向日葵无法连接，tls握手时，服务端没有响应

[cicada-lewis]

前置条件

1. 我已经尝试过以下issue的处理方式

• 开启udp转发后向日葵还是无法控制。 #594
• [Bug] 向日葵无法连接服务器 #3229

2. 我尝试过关闭openclash，此时向日葵是能够正常使用的
3. 我用单臂路由的形式使用istoreos(使用hyperV以虚拟机的形式安装在本机)，并在openclash中开启了旁路网关（旁路由）兼容
4. 我在本地使用wireshark抓包向日葵域名slapi.oray.com，抓包图片如下，可以看到发送tls 的client hello后，没有收到服务端的响应
   
5. 我在istoreos中使用tcpdump抓包，得到了同样的结果
   
6. 我有试着将oray.com oray.net sunlogin.com等向日葵域名加入直连规则里，不过按我理解我使用了geosite应该是可以排除掉向日葵的域名的

openclash调试日志如下，省略了大量规则

OpenClash 调试日志

生成时间: 2025-02-12 16:26:57
插件版本: 0.46.064
隐私提示: 上传此日志前请注意检查、屏蔽公网IP、节点、密码等相关敏感信息

#===================== 系统信息 =====================#

主机型号: Microsoft Corporation Virtual Machine
固件版本: iStoreOS 22.03.7 2024122712
LuCI版本: git-23.093.42303-d58cd69
内核版本: 5.10.221
处理器架构: x86_64

#此项有值时,如不使用IPv6,建议到网络-接口-lan的设置中禁用IPV6的DHCP
IPV6-DHCP: 

DNS劫持: Dnsmasq 转发
#DNS劫持为Dnsmasq时，此项结果应仅有配置文件的DNS监听地址
Dnsmasq转发设置: 127.0.*.*#7874

#===================== 依赖检查 =====================#

dnsmasq-full: 已安装
dnsmasq-full(ipset): 已安装
dnsmasq-full(nftset): 已安装
coreutils: 已安装
coreutils-nohup: 已安装
bash: 已安装
curl: 已安装
ca-certificates: 已安装
ipset: 已安装
ip-full: 已安装
libcap: 已安装
libcap-bin: 已安装
ruby: 已安装
ruby-yaml: 已安装
ruby-psych: 已安装
ruby-pstore: 已安装
kmod-tun(TUN模式): 已安装
luci-compat(Luci >= 19.07): 已安装
kmod-inet-diag(PROCESS-NAME): 已安装
unzip: 已安装
iptables-mod-tproxy: 已安装
kmod-ipt-tproxy: 已安装
iptables-mod-extra: 已安装
kmod-ipt-extra: 已安装
kmod-ipt-nat: 已安装

#===================== 内核检查 =====================#

运行状态: 运行中
运行内核：Meta
进程pid: 32655
运行权限: 32655: cap_dac_override,cap_net_bind_service,cap_net_admin,cap_net_raw,cap_sys_ptrace,cap_sys_admin,cap_sys_resource=eip
运行用户: nobody
已选择的架构: linux-amd64

#下方无法显示内核版本号时请确认您的内核版本是否正确或者有无权限

Meta内核版本: alpha-g368b1e1
Meta内核文件: 存在
Meta内核运行权限: 正常

#===================== 插件设置 =====================#

当前配置文件: /etc/openclash/config/xair.yaml
启动配置文件: /etc/openclash/xair.yaml
运行模式: fake-ip
默认代理模式: rule
UDP流量转发(tproxy): 停用
自定义DNS: 启用
IPV6代理: 停用
IPV6-DNS解析: 停用
禁用Dnsmasq缓存: 启用
自定义规则: 启用
仅允许内网: 启用
仅代理命中规则流量: 启用
仅允许常用端口流量: 停用
绕过中国大陆IP: 启用
路由本机代理: 启用

