search

vernesong / OpenClash

A Clash Client For OpenWrt
MIT License
17.69k stars 3.2k forks source link

[Bug] 控制面板Dashboard无法监控Docker中BT下载的流量 #3136

Closed rgs66 closed 1 year ago

rgs66 commented 1 year ago

Verify Steps

OpenClash Version

v0.45.103-beta

Bug on Environment

Official OpenWrt

Bug on Platform

Linux-amd64(x86-64)

To Reproduce

**1. openwrt为旁路由模式

  1. 在openwrt中安装了aria2-pro的Docker镜像，网络模式为HOST模式，运行都很正常，下载上传都很正常
  2. 具体问题为，不管把openclash切换为哪一种模式，在Dashboard 中，均不显示流量信息
  3. aria2开启了IPV6，openclash开启了ipv6, 但没开启ip6流量代理，因为开启流量代理之后，ARIA2就无法下载没速度 5.以下是调试日志，大佬帮看一下，哪里出问题了，个人感觉是防火墙的问题，但又看不太懂，请大佬指教**

Describe the Bug

xx

OpenClash Log

OpenClash 调试日志

生成时间: 2023-03-23 10:50:19 插件版本: v0.45.103-beta 隐私提示: 上传此日志前请注意检查、屏蔽公网IP、节点、密码等相关敏感信息

===================== 系统信息 =====================

主机型号: VMware - Intel(R) Celeron(R) CPU 3965U @ 2.20GHz : 1 Core 1 Thread 固件版本: OpenWrt SNAPSHOT r4847-5ca4955cf LuCI版本: git-22.225.38104-d169a90-1 内核版本: 5.15.60 处理器架构: x86_64

此项有值时,如不使用IPv6,建议到网络-接口-lan的设置中禁用IPV6的DHCP

IPV6-DHCP:

DNS劫持: Dnsmasq 转发

DNS劫持为Dnsmasq时，此项结果应仅有配置文件的DNS监听地址

Dnsmasq转发设置: 127.0.0.1#7874

===================== 依赖检查 =====================

dnsmasq-full: 已安装 coreutils: 已安装 coreutils-nohup: 已安装 bash: 已安装 curl: 已安装 ca-certificates: 已安装 ipset: 已安装 ip-full: 已安装 libcap: 已安装 libcap-bin: 已安装 ruby: 已安装 ruby-yaml: 已安装 ruby-psych: 已安装 ruby-pstore: 已安装 kmod-tun(TUN模式): 已安装 luci-compat(Luci >= 19.07): 已安装 kmod-inet-diag(PROCESS-NAME): 未安装 unzip: 已安装 iptables-mod-tproxy: 已安装 kmod-ipt-tproxy: 已安装 iptables-mod-extra: 已安装 kmod-ipt-extra: 已安装 kmod-ipt-nat: 已安装

===================== 内核检查 =====================

运行状态: 运行中 内核：Meta 进程pid: 21327 运行权限: 21327: cap_dac_override,cap_net_bind_service,cap_net_admin,cap_net_raw,cap_sys_ptrace,cap_sys_resource=eip 运行用户: nobody 已选择的架构: Meta

下方无法显示内核版本号时请确认您的内核版本是否正确或者有无权限

Tun内核版本: 2023.03.04-5-g4a8cefb Tun内核文件: 存在 Tun内核运行权限: 正常

Dev内核版本: v1.13.0-7-g4ffc999 Dev内核文件: 存在 Dev内核运行权限: 正常

Meta内核版本: alpha-g2f992e9 Meta内核文件: 存在 Meta内核运行权限: 正常

===================== 插件设置 =====================

当前配置文件: /etc/openclash/config/taitan.yaml 启动配置文件: /etc/openclash/taitan.yaml 运行模式: fake-ip 默认代理模式: rule UDP流量转发(tproxy): 启用 自定义DNS: 启用 IPV6代理: 停用 IPV6-DNS解析: 启用 禁用Dnsmasq缓存: 启用 自定义规则: 启用 仅允许内网: 停用 仅代理命中规则流量: 停用 仅允许常用端口流量: 停用 绕过中国大陆IP: 停用 路由本机代理: 启用

启动异常时建议关闭此项后重试

混合节点: 停用 保留配置: 停用

启动异常时建议关闭此项后重试

第三方规则: 启用

===================== 自定义规则 一 =====================

script:

shortcuts:

Notice: The core timezone is UTC

CST 20:00-24:00 = time.now().hour > 12 and time.now().hour < 16

内核时区为UTC,故以下time.now()函数的取值需要根据本地时区进行转换

北京时间(CST) 20:00-24:00 = time.now().hour > 12 and time.now().hour < 16

quic: network == 'udp' and dst_port == 443 and (geoip(resolve_ip(host)) != 'CN' or geoip(dst_ip) != 'CN')

time-limit: in_cidr(src_ip,'192.168.1.2/32') and time.now().hour < 20 or time.now().hour > 21

time-limit: src_ip == '192.168.1.2' and time.now().hour < 20 or time.now().hour > 21

code: |

def main(ctx, metadata):

directkeywordlist = ["baidu"]

for directkeyword in directkeywordlist:

if directkeyword in metadata["host"]:

ctx.log('[Script] matched keyword %s use direct' % directkeyword)

return "DIRECT"

rules: XXX

- PROCESS-NAME,curl,DIRECT #匹配路由自身进程(curl直连)

- DOMAIN-SUFFIX,google.com,Proxy #匹配域名后缀(交由Proxy代理服务器组)

- DOMAIN-KEYWORD,google,Proxy #匹配域名关键字(交由Proxy代理服务器组)

- DOMAIN,google.com,Proxy #匹配域名(交由Proxy代理服务器组)

- DOMAIN-SUFFIX,ad.com,REJECT #匹配域名后缀(拒绝)

- IP-CIDR,127.0.0.0/8,DIRECT #匹配数据目标IP(直连)

- SRC-IP-CIDR,192.168.1.201/32,DIRECT #匹配数据发起IP(直连)

- DST-PORT,80,DIRECT #匹配数据目标端口(直连)

- SRC-PORT,7777,DIRECT #匹配数据源端口(直连)

排序在上的规则优先生效,如添加（去除规则前的#号）：

IP段：192.168.1.2-192.168.1.200 直连

- SRC-IP-CIDR,192.168.1.2/31,DIRECT

- SRC-IP-CIDR,192.168.1.4/30,DIRECT

- SRC-IP-CIDR,192.168.1.8/29,DIRECT

- SRC-IP-CIDR,192.168.1.16/28,DIRECT

- SRC-IP-CIDR,192.168.1.32/27,DIRECT

- SRC-IP-CIDR,192.168.1.64/26,DIRECT

- SRC-IP-CIDR,192.168.1.128/26,DIRECT

- SRC-IP-CIDR,192.168.1.192/29,DIRECT

- SRC-IP-CIDR,192.168.1.200/32,DIRECT

IP段：192.168.1.202-192.168.1.255 直连

- SRC-IP-CIDR,192.168.1.202/31,DIRECT

- SRC-IP-CIDR,192.168.1.204/30,DIRECT

- SRC-IP-CIDR,192.168.1.208/28,DIRECT

- SRC-IP-CIDR,192.168.1.224/27,DIRECT

此时IP为192.168.1.1和192.168.1.201的客户端流量走代理（策略），其余客户端不走代理

因为Fake-IP模式下，IP地址为192.168.1.1的路由器自身流量可走代理（策略），所以需要排除

仅设置路由器自身直连：

- SRC-IP-CIDR,192.168.1.1/32,DIRECT

- SRC-IP-CIDR,198.18.0.1/32,DIRECT

DDNS

- DOMAIN-SUFFIX,checkip.dyndns.org,DIRECT

- DOMAIN-SUFFIX,checkipv6.dyndns.org,DIRECT

- DOMAIN-SUFFIX,checkip.synology.com,DIRECT

- DOMAIN-SUFFIX,ifconfig.co,DIRECT

- DOMAIN-SUFFIX,api.myip.com,DIRECT

- DOMAIN-SUFFIX,ip-api.com,DIRECT

- DOMAIN-SUFFIX,ipapi.co,DIRECT

- DOMAIN-SUFFIX,ip6.seeip.org,DIRECT

- DOMAIN-SUFFIX,members.3322.org,DIRECT

在线IP段转CIDR地址：http://ip2cidr.com

===================== 自定义规则 二 =====================

script:

