SasamiMasakiJurai
commented
2 years ago 启动xray后的iptables-save
/$ iptables-save
Generated by iptables-save v1.8.7 on Wed Dec 29 22:04:18 2021
*nat :PREROUTING ACCEPT [93:6792] :INPUT ACCEPT [62:4677] :OUTPUT ACCEPT [11:971] :POSTROUTING ACCEPT [32:1811] :MINIUPNPD - [0:0] :MINIUPNPD-POSTROUTING - [0:0] :postrouting_lan_rule - [0:0] :postrouting_rule - [0:0] :postrouting_wan_rule - [0:0] :prerouting_lan_rule - [0:0] :prerouting_rule - [0:0] :prerouting_wan_rule - [0:0] :zone_lan_postrouting - [0:0] :zone_lan_prerouting - [0:0] :zone_wan_postrouting - [0:0] :zone_wan_prerouting - [0:0] -A PREROUTING -m comment --comment "!fw3: Custom prerouting rule chain" -j prerouting_rule -A PREROUTING -i br-lan -m comment --comment "!fw3" -j zone_lan_prerouting -A PREROUTING -i pppoe-wan -m comment --comment "!fw3" -j zone_wan_prerouting -A PREROUTING -i eth2 -m comment --comment "!fw3" -j zone_wan_prerouting -A POSTROUTING -m comment --comment "!fw3: Custom postrouting rule chain" -j postrouting_rule -A POSTROUTING -o br-lan -m comment --comment "!fw3" -j zone_lan_postrouting -A POSTROUTING -o pppoe-wan -m comment --comment "!fw3" -j zone_wan_postrouting -A POSTROUTING -o eth2 -m comment --comment "!fw3" -j zone_wan_postrouting -A zone_lan_postrouting -m comment --comment "!fw3: Custom lan postrouting rule chain" -j postrouting_lan_rule -A zone_lan_prerouting -m comment --comment "!fw3: Custom lan prerouting rule chain" -j prerouting_lan_rule -A zone_wan_postrouting -m comment --comment "!fw3: Custom wan postrouting rule chain" -j postrouting_wan_rule -A zone_wan_postrouting -j MINIUPNPD-POSTROUTING -A zone_wan_postrouting -m comment --comment "!fw3" -j MASQUERADE -A zone_wan_prerouting -m comment --comment "!fw3: Custom wan prerouting rule chain" -j prerouting_wan_rule -A zone_wan_prerouting -j MINIUPNPD COMMIT
Completed on Wed Dec 29 22:04:18 2021
Generated by iptables-save v1.8.7 on Wed Dec 29 22:04:18 2021
*mangle :PREROUTING ACCEPT [275:25983] :INPUT ACCEPT [346:32382] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [257:97542] :POSTROUTING ACCEPT [253:97382] :TP_SPEC_LAN_AC - [0:0] :TP_SPEC_LAN_DG - [0:0] :TP_SPEC_WAN_AC - [0:0] :TP_SPEC_WAN_DG - [0:0] :TP_SPEC_WAN_FW - [0:0] -A PREROUTING -i br-lan -j TP_SPEC_LAN_DG -A PREROUTING -m mark --mark 0xfc -j TP_SPEC_WAN_AC -A FORWARD -o pppoe-wan -p tcp -m tcp --tcp-flags SYN,RST SYN -m comment --comment "!fw3: Zone wan MTU fixing" -j TCPMSS --clamp-mss-to-pmtu -A FORWARD -i pppoe-wan -p tcp -m tcp --tcp-flags SYN,RST SYN -m comment --comment "!fw3: Zone wan MTU fixing" -j TCPMSS --clamp-mss-to-pmtu -A FORWARD -o eth2 -p tcp -m tcp --tcp-flags SYN,RST SYN -m comment --comment "!fw3: Zone wan MTU fixing" -j TCPMSS --clamp-mss-to-pmtu -A FORWARD -i eth2 -p tcp -m tcp --tcp-flags SYN,RST SYN -m comment --comment "!fw3: Zone wan MTU fixing" -j TCPMSS --clamp-mss-to-pmtu -A OUTPUT -j TP_SPEC_WAN_DG -A TP_SPEC_LAN_AC -m set --match-set tp_spec_src_bp src -j RETURN -A TP_SPEC_LAN_AC -m set --match-set tp_spec_src_fw src -j TP_SPEC_WAN_FW -A TP_SPEC_LAN_AC -m set --match-set tp_spec_src_ac src -j