search

vernesong / OpenClash

A Clash Client For OpenWrt
MIT License
16.9k stars 3.11k forks source link

[Bug] 绕过核心的来源端口不生效 #3618

Closed Turing-China closed 8 months ago

Turing-China commented 10 months ago

Verify Steps

OpenClash Version

v0.45.152-beta

Bug on Environment

Official OpenWrt

Bug on Platform

Linux-arm64

To Reproduce

绕过核心的来源端口设置后不生效，还是会经过核心

Describe the Bug

绕过核心的来源端口设置后不生效，还是会经过核心

OpenClash Log

OpenClash 调试日志

生成时间: 2023-11-23 12:54:31 插件版本: v0.45.152-beta 隐私提示: 上传此日志前请注意检查、屏蔽公网IP、节点、密码等相关敏感信息



#===================== 系统信息 =====================#

主机型号: FriendlyElec NanoPi R5S
固件版本: OpenWrt SNAPSHOT r6228-fd7b5ec17
LuCI版本: git-23.291.46448-4898ed2-1
内核版本: 5.15.136
处理器架构: aarch64_generic

#此项有值时,如不使用IPv6,建议到网络-接口-lan的设置中禁用IPV6的DHCP
IPV6-DHCP: 

DNS劫持: 停用
#DNS劫持为Dnsmasq时，此项结果应仅有配置文件的DNS监听地址
Dnsmasq转发设置: 

#===================== 依赖检查 =====================#

dnsmasq-full: 已安装
coreutils: 已安装
coreutils-nohup: 已安装
bash: 已安装
curl: 已安装
ca-certificates: 已安装
ipset: 已安装
ip-full: 已安装
libcap: 已安装
libcap-bin: 已安装
ruby: 未安装
ruby-yaml: 未安装
ruby-psych: 已安装
ruby-pstore: 已安装
kmod-tun(TUN模式): 已安装
luci-compat(Luci >= 19.07): 已安装
kmod-inet-diag(PROCESS-NAME): 已安装
unzip: 已安装
iptables-mod-tproxy: 已安装
kmod-ipt-tproxy: 已安装
iptables-mod-extra: 已安装
kmod-ipt-extra: 已安装
kmod-ipt-nat: 已安装

#===================== 内核检查 =====================#

运行状态: 运行中
运行内核：Meta
进程pid: 23918
运行权限: 23918: cap_dac_override,cap_net_bind_service,cap_net_admin,cap_net_raw,cap_sys_ptrace,cap_sys_resource=eip
运行用户: nobody
已选择的架构: linux-arm64

#下方无法显示内核版本号时请确认您的内核版本是否正确或者有无权限
Tun内核版本: 
Tun内核文件: 不存在
Tun内核运行权限: 否

Dev内核版本: v1.15.1-7-g6eee226
Dev内核文件: 存在
Dev内核运行权限: 正常

Meta内核版本: alpha-g8c3557e
Meta内核文件: 存在
Meta内核运行权限: 正常

#===================== 插件设置 =====================#

当前配置文件: /etc/openclash/config/负载均衡节点.yaml
启动配置文件: /etc/openclash/负载均衡节点.yaml
运行模式: redir-host
默认代理模式: rule
UDP流量转发(tproxy): 启用
自定义DNS: 停用
IPV6代理: 停用
IPV6-DNS解析: 停用
禁用Dnsmasq缓存: 启用
自定义规则: 启用
仅允许内网: 启用
仅代理命中规则流量: 停用
仅允许常用端口流量: 停用
绕过中国大陆IP: 启用
路由本机代理: 启用

#启动异常时建议关闭此项后重试
混合节点: 停用
保留配置: 停用

#启动异常时建议关闭此项后重试
第三方规则: 停用

#===================== 自定义规则 一 =====================#
script:

rules:

##在线IP段转CIDR地址：http://ip2cidr.com
- IP-CIDR,50.201.43.136/32,🇭🇰 香港节点 #匹配数据目标IP(直连香港节点);业务一部FTP
- DOMAIN,ftp.spencergifts.com,🇭🇰 香港节点 #匹配域名(直连香港节点);业务一部FTP
- DST-PORT,123,DIRECT #匹配数据目标端口(直连)
- IP-CIDR,203.153.4.156/32,DIRECT #单证订舱网站(直连)
- DOMAIN-SUFFIX,kerrylogistics.com,DIRECT #单证订舱网站(直连)
- DOMAIN-SUFFIX,3gppnetwork.org,🇭🇰 香港节点 #WiFi-calling
- IP-CIDR,208.54.39.0/25,🇭🇰 香港节点 #WiFi-calling
- IP-CIDR,208.54.39.128/25,🇭🇰 香港节点 #WiFi-calling
#===================== 自定义规则 二 =====================#
script:

rules:

