从141更新到152后插件重启死循环 #3616

WMK965 · 2023-11-22T04:15:32Z

WMK965
Nov 22, 2023

我不确定这个够不够格提issue，于是就先发这来了，麻烦各位帮我看一下是何原因引起的，感谢
冷启动不会出现死循环，插件应用设置重启以及开机后自动启动会出现死循环
以************代替的为我的重定向地址及机场链接

系统环境：2023.07.25 OpenWrt Li [2023] Compiled by Li OpenWrt R23.7.7 / Lede - 18.06
https://cloud.965server.top/home/Share/Image/18.06-Lede-x86-64-1690219752-legacy-2f2fda.img

OpenClash 调试日志

生成时间: 2023-11-22 10:03:20
插件版本: v0.45.152-beta
隐私提示: 上传此日志前请注意检查、屏蔽公网IP、节点、密码等相关敏感信息


#===================== 系统信息 =====================#

主机型号: YL-J1900-V1/YL-J1900-V1 - Intel(R) Celeron(R) CPU J1900 @ 1.99GHz : 4C4T
固件版本: OpenWrt SNAPSHOT r6186-f657b57c5
LuCI版本: git-23.198.59743-991daf5-1
内核版本: 6.1.39
处理器架构: x86_64

#此项有值时,如不使用IPv6,建议到网络-接口-lan的设置中禁用IPV6的DHCP
IPV6-DHCP: 

DNS劫持: Dnsmasq 转发
#DNS劫持为Dnsmasq时，此项结果应仅有配置文件的DNS监听地址
Dnsmasq转发设置: 127.0.0.1#7874

#===================== 依赖检查 =====================#

dnsmasq-full: 已安装
coreutils: 已安装
coreutils-nohup: 已安装
bash: 已安装
curl: 已安装
ca-certificates: 已安装
ipset: 已安装
ip-full: 已安装
libcap: 已安装
libcap-bin: 已安装
ruby: 已安装
ruby-yaml: 已安装
ruby-psych: 已安装
ruby-pstore: 已安装
kmod-tun(TUN模式): 已安装
luci-compat(Luci >= 19.07): 已安装
kmod-inet-diag(PROCESS-NAME): 已安装
unzip: 已安装
iptables-mod-tproxy: 已安装
kmod-ipt-tproxy: 已安装
iptables-mod-extra: 已安装
kmod-ipt-extra: 已安装
kmod-ipt-nat: 已安装

#===================== 内核检查 =====================#

运行状态: 运行中
运行内核：Meta
进程pid: 24721
运行权限: 24721: cap_dac_override,cap_net_bind_service,cap_net_admin,cap_net_raw,cap_sys_ptrace,cap_sys_resource=eip
运行用户: nobody
已选择的架构: 未选择架构

#下方无法显示内核版本号时请确认您的内核版本是否正确或者有无权限
Tun内核版本: 2023.08.17-13-gdcc8d87
Tun内核文件: 存在
Tun内核运行权限: 正常

Dev内核版本: v1.18.0-13-gd034a40
Dev内核文件: 存在
Dev内核运行权限: 正常

Meta内核版本: alpha-g8c3557e
Meta内核文件: 存在
Meta内核运行权限: 正常

#===================== 插件设置 =====================#

当前配置文件: /etc/openclash/config/965Config_School.yaml
启动配置文件: /etc/openclash/965Config_School.yaml
运行模式: redir-host-mix
默认代理模式: rule
UDP流量转发(tproxy): 停用
自定义DNS: 启用
IPV6代理: 停用
IPV6-DNS解析: 停用
禁用Dnsmasq缓存: 启用
自定义规则: 停用
仅允许内网: 启用
仅代理命中规则流量: 停用
仅允许常用端口流量: 停用
绕过中国大陆IP: 停用
路由本机代理: 启用

#启动异常时建议关闭此项后重试
混合节点: 停用
保留配置: 停用

#启动异常时建议关闭此项后重试
第三方规则: 停用

#===================== 配置文件 =====================#

port: 7890
socks-port: 7891
redir-port: 7892
allow-lan: true
bind-address: "*"
log-level: info
external-controller: 0.0.0.0:9965
ipv6: false
mode: rule
tcp-concurrent: true
dns:
  enable: true
  listen: 0.0.0.0:7874
  ipv6: false
  default-nameserver:
  - 203.80.96.10
  - 76.76.19.19
  enhanced-mode: redir-host
  fake-ip-filter:
  - "*.lan"
  - "*.local"
  - "*.msftconnecttest.com"
  nameserver:
  - https://dns.alidns.com/dns-query
  - https://dns.cloudflare.com/dns-query
  fallback:
  - 202.192.112.34
  - 210.21.4.130
  proxy-server-nameserver:
  - https://dns.alidns.com/dns-query
  - https://dns.cloudflare.com/dns-query
  use-hosts: true
proxy-groups:
- name: Switch
  type: select
  proxies:
  - Fallback
  - All_List
  url: http://www.gstatic.com/generate_204
  interval: 300
- name: Fallback
  type: fallback
  proxies:
  - HongKong
  - Japan
  - All_List
  - Taiwan
  - Singapore
  - USA
  url: http://www.gstatic.com/generate_204
  interval: 180
- name: All_List
  type: select
  use:
  - CreamData
  - iKuuu
  url: http://www.gstatic.com/generate_204
  interval: 300
- name: CN
  type: select
  proxies:
  - DIRECT
  - Fallback
  - All_List
  url: http://connectivitycheck.platform.hicloud.com/generate_204
  interval: 300
- name: Bilibili
  type: select
  proxies:
  - Fallback
  - All_List
  - DIRECT
  url: http://www.gstatic.com/generate_204
  interval: 300
- name: HongKong
  type: select
  filter: "^(?!.*?(Premium)).*(香港|Hong Kong|HK)"
  use:
  - CreamData
  - iKuuu
  url: http://www.gstatic.com/generate_204
  interval: 300
- name: Taiwan
  type: select
  filter: "^(?!.*?(Premium)).*(台湾|Taiwan|TW)"
  use:
  - CreamData
  - iKuuu
  url: http://www.gstatic.com/generate_204
  interval: 300
- name: Singapore
  type: select
  filter: "^(?!.*?(Premium)).*(新加坡|Singapore|SG)"
  use:
  - CreamData
  - iKuuu
  url: http://www.gstatic.com/generate_204
  interval: 300
- name: Japan
  type: select
  filter: "^(?!.*?(Premium)).*(日本|Japan|JP)"
  use:
  - CreamData
  - iKuuu
  url: http://www.gstatic.com/generate_204
  interval: 300
- name: USA
  type: select
  filter: "^(?!.*?(Premium)).*(美国|USA|US)"
  use:
  - CreamData
  - iKuuu
  url: http://www.gstatic.com/generate_204
  interval: 300
rules:
- DST-PORT,7895,REJECT
- DST-PORT,7892,REJECT
- IP-CIDR,198.18.0.1/16,REJECT,no-resolve
- DST-PORT,80,Switch
- DST-PORT,8080,Switch
- DST-PORT,5222,Switch
- DST-PORT,5223,Switch
- DST-PORT,5228,Switch
- DST-PORT,8000,Switch
- DST-PORT,8001,Switch
- DST-PORT,14000,Switch
- DOMAIN,speed.cloudflare.com,CN
- DOMAIN-SUFFIX,test-ipv6.com,CN
- RULE-SET,Unbreak,CN
- DOMAIN-SUFFIX,loli.net,CN
- DOMAIN,click.simba.taobao.com,CN
- RULE-SET,Advertising,REJECT
- RULE-SET,Advertising-antiAD,REJECT
- RULE-SET,Apple,CN
- RULE-SET,Microsoft,Switch
- RULE-SET,Nintendo,Switch
- DOMAIN,http-inputs-notion.splunkcloud.com,Switch
- RULE-SET,Notion,Switch
- DOMAIN-SUFFIX,hanime1.me,Switch
- DOMAIN-SUFFIX,imgur.com,Switch
- DOMAIN-SUFFIX,sb-cd.com,Switch
- DOMAIN-SUFFIX,cdn1122.com,Switch
- DOMAIN-SUFFIX,hembed.com,Switch
- DOMAIN-SUFFIX,motherlessmedia.com,Switch
- DOMAIN-SUFFIX,steamcommunity.com,Switch
- DOMAIN,avatars.akamai.steamstatic.com,Switch
- DOMAIN,api.steampowered.com,Switch
- DOMAIN,store.steampowered.com,Switch
- RULE-SET,SteamCN,CN
- RULE-SET,Telegram,Switch
- DOMAIN,open.spotify.com,Switch
- DOMAIN-SUFFIX,akamaized.net,CN
- DOMAIN-SUFFIX,spotify.com,CN
- DOMAIN-SUFFIX,spotifycdn.com,CN
- DOMAIN-SUFFIX,scdn.co,CN
- DOMAIN-SUFFIX,branch.io,CN
- RULE-SET,Spotify,CN
- DOMAIN,anime1.me,Switch
- DOMAIN-SUFFIX,anime1.me,CN
- DOMAIN-SUFFIX,biliapi.com,Bilibili
- DOMAIN-SUFFIX,biliapi.net,Bilibili
- DOMAIN-SUFFIX,bilibili.com,Bilibili
- DOMAIN-SUFFIX,bilibili.tv,Bilibili
- DOMAIN-SUFFIX,bilivideo.com,Bilibili
- RULE-SET,Streaming,Switch
- DOMAIN-SUFFIX,imap.gmail.com,Switch
- DOMAIN-SUFFIX,smtp.gmail.com,Switch
- DOMAIN-SUFFIX,ghproxy.com,CN
- DOMAIN-SUFFIX,smms.app,CN
- DOMAIN-SUFFIX,conntest.moonlight-stream.org,CN
- RULE-SET,Global,Switch
- RULE-SET,China,CN
- GEOIP,CN,CN
- GEOIP,LAN,DIRECT
- MATCH,Switch
rule-providers:
  Unbreak:
    type: http
    behavior: classical
    path: "./rule_provider/Unbreak.yaml"
    url: https://cdn.jsdelivr.net/gh/DivineEngine/Profiles@master/Clash/RuleSet/Unbreak.yaml
    interval: 86400
  Advertising:
    type: http
    behavior: domain
    path: "./rule_provider/Advertising.yaml"
    url: https://cdn.jsdelivr.net/gh/blackmatrix7/ios_rule_script@master/rule/Clash/Advertising/Advertising_Domain.yaml
    interval: 86400
  Advertising-antiAD:
    type: http
    behavior: domain
    path: "./rule_provider/Advertising-antiAD.yaml"
    url: https://anti-ad.net/clash.yaml
    interval: 86400
  Apple:
    type: http
    behavior: classical
    path: "./rule_provider/Apple.yaml"
    url: https://cdn.jsdelivr.net/gh/blackmatrix7/ios_rule_script@master/rule/Clash/Apple/Apple.yaml
    interval: 86400
  Microsoft:
    type: http
    behavior: classical
    path: "./rule_provider/Microsoft.yaml"
    url: https://cdn.jsdelivr.net/gh/blackmatrix7/ios_rule_script@master/rule/Clash/Microsoft/Microsoft.yaml
    interval: 86400
  Nintendo:
    type: http
    behavior: classical
    path: "./rule_provider/Nintendo.yaml"
    url: https://cdn.jsdelivr.net/gh/blackmatrix7/ios_rule_script@master/rule/Clash/Nintendo/Nintendo.yaml
    interval: 86400
  Notion:
    type: http
    behavior: classical
    path: "./rule_provider/Notion.yaml"
    url: https://cdn.jsdelivr.net/gh/blackmatrix7/ios_rule_script@master/rule/Clash/Notion/Notion.yaml
    interval: 86400
  SteamCN:
    type: http
    behavior: classical
    path: "./rule_provider/SteamCN.yaml"
    url: https://cdn.jsdelivr.net/gh/blackmatrix7/ios_rule_script@master/rule/Clash/SteamCN/SteamCN.yaml
    interval: 86400
  Telegram:
    type: http
    behavior: classical
    path: "./rule_provider/Telegram.yaml"
    url: https://cdn.jsdelivr.net/gh/blackmatrix7/ios_rule_script@master/rule/Clash/Telegram/Telegram.yaml
    interval: 86400
  Spotify:
    type: http
    behavior: classical
    path: "./rule_provider/Spotify.yaml"
    url: https://cdn.jsdelivr.net/gh/blackmatrix7/ios_rule_script@master/rule/Clash/Spotify/Spotify.yaml
    interval: 86400
  Streaming:
    type: http
    behavior: domain
    path: "./rule_provider/Streaming.yaml"
    url: https://cdn.jsdelivr.net/gh/blackmatrix7/ios_rule_script@master/rule/Clash/GlobalMedia/GlobalMedia_Domain.yaml
    interval: 86400
  Global:
    type: http
    behavior: domain
    path: "./rule_provider/Global.yaml"
    url: https://cdn.jsdelivr.net/gh/blackmatrix7/ios_rule_script@master/rule/Clash/Global/Global_Domain.yaml
    interval: 86400
  China:
    type: http
    behavior: domain
    path: "./rule_provider/China.yaml"
    url: https://cdn.jsdelivr.net/gh/blackmatrix7/ios_rule_script@master/rule/Clash/China/China_Domain.yaml
    interval: 86400
parsers:
tproxy-port: 7895
mixed-port: 7893
external-ui: "/usr/share/openclash/ui"
interface-name: eth0
keep-alive-interval: 1800
tun:
  enable: true
  stack: system
  device: utun
  auto-route: false
  auto-detect-interface: false
  dns-hijack:
  - tcp://any:53
profile:
  store-selected: true
hosts:
  oanews.gdmu.edu.cn: 222.16.96.25
  jw.gdmu.edu.cn: 222.16.96.53
  authserver.gdmu.edu.cn: 202.192.112.90
  ehall.gdmu.edu.cn: 222.16.96.142
  res.gdmu.edu.cn: 222.16.96.142
  raw.githubusercontent.com: 185.199.110.133
authentication:
- 965:@1a2b3c4dWMK

