search

vernesong / OpenClash

A Clash Client For OpenWrt
MIT License
16.55k stars 3.06k forks source link

[Bug] fake-ip模式下。有一些分组，走到了direct本地直连上去了（有可能是设置问题跪求指点 #3543

Closed xiaolongzhou123 closed 9 months ago

xiaolongzhou123 commented 11 months ago

Verify Steps

OpenClash Version

v0.45.141-beta

Bug on Environment

Lean

Bug on Platform

Linux-amd64(x86-64)

To Reproduce

1.不能访问chat.openai.com，走本地直连了。规则中有走chatgpt分组

  1. 手机端ios.都是ok的
  2. 当不能访问的时候。电脑上edge，火狐。chrome都试过了。也是一样。都走本地直连了 4.有时候。又能正常访问。我看规则里面，是走chatgpt分组了。。

疑问：为啥有时候能，有什么不能

Describe the Bug

chat.openai.com访问这个网站的时候，有时候走chatgpt分组，有时候走本地直连。 走本地直连的时候，我看了目的ip，被解析成了：104.18.37.228(Cloudflare)

OpenClash Log

OpenClash 调试日志

生成时间: 2023-10-04 00:01:13 插件版本: v0.45.141-beta 隐私提示: 上传此日志前请注意检查、屏蔽公网IP、节点、密码等相关敏感信息


#===================== 系统信息 =====================#

主机型号: Intel(R) Client Systems NUC7i5BNH - Intel(R) Core(TM) i5-7260U CPU @ 2.20GHz : 2 Core 4 Thread
固件版本: OpenWrt SNAPSHOT r5804-e643c1b72
LuCI版本: git-23.198.59743-991daf5-1
内核版本: 5.15.98
处理器架构: x86_64

#此项有值时,如不使用IPv6,建议到网络-接口-lan的设置中禁用IPV6的DHCP
IPV6-DHCP: 

DNS劫持: Dnsmasq 转发
#DNS劫持为Dnsmasq时，此项结果应仅有配置文件的DNS监听地址
Dnsmasq转发设置: 127.0.0.1#7874

#===================== 依赖检查 =====================#

dnsmasq-full: 已安装
coreutils: 已安装
coreutils-nohup: 已安装
bash: 已安装
curl: 已安装
ca-certificates: 已安装
ipset: 已安装
ip-full: 已安装
libcap: 已安装
libcap-bin: 已安装
ruby: 已安装
ruby-yaml: 已安装
ruby-psych: 已安装
ruby-pstore: 已安装
kmod-tun(TUN模式): 已安装
luci-compat(Luci >= 19.07): 已安装
kmod-inet-diag(PROCESS-NAME): 未安装
unzip: 已安装
iptables-mod-tproxy: 已安装
kmod-ipt-tproxy: 已安装
iptables-mod-extra: 已安装
kmod-ipt-extra: 已安装
kmod-ipt-nat: 已安装

#===================== 内核检查 =====================#

运行状态: 运行中
运行内核：Meta
进程pid: 5580
运行权限: 5580: cap_dac_override,cap_net_bind_service,cap_net_admin,cap_net_raw,cap_sys_ptrace,cap_sys_resource=eip
运行用户: nobody
已选择的架构: linux-amd64

#下方无法显示内核版本号时请确认您的内核版本是否正确或者有无权限
Tun内核版本: 
Tun内核文件: 不存在
Tun内核运行权限: 否

Dev内核版本: v1.15.1-7-g6eee226
Dev内核文件: 存在
Dev内核运行权限: 正常

Meta内核版本: alpha-gefcb278
Meta内核文件: 存在
Meta内核运行权限: 正常

#===================== 插件设置 =====================#

当前配置文件: /etc/openclash/config/wgetcloud.yaml
启动配置文件: /etc/openclash/wgetcloud.yaml
运行模式: fake-ip
默认代理模式: rule
UDP流量转发(tproxy): 启用
自定义DNS: 启用
IPV6代理: 停用
IPV6-DNS解析: 停用
禁用Dnsmasq缓存: 启用
自定义规则: 停用
仅允许内网: 停用
仅代理命中规则流量: 停用
仅允许常用端口流量: 停用
绕过中国大陆IP: 停用
路由本机代理: 启用