#===================== 配置文件 =====================#

mixed-port: 7893
allow-lan: true
bind-address: "*"
mode: rule
log-level: info
external-controller: 0.0.0.0:9090
dns:
  enable: true
  ipv6: false
  default-nameserver:
  - 223.5.5.5
  - 119.29.29.29
  enhanced-mode: redir-host
  use-hosts: true
  nameserver:
  - https://doh.pub/dns-query
  - https://dns.alidns.com/dns-query
  fallback:
  - https://dns.twnic.tw/dns-query
  - https://cloudflare-dns.com/dns-quer
  - https://dns.google/dns-query
  - tls://1.0.0.1:853
  fallback-filter:
    geoip: true
    ipcidr:
    - 240.0.0.0/4
    - 0.0.0.0/32
  listen: 0.0.0.0:7874
proxy-groups:
- name: "\U0001F680 网络加速"
  type: select
  proxies:
  - "⚖️ 负载均衡-轮询"
  - "⚖️ 负载均衡-散列"
  - "\U0001F517 自动选择"
  - "\U0001F9EF 故障转移"
  - "\U0001F684 Node-1"
  - "\U0001F684 Node-2"
  - "\U0001F684 Node-3"
  - "\U0001F684 Node-4"
- name: "\U0001F517 自动选择"
  type: url-test
  proxies:
  - "\U0001F684 Node-1"
  - "\U0001F684 Node-2"
  - "\U0001F684 Node-3"
  - "\U0001F684 Node-4"
  url: http://www.gstatic.com/generate_204
  interval: 86400
- name: "\U0001F9EF 故障转移"
  type: fallback
  proxies:
  - "\U0001F684 Node-1"
  - "\U0001F684 Node-2"
  - "\U0001F684 Node-3"
  - "\U0001F684 Node-4"
  url: http://www.gstatic.com/generate_204
  interval: 7200
- name: "⚖️ 负载均衡-轮询"
  type: load-balance
  url: http://www.gstatic.com/generate_204
  interval: 300
  strategy: round-robin
  proxies:
  - "\U0001F684 Node-1"
  - "\U0001F684 Node-2"
  - "\U0001F684 Node-3"
  - "\U0001F684 Node-4"
- name: "⚖️ 负载均衡-散列"
  type: load-balance
  url: http://www.gstatic.com/generate_204
  interval: 300
  strategy: consistent-hashing
  proxies:
  - "\U0001F684 Node-1"
  - "\U0001F684 Node-2"
  - "\U0001F684 Node-3"
  - "\U0001F684 Node-4"
- name: "\U0001F1ED\U0001F1F0 香港节点"
  type: select
  proxies:
  - "\U0001F1ED\U0001F1F0 香港-1"
  - "\U0001F1ED\U0001F1F0 香港-2"
  - "\U0001F1ED\U0001F1F0 香港-3"
  - "\U0001F1ED\U0001F1F0 香港-4"
rules:
- DST-PORT,7895,REJECT
- DST-PORT,7892,REJECT
- IP-CIDR,198.18.0.1/16,REJECT,no-resolve
- "IP-CIDR,50.201.43.136/32,\U0001F1ED\U0001F1F0 香港节点"
- "DOMAIN,ftp.spencergifts.com,\U0001F1ED\U0001F1F0 香港节点"
- DST-PORT,123,DIRECT
- IP-CIDR,203.153.4.156/32,DIRECT
- IP-CIDR,224.0.0.0/4,DIRECT
- IP-CIDR6,fe80::/10,DIRECT
- DOMAIN-SUFFIX,cn,DIRECT
- DOMAIN-KEYWORD,-cn,DIRECT
- GEOIP,CN,DIRECT
- "MATCH,\U0001F680 网络加速"
redir-port: 7892
tproxy-port: 7895
port: 7890
socks-port: 7891
external-ui: "/usr/share/openclash/ui"
ipv6: false
geodata-mode: true
geodata-loader: standard
global-client-fingerprint: random
sniffer:
  enable: true
  force-dns-mapping: true
  parse-pure-ip: true
profile:
  store-selected: true
  store-fake-ip: true
authentication:
- Clash:wsLa5e1U

#===================== 自定义覆写设置 =====================#

#!/bin/sh
. /usr/share/openclash/ruby.sh
. /usr/share/openclash/log.sh
. /lib/functions.sh

# This script is called by /etc/init.d/openclash
# Add your custom overwrite scripts here, they will be take effict after the OpenClash own srcipts

LOG_OUT "Tip: Start Running Custom Overwrite Scripts..."
LOGTIME=$(echo $(date "+%Y-%m-%d %H:%M:%S"))
LOG_FILE="/tmp/openclash.log"
CONFIG_FILE="$1" #config path

