控制面板无法监控Docker中BT下载的流量

[rgs66]

1. openwrt为旁路由模式
2. 在openwrt中安装了aria2-pro的Docker镜像，网络模式为HOST模式，运行都很正常，下载上传都很正常
3. 具体问题为，不管把openclash切换为哪一种模式，在Dashboard 中，均不显示流量信息
4. aria2开启了IPV6，openclash开启了ipv6, 但没开启ip6流量代理，因为开启流量代理之后，ARIA2就无法下载没速度
5.以下是调试日志，大佬帮看一下，哪里出问题了，个人感觉是防火墙的问题，但又看不太懂，请大佬指教

OpenClash 调试日志

生成时间: 2023-03-23 10:50:19
插件版本: v0.45.103-beta
隐私提示: 上传此日志前请注意检查、屏蔽公网IP、节点、密码等相关敏感信息

#===================== 系统信息 =====================#

主机型号: VMware - Intel(R) Celeron(R) CPU 3965U @ 2.20GHz : 1 Core 1 Thread
固件版本: OpenWrt SNAPSHOT r4847-5ca4955cf
LuCI版本: git-22.225.38104-d169a90-1
内核版本: 5.15.60
处理器架构: x86_64

#此项有值时,如不使用IPv6,建议到网络-接口-lan的设置中禁用IPV6的DHCP
IPV6-DHCP: 

DNS劫持: Dnsmasq 转发
#DNS劫持为Dnsmasq时，此项结果应仅有配置文件的DNS监听地址
Dnsmasq转发设置: 127.0.0.1#7874

#===================== 依赖检查 =====================#

dnsmasq-full: 已安装
coreutils: 已安装
coreutils-nohup: 已安装
bash: 已安装
curl: 已安装
ca-certificates: 已安装
ipset: 已安装
ip-full: 已安装
libcap: 已安装
libcap-bin: 已安装
ruby: 已安装
ruby-yaml: 已安装
ruby-psych: 已安装
ruby-pstore: 已安装
kmod-tun(TUN模式): 已安装
luci-compat(Luci >= 19.07): 已安装
kmod-inet-diag(PROCESS-NAME): 未安装
unzip: 已安装
iptables-mod-tproxy: 已安装
kmod-ipt-tproxy: 已安装
iptables-mod-extra: 已安装
kmod-ipt-extra: 已安装
kmod-ipt-nat: 已安装

#===================== 内核检查 =====================#

运行状态: 运行中
内核：Meta
进程pid: 21327
运行权限: 21327: cap_dac_override,cap_net_bind_service,cap_net_admin,cap_net_raw,cap_sys_ptrace,cap_sys_resource=eip
运行用户: nobody
已选择的架构: Meta

#下方无法显示内核版本号时请确认您的内核版本是否正确或者有无权限
Tun内核版本: 2023.03.04-5-g4a8cefb
Tun内核文件: 存在
Tun内核运行权限: 正常

Dev内核版本: v1.13.0-7-g4ffc999
Dev内核文件: 存在
Dev内核运行权限: 正常

Meta内核版本: alpha-g2f992e9
Meta内核文件: 存在
Meta内核运行权限: 正常

#===================== 插件设置 =====================#

当前配置文件: /etc/openclash/config/taitan.yaml
启动配置文件: /etc/openclash/taitan.yaml
运行模式: fake-ip
默认代理模式: rule
UDP流量转发(tproxy): 启用
自定义DNS: 启用
IPV6代理: 停用
IPV6-DNS解析: 启用
禁用Dnsmasq缓存: 启用
自定义规则: 启用
仅允许内网: 停用
仅代理命中规则流量: 停用
仅允许常用端口流量: 停用
绕过中国大陆IP: 停用
路由本机代理: 启用

#启动异常时建议关闭此项后重试
混合节点: 停用
保留配置: 停用

#启动异常时建议关闭此项后重试
第三方规则: 启用

#===================== 自定义规则 一 =====================#
script:
##  shortcuts:
##    Notice: The core timezone is UTC
##    CST 20:00-24:00 = time.now().hour > 12 and time.now().hour < 16
##    内核时区为UTC,故以下time.now()函数的取值需要根据本地时区进行转换
##    北京时间(CST) 20:00-24:00 = time.now().hour > 12 and time.now().hour < 16
##    quic: network == 'udp' and dst_port == 443 and (geoip(resolve_ip(host)) != 'CN' or geoip(dst_ip) != 'CN')
##    time-limit: in_cidr(src_ip,'192.168.1.2/32') and time.now().hour < 20 or time.now().hour > 21
##    time-limit: src_ip == '192.168.1.2' and time.now().hour < 20 or time.now().hour > 21

##  code: |
##    def main(ctx, metadata):
##        directkeywordlist = ["baidu"]
##        for directkeyword in directkeywordlist:
##          if directkeyword in metadata["host"]:
##            ctx.log('[Script] matched keyword %s use direct' % directkeyword)
##            return "DIRECT"

rules:
XXX





##- PROCESS-NAME,curl,DIRECT #匹配路由自身进程(curl直连)
##- DOMAIN-SUFFIX,google.com,Proxy #匹配域名后缀(交由Proxy代理服务器组)
##- DOMAIN-KEYWORD,google,Proxy #匹配域名关键字(交由Proxy代理服务器组)
##- DOMAIN,google.com,Proxy #匹配域名(交由Proxy代理服务器组)
##- DOMAIN-SUFFIX,ad.com,REJECT #匹配域名后缀(拒绝)
##- IP-CIDR,127.0.0.0/8,DIRECT #匹配数据目标IP(直连)
##- SRC-IP-CIDR,192.168.1.201/32,DIRECT #匹配数据发起IP(直连)
##- DST-PORT,80,DIRECT #匹配数据目标端口(直连)
##- SRC-PORT,7777,DIRECT #匹配数据源端口(直连)

##排序在上的规则优先生效,如添加（去除规则前的#号）：
##IP段：192.168.1.2-192.168.1.200 直连
##- SRC-IP-CIDR,192.168.1.2/31,DIRECT
##- SRC-IP-CIDR,192.168.1.4/30,DIRECT
##- SRC-IP-CIDR,192.168.1.8/29,DIRECT
##- SRC-IP-CIDR,192.168.1.16/28,DIRECT
##- SRC-IP-CIDR,192.168.1.32/27,DIRECT
##- SRC-IP-CIDR,192.168.1.64/26,DIRECT
##- SRC-IP-CIDR,192.168.1.128/26,DIRECT
##- SRC-IP-CIDR,192.168.1.192/29,DIRECT
##- SRC-IP-CIDR,192.168.1.200/32,DIRECT

##IP段：192.168.1.202-192.168.1.255 直连
##- SRC-IP-CIDR,192.168.1.202/31,DIRECT
##- SRC-IP-CIDR,192.168.1.204/30,DIRECT
##- SRC-IP-CIDR,192.168.1.208/28,DIRECT
##- SRC-IP-CIDR,192.168.1.224/27,DIRECT

##此时IP为192.168.1.1和192.168.1.201的客户端流量走代理（策略），其余客户端不走代理
##因为Fake-IP模式下，IP地址为192.168.1.1的路由器自身流量可走代理（策略），所以需要排除

##仅设置路由器自身直连：
##- SRC-IP-CIDR,192.168.1.1/32,DIRECT
##- SRC-IP-CIDR,198.18.0.1/32,DIRECT

##DDNS
##- DOMAIN-SUFFIX,checkip.dyndns.org,DIRECT
##- DOMAIN-SUFFIX,checkipv6.dyndns.org,DIRECT
##- DOMAIN-SUFFIX,checkip.synology.com,DIRECT
##- DOMAIN-SUFFIX,ifconfig.co,DIRECT
##- DOMAIN-SUFFIX,api.myip.com,DIRECT
##- DOMAIN-SUFFIX,ip-api.com,DIRECT
##- DOMAIN-SUFFIX,ipapi.co,DIRECT
##- DOMAIN-SUFFIX,ip6.seeip.org,DIRECT
##- DOMAIN-SUFFIX,members.3322.org,DIRECT

##在线IP段转CIDR地址：http://ip2cidr.com
#===================== 自定义规则 二 =====================#
script:
##  shortcuts:
##    common_port: dst_port not in [21, 22, 23, 53, 80, 123, 143, 194, 443, 465, 587, 853, 993, 995, 998, 2052, 2053, 2082, 2083, 2086, 2095, 2096, 5222, 5228, 5229, 5230, 8080, 8443, 8880, 8888, 8889]

##  code: |
##    def main(ctx, metadata):
##        directkeywordlist = ["baidu"]
##        for directkeyword in directkeywordlist:
##          if directkeyword in metadata["host"]:
##            ctx.log('[Script] matched keyword %s use direct' % directkeyword)
##            return "DIRECT"

rules:
##- SCRIPT,common_port,DIRECT #shortcuts rule

##- DOMAIN-SUFFIX,google.com,Proxy #匹配域名后缀(交由Proxy代理服务器组)
##- DOMAIN-KEYWORD,google,Proxy #匹配域名关键字(交由Proxy代理服务器组)
##- DOMAIN,google.com,Proxy #匹配域名(交由Proxy代理服务器组)
##- DOMAIN-SUFFIX,ad.com,REJECT #匹配域名后缀(拒绝)
##- IP-CIDR,127.0.0.0/8,DIRECT #匹配数据目标IP(直连)
##- SRC-IP-CIDR,192.168.1.201/32,DIRECT #匹配数据发起IP(直连)
#- DST-PORT,16800,DIRECT #匹配数据目标端口(直连)
#- SRC-PORT,16800,DIRECT #匹配数据源端口(直连)