shortcuts:

common_port: dst_port not in [21, 22, 23, 53, 80, 123, 143, 194, 443, 465, 587, 853, 993, 995, 998, 2052, 2053, 2082, 2083, 2086, 2095, 2096, 5222, 5228, 5229, 5230, 8080, 8443, 8880, 8888, 8889]

code: |

def main(ctx, metadata):

directkeywordlist = ["baidu"]

for directkeyword in directkeywordlist:

if directkeyword in metadata["host"]:

ctx.log('[Script] matched keyword %s use direct' % directkeyword)

return "DIRECT"

rules:

- SCRIPT,common_port,DIRECT #shortcuts rule

- DOMAIN-SUFFIX,google.com,Proxy #匹配域名后缀(交由Proxy代理服务器组)

- DOMAIN-KEYWORD,google,Proxy #匹配域名关键字(交由Proxy代理服务器组)

- DOMAIN,google.com,Proxy #匹配域名(交由Proxy代理服务器组)

- DOMAIN-SUFFIX,ad.com,REJECT #匹配域名后缀(拒绝)

- IP-CIDR,127.0.0.0/8,DIRECT #匹配数据目标IP(直连)

- SRC-IP-CIDR,192.168.1.201/32,DIRECT #匹配数据发起IP(直连)

- DST-PORT,16800,DIRECT #匹配数据目标端口(直连)

- SRC-PORT,16800,DIRECT #匹配数据源端口(直连)

===================== 配置文件 =====================

mixed-port: 7893 socks-port: 7891 allow-lan: true bind-address: "*" ipv6: true log-level: silent external-controller: 0.0.0.0:9090 experimental: ignore-resolve-fail: true cfw-latency-timeout: 3000 cfw-latency-url: http://www.gstatic.com/generate_204 cfw-conn-break-strategy: proxy: none profile: true mode: false cfw-proxies-order: default cfw-bypass-bak:

redir-port: 7892 tproxy-port: 7895 port: 7890 mode: rule external-ui: "/usr/share/openclash/ui" interface-name: br-lan tcp-concurrent: true dns: enable: true ipv6: true enhanced-mode: fake-ip fake-ip-range: 198.18.0.1/16 listen: 0.0.0.0:7874 nameserver:

===================== 自定义覆写设置 =====================

!/bin/sh

. /usr/share/openclash/ruby.sh . /usr/share/openclash/log.sh . /lib/functions.sh

This script is called by /etc/init.d/openclash

Add your custom overwrite scripts here, they will be take effict after the OpenClash own srcipts

LOG_OUT "Tip: Start Running Custom Overwrite Scripts..." LOGTIME=$(echo $(date "+%Y-%m-%d %H:%M:%S")) LOG_FILE="/tmp/openclash.log" CONFIG_FILE="$1" #config path

Simple Demo:

#General Demo
#1--config path
#2--key name
#3--value
#ruby_edit "$CONFIG_FILE" "['redir-port']" "7892"
#ruby_edit "$CONFIG_FILE" "['secret']" "123456"
#ruby_edit "$CONFIG_FILE" "['dns']['enable']" "true"

#Hash Demo
#1--config path
#2--key name
#3--hash type value
#ruby_edit "$CONFIG_FILE" "['experimental']" "{'sniff-tls-sni'=>true}"
#ruby_edit "$CONFIG_FILE" "['sniffer']" "{'sniffing'=>['tls','http']}"

#Array Demo:
#1--config path
#2--key name
#3--position(start from 0, end with -1)
#4--value
#ruby_arr_insert "$CONFIG_FILE" "['dns']['nameserver']" "0" "114.114.114.114"

#Array Add From Yaml File Demo:
#1--config path
#2--key name
#3--position(start from 0, end with -1)
#4--value file path
#5--value key name in #4 file
#ruby_arr_add_file "$CONFIG_FILE" "['dns']['fallback-filter']['ipcidr']" "0" "/etc/openclash/custom/openclash_custom_fallback_filter.yaml" "['fallback-filter']['ipcidr']"

Ruby Script Demo:

#ruby -ryaml -rYAML -I "/usr/share/openclash" -E UTF-8 -e "
#   begin
#      Value = YAML.load_file('$CONFIG_FILE');
#   rescue Exception => e
#      puts '${LOGTIME} Error: Load File Failed,【' + e.message + '】';
#   end;

    #General
#   begin
#   Thread.new{
#      Value['redir-port']=7892;
#      Value['tproxy-port']=7895;
#      Value['port']=7890;
#      Value['socks-port']=7891;
#      Value['mixed-port']=7893;
#   }.join;

#   rescue Exception => e
#      puts '${LOGTIME} Error: Set General Failed,【' + e.message + '】';
#   ensure
#      File.open('$CONFIG_FILE','w') {|f| YAML.dump(Value, f)};
#   end" 2>/dev/null >> $LOG_FILE

exit 0

===================== 自定义防火墙设置 =====================

!/bin/sh

. /usr/share/openclash/log.sh . /lib/functions.sh

This script is called by /etc/init.d/openclash

Add your custom firewall rules here, they will be added after the end of the OpenClash iptables rules

LOG_OUT "Tip: Start Add Custom Firewall Rules..."