#Simple Demo:
    #General Demo
    #1--config path
    #2--key name
    #3--value
    #ruby_edit "$CONFIG_FILE" "['redir-port']" "7892"
    #ruby_edit "$CONFIG_FILE" "['secret']" "123456"
    #ruby_edit "$CONFIG_FILE" "['dns']['enable']" "true"

    #Hash Demo
    #1--config path
    #2--key name
    #3--hash type value
    #ruby_edit "$CONFIG_FILE" "['experimental']" "{'sniff-tls-sni'=>true}"
    #ruby_edit "$CONFIG_FILE" "['sniffer']" "{'sniffing'=>['tls','http']}"

    #Array Demo:
    #1--config path
    #2--key name
    #3--position(start from 0, end with -1)
    #4--value
    #ruby_arr_insert "$CONFIG_FILE" "['dns']['nameserver']" "0" "114.114.114.114"

    #Array Add From Yaml File Demo:
    #1--config path
    #2--key name
    #3--position(start from 0, end with -1)
    #4--value file path
    #5--value key name in #4 file
    #ruby_arr_add_file "$CONFIG_FILE" "['dns']['fallback-filter']['ipcidr']" "0" "/etc/openclash/custom/openclash_custom_fallback_filter.yaml" "['fallback-filter']['ipcidr']"

#Ruby Script Demo:
    #ruby -ryaml -rYAML -I "/usr/share/openclash" -E UTF-8 -e "
    #   begin
    #      Value = YAML.load_file('$CONFIG_FILE');
    #   rescue Exception => e
    #      puts '${LOGTIME} Error: Load File Failed,【' + e.message + '】';
    #   end;

        #General
    #   begin
    #   Thread.new{
    #      Value['redir-port']=7892;
    #      Value['tproxy-port']=7895;
    #      Value['port']=7890;
    #      Value['socks-port']=7891;
    #      Value['mixed-port']=7893;
    #   }.join;

    #   rescue Exception => e
    #      puts '${LOGTIME} Error: Set General Failed,【' + e.message + '】';
    #   ensure
    #      File.open('$CONFIG_FILE','w') {|f| YAML.dump(Value, f)};
    #   end" 2>/dev/null >> $LOG_FILE

exit 0
#===================== 自定义防火墙设置 =====================#

#!/bin/sh
. /usr/share/openclash/log.sh
. /lib/functions.sh

# This script is called by /etc/init.d/openclash
# Add your custom firewall rules here, they will be added after the end of the OpenClash iptables rules

LOG_OUT "Tip: Start Add Custom Firewall Rules..."

exit 0
#===================== IPTABLES 防火墙设置 =====================#

#IPv4 NAT chain

# Generated by iptables-save v1.8.7 on Thu Nov 23 12:54:33 2023
*nat
:PREROUTING ACCEPT [1718:190555]
:INPUT ACCEPT [2503:227001]
:OUTPUT ACCEPT [3942:259566]
:POSTROUTING ACCEPT [55:3704]
:MINIUPNPD - [0:0]
:MINIUPNPD-POSTROUTING - [0:0]
:openclash - [0:0]
:openclash_output - [0:0]
:postrouting_lan_rule - [0:0]
:postrouting_rule - [0:0]
:postrouting_wan_rule - [0:0]
:prerouting_lan_rule - [0:0]
:prerouting_rule - [0:0]
:prerouting_wan_rule - [0:0]
:zone_lan_postrouting - [0:0]
:zone_lan_prerouting - [0:0]
:zone_wan_postrouting - [0:0]
:zone_wan_prerouting - [0:0]
-A PREROUTING -d 8.8.4.4/32 -p tcp -m comment --comment "OpenClash Google DNS Hijack" -m tcp --dport 53 -j REDIRECT --to-ports 7892
-A PREROUTING -d 8.8.8.8/32 -p tcp -m comment --comment "OpenClash Google DNS Hijack" -m tcp --dport 53 -j REDIRECT --to-ports 7892
-A PREROUTING -m comment --comment "!fw3: Custom prerouting rule chain" -j prerouting_rule
-A PREROUTING -i br-lan -m comment --comment "!fw3" -j zone_lan_prerouting
-A PREROUTING -i utun -m comment --comment "!fw3" -j zone_lan_prerouting
-A PREROUTING -i eth0 -m comment --comment "!fw3" -j zone_wan_prerouting
-A PREROUTING -p tcp -j openclash
-A OUTPUT -j openclash_output
-A POSTROUTING -m comment --comment "!fw3: Custom postrouting rule chain" -j postrouting_rule
-A POSTROUTING -o br-lan -m comment --comment "!fw3" -j zone_lan_postrouting
-A POSTROUTING -o utun -m comment --comment "!fw3" -j zone_lan_postrouting
-A POSTROUTING -o eth0 -m comment --comment "!fw3" -j zone_wan_postrouting
-A openclash -p tcp -m tcp --sport 1688 -j RETURN
-A openclash -m set --match-set localnetwork dst -j RETURN
-A openclash -m set --match-set localnetwork src -m set --match-set lan_ac_black_ports src -j RETURN
-A openclash -m set --match-set china_ip_route dst -m set ! --match-set china_ip_route_pass dst -j RETURN
-A openclash -p tcp -j REDIRECT --to-ports 7892
-A openclash_output -p tcp -m tcp --sport 1688 -j RETURN
-A openclash_output -m set --match-set localnetwork dst -j RETURN
-A openclash_output -m set --match-set localnetwork src -m set --match-set lan_ac_black_ports src -j RETURN
-A openclash_output -m owner ! --uid-owner 65534 -m set --match-set china_ip_route dst -m set ! --match-set china_ip_route_pass dst -j RETURN
-A openclash_output -p tcp -m owner ! --uid-owner 65534 -j REDIRECT --to-ports 7892
-A zone_lan_postrouting -m comment --comment "!fw3: Custom lan postrouting rule chain" -j postrouting_lan_rule
-A zone_lan_prerouting -m comment --comment "!fw3: Custom lan prerouting rule chain" -j prerouting_lan_rule
-A zone_wan_postrouting -j MINIUPNPD-POSTROUTING
-A zone_wan_postrouting -m comment --comment "!fw3: Custom wan postrouting rule chain" -j postrouting_wan_rule
-A zone_wan_postrouting -m comment --comment "!fw3" -j MASQUERADE --mode fullcone
-A zone_wan_prerouting -j MINIUPNPD
-A zone_wan_prerouting -m comment --comment "!fw3: Custom wan prerouting rule chain" -j prerouting_wan_rule
COMMIT
# Completed on Thu Nov 23 12:54:33 2023