#===================== 配置文件 =====================#

mixed-port: 7893
socks-port: 7891
allow-lan: true
bind-address: "*"
ipv6: true
log-level: silent
external-controller: 0.0.0.0:9090
experimental:
  ignore-resolve-fail: true
cfw-latency-timeout: 3000
cfw-latency-url: http://www.gstatic.com/generate_204
cfw-conn-break-strategy:
  proxy: none
  profile: true
  mode: false
cfw-proxies-order: default
cfw-bypass-bak:
- qq.com
- music.163.com
- "*.music.126.net"
- localhost
- 127.*
- 10.*
- 172.16.*
- 172.17.*
- 172.18.*
- 172.19.*
- 172.20.*
- 172.21.*
- 172.22.*
- 172.23.*
- 172.24.*
- 172.25.*
- 172.26.*
- 172.27.*
- 172.28.*
- 172.29.*
- 172.30.*
- 172.31.*
- 192.168.*
- "<local>"
cfw-bypass:
- "*.13th.tech"
- "*.423down.com"
- "*.bokecc.com"
- "*.chaipip.com"
- "*.chinaplay.store"
- "*.hrtsea.com"
- "*.kaikeba.com"
- "*.laomo.me"
- "*.mpyit.com"
- "*.msftconnecttest.com"
- "*.msftncsi.com"
- "*.qupu123.com"
- "*.pdfwifi.com"
- "*.zhenguanyu.biz"
- "*.zhenguanyu.com"
- "*.cn"
- "*.xn--fiqs8s"
- "*.xn--55qx5d"
- "*.xn--io0a7i"
- "*360buy*"
- "*alicdn*"
- "*alimama*"
- "*alipay*"
- "*appzapp*"
- "*baidupcs*"
- "*bilibili*"
- "*ccgslb*"
- "*chinacache*"
- "*duobao*"
- "*jdpay*"
- "*moke*"
- "*qhimg*"
- "*vpimg*"
- "*xiami*"
- "*xiaomi*"
- "*.360.com"
- "*.360kuai.com"
- "*.360safe.com"
- "*.dhrest.com"
- "*.qhres.com"
- "*.qhstatic.com"
- "*.qhupdate.com"
- "*.so.com"
- "*.4399.com"
- "*.4399pk.com"
- "*.5054399.com"
- "*.img4399.com"
- "*.58.com"
- "*.1688.com"
- "*.aliapp.org"
- "*.alibaba.com"
- "*.alibabacloud.com"
- "*.alibabausercontent.com"
- "*.alicdn.com"
- "*.alicloudccp.com"
- "*.aliexpress.com"
- "*.aliimg.com"
- "*.alikunlun.com"
- "*.alipay.com"
- "*.alipayobjects.com"
- "*.alisoft.com"
- "*.aliyun.com"
- "*.aliyuncdn.com"
- "*.aliyuncs.com"
- "*.aliyundrive.com"
- "*.amap.com"
- "*.autonavi.com"
- "*.dingtalk.com"
- "*.ele.me"
- "*.hichina.com"
- "*.mmstat.com"
- "*.mxhichina.com"
- "*.soku.com"
- "*.taobao.com"
- "*.taobaocdn.com"
- "*.tbcache.com"
- "*.tbcdn.com"
- "*.tmall.com"
- "*.tmall.hk"
- "*.ucweb.com"
- "*.xiami.com"
- "*.xiami.net"
- "*.ykimg.com"
- "*.youku.com"
- "*.baidu.com"
- "*.baidubcr.com"
- "*.baidupcs.com"
- "*.baidustatic.com"
- "*.bcebos.com"
- "*.bdimg.com"
- "*.bdstatic.com"
- "*.bdurl.net"
- "*.hao123.com"
- "*.hao123img.com"
- "*.jomodns.com"
- "*.yunjiasu-cdn.net"
- "*.acg.tv"
- "*.acgvideo.com"
- "*.b23.tv"
- "*.bigfun.cn"
- "*.bigfunapp.cn"
- "*.biliapi.com"
- "*.biliapi.net"
- "*.bilibili.com"
- "*.biligame.com"
- "*.biligame.net"
- "*.bilivideo.com"
- "*.bilivideo.cn"
- "*.hdslb.com"
- "*.im9.com"
- "*.smtcdns.net"
- "*.battle.net"
- "*.battlenet.com"
- "*.blizzard.com"
- "*.amemv.com"
- "*.bdxiguaimg.com"
- "*.bdxiguastatic.com"
- "*.byted-static.com"
- "*.bytedance.com"
- "*.bytedance.net"
- "*.bytedns.net"
- "*.bytednsdoc.com"
- "*.bytegoofy.com"
- "*.byteimg.com"
- "*.bytescm.com"
- "*.bytetos.com"
- "*.bytexservice.com"
- "*.douyin.com"
- "*.douyinpic.com"
- "*.douyinstatic.com"
- "*.douyinvod.com"
- "*.feelgood.cn"
- "*.feiliao.com"
- "*.gifshow.com"
- "*.huoshan.com"
- "*.huoshanzhibo.com"
- "*.ibytedapm.com"
- "*.iesdouyin.com"
- "*.ixigua.com"
- "*.kspkg.com"
- "*.pstatp.com"
- "*.snssdk.com"
- "*.toutiao.com"
- "*.toutiao13.com"
- "*.toutiaoapi.com"
- "*.toutiaocdn.com"
- "*.toutiaocdn.net"
- "*.toutiaocloud.com"
- "*.toutiaohao.com"
- "*.toutiaohao.net"
- "*.toutiaoimg.com"
- "*.toutiaopage.com"
- "*.wukong.com"
- "*.zijieapi.com"
- "*.zijieimg.com"
- "*.zjbyte.com"
- "*.zjcdn.com"
- "*.cctv.com"
- "*.cctvpic.com"
- "*.livechina.com"
- "*.21cn.com"
- "*.didialift.com"
- "*.didiglobal.com"
- "*.udache.com"
- "*.douyu.com"
- "*.douyu.tv"
- "*.douyuscdn.com"
- "*.douyutv.com"
- "*.epicgames.com"
- "*.epicgames.dev"
- "*.helpshift.com"
- "*.paragon.com"
- "*.unrealengine.com"
- "*.dbankcdn.com"
- "*.hc-cdn.com"
- "*.hicloud.com"
- "*.hihonor.com"
- "*.huawei.com"
- "*.huaweicloud.com"
- "*.huaweishop.net"
- "*.hwccpc.com"
- "*.vmall.com"
- "*.vmallres.com"
- "*.iflyink.com"
- "*.iflyrec.com"
- "*.iflytek.com"
- "*.71.am"
- "*.71edge.com"
- "*.iqiyi.com"
- "*.iqiyipic.com"
- "*.ppsimg.com"
- "*.qiyi.com"
- "*.qiyipic.com"
- "*.qy.net"
- "*.360buy.com"
- "*.360buyimg.com"
- "*.jcloudcs.com"
- "*.jd.com"
- "*.jd.hk"
- "*.jdcloud.com"
- "*.jdpay.com"
- "*.paipai.com"
- "*.iciba.com"
- "*.ksosoft.com"
- "*.ksyun.com"
- "*.kuaishou.com"
- "*.yximgs.com"
- "*.meitu.com"
- "*.meitudata.com"
- "*.meitustat.com"
- "*.meipai.com"
- "*.le.com"
- "*.lecloud.com"
- "*.letv.com"
- "*.letvcloud.com"
- "*.letvimg.com"
- "*.letvlive.com"
- "*.letvstore.com"
- "*.hitv.com"
- "*.hunantv.com"
- "*.mgtv.com"
- "*.duokan.com"
- "*.mi-img.com"
- "*.mi.com"
- "*.miui.com"
- "*.xiaomi.com"
- "*.xiaomi.net"
- "*.xiaomicp.com"
- "*.126.com"
- "*.126.net"
- "*.127.net"
- "*.163.com"
- "*.163yun.com"
- "*.lofter.com"
- "*.netease.com"
- "*.ydstatic.com"
- "*.youdao.com"
- "*.pplive.com"
- "*.pptv.com"
- "*.pinduoduo.com"
- "*.yangkeduo.com"
- "*.leju.com"
- "*.miaopai.com"
- "*.sina.com"
- "*.sina.com.cn"
- "*.sina.cn"
- "*.sinaapp.com"
- "*.sinaapp.cn"
- "*.sinaimg.com"
- "*.sinaimg.cn"
- "*.weibo.com"
- "*.weibo.cn"
- "*.weibocdn.com"
- "*.weibocdn.cn"
- "*.xiaoka.tv"
- "*.go2map.com"
- "*.sogo.com"
- "*.sogou.com"
- "*.sogoucdn.com"
- "*.sohu-inc.com"
- "*.sohu.com"
- "*.sohucs.com"
- "*.sohuno.com"
- "*.sohurdc.com"
- "*.v-56.com"
- "*.playstation.com"
- "*.playstation.net"
- "*.playstationnetwork.com"
- "*.sony.com"
- "*.sonyentertainmentnetwork.com"
- "*.cm.steampowered.com"
- "*.steamcontent.com"
- "*.steamusercontent.com"
- "*.steamchina.com"
- csgo.wmsj.cn
- dota2.wmsj.cn
- wmsjsteam.com
- dl.steam.clngaa.com
- dl.steam.ksyna.com
- st.dl.bscstorage.net
- st.dl.eccdnx.com
- st.dl.pinyuncloud.com
- steampipe.steamcontent.tnkjmec.com
- steampowered.com.8686c.com
- steamstatic.com.8686c.com
- "*.foxmail.com"
- "*.gtimg.com"
- "*.idqqimg.com"
- "*.igamecj.com"
- "*.myapp.com"
- "*.myqcloud.com"
- "*.qq.com"
- "*.qqmail.com"
- "*.qqurl.com"
- "*.smtcdns.com"
- "*.smtcdns.net"
- "*.soso.com"
- "*.tencent-cloud.net"
- "*.tencent.com"
- "*.tencentmind.com"
- "*.tenpay.com"
- "*.wechat.com"
- "*.weixin.com"
- "*.weiyun.com"
- "*.appsimg.com"
- "*.appvipshop.com"
- "*.vip.com"
- "*.vipstatic.com"
- "*.ximalaya.com"
- "*.xmcdn.com"
- "*.00cdn.com"
- "*.88cdn.com"
- "*.kanimg.com"
- "*.kankan.com"
- "*.p2cdn.com"
- "*.sandai.net"
- "*.thundercdn.com"
- "*.xunlei.com"
- "*.got001.com"
- "*.p4pfile.com"
- "*.rrys.tv"
- "*.rrys2020.com"
- "*.yyets.com"
- "*.zimuzu.io"
- "*.zimuzu.tv"
- "*.zmz001.com"
- "*.zmz002.com"
- "*.zmz003.com"
- "*.zmz004.com"
- "*.zmz2019.com"
- "*.zmzapi.com"
- "*.zmzapi.net"
- "*.zmzfile.com"
- "*announce*"
- "*torrent*"
- "*tracker*"
- "*.animebytes.tv"
- "*.animetorrents.me"
- "*.awesome-hd.me"
- "*.beitai.pt"
- "*.bittorrent.com"
- "*.broadcasthe.net"
- "*.chdbits.co"
- "*.classix-unlimited.co.uk"
- "*.empornium.me"
- "*.gazellegames.net"
- "*.hd4fans.org"
- "*.hdchina.org"
- "*.hdhome.org"
- "*.hdsky.me"
- "*.hdtime.org"
- "*.hdzone.me"
- "*.icetorrent.org"
- "*.jpopsuki.eu"
- "*.keepfrds.com"
- "*.leaguehd.com"
- "*.m-team.cc"
- "*.madsrevolution.net"
- "*.msg.vg"
- "*.nanyangpt.com"
- "*.ncore.cc"
- "*.open.cd"
- "*.ourbits.club"
- "*.passthepopcorn.me"
- "*.privatehd.to"
- "*.pthome.net"
- "*.redacted.ch"
- "*.springsunday.net"
- "*.tjupt.org"
- "*.tju.pt"
- "*.totheglory.im"
- "*.trontv.com"
- "*.teamviewer.com"
- "*.baomitu.com"
- "*.bootcss.com"
- "*.jiasule.com"
- "*.staticfile.org"
- "*.upaiyun.com"
- "*.10010.com"
- "*.115.com"
- "*.12306.com"
- "*.17173.com"
- "*.178.com"
- "*.17k.com"
- "*.360doc.com"
- "*.36kr.com"
- "*.3dmgame.com"
- "*.51cto.com"
- "*.51job.com"
- "*.51jobcdn.com"
- "*.56.com"
- "*.8686c.com"
- "*.abchina.com"
- "*.abercrombie.com"
- "*.acfun.tv"
- "*.air-matters.com"
- "*.air-matters.io"
- "*.aixifan.com"
- "*.algocasts.io"
- "*.babytree.com"
- "*.babytreeimg.com"
- "*.baicizhan.com"
- "*.baidupan.com"
- "*.baike.com"
- "*.biqudu.com"
- "*.biquge.com"
- "*.bitauto.com"
- "*.c-ctrip.com"
- "*.camera360.com"
- "*.cdnmama.com"
- "*.chaoxing.com"
- "*.che168.com"
- "*.chinacache.net"
- "*.chinaso.com"
- "*.chinaz.com"
- "*.chinaz.net"
- "*.chuimg.com"
- "*.cibntv.net"
- "*.clouddn.com"
- "*.cloudxns.net"
- "*.cn163.net"
- "*.cnblogs.com"
- "*.cnki.net"
- "*.cnmstl.net"
- "*.coolapk.com"
- "*.coolapkmarket.com"
- "*.csdn.net"
- "*.ctrip.com"
- "*.dangdang.com"
- "*.dfcfw.com"
- "*.dianping.com"
- "*.dilidili.wang"
- "*.douban.com"
- "*.doubanio.com"
- "*.dpfile.com"
- "*.duowan.com"
- "*.dxycdn.com"
- "*.dytt8.net"
- "*.easou.com"
- "*.eastday.com"
- "*.eastmoney.com"
- "*.ecitic.com"
- "*.ewqcxz.com"
- "*.fang.com"
- "*.fantasy.tv"
- "*.feng.com"
- "*.fengkongcloud.com"
- "*.fir.im"
- "*.frdic.com"
- "*.fresh-ideas.cc"
- "*.ganji.com"
- "*.ganjistatic1.com"
- "*.geetest.com"
- "*.geilicdn.com"
- "*.ghpym.com"
- "*.godic.net"
- "*.guazi.com"
- "*.gwdang.com"
- "*.gzlzfm.com"
- "*.haibian.com"
- "*.haosou.com"
- "*.hollisterco.com"
- "*.hongxiu.com"
- "*.huajiao.com"
- "*.hupu.com"
- "*.huxiucdn.com"
- "*.huya.com"
- "*.ifeng.com"
- "*.ifengimg.com"
- "*.images-amazon.com"
- "*.infzm.com"
- "*.ipip.net"
- "*.it168.com"
- "*.ithome.com"
- "*.ixdzs.com"
- "*.jianguoyun.com"
- "*.jianshu.com"
- "*.jianshu.io"
- "*.jianshuapi.com"
- "*.jiathis.com"
- "*.jmstatic.com"
- "*.jumei.com"
- "*.kaola.com"
- "*.knewone.com"
- "*.koowo.com"
- "*.ksyungslb.com"
- "*.kuaidi100.com"
- "*.kugou.com"
- "*.lancdns.com"
- "*.landiannews.com"
- "*.lanzou.com"
- "*.lanzoui.com"
- "*.lanzoux.com"
- "*.lemicp.com"
- "*.letitfly.me"
- "*.lizhi.fm"
- "*.lizhi.io"
- "*.lizhifm.com"
- "*.luoo.net"
- "*.lvmama.com"
- "*.lxdns.com"
- "*.maoyan.com"
- "*.meilishuo.com"
- "*.meituan.com"
- "*.meituan.net"
- "*.meizu.com"
- "*.migucloud.com"
- "*.miguvideo.com"
- "*.mobike.com"
- "*.mogu.com"
- "*.mogucdn.com"
- "*.mogujie.com"
- "*.moji.com"
- "*.moke.com"
- "*.msstatic.com"
- "*.mubu.com"
- "*.myunlu.com"
- "*.nruan.com"
- "*.nuomi.com"
- "*.onedns.net"
- "*.oneplus.com"
- "*.onlinedown.net"
- "*.oppo.com"
- "*.oracle.com"
- "*.oschina.net"
- "*.ourdvs.com"
- "*.polyv.net"
- "*.qbox.me"
- "*.qcloud.com"
- "*.qcloudcdn.com"
- "*.qdaily.com"
- "*.qdmm.com"
- "*.qhimg.com"
- "*.qianqian.com"
- "*.qidian.com"
- "*.qihucdn.com"
- "*.qin.io"
- "*.qiniu.com"
- "*.qiniucdn.com"
- "*.qiniudn.com"
- "*.qiushibaike.com"
- "*.quanmin.tv"
- "*.qunar.com"
- "*.qunarzz.com"
- "*.realme.com"
- "*.repaik.com"
- "*.ruguoapp.com"
- "*.runoob.com"
- "*.sankuai.com"
- "*.segmentfault.com"
- "*.sf-express.com"
- "*.shumilou.net"
- "*.simplecd.me"
- "*.smzdm.com"
- "*.snwx.com"
- "*.soufunimg.com"
- "*.sspai.com"
- "*.startssl.com"
- "*.suning.com"
- "*.synology.com"
- "*.taihe.com"
- "*.th-sjy.com"
- "*.tianqi.com"
- "*.tianqistatic.com"
- "*.tianyancha.com"
- "*.tianyaui.com"
- "*.tietuku.com"
- "*.tiexue.net"
- "*.tmiaoo.com"
- "*.trip.com"
- "*.ttmeiju.com"
- "*.tudou.com"
- "*.tuniu.com"
- "*.tuniucdn.com"
- "*.umengcloud.com"
- "*.upyun.com"
- "*.uxengine.net"
- "*.videocc.net"
- "*.vivo.com"
- "*.wandoujia.com"
- "*.weather.com"
- "*.weico.cc"
- "*.weidian.com"
- "*.weiphone.com"
- "*.weiphone.net"
- "*.womai.com"
- "*.wscdns.com"
- "*.xdrig.com"
- "*.xhscdn.com"
- "*.xiachufang.com"
- "*.xiaohongshu.com"
- "*.xiaojukeji.com"
- "*.xinhuanet.com"
- "*.xip.io"
- "*.xitek.com"
- "*.xiumi.us"
- "*.xslb.net"
- "*.xueqiu.com"
- "*.yach.me"
- "*.yeepay.com"
- "*.yhd.com"
- "*.yihaodianimg.com"
- "*.yinxiang.com"
- "*.yinyuetai.com"
- "*.yixia.com"
- "*.ys168.com"
- "*.yuewen.com"
- "*.yy.com"
- "*.yystatic.com"
- "*.zealer.com"
- "*.zhangzishi.cc"
- "*.zhanqi.tv"
- "*.zhaopin.com"
- "*.zhihu.com"
- "*.zhimg.com"
- "*.zhongsou.com"
- "*.zhuihd.com"
- localhost
- 127.*
- 10.*
- 172.16.*
- 172.17.*
- 172.18.*
- 172.19.*
- 172.20.*
- 172.21.*
- 172.22.*
- 172.23.*
- 172.24.*
- 172.25.*
- 172.26.*
- 172.27.*
- 172.28.*
- 172.29.*
- 172.30.*
- 172.31.*
- 192.168.*
- "<local>"
proxy-groups:

redir-port: 7892
tproxy-port: 7895
port: 7890
mode: rule
external-ui: "/usr/share/openclash/ui"
interface-name: br-lan
tcp-concurrent: true
dns:
  enable: true
  ipv6: true
  enhanced-mode: fake-ip
  fake-ip-range: 198.18.0.1/16
  listen: 0.0.0.0:7874
  nameserver:
  - dhcp://"br-lan"
  - 10.10.10.253
  - "[fe80::20c:29ff:fe49:53dc]:53"
  - 114.114.114.114
  - 119.29.29.29
  - 119.28.28.28
  - 223.5.5.5
  - https://doh.pub/dns-query
  - https://dns.alidns.com/dns-query
  fallback:
  - https://dns.cloudflare.com/dns-query
  - tls://dns.google:853
  - https://1.1.1.1/dns-query
  - tls://1.1.1.1:853
  - tls://8.8.8.8:853
  - "[2001:4860:4860::8888]:53"
  - "[2001:4860:4860::8844]:53"
  - "[2001:da8::666]:53"
  - https://public.dns.iij.jp/dns-query
  - https://jp.tiar.app/dns-query
  - https://jp.tiarap.org/dns-query
  - tls://jp.tiar.app
  - tls://dot.tiar.app
  fallback-filter:
    geoip: true
    geoip-code: CN
    ipcidr:
    - 0.0.0.0/8
    - 10.0.0.0/8
    - 100.64.0.0/10
    - 127.0.0.0/8
    - 169.254.0.0/16
    - 172.16.0.0/12
    - 192.0.0.0/24
    - 192.0.2.0/24
    - 192.88.99.0/24
    - 192.168.0.0/16
    - 198.18.0.0/15
    - 198.51.100.0/24
    - 203.0.113.0/24
    - 224.0.0.0/4
    - 240.0.0.0/4
    - 255.255.255.255/32
    domain:
    - "+.google.com"
    - "+.facebook.com"
    - "+.youtube.com"
    - "+.githubusercontent.com"
    - "+.googlevideo.com"
    - "+.msftconnecttest.com"
    - "+.msftncsi.com"
    - msftconnecttest.com
    - msftncsi.com
  fake-ip-filter:
  - "*.lan"
  - "*.localdomain"
  - "*.example"
  - "*.invalid"
  - "*.localhost"
  - "*.test"
  - "*.local"
  - "*.home.arpa"
  - time.*.com
  - time.*.gov
  - time.*.edu.cn
  - time.*.apple.com
  - time-ios.apple.com
  - time1.*.com
  - time2.*.com
  - time3.*.com
  - time4.*.com
  - time5.*.com
  - time6.*.com
  - time7.*.com
  - ntp.*.com
  - ntp1.*.com
  - ntp2.*.com
  - ntp3.*.com
  - ntp4.*.com
  - ntp5.*.com
  - ntp6.*.com
  - ntp7.*.com
  - "*.time.edu.cn"
  - "*.ntp.org.cn"
  - "+.pool.ntp.org"
  - time1.cloud.tencent.com
  - music.163.com
  - "*.music.163.com"
  - "*.126.net"
  - musicapi.taihe.com
  - music.taihe.com
  - songsearch.kugou.com
  - trackercdn.kugou.com
  - "*.kuwo.cn"
  - api-jooxtt.sanook.com
  - api.joox.com
  - joox.com
  - y.qq.com
  - "*.y.qq.com"
  - streamoc.music.tc.qq.com
  - mobileoc.music.tc.qq.com
  - isure.stream.qqmusic.qq.com
  - dl.stream.qqmusic.qq.com
  - aqqmusic.tc.qq.com
  - amobile.music.tc.qq.com
  - "*.xiami.com"
  - "*.music.migu.cn"
  - music.migu.cn
  - "+.msftconnecttest.com"
  - "+.msftncsi.com"
  - msftconnecttest.com
  - msftncsi.com
  - localhost.ptlogin2.qq.com
  - localhost.sec.qq.com
  - "+.srv.nintendo.net"
  - "*.n.n.srv.nintendo.net"
  - "+.stun.playstation.net"
  - xbox.*.*.microsoft.com
  - "*.*.xboxlive.com"
  - xbox.*.microsoft.com
  - xnotify.xboxlive.com
  - "+.battlenet.com.cn"
  - "+.wotgame.cn"
  - "+.wggames.cn"
  - "+.wowsgame.cn"
  - "+.wargaming.net"
  - proxy.golang.org
  - stun.*.*
  - stun.*.*.*
  - "+.stun.*.*"
  - "+.stun.*.*.*"
  - "+.stun.*.*.*.*"
  - "+.stun.*.*.*.*.*"
  - heartbeat.belkin.com
  - "*.linksys.com"
  - "*.linksyssmartwifi.com"
  - "*.router.asus.com"
  - mesu.apple.com
  - swscan.apple.com
  - swquery.apple.com
  - swdownload.apple.com
  - swcdn.apple.com
  - swdist.apple.com
  - lens.l.google.com
  - stun.l.google.com
  - "+.nflxvideo.net"
  - "*.square-enix.com"
  - "*.finalfantasyxiv.com"
  - "*.ffxiv.com"
  - "*.ff14.sdo.com"
  - ff.dorado.sdo.com
  - "*.mcdn.bilivideo.cn"
  - "+.media.dssott.com"
  - shark007.net
sniffer:
  enable: true
  parse-pure-ip: true
profile:
  store-selected: true
  store-fake-ip: true
authentication:
- Clash:6aqAdrpe