TP_SPEC_WAN_AC -A TP_SPEC_LAN_AC -j TP_SPEC_WAN_AC -A TP_SPEC_LAN_DG -m set --match-set tp_spec_dst_sp dst -j RETURN -A TP_SPEC_LAN_DG -p tcp -j TP_SPEC_LAN_AC -A TP_SPEC_LAN_DG -p udp -j TP_SPEC_LAN_AC -A TP_SPEC_WAN_AC -m set --match-set tp_spec_dst_fw dst -j TP_SPEC_WAN_FW -A TP_SPEC_WAN_AC -m set --match-set tp_spec_dst_bp dst -j RETURN -A TP_SPEC_WAN_AC -j TP_SPEC_WAN_FW -A TP_SPEC_WAN_DG -m set --match-set tp_spec_dst_sp dst -j RETURN -A TP_SPEC_WAN_DG -m set --match-set tp_spec_dst_bp dst -j RETURN -A TP_SPEC_WAN_DG -m set --match-set tp_spec_def_gw dst -j RETURN -A TP_SPEC_WAN_DG -m mark --mark 0xff -j RETURN -A TP_SPEC_WAN_DG -p tcp -j MARK --set-xmark 0xfc/0xffffffff -A TP_SPEC_WAN_DG -p udp -j MARK --set-xmark 0xfc/0xffffffff -A TP_SPEC_WAN_FW -p tcp -j TPROXY --on-port 1080 --on-ip 0.0.0.0 --tproxy-mark 0xfb/0xffffffff -A TP_SPEC_WAN_FW -p udp -j TPROXY --on-port 1081 --on-ip 0.0.0.0 --tproxy-mark 0xfb/0xffffffff COMMIT
Completed on Wed Dec 29 22:04:18 2021
Generated by iptables-save v1.8.7 on Wed Dec 29 22:04:18 2021
*filter :INPUT ACCEPT [4:160] :FORWARD DROP [0:0] :OUTPUT ACCEPT [0:0] :MINIUPNPD - [0:0] :forwarding_lan_rule - [0:0] :forwarding_rule - [0:0] :forwarding_wan_rule - [0:0] :input_lan_rule - [0:0] :input_rule - [0:0] :input_wan_rule - [0:0] :output_lan_rule - [0:0] :output_rule - [0:0] :output_wan_rule - [0:0] :reject - [0:0] :syn_flood - [0:0] :zone_lan_dest_ACCEPT - [0:0] :zone_lan_forward - [0:0] :zone_lan_input - [0:0] :zone_lan_output - [0:0] :zone_lan_src_ACCEPT - [0:0] :zone_wan_dest_ACCEPT - [0:0] :zone_wan_dest_REJECT - [0:0] :zone_wan_forward - [0:0] :zone_wan_input - [0:0] :zone_wan_output - [0:0] :zone_wan_src_REJECT - [0:0] -A INPUT -i lo -m comment --comment "!fw3" -j ACCEPT -A INPUT -m comment --comment "!fw3: Custom input rule chain" -j input_rule -A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment "!fw3" -j ACCEPT -A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -m comment --comment "!fw3" -j syn_flood -A INPUT -i br-lan -m comment --comment "!fw3" -j zone_lan_input -A INPUT -i pppoe-wan -m comment --comment "!fw3" -j zone_wan_input -A INPUT -i eth2 -m comment --comment "!fw3" -j zone_wan_input -A FORWARD -m comment --comment "!fw3: Custom forwarding rule chain" -j forwarding_rule -A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment "!fw3" -j ACCEPT -A FORWARD -i br-lan -m comment --comment "!fw3" -j zone_lan_forward -A FORWARD -i pppoe-wan -m comment --comment "!fw3" -j zone_wan_forward -A FORWARD -i eth2 -m comment --comment "!fw3" -j zone_wan_forward -A FORWARD -m comment --comment "!fw3" -j reject -A OUTPUT -o lo -m comment --comment "!fw3" -j ACCEPT -A OUTPUT -m comment --comment "!fw3: Custom output rule chain" -j output_rule -A OUTPUT -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment "!fw3" -j ACCEPT -A OUTPUT -o br-lan -m comment --comment "!fw3" -j zone_lan_output -A OUTPUT -o pppoe-wan -m comment --comment "!fw3" -j zone_wan_output -A OUTPUT -o eth2 -m comment --comment "!fw3" -j zone_wan_output -A reject -p tcp -m comment --comment "!fw3" -j REJECT --reject-with tcp-reset -A reject -m comment --comment "!fw3" -j REJECT --reject-with icmp-port-unreachable -A syn_flood -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -m limit --limit 25/sec --limit-burst 50 -m comment --comment "!fw3" -j RETURN -A syn_flood -m comment --comment "!fw3" -j DROP -A zone_lan_dest_ACCEPT -o br-lan -m comment --comment "!fw3" -j ACCEPT -A zone_lan_forward -m comment --comment "!fw3: Custom lan forwarding rule chain" -j forwarding_lan_rule -A zone_lan_forward -m comment --comment "!fw3: Zone lan to wan forwarding policy" -j zone_wan_dest_ACCEPT -A zone_lan_forward -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port forwards" -j ACCEPT -A zone_lan_forward -m comment --comment "!fw3" -j zone_lan_dest_ACCEPT -A zone_lan_input -m comment --comment "!fw3: Custom lan input rule chain" -j input_lan_rule -A zone_lan_input -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port redirections" -j ACCEPT -A zone_lan_input -m comment --comment "!fw3" -j zone_lan_src_ACCEPT -A zone_lan_output -m comment --comment "!fw3: Custom lan output rule chain" -j output_lan_rule -A zone_lan_output -m comment --comment "!fw3" -j zone_lan_dest_ACCEPT -A zone_lan_src_ACCEPT -i br-lan -m conntrack --ctstate NEW,UNTRACKED -m comment --comment "!fw3" -j ACCEPT -A zone_wan_dest_ACCEPT -o pppoe-wan -m conntrack --ctstate INVALID -m comment --comment "!fw3: Prevent NAT leakage" -j DROP -A zone_wan_dest_ACCEPT -o pppoe-wan -m comment --comment "!fw3" -j ACCEPT -A zone_wan_dest_ACCEPT -o eth2 -m conntrack --ctstate INVALID -m comment --comment "!fw3: Prevent NAT leakage" -j DROP -A zone_wan_dest_ACCEPT -o eth2 -m comment --comment "!fw3" -j ACCEPT -A zone_wan_dest_REJECT -o pppoe-wan -m comment --comment "!fw3" -j reject -A zone_wan_dest_REJECT -o eth2 -m comment --comment "!fw3" -j reject -A zone_wan_forward -m comment --comment "!fw3: Custom wan forwarding rule chain" -j forwarding_wan_rule -A zone_wan_forward -p esp -m comment --comment "!fw3: Allow-IPSec-ESP" -j zone_lan_dest_ACCEPT -A zone_wan_forward -p udp -m udp --dport 500 -m comment --comment "!fw3: Allow-ISAKMP" -j zone_lan_dest_ACCEPT -A zone_wan_forward -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port forwards" -j ACCEPT -A zone_wan_forward -j MINIUPNPD -A zone_wan_forward -m comment --comment "!fw3" -j zone_wan_dest_REJECT -A zone_wan_input -m comment --comment "!fw3: Custom wan input rule chain" -j input_wan_rule -A zone_wan_input -p udp -m udp --dport 68 -m comment --comment "!fw3: Allow-DHCP-Renew" -j ACCEPT -A zone_wan_input -p icmp -m icmp --icmp-type 8 -m comment --comment "!fw3: Allow-Ping" -j ACCEPT -A zone_wan_input -p igmp -m comment --comment "!fw3: Allow-IGMP" -j ACCEPT -A zone_wan_input -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port redirections" -j ACCEPT -A zone_wan_input -j MINIUPNPD -A zone_wan_input -m comment --comment "!fw3" -j zone_wan_src_REJECT -A zone_wan_output -m comment --comment "!fw3: Custom wan output rule chain" -j output_wan_rule -A zone_wan_output -m comment --comment "!fw3" -j zone_wan_dest_ACCEPT -A zone_wan_src_REJECT -i pppoe-wan -m comment --comment "!fw3" -j reject -A zone_wan_src_REJECT -i eth2 -m comment --comment "!fw3" -j reject COMMIT
