search

vernesong / OpenClash

A Clash Client For OpenWrt
MIT License
17.49k stars 3.18k forks source link

[Bug] 109/110版本导致无法上网 #3191

Closed ghost closed 1 year ago

ghost commented 1 year ago

Verify Steps

OpenClash Version

v0.45-100-beta

Bug on Environment

Lean

Bug on Platform

Linux-amd64(x86-64)

To Reproduce

在r2s和r86s上（都是lean的固件），108版本一切正常，更新clash版本后正常，更新openclash到110版本后无法上网。

Describe the Bug

在路由器上ping 公网ip都是正常的，但无法解析任何域名，路由器和电脑都无法上网。 直接使用dig命令指定dns查询也是无法解析任何域名，关闭openclash后dig命令正常，路由器和电脑都正常上网。

OpenClash Log

OpenClash 调试日志

生成时间: 2023-04-15 20:58:55 插件版本: v0.45.110-beta 隐私提示: 上传此日志前请注意检查、屏蔽公网IP、节点、密码等相关敏感信息


#===================== 系统信息 =====================#

主机型号: BROUNION R86S/R86S - Intel(R) Celeron(R) N5105 @ 2.00GHz : 4C4T
固件版本: OpenWrt SNAPSHOT r5872-e69815120
LuCI版本: git-22.330.64765-00290b6-1
内核版本: 5.15.104
处理器架构: x86_64

#此项有值时,如不使用IPv6,建议到网络-接口-lan的设置中禁用IPV6的DHCP
IPV6-DHCP: 

DNS劫持: Dnsmasq 转发
#DNS劫持为Dnsmasq时，此项结果应仅有配置文件的DNS监听地址
Dnsmasq转发设置: 127.0.0.1#7874

#===================== 依赖检查 =====================#

dnsmasq-full: 已安装
coreutils: 已安装
coreutils-nohup: 已安装
bash: 已安装
curl: 已安装
ca-certificates: 已安装
ipset: 已安装
ip-full: 已安装
libcap: 已安装
libcap-bin: 已安装
ruby: 已安装
ruby-yaml: 已安装
ruby-psych: 已安装
ruby-pstore: 已安装
kmod-tun(TUN模式): 已安装
luci-compat(Luci >= 19.07): 未安装
kmod-inet-diag(PROCESS-NAME): 已安装
unzip: 已安装
iptables-mod-tproxy: 已安装
kmod-ipt-tproxy: 已安装
iptables-mod-extra: 已安装
kmod-ipt-extra: 已安装
kmod-ipt-nat: 已安装

#===================== 内核检查 =====================#

运行状态: 运行中
运行内核：TUN
进程pid: 19015
运行权限: 19015: cap_dac_override,cap_net_bind_service,cap_net_admin,cap_net_raw,cap_sys_ptrace,cap_sys_resource=eip
运行用户: nobody
已选择的架构: linux-amd64

#下方无法显示内核版本号时请确认您的内核版本是否正确或者有无权限
Tun内核版本: 2023.04.13-1-ge15ba70
Tun内核文件: 存在
Tun内核运行权限: 正常

Dev内核版本: v1.15.0
Dev内核文件: 存在
Dev内核运行权限: 正常

Meta内核版本: alpha-gc2d1f71
Meta内核文件: 存在
Meta内核运行权限: 正常

#===================== 插件设置 =====================#

当前配置文件: /etc/openclash/config/Clash.yaml
启动配置文件: /etc/openclash/Clash.yaml
运行模式: fake-ip
默认代理模式: rule
UDP流量转发(tproxy): 启用
自定义DNS: 停用
IPV6代理: 停用
IPV6-DNS解析: 停用
禁用Dnsmasq缓存: 启用
自定义规则: 启用
仅允许内网: 停用
仅代理命中规则流量: 停用
仅允许常用端口流量: 停用
绕过中国大陆IP: 停用
路由本机代理: 启用

#启动异常时建议关闭此项后重试
混合节点: 停用
保留配置: 停用

#启动异常时建议关闭此项后重试
第三方规则: 停用

#===================== 自定义规则 一 =====================#
script:
##  shortcuts:
##    quic: network == 'udp' and dst_port == 443 and (geoip(resolve_ip(host)) != 'CN' or geoip(dst_ip) != 'CN')
##    time-limit: in_cidr(src_ip,'192.168.1.2/32') and time.now().hour < 20 or time.now().hour > 21
##    time-limit: src_ip == '192.168.1.2' and time.now().hour < 20 or time.now().hour > 21

rules:
##- SRC-IP-CIDR,192.168.99.173/32,ELPIS
##- SCRIPT,quic,REJECT #shortcuts rule
##- SCRIPT,time-limit,REJECT #shortcuts rule

##- DOMAIN-SUFFIX,google.com,Proxy #匹配域名后缀(交由Proxy代理服务器组)
##- DOMAIN,google.com,Proxy #匹配域名(交由Proxy代理服务器组)
##- DOMAIN-SUFFIX,ad.com,REJECT #匹配域名后缀(拒绝)
##- IP-CIDR,127.0.0.0/8,DIRECT #匹配数据目标IP(直连)
##- SRC-IP-CIDR,192.168.1.201/32,DIRECT #匹配数据发起IP(直连)
##- DST-PORT,80,DIRECT #匹配数据目标端口(直连)
##- SRC-PORT,7777,DIRECT #匹配数据源端口(直连)

##排序在上的规则优先生效,如添加（去除规则前的#号）：
##IP段：192.168.1.2-192.168.1.200 直连
##- SRC-IP-CIDR,192.168.1.2/31,DIRECT
##- SRC-IP-CIDR,192.168.1.4/30,DIRECT
##- SRC-IP-CIDR,192.168.1.8/29,DIRECT
##- SRC-IP-CIDR,192.168.1.16/28,DIRECT
##- SRC-IP-CIDR,192.168.1.32/27,DIRECT
##- SRC-IP-CIDR,192.168.1.64/26,DIRECT
##- SRC-IP-CIDR,192.168.1.128/26,DIRECT
##- SRC-IP-CIDR,192.168.1.192/29,DIRECT
##- SRC-IP-CIDR,192.168.1.200/32,DIRECT

##IP段：192.168.1.202-192.168.1.255 直连
##- SRC-IP-CIDR,192.168.1.202/31,DIRECT
##- SRC-IP-CIDR,192.168.1.204/30,DIRECT
##- SRC-IP-CIDR,192.168.1.208/28,DIRECT
##- SRC-IP-CIDR,192.168.1.224/27,DIRECT

##此时IP为192.168.1.1和192.168.1.201的客户端流量走代理（策略），其余客户端不走代理
##因为Fake-IP模式下，IP地址为192.168.1.1的路由器自身流量可走代理（策略），所以需要排除

##仅设置路由器自身直连：
##- SRC-IP-CIDR,192.168.1.1/32,DIRECT
##- SRC-IP-CIDR,198.18.0.1/32,DIRECT

