modified: Mon, 13 Jun 2016 02:50:08 GMT
Pragma: no-cache
Server: bfe/1.0.8.18

#===================== 测试本机网络下载 =====================#

#===================== 最近运行日志 =====================#

12:02:03 INF [Config] initial rule provider name=apple
2022-11-21 20:02:08 Step 7: Set Firewall Rules...
2022-11-21 20:02:10 Tip: Bypass the China IP May Cause the Dnsmasq Load For a Long Time After Restart in FAKE-IP Mode, Hijack the DNS to Core Untill the Dnsmasq Works Well...
2022-11-21 20:02:14 Step 8: Restart Dnsmasq...
2022-11-21 20:02:18 Step 9: Add Cron Rules, Start Daemons...
2022-11-21 20:02:18 OpenClash Start Successful!
2022-11-21 20:02:18 Tip: Dnsmasq Work is Normal, Restore The Firewall DNS Hijacking Rules...
2022-11-21 20:02:55 OpenClash Stoping...
2022-11-21 20:02:55 Step 1: Backup The Current Groups State...
2022-11-21 20:02:55 Step 2: Delete OpenClash Firewall Rules...
2022-11-21 20:02:58 Step 3: Close The OpenClash Daemons...
2022-11-21 20:02:58 Step 4: Close The Clash Core Process...
2022-11-21 20:02:58 Step 5: Restart Dnsmasq...
2022-11-21 20:03:01 Step 6: Delete OpenClash Residue File...
2022-11-21 20:03:01 OpenClash Start Running...
2022-11-21 20:03:01 Step 1: Get The Configuration...
2022-11-21 20:03:01 Step 2: Check The Components...
2022-11-21 20:03:01 Tip: Because of the file【 /etc/config/openclash 】modificated, Pause quick start...
2022-11-21 20:03:01 Step 3: Modify The Config File...
2022-11-21 20:03:02 Tip: You have seted the authentication of SOCKS5/HTTP(S) proxy with【Clash:Lbt8c7GA】
2022-11-21 20:03:03 Step 4: Start Running The Clash Core...
2022-11-21 20:03:03 Tip: Detected The Exclusive Function of The TUN Core, Use TUN Core to Start...
2022-11-21 20:03:04 Step 5: Check The Core Status...
12:03:05 INF [Config] initial compatible provider name=EU
12:03:05 INF [Config] initial compatible provider name=US
12:03:05 INF [Config] initial compatible provider name=SpeedTest
12:03:05 INF [Config] initial compatible provider name=*******
12:03:05 INF [Config] initial compatible provider name=JP
12:03:05 INF [Config] initial compatible provider name=HK
12:03:05 INF [Config] initial compatible provider name=自动选择
12:03:05 INF [Config] initial compatible provider name=故障转移
12:03:05 INF [Config] initial rule provider name=cncidr
12:03:05 INF [Config] initial rule provider name=icloud
12:03:05 INF [Config] initial rule provider name=proxy
12:03:06 INF [Config] initial rule provider name=lancidr
12:03:06 INF [Config] initial rule provider name=greatfire
12:03:06 INF [Config] initial rule provider name=applications
12:03:06 INF [Config] initial rule provider name=gfw
12:03:06 INF [Config] initial rule provider name=google
12:03:06 INF [Config] initial rule provider name=apple
12:03:06 INF [Config] initial rule provider name=direct
2022-11-21 20:03:07 Step 6: Wait For The File Downloading...
12:03:08 INF [Config] initial rule provider name=reject
12:03:09 INF [Config] initial rule provider name=tld-not-cn
12:03:09 INF [Config] initial rule provider name=private
12:03:09 INF [Config] initial rule provider name=telegramcidr
2022-11-21 20:03:13 Step 7: Set Firewall Rules...
2022-11-21 20:03:17 Step 8: Restart Dnsmasq...
2022-11-21 20:03:21 Step 9: Add Cron Rules, Start Daemons...
2022-11-21 20:03:21 OpenClash Start Successful!