exit 0

===================== IPTABLES 防火墙设置 =====================

IPv4 NAT chain

Generated by iptables-save v1.8.7 on Thu Mar 23 10:50:24 2023

*nat :PREROUTING ACCEPT [869:80008] :INPUT ACCEPT [3780:245170] :OUTPUT ACCEPT [10362:690460] :POSTROUTING ACCEPT [10367:690856] :CLOUD_MUSIC - [0:0] :DOCKER - [0:0] :MINIUPNPD - [0:0] :MINIUPNPD-POSTROUTING - [0:0] :openclash - [0:0] :openclash_output - [0:0] :postrouting_VPN_rule - [0:0] :postrouting_docker_rule - [0:0] :postrouting_lan_rule - [0:0] :postrouting_rule - [0:0] :postrouting_vpn_rule - [0:0] :postrouting_wan_rule - [0:0] :prerouting_VPN_rule - [0:0] :prerouting_docker_rule - [0:0] :prerouting_lan_rule - [0:0] :prerouting_rule - [0:0] :prerouting_vpn_rule - [0:0] :prerouting_wan_rule - [0:0] :zone_VPN_postrouting - [0:0] :zone_VPN_prerouting - [0:0] :zone_docker_postrouting - [0:0] :zone_docker_prerouting - [0:0] :zone_lan_postrouting - [0:0] :zone_lan_prerouting - [0:0] :zone_vpn_postrouting - [0:0] :zone_vpn_prerouting - [0:0] :zone_wan_postrouting - [0:0] :zone_wan_prerouting - [0:0] -A PREROUTING -d 8.8.4.4/32 -p tcp -m comment --comment "OpenClash Google DNS Hijack" -m tcp --dport 53 -j REDIRECT --to-ports 7892 -A PREROUTING -d 8.8.8.8/32 -p tcp -m comment --comment "OpenClash Google DNS Hijack" -m tcp --dport 53 -j REDIRECT --to-ports 7892 -A PREROUTING -p tcp -m tcp --dport 53 -m comment --comment "OpenClash DNS Hijack" -j REDIRECT --to-ports 53 -A PREROUTING -p udp -m udp --dport 53 -m comment --comment "OpenClash DNS Hijack" -j REDIRECT --to-ports 53 -A PREROUTING -p tcp -m set --match-set music dst -j CLOUD_MUSIC -A PREROUTING -p udp -m udp --dport 53 -j REDIRECT --to-ports 53 -A PREROUTING -p tcp -m tcp --dport 53 -j REDIRECT --to-ports 53 -A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER -A PREROUTING -m comment --comment "!fw3: Custom prerouting rule chain" -j prerouting_rule -A PREROUTING -i br-lan -m comment --comment "!fw3" -j zone_lan_prerouting -A PREROUTING -i ipsec0 -m comment --comment "!fw3" -j zone_VPN_prerouting -A PREROUTING -i tun0 -m comment --comment "!fw3" -j zone_vpn_prerouting -A PREROUTING -i docker0 -m comment --comment "!fw3" -j zone_docker_prerouting -A PREROUTING -p tcp -j openclash -A OUTPUT ! -d 127.0.0.0/8 -m addrtype --dst-type LOCAL -j DOCKER -A OUTPUT -j openclash_output -A POSTROUTING -s 172.17.0.0/16 ! -o docker0 -j MASQUERADE -A POSTROUTING -m comment --comment "!fw3: Custom postrouting rule chain" -j postrouting_rule -A POSTROUTING -o br-lan -m comment --comment "!fw3" -j zone_lan_postrouting -A POSTROUTING -o ipsec0 -m comment --comment "!fw3" -j zone_VPN_postrouting -A POSTROUTING -o tun0 -m comment --comment "!fw3" -j zone_vpn_postrouting -A POSTROUTING -o docker0 -m comment --comment "!fw3" -j zone_docker_postrouting -A CLOUD_MUSIC -d 0.0.0.0/8 -j RETURN -A CLOUD_MUSIC -d 10.0.0.0/8 -j RETURN -A CLOUD_MUSIC -d 127.0.0.0/8 -j RETURN -A CLOUD_MUSIC -d 169.254.0.0/16 -j RETURN -A CLOUD_MUSIC -d 172.16.0.0/12 -j RETURN -A CLOUD_MUSIC -d 192.168.0.0/16 -j RETURN -A CLOUD_MUSIC -d 224.0.0.0/4 -j RETURN -A CLOUD_MUSIC -d 240.0.0.0/4 -j RETURN -A CLOUD_MUSIC -p tcp -m set ! --match-set music_http src -m tcp --dport 80 -j REDIRECT --to-ports 5200 -A CLOUD_MUSIC -p tcp -m set ! --match-set music_https src -m tcp --dport 443 -j REDIRECT --to-ports 5201 -A DOCKER -i docker0 -j RETURN -A openclash -p tcp -m tcp --sport 5244 -j RETURN -A openclash -p tcp -m tcp --sport 1688 -j RETURN -A openclash -p tcp -m tcp --sport 1194 -j RETURN -A openclash -m set --match-set localnetwork dst -j RETURN -A openclash -d 198.18.0.0/16 -p tcp -j REDIRECT --to-ports 7892 -A openclash -p tcp -j REDIRECT --to-ports 7892 -A openclash_output -p tcp -m tcp --sport 5244 -j RETURN -A openclash_output -p tcp -m tcp --sport 1688 -j RETURN -A openclash_output -p tcp -m tcp --sport 1194 -j RETURN -A openclash_output -s 10.10.10.252/32 -p tcp -m tcp --sport 16800 -j RETURN -A openclash_output -s 10.10.10.252/32 -p tcp -m tcp --sport 5244 -j RETURN -A openclash_output -d 198.18.0.0/16 -p tcp -m owner ! --uid-owner 65534 -j REDIRECT --to-ports 7892 -A openclash_output -m set --match-set localnetwork dst -j RETURN -A openclash_output -p tcp -m owner ! --uid-owner 65534 -j REDIRECT --to-ports 7892 -A zone_VPN_postrouting -m comment --comment "!fw3: Custom VPN postrouting rule chain" -j postrouting_VPN_rule -A zone_VPN_prerouting -m comment --comment "!fw3: Custom VPN prerouting rule chain" -j prerouting_VPN_rule -A zone_docker_postrouting -m comment --comment "!fw3: Custom docker postrouting rule chain" -j postrouting_docker_rule -A zone_docker_prerouting -m comment --comment "!fw3: Custom docker prerouting rule chain" -j prerouting_docker_rule -A zone_lan_postrouting -j MINIUPNPD-POSTROUTING -A zone_lan_postrouting -j MINIUPNPD-POSTROUTING -A zone_lan_postrouting -m comment --comment "!fw3: Custom lan postrouting rule chain" -j postrouting_lan_rule -A zone_lan_prerouting -j MINIUPNPD -A zone_lan_prerouting -j MINIUPNPD -A zone_lan_prerouting -m comment --comment "!fw3: Custom lan prerouting rule chain" -j prerouting_lan_rule -A zone_vpn_postrouting -m comment --comment "!fw3: Custom vpn postrouting rule chain" -j postrouting_vpn_rule -A zone_vpn_postrouting -m comment --comment "!fw3" -j FULLCONENAT -A zone_vpn_prerouting -m comment --comment "!fw3: Custom vpn prerouting rule chain" -j prerouting_vpn_rule -A zone_vpn_prerouting -m comment --comment "!fw3" -j FULLCONENAT -A zone_wan_postrouting -m comment --comment "!fw3: Custom wan postrouting rule chain" -j postrouting_wan_rule -A zone_wan_postrouting -m comment --comment "!fw3" -j FULLCONENAT -A zone_wan_prerouting -m comment --comment "!fw3: Custom wan prerouting rule chain" -j prerouting_wan_rule -A zone_wan_prerouting -p tcp -m tcp --dport 5244 -m comment --comment "!fw3: alist" -j DNAT --to-destination 10.10.10.252:5244 -A zone_wan_prerouting -p udp -m udp --dport 5244 -m comment --comment "!fw3: alist" -j DNAT --to-destination 10.10.10.252:5244 -A zone_wan_prerouting -p tcp -m tcp --dport 16800 -m comment --comment "!fw3: aria2" -j DNAT --to-destination 10.10.10.252:16800 -A zone_wan_prerouting -p udp -m udp --dport 16800 -m comment --comment "!fw3: aria2" -j DNAT --to-destination 10.10.10.252:16800 -A zone_wan_prerouting -m comment --comment "!fw3" -j FULLCONENAT COMMIT