##DDNS
##- DOMAIN-SUFFIX,checkip.dyndns.org,DIRECT
##- DOMAIN-SUFFIX,checkipv6.dyndns.org,DIRECT
##- DOMAIN-SUFFIX,checkip.synology.com,DIRECT
##- DOMAIN-SUFFIX,ifconfig.co,DIRECT
##- DOMAIN-SUFFIX,api.myip.com,DIRECT
##- DOMAIN-SUFFIX,ip-api.com,DIRECT
##- DOMAIN-SUFFIX,ipapi.co,DIRECT
##- DOMAIN-SUFFIX,ip6.seeip.org,DIRECT
##- DOMAIN-SUFFIX,members.3322.org,DIRECT

##在线IP段转CIDR地址：http://ip2cidr.com
#===================== 自定义规则 二 =====================#
script:
##  shortcuts:
##    common_port: dst_port not in [21, 22, 23, 53, 80, 123, 143, 194, 443, 465, 587, 853, 993, 995, 998, 2052, 2053, 2082, 2083, 2086, 2095, 2096, 5222, 5228, 5229, 5230, 8080, 8443, 8880, 8888, 8889]

##  code: |
##    def main(ctx, metadata):
##        directkeywordlist = ["baidu"]
##        for directkeyword in directkeywordlist:
##          if directkeyword in metadata["host"]:
##            ctx.log('[Script] matched keyword %s use direct' % directkeyword)
##            return "DIRECT"

rules:
##- SCRIPT,common_port,DIRECT #shortcuts rule

##- DOMAIN-SUFFIX,google.com,Proxy #匹配域名后缀(交由Proxy代理服务器组)
##- DOMAIN-KEYWORD,google,Proxy #匹配域名关键字(交由Proxy代理服务器组)
##- DOMAIN,google.com,Proxy #匹配域名(交由Proxy代理服务器组)
##- DOMAIN-SUFFIX,ad.com,REJECT #匹配域名后缀(拒绝)
##- IP-CIDR,127.0.0.0/8,DIRECT #匹配数据目标IP(直连)
##- SRC-IP-CIDR,192.168.1.201/32,DIRECT #匹配数据发起IP(直连)
##- DST-PORT,80,DIRECT #匹配数据目标端口(直连)
##- SRC-PORT,7777,DIRECT #匹配数据源端口(直连)

#===================== 配置文件 =====================#

dns:
  enable: true
  ipv6: false
  enhanced-mode: fake-ip
  default-nameserver:
  - 119.29.29.29
  - 223.5.5.5
  nameserver:
  - 119.29.29.29
  - 223.5.5.5
  fake-ip-filter:
  fake-ip-range: 198.18.0.1/16
  listen: 0.0.0.0:7874
proxy-groups:
- name: FAST
  type: url-test
  disable-udp: false
  proxies:
  - *******
  url: http://cp.cloudflare.com/generate_204
  interval: '1800'
  tolerance: '0'
  lazy: false
rule-providers:
  Block:
    type: http
    behavior: domain
    url: ******
    path: "./rule_provider/Block.yaml"
    interval: 86400
  Proxy:
    type: http
    behavior: domain
    url: ******
    path: "./rule_provider/Proxy.yaml"
    interval: 86400
  Direct:
    type: http
    behavior: domain
    url: ******
    path: "./rule_provider/Direct.yaml"
    interval: 86400
rules:
- DST-PORT,7895,REJECT
- DST-PORT,7892,REJECT
- IP-CIDR,198.18.0.1/16,REJECT,no-resolve
- RULE-SET,Block,REJECT
- RULE-SET,Proxy,FAST
- RULE-SET,Direct,DIRECT
- GEOIP,LAN,DIRECT
- GEOIP,CN,DIRECT
- MATCH,FAST
redir-port: 7892
tproxy-port: 7895
port: 7890
socks-port: 7891
mixed-port: 7893
mode: rule
log-level: silent
allow-lan: true
external-controller: 0.0.0.0:9090
bind-address: "*"
external-ui: "/usr/share/openclash/ui"
ipv6: false
interface-name: eth0
experimental:
  sniff-tls-sni: true
profile:
  store-selected: true
  store-fake-ip: true
authentication:
- Clash:8OddjD2r

#===================== 自定义覆写设置 =====================#

#!/bin/sh
. /usr/share/openclash/ruby.sh
. /usr/share/openclash/log.sh
. /lib/functions.sh

# This script is called by /etc/init.d/openclash
# Add your custom overwrite scripts here, they will be take effict after the OpenClash own srcipts

LOG_OUT "Tip: Start Running Custom Overwrite Scripts..."
LOGTIME=$(echo $(date "+%Y-%m-%d %H:%M:%S"))
LOG_FILE="/tmp/openclash.log"
CONFIG_FILE="$1" #config path

#ruby -ryaml -rYAML -I "/usr/share/openclash" -E UTF-8 -e "
#   begin
#      Value = YAML.load_file('$CONFIG_FILE');
#   rescue Exception => e
#      puts '${LOGTIME} Error: Load File Failed,【' + e.message + '】';
#   end;

    #General
#   begin
#   Thread.new{
#      Value['redir-port']=7892;
#      Value['tproxy-port']=7895;
#      Value['port']=7890;
#      Value['socks-port']=7891;
#      Value['mixed-port']=7893;
#   }.join;
#   rescue Exception => e
#      puts '${LOGTIME} Error: Set General Failed,【' + e.message + '】';
#   ensure
#      File.open('$CONFIG_FILE','w') {|f| YAML.dump(Value, f)};
#   end" 2>/dev/null >> $LOG_FILE