#启动异常时建议关闭此项后重试
混合节点: 停用
保留配置: 停用

#启动异常时建议关闭此项后重试
第三方规则: 停用

#===================== 配置文件 =====================#

port: 7890
socks-port: 7891
allow-lan: true
mode: rule
log-level: info
external-controller: 0.0.0.0:9090
proxy-groups:
- name: "\U0001F530 节点选择"
  type: select
  proxies:
  - "♻️ 自动选择"
  - "\U0001F3AF 全球直连"
  - "\U0001F1ED\U0001F1F0 香港 01"
  - "\U0001F1EF\U0001F1F5 日本 01"
  - "\U0001F1EF\U0001F1F5 日本 02"
- name: "♻️ 自动选择"
  type: url-test
  url: http://www.gstatic.com/generate_204
  interval: 300
  proxies:
  - "\U0001F1ED\U0001F1F0 香港 01"
  - "\U0001F1ED\U0001F1F0 香港 02"
  - "\U0001F1ED\U0001F1F0 香港 03"
  - "\U0001F1EF\U0001F1F5 日本 03"
  - "\U0001F1F2\U0001F1FE 马来西亚 01 5"
- name: "\U0001F3A5 NETFLIX"
  type: select
  proxies:
  - "\U0001F530 节点选择"
  - "♻️ 自动选择"
  - "\U0001F3AF 全球直连"
  - "\U0001F1ED\U0001F1F0 香港 01"
  - "\U0001F1ED\U0001F1F0 香港 02"
  - "\U0001F1ED\U0001F1F0 香港 03"
- name: "\U0001F525 CHATGPT"
  type: select
  proxies:
  - "\U0001F530 节点选择"
  - "♻️ 自动选择"
  - "\U0001F3AF 全球直连"
  - "\U0001F1ED\U0001F1F0 香港 01"
  - "\U0001F1E8\U0001F1F3 台湾 01"
- name: "\U0001F525 YOUTUBE"
  type: select
  proxies:
  - "\U0001F530 节点选择"
  - "♻️ 自动选择"
  - "\U0001F3AF 全球直连"
  - "\U0001F1ED\U0001F1F0 香港 01"
- name: "\U0001F30D 国外媒体"
  type: select
  proxies:
  - "\U0001F530 节点选择"
  - "♻️ 自动选择"
  - "\U0001F3AF 全球直连"
  - "\U0001F1ED\U0001F1F0 香港 01"
  - "\U0001F1ED\U0001F1F0 香港 02"
  - "\U0001F1ED\U0001F1F0 香港 03"
  - "\U0001F1E8\U0001F1F3 台湾 01"
  - "\U0001F1E8\U0001F1F3 台湾 02"
- name: "\U0001F30F 国内媒体"
  type: select
  proxies:
  - "\U0001F3AF 全球直连"
  - "\U0001F1ED\U0001F1F0 香港 01"
  - "\U0001F1ED\U0001F1F0 香港 02"
  - "\U0001F1ED\U0001F1F0 香港 03 2"
  - "\U0001F530 节点选择"
- name: Ⓜ️ 微软服务
  type: select
  proxies:
  - "\U0001F3AF 全球直连"
  - "\U0001F530 节点选择"
  - "\U0001F1ED\U0001F1F0 香港 01"
  - "\U0001F1ED\U0001F1F0 香港 02"
- name: "\U0001F4F2 电报信息"
  type: select
  proxies:
  - "\U0001F530 节点选择"
  - "\U0001F3AF 全球直连"
  - "\U0001F1ED\U0001F1F0 香港 01"
  - "\U0001F1ED\U0001F1F0 香港 02"
  - "\U0001F1ED\U0001F1F0 香港 03"
  - "\U0001F1EF\U0001F1F5 日本 02"
  - "\U0001F1EF\U0001F1F5 日本 03"
- name: "\U0001F34E 苹果服务"
  type: select
  proxies:
  - "\U0001F530 节点选择"
  - "\U0001F3AF 全球直连"
  - "♻️ 自动选择"
  - "\U0001F1ED\U0001F1F0 香港 01"
  - "\U0001F1ED\U0001F1F0 香港 02"
  - "\U0001F1ED\U0001F1F0 香港 03"
  - "\U0001F1E8\U0001F1F3 台湾 01"
  - "\U0001F1E8\U0001F1F3 台湾 02"
- name: "\U0001F3AF 全球直连"
  type: select
  proxies:
  - DIRECT
- name: "\U0001F6D1 全球拦截"
  type: select
  proxies:
  - REJECT
  - DIRECT
- name: "\U0001F41F 漏网之鱼"
  type: select
  proxies:
  - "\U0001F530 节点选择"
  - "\U0001F3AF 全球直连"
  - "♻️ 自动选择"
  - "\U0001F1ED\U0001F1F0 香港 01"
  - "\U0001F1ED\U0001F1F0 香港 02"
  - "\U0001F1ED\U0001F1F0 香港 03"
  - "\U0001F1E8\U0001F1F3 台湾 01"
  - "\U0001F1E8\U0001F1F3 台湾 02"
rules:
- DST-PORT,7895,REJECT
- DST-PORT,7892,REJECT
- IP-CIDR,198.18.0.1/16,REJECT,no-resolve
- "DOMAIN-SUFFIX,local,\U0001F3AF 全球直连"
- "IP-CIDR,192.168.0.0/16,\U0001F3AF 全球直连,no-resolve"
- "IP-CIDR6,fc00::/7,\U0001F3AF 全球直连,no-resolve"
- "IP-CIDR6,fe80::/10,\U0001F3AF 全球直连,no-resolve"
- "IP-CIDR6,fd00::/8,\U0001F3AF 全球直连,no-resolve"
- DOMAIN-KEYWORD,1drv,Ⓜ️ 微软服务
- DOMAIN-KEYWORD,microsoft,Ⓜ️ 微软服务
- DOMAIN-SUFFIX,aadrm.com,Ⓜ️ 微软服务
- DOMAIN-SUFFIX,wunderlist.com,Ⓜ️ 微软服务
- DOMAIN-SUFFIX,yammer.com,Ⓜ️ 微软服务
- DOMAIN-SUFFIX,yammerusercontent.com,Ⓜ️ 微软服务
- DOMAIN-SUFFIX,bingapis.com,Ⓜ️ 微软服务
- "DOMAIN-SUFFIX,netflix.com,\U0001F3A5 NETFLIX"
- "DOMAIN-SUFFIX,netflix.net,\U0001F3A5 NETFLIX"
- "DOMAIN-KEYWORD,dualstack.apiproxy-,\U0001F3A5 NETFLIX"
- "DOMAIN-KEYWORD,dualstack.ichnaea-web-,\U0001F3A5 NETFLIX"
- "IP-CIDR,23.246.0.0/18,\U0001F3A5 NETFLIX,no-resolve"
- "IP-CIDR,37.77.184.0/21,\U0001F3A5 NETFLIX,no-resolve"
- "IP-CIDR,34.210.42.111/32,\U0001F3A5 NETFLIX,no-resolve"
- "IP-CIDR,52.89.124.203/32,\U0001F3A5 NETFLIX,no-resolve"
- "IP-CIDR,54.148.37.5/32,\U0001F3A5 NETFLIX,no-resolve"
- "DOMAIN-SUFFIX,openai.com,\U0001F525 CHATGPT"
- "DOMAIN,youtubei.googleapis.com,\U0001F525 YOUTUBE"
- "DOMAIN,yt3.ggpht.com,\U0001F525 YOUTUBE"
- "DOMAIN-SUFFIX,.youtube,\U0001F525 YOUTUBE"
- "DOMAIN-SUFFIX,ggpht.cn,\U0001F525 YOUTUBE"
- "DOMAIN-SUFFIX,youtube.com.bd,\U0001F525 YOUTUBE"
- "DOMAIN-SUFFIX,youtube.com.bh,\U0001F525 YOUTUBE"
- "DOMAIN-SUFFIX,yt.be,\U0001F525 YOUTUBE"
- "DOMAIN-SUFFIX,ytimg.com,\U0001F525 YOUTUBE"
- "DOMAIN-KEYWORD,youtube,\U0001F525 YOUTUBE"
- "IP-CIDR,172.110.32.0/21,\U0001F525 YOUTUBE,no-resolve"
- "IP-CIDR,216.73.80.0/20,\U0001F525 YOUTUBE,no-resolve"
- "IP-CIDR6,2620:120:e000::/40,\U0001F525 YOUTUBE,no-resolve"
- "DOMAIN-SUFFIX,jtvnw.net,\U0001F30D 国外媒体"
- "DOMAIN-SUFFIX,ttvnw.net,\U0001F30D 国外媒体"
- "DOMAIN-SUFFIX,viu.com,\U0001F30D 国外媒体"
- "DOMAIN-SUFFIX,viu.tv,\U0001F30D 国外媒体"
- "DOMAIN,youtubei.googleapis.com,\U0001F30D 国外媒体"
- "DOMAIN,yt3.ggpht.com,\U0001F30D 国外媒体"
- "DOMAIN-SUFFIX,acg.tv,\U0001F30F 国内媒体"
- "DOMAIN-SUFFIX,acgvideo.com,\U0001F30F 国内媒体"
- "DOMAIN-SUFFIX,b23.tv,\U0001F30F 国内媒体"
- "DOMAIN-SUFFIX,bilibili.com,\U0001F30F 国内媒体"
- "IP-CIDR,23.40.241.251/32,\U0001F30F 国内媒体,no-resolve"
- "IP-CIDR,23.40.242.10/32,\U0001F30F 国内媒体,no-resolve"
- "DOMAIN-SUFFIX,api.mob.app.letv.com,\U0001F30F 国内媒体"
- "DOMAIN-SUFFIX,v.smtcdns.com,\U0001F30F 国内媒体"
- "DOMAIN-SUFFIX,vv.video.qq.com,\U0001F30F 国内媒体"
- "DOMAIN-SUFFIX,youku.com,\U0001F30F 国内媒体"
- "IP-CIDR,106.11.0.0/16,\U0001F30F 国内媒体,no-resolve"
- "DOMAIN-SUFFIX,t.me,\U0001F4F2 电报信息"
- "DOMAIN-SUFFIX,tdesktop.com,\U0001F4F2 电报信息"
- "DOMAIN-SUFFIX,telegra.ph,\U0001F4F2 电报信息"
- "IP-CIDR6,2001:b28:f23c::/48,\U0001F4F2 电报信息,no-resolve"
- "IP-CIDR6,2a0a:f280::/32,\U0001F4F2 电报信息,no-resolve"
- "DOMAIN-SUFFIX,amazon.co.jp,\U0001F530 节点选择"
- "DOMAIN,d3c33hcgiwev3.cloudfront.net,\U0001F530 节点选择"
- "DOMAIN,payments-jp.amazon.com,\U0001F530 节点选择"
- "DOMAIN-SUFFIX,zaobao.com.sg,\U0001F530 节点选择"
- "DOMAIN,international-gfe.download.nvidia.com,\U0001F530 节点选择"
- "DOMAIN-SUFFIX,aaplimg.com,\U0001F34E 苹果服务"
- "DOMAIN-SUFFIX,apple.co,\U0001F34E 苹果服务"
- "DOMAIN-SUFFIX,mzstatic.com,\U0001F34E 苹果服务"
- "DOMAIN-KEYWORD,apple.com.akadns.net,\U0001F34E 苹果服务"
- "DOMAIN-KEYWORD,icloud.com.akadns.net,\U0001F34E 苹果服务"
- "IP-CIDR,17.0.0.0/8,\U0001F34E 苹果服务,no-resolve"
- "IP-CIDR,63.92.224.0/19,\U0001F34E 苹果服务,no-resolve"
- "IP-CIDR,205.180.175.0/24,\U0001F34E 苹果服务,no-resolve"
- "DOMAIN-SUFFIX,zenki.cn,\U0001F3AF 全球直连"
- "DOMAIN-KEYWORD,yunpan,\U0001F3AF 全球直连"
- "DOMAIN-KEYWORD,Thunder,\U0001F3AF 全球直连"
- "DOMAIN-KEYWORD,XLLiveUD,\U0001F3AF 全球直连"
- "GEOIP,CN,\U0001F3AF 全球直连"
- "MATCH,\U0001F41F 漏网之鱼"
redir-port: 7892
tproxy-port: 7895
mixed-port: 7893
bind-address: "*"
external-ui: "/usr/share/openclash/ui"
ipv6: false
geodata-mode: true
geodata-loader: standard
tcp-concurrent: true
dns:
  enable: true
  ipv6: false
  enhanced-mode: fake-ip
  fake-ip-range: 198.18.0.1/16
  listen: 0.0.0.0:7874
  nameserver:
  - 202.106.195.68
  fallback:
  - https://dns.cloudflare.com/dns-query
  - https://public.dns.iij.jp/dns-query
  - https://dns.oszx.co/dns-query
sniffer:
  enable: true
profile:
  store-selected: true
authentication:
- Clash:n8VvRAAv