Completed on Thu Mar 23 10:50:24 2023

IPv4 Mangle chain

Generated by iptables-save v1.8.7 on Thu Mar 23 10:50:24 2023

*mangle :PREROUTING ACCEPT [179948:222076961] :INPUT ACCEPT [178492:221464331] :FORWARD ACCEPT [639:30746] :OUTPUT ACCEPT [155486:98243653] :POSTROUTING ACCEPT [156138:98276477] :openclash - [0:0] :openclash_upnp - [0:0] :qos_Default - [0:0] :qos_Default_ct - [0:0] -A PREROUTING -p udp -j openclash -A openclash -p udp -m udp --sport 1194 -j RETURN -A openclash -p udp -m udp --sport 4500 -j RETURN -A openclash -p udp -m udp --sport 500 -j RETURN -A openclash -p udp -m udp --sport 500 -j RETURN -A openclash -p udp -m udp --sport 68 -j RETURN -A openclash -s 10.10.10.252/32 -p udp -m udp --sport 16800 -j RETURN -A openclash -s 10.10.10.252/32 -p udp -m udp --sport 5244 -j RETURN -A openclash -m set --match-set localnetwork dst -j RETURN -A openclash -p udp -m udp --dport 53 -j RETURN -A openclash -d 198.18.0.0/16 -p udp -j TPROXY --on-port 7895 --on-ip 0.0.0.0 --tproxy-mark 0x162/0xffffffff -A openclash -p udp -j openclash_upnp -A openclash -p udp -j TPROXY --on-port 7895 --on-ip 0.0.0.0 --tproxy-mark 0x162/0xffffffff -A qos_Default -j CONNMARK --restore-mark --nfmask 0xf --ctmask 0xf -A qos_Default -m mark --mark 0x0/0xf -j qos_Default_ct -A qos_Default -p udp -m mark --mark 0x0/0xf0 -m length --length 0:500 -j MARK --set-xmark 0x22/0xff -A qos_Default -p icmp -j MARK --set-xmark 0x11/0xff -A qos_Default -p tcp -m mark --mark 0x0/0xf0 -m tcp --sport 1024:65535 --dport 1024:65535 -j MARK --set-xmark 0x44/0xff -A qos_Default -p udp -m mark --mark 0x0/0xf0 -m udp --sport 1024:65535 --dport 1024:65535 -j MARK --set-xmark 0x44/0xff -A qos_Default -j CONNMARK --save-mark --nfmask 0xff --ctmask 0xff -A qos_Default_ct -p tcp -m mark --mark 0x0/0xf -m tcp -m multiport --ports 22,53 -m comment --comment "ssh, dns" -j MARK --set-xmark 0x11/0xff -A qos_Default_ct -p udp -m mark --mark 0x0/0xf -m udp -m multiport --ports 22,53 -m comment --comment "ssh, dns" -j MARK --set-xmark 0x11/0xff -A qos_Default_ct -p tcp -m mark --mark 0x0/0xf -m tcp -m multiport --ports 20,21,25,80,110,443,993,995 -m comment --comment "ftp, smtp, http(s), imap" -j MARK --set-xmark 0x33/0xff -A qos_Default_ct -p tcp -m mark --mark 0x0/0xf -m tcp -m multiport --ports 5190 -m comment --comment "AOL, iChat, ICQ" -j MARK --set-xmark 0x22/0xff -A qos_Default_ct -p udp -m mark --mark 0x0/0xf -m udp -m multiport --ports 5190 -m comment --comment "AOL, iChat, ICQ" -j MARK --set-xmark 0x22/0xff -A qos_Default_ct -j CONNMARK --save-mark --nfmask 0xff --ctmask 0xff COMMIT