#===================== 自定义覆写设置 =====================#

#!/bin/sh
. /usr/share/openclash/ruby.sh
. /usr/share/openclash/log.sh
. /lib/functions.sh

# This script is called by /etc/init.d/openclash
# Add your custom overwrite scripts here, they will be take effict after the OpenClash own srcipts

LOG_OUT "Tip: Start Running Custom Overwrite Scripts..."
LOGTIME=$(echo $(date "+%Y-%m-%d %H:%M:%S"))
LOG_FILE="/tmp/openclash.log"
CONFIG_FILE="$1" #config path

#Simple Demo:
    #General Demo
    #1--config path
    #2--key name
    #3--value
    #ruby_edit "$CONFIG_FILE" "['redir-port']" "7892"
    #ruby_edit "$CONFIG_FILE" "['secret']" "123456"
    #ruby_edit "$CONFIG_FILE" "['dns']['enable']" "true"

    #Hash Demo
    #1--config path
    #2--key name
    #3--hash type value
    #ruby_edit "$CONFIG_FILE" "['experimental']" "{'sniff-tls-sni'=>true}"
    #ruby_edit "$CONFIG_FILE" "['sniffer']" "{'sniffing'=>['tls','http']}"

    #Array Demo:
    #1--config path
    #2--key name
    #3--position(start from 0, end with -1)
    #4--value
    #ruby_arr_insert "$CONFIG_FILE" "['dns']['nameserver']" "0" "114.114.114.114"

    #Array Add From Yaml File Demo:
    #1--config path
    #2--key name
    #3--position(start from 0, end with -1)
    #4--value file path
    #5--value key name in #4 file
    #ruby_arr_add_file "$CONFIG_FILE" "['dns']['fallback-filter']['ipcidr']" "0" "/etc/openclash/custom/openclash_custom_fallback_filter.yaml" "['fallback-filter']['ipcidr']"

#Ruby Script Demo:
    #ruby -ryaml -rYAML -I "/usr/share/openclash" -E UTF-8 -e "
    #   begin
    #      Value = YAML.load_file('$CONFIG_FILE');
    #   rescue Exception => e
    #      puts '${LOGTIME} Error: Load File Failed,【' + e.message + '】';
    #   end;

        #General
    #   begin
    #   Thread.new{
    #      Value['redir-port']=7892;
    #      Value['tproxy-port']=7895;
    #      Value['port']=7890;
    #      Value['socks-port']=7891;
    #      Value['mixed-port']=7893;
    #   }.join;

    #   rescue Exception => e
    #      puts '${LOGTIME} Error: Set General Failed,【' + e.message + '】';
    #   ensure
    #      File.open('$CONFIG_FILE','w') {|f| YAML.dump(Value, f)};
    #   end" 2>/dev/null >> $LOG_FILE

exit 0
#===================== 自定义防火墙设置 =====================#

#!/bin/sh
. /usr/share/openclash/log.sh
. /lib/functions.sh

# This script is called by /etc/init.d/openclash
# Add your custom firewall rules here, they will be added after the end of the OpenClash iptables rules

LOG_OUT "Tip: Start Add Custom Firewall Rules..."

exit 0
#===================== IPTABLES 防火墙设置 =====================#

#IPv4 NAT chain

# Generated by iptables-save v1.8.7 on Thu Mar 23 10:50:24 2023
*nat
:PREROUTING ACCEPT [869:80008]
:INPUT ACCEPT [3780:245170]
:OUTPUT ACCEPT [10362:690460]
:POSTROUTING ACCEPT [10367:690856]
:CLOUD_MUSIC - [0:0]
:DOCKER - [0:0]
:MINIUPNPD - [0:0]
:MINIUPNPD-POSTROUTING - [0:0]
:openclash - [0:0]
:openclash_output - [0:0]
:postrouting_VPN_rule - [0:0]
:postrouting_docker_rule - [0:0]
:postrouting_lan_rule - [0:0]
:postrouting_rule - [0:0]
:postrouting_vpn_rule - [0:0]
:postrouting_wan_rule - [0:0]
:prerouting_VPN_rule - [0:0]
:prerouting_docker_rule - [0:0]
:prerouting_lan_rule - [0:0]
:prerouting_rule - [0:0]
:prerouting_vpn_rule - [0:0]
:prerouting_wan_rule - [0:0]
:zone_VPN_postrouting - [0:0]
:zone_VPN_prerouting - [0:0]
:zone_docker_postrouting - [0:0]
:zone_docker_prerouting - [0:0]
:zone_lan_postrouting - [0:0]
:zone_lan_prerouting - [0:0]
:zone_vpn_postrouting - [0:0]
:zone_vpn_prerouting - [0:0]
:zone_wan_postrouting - [0:0]
:zone_wan_prerouting - [0:0]
-A PREROUTING -d 8.8.4.4/32 -p tcp -m comment --comment "OpenClash Google DNS Hijack" -m tcp --dport 53 -j REDIRECT --to-ports 7892
-A PREROUTING -d 8.8.8.8/32 -p tcp -m comment --comment "OpenClash Google DNS Hijack" -m tcp --dport 53 -j REDIRECT --to-ports 7892
-A PREROUTING -p tcp -m tcp --dport 53 -m comment --comment "OpenClash DNS Hijack" -j REDIRECT --to-ports 53
-A PREROUTING -p udp -m udp --dport 53 -m comment --comment "OpenClash DNS Hijack" -j REDIRECT --to-ports 53
-A PREROUTING -p tcp -m set --match-set music dst -j CLOUD_MUSIC
-A PREROUTING -p udp -m udp --dport 53 -j REDIRECT --to-ports 53
-A PREROUTING -p tcp -m tcp --dport 53 -j REDIRECT --to-ports 53
-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER
-A PREROUTING -m comment --comment "!fw3: Custom prerouting rule chain" -j prerouting_rule
-A PREROUTING -i br-lan -m comment --comment "!fw3" -j zone_lan_prerouting
-A PREROUTING -i ipsec0 -m comment --comment "!fw3" -j zone_VPN_prerouting
-A PREROUTING -i tun0 -m comment --comment "!fw3" -j zone_vpn_prerouting
-A PREROUTING -i docker0 -m comment --comment "!fw3" -j zone_docker_prerouting
-A PREROUTING -p tcp -j openclash
-A OUTPUT ! -d 127.0.0.0/8 -m addrtype --dst-type LOCAL -j DOCKER
-A OUTPUT -j openclash_output
-A POSTROUTING -s 172.17.0.0/16 ! -o docker0 -j MASQUERADE
-A POSTROUTING -m comment --comment "!fw3: Custom postrouting rule chain" -j postrouting_rule
-A POSTROUTING -o br-lan -m comment --comment "!fw3" -j zone_lan_postrouting
-A POSTROUTING -o ipsec0 -m comment --comment "!fw3" -j zone_VPN_postrouting
-A POSTROUTING -o tun0 -m comment --comment "!fw3" -j zone_vpn_postrouting
-A POSTROUTING -o docker0 -m comment --comment "!fw3" -j zone_docker_postrouting
-A CLOUD_MUSIC -d 0.0.0.0/8 -j RETURN
-A CLOUD_MUSIC -d 10.0.0.0/8 -j RETURN
-A CLOUD_MUSIC -d 127.0.0.0/8 -j RETURN
-A CLOUD_MUSIC -d 169.254.0.0/16 -j RETURN
-A CLOUD_MUSIC -d 172.16.0.0/12 -j RETURN
-A CLOUD_MUSIC -d 192.168.0.0/16 -j RETURN
-A CLOUD_MUSIC -d 224.0.0.0/4 -j RETURN
-A CLOUD_MUSIC -d 240.0.0.0/4 -j RETURN
-A CLOUD_MUSIC -p tcp -m set ! --match-set music_http src -m tcp --dport 80 -j REDIRECT --to-ports 5200
-A CLOUD_MUSIC -p tcp -m set ! --match-set music_https src -m tcp --dport 443 -j REDIRECT --to-ports 5201
-A DOCKER -i docker0 -j RETURN
-A openclash -p tcp -m tcp --sport 5244 -j RETURN
-A openclash -p tcp -m tcp --sport 1688 -j RETURN
-A openclash -p tcp -m tcp --sport 1194 -j RETURN
-A openclash -m set --match-set localnetwork dst -j RETURN
-A openclash -d 198.18.0.0/16 -p tcp -j REDIRECT --to-ports 7892
-A openclash -p tcp -j REDIRECT --to-ports 7892
-A openclash_output -p tcp -m tcp --sport 5244 -j RETURN
-A openclash_output -p tcp -m tcp --sport 1688 -j RETURN
-A openclash_output -p tcp -m tcp --sport 1194 -j RETURN
-A openclash_output -s 10.10.10.252/32 -p tcp -m tcp --sport 16800 -j RETURN
-A openclash_output -s 10.10.10.252/32 -p tcp -m tcp --sport 5244 -j RETURN
-A openclash_output -d 198.18.0.0/16 -p tcp -m owner ! --uid-owner 65534 -j REDIRECT --to-ports 7892
-A openclash_output -m set --match-set localnetwork dst -j RETURN
-A openclash_output -p tcp -m owner ! --uid-owner 65534 -j REDIRECT --to-ports 7892
-A zone_VPN_postrouting -m comment --comment "!fw3: Custom VPN postrouting rule chain" -j postrouting_VPN_rule
-A zone_VPN_prerouting -m comment --comment "!fw3: Custom VPN prerouting rule chain" -j prerouting_VPN_rule
-A zone_docker_postrouting -m comment --comment "!fw3: Custom docker postrouting rule chain" -j postrouting_docker_rule
-A zone_docker_prerouting -m comment --comment "!fw3: Custom docker prerouting rule chain" -j prerouting_docker_rule
-A zone_lan_postrouting -j MINIUPNPD-POSTROUTING
-A zone_lan_postrouting -j MINIUPNPD-POSTROUTING
-A zone_lan_postrouting -m comment --comment "!fw3: Custom lan postrouting rule chain" -j postrouting_lan_rule
-A zone_lan_prerouting -j MINIUPNPD
-A zone_lan_prerouting -j MINIUPNPD
-A zone_lan_prerouting -m comment --comment "!fw3: Custom lan prerouting rule chain" -j prerouting_lan_rule
-A zone_vpn_postrouting -m comment --comment "!fw3: Custom vpn postrouting rule chain" -j postrouting_vpn_rule
-A zone_vpn_postrouting -m comment --comment "!fw3" -j FULLCONENAT
-A zone_vpn_prerouting -m comment --comment "!fw3: Custom vpn prerouting rule chain" -j prerouting_vpn_rule
-A zone_vpn_prerouting -m comment --comment "!fw3" -j FULLCONENAT
-A zone_wan_postrouting -m comment --comment "!fw3: Custom wan postrouting rule chain" -j postrouting_wan_rule
-A zone_wan_postrouting -m comment --comment "!fw3" -j FULLCONENAT
-A zone_wan_prerouting -m comment --comment "!fw3: Custom wan prerouting rule chain" -j prerouting_wan_rule
-A zone_wan_prerouting -p tcp -m tcp --dport 5244 -m comment --comment "!fw3: alist" -j DNAT --to-destination 10.10.10.252:5244
-A zone_wan_prerouting -p udp -m udp --dport 5244 -m comment --comment "!fw3: alist" -j DNAT --to-destination 10.10.10.252:5244
-A zone_wan_prerouting -p tcp -m tcp --dport 16800 -m comment --comment "!fw3: aria2" -j DNAT --to-destination 10.10.10.252:16800
-A zone_wan_prerouting -p udp -m udp --dport 16800 -m comment --comment "!fw3: aria2" -j DNAT --to-destination 10.10.10.252:16800
-A zone_wan_prerouting -m comment --comment "!fw3" -j FULLCONENAT
COMMIT
# Completed on Thu Mar 23 10:50:24 2023