#===================== 自定义覆写设置 =====================#

#!/bin/sh
. /usr/share/openclash/ruby.sh
. /usr/share/openclash/log.sh
. /lib/functions.sh

# This script is called by /etc/init.d/openclash
# Add your custom overwrite scripts here, they will be take effict after the OpenClash own srcipts

LOG_OUT "Tip: Start Running Custom Overwrite Scripts..."
LOGTIME=$(echo $(date "+%Y-%m-%d %H:%M:%S"))
LOG_FILE="/tmp/openclash.log"
CONFIG_FILE="$1" #config path

exit 0
#===================== 自定义防火墙设置 =====================#

#!/bin/sh
. /usr/share/openclash/log.sh
. /lib/functions.sh

# This script is called by /etc/init.d/openclash
# Add your custom firewall rules here, they will be added after the end of the OpenClash iptables rules

LOG_OUT "Tip: Start Add Custom Firewall Rules..."

exit 0
#===================== IPTABLES 防火墙设置 =====================#

#IPv4 NAT chain

# Generated by iptables-save v1.8.7 on Wed Oct  4 00:01:14 2023
*nat
:PREROUTING ACCEPT [268:51157]
:INPUT ACCEPT [920:88662]
:OUTPUT ACCEPT [1569:131134]
:POSTROUTING ACCEPT [1747:141696]
:DOCKER - [0:0]
:MINIUPNPD - [0:0]
:MINIUPNPD-POSTROUTING - [0:0]
:openclash - [0:0]
:openclash_output - [0:0]
:postrouting_lan_rule - [0:0]
:postrouting_rule - [0:0]
:postrouting_vpn_rule - [0:0]
:prerouting_lan_rule - [0:0]
:prerouting_rule - [0:0]
:prerouting_vpn_rule - [0:0]
:zone_lan_postrouting - [0:0]
:zone_lan_prerouting - [0:0]
:zone_vpn_postrouting - [0:0]
:zone_vpn_prerouting - [0:0]
-A PREROUTING -d 8.8.4.4/32 -p tcp -m comment --comment "OpenClash Google DNS Hijack" -m tcp --dport 53 -j REDIRECT --to-ports 7892
-A PREROUTING -d 8.8.8.8/32 -p tcp -m comment --comment "OpenClash Google DNS Hijack" -m tcp --dport 53 -j REDIRECT --to-ports 7892
-A PREROUTING -p tcp -m tcp --dport 53 -m comment --comment "OpenClash DNS Hijack" -j REDIRECT --to-ports 53
-A PREROUTING -p udp -m udp --dport 53 -m comment --comment "OpenClash DNS Hijack" -j REDIRECT --to-ports 53
-A PREROUTING -p udp -m udp --dport 53 -j REDIRECT --to-ports 53
-A PREROUTING -p tcp -m tcp --dport 53 -j REDIRECT --to-ports 53
-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER
-A PREROUTING -m comment --comment "!fw3: Custom prerouting rule chain" -j prerouting_rule
-A PREROUTING -i eth0 -m comment --comment "!fw3" -j zone_lan_prerouting
-A PREROUTING -i tun0 -m comment --comment "!fw3" -j zone_vpn_prerouting
-A PREROUTING -p tcp -j openclash
-A OUTPUT ! -d 127.0.0.0/8 -m addrtype --dst-type LOCAL -j DOCKER
-A OUTPUT -j openclash_output
-A POSTROUTING -s 172.22.0.0/16 ! -o br-631d0ee64951 -j MASQUERADE
-A POSTROUTING -s 172.17.0.0/16 ! -o docker0 -j MASQUERADE
-A POSTROUTING -s 172.22.0.5/32 -d 172.22.0.5/32 -p tcp -m tcp --dport 80 -j MASQUERADE
-A POSTROUTING -s 172.22.0.7/32 -d 172.22.0.7/32 -p tcp -m tcp --dport 80 -j MASQUERADE
-A POSTROUTING -s 172.22.0.8/32 -d 172.22.0.8/32 -p tcp -m tcp --dport 20005 -j MASQUERADE
-A POSTROUTING -m comment --comment "!fw3: Custom postrouting rule chain" -j postrouting_rule
-A POSTROUTING -o eth0 -m comment --comment "!fw3" -j zone_lan_postrouting
-A POSTROUTING -o tun0 -m comment --comment "!fw3" -j zone_vpn_postrouting
-A DOCKER -i br-631d0ee64951 -j RETURN
-A DOCKER -i docker0 -j RETURN
-A DOCKER ! -i br-631d0ee64951 -p tcp -m tcp --dport 9009 -j DNAT --to-destination 172.22.0.5:80
-A DOCKER ! -i br-631d0ee64951 -p tcp -m tcp --dport 9998 -j DNAT --to-destination 172.22.0.7:80
-A DOCKER ! -i br-631d0ee64951 -p tcp -m tcp --dport 20005 -j DNAT --to-destination 172.22.0.8:20005
-A openclash -m set --match-set localnetwork dst -j RETURN
-A openclash -d 198.18.0.0/16 -p tcp -j REDIRECT --to-ports 7892
-A openclash -m set --match-set localnetwork src -m set --match-set lan_ac_black_ports src -j RETURN
-A openclash -p tcp -j REDIRECT --to-ports 7892
-A openclash_output -d 198.18.0.0/16 -p tcp -m owner ! --uid-owner 65534 -j REDIRECT --to-ports 7892
-A openclash_output -m set --match-set localnetwork dst -j RETURN
-A openclash_output -m set --match-set localnetwork src -m set --match-set lan_ac_black_ports src -j RETURN
-A openclash_output -p tcp -m owner ! --uid-owner 65534 -j REDIRECT --to-ports 7892
-A zone_lan_postrouting -j MINIUPNPD-POSTROUTING
-A zone_lan_postrouting -m comment --comment "!fw3: Custom lan postrouting rule chain" -j postrouting_lan_rule
-A zone_lan_prerouting -j MINIUPNPD
-A zone_lan_prerouting -m comment --comment "!fw3: Custom lan prerouting rule chain" -j prerouting_lan_rule
-A zone_vpn_postrouting -m comment --comment "!fw3: Custom vpn postrouting rule chain" -j postrouting_vpn_rule
-A zone_vpn_postrouting -m comment --comment "!fw3" -j MASQUERADE --mode fullcone
-A zone_vpn_prerouting -m comment --comment "!fw3: Custom vpn prerouting rule chain" -j prerouting_vpn_rule
COMMIT
# Completed on Wed Oct  4 00:01:14 2023