Completed on Thu Mar 23 10:50:24 2023

IPv4 Filter chain

Generated by iptables-save v1.8.7 on Thu Mar 23 10:50:24 2023

*filter :INPUT ACCEPT [9:360] :FORWARD DROP [0:0] :OUTPUT ACCEPT [0:0] :DOCKER - [0:0] :DOCKER-ISOLATION-STAGE-1 - [0:0] :DOCKER-ISOLATION-STAGE-2 - [0:0] :DOCKER-MAN - [0:0] :DOCKER-USER - [0:0] :MINIUPNPD - [0:0] :SOCAT - [0:0] :forwarding_VPN_rule - [0:0] :forwarding_docker_rule - [0:0] :forwarding_lan_rule - [0:0] :forwarding_rule - [0:0] :forwarding_vpn_rule - [0:0] :forwarding_wan_rule - [0:0] :input_VPN_rule - [0:0] :input_docker_rule - [0:0] :input_lan_rule - [0:0] :input_rule - [0:0] :input_vpn_rule - [0:0] :input_wan_rule - [0:0] :output_VPN_rule - [0:0] :output_docker_rule - [0:0] :output_lan_rule - [0:0] :output_rule - [0:0] :output_vpn_rule - [0:0] :output_wan_rule - [0:0] :reject - [0:0] :syn_flood - [0:0] :zone_VPN_dest_ACCEPT - [0:0] :zone_VPN_forward - [0:0] :zone_VPN_input - [0:0] :zone_VPN_output - [0:0] :zone_VPN_src_ACCEPT - [0:0] :zone_docker_dest_ACCEPT - [0:0] :zone_docker_forward - [0:0] :zone_docker_input - [0:0] :zone_docker_output - [0:0] :zone_docker_src_ACCEPT - [0:0] :zone_lan_dest_ACCEPT - [0:0] :zone_lan_forward - [0:0] :zone_lan_input - [0:0] :zone_lan_output - [0:0] :zone_lan_src_ACCEPT - [0:0] :zone_vpn_dest_ACCEPT - [0:0] :zone_vpn_forward - [0:0] :zone_vpn_input - [0:0] :zone_vpn_output - [0:0] :zone_vpn_src_ACCEPT - [0:0] :zone_wan_dest_ACCEPT - [0:0] :zone_wan_dest_REJECT - [0:0] :zone_wan_forward - [0:0] :zone_wan_input - [0:0] :zone_wan_output - [0:0] :zone_wan_src_REJECT - [0:0] -A INPUT -p udp -m udp --dport 443 -m comment --comment "OpenClash QUIC REJECT" -m set ! --match-set china_ip_route dst -j REJECT --reject-with icmp-port-unreachable -A INPUT -m policy --dir in --pol ipsec --proto esp -j ACCEPT -A INPUT -j SOCAT -A INPUT -i lo -m comment --comment "!fw3" -j ACCEPT -A INPUT -m comment --comment "!fw3: Custom input rule chain" -j input_rule -A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment "!fw3" -j ACCEPT -A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -m comment --comment "!fw3" -j syn_flood -A INPUT -i br-lan -m comment --comment "!fw3" -j zone_lan_input -A INPUT -i ipsec0 -m comment --comment "!fw3" -j zone_VPN_input -A INPUT -i tun0 -m comment --comment "!fw3" -j zone_vpn_input -A INPUT -i docker0 -m comment --comment "!fw3" -j zone_docker_input -A FORWARD -m policy --dir out --pol ipsec --proto esp -j ACCEPT -A FORWARD -m policy --dir in --pol ipsec --proto esp -j ACCEPT -A FORWARD -j DOCKER-USER -A FORWARD -j DOCKER-ISOLATION-STAGE-1 -A FORWARD -o docker0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT -A FORWARD -o docker0 -j DOCKER -A FORWARD -i docker0 ! -o docker0 -j ACCEPT -A FORWARD -i docker0 -o docker0 -j ACCEPT -A FORWARD -m comment --comment "!fw3: Custom forwarding rule chain" -j forwarding_rule -A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment "!fw3" -j ACCEPT -A FORWARD -i br-lan -m comment --comment "!fw3" -j zone_lan_forward -A FORWARD -i ipsec0 -m comment --comment "!fw3" -j zone_VPN_forward -A FORWARD -i tun0 -m comment --comment "!fw3" -j zone_vpn_forward -A FORWARD -i docker0 -m comment --comment "!fw3" -j zone_docker_forward -A FORWARD -m comment --comment "!fw3" -j reject -A OUTPUT -d 223.252.199.10/32 -j DROP -A OUTPUT -m policy --dir out --pol ipsec --proto esp -j ACCEPT -A OUTPUT -o lo -m comment --comment "!fw3" -j ACCEPT -A OUTPUT -m comment --comment "!fw3: Custom output rule chain" -j output_rule -A OUTPUT -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment "!fw3" -j ACCEPT -A OUTPUT -o br-lan -m comment --comment "!fw3" -j zone_lan_output -A OUTPUT -o ipsec0 -m comment --comment "!fw3" -j zone_VPN_output -A OUTPUT -o tun0 -m comment --comment "!fw3" -j zone_vpn_output -A OUTPUT -o docker0 -m comment --comment "!fw3" -j zone_docker_output -A DOCKER-ISOLATION-STAGE-1 -i docker0 ! -o docker0 -j DOCKER-ISOLATION-STAGE-2 -A DOCKER-ISOLATION-STAGE-1 -j RETURN -A DOCKER-ISOLATION-STAGE-2 -o docker0 -j DROP -A DOCKER-ISOLATION-STAGE-2 -j RETURN -A DOCKER-MAN -i br-lan -o docker0 -j RETURN -A DOCKER-MAN -o docker0 -m conntrack --ctstate RELATED,ESTABLISHED -j RETURN -A DOCKER-MAN -o docker0 -m conntrack --ctstate INVALID,NEW -j DROP -A DOCKER-MAN -j RETURN -A DOCKER-USER -j DOCKER-MAN -A DOCKER-USER -j RETURN -A SOCAT -p tcp -m tcp --dport 2200 -m comment --comment "备注" -j ACCEPT -A reject -p tcp -m comment --comment "!fw3" -j REJECT --reject-with tcp-reset -A reject -m comment --comment "!fw3" -j REJECT --reject-with icmp-port-unreachable -A syn_flood -m limit --limit 25/sec --limit-burst 50 -m comment --comment "!fw3" -j RETURN -A syn_flood -m comment --comment "!fw3" -j DROP -A zone_VPN_dest_ACCEPT -o ipsec0 -m comment --comment "!fw3" -j ACCEPT -A zone_VPN_forward -m comment --comment "!fw3: Custom VPN forwarding rule chain" -j forwarding_VPN_rule -A zone_VPN_forward -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port forwards" -j ACCEPT -A zone_VPN_forward -m comment --comment "!fw3" -j zone_VPN_dest_ACCEPT -A zone_VPN_input -m comment --comment "!fw3: Custom VPN input rule chain" -j input_VPN_rule -A zone_VPN_input -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port redirections" -j ACCEPT -A zone_VPN_input -m comment --comment "!fw3" -j zone_VPN_src_ACCEPT -A zone_VPN_output -m comment --comment "!fw3: Custom VPN output rule chain" -j output_VPN_rule -A zone_VPN_output -m comment --comment "!fw3" -j zone_VPN_dest_ACCEPT -A zone_VPN_src_ACCEPT -i ipsec0 -m conntrack --ctstate NEW,UNTRACKED -m comment --comment "!fw3" -j ACCEPT -A zone_docker_dest_ACCEPT -o docker0 -m comment --comment "!fw3" -j ACCEPT -A zone_docker_forward -m comment --comment "!fw3: Custom docker forwarding rule chain" -j forwarding_docker_rule -A zone_docker_forward -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port forwards" -j ACCEPT -A zone_docker_forward -m comment --comment "!fw3" -j zone_docker_dest_ACCEPT -A zone_docker_input -m comment --comment "!fw3: Custom docker input rule chain" -j input_docker_rule -A zone_docker_input -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port redirections" -j ACCEPT -A zone_docker_input -m comment --comment "!fw3" -j zone_docker_src_ACCEPT -A zone_docker_output -m comment --comment "!fw3: Custom docker output rule chain" -j output_docker_rule -A zone_docker_output -m comment --comment "!fw3" -j zone_docker_dest_ACCEPT -A zone_docker_src_ACCEPT -i docker0 -m conntrack --ctstate NEW,UNTRACKED -m comment --comment "!fw3" -j ACCEPT -A zone_lan_dest_ACCEPT -o br-lan -m comment --comment "!fw3" -j ACCEPT -A zone_lan_forward -j MINIUPNPD -A zone_lan_forward -j MINIUPNPD -A zone_lan_forward -m comment --comment "!fw3: Custom lan forwarding rule chain" -j forwarding_lan_rule -A zone_lan_forward -m comment --comment "!fw3: Zone lan to wan forwarding policy" -j zone_wan_dest_ACCEPT -A zone_lan_forward -m comment --comment "!fw3: Zone lan to vpn forwarding policy" -j zone_vpn_dest_ACCEPT -A zone_lan_forward -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port forwards" -j ACCEPT -A zone_lan_forward -m comment --comment "!fw3" -j zone_lan_dest_ACCEPT -A zone_lan_input -m comment --comment "!fw3: Custom lan input rule chain" -j input_lan_rule -A zone_lan_input -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port redirections" -j ACCEPT -A zone_lan_input -m comment --comment "!fw3" -j zone_lan_src_ACCEPT -A zone_lan_output -m comment --comment "!fw3: Custom lan output rule chain" -j output_lan_rule -A zone_lan_output -m comment --comment "!fw3" -j zone_lan_dest_ACCEPT -A zone_lan_src_ACCEPT -i br-lan -m conntrack --ctstate NEW,UNTRACKED -m comment --comment "!fw3" -j ACCEPT -A zone_vpn_dest_ACCEPT -o tun0 -m conntrack --ctstate INVALID -m comment --comment "!fw3: Prevent NAT leakage" -j DROP -A zone_vpn_dest_ACCEPT -o tun0 -m comment --comment "!fw3" -j ACCEPT -A zone_vpn_forward -m comment --comment "!fw3: Custom vpn forwarding rule chain" -j forwarding_vpn_rule -A zone_vpn_forward -m comment --comment "!fw3: Zone vpn to wan forwarding policy" -j zone_wan_dest_ACCEPT -A zone_vpn_forward -m comment --comment "!fw3: Zone vpn to lan forwarding policy" -j zone_lan_dest_ACCEPT -A zone_vpn_forward -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port forwards" -j ACCEPT -A zone_vpn_forward -m comment --comment "!fw3" -j zone_vpn_dest_ACCEPT -A zone_vpn_input -m comment --comment "!fw3: Custom vpn input rule chain" -j input_vpn_rule -A zone_vpn_input -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port redirections" -j ACCEPT -A zone_vpn_input -m comment --comment "!fw3" -j zone_vpn_src_ACCEPT -A zone_vpn_output -m comment --comment "!fw3: Custom vpn output rule chain" -j output_vpn_rule -A zone_vpn_output -m comment --comment "!fw3" -j zone_vpn_dest_ACCEPT -A zone_vpn_src_ACCEPT -i tun0 -m conntrack --ctstate NEW,UNTRACKED -m comment --comment "!fw3" -j ACCEPT -A zone_wan_forward -m comment --comment "!fw3: Custom wan forwarding rule chain" -j forwarding_wan_rule -A zone_wan_forward -p esp -m comment --comment "!fw3: Allow-IPSec-ESP" -j zone_lan_dest_ACCEPT -A zone_wan_forward -p udp -m udp --dport 500 -m comment --comment "!fw3: Allow-ISAKMP" -j zone_lan_dest_ACCEPT -A zone_wan_forward -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port forwards" -j ACCEPT -A zone_wan_forward -m comment --comment "!fw3" -j zone_wan_dest_REJECT -A zone_wan_input -m comment --comment "!fw3: Custom wan input rule chain" -j input_wan_rule -A zone_wan_input -p udp -m udp --dport 68 -m comment --comment "!fw3: Allow-DHCP-Renew" -j ACCEPT -A zone_wan_input -p icmp -m icmp --icmp-type 8 -m comment --comment "!fw3: Allow-Ping" -j ACCEPT -A zone_wan_input -p igmp -m comment --comment "!fw3: Allow-IGMP" -j ACCEPT -A zone_wan_input -p tcp -m tcp --dport 8118 -m comment --comment "!fw3: adblock" -j DROP -A zone_wan_input -p udp -m udp --dport 500 -m comment --comment "!fw3: ike" -j ACCEPT -A zone_wan_input -p udp -m udp --dport 4500 -m comment --comment "!fw3: ipsec" -j ACCEPT -A zone_wan_input -p ah -m comment --comment "!fw3: ah" -j ACCEPT -A zone_wan_input -p esp -m comment --comment "!fw3: esp" -j ACCEPT -A zone_wan_input -p tcp -m tcp --dport 1194 -m comment --comment "!fw3: openvpn" -j ACCEPT -A zone_wan_input -p udp -m udp --dport 1194 -m comment --comment "!fw3: openvpn" -j ACCEPT -A zone_wan_input -p tcp -m tcp --dport 1688 -m comment --comment "!fw3: kms" -j ACCEPT -A zone_wan_input -p tcp -m tcp --dport 5244 -m comment --comment "!fw3: alist" -j ACCEPT -A zone_wan_input -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port redirections" -j ACCEPT -A zone_wan_input -m comment --comment "!fw3" -j zone_wan_src_REJECT -A zone_wan_output -m comment --comment "!fw3: Custom wan output rule chain" -j output_wan_rule -A zone_wan_output -m comment --comment "!fw3" -j zone_wan_dest_ACCEPT COMMIT