#IPv4 Mangle chain

# Generated by iptables-save v1.8.7 on Thu Mar 23 10:50:24 2023
*mangle
:PREROUTING ACCEPT [179948:222076961]
:INPUT ACCEPT [178492:221464331]
:FORWARD ACCEPT [639:30746]
:OUTPUT ACCEPT [155486:98243653]
:POSTROUTING ACCEPT [156138:98276477]
:openclash - [0:0]
:openclash_upnp - [0:0]
:qos_Default - [0:0]
:qos_Default_ct - [0:0]
-A PREROUTING -p udp -j openclash
-A openclash -p udp -m udp --sport 1194 -j RETURN
-A openclash -p udp -m udp --sport 4500 -j RETURN
-A openclash -p udp -m udp --sport 500 -j RETURN
-A openclash -p udp -m udp --sport 500 -j RETURN
-A openclash -p udp -m udp --sport 68 -j RETURN
-A openclash -s 10.10.10.252/32 -p udp -m udp --sport 16800 -j RETURN
-A openclash -s 10.10.10.252/32 -p udp -m udp --sport 5244 -j RETURN
-A openclash -m set --match-set localnetwork dst -j RETURN
-A openclash -p udp -m udp --dport 53 -j RETURN
-A openclash -d 198.18.0.0/16 -p udp -j TPROXY --on-port 7895 --on-ip 0.0.0.0 --tproxy-mark 0x162/0xffffffff
-A openclash -p udp -j openclash_upnp
-A openclash -p udp -j TPROXY --on-port 7895 --on-ip 0.0.0.0 --tproxy-mark 0x162/0xffffffff
-A qos_Default -j CONNMARK --restore-mark --nfmask 0xf --ctmask 0xf
-A qos_Default -m mark --mark 0x0/0xf -j qos_Default_ct
-A qos_Default -p udp -m mark --mark 0x0/0xf0 -m length --length 0:500 -j MARK --set-xmark 0x22/0xff
-A qos_Default -p icmp -j MARK --set-xmark 0x11/0xff
-A qos_Default -p tcp -m mark --mark 0x0/0xf0 -m tcp --sport 1024:65535 --dport 1024:65535 -j MARK --set-xmark 0x44/0xff
-A qos_Default -p udp -m mark --mark 0x0/0xf0 -m udp --sport 1024:65535 --dport 1024:65535 -j MARK --set-xmark 0x44/0xff
-A qos_Default -j CONNMARK --save-mark --nfmask 0xff --ctmask 0xff
-A qos_Default_ct -p tcp -m mark --mark 0x0/0xf -m tcp -m multiport --ports 22,53 -m comment --comment "ssh, dns" -j MARK --set-xmark 0x11/0xff
-A qos_Default_ct -p udp -m mark --mark 0x0/0xf -m udp -m multiport --ports 22,53 -m comment --comment "ssh, dns" -j MARK --set-xmark 0x11/0xff
-A qos_Default_ct -p tcp -m mark --mark 0x0/0xf -m tcp -m multiport --ports 20,21,25,80,110,443,993,995 -m comment --comment "ftp, smtp, http(s), imap" -j MARK --set-xmark 0x33/0xff
-A qos_Default_ct -p tcp -m mark --mark 0x0/0xf -m tcp -m multiport --ports 5190 -m comment --comment "AOL, iChat, ICQ" -j MARK --set-xmark 0x22/0xff
-A qos_Default_ct -p udp -m mark --mark 0x0/0xf -m udp -m multiport --ports 5190 -m comment --comment "AOL, iChat, ICQ" -j MARK --set-xmark 0x22/0xff
-A qos_Default_ct -j CONNMARK --save-mark --nfmask 0xff --ctmask 0xff
COMMIT
# Completed on Thu Mar 23 10:50:24 2023