exit 0
#===================== 自定义防火墙设置 =====================#

#!/bin/sh

# This script is called by /etc/init.d/openclash

exit 0
#===================== IPTABLES 防火墙设置 =====================#

#IPv4 NAT chain

# Generated by iptables-save v1.8.7 on Sat Apr 15 20:58:57 2023
*nat
:PREROUTING ACCEPT [54:6522]
:INPUT ACCEPT [33:3736]
:OUTPUT ACCEPT [37:4976]
:POSTROUTING ACCEPT [16:3450]
:MINIUPNPD - [0:0]
:MINIUPNPD-POSTROUTING - [0:0]
:openclash - [0:0]
:openclash_output - [0:0]
:postrouting_lan_rule - [0:0]
:postrouting_rule - [0:0]
:postrouting_wan_rule - [0:0]
:prerouting_lan_rule - [0:0]
:prerouting_rule - [0:0]
:prerouting_wan_rule - [0:0]
:zone_lan_postrouting - [0:0]
:zone_lan_prerouting - [0:0]
:zone_wan_postrouting - [0:0]
:zone_wan_prerouting - [0:0]
-A PREROUTING -d 8.8.4.4/32 -p tcp -m comment --comment "OpenClash Google DNS Hijack" -m tcp --dport 53 -j REDIRECT --to-ports 7892
-A PREROUTING -d 8.8.8.8/32 -p tcp -m comment --comment "OpenClash Google DNS Hijack" -m tcp --dport 53 -j REDIRECT --to-ports 7892
-A PREROUTING -p udp -m udp --dport 53 -j REDIRECT --to-ports 53
-A PREROUTING -p tcp -m tcp --dport 53 -j REDIRECT --to-ports 53
-A PREROUTING -m comment --comment "!fw3: Custom prerouting rule chain" -j prerouting_rule
-A PREROUTING -i br-lan -m comment --comment "!fw3" -j zone_lan_prerouting
-A PREROUTING -i eth0 -m comment --comment "!fw3" -j zone_wan_prerouting
-A PREROUTING -p tcp -j openclash
-A OUTPUT -j openclash_output
-A POSTROUTING -s 10.242.0.0/16 -j MASQUERADE
-A POSTROUTING -o ztzlgmpcam -j MASQUERADE
-A POSTROUTING -s 10.242.0.0/16 -j MASQUERADE
-A POSTROUTING -o ztzlgmpcam -j MASQUERADE
-A POSTROUTING -m comment --comment "!fw3: Custom postrouting rule chain" -j postrouting_rule
-A POSTROUTING -o br-lan -m comment --comment "!fw3" -j zone_lan_postrouting
-A POSTROUTING -o eth0 -m comment --comment "!fw3" -j zone_wan_postrouting
-A MINIUPNPD -p tcp -m tcp --dport 8096 -j DNAT --to-destination 192.168.99.216:8096
-A MINIUPNPD -p tcp -m tcp --dport 8920 -j DNAT --to-destination 192.168.99.216:8920
-A MINIUPNPD -p tcp -m tcp --dport 38893 -j DNAT --to-destination 192.168.99.195:9010
-A MINIUPNPD -p tcp -m tcp --dport 39742 -j DNAT --to-destination 192.168.99.195:9020
-A MINIUPNPD -p udp -m udp --dport 39353 -j DNAT --to-destination 192.168.99.195:9030
-A MINIUPNPD -p udp -m udp --dport 36687 -j DNAT --to-destination 192.168.99.195:9031
-A MINIUPNPD -p udp -m udp --dport 36557 -j DNAT --to-destination 192.168.99.195:9032
-A MINIUPNPD -p udp -m udp --dport 31751 -j DNAT --to-destination 192.168.99.195:9033
-A MINIUPNPD-POSTROUTING -s 192.168.99.195/32 -p tcp -m tcp --sport 9010 -j MASQUERADE --to-ports 38893
-A MINIUPNPD-POSTROUTING -s 192.168.99.195/32 -p tcp -m tcp --sport 9020 -j MASQUERADE --to-ports 39742
-A MINIUPNPD-POSTROUTING -s 192.168.99.195/32 -p udp -m udp --sport 9030 -j MASQUERADE --to-ports 39353
-A MINIUPNPD-POSTROUTING -s 192.168.99.195/32 -p udp -m udp --sport 9031 -j MASQUERADE --to-ports 36687
-A MINIUPNPD-POSTROUTING -s 192.168.99.195/32 -p udp -m udp --sport 9032 -j MASQUERADE --to-ports 36557
-A MINIUPNPD-POSTROUTING -s 192.168.99.195/32 -p udp -m udp --sport 9033 -j MASQUERADE --to-ports 31751
-A openclash -i lo -m set --match-set localnetwork dst -j RETURN
-A openclash -i br-lan -m set --match-set localnetwork dst -j RETURN
-A openclash -d 198.18.0.0/16 -p tcp -j REDIRECT --to-ports 7892
-A openclash -p tcp -j REDIRECT --to-ports 7892
-A openclash_output -d 198.18.0.0/16 -p tcp -m owner ! --uid-owner 65534 -j REDIRECT --to-ports 7892
-A openclash_output -m set --match-set localnetwork dst -j RETURN
-A openclash_output -p tcp -m owner ! --uid-owner 65534 -j REDIRECT --to-ports 7892
-A zone_lan_postrouting -m comment --comment "!fw3: Custom lan postrouting rule chain" -j postrouting_lan_rule
-A zone_lan_prerouting -m comment --comment "!fw3: Custom lan prerouting rule chain" -j prerouting_lan_rule
-A zone_wan_postrouting -j MINIUPNPD-POSTROUTING
-A zone_wan_postrouting -m comment --comment "!fw3: Custom wan postrouting rule chain" -j postrouting_wan_rule
-A zone_wan_postrouting -m comment --comment "!fw3" -j FULLCONENAT
-A zone_wan_prerouting -j MINIUPNPD
-A zone_wan_prerouting -m comment --comment "!fw3: Custom wan prerouting rule chain" -j prerouting_wan_rule
-A zone_wan_prerouting -m comment --comment "!fw3" -j FULLCONENAT
COMMIT
# Completed on Sat Apr 15 20:58:57 2023

#IPv4 Mangle chain

# Generated by iptables-save v1.8.7 on Sat Apr 15 20:58:57 2023
*mangle
:PREROUTING ACCEPT [556:94055]
:INPUT ACCEPT [453:91896]
:FORWARD ACCEPT [107:5512]
:OUTPUT ACCEPT [500:95886]
:POSTROUTING ACCEPT [586:100558]
:openclash - [0:0]
:openclash_upnp - [0:0]
-A PREROUTING -p udp -j openclash
-A FORWARD -o eth0 -p tcp -m tcp --tcp-flags SYN,RST SYN -m comment --comment "!fw3: Zone wan MTU fixing" -j TCPMSS --clamp-mss-to-pmtu
-A FORWARD -i eth0 -p tcp -m tcp --tcp-flags SYN,RST SYN -m comment --comment "!fw3: Zone wan MTU fixing" -j TCPMSS --clamp-mss-to-pmtu
-A openclash -p udp -m udp --sport 500 -j RETURN
-A openclash -p udp -m udp --sport 68 -j RETURN
-A openclash -i lo -m set --match-set localnetwork dst -j RETURN
-A openclash -i br-lan -m set --match-set localnetwork dst -j RETURN
-A openclash -p udp -m udp --dport 53 -j RETURN
-A openclash -d 198.18.0.0/16 -p udp -j TPROXY --on-port 7895 --on-ip 0.0.0.0 --tproxy-mark 0x162/0xffffffff
-A openclash -p udp -j openclash_upnp
-A openclash -p udp -j TPROXY --on-port 7895 --on-ip 0.0.0.0 --tproxy-mark 0x162/0xffffffff
-A openclash_upnp -s 192.168.99.216/32 -p udp -m udp --sport 8096 -j RETURN
-A openclash_upnp -s 192.168.99.216/32 -p udp -m udp --sport 8920 -j RETURN
-A openclash_upnp -s 192.168.99.195/32 -p udp -m udp --sport 9010 -j RETURN
-A openclash_upnp -s 192.168.99.195/32 -p udp -m udp --sport 9020 -j RETURN
-A openclash_upnp -s 192.168.99.195/32 -p udp -m udp --sport 9030 -j RETURN
-A openclash_upnp -s 192.168.99.195/32 -p udp -m udp --sport 9031 -j RETURN
-A openclash_upnp -s 192.168.99.195/32 -p udp -m udp --sport 9032 -j RETURN
-A openclash_upnp -s 192.168.99.195/32 -p udp -m udp --sport 9033 -j RETURN
COMMIT
# Completed on Sat Apr 15 20:58:57 2023