#IPv4 Mangle chain

# Generated by iptables-save v1.8.7 on Thu Nov 23 12:54:33 2023
*mangle
:PREROUTING ACCEPT [257077:362822203]
:INPUT ACCEPT [256938:363029884]
:FORWARD ACCEPT [1757:174379]
:OUTPUT ACCEPT [234859:387586637]
:POSTROUTING ACCEPT [236557:387758376]
:RRDIPT_FORWARD - [0:0]
:RRDIPT_INPUT - [0:0]
:RRDIPT_OUTPUT - [0:0]
:openclash - [0:0]
:openclash_output - [0:0]
:openclash_upnp - [0:0]
-A PREROUTING -p udp -j openclash
-A INPUT -j RRDIPT_INPUT
-A FORWARD -j RRDIPT_FORWARD
-A FORWARD -o eth0 -p tcp -m tcp --tcp-flags SYN,RST SYN -m comment --comment "!fw3: Zone wan MTU fixing" -j TCPMSS --clamp-mss-to-pmtu
-A FORWARD -i eth0 -p tcp -m tcp --tcp-flags SYN,RST SYN -m comment --comment "!fw3: Zone wan MTU fixing" -j TCPMSS --clamp-mss-to-pmtu
-A OUTPUT -j RRDIPT_OUTPUT
-A OUTPUT -p udp -j openclash_output
-A RRDIPT_FORWARD -s 172.16.10.200/32 -j RETURN
-A RRDIPT_FORWARD -d 172.16.10.200/32 -j RETURN
-A RRDIPT_FORWARD -s 10.10.17.254/32 -j RETURN
-A RRDIPT_FORWARD -d 10.10.17.254/32 -j RETURN
-A RRDIPT_FORWARD -s 10.10.5.106/32 -j RETURN
-A RRDIPT_FORWARD -d 10.10.5.106/32 -j RETURN
-A RRDIPT_FORWARD -s 10.10.5.108/32 -j RETURN
-A RRDIPT_FORWARD -d 10.10.5.108/32 -j RETURN
-A RRDIPT_FORWARD -s 10.10.5.254/32 -j RETURN
-A RRDIPT_FORWARD -d 10.10.5.254/32 -j RETURN
-A RRDIPT_FORWARD -s 218.75.85.98/32 -j RETURN
-A RRDIPT_FORWARD -d 218.75.85.98/32 -j RETURN
-A RRDIPT_INPUT -i eth0 -j RETURN
-A RRDIPT_OUTPUT -o eth0 -j RETURN
-A openclash -p udp -m udp --sport 500 -j RETURN
-A openclash -p udp -m udp --sport 68 -j RETURN
-A openclash -i lo -j RETURN
-A openclash -m set --match-set localnetwork dst -j RETURN
-A openclash -p udp -m udp --dport 53 -j RETURN
-A openclash -m set --match-set localnetwork src -m set --match-set lan_ac_black_ports src -j RETURN
-A openclash -m set --match-set china_ip_route dst -m set ! --match-set china_ip_route_pass dst -j RETURN
-A openclash -p udp -j openclash_upnp
-A openclash -p udp -j TPROXY --on-port 7895 --on-ip 0.0.0.0 --tproxy-mark 0x162/0xffffffff
-A openclash_output -p udp -m udp --sport 500 -j RETURN
-A openclash_output -p udp -m udp --sport 68 -j RETURN
-A openclash_output -d 198.18.0.0/16 -p udp -m owner ! --uid-owner 65534 -j MARK --set-xmark 0x162/0xffffffff
COMMIT
# Completed on Thu Nov 23 12:54:33 2023