#IPv4 Filter chain

# Generated by iptables-save v1.8.7 on Thu Mar 23 10:50:24 2023
*filter
:INPUT ACCEPT [9:360]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [0:0]
:DOCKER - [0:0]
:DOCKER-ISOLATION-STAGE-1 - [0:0]
:DOCKER-ISOLATION-STAGE-2 - [0:0]
:DOCKER-MAN - [0:0]
:DOCKER-USER - [0:0]
:MINIUPNPD - [0:0]
:SOCAT - [0:0]
:forwarding_VPN_rule - [0:0]
:forwarding_docker_rule - [0:0]
:forwarding_lan_rule - [0:0]
:forwarding_rule - [0:0]
:forwarding_vpn_rule - [0:0]
:forwarding_wan_rule - [0:0]
:input_VPN_rule - [0:0]
:input_docker_rule - [0:0]
:input_lan_rule - [0:0]
:input_rule - [0:0]
:input_vpn_rule - [0:0]
:input_wan_rule - [0:0]
:output_VPN_rule - [0:0]
:output_docker_rule - [0:0]
:output_lan_rule - [0:0]
:output_rule - [0:0]
:output_vpn_rule - [0:0]
:output_wan_rule - [0:0]
:reject - [0:0]
:syn_flood - [0:0]
:zone_VPN_dest_ACCEPT - [0:0]
:zone_VPN_forward - [0:0]
:zone_VPN_input - [0:0]
:zone_VPN_output - [0:0]
:zone_VPN_src_ACCEPT - [0:0]
:zone_docker_dest_ACCEPT - [0:0]
:zone_docker_forward - [0:0]
:zone_docker_input - [0:0]
:zone_docker_output - [0:0]
:zone_docker_src_ACCEPT - [0:0]
:zone_lan_dest_ACCEPT - [0:0]
:zone_lan_forward - [0:0]
:zone_lan_input - [0:0]
:zone_lan_output - [0:0]
:zone_lan_src_ACCEPT - [0:0]
:zone_vpn_dest_ACCEPT - [0:0]
:zone_vpn_forward - [0:0]
:zone_vpn_input - [0:0]
:zone_vpn_output - [0:0]
:zone_vpn_src_ACCEPT - [0:0]
:zone_wan_dest_ACCEPT - [0:0]
:zone_wan_dest_REJECT - [0:0]
:zone_wan_forward - [0:0]
:zone_wan_input - [0:0]
:zone_wan_output - [0:0]
:zone_wan_src_REJECT - [0:0]
-A INPUT -p udp -m udp --dport 443 -m comment --comment "OpenClash QUIC REJECT" -m set ! --match-set china_ip_route dst -j REJECT --reject-with icmp-port-unreachable
-A INPUT -m policy --dir in --pol ipsec --proto esp -j ACCEPT
-A INPUT -j SOCAT
-A INPUT -i lo -m comment --comment "!fw3" -j ACCEPT
-A INPUT -m comment --comment "!fw3: Custom input rule chain" -j input_rule
-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment "!fw3" -j ACCEPT
-A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -m comment --comment "!fw3" -j syn_flood
-A INPUT -i br-lan -m comment --comment "!fw3" -j zone_lan_input
-A INPUT -i ipsec0 -m comment --comment "!fw3" -j zone_VPN_input
-A INPUT -i tun0 -m comment --comment "!fw3" -j zone_vpn_input
-A INPUT -i docker0 -m comment --comment "!fw3" -j zone_docker_input
-A FORWARD -m policy --dir out --pol ipsec --proto esp -j ACCEPT
-A FORWARD -m policy --dir in --pol ipsec --proto esp -j ACCEPT
-A FORWARD -j DOCKER-USER
-A FORWARD -j DOCKER-ISOLATION-STAGE-1
-A FORWARD -o docker0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -o docker0 -j DOCKER
-A FORWARD -i docker0 ! -o docker0 -j ACCEPT
-A FORWARD -i docker0 -o docker0 -j ACCEPT
-A FORWARD -m comment --comment "!fw3: Custom forwarding rule chain" -j forwarding_rule
-A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment "!fw3" -j ACCEPT
-A FORWARD -i br-lan -m comment --comment "!fw3" -j zone_lan_forward
-A FORWARD -i ipsec0 -m comment --comment "!fw3" -j zone_VPN_forward
-A FORWARD -i tun0 -m comment --comment "!fw3" -j zone_vpn_forward
-A FORWARD -i docker0 -m comment --comment "!fw3" -j zone_docker_forward
-A FORWARD -m comment --comment "!fw3" -j reject
-A OUTPUT -d 223.252.199.10/32 -j DROP
-A OUTPUT -m policy --dir out --pol ipsec --proto esp -j ACCEPT
-A OUTPUT -o lo -m comment --comment "!fw3" -j ACCEPT
-A OUTPUT -m comment --comment "!fw3: Custom output rule chain" -j output_rule
-A OUTPUT -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment "!fw3" -j ACCEPT
-A OUTPUT -o br-lan -m comment --comment "!fw3" -j zone_lan_output
-A OUTPUT -o ipsec0 -m comment --comment "!fw3" -j zone_VPN_output
-A OUTPUT -o tun0 -m comment --comment "!fw3" -j zone_vpn_output
-A OUTPUT -o docker0 -m comment --comment "!fw3" -j zone_docker_output
-A DOCKER-ISOLATION-STAGE-1 -i docker0 ! -o docker0 -j DOCKER-ISOLATION-STAGE-2
-A DOCKER-ISOLATION-STAGE-1 -j RETURN
-A DOCKER-ISOLATION-STAGE-2 -o docker0 -j DROP
-A DOCKER-ISOLATION-STAGE-2 -j RETURN
-A DOCKER-MAN -i br-lan -o docker0 -j RETURN
-A DOCKER-MAN -o docker0 -m conntrack --ctstate RELATED,ESTABLISHED -j RETURN
-A DOCKER-MAN -o docker0 -m conntrack --ctstate INVALID,NEW -j DROP
-A DOCKER-MAN -j RETURN
-A DOCKER-USER -j DOCKER-MAN
-A DOCKER-USER -j RETURN
-A SOCAT -p tcp -m tcp --dport 2200 -m comment --comment "备注" -j ACCEPT
-A reject -p tcp -m comment --comment "!fw3" -j REJECT --reject-with tcp-reset
-A reject -m comment --comment "!fw3" -j REJECT --reject-with icmp-port-unreachable
-A syn_flood -m limit --limit 25/sec --limit-burst 50 -m comment --comment "!fw3" -j RETURN
-A syn_flood -m comment --comment "!fw3" -j DROP
-A zone_VPN_dest_ACCEPT -o ipsec0 -m comment --comment "!fw3" -j ACCEPT
-A zone_VPN_forward -m comment --comment "!fw3: Custom VPN forwarding rule chain" -j forwarding_VPN_rule
-A zone_VPN_forward -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port forwards" -j ACCEPT
-A zone_VPN_forward -m comment --comment "!fw3" -j zone_VPN_dest_ACCEPT
-A zone_VPN_input -m comment --comment "!fw3: Custom VPN input rule chain" -j input_VPN_rule
-A zone_VPN_input -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port redirections" -j ACCEPT
-A zone_VPN_input -m comment --comment "!fw3" -j zone_VPN_src_ACCEPT
-A zone_VPN_output -m comment --comment "!fw3: Custom VPN output rule chain" -j output_VPN_rule
-A zone_VPN_output -m comment --comment "!fw3" -j zone_VPN_dest_ACCEPT
-A zone_VPN_src_ACCEPT -i ipsec0 -m conntrack --ctstate NEW,UNTRACKED -m comment --comment "!fw3" -j ACCEPT
-A zone_docker_dest_ACCEPT -o docker0 -m comment --comment "!fw3" -j ACCEPT
-A zone_docker_forward -m comment --comment "!fw3: Custom docker forwarding rule chain" -j forwarding_docker_rule
-A zone_docker_forward -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port forwards" -j ACCEPT
-A zone_docker_forward -m comment --comment "!fw3" -j zone_docker_dest_ACCEPT
-A zone_docker_input -m comment --comment "!fw3: Custom docker input rule chain" -j input_docker_rule
-A zone_docker_input -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port redirections" -j ACCEPT
-A zone_docker_input -m comment --comment "!fw3" -j zone_docker_src_ACCEPT
-A zone_docker_output -m comment --comment "!fw3: Custom docker output rule chain" -j output_docker_rule
-A zone_docker_output -m comment --comment "!fw3" -j zone_docker_dest_ACCEPT
-A zone_docker_src_ACCEPT -i docker0 -m conntrack --ctstate NEW,UNTRACKED -m comment --comment "!fw3" -j ACCEPT
-A zone_lan_dest_ACCEPT -o br-lan -m comment --comment "!fw3" -j ACCEPT
-A zone_lan_forward -j MINIUPNPD
-A zone_lan_forward -j MINIUPNPD
-A zone_lan_forward -m comment --comment "!fw3: Custom lan forwarding rule chain" -j forwarding_lan_rule
-A zone_lan_forward -m comment --comment "!fw3: Zone lan to wan forwarding policy" -j zone_wan_dest_ACCEPT
-A zone_lan_forward -m comment --comment "!fw3: Zone lan to vpn forwarding policy" -j zone_vpn_dest_ACCEPT
-A zone_lan_forward -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port forwards" -j ACCEPT
-A zone_lan_forward -m comment --comment "!fw3" -j zone_lan_dest_ACCEPT
-A zone_lan_input -m comment --comment "!fw3: Custom lan input rule chain" -j input_lan_rule
-A zone_lan_input -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port redirections" -j ACCEPT
-A zone_lan_input -m comment --comment "!fw3" -j zone_lan_src_ACCEPT
-A zone_lan_output -m comment --comment "!fw3: Custom lan output rule chain" -j output_lan_rule
-A zone_lan_output -m comment --comment "!fw3" -j zone_lan_dest_ACCEPT
-A zone_lan_src_ACCEPT -i br-lan -m conntrack --ctstate NEW,UNTRACKED -m comment --comment "!fw3" -j ACCEPT
-A zone_vpn_dest_ACCEPT -o tun0 -m conntrack --ctstate INVALID -m comment --comment "!fw3: Prevent NAT leakage" -j DROP
-A zone_vpn_dest_ACCEPT -o tun0 -m comment --comment "!fw3" -j ACCEPT
-A zone_vpn_forward -m comment --comment "!fw3: Custom vpn forwarding rule chain" -j forwarding_vpn_rule
-A zone_vpn_forward -m comment --comment "!fw3: Zone vpn to wan forwarding policy" -j zone_wan_dest_ACCEPT
-A zone_vpn_forward -m comment --comment "!fw3: Zone vpn to lan forwarding policy" -j zone_lan_dest_ACCEPT
-A zone_vpn_forward -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port forwards" -j ACCEPT
-A zone_vpn_forward -m comment --comment "!fw3" -j zone_vpn_dest_ACCEPT
-A zone_vpn_input -m comment --comment "!fw3: Custom vpn input rule chain" -j input_vpn_rule
-A zone_vpn_input -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port redirections" -j ACCEPT
-A zone_vpn_input -m comment --comment "!fw3" -j zone_vpn_src_ACCEPT
-A zone_vpn_output -m comment --comment "!fw3: Custom vpn output rule chain" -j output_vpn_rule
-A zone_vpn_output -m comment --comment "!fw3" -j zone_vpn_dest_ACCEPT
-A zone_vpn_src_ACCEPT -i tun0 -m conntrack --ctstate NEW,UNTRACKED -m comment --comment "!fw3" -j ACCEPT
-A zone_wan_forward -m comment --comment "!fw3: Custom wan forwarding rule chain" -j forwarding_wan_rule
-A zone_wan_forward -p esp -m comment --comment "!fw3: Allow-IPSec-ESP" -j zone_lan_dest_ACCEPT
-A zone_wan_forward -p udp -m udp --dport 500 -m comment --comment "!fw3: Allow-ISAKMP" -j zone_lan_dest_ACCEPT
-A zone_wan_forward -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port forwards" -j ACCEPT
-A zone_wan_forward -m comment --comment "!fw3" -j zone_wan_dest_REJECT
-A zone_wan_input -m comment --comment "!fw3: Custom wan input rule chain" -j input_wan_rule
-A zone_wan_input -p udp -m udp --dport 68 -m comment --comment "!fw3: Allow-DHCP-Renew" -j ACCEPT
-A zone_wan_input -p icmp -m icmp --icmp-type 8 -m comment --comment "!fw3: Allow-Ping" -j ACCEPT
-A zone_wan_input -p igmp -m comment --comment "!fw3: Allow-IGMP" -j ACCEPT
-A zone_wan_input -p tcp -m tcp --dport 8118 -m comment --comment "!fw3: adblock" -j DROP
-A zone_wan_input -p udp -m udp --dport 500 -m comment --comment "!fw3: ike" -j ACCEPT
-A zone_wan_input -p udp -m udp --dport 4500 -m comment --comment "!fw3: ipsec" -j ACCEPT
-A zone_wan_input -p ah -m comment --comment "!fw3: ah" -j ACCEPT
-A zone_wan_input -p esp -m comment --comment "!fw3: esp" -j ACCEPT
-A zone_wan_input -p tcp -m tcp --dport 1194 -m comment --comment "!fw3: openvpn" -j ACCEPT
-A zone_wan_input -p udp -m udp --dport 1194 -m comment --comment "!fw3: openvpn" -j ACCEPT
-A zone_wan_input -p tcp -m tcp --dport 1688 -m comment --comment "!fw3: kms" -j ACCEPT
-A zone_wan_input -p tcp -m tcp --dport 5244 -m comment --comment "!fw3: alist" -j ACCEPT
-A zone_wan_input -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port redirections" -j ACCEPT
-A zone_wan_input -m comment --comment "!fw3" -j zone_wan_src_REJECT
-A zone_wan_output -m comment --comment "!fw3: Custom wan output rule chain" -j output_wan_rule
-A zone_wan_output -m comment --comment "!fw3" -j zone_wan_dest_ACCEPT
COMMIT
# Completed on Thu Mar 23 10:50:24 2023