#===================== 自定义覆写设置 =====================#

#!/bin/sh
. /usr/share/openclash/ruby.sh
. /usr/share/openclash/log.sh
. /lib/functions.sh

# This script is called by /etc/init.d/openclash
# Add your custom overwrite scripts here, they will be take effict after the OpenClash own srcipts

LOG_OUT "Tip: Start Running Custom Overwrite Scripts..."
LOGTIME=$(echo $(date "+%Y-%m-%d %H:%M:%S"))
LOG_FILE="/tmp/openclash.log"
CONFIG_FILE="$1" #config path

#Simple Demo:
    #General Demo
    #1--config path
    #2--key name
    #3--value
    #ruby_edit "$CONFIG_FILE" "['redir-port']" "7892"
    #ruby_edit "$CONFIG_FILE" "['secret']" "123456"
    #ruby_edit "$CONFIG_FILE" "['dns']['enable']" "true"

    #Hash Demo
    #1--config path
    #2--key name
    #3--hash type value
    #ruby_edit "$CONFIG_FILE" "['experimental']" "{'sniff-tls-sni'=>true}"
    #ruby_edit "$CONFIG_FILE" "['sniffer']" "{'sniffing'=>['tls','http']}"

    #Array Demo:
    #1--config path
    #2--key name
    #3--position(start from 0, end with -1)
    #4--value
    #ruby_arr_insert "$CONFIG_FILE" "['dns']['nameserver']" "0" "114.114.114.114"

    #Array Add From Yaml File Demo:
    #1--config path
    #2--key name
    #3--position(start from 0, end with -1)
    #4--value file path
    #5--value key name in #4 file
    #ruby_arr_add_file "$CONFIG_FILE" "['dns']['fallback-filter']['ipcidr']" "0" "/etc/openclash/custom/openclash_custom_fallback_filter.yaml" "['fallback-filter']['ipcidr']"

#Ruby Script Demo:
    #ruby -ryaml -rYAML -I "/usr/share/openclash" -E UTF-8 -e "
    #   begin
    #      Value = YAML.load_file('$CONFIG_FILE');
    #   rescue Exception => e
    #      puts '${LOGTIME} Error: Load File Failed,【' + e.message + '】';
    #   end;

        #General
    #   begin
    #   Thread.new{
    #      Value['redir-port']=7892;
    #      Value['tproxy-port']=7895;
    #      Value['port']=7890;
    #      Value['socks-port']=7891;
    #      Value['mixed-port']=7893;
    #   }.join;

    #   rescue Exception => e
    #      puts '${LOGTIME} Error: Set General Failed,【' + e.message + '】';
    #   ensure
    #      File.open('$CONFIG_FILE','w') {|f| YAML.dump(Value, f)};
    #   end" 2>/dev/null >> $LOG_FILE

exit 0
#===================== 自定义防火墙设置 =====================#

#!/bin/sh
. /usr/share/openclash/log.sh
. /lib/functions.sh

# This script is called by /etc/init.d/openclash
# Add your custom firewall rules here, they will be added after the end of the OpenClash iptables rules

LOG_OUT "Tip: Start Add Custom Firewall Rules..."

exit 0
#===================== IPTABLES 防火墙设置 =====================#

#IPv4 NAT chain

# Generated by iptables-save v1.8.7 on Wed Nov 22 10:03:26 2023
*nat
:PREROUTING ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:OUTPUT ACCEPT [1:81]
:POSTROUTING ACCEPT [1:81]
:DOCKER - [0:0]
:MINIUPNPD - [0:0]
:MINIUPNPD-POSTROUTING - [0:0]
:openclash - [0:0]
:openclash_output - [0:0]
:postrouting_docker_rule - [0:0]
:postrouting_ipsecserver_rule - [0:0]
:postrouting_lan_rule - [0:0]
:postrouting_rule - [0:0]
:postrouting_vpn_rule - [0:0]
:postrouting_wan_rule - [0:0]
:prerouting_docker_rule - [0:0]
:prerouting_ipsecserver_rule - [0:0]
:prerouting_lan_rule - [0:0]
:prerouting_rule - [0:0]
:prerouting_vpn_rule - [0:0]
:prerouting_wan_rule - [0:0]
:zone_docker_postrouting - [0:0]
:zone_docker_prerouting - [0:0]
:zone_ipsecserver_postrouting - [0:0]
:zone_ipsecserver_prerouting - [0:0]
:zone_lan_postrouting - [0:0]
:zone_lan_prerouting - [0:0]
:zone_vpn_postrouting - [0:0]
:zone_vpn_prerouting - [0:0]
:zone_wan_postrouting - [0:0]
:zone_wan_prerouting - [0:0]
-A PREROUTING -p tcp -m comment --comment "OpenClash TCP DNS Hijack" -m tcp --dport 53 -j ACCEPT
-A PREROUTING -p tcp -m tcp --dport 53 -m comment --comment "OpenClash DNS Hijack" -j REDIRECT --to-ports 53
-A PREROUTING -p udp -m udp --dport 53 -m comment --comment "OpenClash DNS Hijack" -j REDIRECT --to-ports 53
-A PREROUTING -d 23.46.155.216/32 -i br-lan -p tcp -m tcp --dport 80 -j DNAT --to-destination 172.16.9.1:42915
-A PREROUTING -p udp -m udp --dport 53 -j REDIRECT --to-ports 53
-A PREROUTING -p tcp -m tcp --dport 53 -j REDIRECT --to-ports 53
-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER
-A PREROUTING -m comment --comment "!fw3: Custom prerouting rule chain" -j prerouting_rule
-A PREROUTING -i br-lan -m comment --comment "!fw3" -j zone_lan_prerouting
-A PREROUTING -i utun -m comment --comment "!fw3" -j zone_lan_prerouting
-A PREROUTING -i eth0 -m comment --comment "!fw3" -j zone_wan_prerouting
-A PREROUTING -i tun0 -m comment --comment "!fw3" -j zone_vpn_prerouting
-A PREROUTING -i ipsec0 -m comment --comment "!fw3" -j zone_ipsecserver_prerouting
-A PREROUTING -i docker0 -m comment --comment "!fw3" -j zone_docker_prerouting
-A PREROUTING -p udp -m udp --dport 53 -m comment --comment "Rule For Control" -j REDIRECT --to-ports 53
-A PREROUTING -p tcp -m tcp --dport 53 -m comment --comment "Rule For Control" -j REDIRECT --to-ports 53
-A PREROUTING -p tcp -j openclash
-A OUTPUT ! -d 127.0.0.0/8 -m addrtype --dst-type LOCAL -j DOCKER
-A OUTPUT -j openclash_output
-A POSTROUTING -s 172.17.0.0/16 ! -o docker0 -j MASQUERADE
-A POSTROUTING -s 192.168.9.0/24 ! -o br-659bc8f9295d -j MASQUERADE
-A POSTROUTING -s 192.168.9.2/32 -d 192.168.9.2/32 -p tcp -m tcp --dport 8096 -j MASQUERADE
-A POSTROUTING -m comment --comment "!fw3: Custom postrouting rule chain" -j postrouting_rule
-A POSTROUTING -o br-lan -m comment --comment "!fw3" -j zone_lan_postrouting
-A POSTROUTING -o utun -m comment --comment "!fw3" -j zone_lan_postrouting
-A POSTROUTING -o eth0 -m comment --comment "!fw3" -j zone_wan_postrouting
-A POSTROUTING -o tun0 -m comment --comment "!fw3" -j zone_vpn_postrouting
-A POSTROUTING -o ipsec0 -m comment --comment "!fw3" -j zone_ipsecserver_postrouting
-A POSTROUTING -o docker0 -m comment --comment "!fw3" -j zone_docker_postrouting
-A DOCKER -i docker0 -j RETURN
-A DOCKER -i br-659bc8f9295d -j RETURN
-A DOCKER ! -i br-659bc8f9295d -p tcp -m tcp --dport 802 -j DNAT --to-destination 192.168.9.2:8096
-A MINIUPNPD -p udp -m udp --dport 60368 -j DNAT --to-destination 172.16.9.11:60368
-A openclash -p tcp -m tcp --sport 801 -j RETURN
-A openclash -p tcp -m tcp --sport 801 -j RETURN
-A openclash -m set --match-set localnetwork dst -j RETURN
-A openclash -m set ! --match-set common_ports dst -j RETURN
-A openclash -p tcp -j REDIRECT --to-ports 7892
-A openclash_output -p tcp -m tcp --sport 801 -j RETURN
-A openclash_output -p tcp -m tcp --sport 801 -j RETURN
-A openclash_output -m set --match-set localnetwork dst -j RETURN
-A openclash_output -m owner ! --uid-owner 65534 -m set ! --match-set common_ports dst -j RETURN
-A openclash_output -p tcp -m owner ! --uid-owner 65534 -j REDIRECT --to-ports 7892
-A zone_docker_postrouting -m comment --comment "!fw3: Custom docker postrouting rule chain" -j postrouting_docker_rule
-A zone_docker_prerouting -m comment --comment "!fw3: Custom docker prerouting rule chain" -j prerouting_docker_rule
-A zone_ipsecserver_postrouting -m comment --comment "!fw3: Custom ipsecserver postrouting rule chain" -j postrouting_ipsecserver_rule
-A zone_ipsecserver_prerouting -m comment --comment "!fw3: Custom ipsecserver prerouting rule chain" -j prerouting_ipsecserver_rule
-A zone_lan_postrouting -m comment --comment "!fw3: Custom lan postrouting rule chain" -j postrouting_lan_rule
-A zone_lan_prerouting -m comment --comment "!fw3: Custom lan prerouting rule chain" -j prerouting_lan_rule
-A zone_vpn_postrouting -m comment --comment "!fw3: Custom vpn postrouting rule chain" -j postrouting_vpn_rule
-A zone_vpn_postrouting -m comment --comment "!fw3" -j MASQUERADE --mode fullcone
-A zone_vpn_prerouting -m comment --comment "!fw3: Custom vpn prerouting rule chain" -j prerouting_vpn_rule
-A zone_wan_postrouting -j MINIUPNPD-POSTROUTING
-A zone_wan_postrouting -m comment --comment "!fw3: Custom wan postrouting rule chain" -j postrouting_wan_rule
-A zone_wan_postrouting -m comment --comment "!fw3" -j MASQUERADE --mode fullcone
-A zone_wan_prerouting -j MINIUPNPD
-A zone_wan_prerouting -m comment --comment "!fw3: Custom wan prerouting rule chain" -j prerouting_wan_rule
COMMIT
# Completed on Wed Nov 22 10:03:26 2023