#IPv4 Mangle chain

# Generated by iptables-save v1.8.7 on Wed Oct  4 00:01:14 2023
*mangle
:PREROUTING ACCEPT [53200:22063632]
:INPUT ACCEPT [48108:21591121]
:FORWARD ACCEPT [5433:697651]
:OUTPUT ACCEPT [44191:38672709]
:POSTROUTING ACCEPT [49623:39370667]
:openclash - [0:0]
:openclash_output - [0:0]
:openclash_upnp - [0:0]
:qos_Default - [0:0]
:qos_Default_ct - [0:0]
-A PREROUTING -p udp -j openclash
-A OUTPUT -p udp -j openclash_output
-A openclash -i lo -j RETURN
-A openclash -m set --match-set localnetwork dst -j RETURN
-A openclash -p udp -m udp --dport 53 -j RETURN
-A openclash -d 198.18.0.0/16 -p udp -j TPROXY --on-port 7895 --on-ip 0.0.0.0 --tproxy-mark 0x162/0xffffffff
-A openclash -m set --match-set localnetwork src -m set --match-set lan_ac_black_ports src -j RETURN
-A openclash -p udp -j openclash_upnp
-A openclash -p udp -j TPROXY --on-port 7895 --on-ip 0.0.0.0 --tproxy-mark 0x162/0xffffffff
-A openclash_output -d 198.18.0.0/16 -p udp -m owner ! --uid-owner 65534 -j MARK --set-xmark 0x162/0xffffffff
-A qos_Default -j CONNMARK --restore-mark --nfmask 0xf --ctmask 0xf
-A qos_Default -m mark --mark 0x0/0xf -j qos_Default_ct
-A qos_Default -p udp -m mark --mark 0x0/0xf0 -m length --length 0:500 -j MARK --set-xmark 0x22/0xff
-A qos_Default -p icmp -j MARK --set-xmark 0x11/0xff
-A qos_Default -p tcp -m mark --mark 0x0/0xf0 -m tcp --sport 1024:65535 --dport 1024:65535 -j MARK --set-xmark 0x44/0xff
-A qos_Default -p udp -m mark --mark 0x0/0xf0 -m udp --sport 1024:65535 --dport 1024:65535 -j MARK --set-xmark 0x44/0xff
-A qos_Default -j CONNMARK --save-mark --nfmask 0xff --ctmask 0xff
-A qos_Default_ct -p tcp -m mark --mark 0x0/0xf -m tcp -m multiport --ports 22,53 -m comment --comment "ssh, dns" -j MARK --set-xmark 0x11/0xff
-A qos_Default_ct -p udp -m mark --mark 0x0/0xf -m udp -m multiport --ports 22,53 -m comment --comment "ssh, dns" -j MARK --set-xmark 0x11/0xff
-A qos_Default_ct -p tcp -m mark --mark 0x0/0xf -m tcp -m multiport --ports 20,21,25,80,110,443,993,995 -m comment --comment "ftp, smtp, http(s), imap" -j MARK --set-xmark 0x33/0xff
-A qos_Default_ct -p tcp -m mark --mark 0x0/0xf -m tcp -m multiport --ports 5190 -m comment --comment "AOL, iChat, ICQ" -j MARK --set-xmark 0x22/0xff
-A qos_Default_ct -p udp -m mark --mark 0x0/0xf -m udp -m multiport --ports 5190 -m comment --comment "AOL, iChat, ICQ" -j MARK --set-xmark 0x22/0xff
-A qos_Default_ct -j CONNMARK --save-mark --nfmask 0xff --ctmask 0xff
COMMIT
# Completed on Wed Oct  4 00:01:14 2023