#IPv4 Filter chain

# Generated by iptables-save v1.8.7 on Thu Nov 23 12:54:33 2023
*filter
:INPUT ACCEPT [0:0]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [0:0]
:MINIUPNPD - [0:0]
:forwarding_lan_rule - [0:0]
:forwarding_rule - [0:0]
:forwarding_wan_rule - [0:0]
:input_lan_rule - [0:0]
:input_rule - [0:0]
:input_wan_rule - [0:0]
:openclash_wan_input - [0:0]
:output_lan_rule - [0:0]
:output_rule - [0:0]
:output_wan_rule - [0:0]
:reject - [0:0]
:syn_flood - [0:0]
:zone_lan_dest_ACCEPT - [0:0]
:zone_lan_forward - [0:0]
:zone_lan_input - [0:0]
:zone_lan_output - [0:0]
:zone_lan_src_ACCEPT - [0:0]
:zone_wan_dest_ACCEPT - [0:0]
:zone_wan_dest_REJECT - [0:0]
:zone_wan_forward - [0:0]
:zone_wan_input - [0:0]
:zone_wan_output - [0:0]
:zone_wan_src_REJECT - [0:0]
-A INPUT -i eth0 -m set ! --match-set localnetwork src -j openclash_wan_input
-A INPUT -i lo -m comment --comment "!fw3" -j ACCEPT
-A INPUT -m comment --comment "!fw3: Custom input rule chain" -j input_rule
-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment "!fw3" -j ACCEPT
-A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -m comment --comment "!fw3" -j syn_flood
-A INPUT -i br-lan -m comment --comment "!fw3" -j zone_lan_input
-A INPUT -i utun -m comment --comment "!fw3" -j zone_lan_input
-A INPUT -i eth0 -m comment --comment "!fw3" -j zone_wan_input
-A FORWARD -m comment --comment "!fw3: Custom forwarding rule chain" -j forwarding_rule
-A FORWARD -m comment --comment "!fw3: Traffic offloading" -m conntrack --ctstate RELATED,ESTABLISHED -j FLOWOFFLOAD --hw
-A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment "!fw3" -j ACCEPT
-A FORWARD -i br-lan -m comment --comment "!fw3" -j zone_lan_forward
-A FORWARD -i utun -m comment --comment "!fw3" -j zone_lan_forward
-A FORWARD -i eth0 -m comment --comment "!fw3" -j zone_wan_forward
-A FORWARD -m comment --comment "!fw3" -j reject
-A OUTPUT -o lo -m comment --comment "!fw3" -j ACCEPT
-A OUTPUT -m comment --comment "!fw3: Custom output rule chain" -j output_rule
-A OUTPUT -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment "!fw3" -j ACCEPT
-A OUTPUT -o br-lan -m comment --comment "!fw3" -j zone_lan_output
-A OUTPUT -o utun -m comment --comment "!fw3" -j zone_lan_output
-A OUTPUT -o eth0 -m comment --comment "!fw3" -j zone_wan_output
-A openclash_wan_input -p udp -m multiport --dports 7892,7895,9090,7890,7891,7893,7874 -j REJECT --reject-with icmp-port-unreachable
-A openclash_wan_input -p tcp -m multiport --dports 7892,7895,9090,7890,7891,7893,7874 -j REJECT --reject-with icmp-port-unreachable
-A reject -p tcp -m comment --comment "!fw3" -j REJECT --reject-with tcp-reset
-A reject -m comment --comment "!fw3" -j REJECT --reject-with icmp-port-unreachable
-A syn_flood -m limit --limit 25/sec --limit-burst 50 -m comment --comment "!fw3" -j RETURN
-A syn_flood -m comment --comment "!fw3" -j DROP
-A zone_lan_dest_ACCEPT -o br-lan -m comment --comment "!fw3" -j ACCEPT
-A zone_lan_dest_ACCEPT -o utun -m comment --comment "!fw3" -j ACCEPT
-A zone_lan_forward -m comment --comment "!fw3: Custom lan forwarding rule chain" -j forwarding_lan_rule
-A zone_lan_forward -m comment --comment "!fw3: Zone lan to wan forwarding policy" -j zone_wan_dest_ACCEPT
-A zone_lan_forward -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port forwards" -j ACCEPT
-A zone_lan_forward -m comment --comment "!fw3" -j zone_lan_dest_ACCEPT
-A zone_lan_input -m comment --comment "!fw3: Custom lan input rule chain" -j input_lan_rule
-A zone_lan_input -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port redirections" -j ACCEPT
-A zone_lan_input -m comment --comment "!fw3" -j zone_lan_src_ACCEPT
-A zone_lan_output -m comment --comment "!fw3: Custom lan output rule chain" -j output_lan_rule
-A zone_lan_output -m comment --comment "!fw3" -j zone_lan_dest_ACCEPT
-A zone_lan_src_ACCEPT -i br-lan -m conntrack --ctstate NEW,UNTRACKED -m comment --comment "!fw3" -j ACCEPT
-A zone_lan_src_ACCEPT -i utun -m conntrack --ctstate NEW,UNTRACKED -m comment --comment "!fw3" -j ACCEPT
-A zone_wan_dest_ACCEPT -o eth0 -m conntrack --ctstate INVALID -m comment --comment "!fw3: Prevent NAT leakage" -j DROP
-A zone_wan_dest_ACCEPT -o eth0 -m comment --comment "!fw3" -j ACCEPT
-A zone_wan_dest_REJECT -o eth0 -m comment --comment "!fw3" -j reject
-A zone_wan_forward -j MINIUPNPD
-A zone_wan_forward -m comment --comment "!fw3: Custom wan forwarding rule chain" -j forwarding_wan_rule
-A zone_wan_forward -p esp -m comment --comment "!fw3: Allow-IPSec-ESP" -j zone_lan_dest_ACCEPT
-A zone_wan_forward -p udp -m udp --dport 500 -m comment --comment "!fw3: Allow-ISAKMP" -j zone_lan_dest_ACCEPT
-A zone_wan_forward -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port forwards" -j ACCEPT
-A zone_wan_forward -m comment --comment "!fw3" -j zone_wan_dest_REJECT
-A zone_wan_input -m comment --comment "!fw3: Custom wan input rule chain" -j input_wan_rule
-A zone_wan_input -p udp -m udp --dport 68 -m comment --comment "!fw3: Allow-DHCP-Renew" -j ACCEPT
-A zone_wan_input -p icmp -m icmp --icmp-type 8 -m comment --comment "!fw3: Allow-Ping" -j ACCEPT
-A zone_wan_input -p igmp -m comment --comment "!fw3: Allow-IGMP" -j ACCEPT
-A zone_wan_input -p tcp -m tcp --dport 1688 -m comment --comment "!fw3: kms" -j ACCEPT
-A zone_wan_input -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port redirections" -j ACCEPT
-A zone_wan_input -m comment --comment "!fw3" -j zone_wan_src_REJECT
-A zone_wan_output -m comment --comment "!fw3: Custom wan output rule chain" -j output_wan_rule
-A zone_wan_output -m comment --comment "!fw3" -j zone_wan_dest_ACCEPT
-A zone_wan_src_REJECT -i eth0 -m comment --comment "!fw3" -j reject
COMMIT
# Completed on Thu Nov 23 12:54:33 2023