#IPv4 Filter chain

# Generated by iptables-save v1.8.7 on Sat Apr 15 20:58:57 2023
*filter
:INPUT ACCEPT [0:0]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [0:0]
:MINIUPNPD - [0:0]
:forwarding_lan_rule - [0:0]
:forwarding_rule - [0:0]
:forwarding_wan_rule - [0:0]
:input_lan_rule - [0:0]
:input_rule - [0:0]
:input_wan_rule - [0:0]
:output_lan_rule - [0:0]
:output_rule - [0:0]
:output_wan_rule - [0:0]
:reject - [0:0]
:syn_flood - [0:0]
:zone_lan_dest_ACCEPT - [0:0]
:zone_lan_forward - [0:0]
:zone_lan_input - [0:0]
:zone_lan_output - [0:0]
:zone_lan_src_ACCEPT - [0:0]
:zone_wan_dest_ACCEPT - [0:0]
:zone_wan_dest_REJECT - [0:0]
:zone_wan_forward - [0:0]
:zone_wan_input - [0:0]
:zone_wan_output - [0:0]
:zone_wan_src_REJECT - [0:0]
-A INPUT -p udp -m udp --dport 443 -m comment --comment "OpenClash QUIC REJECT" -m set ! --match-set china_ip_route dst -j REJECT --reject-with icmp-port-unreachable
-A INPUT -i lo -m comment --comment "!fw3" -j ACCEPT
-A INPUT -m comment --comment "!fw3: Custom input rule chain" -j input_rule
-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment "!fw3" -j ACCEPT
-A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -m comment --comment "!fw3" -j syn_flood
-A INPUT -i br-lan -m comment --comment "!fw3" -j zone_lan_input
-A INPUT -i eth0 -m comment --comment "!fw3" -j zone_wan_input
-A FORWARD -o ztzlgmpcam -j ACCEPT
-A FORWARD -i ztzlgmpcam -j ACCEPT
-A FORWARD -o ztzlgmpcam -j ACCEPT
-A FORWARD -i ztzlgmpcam -j ACCEPT
-A FORWARD -m comment --comment "!fw3: Custom forwarding rule chain" -j forwarding_rule
-A FORWARD -m comment --comment "!fw3: Traffic offloading" -m conntrack --ctstate RELATED,ESTABLISHED -j FLOWOFFLOAD --hw
-A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment "!fw3" -j ACCEPT
-A FORWARD -i br-lan -m comment --comment "!fw3" -j zone_lan_forward
-A FORWARD -i eth0 -m comment --comment "!fw3" -j zone_wan_forward
-A FORWARD -m comment --comment "!fw3" -j reject
-A OUTPUT -o lo -m comment --comment "!fw3" -j ACCEPT
-A OUTPUT -m comment --comment "!fw3: Custom output rule chain" -j output_rule
-A OUTPUT -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment "!fw3" -j ACCEPT
-A OUTPUT -o br-lan -m comment --comment "!fw3" -j zone_lan_output
-A OUTPUT -o eth0 -m comment --comment "!fw3" -j zone_wan_output
-A MINIUPNPD -d 192.168.99.216/32 -p tcp -m tcp --dport 8096 -j ACCEPT
-A MINIUPNPD -d 192.168.99.216/32 -p tcp -m tcp --dport 8920 -j ACCEPT
-A MINIUPNPD -d 192.168.99.195/32 -p tcp -m tcp --dport 9010 -j ACCEPT
-A MINIUPNPD -d 192.168.99.195/32 -p tcp -m tcp --dport 9020 -j ACCEPT
-A MINIUPNPD -d 192.168.99.195/32 -p udp -m udp --dport 9030 -j ACCEPT
-A MINIUPNPD -d 192.168.99.195/32 -p udp -m udp --dport 9031 -j ACCEPT
-A MINIUPNPD -d 192.168.99.195/32 -p udp -m udp --dport 9032 -j ACCEPT
-A MINIUPNPD -d 192.168.99.195/32 -p udp -m udp --dport 9033 -j ACCEPT
-A reject -p tcp -m comment --comment "!fw3" -j REJECT --reject-with tcp-reset
-A reject -m comment --comment "!fw3" -j REJECT --reject-with icmp-port-unreachable
-A syn_flood -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -m limit --limit 25/sec --limit-burst 50 -m comment --comment "!fw3" -j RETURN
-A syn_flood -m comment --comment "!fw3" -j DROP
-A zone_lan_dest_ACCEPT -o br-lan -m comment --comment "!fw3" -j ACCEPT
-A zone_lan_forward -m comment --comment "!fw3: Custom lan forwarding rule chain" -j forwarding_lan_rule
-A zone_lan_forward -m comment --comment "!fw3: Zone lan to wan forwarding policy" -j zone_wan_dest_ACCEPT
-A zone_lan_forward -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port forwards" -j ACCEPT
-A zone_lan_forward -m comment --comment "!fw3" -j zone_lan_dest_ACCEPT
-A zone_lan_input -m comment --comment "!fw3: Custom lan input rule chain" -j input_lan_rule
-A zone_lan_input -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port redirections" -j ACCEPT
-A zone_lan_input -m comment --comment "!fw3" -j zone_lan_src_ACCEPT
-A zone_lan_output -m comment --comment "!fw3: Custom lan output rule chain" -j output_lan_rule
-A zone_lan_output -m comment --comment "!fw3" -j zone_lan_dest_ACCEPT
-A zone_lan_src_ACCEPT -i br-lan -m conntrack --ctstate NEW,UNTRACKED -m comment --comment "!fw3" -j ACCEPT
-A zone_wan_dest_ACCEPT -o eth0 -m conntrack --ctstate INVALID -m comment --comment "!fw3: Prevent NAT leakage" -j DROP
-A zone_wan_dest_ACCEPT -o eth0 -m comment --comment "!fw3" -j ACCEPT
-A zone_wan_dest_REJECT -o eth0 -m comment --comment "!fw3" -j reject
-A zone_wan_forward -j MINIUPNPD
-A zone_wan_forward -m comment --comment "!fw3: Custom wan forwarding rule chain" -j forwarding_wan_rule
-A zone_wan_forward -p esp -m comment --comment "!fw3: Allow-IPSec-ESP" -j zone_lan_dest_ACCEPT
-A zone_wan_forward -p udp -m udp --dport 500 -m comment --comment "!fw3: Allow-ISAKMP" -j zone_lan_dest_ACCEPT
-A zone_wan_forward -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port forwards" -j ACCEPT
-A zone_wan_forward -m comment --comment "!fw3" -j zone_wan_dest_REJECT
-A zone_wan_input -m comment --comment "!fw3: Custom wan input rule chain" -j input_wan_rule
-A zone_wan_input -p udp -m udp --dport 68 -m comment --comment "!fw3: Allow-DHCP-Renew" -j ACCEPT
-A zone_wan_input -p icmp -m icmp --icmp-type 8 -m comment --comment "!fw3: Allow-Ping" -j ACCEPT
-A zone_wan_input -p igmp -m comment --comment "!fw3: Allow-IGMP" -j ACCEPT
-A zone_wan_input -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port redirections" -j ACCEPT
-A zone_wan_input -m comment --comment "!fw3" -j zone_wan_src_REJECT
-A zone_wan_output -m comment --comment "!fw3: Custom wan output rule chain" -j output_wan_rule
-A zone_wan_output -m comment --comment "!fw3" -j zone_wan_dest_ACCEPT
-A zone_wan_src_REJECT -i eth0 -m comment --comment "!fw3" -j reject
COMMIT
# Completed on Sat Apr 15 20:58:57 2023