#启动异常时建议关闭此项后重试
混合节点: 启用
保留配置: 停用

#启动异常时建议关闭此项后重试
第三方规则: 停用

#===================== 自定义规则 一 =====================#
rules:
  - DOMAIN-SUFFIX,szsandstone.com,DIRECT
  - IP-CIDR,20.20.*.*/24,DIRECT
  - IP-CIDR,20.20.*.*/24,DIRECT
  - IP-CIDR,20.20.*.*/24,DIRECT
  - IP-CIDR,20.20.*.*/24,DIRECT
  - IP-CIDR,20.20.*.*/24,DIRECT
  - IP-CIDR,20.20.*.*/24,DIRECT
  - IP-CIDR,20.20.*.*/24,DIRECT
  - IP-CIDR,20.20.*.*/24,DIRECT
  - IP-CIDR,20.20.*.*/24,DIRECT
  - DOMAIN-KEYWORD,nlark.com,DIRECT
  - DOMAIN-KEYWORD,staticfile.org,DIRECT
##- PROCESS-NAME,curl,DIRECT #匹配路由自身进程(curl直连)
##- DOMAIN-SUFFIX,google.com,Proxy #匹配域名后缀(交由Proxy代理服务器组)
##- DOMAIN-KEYWORD,google,Proxy #匹配域名关键字(交由Proxy代理服务器组)
##- DOMAIN,google.com,Proxy #匹配域名(交由Proxy代理服务器组)
##- DOMAIN-SUFFIX,ad.com,REJECT #匹配域名后缀(拒绝)
##- IP-CIDR,127.0.*.*/8,DIRECT #匹配数据目标IP(直连)
##- SRC-IP-CIDR,192.168.*.*/32,DIRECT #匹配数据发起IP(直连)
##- DST-PORT,80,DIRECT #匹配数据目标端口(直连)
##- SRC-PORT,7777,DIRECT #匹配数据源端口(直连)
##- GEOSITE,category-public-tracker,DIRECT #匹配GEOSITE数据库规则(直连)
##- DOMAIN-REGEX,^abc.*com,PROXY #正则匹配域名
##- RULE-SET,providername,PROXY #匹配规则集

##- IP-CIDR6,2620:*:*:*::7/32,PROXY
##- IP-SUFFIX,8.8.*.*/24,PROXY
##- IP-ASN,13335,DIRECT

##- SRC-GEOIP,cn,DIRECT
##- SRC-IP-ASN,9808,DIRECT
##- SRC-IP-SUFFIX,192.168.*.*/8,DIRECT

##- IN-PORT,7890,PROXY
##- IN-TYPE,SOCKS/HTTP,PROXY
##- IN-USER,mihomo,PROXY
##- IN-NAME,ss,PROXY

##- PROCESS-NAME-REGEX,curl$,PROXY
##- PROCESS-NAME-REGEX,(?i)Telegram,PROXY
##- PROCESS-NAME-REGEX,.*telegram.*,PROXY

##- NETWORK,udp,DIRECT
##- DSCP,4,DIRECT

##- AND,((DOMAIN,baidu.com),(NETWORK,UDP)),DIRECT
##- OR,((NETWORK,UDP),(DOMAIN,baidu.com)),REJECT
##- NOT,((DOMAIN,baidu.com)),PROXY
##- SUB-RULE,(NETWORK,tcp),sub-rule

##排序在上的规则优先生效,如添加（去除规则前的#号）：
##IP段：192.168.*.*-192.168.*.* 直连
##- SRC-IP-CIDR,192.168.*.*/31,DIRECT
##- SRC-IP-CIDR,192.168.*.*/30,DIRECT
##- SRC-IP-CIDR,192.168.*.*/29,DIRECT
##- SRC-IP-CIDR,192.168.*.*/28,DIRECT
##- SRC-IP-CIDR,192.168.*.*/27,DIRECT
##- SRC-IP-CIDR,192.168.*.*/26,DIRECT
##- SRC-IP-CIDR,192.168.*.*/26,DIRECT
##- SRC-IP-CIDR,192.168.*.*/29,DIRECT
##- SRC-IP-CIDR,192.168.*.*/32,DIRECT