#===================== 活动连接信息 =====================#

1. SourceIP:【192.168.17.131】 - Host:【api.ipify.org】 - DestinationIP:【3.232.242.170】 - Network:【tcp】 - RulePayload:【】 - Lastchain:【DIRECT】
2. SourceIP:【*WAN IP*】 - Host:【Empty】 - DestinationIP:【146.66.152.38】 - Network:【udp】 - RulePayload:【】 - Lastchain:【DIRECT】

OpenClash Config

No response

Expected Behavior

国外域名正常劫持，国内域名正常解析

Screenshots

No response

vernesong commented 1 year ago

看一下/tmp/dnsmasq.d

ishkong commented 1 year ago

pic1

vernesong commented 1 year ago

不正常的时候呢

ishkong commented 1 year ago

不正常的时候呢

这就是不正常情况时候的。。。

vernesong commented 1 year ago

那应该是dnsmasq的问题，名单太大，加载太慢

github-actions[bot] commented 1 year ago

This issue is stale because it has been open 60 days with no activity. Remove stale label or comment or this will be closed in 5 days

ghost commented 1 year ago

@vernesong @ishkong

https://github.com/vernesong/OpenClash/issues/2952 能解决这个问题。

oo0keba0oo commented 1 year ago

不知道对你有没有帮助，我发现我本机指定了114.114.114.114的DNS，遇到了和你一样的情况，删掉后就好了。小白不是很懂原理

github-actions[bot] commented 1 year ago

This issue is stale because it has been open 60 days with no activity. Remove stale label or comment or this will be closed in 5 days

ishkong commented 1 year ago

那应该是dnsmasq的问题，名单太大，加载太慢

今天我重新看了一下log，发现了以下日志，但是openclash依然报dnsmasq启动成功，正在还原防火墙劫持

Mon Jun 26 23:44:08 2023 daemon.crit dnsmasq[31274]: bad address at line 1 of /tmp/dnsmasq.d/dnsmasq_accelerated-domains.china.conf
Mon Jun 26 23:44:08 2023 daemon.crit dnsmasq[31274]: FAILED to start up
Mon Jun 26 23:44:13 2023 daemon.crit dnsmasq[31718]: bad address at line 1 of /tmp/dnsmasq.d/dnsmasq_accelerated-domains.china.conf
Mon Jun 26 23:44:13 2023 daemon.crit dnsmasq[31718]: FAILED to start up
Mon Jun 26 23:44:18 2023 daemon.crit dnsmasq[31926]: bad address at line 1 of /tmp/dnsmasq.d/dnsmasq_accelerated-domains.china.conf
Mon Jun 26 23:44:18 2023 daemon.crit dnsmasq[31926]: FAILED to start up
Mon Jun 26 23:44:23 2023 daemon.crit dnsmasq[32146]: bad address at line 1 of /tmp/dnsmasq.d/dnsmasq_accelerated-domains.china.conf
Mon Jun 26 23:44:23 2023 daemon.crit dnsmasq[32146]: FAILED to start up
Mon Jun 26 23:44:28 2023 daemon.crit dnsmasq[32341]: bad address at line 1 of /tmp/dnsmasq.d/dnsmasq_accelerated-domains.china.conf
Mon Jun 26 23:44:28 2023 daemon.crit dnsmasq[32341]: FAILED to start up
Mon Jun 26 23:44:33 2023 daemon.crit dnsmasq[32521]: bad address at line 1 of /tmp/dnsmasq.d/dnsmasq_accelerated-domains.china.conf
Mon Jun 26 23:44:33 2023 daemon.crit dnsmasq[32521]: FAILED to start up

然后这是dnsmasq_accelerated-domains.china.conf第一行的内容

server=/0-100.com/114.114.114.114

然后这是我路由器dnsmasq的版本信息

Dnsmasq version 2.86  Copyright (c) 2000-2021 Simon Kelley
Compile time options: IPv6 GNU-getopt no-DBus UBus no-i18n no-IDN DHCP DHCPv6 no-Lua TFTP conntrack ipset auth no-cryptohash no-DNSSEC no-ID loop-detect inotify dumpfile