#IPv4 Filter chain

# Generated by iptables-save v1.8.7 on Wed Oct  4 00:01:14 2023
*filter
:INPUT ACCEPT [21:905]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [0:0]
:DOCKER - [0:0]
:DOCKER-ISOLATION-STAGE-1 - [0:0]
:DOCKER-ISOLATION-STAGE-2 - [0:0]
:DOCKER-MAN - [0:0]
:DOCKER-USER - [0:0]
:MINIUPNPD - [0:0]
:forwarding_lan_rule - [0:0]
:forwarding_rule - [0:0]
:forwarding_vpn_rule - [0:0]
:input_lan_rule - [0:0]
:input_rule - [0:0]
:input_vpn_rule - [0:0]
:output_lan_rule - [0:0]
:output_rule - [0:0]
:output_vpn_rule - [0:0]
:reject - [0:0]
:syn_flood - [0:0]
:zone_lan_dest_ACCEPT - [0:0]
:zone_lan_forward - [0:0]
:zone_lan_input - [0:0]
:zone_lan_output - [0:0]
:zone_lan_src_ACCEPT - [0:0]
:zone_vpn_dest_ACCEPT - [0:0]
:zone_vpn_forward - [0:0]
:zone_vpn_input - [0:0]
:zone_vpn_output - [0:0]
:zone_vpn_src_ACCEPT - [0:0]
-A INPUT -i lo -m comment --comment "!fw3" -j ACCEPT
-A INPUT -m comment --comment "!fw3: Custom input rule chain" -j input_rule
-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment "!fw3" -j ACCEPT
-A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -m comment --comment "!fw3" -j syn_flood
-A INPUT -i eth0 -m comment --comment "!fw3" -j zone_lan_input
-A INPUT -i tun0 -m comment --comment "!fw3" -j zone_vpn_input
-A FORWARD -j DOCKER-USER
-A FORWARD -j DOCKER-ISOLATION-STAGE-1
-A FORWARD -o br-631d0ee64951 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -o br-631d0ee64951 -j DOCKER
-A FORWARD -i br-631d0ee64951 ! -o br-631d0ee64951 -j ACCEPT
-A FORWARD -i br-631d0ee64951 -o br-631d0ee64951 -j ACCEPT
-A FORWARD -o docker0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -o docker0 -j DOCKER
-A FORWARD -i docker0 ! -o docker0 -j ACCEPT
-A FORWARD -i docker0 -o docker0 -j ACCEPT
-A FORWARD -m comment --comment "!fw3: Custom forwarding rule chain" -j forwarding_rule
-A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment "!fw3" -j ACCEPT
-A FORWARD -i eth0 -m comment --comment "!fw3" -j zone_lan_forward
-A FORWARD -i tun0 -m comment --comment "!fw3" -j zone_vpn_forward
-A FORWARD -m comment --comment "!fw3" -j reject
-A OUTPUT -o lo -m comment --comment "!fw3" -j ACCEPT
-A OUTPUT -m comment --comment "!fw3: Custom output rule chain" -j output_rule
-A OUTPUT -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment "!fw3" -j ACCEPT
-A OUTPUT -o eth0 -m comment --comment "!fw3" -j zone_lan_output
-A OUTPUT -o tun0 -m comment --comment "!fw3" -j zone_vpn_output
-A DOCKER -d 172.22.0.5/32 ! -i br-631d0ee64951 -o br-631d0ee64951 -p tcp -m tcp --dport 80 -j ACCEPT
-A DOCKER -d 172.22.0.7/32 ! -i br-631d0ee64951 -o br-631d0ee64951 -p tcp -m tcp --dport 80 -j ACCEPT
-A DOCKER -d 172.22.0.8/32 ! -i br-631d0ee64951 -o br-631d0ee64951 -p tcp -m tcp --dport 20005 -j ACCEPT
-A DOCKER-ISOLATION-STAGE-1 -i br-631d0ee64951 ! -o br-631d0ee64951 -j DOCKER-ISOLATION-STAGE-2
-A DOCKER-ISOLATION-STAGE-1 -i docker0 ! -o docker0 -j DOCKER-ISOLATION-STAGE-2
-A DOCKER-ISOLATION-STAGE-1 -j RETURN
-A DOCKER-ISOLATION-STAGE-2 -o br-631d0ee64951 -j DROP
-A DOCKER-ISOLATION-STAGE-2 -o docker0 -j DROP
-A DOCKER-ISOLATION-STAGE-2 -j RETURN
-A DOCKER-MAN -i br-lan -o docker0 -j RETURN
-A DOCKER-MAN -o docker0 -m conntrack --ctstate RELATED,ESTABLISHED -j RETURN
-A DOCKER-MAN -o docker0 -m conntrack --ctstate INVALID,NEW -j DROP
-A DOCKER-MAN -j RETURN
-A DOCKER-USER -j DOCKER-MAN
-A DOCKER-USER -j RETURN
-A reject -p tcp -m comment --comment "!fw3" -j REJECT --reject-with tcp-reset
-A reject -m comment --comment "!fw3" -j REJECT --reject-with icmp-port-unreachable
-A syn_flood -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -m limit --limit 25/sec --limit-burst 50 -m comment --comment "!fw3" -j RETURN
-A syn_flood -m comment --comment "!fw3" -j DROP
-A zone_lan_dest_ACCEPT -o eth0 -m comment --comment "!fw3" -j ACCEPT
-A zone_lan_forward -j MINIUPNPD
-A zone_lan_forward -m comment --comment "!fw3: Custom lan forwarding rule chain" -j forwarding_lan_rule
-A zone_lan_forward -p tcp -m comment --comment "!fw3: a" -j ACCEPT
-A zone_lan_forward -p udp -m comment --comment "!fw3: a" -j ACCEPT
-A zone_lan_forward -m comment --comment "!fw3: Zone lan to vpn forwarding policy" -j zone_vpn_dest_ACCEPT
-A zone_lan_forward -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port forwards" -j ACCEPT
-A zone_lan_forward -m comment --comment "!fw3" -j zone_lan_dest_ACCEPT
-A zone_lan_input -m comment --comment "!fw3: Custom lan input rule chain" -j input_lan_rule
-A zone_lan_input -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port redirections" -j ACCEPT
-A zone_lan_input -m comment --comment "!fw3" -j zone_lan_src_ACCEPT
-A zone_lan_output -m comment --comment "!fw3: Custom lan output rule chain" -j output_lan_rule
-A zone_lan_output -m comment --comment "!fw3" -j zone_lan_dest_ACCEPT
-A zone_lan_src_ACCEPT -i eth0 -m conntrack --ctstate NEW,UNTRACKED -m comment --comment "!fw3" -j ACCEPT
-A zone_vpn_dest_ACCEPT -o tun0 -m conntrack --ctstate INVALID -m comment --comment "!fw3: Prevent NAT leakage" -j DROP
-A zone_vpn_dest_ACCEPT -o tun0 -m comment --comment "!fw3" -j ACCEPT
-A zone_vpn_forward -m comment --comment "!fw3: Custom vpn forwarding rule chain" -j forwarding_vpn_rule
-A zone_vpn_forward -m comment --comment "!fw3: Zone vpn to lan forwarding policy" -j zone_lan_dest_ACCEPT
-A zone_vpn_forward -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port forwards" -j ACCEPT
-A zone_vpn_forward -m comment --comment "!fw3" -j zone_vpn_dest_ACCEPT
-A zone_vpn_input -m comment --comment "!fw3: Custom vpn input rule chain" -j input_vpn_rule
-A zone_vpn_input -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port redirections" -j ACCEPT
-A zone_vpn_input -m comment --comment "!fw3" -j zone_vpn_src_ACCEPT
-A zone_vpn_output -m comment --comment "!fw3: Custom vpn output rule chain" -j output_vpn_rule
-A zone_vpn_output -m comment --comment "!fw3" -j zone_vpn_dest_ACCEPT
-A zone_vpn_src_ACCEPT -i tun0 -m conntrack --ctstate NEW,UNTRACKED -m comment --comment "!fw3" -j ACCEPT
COMMIT
# Completed on Wed Oct  4 00:01:14 2023