##IP段：192.168.*.*-192.168.*.* 直连
##- SRC-IP-CIDR,192.168.*.*/31,DIRECT
##- SRC-IP-CIDR,192.168.*.*/30,DIRECT
##- SRC-IP-CIDR,192.168.*.*/28,DIRECT
##- SRC-IP-CIDR,192.168.*.*/27,DIRECT

##此时IP为192.168.*.*和192.168.*.*的客户端流量走代理（策略），其余客户端不走代理
##因为Fake-IP模式下，IP地址为192.168.*.*的路由器自身流量可走代理（策略），所以需要排除

##仅设置路由器自身直连：
##- SRC-IP-CIDR,192.168.*.*/32,DIRECT
##- SRC-IP-CIDR,198.18.*.*/32,DIRECT

##DDNS
##- DOMAIN-KEYWORD,synology,DIRECT
##- DOMAIN-KEYWORD,quickconnect,DIRECT
##- DOMAIN-SUFFIX,checkip.dyndns.org,DIRECT
##- DOMAIN-SUFFIX,checkipv6.dyndns.org,DIRECT
##- DOMAIN-SUFFIX,checkip.synology.com,DIRECT
##- DOMAIN-SUFFIX,ifconfig.co,DIRECT
##- DOMAIN-SUFFIX,api.myip.com,DIRECT
##- DOMAIN-SUFFIX,ip-api.com,DIRECT
##- DOMAIN-SUFFIX,ipapi.co,DIRECT
##- DOMAIN-SUFFIX,ip6.seeip.org,DIRECT
##- DOMAIN-SUFFIX,members.3322.org,DIRECT

##在线IP段转CIDR地址：http://ip2cidr.com
#===================== 自定义规则 二 =====================#
rules:
##- DOMAIN-SUFFIX,google.com,Proxy #匹配域名后缀(交由Proxy代理服务器组)
##- DOMAIN-KEYWORD,google,Proxy #匹配域名关键字(交由Proxy代理服务器组)
##- DOMAIN,google.com,Proxy #匹配域名(交由Proxy代理服务器组)
##- DOMAIN-SUFFIX,ad.com,REJECT #匹配域名后缀(拒绝)
##- IP-CIDR,127.0.*.*/8,DIRECT #匹配数据目标IP(直连)
##- SRC-IP-CIDR,192.168.*.*/32,DIRECT #匹配数据发起IP(直连)
##- DST-PORT,80,DIRECT #匹配数据目标端口(直连)
##- SRC-PORT,7777,DIRECT #匹配数据源端口(直连)