Completed on Thu Mar 23 10:50:24 2023

IPv6 NAT chain

Generated by ip6tables-save v1.8.7 on Thu Mar 23 10:50:24 2023

*nat :PREROUTING ACCEPT [128040:87343966] :INPUT ACCEPT [4100:476718] :OUTPUT ACCEPT [125672:10870777] :POSTROUTING ACCEPT [125672:10870777] -A PREROUTING -p udp -m udp --dport 53 -j REDIRECT --to-ports 53 -A PREROUTING -p tcp -m tcp --dport 53 -j REDIRECT --to-ports 53 COMMIT

Completed on Thu Mar 23 10:50:24 2023

IPv6 Mangle chain

Generated by ip6tables-save v1.8.7 on Thu Mar 23 10:50:24 2023

*mangle :PREROUTING ACCEPT [2638515:3920180878] :INPUT ACCEPT [2583637:3894155280] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [1672558:663289064] :POSTROUTING ACCEPT [1672558:663289064] :qos_Default - [0:0] :qos_Default_ct - [0:0] -A qos_Default -j CONNMARK --restore-mark --nfmask 0xf --ctmask 0xf -A qos_Default -m mark --mark 0x0/0xf -j qos_Default_ct -A qos_Default -p udp -m mark --mark 0x0/0xf0 -m length --length 0:500 -j MARK --set-xmark 0x22/0xff -A qos_Default -p icmp -j MARK --set-xmark 0x11/0xff -A qos_Default -p tcp -m mark --mark 0x0/0xf0 -m tcp --sport 1024:65535 --dport 1024:65535 -j MARK --set-xmark 0x44/0xff -A qos_Default -p udp -m mark --mark 0x0/0xf0 -m udp --sport 1024:65535 --dport 1024:65535 -j MARK --set-xmark 0x44/0xff -A qos_Default -j CONNMARK --save-mark --nfmask 0xff --ctmask 0xff -A qos_Default_ct -p tcp -m mark --mark 0x0/0xf -m tcp -m multiport --ports 22,53 -m comment --comment "ssh, dns" -j MARK --set-xmark 0x11/0xff -A qos_Default_ct -p udp -m mark --mark 0x0/0xf -m udp -m multiport --ports 22,53 -m comment --comment "ssh, dns" -j MARK --set-xmark 0x11/0xff -A qos_Default_ct -p tcp -m mark --mark 0x0/0xf -m tcp -m multiport --ports 20,21,25,80,110,443,993,995 -m comment --comment "ftp, smtp, http(s), imap" -j MARK --set-xmark 0x33/0xff -A qos_Default_ct -p tcp -m mark --mark 0x0/0xf -m tcp -m multiport --ports 5190 -m comment --comment "AOL, iChat, ICQ" -j MARK --set-xmark 0x22/0xff -A qos_Default_ct -p udp -m mark --mark 0x0/0xf -m udp -m multiport --ports 5190 -m comment --comment "AOL, iChat, ICQ" -j MARK --set-xmark 0x22/0xff -A qos_Default_ct -j CONNMARK --save-mark --nfmask 0xff --ctmask 0xff COMMIT