#IPv6 NAT chain

# Generated by ip6tables-save v1.8.7 on Thu Mar 23 10:50:24 2023
*nat
:PREROUTING ACCEPT [128040:87343966]
:INPUT ACCEPT [4100:476718]
:OUTPUT ACCEPT [125672:10870777]
:POSTROUTING ACCEPT [125672:10870777]
-A PREROUTING -p udp -m udp --dport 53 -j REDIRECT --to-ports 53
-A PREROUTING -p tcp -m tcp --dport 53 -j REDIRECT --to-ports 53
COMMIT
# Completed on Thu Mar 23 10:50:24 2023

#IPv6 Mangle chain

# Generated by ip6tables-save v1.8.7 on Thu Mar 23 10:50:24 2023
*mangle
:PREROUTING ACCEPT [2638515:3920180878]
:INPUT ACCEPT [2583637:3894155280]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [1672558:663289064]
:POSTROUTING ACCEPT [1672558:663289064]
:qos_Default - [0:0]
:qos_Default_ct - [0:0]
-A qos_Default -j CONNMARK --restore-mark --nfmask 0xf --ctmask 0xf
-A qos_Default -m mark --mark 0x0/0xf -j qos_Default_ct
-A qos_Default -p udp -m mark --mark 0x0/0xf0 -m length --length 0:500 -j MARK --set-xmark 0x22/0xff
-A qos_Default -p icmp -j MARK --set-xmark 0x11/0xff
-A qos_Default -p tcp -m mark --mark 0x0/0xf0 -m tcp --sport 1024:65535 --dport 1024:65535 -j MARK --set-xmark 0x44/0xff
-A qos_Default -p udp -m mark --mark 0x0/0xf0 -m udp --sport 1024:65535 --dport 1024:65535 -j MARK --set-xmark 0x44/0xff
-A qos_Default -j CONNMARK --save-mark --nfmask 0xff --ctmask 0xff
-A qos_Default_ct -p tcp -m mark --mark 0x0/0xf -m tcp -m multiport --ports 22,53 -m comment --comment "ssh, dns" -j MARK --set-xmark 0x11/0xff
-A qos_Default_ct -p udp -m mark --mark 0x0/0xf -m udp -m multiport --ports 22,53 -m comment --comment "ssh, dns" -j MARK --set-xmark 0x11/0xff
-A qos_Default_ct -p tcp -m mark --mark 0x0/0xf -m tcp -m multiport --ports 20,21,25,80,110,443,993,995 -m comment --comment "ftp, smtp, http(s), imap" -j MARK --set-xmark 0x33/0xff
-A qos_Default_ct -p tcp -m mark --mark 0x0/0xf -m tcp -m multiport --ports 5190 -m comment --comment "AOL, iChat, ICQ" -j MARK --set-xmark 0x22/0xff
-A qos_Default_ct -p udp -m mark --mark 0x0/0xf -m udp -m multiport --ports 5190 -m comment --comment "AOL, iChat, ICQ" -j MARK --set-xmark 0x22/0xff
-A qos_Default_ct -j CONNMARK --save-mark --nfmask 0xff --ctmask 0xff
COMMIT
# Completed on Thu Mar 23 10:50:24 2023

#IPv6 Filter chain

# Generated by ip6tables-save v1.8.7 on Thu Mar 23 10:50:24 2023
*filter
:INPUT ACCEPT [2487:286064]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [49:4536]
:MINIUPNPD - [0:0]
:SOCAT - [0:0]
:forwarding_VPN_rule - [0:0]
:forwarding_docker_rule - [0:0]
:forwarding_lan_rule - [0:0]
:forwarding_rule - [0:0]
:forwarding_vpn_rule - [0:0]
:forwarding_wan_rule - [0:0]
:input_VPN_rule - [0:0]
:input_docker_rule - [0:0]
:input_lan_rule - [0:0]
:input_rule - [0:0]
:input_vpn_rule - [0:0]
:input_wan_rule - [0:0]
:output_VPN_rule - [0:0]
:output_docker_rule - [0:0]
:output_lan_rule - [0:0]
:output_rule - [0:0]
:output_vpn_rule - [0:0]
:output_wan_rule - [0:0]
:reject - [0:0]
:syn_flood - [0:0]
:zone_VPN_dest_ACCEPT - [0:0]
:zone_VPN_forward - [0:0]
:zone_VPN_input - [0:0]
:zone_VPN_output - [0:0]
:zone_VPN_src_ACCEPT - [0:0]
:zone_docker_dest_ACCEPT - [0:0]
:zone_docker_forward - [0:0]
:zone_docker_input - [0:0]
:zone_docker_output - [0:0]
:zone_docker_src_ACCEPT - [0:0]
:zone_lan_dest_ACCEPT - [0:0]
:zone_lan_forward - [0:0]
:zone_lan_input - [0:0]
:zone_lan_output - [0:0]
:zone_lan_src_ACCEPT - [0:0]
:zone_vpn_dest_ACCEPT - [0:0]
:zone_vpn_forward - [0:0]
:zone_vpn_input - [0:0]
:zone_vpn_output - [0:0]
:zone_vpn_src_ACCEPT - [0:0]
:zone_wan_dest_ACCEPT - [0:0]
:zone_wan_dest_REJECT - [0:0]
:zone_wan_forward - [0:0]
:zone_wan_input - [0:0]
:zone_wan_output - [0:0]
:zone_wan_src_REJECT - [0:0]
-A INPUT -j SOCAT
-A INPUT -i lo -m comment --comment "!fw3" -j ACCEPT
-A INPUT -m comment --comment "!fw3: Custom input rule chain" -j input_rule
-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment "!fw3" -j ACCEPT
-A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -m comment --comment "!fw3" -j syn_flood
-A INPUT -i br-lan -m comment --comment "!fw3" -j zone_lan_input
-A INPUT -i ipsec0 -m comment --comment "!fw3" -j zone_VPN_input
-A INPUT -i tun0 -m comment --comment "!fw3" -j zone_vpn_input
-A INPUT -i docker0 -m comment --comment "!fw3" -j zone_docker_input
-A FORWARD -m comment --comment "!fw3: Custom forwarding rule chain" -j forwarding_rule
-A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment "!fw3" -j ACCEPT
-A FORWARD -i br-lan -m comment --comment "!fw3" -j zone_lan_forward
-A FORWARD -i ipsec0 -m comment --comment "!fw3" -j zone_VPN_forward
-A FORWARD -i tun0 -m comment --comment "!fw3" -j zone_vpn_forward
-A FORWARD -i docker0 -m comment --comment "!fw3" -j zone_docker_forward
-A FORWARD -m comment --comment "!fw3" -j reject
-A OUTPUT -o lo -m comment --comment "!fw3" -j ACCEPT
-A OUTPUT -m comment --comment "!fw3: Custom output rule chain" -j output_rule
-A OUTPUT -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment "!fw3" -j ACCEPT
-A OUTPUT -o br-lan -m comment --comment "!fw3" -j zone_lan_output
-A OUTPUT -o ipsec0 -m comment --comment "!fw3" -j zone_VPN_output
-A OUTPUT -o tun0 -m comment --comment "!fw3" -j zone_vpn_output
-A OUTPUT -o docker0 -m comment --comment "!fw3" -j zone_docker_output
-A SOCAT -p tcp -m tcp --dport 2200 -m comment --comment "备注" -j ACCEPT
-A reject -p tcp -m comment --comment "!fw3" -j REJECT --reject-with tcp-reset
-A reject -m comment --comment "!fw3" -j REJECT --reject-with icmp6-port-unreachable
-A syn_flood -m limit --limit 25/sec --limit-burst 50 -m comment --comment "!fw3" -j RETURN
-A syn_flood -m comment --comment "!fw3" -j DROP
-A zone_VPN_dest_ACCEPT -o ipsec0 -m comment --comment "!fw3" -j ACCEPT
-A zone_VPN_forward -m comment --comment "!fw3: Custom VPN forwarding rule chain" -j forwarding_VPN_rule
-A zone_VPN_forward -m comment --comment "!fw3" -j zone_VPN_dest_ACCEPT
-A zone_VPN_input -m comment --comment "!fw3: Custom VPN input rule chain" -j input_VPN_rule
-A zone_VPN_input -m comment --comment "!fw3" -j zone_VPN_src_ACCEPT
-A zone_VPN_output -m comment --comment "!fw3: Custom VPN output rule chain" -j output_VPN_rule
-A zone_VPN_output -m comment --comment "!fw3" -j zone_VPN_dest_ACCEPT
-A zone_VPN_src_ACCEPT -i ipsec0 -m conntrack --ctstate NEW,UNTRACKED -m comment --comment "!fw3" -j ACCEPT
-A zone_docker_dest_ACCEPT -o docker0 -m comment --comment "!fw3" -j ACCEPT
-A zone_docker_forward -m comment --comment "!fw3: Custom docker forwarding rule chain" -j forwarding_docker_rule
-A zone_docker_forward -m comment --comment "!fw3" -j zone_docker_dest_ACCEPT
-A zone_docker_input -m comment --comment "!fw3: Custom docker input rule chain" -j input_docker_rule
-A zone_docker_input -m comment --comment "!fw3" -j zone_docker_src_ACCEPT
-A zone_docker_output -m comment --comment "!fw3: Custom docker output rule chain" -j output_docker_rule
-A zone_docker_output -m comment --comment "!fw3" -j zone_docker_dest_ACCEPT
-A zone_docker_src_ACCEPT -i docker0 -m conntrack --ctstate NEW,UNTRACKED -m comment --comment "!fw3" -j ACCEPT
-A zone_lan_dest_ACCEPT -o br-lan -m comment --comment "!fw3" -j ACCEPT
-A zone_lan_forward -j MINIUPNPD
-A zone_lan_forward -j MINIUPNPD
-A zone_lan_forward -m comment --comment "!fw3: Custom lan forwarding rule chain" -j forwarding_lan_rule
-A zone_lan_forward -m comment --comment "!fw3: Zone lan to wan forwarding policy" -j zone_wan_dest_ACCEPT
-A zone_lan_forward -m comment --comment "!fw3: Zone lan to vpn forwarding policy" -j zone_vpn_dest_ACCEPT
-A zone_lan_forward -m comment --comment "!fw3" -j zone_lan_dest_ACCEPT
-A zone_lan_input -m comment --comment "!fw3: Custom lan input rule chain" -j input_lan_rule
-A zone_lan_input -m comment --comment "!fw3" -j zone_lan_src_ACCEPT
-A zone_lan_output -m comment --comment "!fw3: Custom lan output rule chain" -j output_lan_rule
-A zone_lan_output -m comment --comment "!fw3" -j zone_lan_dest_ACCEPT
-A zone_lan_src_ACCEPT -i br-lan -m conntrack --ctstate NEW,UNTRACKED -m comment --comment "!fw3" -j ACCEPT
-A zone_vpn_dest_ACCEPT -o tun0 -m conntrack --ctstate INVALID -m comment --comment "!fw3: Prevent NAT leakage" -j DROP
-A zone_vpn_dest_ACCEPT -o tun0 -m comment --comment "!fw3" -j ACCEPT
-A zone_vpn_forward -m comment --comment "!fw3: Custom vpn forwarding rule chain" -j forwarding_vpn_rule
-A zone_vpn_forward -m comment --comment "!fw3: Zone vpn to wan forwarding policy" -j zone_wan_dest_ACCEPT
-A zone_vpn_forward -m comment --comment "!fw3: Zone vpn to lan forwarding policy" -j zone_lan_dest_ACCEPT
-A zone_vpn_forward -m comment --comment "!fw3" -j zone_vpn_dest_ACCEPT
-A zone_vpn_input -m comment --comment "!fw3: Custom vpn input rule chain" -j input_vpn_rule
-A zone_vpn_input -m comment --comment "!fw3" -j zone_vpn_src_ACCEPT
-A zone_vpn_output -m comment --comment "!fw3: Custom vpn output rule chain" -j output_vpn_rule
-A zone_vpn_output -m comment --comment "!fw3" -j zone_vpn_dest_ACCEPT
-A zone_vpn_src_ACCEPT -i tun0 -m conntrack --ctstate NEW,UNTRACKED -m comment --comment "!fw3" -j ACCEPT
-A zone_wan_forward -m comment --comment "!fw3: Custom wan forwarding rule chain" -j forwarding_wan_rule
-A zone_wan_forward -p ipv6-icmp -m icmp6 --icmpv6-type 128 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Forward" -j ACCEPT
-A zone_wan_forward -p ipv6-icmp -m icmp6 --icmpv6-type 129 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Forward" -j ACCEPT
-A zone_wan_forward -p ipv6-icmp -m icmp6 --icmpv6-type 1 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Forward" -j ACCEPT
-A zone_wan_forward -p ipv6-icmp -m icmp6 --icmpv6-type 2 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Forward" -j ACCEPT
-A zone_wan_forward -p ipv6-icmp -m icmp6 --icmpv6-type 3 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Forward" -j ACCEPT
-A zone_wan_forward -p ipv6-icmp -m icmp6 --icmpv6-type 4/0 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Forward" -j ACCEPT
-A zone_wan_forward -p ipv6-icmp -m icmp6 --icmpv6-type 4/1 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Forward" -j ACCEPT
-A zone_wan_forward -p esp -m comment --comment "!fw3: Allow-IPSec-ESP" -j zone_lan_dest_ACCEPT
-A zone_wan_forward -p udp -m udp --dport 500 -m comment --comment "!fw3: Allow-ISAKMP" -j zone_lan_dest_ACCEPT
-A zone_wan_forward -m comment --comment "!fw3" -j zone_wan_dest_REJECT
-A zone_wan_input -m comment --comment "!fw3: Custom wan input rule chain" -j input_wan_rule
-A zone_wan_input -s fc00::/6 -d fc00::/6 -p udp -m udp --dport 546 -m comment --comment "!fw3: Allow-DHCPv6" -j ACCEPT
-A zone_wan_input -s fe80::/10 -p ipv6-icmp -m icmp6 --icmpv6-type 130/0 -m comment --comment "!fw3: Allow-MLD" -j ACCEPT
-A zone_wan_input -s fe80::/10 -p ipv6-icmp -m icmp6 --icmpv6-type 131/0 -m comment --comment "!fw3: Allow-MLD" -j ACCEPT
-A zone_wan_input -s fe80::/10 -p ipv6-icmp -m icmp6 --icmpv6-type 132/0 -m comment --comment "!fw3: Allow-MLD" -j ACCEPT
-A zone_wan_input -s fe80::/10 -p ipv6-icmp -m icmp6 --icmpv6-type 143/0 -m comment --comment "!fw3: Allow-MLD" -j ACCEPT
-A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 128 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT
-A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 129 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT
-A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 1 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT
-A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 2 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT
-A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 3 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT
-A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 4/0 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT
-A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 4/1 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT
-A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 133 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT
-A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 135 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT
-A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 134 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT
-A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 136 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT
-A zone_wan_input -p tcp -m tcp --dport 8118 -m comment --comment "!fw3: adblock" -j DROP
-A zone_wan_input -p udp -m udp --dport 500 -m comment --comment "!fw3: ike" -j ACCEPT
-A zone_wan_input -p udp -m udp --dport 4500 -m comment --comment "!fw3: ipsec" -j ACCEPT
-A zone_wan_input -p ah -m comment --comment "!fw3: ah" -j ACCEPT
-A zone_wan_input -p esp -m comment --comment "!fw3: esp" -j ACCEPT
-A zone_wan_input -p tcp -m tcp --dport 1194 -m comment --comment "!fw3: openvpn" -j ACCEPT
-A zone_wan_input -p udp -m udp --dport 1194 -m comment --comment "!fw3: openvpn" -j ACCEPT
-A zone_wan_input -p tcp -m tcp --dport 1688 -m comment --comment "!fw3: kms" -j ACCEPT
-A zone_wan_input -p tcp -m tcp --dport 5244 -m comment --comment "!fw3: alist" -j ACCEPT
-A zone_wan_input -m comment --comment "!fw3" -j zone_wan_src_REJECT
-A zone_wan_output -m comment --comment "!fw3: Custom wan output rule chain" -j output_wan_rule
-A zone_wan_output -m comment --comment "!fw3" -j zone_wan_dest_ACCEPT
COMMIT
# Completed on Thu Mar 23 10:50:24 2023