#IPv4 Mangle chain

# Generated by iptables-save v1.8.7 on Wed Nov 22 10:03:26 2023
*mangle
:PREROUTING ACCEPT [56:36132]
:INPUT ACCEPT [56:36132]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [56:4590]
:POSTROUTING ACCEPT [56:4590]
:RRDIPT_FORWARD - [0:0]
:RRDIPT_INPUT - [0:0]
:RRDIPT_OUTPUT - [0:0]
:openclash - [0:0]
:openclash_dns_hijack - [0:0]
:openclash_upnp - [0:0]
-A PREROUTING -p udp -j openclash
-A PREROUTING -p tcp -m tcp --dport 53 -j openclash_dns_hijack
-A INPUT -j RRDIPT_INPUT
-A FORWARD -j RRDIPT_FORWARD
-A FORWARD -o eth0 -p tcp -m tcp --tcp-flags SYN,RST SYN -m comment --comment "!fw3: Zone wan MTU fixing" -j TCPMSS --clamp-mss-to-pmtu
-A FORWARD -i eth0 -p tcp -m tcp --tcp-flags SYN,RST SYN -m comment --comment "!fw3: Zone wan MTU fixing" -j TCPMSS --clamp-mss-to-pmtu
-A OUTPUT -j RRDIPT_OUTPUT
-A POSTROUTING -j TTL --ttl-set 64
-A RRDIPT_FORWARD -s 172.16.9.11/32 -j RETURN
-A RRDIPT_FORWARD -d 172.16.9.11/32 -j RETURN
-A RRDIPT_FORWARD -s 172.16.9.41/32 -j RETURN
-A RRDIPT_FORWARD -d 172.16.9.41/32 -j RETURN
-A RRDIPT_FORWARD -s 172.16.9.111/32 -j RETURN
-A RRDIPT_FORWARD -d 172.16.9.111/32 -j RETURN
-A RRDIPT_FORWARD -s 172.16.9.125/32 -j RETURN
-A RRDIPT_FORWARD -d 172.16.9.125/32 -j RETURN
-A RRDIPT_FORWARD -s 172.16.9.126/32 -j RETURN
-A RRDIPT_FORWARD -d 172.16.9.126/32 -j RETURN
-A RRDIPT_FORWARD -s 172.16.9.3/32 -j RETURN
-A RRDIPT_FORWARD -d 172.16.9.3/32 -j RETURN
-A RRDIPT_FORWARD -s 172.19.132.1/32 -j RETURN
-A RRDIPT_FORWARD -d 172.19.132.1/32 -j RETURN
-A RRDIPT_FORWARD -s 192.168.9.2/32 -j RETURN
-A RRDIPT_FORWARD -d 192.168.9.2/32 -j RETURN
-A RRDIPT_INPUT -i eth0 -j RETURN
-A RRDIPT_OUTPUT -o eth0 -j RETURN
-A openclash -p udp -m udp --sport 801 -j RETURN
-A openclash -p udp -m udp --sport 500 -j RETURN
-A openclash -p udp -m udp --sport 68 -j RETURN
-A openclash -i utun -j RETURN
-A openclash -m set --match-set localnetwork dst -j RETURN
-A openclash -m set ! --match-set common_ports dst -j RETURN
-A openclash -p udp -j openclash_upnp
-A openclash -j MARK --set-xmark 0x162/0xffffffff
-A openclash_dns_hijack -p tcp -m comment --comment "OpenClash TCP DNS Hijack" -m tcp --dport 53 -j MARK --set-xmark 0x162/0xffffffff
-A openclash_upnp -s 172.16.9.11/32 -p udp -m udp --sport 60368 -j RETURN
COMMIT
# Completed on Wed Nov 22 10:03:26 2023