#IPv6 NAT chain

#IPv6 Mangle chain

#IPv6 Filter chain

#===================== IPSET状态 =====================#

Name: mwan3_connected_v4
Type: hash:net
Revision: 7
Header: family inet hashsize 1024 maxelem 65536 bucketsize 12 initval 0xfe3e71ba
Size in memory: 936
References: 1
Number of entries: 10

Name: mwan3_connected_v6
Type: hash:net
Revision: 7
Header: family inet6 hashsize 1024 maxelem 65536 bucketsize 12 initval 0x8a503fa1
Size in memory: 1240
References: 1
Number of entries: 0

Name: mwan3_source_v6
Type: hash:net
Revision: 7
Header: family inet6 hashsize 1024 maxelem 65536 bucketsize 12 initval 0x51e95849
Size in memory: 1240
References: 0
Number of entries: 0

Name: mwan3_dynamic_v4
Type: hash:net
Revision: 7
Header: family inet hashsize 1024 maxelem 65536 bucketsize 12 initval 0x084bcfb5
Size in memory: 456
References: 1
Number of entries: 0

Name: mwan3_dynamic_v6
Type: hash:net
Revision: 7
Header: family inet6 hashsize 1024 maxelem 65536 bucketsize 12 initval 0xae533487
Size in memory: 1240
References: 1
Number of entries: 0