#IPv6 NAT chain

# Generated by ip6tables-save v1.8.7 on Sat Apr 15 20:58:57 2023
*nat
:PREROUTING ACCEPT [116:23524]
:INPUT ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
-A PREROUTING -p udp -m udp --dport 53 -j REDIRECT --to-ports 53
-A PREROUTING -p tcp -m tcp --dport 53 -j REDIRECT --to-ports 53
COMMIT
# Completed on Sat Apr 15 20:58:57 2023

#IPv6 Mangle chain

# Generated by ip6tables-save v1.8.7 on Sat Apr 15 20:58:57 2023
*mangle
:PREROUTING ACCEPT [37:5795]
:INPUT ACCEPT [3:208]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [2:272]
:POSTROUTING ACCEPT [2:272]
-A FORWARD -o eth0 -p tcp -m tcp --tcp-flags SYN,RST SYN -m comment --comment "!fw3: Zone wan MTU fixing" -j TCPMSS --clamp-mss-to-pmtu
-A FORWARD -i eth0 -p tcp -m tcp --tcp-flags SYN,RST SYN -m comment --comment "!fw3: Zone wan MTU fixing" -j TCPMSS --clamp-mss-to-pmtu
COMMIT
# Completed on Sat Apr 15 20:58:57 2023

#IPv6 Filter chain

# Generated by ip6tables-save v1.8.7 on Sat Apr 15 20:58:57 2023
*filter
:INPUT ACCEPT [0:0]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [0:0]
:MINIUPNPD - [0:0]
:forwarding_lan_rule - [0:0]
:forwarding_rule - [0:0]
:forwarding_wan_rule - [0:0]
:input_lan_rule - [0:0]
:input_rule - [0:0]
:input_wan_rule - [0:0]
:output_lan_rule - [0:0]
:output_rule - [0:0]
:output_wan_rule - [0:0]
:reject - [0:0]
:syn_flood - [0:0]
:zone_lan_dest_ACCEPT - [0:0]
:zone_lan_forward - [0:0]
:zone_lan_input - [0:0]
:zone_lan_output - [0:0]
:zone_lan_src_ACCEPT - [0:0]
:zone_wan_dest_ACCEPT - [0:0]
:zone_wan_dest_REJECT - [0:0]
:zone_wan_forward - [0:0]
:zone_wan_input - [0:0]
:zone_wan_output - [0:0]
:zone_wan_src_REJECT - [0:0]
-A INPUT -i lo -m comment --comment "!fw3" -j ACCEPT
-A INPUT -m comment --comment "!fw3: Custom input rule chain" -j input_rule
-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment "!fw3" -j ACCEPT
-A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -m comment --comment "!fw3" -j syn_flood
-A INPUT -i br-lan -m comment --comment "!fw3" -j zone_lan_input
-A INPUT -i eth0 -m comment --comment "!fw3" -j zone_wan_input
-A FORWARD -m comment --comment "!fw3: Custom forwarding rule chain" -j forwarding_rule
-A FORWARD -m comment --comment "!fw3: Traffic offloading" -m conntrack --ctstate RELATED,ESTABLISHED -j FLOWOFFLOAD --hw
-A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment "!fw3" -j ACCEPT
-A FORWARD -i br-lan -m comment --comment "!fw3" -j zone_lan_forward
-A FORWARD -i eth0 -m comment --comment "!fw3" -j zone_wan_forward
-A FORWARD -m comment --comment "!fw3" -j reject
-A OUTPUT -o lo -m comment --comment "!fw3" -j ACCEPT
-A OUTPUT -m comment --comment "!fw3: Custom output rule chain" -j output_rule
-A OUTPUT -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment "!fw3" -j ACCEPT
-A OUTPUT -o br-lan -m comment --comment "!fw3" -j zone_lan_output
-A OUTPUT -o eth0 -m comment --comment "!fw3" -j zone_wan_output
-A reject -p tcp -m comment --comment "!fw3" -j REJECT --reject-with tcp-reset
-A reject -m comment --comment "!fw3" -j REJECT --reject-with icmp6-port-unreachable
-A syn_flood -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -m limit --limit 25/sec --limit-burst 50 -m comment --comment "!fw3" -j RETURN
-A syn_flood -m comment --comment "!fw3" -j DROP
-A zone_lan_dest_ACCEPT -o br-lan -m comment --comment "!fw3" -j ACCEPT
-A zone_lan_forward -m comment --comment "!fw3: Custom lan forwarding rule chain" -j forwarding_lan_rule
-A zone_lan_forward -m comment --comment "!fw3: Zone lan to wan forwarding policy" -j zone_wan_dest_ACCEPT
-A zone_lan_forward -m comment --comment "!fw3" -j zone_lan_dest_ACCEPT
-A zone_lan_input -m comment --comment "!fw3: Custom lan input rule chain" -j input_lan_rule
-A zone_lan_input -m comment --comment "!fw3" -j zone_lan_src_ACCEPT
-A zone_lan_output -m comment --comment "!fw3: Custom lan output rule chain" -j output_lan_rule
-A zone_lan_output -m comment --comment "!fw3" -j zone_lan_dest_ACCEPT
-A zone_lan_src_ACCEPT -i br-lan -m conntrack --ctstate NEW,UNTRACKED -m comment --comment "!fw3" -j ACCEPT
-A zone_wan_dest_ACCEPT -o eth0 -m conntrack --ctstate INVALID -m comment --comment "!fw3: Prevent NAT leakage" -j DROP
-A zone_wan_dest_ACCEPT -o eth0 -m comment --comment "!fw3" -j ACCEPT
-A zone_wan_dest_REJECT -o eth0 -m comment --comment "!fw3" -j reject
-A zone_wan_forward -j MINIUPNPD
-A zone_wan_forward -m comment --comment "!fw3: Custom wan forwarding rule chain" -j forwarding_wan_rule
-A zone_wan_forward -p ipv6-icmp -m icmp6 --icmpv6-type 128 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Forward" -j ACCEPT
-A zone_wan_forward -p ipv6-icmp -m icmp6 --icmpv6-type 129 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Forward" -j ACCEPT
-A zone_wan_forward -p ipv6-icmp -m icmp6 --icmpv6-type 1 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Forward" -j ACCEPT
-A zone_wan_forward -p ipv6-icmp -m icmp6 --icmpv6-type 2 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Forward" -j ACCEPT
-A zone_wan_forward -p ipv6-icmp -m icmp6 --icmpv6-type 3 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Forward" -j ACCEPT
-A zone_wan_forward -p ipv6-icmp -m icmp6 --icmpv6-type 4/0 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Forward" -j ACCEPT
-A zone_wan_forward -p ipv6-icmp -m icmp6 --icmpv6-type 4/1 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Forward" -j ACCEPT
-A zone_wan_forward -p esp -m comment --comment "!fw3: Allow-IPSec-ESP" -j zone_lan_dest_ACCEPT
-A zone_wan_forward -p udp -m udp --dport 500 -m comment --comment "!fw3: Allow-ISAKMP" -j zone_lan_dest_ACCEPT
-A zone_wan_forward -m comment --comment "!fw3" -j zone_wan_dest_REJECT
-A zone_wan_input -m comment --comment "!fw3: Custom wan input rule chain" -j input_wan_rule
-A zone_wan_input -s fc00::/6 -d fc00::/6 -p udp -m udp --dport 546 -m comment --comment "!fw3: Allow-DHCPv6" -j ACCEPT
-A zone_wan_input -s fe80::/10 -p ipv6-icmp -m icmp6 --icmpv6-type 130/0 -m comment --comment "!fw3: Allow-MLD" -j ACCEPT
-A zone_wan_input -s fe80::/10 -p ipv6-icmp -m icmp6 --icmpv6-type 131/0 -m comment --comment "!fw3: Allow-MLD" -j ACCEPT
-A zone_wan_input -s fe80::/10 -p ipv6-icmp -m icmp6 --icmpv6-type 132/0 -m comment --comment "!fw3: Allow-MLD" -j ACCEPT
-A zone_wan_input -s fe80::/10 -p ipv6-icmp -m icmp6 --icmpv6-type 143/0 -m comment --comment "!fw3: Allow-MLD" -j ACCEPT
-A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 128 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT
-A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 129 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT
-A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 1 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT
-A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 2 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT
-A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 3 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT
-A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 4/0 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT
-A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 4/1 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT
-A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 133 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT
-A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 135 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT
-A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 134 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT
-A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 136 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT
-A zone_wan_input -m comment --comment "!fw3" -j zone_wan_src_REJECT
-A zone_wan_output -m comment --comment "!fw3: Custom wan output rule chain" -j output_wan_rule
-A zone_wan_output -m comment --comment "!fw3" -j zone_wan_dest_ACCEPT
-A zone_wan_src_REJECT -i eth0 -m comment --comment "!fw3" -j reject
COMMIT
# Completed on Sat Apr 15 20:58:57 2023