#IPv4 Filter chain

# Generated by iptables-save v1.8.7 on Wed Nov 22 10:03:26 2023
*filter
:INPUT ACCEPT [0:0]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [0:0]
:DOCKER - [0:0]
:DOCKER-ISOLATION-STAGE-1 - [0:0]
:DOCKER-ISOLATION-STAGE-2 - [0:0]
:DOCKER-MAN - [0:0]
:DOCKER-USER - [0:0]
:MIA - [0:0]
:MINIUPNPD - [0:0]
:SOCAT - [0:0]
:forwarding_docker_rule - [0:0]
:forwarding_ipsecserver_rule - [0:0]
:forwarding_lan_rule - [0:0]
:forwarding_rule - [0:0]
:forwarding_vpn_rule - [0:0]
:forwarding_wan_rule - [0:0]
:input_docker_rule - [0:0]
:input_ipsecserver_rule - [0:0]
:input_lan_rule - [0:0]
:input_rule - [0:0]
:input_vpn_rule - [0:0]
:input_wan_rule - [0:0]
:openclash_wan_input - [0:0]
:output_docker_rule - [0:0]
:output_ipsecserver_rule - [0:0]
:output_lan_rule - [0:0]
:output_rule - [0:0]
:output_vpn_rule - [0:0]
:output_wan_rule - [0:0]
:reject - [0:0]
:syn_flood - [0:0]
:zone_docker_dest_ACCEPT - [0:0]
:zone_docker_forward - [0:0]
:zone_docker_input - [0:0]
:zone_docker_output - [0:0]
:zone_docker_src_ACCEPT - [0:0]
:zone_ipsecserver_dest_ACCEPT - [0:0]
:zone_ipsecserver_forward - [0:0]
:zone_ipsecserver_input - [0:0]
:zone_ipsecserver_output - [0:0]
:zone_ipsecserver_src_ACCEPT - [0:0]
:zone_lan_dest_ACCEPT - [0:0]
:zone_lan_forward - [0:0]
:zone_lan_input - [0:0]
:zone_lan_output - [0:0]
:zone_lan_src_ACCEPT - [0:0]
:zone_vpn_dest_ACCEPT - [0:0]
:zone_vpn_forward - [0:0]
:zone_vpn_input - [0:0]
:zone_vpn_output - [0:0]
:zone_vpn_src_ACCEPT - [0:0]
:zone_wan_dest_ACCEPT - [0:0]
:zone_wan_dest_REJECT - [0:0]
:zone_wan_forward - [0:0]
:zone_wan_input - [0:0]
:zone_wan_output - [0:0]
:zone_wan_src_REJECT - [0:0]
-A INPUT -i eth0 -m set ! --match-set localnetwork src -j openclash_wan_input
-A INPUT -p tcp -m tcp --dport 53 -m comment --comment "Rule For Control" -j MIA
-A INPUT -p udp -m udp --dport 53 -m comment --comment "Rule For Control" -j MIA
-A INPUT -j SOCAT
-A INPUT -i br-lan -p udp -m udp --dport 60502 -j ACCEPT
-A INPUT -i br-lan -p udp -m udp --dport 55717 -j ACCEPT
-A INPUT -i br-lan -p udp -m udp --dport 33642 -j ACCEPT
-A INPUT -d 172.16.9.1/32 -i br-lan -p tcp -m tcp --dport 42915 -j ACCEPT
-A INPUT -s 127.0.0.1/32 -d 127.0.0.1/32 -i lo -p tcp -m tcp --dport 47403 -j DROP
-A INPUT -i br-lan -p tcp -m tcp --dport 16363 -j ACCEPT
-A INPUT -i lo -m comment --comment "!fw3" -j ACCEPT
-A INPUT -m comment --comment "!fw3: Custom input rule chain" -j input_rule
-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment "!fw3" -j ACCEPT
-A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -m comment --comment "!fw3" -j syn_flood
-A INPUT -i br-lan -m comment --comment "!fw3" -j zone_lan_input
-A INPUT -i utun -m comment --comment "!fw3" -j zone_lan_input
-A INPUT -i eth0 -m comment --comment "!fw3" -j zone_wan_input
-A INPUT -i tun0 -m comment --comment "!fw3" -j zone_vpn_input
-A INPUT -i ipsec0 -m comment --comment "!fw3" -j zone_ipsecserver_input
-A INPUT -i docker0 -m comment --comment "!fw3" -j zone_docker_input
-A FORWARD -o utun -p udp -m udp --dport 443 -m comment --comment "OpenClash QUIC REJECT" -m set ! --match-set china_ip_route dst -j REJECT --reject-with icmp-port-unreachable
-A FORWARD -o utun -m comment --comment "OpenClash TUN Forward" -j ACCEPT
-A FORWARD -m comment --comment "Rule For Control" -j MIA
-A FORWARD -j DOCKER-USER
-A FORWARD -j DOCKER-ISOLATION-STAGE-1
-A FORWARD -o docker0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -o docker0 -j DOCKER
-A FORWARD -i docker0 ! -o docker0 -j ACCEPT
-A FORWARD -i docker0 -o docker0 -j ACCEPT
-A FORWARD -o br-659bc8f9295d -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -o br-659bc8f9295d -j DOCKER
-A FORWARD -i br-659bc8f9295d ! -o br-659bc8f9295d -j ACCEPT
-A FORWARD -i br-659bc8f9295d -o br-659bc8f9295d -j ACCEPT
-A FORWARD -m comment --comment "!fw3: Custom forwarding rule chain" -j forwarding_rule
-A FORWARD -m comment --comment "!fw3: Traffic offloading" -m conntrack --ctstate RELATED,ESTABLISHED -j FLOWOFFLOAD --hw
-A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment "!fw3" -j ACCEPT
-A FORWARD -i br-lan -m comment --comment "!fw3" -j zone_lan_forward
-A FORWARD -i utun -m comment --comment "!fw3" -j zone_lan_forward
-A FORWARD -i eth0 -m comment --comment "!fw3" -j zone_wan_forward
-A FORWARD -i tun0 -m comment --comment "!fw3" -j zone_vpn_forward
-A FORWARD -i ipsec0 -m comment --comment "!fw3" -j zone_ipsecserver_forward
-A FORWARD -i docker0 -m comment --comment "!fw3" -j zone_docker_forward
-A FORWARD -m comment --comment "!fw3" -j reject
-A OUTPUT -o lo -m comment --comment "!fw3" -j ACCEPT
-A OUTPUT -m comment --comment "!fw3: Custom output rule chain" -j output_rule
-A OUTPUT -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment "!fw3" -j ACCEPT
-A OUTPUT -o br-lan -m comment --comment "!fw3" -j zone_lan_output
-A OUTPUT -o utun -m comment --comment "!fw3" -j zone_lan_output
-A OUTPUT -o eth0 -m comment --comment "!fw3" -j zone_wan_output
-A OUTPUT -o tun0 -m comment --comment "!fw3" -j zone_vpn_output
-A OUTPUT -o ipsec0 -m comment --comment "!fw3" -j zone_ipsecserver_output
-A OUTPUT -o docker0 -m comment --comment "!fw3" -j zone_docker_output
-A DOCKER -d 192.168.9.2/32 ! -i br-659bc8f9295d -o br-659bc8f9295d -p tcp -m tcp --dport 8096 -j ACCEPT
-A DOCKER-ISOLATION-STAGE-1 -i docker0 ! -o docker0 -j DOCKER-ISOLATION-STAGE-2
-A DOCKER-ISOLATION-STAGE-1 -i br-659bc8f9295d ! -o br-659bc8f9295d -j DOCKER-ISOLATION-STAGE-2
-A DOCKER-ISOLATION-STAGE-1 -j RETURN
-A DOCKER-ISOLATION-STAGE-2 -o docker0 -j DROP
-A DOCKER-ISOLATION-STAGE-2 -o br-659bc8f9295d -j DROP
-A DOCKER-ISOLATION-STAGE-2 -j RETURN
-A DOCKER-MAN -i br-lan -o docker0 -j RETURN
-A DOCKER-MAN -o docker0 -m conntrack --ctstate RELATED,ESTABLISHED -j RETURN
-A DOCKER-MAN -o docker0 -m conntrack --ctstate INVALID,NEW -j DROP
-A DOCKER-MAN -j RETURN
-A DOCKER-USER -j DOCKER-MAN
-A DOCKER-USER -j RETURN
-A MINIUPNPD -d 172.16.9.11/32 -p udp -m udp --dport 60368 -j ACCEPT
-A openclash_wan_input -p udp -m multiport --dports 7892,7895,9965,7890,7891,7893,7874 -j REJECT --reject-with icmp-port-unreachable
-A openclash_wan_input -p tcp -m multiport --dports 7892,7895,9965,7890,7891,7893,7874 -j REJECT --reject-with icmp-port-unreachable
-A reject -p tcp -m comment --comment "!fw3" -j REJECT --reject-with tcp-reset
-A reject -m comment --comment "!fw3" -j REJECT --reject-with icmp-port-unreachable
-A syn_flood -m limit --limit 25/sec --limit-burst 50 -m comment --comment "!fw3" -j RETURN
-A syn_flood -m comment --comment "!fw3" -j DROP
-A zone_docker_dest_ACCEPT -o docker0 -m comment --comment "!fw3" -j ACCEPT
-A zone_docker_forward -m comment --comment "!fw3: Custom docker forwarding rule chain" -j forwarding_docker_rule
-A zone_docker_forward -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port forwards" -j ACCEPT
-A zone_docker_forward -m comment --comment "!fw3" -j zone_docker_dest_ACCEPT
-A zone_docker_input -m comment --comment "!fw3: Custom docker input rule chain" -j input_docker_rule
-A zone_docker_input -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port redirections" -j ACCEPT
-A zone_docker_input -m comment --comment "!fw3" -j zone_docker_src_ACCEPT
-A zone_docker_output -m comment --comment "!fw3: Custom docker output rule chain" -j output_docker_rule
-A zone_docker_output -m comment --comment "!fw3" -j zone_docker_dest_ACCEPT
-A zone_docker_src_ACCEPT -i docker0 -m conntrack --ctstate NEW,UNTRACKED -m comment --comment "!fw3" -j ACCEPT
-A zone_ipsecserver_dest_ACCEPT -o ipsec0 -m comment --comment "!fw3" -j ACCEPT
-A zone_ipsecserver_forward -m comment --comment "!fw3: Custom ipsecserver forwarding rule chain" -j forwarding_ipsecserver_rule
-A zone_ipsecserver_forward -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port forwards" -j ACCEPT
-A zone_ipsecserver_forward -m comment --comment "!fw3" -j zone_ipsecserver_dest_ACCEPT
-A zone_ipsecserver_input -m comment --comment "!fw3: Custom ipsecserver input rule chain" -j input_ipsecserver_rule
-A zone_ipsecserver_input -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port redirections" -j ACCEPT
-A zone_ipsecserver_input -m comment --comment "!fw3" -j zone_ipsecserver_src_ACCEPT
-A zone_ipsecserver_output -m comment --comment "!fw3: Custom ipsecserver output rule chain" -j output_ipsecserver_rule
-A zone_ipsecserver_output -m comment --comment "!fw3" -j zone_ipsecserver_dest_ACCEPT
-A zone_ipsecserver_src_ACCEPT -i ipsec0 -m conntrack --ctstate NEW,UNTRACKED -m comment --comment "!fw3" -j ACCEPT
-A zone_lan_dest_ACCEPT -o br-lan -m comment --comment "!fw3" -j ACCEPT
-A zone_lan_dest_ACCEPT -o utun -m comment --comment "!fw3" -j ACCEPT
-A zone_lan_forward -m comment --comment "!fw3: Custom lan forwarding rule chain" -j forwarding_lan_rule
-A zone_lan_forward -m comment --comment "!fw3: Zone lan to wan forwarding policy" -j zone_wan_dest_ACCEPT
-A zone_lan_forward -m comment --comment "!fw3: Zone lan to vpn forwarding policy" -j zone_vpn_dest_ACCEPT
-A zone_lan_forward -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port forwards" -j ACCEPT
-A zone_lan_forward -m comment --comment "!fw3" -j zone_lan_dest_ACCEPT
-A zone_lan_input -m comment --comment "!fw3: Custom lan input rule chain" -j input_lan_rule
-A zone_lan_input -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port redirections" -j ACCEPT
-A zone_lan_input -m comment --comment "!fw3" -j zone_lan_src_ACCEPT
-A zone_lan_output -m comment --comment "!fw3: Custom lan output rule chain" -j output_lan_rule
-A zone_lan_output -m comment --comment "!fw3" -j zone_lan_dest_ACCEPT
-A zone_lan_src_ACCEPT -i br-lan -m conntrack --ctstate NEW,UNTRACKED -m comment --comment "!fw3" -j ACCEPT
-A zone_lan_src_ACCEPT -i utun -m conntrack --ctstate NEW,UNTRACKED -m comment --comment "!fw3" -j ACCEPT
-A zone_vpn_dest_ACCEPT -o tun0 -m conntrack --ctstate INVALID -m comment --comment "!fw3: Prevent NAT leakage" -j DROP
-A zone_vpn_dest_ACCEPT -o tun0 -m comment --comment "!fw3" -j ACCEPT
-A zone_vpn_forward -m comment --comment "!fw3: Custom vpn forwarding rule chain" -j forwarding_vpn_rule
-A zone_vpn_forward -m comment --comment "!fw3: Zone vpn to wan forwarding policy" -j zone_wan_dest_ACCEPT
-A zone_vpn_forward -m comment --comment "!fw3: Zone vpn to lan forwarding policy" -j zone_lan_dest_ACCEPT
-A zone_vpn_forward -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port forwards" -j ACCEPT
-A zone_vpn_forward -m comment --comment "!fw3" -j zone_vpn_dest_ACCEPT
-A zone_vpn_input -m comment --comment "!fw3: Custom vpn input rule chain" -j input_vpn_rule
-A zone_vpn_input -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port redirections" -j ACCEPT
-A zone_vpn_input -m comment --comment "!fw3" -j zone_vpn_src_ACCEPT
-A zone_vpn_output -m comment --comment "!fw3: Custom vpn output rule chain" -j output_vpn_rule
-A zone_vpn_output -m comment --comment "!fw3" -j zone_vpn_dest_ACCEPT
-A zone_vpn_src_ACCEPT -i tun0 -m conntrack --ctstate NEW,UNTRACKED -m comment --comment "!fw3" -j ACCEPT
-A zone_wan_dest_ACCEPT -o eth0 -m conntrack --ctstate INVALID -m comment --comment "!fw3: Prevent NAT leakage" -j DROP
-A zone_wan_dest_ACCEPT -o eth0 -m comment --comment "!fw3" -j ACCEPT
-A zone_wan_dest_REJECT -o eth0 -m comment --comment "!fw3" -j reject
-A zone_wan_forward -j MINIUPNPD
-A zone_wan_forward -m comment --comment "!fw3: Custom wan forwarding rule chain" -j forwarding_wan_rule
-A zone_wan_forward -p esp -m comment --comment "!fw3: Allow-IPSec-ESP" -j zone_lan_dest_ACCEPT
-A zone_wan_forward -p udp -m udp --dport 500 -m comment --comment "!fw3: Allow-ISAKMP" -j zone_lan_dest_ACCEPT
-A zone_wan_forward -p tcp -m comment --comment "!fw3: Deny-All-Forward" -j reject
-A zone_wan_forward -p udp -m comment --comment "!fw3: Deny-All-Forward" -j reject
-A zone_wan_forward -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port forwards" -j ACCEPT
-A zone_wan_forward -m comment --comment "!fw3" -j zone_wan_dest_REJECT
-A zone_wan_input -m comment --comment "!fw3: Custom wan input rule chain" -j input_wan_rule
-A zone_wan_input -p udp -m udp --dport 68 -m comment --comment "!fw3: Allow-DHCP-Renew" -j ACCEPT
-A zone_wan_input -p igmp -m comment --comment "!fw3: Allow-IGMP" -j ACCEPT
-A zone_wan_input -p tcp -m tcp --dport 8118 -m comment --comment "!fw3: adblock" -j DROP
-A zone_wan_input -p tcp -m tcp --dport 801 -m comment --comment "!fw3: Alist-Interface" -j ACCEPT
-A zone_wan_input -p udp -m udp --dport 801 -m comment --comment "!fw3: Alist-Interface" -j ACCEPT
-A zone_wan_input -p tcp -m comment --comment "!fw3: Deny-All-In" -j reject
-A zone_wan_input -p udp -m comment --comment "!fw3: Deny-All-In" -j reject
-A zone_wan_input -p tcp -m tcp --dport 801 -m comment --comment "!fw3: alist" -j ACCEPT
-A zone_wan_input -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port redirections" -j ACCEPT
-A zone_wan_input -m comment --comment "!fw3" -j zone_wan_src_REJECT
-A zone_wan_output -m comment --comment "!fw3: Custom wan output rule chain" -j output_wan_rule
-A zone_wan_output -m comment --comment "!fw3" -j zone_wan_dest_ACCEPT
-A zone_wan_src_REJECT -i eth0 -m comment --comment "!fw3" -j reject
COMMIT
# Completed on Wed Nov 22 10:03:26 2023