#IPv6 NAT chain

# Generated by ip6tables-save v1.8.7 on Wed Oct  4 00:01:14 2023
*nat
:PREROUTING ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:OUTPUT ACCEPT [174:32856]
:POSTROUTING ACCEPT [174:32856]
-A PREROUTING -p udp -m udp --dport 53 -j REDIRECT --to-ports 53
-A PREROUTING -p tcp -m tcp --dport 53 -j REDIRECT --to-ports 53
COMMIT
# Completed on Wed Oct  4 00:01:14 2023

#IPv6 Mangle chain

# Generated by ip6tables-save v1.8.7 on Wed Oct  4 00:01:14 2023
*mangle
:PREROUTING ACCEPT [232:21917]
:INPUT ACCEPT [232:21917]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [232:21917]
:POSTROUTING ACCEPT [232:21917]
:qos_Default - [0:0]
:qos_Default_ct - [0:0]
-A qos_Default -j CONNMARK --restore-mark --nfmask 0xf --ctmask 0xf
-A qos_Default -m mark --mark 0x0/0xf -j qos_Default_ct
-A qos_Default -p udp -m mark --mark 0x0/0xf0 -m length --length 0:500 -j MARK --set-xmark 0x22/0xff
-A qos_Default -p icmp -j MARK --set-xmark 0x11/0xff
-A qos_Default -p tcp -m mark --mark 0x0/0xf0 -m tcp --sport 1024:65535 --dport 1024:65535 -j MARK --set-xmark 0x44/0xff
-A qos_Default -p udp -m mark --mark 0x0/0xf0 -m udp --sport 1024:65535 --dport 1024:65535 -j MARK --set-xmark 0x44/0xff
-A qos_Default -j CONNMARK --save-mark --nfmask 0xff --ctmask 0xff
-A qos_Default_ct -p tcp -m mark --mark 0x0/0xf -m tcp -m multiport --ports 22,53 -m comment --comment "ssh, dns" -j MARK --set-xmark 0x11/0xff
-A qos_Default_ct -p udp -m mark --mark 0x0/0xf -m udp -m multiport --ports 22,53 -m comment --comment "ssh, dns" -j MARK --set-xmark 0x11/0xff
-A qos_Default_ct -p tcp -m mark --mark 0x0/0xf -m tcp -m multiport --ports 20,21,25,80,110,443,993,995 -m comment --comment "ftp, smtp, http(s), imap" -j MARK --set-xmark 0x33/0xff
-A qos_Default_ct -p tcp -m mark --mark 0x0/0xf -m tcp -m multiport --ports 5190 -m comment --comment "AOL, iChat, ICQ" -j MARK --set-xmark 0x22/0xff
-A qos_Default_ct -p udp -m mark --mark 0x0/0xf -m udp -m multiport --ports 5190 -m comment --comment "AOL, iChat, ICQ" -j MARK --set-xmark 0x22/0xff
-A qos_Default_ct -j CONNMARK --save-mark --nfmask 0xff --ctmask 0xff
COMMIT
# Completed on Wed Oct  4 00:01:14 2023

#IPv6 Filter chain

# Generated by ip6tables-save v1.8.7 on Wed Oct  4 00:01:14 2023
*filter
:INPUT ACCEPT [0:0]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [0:0]
:MINIUPNPD - [0:0]
:forwarding_lan_rule - [0:0]
:forwarding_rule - [0:0]
:forwarding_vpn_rule - [0:0]
:input_lan_rule - [0:0]
:input_rule - [0:0]
:input_vpn_rule - [0:0]
:output_lan_rule - [0:0]
:output_rule - [0:0]
:output_vpn_rule - [0:0]
:reject - [0:0]
:syn_flood - [0:0]
:zone_lan_dest_ACCEPT - [0:0]
:zone_lan_forward - [0:0]
:zone_lan_input - [0:0]
:zone_lan_output - [0:0]
:zone_lan_src_ACCEPT - [0:0]
:zone_vpn_dest_ACCEPT - [0:0]
:zone_vpn_forward - [0:0]
:zone_vpn_input - [0:0]
:zone_vpn_output - [0:0]
:zone_vpn_src_ACCEPT - [0:0]
-A INPUT -i lo -m comment --comment "!fw3" -j ACCEPT
-A INPUT -m comment --comment "!fw3: Custom input rule chain" -j input_rule
-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment "!fw3" -j ACCEPT
-A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -m comment --comment "!fw3" -j syn_flood
-A INPUT -i eth0 -m comment --comment "!fw3" -j zone_lan_input
-A INPUT -i tun0 -m comment --comment "!fw3" -j zone_vpn_input
-A FORWARD -m comment --comment "!fw3: Custom forwarding rule chain" -j forwarding_rule
-A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment "!fw3" -j ACCEPT
-A FORWARD -i eth0 -m comment --comment "!fw3" -j zone_lan_forward
-A FORWARD -i tun0 -m comment --comment "!fw3" -j zone_vpn_forward
-A FORWARD -m comment --comment "!fw3" -j reject
-A OUTPUT -o lo -m comment --comment "!fw3" -j ACCEPT
-A OUTPUT -m comment --comment "!fw3: Custom output rule chain" -j output_rule
-A OUTPUT -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment "!fw3" -j ACCEPT
-A OUTPUT -o eth0 -m comment --comment "!fw3" -j zone_lan_output
-A OUTPUT -o tun0 -m comment --comment "!fw3" -j zone_vpn_output
-A reject -p tcp -m comment --comment "!fw3" -j REJECT --reject-with tcp-reset
-A reject -m comment --comment "!fw3" -j REJECT --reject-with icmp6-port-unreachable
-A syn_flood -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -m limit --limit 25/sec --limit-burst 50 -m comment --comment "!fw3" -j RETURN
-A syn_flood -m comment --comment "!fw3" -j DROP
-A zone_lan_dest_ACCEPT -o eth0 -m comment --comment "!fw3" -j ACCEPT
-A zone_lan_forward -j MINIUPNPD
-A zone_lan_forward -m comment --comment "!fw3: Custom lan forwarding rule chain" -j forwarding_lan_rule
-A zone_lan_forward -m comment --comment "!fw3: Zone lan to vpn forwarding policy" -j zone_vpn_dest_ACCEPT
-A zone_lan_forward -m comment --comment "!fw3" -j zone_lan_dest_ACCEPT
-A zone_lan_input -m comment --comment "!fw3: Custom lan input rule chain" -j input_lan_rule
-A zone_lan_input -m comment --comment "!fw3" -j zone_lan_src_ACCEPT
-A zone_lan_output -m comment --comment "!fw3: Custom lan output rule chain" -j output_lan_rule
-A zone_lan_output -m comment --comment "!fw3" -j zone_lan_dest_ACCEPT
-A zone_lan_src_ACCEPT -i eth0 -m conntrack --ctstate NEW,UNTRACKED -m comment --comment "!fw3" -j ACCEPT
-A zone_vpn_dest_ACCEPT -o tun0 -m conntrack --ctstate INVALID -m comment --comment "!fw3: Prevent NAT leakage" -j DROP
-A zone_vpn_dest_ACCEPT -o tun0 -m comment --comment "!fw3" -j ACCEPT
-A zone_vpn_forward -m comment --comment "!fw3: Custom vpn forwarding rule chain" -j forwarding_vpn_rule
-A zone_vpn_forward -m comment --comment "!fw3: Zone vpn to lan forwarding policy" -j zone_lan_dest_ACCEPT
-A zone_vpn_forward -m comment --comment "!fw3" -j zone_vpn_dest_ACCEPT
-A zone_vpn_input -m comment --comment "!fw3: Custom vpn input rule chain" -j input_vpn_rule
-A zone_vpn_input -m comment --comment "!fw3" -j zone_vpn_src_ACCEPT
-A zone_vpn_output -m comment --comment "!fw3: Custom vpn output rule chain" -j output_vpn_rule
-A zone_vpn_output -m comment --comment "!fw3" -j zone_vpn_dest_ACCEPT
-A zone_vpn_src_ACCEPT -i tun0 -m conntrack --ctstate NEW,UNTRACKED -m comment --comment "!fw3" -j ACCEPT
COMMIT
# Completed on Wed Oct  4 00:01:14 2023

