search

xiaorouji / openwrt-passwall

7.02k stars 2.62k forks source link

IPv6透明代理的iptables规则，漏掉了代理udp流量的规则 #1600

Closed MikeMiao closed 2 years ago

MikeMiao commented 2 years ago

系统：OpenWrt Ipv6-Mini-S2021.11.20 by Sirpdboy / LuCI Master (git-21.320.49600-21168d4) passwall版本：4.43-2

故障现象：内网开启ipv6，并在高级菜单内启用了IPv6代理（Tproxy）之后，youtube视频加载速度变得十分缓慢

分析：排查后发现，该版本passwall在启用IPv6透明代理之后，即使udp代理模式选择“全局”或者“中国列表以外”，ip6tables内未自动添加udp的代理规则，造成udp直连，youtube等支持quic的视频网站，udp443端口未过代理，造成视频加载速度缓慢。

对比：尝试使用另一版本的固件： OpenWrt R21.8.6 GDQ v9.1[2021] Compiled by eSir / LuCI Master (git-21.238.35254-83494a9) 附带passwall版本为较老的4.34-1，未发现此问题。

正常配置及ip6tables： image image

异常配置及ip6tables： image image

smallprogram commented 2 years ago

For some reasons, the udp proxy of ipv6 is blocked https://github.com/xiaorouji/openwrt-passwall/blob/5134b7ffd205383dbd965e3fc1940eaef9f33642/luci-app-passwall/root/usr/share/passwall/iptables.sh#L414-L418

MikeMiao commented 2 years ago

got it, thanks a lot.

WROIATE commented 2 years ago

How about xray? Seem them achieved Fullcone?

LitCcc commented 2 years ago

How about xray? Seem them achieved Fullcone?

If you are using Xray, you can uncomment these rules in iptables.sh. It works fine for me.

MikeMiao commented 2 years ago

How about xray? Seem them achieved Fullcone?

I tried Xray 1.4.5 and 1.5.0,it works well with ipv6 udp traffic and nat type is indeed fullcone .However just like @LitCcc said, you have to manually uncomment those lines in /usr/share/passwall/iptables.sh which reenable paswall to automatically add ipv6 udp divert ruls in ip6tables.

@smallprogram I think it's a good idea to add an option at frontend and leave the choice to user whether to divert ipv6 udp traffic to proxy or not, passwall was designed to work with various of proxy programs, I believe some of them would work well with ipv6 udp traffic just like xray.

smallprogram commented 2 years ago

Maybe the next version will fulfill your needs, but not now. I have been too busy lately to contribute code

xiaorouji commented 2 years ago

https://github.com/xiaorouji/openwrt-passwall/commit/0c05475eacc4984cc3dcab227e4325e6c0c350a9