#===================== IPSET状态 =====================#

Name: localnetwork
Name: china_ip_route
Name: china_ip_route_pass

#===================== 路由表状态 =====================#

#route -n
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         192.168.1.1     0.0.0.0         UG    0      0        0 eth0
10.242.0.0      0.0.0.0         255.255.0.0     U     0      0        0 ztzlgmpcam
192.168.1.0     0.0.0.0         255.255.255.0   U     0      0        0 eth0
192.168.22.0    10.242.100.7    255.255.255.0   UG    5000   0        0 ztzlgmpcam
192.168.33.0    10.242.100.213  255.255.255.0   UG    5000   0        0 ztzlgmpcam
192.168.44.0    10.242.100.99   255.255.255.0   UG    5000   0        0 ztzlgmpcam
192.168.55.0    10.242.100.80   255.255.255.0   UG    5000   0        0 ztzlgmpcam
192.168.66.0    10.242.100.37   255.255.255.0   UG    5000   0        0 ztzlgmpcam
192.168.77.0    10.242.100.75   255.255.255.0   UG    5000   0        0 ztzlgmpcam
192.168.88.0    10.242.100.92   255.255.255.0   UG    5000   0        0 ztzlgmpcam
192.168.99.0    0.0.0.0         255.255.255.0   U     0      0        0 br-lan
#ip route list
default via 192.168.1.1 dev eth0 proto static src 192.168.1.2 
10.242.0.0/16 dev ztzlgmpcam proto kernel scope link src 10.242.100.212 
192.168.1.0/24 dev eth0 proto kernel scope link src 192.168.1.2 
192.168.22.0/24 via 10.242.100.7 dev ztzlgmpcam proto static metric 5000 
192.168.33.0/24 via 10.242.100.213 dev ztzlgmpcam proto static metric 5000 
192.168.44.0/24 via 10.242.100.99 dev ztzlgmpcam proto static metric 5000 
192.168.55.0/24 via 10.242.100.80 dev ztzlgmpcam proto static metric 5000 
192.168.66.0/24 via 10.242.100.37 dev ztzlgmpcam proto static metric 5000 
192.168.77.0/24 via 10.242.100.75 dev ztzlgmpcam proto static metric 5000 
192.168.88.0/24 via 10.242.100.92 dev ztzlgmpcam proto static metric 5000 
192.168.99.0/24 dev br-lan proto kernel scope link src 192.168.99.1 
#ip rule show
0:  from all lookup local
32765:  from all fwmark 0x162 lookup 354
32766:  from all lookup main
32767:  from all lookup default

#===================== 端口占用状态 =====================#

tcp        0      0 :::7893                 :::*                    LISTEN      19015/clash
tcp        0      0 :::7892                 :::*                    LISTEN      19015/clash
tcp        0      0 :::7895                 :::*                    LISTEN      19015/clash
tcp        0      0 :::7891                 :::*                    LISTEN      19015/clash
tcp        0      0 :::7890                 :::*                    LISTEN      19015/clash
tcp        0      0 :::9090                 :::*                    LISTEN      19015/clash
udp        0      0 :::45822                :::*                                19015/clash
udp        0      0 :::46273                :::*                                19015/clash
udp        0      0 :::54629                :::*                                19015/clash
udp        0      0 :::38493                :::*                                19015/clash
udp        0      0 :::44415                :::*                                19015/clash
udp        0      0 :::7874                 :::*                                19015/clash
udp        0      0 :::7891                 :::*                                19015/clash
udp        0      0 :::7892                 :::*                                19015/clash
udp        0      0 :::7893                 :::*                                19015/clash
udp        0      0 :::7895                 :::*                                19015/clash
udp        0      0 :::53417                :::*                                19015/clash

#===================== 测试本机DNS查询(www.baidu.com) =====================#

;; connection timed out; no servers could be reached

#===================== 测试内核DNS查询(www.instagram.com) =====================#

#===================== resolv.conf.auto =====================#

# Interface lan
nameserver 114.114.114.114
nameserver 119.29.29.29

#===================== resolv.conf.d =====================#

# Interface wan
nameserver 119.29.29.29
nameserver 223.5.5.5
nameserver 114.114.114.114

#===================== 测试本机网络连接(www.baidu.com) =====================#

#===================== 测试本机网络下载(raw.githubusercontent.com) =====================#