#===================== IPSET状态 =====================#
Name: mwan3_connected_v4
Type: hash:net
Revision: 7
Header: family inet hashsize 1024 maxelem 65536 bucketsize 12 initval 0xa58f6a12
Size in memory: 944
References: 1
Number of entries: 10

Name: lan_ac_black_ports
Type: bitmap:port
Revision: 3
Header: range 0-65535
Size in memory: 8272
References: 3
Number of entries: 1

Name: localnetwork
Type: hash:net
Revision: 7
Header: family inet hashsize 1024 maxelem 65536 bucketsize 12 initval 0x4ed816b6
Size in memory: 896
References: 6
Number of entries: 9

#===================== 路由表状态 =====================#

#IPv4

#route -n
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         192.168.24.1    0.0.0.0         UG    0      0        0 eth0
172.17.0.0      0.0.0.0         255.255.0.0     U     0      0        0 docker0
172.22.0.0      0.0.0.0         255.255.0.0     U     0      0        0 br-631d0ee64951
192.168.24.0    0.0.0.0         255.255.255.0   U     0      0        0 eth0

#ip route list
default via 192.168.24.1 dev eth0 proto static 
172.17.0.0/16 dev docker0 proto kernel scope link src 172.17.0.1 linkdown 
172.22.0.0/16 dev br-631d0ee64951 proto kernel scope link src 172.22.0.1 
192.168.24.0/24 dev eth0 proto kernel scope link src 192.168.24.2 

#ip rule show
0:  from all lookup local
219:    from all fwmark 0x162 lookup 354
220:    from all lookup 220
32766:  from all lookup main
32767:  from all lookup default

#IPv6

#route -A inet6
Kernel IPv6 routing table
Destination                                 Next Hop                                Flags Metric Ref    Use Iface
::/0                                        ::                                      !n    -1     1        0 lo      
fe80::/64                                   ::                                      U     256    1        0 ipsec0  
fe80::/64                                   ::                                      U     256    1        0 eth0    
fe80::/64                                   ::                                      U     256    1        0 br-631d0ee64951
fe80::/64                                   ::                                      U     256    1        0 vethd297b29
fe80::/64                                   ::                                      U     256    1        0 veth5173f32
fe80::/64                                   ::                                      U     256    1        0 vethdba6b59
fe80::/64                                   ::                                      U     256    1        0 veth4becd55
fe80::/64                                   ::                                      U     256    1        0 vethc4796f6
fe80::/64                                   ::                                      U     256    1        0 veth45cc2c7
fe80::/64                                   ::                                      U     256    1        0 veth01f9b57
::/0                                        ::                                      !n    -1     1        0 lo      
::1/128                                     ::                                      Un    0      6        0 lo      
fe80::/128                                  ::                                      Un    0      7        0 ipsec0  
fe80::/128                                  ::                                      Un    0      3        0 eth0    
fe80::/128                                  ::                                      Un    0      3        0 vethd297b29
fe80::/128                                  ::                                      Un    0      3        0 br-631d0ee64951
fe80::/128                                  ::                                      Un    0      3        0 veth4becd55
fe80::/128                                  ::                                      Un    0      3        0 vethdba6b59
fe80::/128                                  ::                                      Un    0      3        0 veth5173f32
fe80::/128                                  ::                                      Un    0      3        0 vethc4796f6
fe80::/128                                  ::                                      Un    0      3        0 veth45cc2c7
fe80::/128                                  ::                                      Un    0      3        0 veth01f9b57
fe80::42:c2ff:fe6a:cd79/128                 ::                                      Un    0      2        0 br-631d0ee64951
fe80::28cf:1cff:fe8b:af4a/128               ::                                      Un    0      2        0 veth5173f32
fe80::3c6e:3dff:fe2b:4bca/128               ::                                      Un    0      3        0 veth4becd55
fe80::4c1e:f0ff:fe83:7f49/128               ::                                      Un    0      2        0 veth45cc2c7
fe80::6c36:b3ff:fe0d:70d/128                ::                                      Un    0      4        0 vethd297b29
fe80::708c:8bff:fe2d:7ca/128                ::                                      Un    0      2        0 vethc4796f6
fe80::96c6:91ff:fea8:4180/128               ::                                      Un    0      4        0 eth0    
fe80::a8a5:d3ff:feb9:a068/128               ::                                      Un    0      2        0 veth01f9b57
fe80::c641:b1bf:93cd:88db/128               ::                                      Un    0      3        0 ipsec0  
fe80::fc6c:b2ff:fee5:e033/128               ::                                      Un    0      2        0 vethdba6b59
ff00::/8                                    ::                                      U     256    5        0 ipsec0  
ff00::/8                                    ::                                      U     256    5        0 eth0    
ff00::/8                                    ::                                      U     256    5        0 br-631d0ee64951
ff00::/8                                    ::                                      U     256    5        0 vethd297b29
ff00::/8                                    ::                                      U     256    4        0 veth5173f32
ff00::/8                                    ::                                      U     256    4        0 vethdba6b59
ff00::/8                                    ::                                      U     256    4        0 veth4becd55
ff00::/8                                    ::                                      U     256    4        0 vethc4796f6
ff00::/8                                    ::                                      U     256    3        0 veth45cc2c7
ff00::/8                                    ::                                      U     256    2        0 veth01f9b57
::/0                                        ::                                      !n    -1     1        0 lo      

#ip -6 route list
fe80::/64 dev ipsec0 proto kernel metric 256 pref medium
fe80::/64 dev eth0 proto kernel metric 256 pref medium
fe80::/64 dev br-631d0ee64951 proto kernel metric 256 pref medium
fe80::/64 dev vethd297b29 proto kernel metric 256 pref medium
fe80::/64 dev veth5173f32 proto kernel metric 256 pref medium
fe80::/64 dev vethdba6b59 proto kernel metric 256 pref medium
fe80::/64 dev veth4becd55 proto kernel metric 256 pref medium
fe80::/64 dev vethc4796f6 proto kernel metric 256 pref medium
fe80::/64 dev veth45cc2c7 proto kernel metric 256 pref medium
fe80::/64 dev veth01f9b57 proto kernel metric 256 pref medium