#IPv6 NAT chain

# Generated by ip6tables-save v1.8.7 on Wed Nov 22 10:03:26 2023
*nat
:PREROUTING ACCEPT [13:3427]
:INPUT ACCEPT [3:1189]
:OUTPUT ACCEPT [75:11161]
:POSTROUTING ACCEPT [75:11161]
-A PREROUTING -p udp -m udp --dport 53 -j REDIRECT --to-ports 53
-A PREROUTING -p tcp -m tcp --dport 53 -j REDIRECT --to-ports 53
COMMIT
# Completed on Wed Nov 22 10:03:26 2023

#IPv6 Mangle chain

# Generated by ip6tables-save v1.8.7 on Wed Nov 22 10:03:26 2023
*mangle
:PREROUTING ACCEPT [22:5910]
:INPUT ACCEPT [18:5546]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [17:5615]
:POSTROUTING ACCEPT [26:8388]
-A FORWARD -o eth0 -p tcp -m tcp --tcp-flags SYN,RST SYN -m comment --comment "!fw3: Zone wan MTU fixing" -j TCPMSS --clamp-mss-to-pmtu
-A FORWARD -i eth0 -p tcp -m tcp --tcp-flags SYN,RST SYN -m comment --comment "!fw3: Zone wan MTU fixing" -j TCPMSS --clamp-mss-to-pmtu
COMMIT
# Completed on Wed Nov 22 10:03:26 2023