Name: mwan3_custom_v4
Type: hash:net
Revision: 7
Header: family inet hashsize 1024 maxelem 65536 bucketsize 12 initval 0x0d03af91
Size in memory: 456
References: 1
Number of entries: 0

Name: mwan3_custom_v6
Type: hash:net
Revision: 7
Header: family inet6 hashsize 1024 maxelem 65536 bucketsize 12 initval 0xba4330d0
Size in memory: 1240
References: 1
Number of entries: 0

Name: lan_ac_black_ports
Type: bitmap:port
Revision: 3
Header: range 0-65535
Size in memory: 8264
References: 3
Number of entries: 1

Name: localnetwork
Type: hash:net
Revision: 7
Header: family inet hashsize 1024 maxelem 65536 bucketsize 12 initval 0x2a5d40d7
Size in memory: 888
References: 7
Number of entries: 9

Name: china_ip_route
Type: hash:net
Revision: 7
Header: family inet hashsize 4096 maxelem 1000000 bucketsize 12 initval 0x33d1fe0e
Size in memory: 256704
References: 3
Number of entries: 8645

Name: china_ip_route_pass
Type: hash:net
Revision: 7
Header: family inet hashsize 1024 maxelem 1000000 bucketsize 12 initval 0xb73b8da3
Size in memory: 456
References: 3
Number of entries: 0

Name: mwan3_connected
Type: list:set
Revision: 3
Header: size 8
Size in memory: 368
References: 0
Number of entries: 6

#===================== 路由表状态 =====================#

#IPv4

#route -n
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         10.10.5.254     0.0.0.0         UG    0      0        0 eth0
10.10.5.0       0.0.0.0         255.255.255.0   U     0      0        0 eth0
172.16.10.0     0.0.0.0         255.255.255.0   U     0      0        0 br-lan

#ip route list
default via 10.10.5.254 dev eth0 proto static 
10.10.5.0/24 dev eth0 proto kernel scope link src 10.10.5.253 
172.16.10.0/24 dev br-lan proto kernel scope link src 172.16.10.254 

#ip rule show
0:  from all lookup local
32765:  from all fwmark 0x162 lookup 354
32766:  from all lookup main
32767:  from all lookup default

#IPv6

#route -A inet6
Kernel IPv6 routing table
Destination                                 Next Hop                                Flags Metric Ref    Use Iface
fe80::/64                                   ::                                      U     256    1        0 br-lan  
fe80::/64                                   ::                                      U     256    1        0 eth0    
::/0                                        ::                                      !n    -1     1        0 lo      
::1/128                                     ::                                      Un    0      6        0 lo      
fe80::/128                                  ::                                      Un    0      3        0 eth0    
fe80::/128                                  ::                                      Un    0      3        0 br-lan  
fe80::c464:abff:fe8d:c858/128               ::                                      Un    0      4        0 eth0    
fe80::c464:abff:fe8d:c859/128               ::                                      Un    0      2        0 br-lan  
ff00::/8                                    ::                                      U     256    5        0 br-lan  
ff00::/8                                    ::                                      U     256    5        0 eth0    
::/0                                        ::                                      !n    -1     1        0 lo      

#ip -6 route list
fe80::/64 dev br-lan proto kernel metric 256 pref medium
fe80::/64 dev eth0 proto kernel metric 256 pref medium

#ip -6 rule show
0:  from all lookup local
32766:  from all lookup main
4200000001: from all iif lo failed_policy
4200000002: from all iif eth0 failed_policy
4200000066: from all iif br-lan failed_policy