Completed on Thu Mar 23 10:50:24 2023

IPv6 Filter chain

Generated by ip6tables-save v1.8.7 on Thu Mar 23 10:50:24 2023

*filter :INPUT ACCEPT [2487:286064] :FORWARD DROP [0:0] :OUTPUT ACCEPT [49:4536] :MINIUPNPD - [0:0] :SOCAT - [0:0] :forwarding_VPN_rule - [0:0] :forwarding_docker_rule - [0:0] :forwarding_lan_rule - [0:0] :forwarding_rule - [0:0] :forwarding_vpn_rule - [0:0] :forwarding_wan_rule - [0:0] :input_VPN_rule - [0:0] :input_docker_rule - [0:0] :input_lan_rule - [0:0] :input_rule - [0:0] :input_vpn_rule - [0:0] :input_wan_rule - [0:0] :output_VPN_rule - [0:0] :output_docker_rule - [0:0] :output_lan_rule - [0:0] :output_rule - [0:0] :output_vpn_rule - [0:0] :output_wan_rule - [0:0] :reject - [0:0] :syn_flood - [0:0] :zone_VPN_dest_ACCEPT - [0:0] :zone_VPN_forward - [0:0] :zone_VPN_input - [0:0] :zone_VPN_output - [0:0] :zone_VPN_src_ACCEPT - [0:0] :zone_docker_dest_ACCEPT - [0:0] :zone_docker_forward - [0:0] :zone_docker_input - [0:0] :zone_docker_output - [0:0] :zone_docker_src_ACCEPT - [0:0] :zone_lan_dest_ACCEPT - [0:0] :zone_lan_forward - [0:0] :zone_lan_input - [0:0] :zone_lan_output - [0:0] :zone_lan_src_ACCEPT - [0:0] :zone_vpn_dest_ACCEPT - [0:0] :zone_vpn_forward - [0:0] :zone_vpn_input - [0:0] :zone_vpn_output - [0:0] :zone_vpn_src_ACCEPT - [0:0] :zone_wan_dest_ACCEPT - [0:0] :zone_wan_dest_REJECT - [0:0] :zone_wan_forward - [0:0] :zone_wan_input - [0:0] :zone_wan_output - [0:0] :zone_wan_src_REJECT - [0:0] -A INPUT -j SOCAT -A INPUT -i lo -m comment --comment "!fw3" -j ACCEPT -A INPUT -m comment --comment "!fw3: Custom input rule chain" -j input_rule -A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment "!fw3" -j ACCEPT -A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -m comment --comment "!fw3" -j syn_flood -A INPUT -i br-lan -m comment --comment "!fw3" -j zone_lan_input -A INPUT -i ipsec0 -m comment --comment "!fw3" -j zone_VPN_input -A INPUT -i tun0 -m comment --comment "!fw3" -j zone_vpn_input -A INPUT -i docker0 -m comment --comment "!fw3" -j zone_docker_input -A FORWARD -m comment --comment "!fw3: Custom forwarding rule chain" -j forwarding_rule -A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment "!fw3" -j ACCEPT -A FORWARD -i br-lan -m comment --comment "!fw3" -j zone_lan_forward -A FORWARD -i ipsec0 -m comment --comment "!fw3" -j zone_VPN_forward -A FORWARD -i tun0 -m comment --comment "!fw3" -j zone_vpn_forward -A FORWARD -i docker0 -m comment --comment "!fw3" -j zone_docker_forward -A FORWARD -m comment --comment "!fw3" -j reject -A OUTPUT -o lo -m comment --comment "!fw3" -j ACCEPT -A OUTPUT -m comment --comment "!fw3: Custom output rule chain" -j output_rule -A OUTPUT -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment "!fw3" -j ACCEPT -A OUTPUT -o br-lan -m comment --comment "!fw3" -j zone_lan_output -A OUTPUT -o ipsec0 -m comment --comment "!fw3" -j zone_VPN_output -A OUTPUT -o tun0 -m comment --comment "!fw3" -j zone_vpn_output -A OUTPUT -o docker0 -m comment --comment "!fw3" -j zone_docker_output -A SOCAT -p tcp -m tcp --dport 2200 -m comment --comment "备注" -j ACCEPT -A reject -p tcp -m comment --comment "!fw3" -j REJECT --reject-with tcp-reset -A reject -m comment --comment "!fw3" -j REJECT --reject-with icmp6-port-unreachable -A syn_flood -m limit --limit 25/sec --limit-burst 50 -m comment --comment "!fw3" -j RETURN -A syn_flood -m comment --comment "!fw3" -j DROP -A zone_VPN_dest_ACCEPT -o ipsec0 -m comment --comment "!fw3" -j ACCEPT -A zone_VPN_forward -m comment --comment "!fw3: Custom VPN forwarding rule chain" -j forwarding_VPN_rule -A zone_VPN_forward -m comment --comment "!fw3" -j zone_VPN_dest_ACCEPT -A zone_VPN_input -m comment --comment "!fw3: Custom VPN input rule chain" -j input_VPN_rule -A zone_VPN_input -m comment --comment "!fw3" -j zone_VPN_src_ACCEPT -A zone_VPN_output -m comment --comment "!fw3: Custom VPN output rule chain" -j output_VPN_rule -A zone_VPN_output -m comment --comment "!fw3" -j zone_VPN_dest_ACCEPT -A zone_VPN_src_ACCEPT -i ipsec0 -m conntrack --ctstate NEW,UNTRACKED -m comment --comment "!fw3" -j ACCEPT -A zone_docker_dest_ACCEPT -o docker0 -m comment --comment "!fw3" -j ACCEPT -A zone_docker_forward -m comment --comment "!fw3: Custom docker forwarding rule chain" -j forwarding_docker_rule -A zone_docker_forward -m comment --comment "!fw3" -j zone_docker_dest_ACCEPT -A zone_docker_input -m comment --comment "!fw3: Custom docker input rule chain" -j input_docker_rule -A zone_docker_input -m comment --comment "!fw3" -j zone_docker_src_ACCEPT -A zone_docker_output -m comment --comment "!fw3: Custom docker output rule chain" -j output_docker_rule -A zone_docker_output -m comment --comment "!fw3" -j zone_docker_dest_ACCEPT -A zone_docker_src_ACCEPT -i docker0 -m conntrack --ctstate NEW,UNTRACKED -m comment --comment "!fw3" -j ACCEPT -A zone_lan_dest_ACCEPT -o br-lan -m comment --comment "!fw3" -j ACCEPT -A zone_lan_forward -j MINIUPNPD -A zone_lan_forward -j MINIUPNPD -A zone_lan_forward -m comment --comment "!fw3: Custom lan forwarding rule chain" -j forwarding_lan_rule -A zone_lan_forward -m comment --comment "!fw3: Zone lan to wan forwarding policy" -j zone_wan_dest_ACCEPT -A zone_lan_forward -m comment --comment "!fw3: Zone lan to vpn forwarding policy" -j zone_vpn_dest_ACCEPT -A zone_lan_forward -m comment --comment "!fw3" -j zone_lan_dest_ACCEPT -A zone_lan_input -m comment --comment "!fw3: Custom lan input rule chain" -j input_lan_rule -A zone_lan_input -m comment --comment "!fw3" -j zone_lan_src_ACCEPT -A zone_lan_output -m comment --comment "!fw3: Custom lan output rule chain" -j output_lan_rule -A zone_lan_output -m comment --comment "!fw3" -j zone_lan_dest_ACCEPT -A zone_lan_src_ACCEPT -i br-lan -m conntrack --ctstate NEW,UNTRACKED -m comment --comment "!fw3" -j ACCEPT -A zone_vpn_dest_ACCEPT -o tun0 -m conntrack --ctstate INVALID -m comment --comment "!fw3: Prevent NAT leakage" -j DROP -A zone_vpn_dest_ACCEPT -o tun0 -m comment --comment "!fw3" -j ACCEPT -A zone_vpn_forward -m comment --comment "!fw3: Custom vpn forwarding rule chain" -j forwarding_vpn_rule -A zone_vpn_forward -m comment --comment "!fw3: Zone vpn to wan forwarding policy" -j zone_wan_dest_ACCEPT -A zone_vpn_forward -m comment --comment "!fw3: Zone vpn to lan forwarding policy" -j zone_lan_dest_ACCEPT -A zone_vpn_forward -m comment --comment "!fw3" -j zone_vpn_dest_ACCEPT -A zone_vpn_input -m comment --comment "!fw3: Custom vpn input rule chain" -j input_vpn_rule -A zone_vpn_input -m comment --comment "!fw3" -j zone_vpn_src_ACCEPT -A zone_vpn_output -m comment --comment "!fw3: Custom vpn output rule chain" -j output_vpn_rule -A zone_vpn_output -m comment --comment "!fw3" -j zone_vpn_dest_ACCEPT -A zone_vpn_src_ACCEPT -i tun0 -m conntrack --ctstate NEW,UNTRACKED -m comment --comment "!fw3" -j ACCEPT -A zone_wan_forward -m comment --comment "!fw3: Custom wan forwarding rule chain" -j forwarding_wan_rule -A zone_wan_forward -p ipv6-icmp -m icmp6 --icmpv6-type 128 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Forward" -j ACCEPT -A zone_wan_forward -p ipv6-icmp -m icmp6 --icmpv6-type 129 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Forward" -j ACCEPT -A zone_wan_forward -p ipv6-icmp -m icmp6 --icmpv6-type 1 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Forward" -j ACCEPT -A zone_wan_forward -p ipv6-icmp -m icmp6 --icmpv6-type 2 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Forward" -j ACCEPT -A zone_wan_forward -p ipv6-icmp -m icmp6 --icmpv6-type 3 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Forward" -j ACCEPT -A zone_wan_forward -p ipv6-icmp -m icmp6 --icmpv6-type 4/0 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Forward" -j ACCEPT -A zone_wan_forward -p ipv6-icmp -m icmp6 --icmpv6-type 4/1 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Forward" -j ACCEPT -A zone_wan_forward -p esp -m comment --comment "!fw3: Allow-IPSec-ESP" -j zone_lan_dest_ACCEPT -A zone_wan_forward -p udp -m udp --dport 500 -m comment --comment "!fw3: Allow-ISAKMP" -j zone_lan_dest_ACCEPT -A zone_wan_forward -m comment --comment "!fw3" -j zone_wan_dest_REJECT -A zone_wan_input -m comment --comment "!fw3: Custom wan input rule chain" -j input_wan_rule -A zone_wan_input -s fc00::/6 -d fc00::/6 -p udp -m udp --dport 546 -m comment --comment "!fw3: Allow-DHCPv6" -j ACCEPT -A zone_wan_input -s fe80::/10 -p ipv6-icmp -m icmp6 --icmpv6-type 130/0 -m comment --comment "!fw3: Allow-MLD" -j ACCEPT -A zone_wan_input -s fe80::/10 -p ipv6-icmp -m icmp6 --icmpv6-type 131/0 -m comment --comment "!fw3: Allow-MLD" -j ACCEPT -A zone_wan_input -s fe80::/10 -p ipv6-icmp -m icmp6 --icmpv6-type 132/0 -m comment --comment "!fw3: Allow-MLD" -j ACCEPT -A zone_wan_input -s fe80::/10 -p ipv6-icmp -m icmp6 --icmpv6-type 143/0 -m comment --comment "!fw3: Allow-MLD" -j ACCEPT -A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 128 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT -A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 129 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT -A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 1 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT -A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 2 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT -A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 3 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT -A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 4/0 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT -A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 4/1 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT -A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 133 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT -A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 135 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT -A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 134 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT -A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 136 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT -A zone_wan_input -p tcp -m tcp --dport 8118 -m comment --comment "!fw3: adblock" -j DROP -A zone_wan_input -p udp -m udp --dport 500 -m comment --comment "!fw3: ike" -j ACCEPT -A zone_wan_input -p udp -m udp --dport 4500 -m comment --comment "!fw3: ipsec" -j ACCEPT -A zone_wan_input -p ah -m comment --comment "!fw3: ah" -j ACCEPT -A zone_wan_input -p esp -m comment --comment "!fw3: esp" -j ACCEPT -A zone_wan_input -p tcp -m tcp --dport 1194 -m comment --comment "!fw3: openvpn" -j ACCEPT -A zone_wan_input -p udp -m udp --dport 1194 -m comment --comment "!fw3: openvpn" -j ACCEPT -A zone_wan_input -p tcp -m tcp --dport 1688 -m comment --comment "!fw3: kms" -j ACCEPT -A zone_wan_input -p tcp -m tcp --dport 5244 -m comment --comment "!fw3: alist" -j ACCEPT -A zone_wan_input -m comment --comment "!fw3" -j zone_wan_src_REJECT -A zone_wan_output -m comment --comment "!fw3: Custom wan output rule chain" -j output_wan_rule -A zone_wan_output -m comment --comment "!fw3" -j zone_wan_dest_ACCEPT COMMIT