#IPv6 Filter chain

# Generated by ip6tables-save v1.8.7 on Wed Nov 22 10:03:26 2023
*filter
:INPUT ACCEPT [0:0]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [0:0]
:MINIUPNPD - [0:0]
:SOCAT - [0:0]
:forwarding_docker_rule - [0:0]
:forwarding_ipsecserver_rule - [0:0]
:forwarding_lan_rule - [0:0]
:forwarding_rule - [0:0]
:forwarding_vpn_rule - [0:0]
:forwarding_wan_rule - [0:0]
:input_docker_rule - [0:0]
:input_ipsecserver_rule - [0:0]
:input_lan_rule - [0:0]
:input_rule - [0:0]
:input_vpn_rule - [0:0]
:input_wan_rule - [0:0]
:output_docker_rule - [0:0]
:output_ipsecserver_rule - [0:0]
:output_lan_rule - [0:0]
:output_rule - [0:0]
:output_vpn_rule - [0:0]
:output_wan_rule - [0:0]
:reject - [0:0]
:syn_flood - [0:0]
:zone_docker_dest_ACCEPT - [0:0]
:zone_docker_forward - [0:0]
:zone_docker_input - [0:0]
:zone_docker_output - [0:0]
:zone_docker_src_ACCEPT - [0:0]
:zone_ipsecserver_dest_ACCEPT - [0:0]
:zone_ipsecserver_forward - [0:0]
:zone_ipsecserver_input - [0:0]
:zone_ipsecserver_output - [0:0]
:zone_ipsecserver_src_ACCEPT - [0:0]
:zone_lan_dest_ACCEPT - [0:0]
:zone_lan_forward - [0:0]
:zone_lan_input - [0:0]
:zone_lan_output - [0:0]
:zone_lan_src_ACCEPT - [0:0]
:zone_vpn_dest_ACCEPT - [0:0]
:zone_vpn_forward - [0:0]
:zone_vpn_input - [0:0]
:zone_vpn_output - [0:0]
:zone_vpn_src_ACCEPT - [0:0]
:zone_wan_dest_ACCEPT - [0:0]
:zone_wan_dest_REJECT - [0:0]
:zone_wan_forward - [0:0]
:zone_wan_input - [0:0]
:zone_wan_output - [0:0]
:zone_wan_src_REJECT - [0:0]
-A INPUT -j SOCAT
-A INPUT -i lo -m comment --comment "!fw3" -j ACCEPT
-A INPUT -m comment --comment "!fw3: Custom input rule chain" -j input_rule
-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment "!fw3" -j ACCEPT
-A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -m comment --comment "!fw3" -j syn_flood
-A INPUT -i br-lan -m comment --comment "!fw3" -j zone_lan_input
-A INPUT -i utun -m comment --comment "!fw3" -j zone_lan_input
-A INPUT -i eth0 -m comment --comment "!fw3" -j zone_wan_input
-A INPUT -i tun0 -m comment --comment "!fw3" -j zone_vpn_input
-A INPUT -i ipsec0 -m comment --comment "!fw3" -j zone_ipsecserver_input
-A INPUT -i docker0 -m comment --comment "!fw3" -j zone_docker_input
-A FORWARD -m comment --comment "!fw3: Custom forwarding rule chain" -j forwarding_rule
-A FORWARD -m comment --comment "!fw3: Traffic offloading" -m conntrack --ctstate RELATED,ESTABLISHED -j FLOWOFFLOAD --hw
-A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment "!fw3" -j ACCEPT
-A FORWARD -i br-lan -m comment --comment "!fw3" -j zone_lan_forward
-A FORWARD -i utun -m comment --comment "!fw3" -j zone_lan_forward
-A FORWARD -i eth0 -m comment --comment "!fw3" -j zone_wan_forward
-A FORWARD -i tun0 -m comment --comment "!fw3" -j zone_vpn_forward
-A FORWARD -i ipsec0 -m comment --comment "!fw3" -j zone_ipsecserver_forward
-A FORWARD -i docker0 -m comment --comment "!fw3" -j zone_docker_forward
-A FORWARD -m comment --comment "!fw3" -j reject
-A OUTPUT -o lo -m comment --comment "!fw3" -j ACCEPT
-A OUTPUT -m comment --comment "!fw3: Custom output rule chain" -j output_rule
-A OUTPUT -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment "!fw3" -j ACCEPT
-A OUTPUT -o br-lan -m comment --comment "!fw3" -j zone_lan_output
-A OUTPUT -o utun -m comment --comment "!fw3" -j zone_lan_output
-A OUTPUT -o eth0 -m comment --comment "!fw3" -j zone_wan_output
-A OUTPUT -o tun0 -m comment --comment "!fw3" -j zone_vpn_output
-A OUTPUT -o ipsec0 -m comment --comment "!fw3" -j zone_ipsecserver_output
-A OUTPUT -o docker0 -m comment --comment "!fw3" -j zone_docker_output
-A reject -p tcp -m comment --comment "!fw3" -j REJECT --reject-with tcp-reset
-A reject -m comment --comment "!fw3" -j REJECT --reject-with icmp6-port-unreachable
-A syn_flood -m limit --limit 25/sec --limit-burst 50 -m comment --comment "!fw3" -j RETURN
-A syn_flood -m comment --comment "!fw3" -j DROP
-A zone_docker_dest_ACCEPT -o docker0 -m comment --comment "!fw3" -j ACCEPT
-A zone_docker_forward -m comment --comment "!fw3: Custom docker forwarding rule chain" -j forwarding_docker_rule
-A zone_docker_forward -m comment --comment "!fw3" -j zone_docker_dest_ACCEPT
-A zone_docker_input -m comment --comment "!fw3: Custom docker input rule chain" -j input_docker_rule
-A zone_docker_input -m comment --comment "!fw3" -j zone_docker_src_ACCEPT
-A zone_docker_output -m comment --comment "!fw3: Custom docker output rule chain" -j output_docker_rule
-A zone_docker_output -m comment --comment "!fw3" -j zone_docker_dest_ACCEPT
-A zone_docker_src_ACCEPT -i docker0 -m conntrack --ctstate NEW,UNTRACKED -m comment --comment "!fw3" -j ACCEPT
-A zone_ipsecserver_dest_ACCEPT -o ipsec0 -m comment --comment "!fw3" -j ACCEPT
-A zone_ipsecserver_forward -m comment --comment "!fw3: Custom ipsecserver forwarding rule chain" -j forwarding_ipsecserver_rule
-A zone_ipsecserver_forward -m comment --comment "!fw3" -j zone_ipsecserver_dest_ACCEPT
-A zone_ipsecserver_input -m comment --comment "!fw3: Custom ipsecserver input rule chain" -j input_ipsecserver_rule
-A zone_ipsecserver_input -m comment --comment "!fw3" -j zone_ipsecserver_src_ACCEPT
-A zone_ipsecserver_output -m comment --comment "!fw3: Custom ipsecserver output rule chain" -j output_ipsecserver_rule
-A zone_ipsecserver_output -m comment --comment "!fw3" -j zone_ipsecserver_dest_ACCEPT
-A zone_ipsecserver_src_ACCEPT -i ipsec0 -m conntrack --ctstate NEW,UNTRACKED -m comment --comment "!fw3" -j ACCEPT
-A zone_lan_dest_ACCEPT -o br-lan -m comment --comment "!fw3" -j ACCEPT
-A zone_lan_dest_ACCEPT -o utun -m comment --comment "!fw3" -j ACCEPT
-A zone_lan_forward -m comment --comment "!fw3: Custom lan forwarding rule chain" -j forwarding_lan_rule
-A zone_lan_forward -m comment --comment "!fw3: Zone lan to wan forwarding policy" -j zone_wan_dest_ACCEPT
-A zone_lan_forward -m comment --comment "!fw3: Zone lan to vpn forwarding policy" -j zone_vpn_dest_ACCEPT
-A zone_lan_forward -m comment --comment "!fw3" -j zone_lan_dest_ACCEPT
-A zone_lan_input -m comment --comment "!fw3: Custom lan input rule chain" -j input_lan_rule
-A zone_lan_input -m comment --comment "!fw3" -j zone_lan_src_ACCEPT
-A zone_lan_output -m comment --comment "!fw3: Custom lan output rule chain" -j output_lan_rule
-A zone_lan_output -m comment --comment "!fw3" -j zone_lan_dest_ACCEPT
-A zone_lan_src_ACCEPT -i br-lan -m conntrack --ctstate NEW,UNTRACKED -m comment --comment "!fw3" -j ACCEPT
-A zone_lan_src_ACCEPT -i utun -m conntrack --ctstate NEW,UNTRACKED -m comment --comment "!fw3" -j ACCEPT
-A zone_vpn_dest_ACCEPT -o tun0 -m conntrack --ctstate INVALID -m comment --comment "!fw3: Prevent NAT leakage" -j DROP
-A zone_vpn_dest_ACCEPT -o tun0 -m comment --comment "!fw3" -j ACCEPT
-A zone_vpn_forward -m comment --comment "!fw3: Custom vpn forwarding rule chain" -j forwarding_vpn_rule
-A zone_vpn_forward -m comment --comment "!fw3: Zone vpn to wan forwarding policy" -j zone_wan_dest_ACCEPT
-A zone_vpn_forward -m comment --comment "!fw3: Zone vpn to lan forwarding policy" -j zone_lan_dest_ACCEPT
-A zone_vpn_forward -m comment --comment "!fw3" -j zone_vpn_dest_ACCEPT
-A zone_vpn_input -m comment --comment "!fw3: Custom vpn input rule chain" -j input_vpn_rule
-A zone_vpn_input -m comment --comment "!fw3" -j zone_vpn_src_ACCEPT
-A zone_vpn_output -m comment --comment "!fw3: Custom vpn output rule chain" -j output_vpn_rule
-A zone_vpn_output -m comment --comment "!fw3" -j zone_vpn_dest_ACCEPT
-A zone_vpn_src_ACCEPT -i tun0 -m conntrack --ctstate NEW,UNTRACKED -m comment --comment "!fw3" -j ACCEPT
-A zone_wan_dest_ACCEPT -o eth0 -m conntrack --ctstate INVALID -m comment --comment "!fw3: Prevent NAT leakage" -j DROP
-A zone_wan_dest_ACCEPT -o eth0 -m comment --comment "!fw3" -j ACCEPT
-A zone_wan_dest_REJECT -o eth0 -m comment --comment "!fw3" -j reject
-A zone_wan_forward -j MINIUPNPD
-A zone_wan_forward -m comment --comment "!fw3: Custom wan forwarding rule chain" -j forwarding_wan_rule
-A zone_wan_forward -p ipv6-icmp -m icmp6 --icmpv6-type 128 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Forward" -j ACCEPT
-A zone_wan_forward -p ipv6-icmp -m icmp6 --icmpv6-type 129 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Forward" -j ACCEPT
-A zone_wan_forward -p ipv6-icmp -m icmp6 --icmpv6-type 1 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Forward" -j ACCEPT
-A zone_wan_forward -p ipv6-icmp -m icmp6 --icmpv6-type 2 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Forward" -j ACCEPT
-A zone_wan_forward -p ipv6-icmp -m icmp6 --icmpv6-type 3 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Forward" -j ACCEPT
-A zone_wan_forward -p ipv6-icmp -m icmp6 --icmpv6-type 4/0 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Forward" -j ACCEPT
-A zone_wan_forward -p ipv6-icmp -m icmp6 --icmpv6-type 4/1 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Forward" -j ACCEPT
-A zone_wan_forward -p esp -m comment --comment "!fw3: Allow-IPSec-ESP" -j zone_lan_dest_ACCEPT
-A zone_wan_forward -p udp -m udp --dport 500 -m comment --comment "!fw3: Allow-ISAKMP" -j zone_lan_dest_ACCEPT
-A zone_wan_forward -p tcp -m comment --comment "!fw3: Deny-All-Forward" -j reject
-A zone_wan_forward -p udp -m comment --comment "!fw3: Deny-All-Forward" -j reject
-A zone_wan_forward -m comment --comment "!fw3" -j zone_wan_dest_REJECT
-A zone_wan_input -m comment --comment "!fw3: Custom wan input rule chain" -j input_wan_rule
-A zone_wan_input -s fc00::/6 -d fc00::/6 -p udp -m udp --dport 546 -m comment --comment "!fw3: Allow-DHCPv6" -j ACCEPT
-A zone_wan_input -s fe80::/10 -p ipv6-icmp -m icmp6 --icmpv6-type 130/0 -m comment --comment "!fw3: Allow-MLD" -j ACCEPT
-A zone_wan_input -s fe80::/10 -p ipv6-icmp -m icmp6 --icmpv6-type 131/0 -m comment --comment "!fw3: Allow-MLD" -j ACCEPT
-A zone_wan_input -s fe80::/10 -p ipv6-icmp -m icmp6 --icmpv6-type 132/0 -m comment --comment "!fw3: Allow-MLD" -j ACCEPT
-A zone_wan_input -s fe80::/10 -p ipv6-icmp -m icmp6 --icmpv6-type 143/0 -m comment --comment "!fw3: Allow-MLD" -j ACCEPT
-A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 128 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT
-A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 129 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT
-A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 1 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT
-A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 2 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT
-A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 3 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT
-A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 4/0 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT
-A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 4/1 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT
-A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 133 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT
-A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 135 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT
-A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 134 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT
-A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 136 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT
-A zone_wan_input -p tcp -m tcp --dport 8118 -m comment --comment "!fw3: adblock" -j DROP
-A zone_wan_input -p tcp -m tcp --dport 801 -m comment --comment "!fw3: Alist-Interface" -j ACCEPT
-A zone_wan_input -p udp -m udp --dport 801 -m comment --comment "!fw3: Alist-Interface" -j ACCEPT
-A zone_wan_input -p tcp -m comment --comment "!fw3: Deny-All-In" -j reject
-A zone_wan_input -p udp -m comment --comment "!fw3: Deny-All-In" -j reject
-A zone_wan_input -p tcp -m tcp --dport 801 -m comment --comment "!fw3: alist" -j ACCEPT
-A zone_wan_input -m comment --comment "!fw3" -j zone_wan_src_REJECT
-A zone_wan_output -m comment --comment "!fw3: Custom wan output rule chain" -j output_wan_rule
-A zone_wan_output -m comment --comment "!fw3" -j zone_wan_dest_ACCEPT
-A zone_wan_src_REJECT -i eth0 -m comment --comment "!fw3" -j reject
COMMIT
# Completed on Wed Nov 22 10:03:26 2023

#===================== IPSET状态 =====================#

Name: mwan3_dynamic_ipv6
Type: hash:net
Revision: 7
Header: family inet6 hashsize 1024 maxelem 65536 bucketsize 12 initval 0xaa854335
Size in memory: 1240
References: 0
Number of entries: 0

Name: mwan3_connected_ipv4
Type: hash:net
Revision: 7
Header: family inet hashsize 1024 maxelem 65536 bucketsize 12 initval 0x5b47f9fa
Size in memory: 984
References: 0
Number of entries: 11

Name: mwan3_connected_ipv6
Type: hash:net
Revision: 7
Header: family inet6 hashsize 1024 maxelem 65536 bucketsize 12 initval 0x1ca79e35
Size in memory: 1312
References: 0
Number of entries: 1

Name: mwan3_custom_ipv4
Type: hash:net
Revision: 7
Header: family inet hashsize 1024 maxelem 65536 bucketsize 12 initval 0x20f6a000
Size in memory: 456
References: 0
Number of entries: 0

Name: mwan3_custom_ipv6
Type: hash:net
Revision: 7
Header: family inet6 hashsize 1024 maxelem 65536 bucketsize 12 initval 0x24c008b2
Size in memory: 1240
References: 0
Number of entries: 0

Name: mwan3_rule_ipv4_https
Type: hash:ip,mark
Revision: 3
Header: family inet markmask 0x00003f00 hashsize 1024 maxelem 65536 timeout 600 bucketsize 12 initval 0xdf5c1afb
Size in memory: 200
References: 0
Number of entries: 0

Name: mwan3_rule_ipv6_https
Type: hash:ip,mark
Revision: 3
Header: family inet6 markmask 0x00003f00 hashsize 1024 maxelem 65536 timeout 600 bucketsize 12 initval 0xd97a1181
Size in memory: 216
References: 0
Number of entries: 0

Name: cn
Type: hash:net
Revision: 7
Header: family inet hashsize 2048 maxelem 65536 bucketsize 12 initval 0x65170d89
Size in memory: 223680
References: 0
Number of entries: 8304

Name: ct
Type: hash:net
Revision: 7
Header: family inet hashsize 1024 maxelem 65536 bucketsize 12 initval 0x9fb840ca
Size in memory: 59064
References: 0
Number of entries: 1948

Name: cnc
Type: hash:net
Revision: 7
Header: family inet hashsize 1024 maxelem 65536 bucketsize 12 initval 0x7f55fab9
Size in memory: 32088
References: 0
Number of entries: 895