#===================== IPSET状态 =====================#

Name: cn
Name: ct
Name: cnc
Name: cmcc
Name: crtc
Name: cernet
Name: gwbn
Name: othernet
Name: music
Name: mwan3_connected_v4
Name: mwan3_connected_v6
Name: mwan3_source_v6
Name: mwan3_dynamic_v4
Name: mwan3_dynamic_v6
Name: mwan3_custom_v4
Name: mwan3_custom_v6
Name: music_http
Name: music_https
Name: china
Name: china_ip_route
Name: china_ip_route_pass
Name: localnetwork
Name: mwan3_connected

#===================== 路由表状态 =====================#

#route -n
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         10.10.10.253    0.0.0.0         UG    0      0        0 br-lan
10.10.10.0      0.0.0.0         255.255.255.0   U     0      0        0 br-lan
172.17.0.0      0.0.0.0         255.255.0.0     U     0      0        0 docker0
#ip route list
default via 10.10.10.253 dev br-lan proto static 
10.10.10.0/24 dev br-lan proto kernel scope link src 10.10.10.252 
172.17.0.0/16 dev docker0 proto kernel scope link src 172.17.0.1 linkdown 
#ip rule show
0:	from all lookup local
32765:	from all fwmark 0x162 lookup 354
32766:	from all lookup main
32767:	from all lookup default

#===================== 端口占用状态 =====================#

tcp        0      0 :::7891                 :::*                    LISTEN      21327/clash
tcp        0      0 :::7890                 :::*                    LISTEN      21327/clash
tcp        0      0 :::7895                 :::*                    LISTEN      21327/clash
tcp        0      0 :::7893                 :::*                    LISTEN      21327/clash
tcp        0      0 :::7892                 :::*                    LISTEN      21327/clash
tcp        0      0 :::9090                 :::*                    LISTEN      21327/clash
udp        0      0 :::7874                 :::*                                21327/clash
udp        0      0 :::7891                 :::*                                21327/clash
udp        0      0 :::7892                 :::*                                21327/clash
udp        0      0 :::7893                 :::*                                21327/clash
udp        0      0 :::7895                 :::*                                21327/clash

#===================== 测试本机DNS查询(www.baidu.com) =====================#

Server:		127.0.0.1
Address:	127.0.0.1:53


Name:	www.baidu.com
Address: 198.18.0.43


#===================== 测试内核DNS查询(www.instagram.com) =====================#

Status: 0
TC: false
RD: true
RA: true
AD: false
CD: false

Question: 
  Name: www.instagram.com.
  Qtype: 1
  Qclass: 1

Answer: 
  TTL: 54
  data: 108.160.169.55
  name: www.instagram.com.
  type: 1


#===================== resolv.conf.d =====================#

# Interface lan
nameserver 114.114.114.114
nameserver 223.5.5.5

#===================== 测试本机网络连接(www.baidu.com) =====================#

HTTP/1.1 200 OK
Accept-Ranges: bytes
Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform
Connection: keep-alive
Content-Length: 277
Content-Type: text/html
Date: Thu, 23 Mar 2023 02:50:32 GMT
Etag: "575e1f59-115"
Last-Modified: Mon, 13 Jun 2016 02:50:01 GMT
Pragma: no-cache
Server: bfe/1.0.8.18


#===================== 测试本机网络下载(raw.githubusercontent.com) =====================#

HTTP/1.1 200 OK
Connection: keep-alive
Content-Length: 83
Cache-Control: max-age=300
Content-Security-Policy: default-src 'none'; style-src 'unsafe-inline'; sandbox
Content-Type: text/plain; charset=utf-8
ETag: "275ce7c4d332951875158904a2c8128e7ea40f4ae5057d32acf9f67754ef0e71"
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
X-Frame-Options: deny
X-XSS-Protection: 1; mode=block
X-GitHub-Request-Id: 8152:0E7C:ED992C:1345868:640FF9DE
Accept-Ranges: bytes
Date: Thu, 23 Mar 2023 02:50:33 GMT
Via: 1.1 varnish
X-Served-By: cache-dxb1470020-DXB
X-Cache: HIT
X-Cache-Hits: 1
X-Timer: S1679539834.741591,VS0,VE0
Vary: Authorization,Accept-Encoding,Origin
Access-Control-Allow-Origin: *
X-Fastly-Request-ID: 743791acb1ba66b89bb6f2f5242363ac43975e64
Expires: Thu, 23 Mar 2023 02:55:33 GMT
Source-Age: 103


#===================== 最近运行日志(自动切换为Debug模式) =====================#

time="2023-03-23T10:50:40.585730398+08:00" level=debug msg="[DNS] processor.XXX.com --> XXX.XX.XXX.XXX"
time="2023-03-23T10:50:40.620391014+08:00" level=debug msg="[Process] find process processor.XXX.com: socket: protocol not supported"
time="2023-03-23T10:50:40.648821243+08:00" level=debug msg="[Process] find process processor.XXX.com: socket: protocol not supported"

#===================== 最近运行日志获取完成(自动切换为silent模式) =====================#


#===================== 活动连接信息 =====================#