Completed on Thu Mar 23 10:50:24 2023

===================== IPSET状态 =====================

Name: cn Name: ct Name: cnc Name: cmcc Name: crtc Name: cernet Name: gwbn Name: othernet Name: music Name: mwan3_connected_v4 Name: mwan3_connected_v6 Name: mwan3_source_v6 Name: mwan3_dynamic_v4 Name: mwan3_dynamic_v6 Name: mwan3_custom_v4 Name: mwan3_custom_v6 Name: music_http Name: music_https Name: china Name: china_ip_route Name: china_ip_route_pass Name: localnetwork Name: mwan3_connected

===================== 路由表状态 =====================

route -n

Kernel IP routing table Destination Gateway Genmask Flags Metric Ref Use Iface 0.0.0.0 10.10.10.253 0.0.0.0 UG 0 0 0 br-lan 10.10.10.0 0.0.0.0 255.255.255.0 U 0 0 0 br-lan 172.17.0.0 0.0.0.0 255.255.0.0 U 0 0 0 docker0

ip route list

default via 10.10.10.253 dev br-lan proto static 10.10.10.0/24 dev br-lan proto kernel scope link src 10.10.10.252 172.17.0.0/16 dev docker0 proto kernel scope link src 172.17.0.1 linkdown

ip rule show

0: from all lookup local 32765: from all fwmark 0x162 lookup 354 32766: from all lookup main 32767: from all lookup default

===================== 端口占用状态 =====================

tcp 0 0 :::7891 ::: LISTEN 21327/clash tcp 0 0 :::7890 ::: LISTEN 21327/clash tcp 0 0 :::7895 ::: LISTEN 21327/clash tcp 0 0 :::7893 ::: LISTEN 21327/clash tcp 0 0 :::7892 ::: LISTEN 21327/clash tcp 0 0 :::9090 ::: LISTEN 21327/clash udp 0 0 :::7874 ::: 21327/clash udp 0 0 :::7891 ::: 21327/clash udp 0 0 :::7892 ::: 21327/clash udp 0 0 :::7893 ::: 21327/clash udp 0 0 :::7895 :::* 21327/clash

===================== 测试本机DNS查询(www.baidu.com) =====================

Server: 127.0.0.1 Address: 127.0.0.1:53

Name: www.baidu.com Address: 198.18.0.43

===================== 测试内核DNS查询(www.instagram.com) =====================

Status: 0 TC: false RD: true RA: true AD: false CD: false

Question: Name: www.instagram.com. Qtype: 1 Qclass: 1

Answer: TTL: 54 data: 108.160.169.55 name: www.instagram.com. type: 1

===================== resolv.conf.d =====================

Interface lan

nameserver 114.114.114.114 nameserver 223.5.5.5

===================== 测试本机网络连接(www.baidu.com) =====================

HTTP/1.1 200 OK Accept-Ranges: bytes Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Connection: keep-alive Content-Length: 277 Content-Type: text/html Date: Thu, 23 Mar 2023 02:50:32 GMT Etag: "575e1f59-115" Last-Modified: Mon, 13 Jun 2016 02:50:01 GMT Pragma: no-cache Server: bfe/1.0.8.18

===================== 测试本机网络下载(raw.githubusercontent.com) =====================

HTTP/1.1 200 OK Connection: keep-alive Content-Length: 83 Cache-Control: max-age=300 Content-Security-Policy: default-src 'none'; style-src 'unsafe-inline'; sandbox Content-Type: text/plain; charset=utf-8 ETag: "275ce7c4d332951875158904a2c8128e7ea40f4ae5057d32acf9f67754ef0e71" Strict-Transport-Security: max-age=31536000 X-Content-Type-Options: nosniff X-Frame-Options: deny X-XSS-Protection: 1; mode=block X-GitHub-Request-Id: 8152:0E7C:ED992C:1345868:640FF9DE Accept-Ranges: bytes Date: Thu, 23 Mar 2023 02:50:33 GMT Via: 1.1 varnish X-Served-By: cache-dxb1470020-DXB X-Cache: HIT X-Cache-Hits: 1 X-Timer: S1679539834.741591,VS0,VE0 Vary: Authorization,Accept-Encoding,Origin Access-Control-Allow-Origin: * X-Fastly-Request-ID: 743791acb1ba66b89bb6f2f5242363ac43975e64 Expires: Thu, 23 Mar 2023 02:55:33 GMT Source-Age: 103

===================== 最近运行日志(自动切换为Debug模式) =====================

time="2023-03-23T10:50:40.585730398+08:00" level=debug msg="[DNS] processor.XXX.com --> XXX.XX.XXX.XXX" time="2023-03-23T10:50:40.620391014+08:00" level=debug msg="[Process] find process processor.XXX.com: socket: protocol not supported" time="2023-03-23T10:50:40.648821243+08:00" level=debug msg="[Process] find process processor.XXX.com: socket: protocol not supported"

===================== 最近运行日志获取完成(自动切换为silent模式) =====================

===================== 活动连接信息 =====================

OpenClash Config

No response

Expected Behavior

xxxxxx

Screenshots

No response

vernesong commented 1 year ago

大概ipv6没进内核就不会显示

rgs66 commented 1 year ago

大概ipv6没进内核就不会显示

那怎么才能让ipv6进内核呢

vernesong commented 1 year ago

开v6代理才行

rgs66 commented 1 year ago

开v6代理才行

我已经开了V6代理了 image

vernesong commented 1 year ago

你看看docker的ip地址，看是不是绕过了 image

rgs66 commented 1 year ago

你看看docker的ip地址，看是不是绕过了 image docker用的是HOST模式，和软路由一个地址，10.10.10.252

github-actions[bot] commented 1 year ago

This issue is stale because it has been open 60 days with no activity. Remove stale label or comment or this will be closed in 5 days