Name: cmcc
Type: hash:net
Revision: 7
Header: family inet hashsize 1024 maxelem 65536 bucketsize 12 initval 0x03fc18d4
Size in memory: 3048
References: 0
Number of entries: 55

Name: crtc
Type: hash:net
Revision: 7
Header: family inet hashsize 1024 maxelem 65536 bucketsize 12 initval 0xe923a7da
Size in memory: 1224
References: 0
Number of entries: 16

Name: cernet
Type: hash:net
Revision: 7
Header: family inet hashsize 1024 maxelem 65536 bucketsize 12 initval 0xba521cf5
Size in memory: 7608
References: 0
Number of entries: 162

Name: gwbn
Type: hash:net
Revision: 7
Header: family inet hashsize 1024 maxelem 65536 bucketsize 12 initval 0x7f6f1a30
Size in memory: 4824
References: 0
Number of entries: 94

Name: othernet
Type: hash:net
Revision: 7
Header: family inet hashsize 2048 maxelem 65536 bucketsize 12 initval 0x62de6a13
Size in memory: 147936
References: 0
Number of entries: 5134

Name: localnetwork
Type: hash:net
Revision: 7
Header: family inet hashsize 1024 maxelem 65536 bucketsize 12 initval 0xa6c4fa4e
Size in memory: 984
References: 4
Number of entries: 11

Name: common_ports
Type: bitmap:port
Revision: 3
Header: range 0-65535
Size in memory: 8264
References: 3
Number of entries: 31

Name: china_ip_route
Type: hash:net
Revision: 7
Header: family inet hashsize 32768 maxelem 1000000 bucketsize 12 initval 0x661a803a
Size in memory: 2625072
References: 1
Number of entries: 92986

Name: china_ip_route_pass
Type: hash:net
Revision: 7
Header: family inet hashsize 1024 maxelem 1000000 bucketsize 12 initval 0x03e724d6
Size in memory: 456
References: 0
Number of entries: 0

Name: mwan3_dynamic_ipv4
Type: list:set
Revision: 3
Header: size 8
Size in memory: 80
References: 0
Number of entries: 0

#===================== 路由表状态 =====================#

#IPv4

#route -n
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         172.19.132.1    0.0.0.0         UG    0      0        0 eth0
172.16.9.0      0.0.0.0         255.255.255.128 U     0      0        0 br-lan
172.17.0.0      0.0.0.0         255.255.0.0     U     0      0        0 docker0
172.19.132.0    0.0.0.0         255.255.252.0   U     0      0        0 eth0
192.168.9.0     0.0.0.0         255.255.255.0   U     0      0        0 br-659bc8f9295d
198.18.0.0      0.0.0.0         255.255.255.252 U     0      0        0 utun

#ip route list
default via 172.19.132.1 dev eth0 proto static src 172.19.132.6 
172.16.9.0/25 dev br-lan proto kernel scope link src 172.16.9.1 
172.17.0.0/16 dev docker0 proto kernel scope link src 172.17.0.1 linkdown 
172.19.132.0/22 dev eth0 proto kernel scope link src 172.19.132.6 
192.168.9.0/24 dev br-659bc8f9295d proto kernel scope link src 192.168.9.1 
198.18.0.0/30 dev utun proto kernel scope link src 198.18.0.1 

#ip rule show
0:	from all lookup local
32765:	from all fwmark 0x162 lookup 354
32766:	from all lookup main
32767:	from all lookup default

#IPv6

#route -A inet6
Kernel IPv6 routing table
Destination                                 Next Hop                                Flags Metric Ref    Use Iface
fe80::/64                                   ::                                      U     256    1        0 eth0    
fe80::/64                                   ::                                      U     256    1        0 br-lan  
fe80::/64                                   ::                                      U     256    1        0 vetha5e65ba
fe80::/64                                   ::                                      U     256    1        0 br-659bc8f9295d
fe80::/64                                   ::                                      U     256    1        0 utun    
::/0                                        ::                                      !n    -1     1        0 lo      
::1/128                                     ::                                      Un    0      6        0 lo      
fe80::/128                                  ::                                      Un    0      6        0 eth0    
fe80::/128                                  ::                                      Un    0      3        0 br-lan  
fe80::/128                                  ::                                      Un    0      3        0 br-659bc8f9295d
fe80::/128                                  ::                                      Un    0      3        0 vetha5e65ba
fe80::/128                                  ::                                      Un    0      3        0 utun    
fe80::42:5fff:fe2f:33c8/128                 ::                                      Un    0      2        0 br-659bc8f9295d
fe80::2e0:67ff:fe06:fc47/128                ::                                      Un    0      2        0 br-lan  
fe80::9b36:7317:af6c:6edc/128               ::                                      Un    0      2        0 utun    
fe80::d4e8:7eff:fe47:30ca/128               ::                                      Un    0      2        0 vetha5e65ba
fe80::f257:a6ff:fe99:9a94/128               ::                                      Un    0      4        0 eth0    
ff00::/8                                    ::                                      U     256    6        0 eth0    
ff00::/8                                    ::                                      U     256    5        0 br-lan  
ff00::/8                                    ::                                      U     256    5        0 vetha5e65ba
ff00::/8                                    ::                                      U     256    4        0 br-659bc8f9295d
ff00::/8                                    ::                                      U     256    5        0 utun    
::/0                                        ::                                      !n    -1     1        0 lo      

#ip -6 route list
fe80::/64 dev eth0 proto kernel metric 256 pref medium
fe80::/64 dev br-lan proto kernel metric 256 pref medium
fe80::/64 dev vetha5e65ba proto kernel metric 256 pref medium
fe80::/64 dev br-659bc8f9295d proto kernel metric 256 pref medium
fe80::/64 dev utun proto kernel metric 256 pref medium

#ip -6 rule show
0:	from all lookup local
32766:	from all lookup main
4200000001:	from all iif lo failed_policy
4200000007:	from all iif eth0 failed_policy
4200000010:	from all iif br-lan failed_policy
4200000023:	from all iif utun failed_policy

#===================== Tun设备状态 =====================#

utun: tun

#===================== 端口占用状态 =====================#

tcp        0      0 198.18.0.1:46511        0.0.0.0:*               LISTEN      24721/clash
tcp        0      0 :::9965                 :::*                    LISTEN      24721/clash
tcp        0      0 :::7895                 :::*                    LISTEN      24721/clash
tcp        0      0 :::7893                 :::*                    LISTEN      24721/clash
tcp        0      0 :::7892                 :::*                    LISTEN      24721/clash
tcp        0      0 :::7891                 :::*                    LISTEN      24721/clash
tcp        0      0 :::7890                 :::*                    LISTEN      24721/clash
udp        0      0 :::7874                 :::*                                24721/clash
udp        0      0 :::7891                 :::*                                24721/clash
udp        0      0 :::7892                 :::*                                24721/clash
udp        0      0 :::7893                 :::*                                24721/clash
udp        0      0 :::7895                 :::*                                24721/clash

#===================== 测试本机DNS查询(www.baidu.com) =====================#

Server:		202.192.112.34
Address:	202.192.112.34:53

Non-authoritative answer:
www.baidu.com	canonical name = www.a.shifen.com
Name:	www.a.shifen.com
Address: 157.148.69.74
Name:	www.a.shifen.com
Address: 157.148.69.80

Non-authoritative answer:
www.baidu.com	canonical name = www.a.shifen.com
Name:	www.a.shifen.com
Address: 2408:8756:c52:1aec:0:ff:b013:5a11
Name:	www.a.shifen.com
Address: 2408:8756:c52:1107:0:ff:b035:844b


#===================== 测试内核DNS查询(www.instagram.com) =====================#

Status: 0
TC: false
RD: true
RA: true
AD: false
CD: false

Question: 
  Name: www.instagram.com.
  Qtype: 1
  Qclass: 1

Answer: 
  TTL: 1
  data: 103.252.114.61
  name: www.instagram.com.
  type: 1


Dnsmasq 当前默认 resolv 文件：/tmp/resolv.conf.d/resolv.conf.auto

#===================== /tmp/resolv.conf.d/resolv.conf.auto =====================#

# Interface lan
nameserver 172.16.9.1
# Interface wan
nameserver 202.192.112.34
nameserver 210.21.4.130

#===================== 测试本机网络连接(www.baidu.com) =====================#


#===================== 测试本机网络下载(raw.githubusercontent.com) =====================#