#ip -6 rule show
0:  from all lookup local
220:    from all lookup 220
32766:  from all lookup main
4200000001: from all iif lo failed_policy
4200000004: from all iif eth0 failed_policy

#===================== 端口占用状态 =====================#

tcp        0      0 :::9090                 :::*                    LISTEN      5580/clash
tcp        0      0 :::7895                 :::*                    LISTEN      5580/clash
tcp        0      0 :::7892                 :::*                    LISTEN      5580/clash
tcp        0      0 :::7893                 :::*                    LISTEN      5580/clash
tcp        0      0 :::7890                 :::*                    LISTEN      5580/clash
tcp        0      0 :::7891                 :::*                    LISTEN      5580/clash
udp        0      0 :::33662                :::*                                5580/clash
udp        0      0 :::58812                :::*                                5580/clash
udp        0      0 :::46787                :::*                                5580/clash
udp        0      0 :::7874                 :::*                                5580/clash
udp        0      0 :::7891                 :::*                                5580/clash
udp        0      0 :::7892                 :::*                                5580/clash
udp        0      0 :::7893                 :::*                                5580/clash
udp        0      0 :::7895                 :::*                                5580/clash

#===================== 测试本机DNS查询(www.baidu.com) =====================#

Server:     127.0.0.1
Address:    127.0.0.1:53

Name:   www.baidu.com
Address: 198.18.0.10

#===================== 测试内核DNS查询(www.instagram.com) =====================#

Status: 0
TC: false
RD: true
RA: true
AD: false
CD: false

Question: 
  Name: www.instagram.com.
  Qtype: 1
  Qclass: 1

Answer: 
  TTL: 2400
  data: geo-p42.instagram.com.
  name: www.instagram.com.
  type: 5

  TTL: 2400
  data: z-p42-instagram.c10r.instagram.com.
  name: geo-p42.instagram.com.
  type: 5

  TTL: 2400
  data: 157.240.251.174
  name: z-p42-instagram.c10r.instagram.com.
  type: 1

Additional: 
  TTL: 0
  data: ON:; EDNS: version 0; flags:; udp: 1232
  name: .
  type: 41

Dnsmasq 当前默认 resolv 文件：/tmp/resolv.conf.d/resolv.conf.auto

#===================== /tmp/resolv.conf.d/resolv.conf.auto =====================#

# Interface lan
nameserver 202.106.195.68

#===================== 测试本机网络连接(www.baidu.com) =====================#

HTTP/1.1 200 OK
Accept-Ranges: bytes
Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform
Connection: keep-alive
Content-Length: 277
Content-Type: text/html
Date: Tue, 03 Oct 2023 16:01:15 GMT
Etag: "575e1f59-115"
Last-Modified: Mon, 13 Jun 2016 02:50:01 GMT
Pragma: no-cache
Server: bfe/1.0.8.18

#===================== 测试本机网络下载(raw.githubusercontent.com) =====================#

HTTP/1.1 404 Not Found
Connection: keep-alive
Content-Length: 14
Content-Security-Policy: default-src 'none'; style-src 'unsafe-inline'; sandbox
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
X-Frame-Options: deny
X-XSS-Protection: 1; mode=block
Content-Type: text/plain; charset=utf-8
X-GitHub-Request-Id: B8B2:2BBCC6:248668:28CB28:651C3AA6
Accept-Ranges: bytes
Date: Tue, 03 Oct 2023 16:01:15 GMT
Via: 1.1 varnish
X-Served-By: cache-nrt-rjtf7700071-NRT
X-Cache: HIT
X-Cache-Hits: 1
X-Timer: S1696348876.881631,VS0,VE1
Vary: Authorization,Accept-Encoding,Origin
Access-Control-Allow-Origin: *
Cross-Origin-Resource-Policy: cross-origin
X-Fastly-Request-ID: 4f4937f78ead84f3aab82843f05da38dcda08057
Expires: Tue, 03 Oct 2023 16:06:15 GMT
Source-Age: 36

#===================== 最近运行日志(自动切换为Debug模式) =====================#

time="2023-10-03T15:58:10.776023629Z" level=info msg="[TCP] 192.168.22.219:2056 --> down7.huorong.cn:80 match DomainSuffix(cn) using 🎯 全球直连[DIRECT]"
time="2023-10-03T15:58:11.046005463Z" level=info msg="[TCP] 192.168.22.219:2057 --> update.huorong.cn:80 match DomainSuffix(cn) using 🎯 全球直连[DIRECT]"
time="2023-10-03T15:58:11.106550516Z" level=info msg="[TCP] 192.168.22.219:2058 --> down7.huorong.cn:80 match DomainSuffix(cn) using 🎯 全球直连[DIRECT]"
time="2023-10-03T16:01:19.332684253Z" level=debug msg="re-creating the http client due to requesting https://public.dns.iij.jp:443/dns-query?dns=AAABAAABAAAAAAAABmFzc2V0cwNtc24DY29tAAABAAE: Get \"https://public.dns.iij.jp:443/dns-query?dns=AAABAAABAAAAAAAABmFzc2V0cwNtc24DY29tAAABAAE\": read tcp 192.168.24.2:47332->103.2.57.5:443: read: connection reset by peer"
time="2023-10-03T16:01:19.332799292Z" level=debug msg="[https://public.dns.iij.jp:443/dns-query?dns=AAABAAABAAAAAAAABmFzc2V0cwNtc24DY29tAAABAAE] using HTTP/2 for this upstream: <nil>"
time="2023-10-03T16:01:19.466759482Z" level=debug msg="[DNS] assets.msn.com --> [2.19.120.12 2.19.120.18], from https://dns.oszx.co:443/dns-query"
time="2023-10-03T16:01:19.723870584Z" level=info msg="[TCP] 192.168.22.219:2176 --> assets.msn.com:443 match DomainSuffix(msn.com) using Ⓜ️ 微软服务[DIRECT]"

#===================== 最近运行日志获取完成(自动切换为silent模式) =====================#

#===================== 活动连接信息 =====================#

1. SourceIP:【192.168.22.219】 - Host:【lh3.googleusercontent.com】 - DestinationIP:【】 - Network:【tcp】 - RulePayload:【google】 - Lastchain:【🇭🇰 香港 01 4】
2. SourceIP:【192.168.22.219】 - Host:【encrypted-tbn0.gstatic.com】 - DestinationIP:【】 - Network:【tcp】 - RulePayload:【gstatic.com】 - Lastchain:【🇭🇰 香港 01 4】
53. SourceIP:【192.168.22.219】 - Host:【github.com】 - DestinationIP:【】 - Network:【tcp】 - RulePayload:【github.com】 - Lastchain:【🇭🇰 香港 01 4】

OpenClash Config

No response

Expected Behavior

理论上。。这个规则。。应该走chatgpt分组。不应该走direct本地直连。。。

Screenshots

不正常 有时候正常 有规则

vernesong commented 11 months ago

节点没写支持udp就默认直连

github-actions[bot] commented 9 months ago

This issue is stale because it has been open 60 days with no activity. Remove stale label or comment or this will be closed in 5 days