#===================== 最近运行日志(自动切换为Debug模式) =====================#

2023-04-15 20:58:19 Installing The New Version, Please Do Not Refresh The Page or Do Other Operations...
2023-04-15 20:58:28 Warning: OpenClash Now Disabled, Need Start From Luci Page, Exit...
2023-04-15 20:58:19 OpenClash Update Successful, About To Restart!
2023-04-15 20:58:28 OpenClash Restart...
2023-04-15 20:58:28 OpenClash Stoping...
2023-04-15 20:58:28 Step 1: Backup The Current Groups State...
2023-04-15 20:58:28 Step 2: Delete OpenClash Firewall Rules...
2023-04-15 20:58:29 Step 3: Close The OpenClash Daemons...
2023-04-15 20:58:29 Step 4: Close The Clash Core Process...
2023-04-15 20:58:29 Step 5: Restart Dnsmasq...
2023-04-15 20:58:34 Step 6: Delete OpenClash Residue File...
2023-04-15 20:58:34 OpenClash Start Running...
2023-04-15 20:58:34 Step 1: Get The Configuration...
2023-04-15 20:58:34 Step 2: Check The Components...
2023-04-15 20:58:34 Step 3: Modify The Config File...
2023-04-15 20:58:35 Tip: You have seted the authentication of SOCKS5/HTTP(S) proxy with【Clash:8OddjD2r】
2023-04-15 20:58:35 Tip: Start Running Custom Overwrite Scripts...
2023-04-15 20:58:35 Step 4: Start Running The Clash Core...
2023-04-15 20:58:35 Tip: Detected The Exclusive Function of The TUN Core, Use TUN Core to Start...
2023-04-15 20:58:36 Step 5: Check The Core Status...
12:58:36 INF [Config] initial compatible provider name=FAST
12:58:36 INF [Config] initial rule provider name=Direct
12:58:36 INF [Config] initial rule provider name=Block
12:58:36 INF [Config] initial rule provider name=Proxy
2023-04-15 20:58:39 Step 6: Wait For The File Downloading...
2023-04-15 20:58:39 Step 7: Set Firewall Rules...
2023-04-15 20:58:39 Tip: DNS Hijacking Mode is Dnsmasq Redirect...
2023-04-15 20:58:39 Tip: Start Add Port Bypassing Rules For Firewall Redirect and Firewall Rules...
2023-04-15 20:58:39 Step 8: Restart Dnsmasq...
2023-04-15 20:58:42 Step 9: Add Cron Rules, Start Daemons...
2023-04-15 20:58:42 OpenClash Start Successful!
2023-04-15 20:58:33【/tmp/openclash_last_version】Download Failed:【curl: (28) Operation too slow. Less than 1 bytes/sec transferred the last 30 seconds】
12:59:33 DBG [UDP] accept session lAddr=192.168.99.133:54321 rAddr=111.13.213.254:8053 inbound=TProxy
12:59:33 INF [UDP] connected lAddr=192.168.99.133:54321 rAddr=111.13.213.254:8053 mode=rule rule=GeoIP(CN) proxy=DIRECT
12:59:34 DBG [UDP] accept session lAddr=192.168.1.2:1863 rAddr=42.187.183.76:8000 inbound=TProxy
12:59:34 INF [UDP] connected lAddr=192.168.1.2:1863 rAddr=42.187.183.76:8000 mode=rule rule=GeoIP(CN) proxy=DIRECT
12:59:38 DBG [UDP] accept session lAddr=192.168.99.168:29147 rAddr=120.131.3.73:32100 inbound=TProxy
12:59:38 INF [UDP] connected lAddr=192.168.99.168:29147 rAddr=120.131.3.73:32100 mode=rule rule=GeoIP(CN) proxy=DIRECT
12:59:42 DBG [TCP] accept connection lAddr=192.168.99.140:53124 rAddr=connectivity.samsung.com.cn:80 inbound=Redir
12:59:42 DBG [TCP] accept connection lAddr=192.168.99.140:43970 rAddr=connectivity.samsung.com.cn:443 inbound=Redir

#===================== 最近运行日志获取完成(自动切换为silent模式) =====================#

#===================== 活动连接信息 =====================#

1. SourceIP:【192.168.99.181】 - Host:【aus5.mozilla.org】 - DestinationIP:【】 - Network:【tcp】 - RulePayload:【Proxy】 - Lastchain:【HADES】
2. SourceIP:【192.168.99.133】 - Host:【Empty】 - DestinationIP:【183.84.5.209】 - Network:【tcp】 - RulePayload:【CN】 - Lastchain:【DIRECT】
3. SourceIP:【119.28.206.193】 - Host:【Empty】 - DestinationIP:【192.168.1.2】 - Network:【udp】 - RulePayload:【LAN】 - Lastchain:【DIRECT】
4. SourceIP:【120.131.3.73】 - Host:【Empty】 - DestinationIP:【192.168.1.2】 - Network:【udp】 - RulePayload:【LAN】 - Lastchain:【DIRECT】
5. SourceIP:【192.168.99.204】 - Host:【api.miwifi.com】 - DestinationIP:【】 - Network:【tcp】 - RulePayload:【】 - Lastchain:【HADES】
6. SourceIP:【192.168.99.181】 - Host:【services.addons.mozilla.org】 - DestinationIP:【】 - Network:【tcp】 - RulePayload:【Proxy】 - Lastchain:【HADES】
7. SourceIP:【50.7.252.138】 - Host:【Empty】 - DestinationIP:【192.168.1.2】 - Network:【udp】 - RulePayload:【LAN】 - Lastchain:【DIRECT】
8. SourceIP:【203.107.6.88】 - Host:【Empty】 - DestinationIP:【192.168.1.2】 - Network:【udp】 - RulePayload:【LAN】 - Lastchain:【DIRECT】
9. SourceIP:【192.168.1.2】 - Host:【Empty】 - DestinationIP:【42.187.183.76】 - Network:【udp】 - RulePayload:【CN】 - Lastchain:【DIRECT】
10. SourceIP:【192.168.99.168】 - Host:【xiaomi2.p2psy2.io.mi.com】 - DestinationIP:【】 - Network:【tcp】 - RulePayload:【】 - Lastchain:【HADES】
11. SourceIP:【84.17.53.155】 - Host:【Empty】 - DestinationIP:【192.168.1.2】 - Network:【udp】 - RulePayload:【LAN】 - Lastchain:【DIRECT】
12. SourceIP:【119.29.29.29】 - Host:【Empty】 - DestinationIP:【192.168.1.2】 - Network:【udp】 - RulePayload:【LAN】 - Lastchain:【DIRECT】
13. SourceIP:【114.114.114.114】 - Host:【Empty】 - DestinationIP:【192.168.1.2】 - Network:【udp】 - RulePayload:【LAN】 - Lastchain:【DIRECT】
14. SourceIP:【111.13.213.254】 - Host:【Empty】 - DestinationIP:【192.168.1.2】 - Network:【udp】 - RulePayload:【LAN】 - Lastchain:【DIRECT】
15. SourceIP:【192.168.99.161】 - Host:【Empty】 - DestinationIP:【36.155.208.26】 - Network:【tcp】 - RulePayload:【CN】 - Lastchain:【DIRECT】
16. SourceIP:【104.194.8.134】 - Host:【Empty】 - DestinationIP:【192.168.1.2】 - Network:【udp】 - RulePayload:【LAN】 - Lastchain:【DIRECT】
17. SourceIP:【103.195.103.66】 - Host:【Empty】 - DestinationIP:【192.168.1.2】 - Network:【udp】 - RulePayload:【LAN】 - Lastchain:【DIRECT】
18. SourceIP:【106.55.184.199】 - Host:【Empty】 - DestinationIP:【192.168.1.2】 - Network:【udp】 - RulePayload:【LAN】 - Lastchain:【DIRECT】
19. SourceIP:【192.168.99.168】 - Host:【Empty】 - DestinationIP:【120.131.3.73】 - Network:【tcp】 - RulePayload:【CN】 - Lastchain:【DIRECT】
20. SourceIP:【223.5.5.5】 - Host:【Empty】 - DestinationIP:【192.168.1.2】 - Network:【udp】 - RulePayload:【LAN】 - Lastchain:【DIRECT】
21. SourceIP:【192.168.99.181】 - Host:【versioncheck-bg.addons.mozilla.org】 - DestinationIP:【】 - Network:【tcp】 - RulePayload:【Proxy】 - Lastchain:【HADES】
22. SourceIP:【192.168.99.181】 - Host:【fcmconnection.googleapis.com】 - DestinationIP:【142.251.42.234】 - Network:【tcp】 - RulePayload:【Proxy】 - Lastchain:【HADES】
23. SourceIP:【192.168.99.181】 - Host:【Empty】 - DestinationIP:【149.154.175.50】 - Network:【tcp】 - RulePayload:【】 - Lastchain:【HADES】
24. SourceIP:【120.92.164.118】 - Host:【Empty】 - DestinationIP:【192.168.1.2】 - Network:【udp】 - RulePayload:【LAN】 - Lastchain:【DIRECT】
25. SourceIP:【192.168.99.168】 - Host:【Empty】 - DestinationIP:【120.92.164.118】 - Network:【tcp】 - RulePayload:【CN】 - Lastchain:【DIRECT】
26. SourceIP:【192.168.99.152】 - Host:【Empty】 - DestinationIP:【193.182.111.141】 - Network:【udp】 - RulePayload:【】 - Lastchain:【HADES】
27. SourceIP:【192.168.99.140】 - Host:【mtalk.google.com】 - DestinationIP:【】 - Network:【tcp】 - RulePayload:【Proxy】 - Lastchain:【HADES】