#===================== 最近运行日志(自动切换为Debug模式) =====================#

time="2023-11-22T10:03:13.111821941+08:00" level=info msg="Start initial provider Microsoft"
time="2023-11-22T10:03:13.114064512+08:00" level=info msg="Start initial provider Streaming"
time="2023-11-22T10:03:13.125604127+08:00" level=info msg="Start initial provider Apple"
time="2023-11-22T10:03:13.516611892+08:00" level=info msg="[TCP] clash.meta --> ************ match DstPort(80) using Switch[COMPATIBLE]"
time="2023-11-22T10:03:13.530661134+08:00" level=info msg="[TCP] clash.meta --> ************ match DstPort(80) using Switch[🇭🇰 HK | 香港 18]"
time="2023-11-22T10:03:13.533487081+08:00" level=info msg="[TCP] clash.meta --> ************ match DstPort(80) using Switch[🇭🇰 HK | 香港 18]"
time="2023-11-22T10:03:13.53902705+08:00" level=info msg="[TCP] clash.meta --> ************ match DstPort(80) using Switch[🇭🇰 HK | 香港 01]"
time="2023-11-22T10:03:13.67443907+08:00" level=info msg="[TCP] clash.meta --> ************ match Match using Switch[🇭🇰 HK | 香港 18]"
time="2023-11-22T10:03:14.246661465+08:00" level=info msg="[TCP] clash.meta --> ************ match Match using Switch[🇭🇰 HK | 香港 18]"
time="2023-11-22T10:03:14.294461348+08:00" level=info msg="[TCP] clash.meta --> ************ match GeoIP(CN) using CN[DIRECT]"
time="2023-11-22T10:03:14.323347842+08:00" level=info msg="[TCP] clash.meta --> ************ match GeoIP(CN) using CN[DIRECT]"
time="2023-11-22T10:03:20.155801093+08:00" level=info msg="Start initial configuration in progress"
time="2023-11-22T10:03:20.157801043+08:00" level=info msg="Geodata Loader mode: memconservative"
time="2023-11-22T10:03:20.158932212+08:00" level=info msg="Initial configuration complete, total time: 2ms"
time="2023-11-22T10:03:20.160134868+08:00" level=info msg="RESTful API listening at: [::]:9965"
time="2023-11-22T10:03:20.214280921+08:00" level=info msg="Authentication of local server updated"
time="2023-11-22T10:03:20.214328859+08:00" level=info msg="Sniffer is closed"
time="2023-11-22T10:03:20.214349995+08:00" level=info msg="Use tcp concurrent"
time="2023-11-22T10:03:20.214531702+08:00" level=info msg="DNS server listening at: [::]:7874"
time="2023-11-22T10:03:20.214745119+08:00" level=info msg="HTTP proxy listening at: [::]:7890"
time="2023-11-22T10:03:20.214874855+08:00" level=info msg="SOCKS proxy listening at: [::]:7891"
time="2023-11-22T10:03:20.214989011+08:00" level=info msg="Redirect proxy listening at: [::]:7892"
time="2023-11-22T10:03:20.215099471+08:00" level=info msg="TProxy server listening at: [::]:7895"
time="2023-11-22T10:03:20.215342126+08:00" level=info msg="Mixed(http+socks) proxy listening at: [::]:7893"
time="2023-11-22T10:03:20.217566608+08:00" level=info msg="[TUN] Tun adapter listening at: utun([198.18.0.1/30],[]), mtu: 9000, auto route: false, ip stack: System"
time="2023-11-22T10:03:20.218140558+08:00" level=info msg="Start initial compatible provider default"
time="2023-11-22T10:03:20.21823155+08:00" level=info msg="Start initial provider ************"
time="2023-11-22T10:03:20.220528863+08:00" level=info msg="Start initial compatible provider Switch"
time="2023-11-22T10:03:20.221299835+08:00" level=info msg="Start initial compatible provider Bilibili"
time="2023-11-22T10:03:20.221369906+08:00" level=info msg="Start initial provider ************"
time="2023-11-22T10:03:20.224298085+08:00" level=info msg="Start initial compatible provider Fallback"
time="2023-11-22T10:03:20.224400827+08:00" level=info msg="Start initial compatible provider CN"
time="2023-11-22T10:03:20.372822457+08:00" level=info msg="Start initial provider Microsoft"
time="2023-11-22T10:03:20.383949872+08:00" level=info msg="Start initial provider Nintendo"
time="2023-11-22T10:03:20.390721893+08:00" level=info msg="Start initial provider Notion"
time="2023-11-22T10:03:20.391180631+08:00" level=info msg="Start initial provider China"
time="2023-11-22T10:03:20.393939334+08:00" level=info msg="Start initial provider Global"
time="2023-11-22T10:03:20.406713704+08:00" level=info msg="Start initial provider Spotify"
time="2023-11-22T10:03:20.413079523+08:00" level=info msg="Start initial provider Advertising"
time="2023-11-22T10:03:20.415750104+08:00" level=info msg="Start initial provider Unbreak"
time="2023-11-22T10:03:20.415892622+08:00" level=info msg="Start initial provider Streaming"
time="2023-11-22T10:03:20.432945614+08:00" level=info msg="Start initial provider Telegram"
time="2023-11-22T10:03:20.432951879+08:00" level=info msg="Start initial provider Apple"
time="2023-11-22T10:03:20.432955948+08:00" level=info msg="Start initial provider Advertising-antiAD"
time="2023-11-22T10:03:20.432959477+08:00" level=info msg="Start initial provider SteamCN"
time="2023-11-22T10:03:20.908131523+08:00" level=info msg="[TCP] clash.meta --> ************ match DstPort(80) using Switch[🇭🇰 HK | 香港 01]"
time="2023-11-22T10:03:20.90953647+08:00" level=info msg="[TCP] clash.meta --> ************ match DstPort(80) using Switch[🇭🇰 HK | 香港 01]"
time="2023-11-22T10:03:20.937474041+08:00" level=info msg="[TCP] clash.meta --> ************ match DstPort(80) using Switch[🇭🇰 HK | 香港 01]"
time="2023-11-22T10:03:20.985594341+08:00" level=info msg="[TCP] clash.meta --> ************ match DstPort(80) using Switch[🇭🇰 HK | 香港 01]"
time="2023-11-22T10:03:21.616999489+08:00" level=info msg="[TCP] clash.meta --> ************ match GeoIP(CN) using CN[DIRECT]"
time="2023-11-22T10:03:21.64226072+08:00" level=info msg="[TCP] clash.meta --> ************ match GeoIP(CN) using CN[DIRECT]"
time="2023-11-22T10:03:21.702599764+08:00" level=info msg="[TCP] clash.meta --> ************ match Match using Switch[🇭🇰 HK | 香港 18]"
time="2023-11-22T10:03:21.711086297+08:00" level=info msg="[TCP] clash.meta --> ************ match Match using Switch[🇭🇰 HK | 香港 18]"
2023-11-22 10:03:22 Tip: DNS Hijacking Mode is Dnsmasq Redirect...
2023-11-22 10:03:24 Tip: Waiting for TUN Interface Start...
2023-11-22 10:03:25 Tip: Start Add Port Bypassing Rules For Firewall Redirect and Firewall Rules...
2023-11-22 10:03:25 Tip: Start Add Custom Firewall Rules...
2023-11-22 10:03:28 Reload OpenClash Firewall Rules...
time="2023-11-22T10:03:29.819430503+08:00" level=debug msg="[DNS] resolve api.miwifi.com from https://dns.cloudflare.com:443/dns-query"
time="2023-11-22T10:03:29.819884377+08:00" level=debug msg="[DNS] resolve api.miwifi.com from https://dns.alidns.com:443/dns-query"
time="2023-11-22T10:03:29.860183071+08:00" level=debug msg="[DNS] api.miwifi.com --> [123.125.102.156 111.202.0.148] A from https://dns.alidns.com:443/dns-query"
2023-11-22 10:03:31 Test The Config File First...
time="2023-11-22T10:03:32.740010651+08:00" level=info msg="Start initial configuration in progress"
time="2023-11-22T10:03:32.741778899+08:00" level=info msg="Geodata Loader mode: memconservative"
time="2023-11-22T10:03:32.742839818+08:00" level=info msg="Initial configuration complete, total time: 2ms"
2023-11-22 10:03:32 configuration file【/etc/openclash/965Config_School.yaml】test is successful
time="2023-11-22T10:03:33.027945275+08:00" level=info msg="Start initial configuration in progress"
time="2023-11-22T10:03:33.029534049+08:00" level=info msg="Geodata Loader mode: memconservative"
time="2023-11-22T10:03:33.030245493+08:00" level=info msg="Initial configuration complete, total time: 2ms"
time="2023-11-22T10:03:33.030388034+08:00" level=info msg="Authentication of local server updated"
time="2023-11-22T10:03:33.030417728+08:00" level=info msg="Sniffer is closed"
time="2023-11-22T10:03:33.030439344+08:00" level=info msg="Use tcp concurrent"
time="2023-11-22T10:03:33.030601941+08:00" level=info msg="Start initial compatible provider default"
time="2023-11-22T10:03:33.030665842+08:00" level=info msg="Start initial provider CreamData"
time="2023-11-22T10:03:33.034014749+08:00" level=info msg="Start initial compatible provider CN"
time="2023-11-22T10:03:33.034101238+08:00" level=info msg="Start initial compatible provider Fallback"
time="2023-11-22T10:03:33.034153665+08:00" level=info msg="Start initial compatible provider Bilibili"
time="2023-11-22T10:03:33.034205659+08:00" level=info msg="Start initial compatible provider Switch"
time="2023-11-22T10:03:33.034219654+08:00" level=info msg="Start initial provider iKuuu"
time="2023-11-22T10:03:33.125846776+08:00" level=info msg="Start initial provider Advertising"
time="2023-11-22T10:03:33.126589438+08:00" level=info msg="Start initial provider Streaming"
time="2023-11-22T10:03:33.134104567+08:00" level=info msg="Start initial provider Apple"
time="2023-11-22T10:03:33.136250253+08:00" level=info msg="Start initial provider SteamCN"
time="2023-11-22T10:03:33.137170683+08:00" level=info msg="Start initial provider Global"
time="2023-11-22T10:03:33.13998236+08:00" level=info msg="Start initial provider Telegram"
time="2023-11-22T10:03:33.142055456+08:00" level=info msg="Start initial provider Notion"
time="2023-11-22T10:03:33.142609968+08:00" level=info msg="Start initial provider Unbreak"
time="2023-11-22T10:03:33.143682193+08:00" level=info msg="Start initial provider Spotify"
time="2023-11-22T10:03:33.143929887+08:00" level=info msg="Start initial provider Nintendo"
time="2023-11-22T10:03:33.150074472+08:00" level=info msg="Start initial provider Advertising-antiAD"
time="2023-11-22T10:03:33.159103384+08:00" level=info msg="Start initial provider China"
time="2023-11-22T10:03:33.218182295+08:00" level=info msg="Start initial provider Microsoft"
time="2023-11-22T10:03:33.621263267+08:00" level=info msg="[TCP] clash.meta --> ************ match DstPort(80) using Switch[COMPATIBLE]"
time="2023-11-22T10:03:33.707790295+08:00" level=info msg="[TCP] clash.meta --> ************ match DstPort(80) using Switch[🇭🇰 HK | 香港 01]"
time="2023-11-22T10:03:33.708165791+08:00" level=info msg="[TCP] clash.meta --> ************ match DstPort(80) using Switch[🇭🇰 HK | 香港 18]"
time="2023-11-22T10:03:33.708948998+08:00" level=info msg="[TCP] clash.meta --> ************ match DstPort(80) using Switch[🇭🇰 HK | 香港 18]"
time="2023-11-22T10:03:33.807400448+08:00" level=info msg="[TCP] clash.meta --> ************ match Match using Switch[🇭🇰 HK | 香港 18]"
time="2023-11-22T10:03:34.388079537+08:00" level=info msg="[TCP] clash.meta --> ************ match GeoIP(CN) using CN[DIRECT]"
time="2023-11-22T10:03:34.408552954+08:00" level=info msg="[TCP] clash.meta --> ************ match GeoIP(CN) using CN[DIRECT]"
time="2023-11-22T10:03:34.411277083+08:00" level=info msg="[TCP] clash.meta --> ************ match Match using Switch[🇭🇰 HK | 香港 18]"

#===================== 最近运行日志获取完成(自动切换为silent模式) =====================#


#===================== 活动连接信息 =====================#

WMK965 · 2023-11-22T04:16:59Z

WMK965
Nov 22, 2023
Author

补充一下，绑定网络接口尝试过，无改善

0 replies

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

从141更新到152后插件重启死循环 #3616

{{title}}

Replies: 1 comment

{{title}}

Select a reply

从141更新到152后插件重启死循环 #3616

WMK965 Nov 22, 2023

Replies: 1 comment

WMK965 Nov 22, 2023 Author

WMK965
Nov 22, 2023

WMK965
Nov 22, 2023
Author