#===================== 端口占用状态 =====================#

tcp        0      0 :::7895                 :::*                    LISTEN      23918/clash
tcp        0      0 :::7892                 :::*                    LISTEN      23918/clash
tcp        0      0 :::7893                 :::*                    LISTEN      23918/clash
tcp        0      0 :::7890                 :::*                    LISTEN      23918/clash
tcp        0      0 :::7891                 :::*                    LISTEN      23918/clash
tcp        0      0 :::9090                 :::*                    LISTEN      23918/clash
udp        0      0 :::45675                :::*                                23918/clash
udp        0      0 :::56102                :::*                                23918/clash
udp        0      0 :::33770                :::*                                23918/clash
udp        0      0 :::46076                :::*                                23918/clash
udp        0      0 :::52299                :::*                                23918/clash
udp        0      0 :::33989                :::*                                23918/clash
udp        0      0 :::54489                :::*                                23918/clash
udp        0      0 :::56640                :::*                                23918/clash
udp        0      0 :::60744                :::*                                23918/clash
udp        0      0 :::42313                :::*                                23918/clash
udp        0      0 :::54640                :::*                                23918/clash
udp        0      0 :::60825                :::*                                23918/clash
udp        0      0 :::40396                :::*                                23918/clash
udp        0      0 :::52789                :::*                                23918/clash
udp        0      0 :::44640                :::*                                23918/clash
udp        0      0 :::59022                :::*                                23918/clash
udp        0      0 :::7874                 :::*                                23918/clash
udp        0      0 :::7891                 :::*                                23918/clash
udp        0      0 :::7892                 :::*                                23918/clash
udp        0      0 :::7893                 :::*                                23918/clash
udp        0      0 :::7895                 :::*                                23918/clash
udp        0      0 :::36633                :::*                                23918/clash
udp        0      0 :::36669                :::*                                23918/clash
udp        0      0 :::34648                :::*                                23918/clash
udp        0      0 :::59248                :::*                                23918/clash
udp        0      0 :::51108                :::*                                23918/clash
udp        0      0 :::40941                :::*                                23918/clash
udp        0      0 :::49181                :::*                                23918/clash
udp        0      0 :::59551                :::*                                23918/clash
udp        0      0 :::35055                :::*                                23918/clash
udp        0      0 :::35077                :::*                                23918/clash
udp        0      0 :::55560                :::*                                23918/clash
udp        0      0 :::57638                :::*                                23918/clash
udp        0      0 :::47453                :::*                                23918/clash
udp        0      0 :::41310                :::*                                23918/clash
udp        0      0 :::41312                :::*                                23918/clash
udp        0      0 :::39273                :::*                                23918/clash
udp        0      0 :::55739                :::*                                23918/clash

#===================== 测试本机DNS查询(www.baidu.com) =====================#

Server:     127.0.0.1
Address:    127.0.0.1:53

Non-authoritative answer:
www.baidu.com   canonical name = www.a.shifen.com
Name:   www.a.shifen.com
Address: 180.101.50.188
Name:   www.a.shifen.com
Address: 180.101.50.242

Non-authoritative answer:
www.baidu.com   canonical name = www.a.shifen.com

#===================== 测试内核DNS查询(www.instagram.com) =====================#

Status: 0
TC: false
RD: true
RA: true
AD: false
CD: false

Question: 
  Name: www.instagram.com.
  Qtype: 1
  Qclass: 1

Answer: 
  TTL: 3503
  data: geo-p42.instagram.com.
  name: www.instagram.com.
  type: 5

  TTL: 3503
  data: z-p42-instagram.c10r.instagram.com.
  name: geo-p42.instagram.com.
  type: 5

  TTL: 12
  data: 157.240.22.174
  name: z-p42-instagram.c10r.instagram.com.
  type: 1

Dnsmasq 当前默认 resolv 文件：/tmp/resolv.conf.d/resolv.conf.auto

#===================== /tmp/resolv.conf.d/resolv.conf.auto =====================#

# Interface lan
nameserver 223.5.5.5
nameserver 119.29.29.29
# Interface wan
nameserver 223.5.5.5
nameserver 119.29.29.29

#===================== 测试本机网络连接(www.baidu.com) =====================#

HTTP/1.1 200 OK
Accept-Ranges: bytes
Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform
Connection: keep-alive
Content-Length: 277
Content-Type: text/html
Date: Thu, 23 Nov 2023 04:54:35 GMT
Etag: "575e1f60-115"
Last-Modified: Mon, 13 Jun 2016 02:50:08 GMT
Pragma: no-cache
Server: bfe/1.0.8.18

#===================== 测试本机网络下载(raw.githubusercontent.com) =====================#

HTTP/2 404 
content-security-policy: default-src 'none'; style-src 'unsafe-inline'; sandbox
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
x-frame-options: deny
x-xss-protection: 1; mode=block
content-type: text/plain; charset=utf-8
x-github-request-id: D346:3E86:6ABBD6:82AED9:655EDB0B
accept-ranges: bytes
date: Thu, 23 Nov 2023 04:54:36 GMT
via: 1.1 varnish
x-served-by: cache-sjc1000085-SJC
x-cache: MISS
x-cache-hits: 0
x-timer: S1700715276.283758,VS0,VE80
vary: Authorization,Accept-Encoding,Origin
access-control-allow-origin: *
cross-origin-resource-policy: cross-origin
x-fastly-request-id: dbd484070fa841eae699e0475b6adf64ea195583
expires: Thu, 23 Nov 2023 04:59:36 GMT
source-age: 0
content-length: 14

### OpenClash Config

_No response_

### Expected Behavior

功能正常

### Screenshots

_No response_
vernesong commented 10 months ago

选项指的是本地内网指定端口的流量

Turing-China commented 10 months ago

选项指的是本地内网指定端口的流量 我想访问外网的某些端口不经过核心，有办法设置吗？

github-actions[bot] commented 8 months ago

This issue is stale because it has been open 60 days with no activity. Remove stale label or comment or this will be closed in 5 days