OpenClash Config

No response

Expected Behavior

看看108到110改了哪些地方可能导致问题。

Screenshots

No response

ghost commented 1 year ago

逐步回退编译后发现问题是从109版本开始出现的,108到109似乎只有一个commit，问题估计就出在那里。 110版本上dig命令无法返回任何结果，109版本上是直接报错如下信息：

root@OpenWrt:~# cat /etc/resolv.conf
# Interface wan
nameserver 192.168.1.1
root@OpenWrt:~# dig ip.sb
;; UDP setup with 192.168.1.1#53(192.168.1.1) for ip.sb failed: address in use.
;; UDP setup with 192.168.1.1#53(192.168.1.1) for ip.sb failed: address in use.
;; UDP setup with 192.168.1.1#53(192.168.1.1) for ip.sb failed: address in use.
root@OpenWrt:~# dig ip.sb @127.0.0.1
;; UDP setup with 127.0.0.1#53(127.0.0.1) for ip.sb failed: address in use.
;; UDP setup with 127.0.0.1#53(127.0.0.1) for ip.sb failed: address in use.
;; UDP setup with 127.0.0.1#53(127.0.0.1) for ip.sb failed: address in use.
VIKINGYFY commented 1 year ago

同样问题，现在不敢升级主体到110了，108主体，单独更新内核没有问题

ghost commented 1 year ago

确定是这个https://github.com/vernesong/OpenClash/commit/de3dc633370824a93d89892c4f1835e0ff104b7b commit导入的问题, 出现的问题就是：

root@OpenWrt:~# cat /etc/resolv.conf
# Interface wan
nameserver 192.168.1.1
root@OpenWrt:~# dig ip.sb
;; UDP setup with 192.168.1.1#53(192.168.1.1) for ip.sb failed: address in use.
;; UDP setup with 192.168.1.1#53(192.168.1.1) for ip.sb failed: address in use.
;; UDP setup with 192.168.1.1#53(192.168.1.1) for ip.sb failed: address in use.
root@OpenWrt:~# dig ip.sb @127.0.0.1
;; UDP setup with 127.0.0.1#53(127.0.0.1) for ip.sb failed: address in use.
;; UDP setup with 127.0.0.1#53(127.0.0.1) for ip.sb failed: address in use.
;; UDP setup with 127.0.0.1#53(127.0.0.1) for ip.sb failed: address in use.

而更新到110版本之后错误变成了

root@OpenWrt:~# dig ip.sb
;; communications error to 192.168.1.1#53: timed out
;; communications error to 192.168.1.1#53: timed out
;; communications error to 192.168.1.1#53: timed out
weilai-all commented 1 year ago

我这边还好，兼容模式无法代理，tun模式正常代理但是无法访问docker映射出来的端口，切换到混合模式一切正常，应该108后出现的.

ghost commented 1 year ago

111版本依然存在这个问题

paladin4fan commented 1 year ago

+1 而且还有无限重制防火墙规则 以及导致路由root分区变成只读之类的现象

lzfmars commented 1 year ago

+1，110/111路由root分区变成只读

sskkcc commented 1 year ago

不知道怎么回事，110和111会导致我的路由器无法分配任何ipv4相关地址，只能手动添加ip地址和网关，但是会给我分配ipv6地址，最后我不得不删掉dnsmasq-full重新安装，才恢复正常。这两个版本会修改dnsmasq-full或者先关依赖包？

yyysuo commented 1 year ago

+1 而且还有无限重制防火墙规则 以及导致路由root分区变成只读之类的现象

怎么发现只读的，只读了之后怎么处理，回退到103就可以了吗？

BuBuXSY commented 1 year ago

111一样的问题伴有Error Msg listenLocalconn failed with error address already in use ,packet loss 而且DNS用域名的DOH无法对其他域名解析一直报错 打开网页也是发现无法上网是因为无法找到IP 但如果更换成DOT（IP）的就正常了 目前已回退103恢复正常

paladin4fan commented 1 year ago

+1 而且还有无限重制防火墙规则 以及导致路由root分区变成只读之类的现象

怎么发现只读的，只读了之后怎么处理，回退到103就可以了吗？

luci界面修改完任何设置点击保存后不生效 依然显示“未保存的应用” ssh登录路由器创建\修改\删除文件提示只读的文件系统

解决方法当然不是单降级插件 这个只读是由于分区信息出错了造成的 需要用e2fsck工具 如果你的路由没装这个工具 软路由要一个u盘启动Linux liveCD或者把路由系统盘拆到Linux PC上完成 硬路由估计得直接重新刷了

yyysuo commented 1 year ago

+1 而且还有无限重制防火墙规则 以及导致路由root分区变成只读之类的现象

怎么发现只读的，只读了之后怎么处理，回退到103就可以了吗？

luci界面修改完任何设置点击保存后不生效 依然显示“未保存的应用” ssh登录路由器创建\修改\删除文件提示只读的文件系统

解决方法当然不是单降级插件 这个只读是由于分区信息出错了造成的 需要用e2fsck工具 如果你的路由没装这个工具 软路由要一个u盘启动Linux liveCD或者把路由系统盘拆到Linux PC上完成 硬路由估计得直接重新刷了

我6.1.24的内核好像升级到过110，没出现这个问题，后来发现iptv看不了，又退回去了，如果系统目前能正常修改配置，那应该就是没受到影响。

ghost commented 1 year ago

112版本已修复