LitCcc
yichya
jlzsss
yukeiyang
看到大版本更新了， 作为参与者， 准备做第一个吃螃蟹的人， 结果彻底无法上网了， 下面把症状详细描述下：
1.准备工作 为了控制变量， 彻底重装系统， 防止出现残留问题。 因此， 安装的是 openwrt-21.02.1-x86-64-generic-ext4-combined-efi 原版系统 插件仅安装最新的 luci-app-xray_1.2.0-1_all.ipk 系统仅设置了拨号上网和系统更新， 其他插件一概未装
2.插件安装 安装插件后， 自动安装了内置的xray， 然后仅设置了Xray Servers,添加了geoip和geosite至指定文件夹，设置了geoip为cn，routing domain为IPIfNonMatch， 其他未动， 具体config.json如下（已脱敏）：
{ "outbounds": [ { "streamSettings": { "network": "tcp", "xtlsSettings": { "alpn": [ "h2", "http\/1.1" ], "allowInsecure": false }, "tcpSettings": { "header": { "type": "none" } }, "sockopt": { "mark": 255, "domainStrategy": "UseIP" }, "security": "xtls" }, "settings": { "vnext": [ { "port": 443, "users": [ { "id": "xxx-xxx-xxx-xxx-xxx", "flow": "xtls-rprx-direct", "encryption": "none" } ], "address": "xxx-xxx-xxx-xxx-xxx" } ] }, "protocol": "vless", "tag": "tcp_outbound" }, { "streamSettings": { "network": "tcp", "xtlsSettings": { "alpn": [ "h2", "http\/1.1" ], "allowInsecure": false }, "tcpSettings": { "header": { "type": "none" } }, "sockopt": { "mark": 255, "domainStrategy": "UseIP" }, "security": "xtls" }, "settings": { "vnext": [ { "port": 443, "users": [ { "id": "xxx-xxx-xxx-xxx-xxx", "flow": "xtls-rprx-direct", "encryption": "none" } ], "address": "xxx-xxx-xxx-xxx-xxx" } ] }, "protocol": "vless", "tag": "udp_outbound" }, { "streamSettings": { "sockopt": { "mark": 255 } }, "protocol": "freedom", "tag": "direct" }, { "tag": "dns_server_outbound", "protocol": "dns", "streamSettings": { "sockopt": { "mark": 255 } } } ], "log": { "loglevel": "debug", "access": "none", "dnsLog": false }, "dns": { "servers": [ { "port": 53, "domains": [ "xxx-xxx-xxx-xxx-xxx" ], "address": "114.114.114.114" }, { "port": 53, "domains": [ "geosite:geolocation-!cn" ], "address": "8.8.8.8" }, { "port": 53, "domains": [ "geosite:cn" ], "address": "114.114.114.114" }, { "port": 53, "address": "1.1.1.1" } ], "tag": "dns_conf_inbound" }, "api": { "services": [ "HandlerService", "LoggerService", "StatsService" ], "tag": "api" }, "routing": { "rules": [ { "domain": [ "geosite:cn" ], "type": "field", "inboundTag": [ "tproxy_tcp_inbound", "tproxy_udp_inbound", "dns_conf_inbound", "https_inbound", "http_inbound" ], "outboundTag": "direct" }, { "domain": [ "geosite:geolocation-!cn" ], "type": "field", "inboundTag": [ "tproxy_tcp_inbound", "tproxy_udp_inbound", "dns_conf_inbound" ], "outboundTag": "tcp_outbound" }, { "domain": [ "geosite:geolocation-!cn" ], "type": "field", "inboundTag": [ "tproxy_udp_inbound" ], "outboundTag": "udp_outbound" }, { "ip": [ "geoip:private" ], "type": "field", "inboundTag": [ "tproxy_tcp_inbound", "tproxy_udp_inbound", "dns_conf_inbound", "socks_inbound", "https_inbound", "http_inbound" ], "outboundTag": "direct" }, { "ip": [ "geoip:cn" ], "type": "field", "inboundTag": [ "tproxy_tcp_inbound", "tproxy_udp_inbound", "dns_conf_inbound" ], "outboundTag": "direct" }, { "type": "field", "inboundTag": [ "tproxy_tcp_inbound", "dns_conf_inbound", "socks_inbound", "https_inbound", "http_inbound" ], "outboundTag": "tcp_outbound" }, { "type": "field", "inboundTag": [ "tproxy_udp_inbound" ], "outboundTag": "udp_outbound" }, { "type": "field", "inboundTag": [ "dns_server_inbound_5300", "dns_server_inbound_5301", "dns_server_inbound_5302", "dns_server_inbound_5303" ], "outboundTag": "dns_server_outbound" }, { "type": "field", "inboundTag": [ "api" ], "outboundTag": "api" } ], "domainStrategy": "IPIfNonMatch" }, "policy": { "system": { "statsInboundDownlink": false, "statsOutboundDownlink": false, "statsOutboundUplink": false, "statsInboundUplink": false }, "levels": { "0": { "uplinkOnly": 0, "statsUserDownlink": false, "statsUserUplink": false, "connIdle": 0, "bufferSize": 0, "handshake": 0, "downlinkOnly": 0 } } }, "inbounds": [ { "settings": { "allowTransparent": false }, "port": "1083", "protocol": "http", "tag": "http_inbound" }, { "port": "1080", "protocol": "dokodemo-door", "streamSettings": { "sockopt": { "tproxy": "tproxy", "mark": 255 } }, "settings": { "network": "tcp", "followRedirect": true }, "sniffing": { "enabled": true, "destOverride": [ "http", "tls" ], "metadataOnly": false }, "tag": "tproxy_tcp_inbound" }, { "port": "1081", "protocol": "dokodemo-door", "streamSettings": { "sockopt": { "tproxy": "tproxy", "mark": 255 } }, "settings": { "network": "udp", "followRedirect": true }, "tag": "tproxy_udp_inbound" }, { "settings": { "udp": true }, "port": "1082", "protocol": "socks", "tag": "socks_inbound" }, { "settings": { "port": 53, "network": "tcp,udp", "address": "1.1.1.1" }, "port": 5300, "protocol": "dokodemo-door", "tag": "dns_server_inbound_5300" }, { "settings": { "port": 53, "network": "tcp,udp", "address": "1.1.1.1" }, "port": 5301, "protocol": "dokodemo-door", "tag": "dns_server_inbound_5301" }, { "settings": { "port": 53, "network": "tcp,udp", "address": "1.1.1.1" }, "port": 5302, "protocol": "dokodemo-door", "tag": "dns_server_inbound_5302" }, { "settings": { "port": 53, "network": "tcp,udp", "address": "1.1.1.1" }, "port": 5303, "protocol": "dokodemo-door", "tag": "dns_server_inbound_5303" }, { "port": 8080, "protocol": "dokodemo-door", "tag": "api", "settings": { "address": "127.0.0.1" }, "listen": "127.0.0.1" } ] }
3.症状 启动xray后， 整个网络无法使用， 无论是国内还是国外均无法打开， 使用内置网络诊断显示
ping: bad address 'openwrt.org' nslokup;; connection timed out; no servers could be reached
而关闭xray后 则国内网站可以访问， 使用内置网络诊断显示
PING openwrt.org (139.59.209.225): 56 data bytes 64 bytes from 139.59.209.225: seq=0 ttl=53 time=243.199 ms 64 bytes from 139.59.209.225: seq=1 ttl=53 time=243.675 ms 64 bytes from 139.59.209.225: seq=2 ttl=53 time=243.078 ms 64 bytes from 139.59.209.225: seq=3 ttl=53 time=242.920 ms 64 bytes from 139.59.209.225: seq=4 ttl=53 time=243.514 ms
--- openwrt.org ping statistics --- 5 packets transmitted, 5 packets received, 0% packet loss round-trip min/avg/max = 242.920/243.277/243.675 ms
nslokup Server: 127.0.0.1 Address: 127.0.0.1#53
Name: openwrt.org Address 1: 139.59.209.225 Address 2: 2a03:b0c0:3:d0::1af1:1
因此， 貌似有较大问题， 不清楚是哪个环节出了问题。