#===================== 配置文件 =====================#

port: 7890
socks-port: 7891
allow-lan: true
mode: rule
log-level: info
external-controller: 0.0.*.*:9090
proxy-groups:
- name: "\U0001F680 节点选择"
  type: select
  proxies:
  - "\U0001F1ED\U0001F1F0 香港节点"
  - "\U0001F1FA\U0001F1F8 美国节点"
  - "\U0001F1EF\U0001F1F5 日本节点"
  - "\U0001F1F8\U0001F1EC 新加坡节点"
  - "\U0001F1F9\U0001F1FC 台湾节点"
  - "\U0001F1F0\U0001F1F7 韩国节点"
  - "\U0001F1E8\U0001F1E6 加拿大节点"
  - "\U0001F1EC\U0001F1E7 英国节点"
  - "\U0001F1EB\U0001F1F7 法国节点"
  - "\U0001F1E9\U0001F1EA 德国节点"
  - "\U0001F1F3\U0001F1F1 荷兰节点"
  - "\U0001F1F9\U0001F1F7 土耳其节点"
  - "\U0001F1FB\U0001F1F3 越南节点"
  - "♻️ 自动选择"
  - "\U0001F680 手动切换"
- name: "\U0001F680 手动切换"
  type: select
  proxies:
  - '您当前的套餐将持续到: 2025-07-07'
rules:
- DOMAIN-SUFFIX,szsandstone.com,DIRECT
- IP-CIDR,20.20.*.*/24,DIRECT
- IP-CIDR,20.20.*.*/24,DIRECT
- IP-CIDR,20.20.*.*/24,DIRECT
- IP-CIDR,20.20.*.*/24,DIRECT
- IP-CIDR,20.20.*.*/24,DIRECT
- IP-CIDR,20.20.*.*/24,DIRECT
- IP-CIDR,20.20.*.*/24,DIRECT
- IP-CIDR,20.20.*.*/24,DIRECT
- IP-CIDR,20.20.*.*/24,DIRECT
- DOMAIN-KEYWORD,nlark.com,DIRECT
- DOMAIN-KEYWORD,staticfile.org,DIRECT
- GEOSITE,category-public-tracker,DIRECT
- ...此处忽略一系列的规则
- MATCH,DIRECT
dns:
  enable: true
  ipv6: false
  enhanced-mode: fake-ip
  fake-ip-range: 198.18.*.*/16
  listen: 0.0.*.*:7874
  fake-ip-filter-mode: blacklist
  direct-nameserver:
  - 10.10.*.*
  nameserver:
  - 211.137.*.*
  - 223.5.*.*
  - 10.30.*.*
  - 10.10.*.*
  fake-ip-filter:
  - "*.lan"
  - "*.localdomain"
  - "*.example"
  - "*.invalid"
  - "*.localhost"
  - "*.test"
  - "*.local"
  - "*.home.arpa"
  - time.*.com
  - time.*.gov
  - time.*.edu.cn
  - time.*.apple.com
  - time-ios.apple.com
  - time1.*.com
  - time2.*.com
  - time3.*.com
  - time4.*.com
  - time5.*.com
  - time6.*.com
  - time7.*.com
  - ntp.*.com
  - ntp1.*.com
  - ntp2.*.com
  - ntp3.*.com
  - ntp4.*.com
  - ntp5.*.com
  - ntp6.*.com
  - ntp7.*.com
  - "*.time.edu.cn"
  - "*.ntp.org.cn"
  - "+.pool.ntp.org"
  - time1.cloud.tencent.com
  - music.163.com
  - "*.music.163.com"
  - "*.126.net"
  - musicapi.taihe.com
  - music.taihe.com
  - songsearch.kugou.com
  - trackercdn.kugou.com
  - "*.kuwo.cn"
  - api-jooxtt.sanook.com
  - api.joox.com
  - joox.com
  - y.qq.com
  - "*.y.qq.com"
  - streamoc.music.tc.qq.com
  - mobileoc.music.tc.qq.com
  - isure.stream.qqmusic.qq.com
  - dl.stream.qqmusic.qq.com
  - aqqmusic.tc.qq.com
  - amobile.music.tc.qq.com
  - "*.xiami.com"
  - "*.music.migu.cn"
  - music.migu.cn
  - "+.msftconnecttest.com"
  - "+.msftncsi.com"
  - localhost.ptlogin2.qq.com
  - localhost.sec.qq.com
  - "+.qq.com"
  - "+.tencent.com"
  - "+.srv.nintendo.net"
  - "*.n.n.srv.nintendo.net"
  - "+.cdn.nintendo.net"
  - "+.stun.playstation.net"
  - xbox.*.*.microsoft.com
  - "*.*.xboxlive.com"
  - xbox.*.microsoft.com
  - xnotify.xboxlive.com
  - "+.battlenet.com.cn"
  - "+.wotgame.cn"
  - "+.wggames.cn"
  - "+.wowsgame.cn"
  - "+.wargaming.net"
  - proxy.golang.org
  - stun.*.*
  - stun.*.*.*
  - "+.stun.*.*"
  - "+.stun.*.*.*"
  - "+.stun.*.*.*.*"
  - "+.stun.*.*.*.*.*"
  - heartbeat.belkin.com
  - "*.linksys.com"
  - "*.linksyssmartwifi.com"
  - "*.router.asus.com"
  - mesu.apple.com
  - swscan.apple.com
  - swquery.apple.com
  - swdownload.apple.com
  - swcdn.apple.com
  - swdist.apple.com
  - lens.l.google.com
  - stun.l.google.com
  - na.b.g-tun.com
  - "+.nflxvideo.net"
  - "*.square-enix.com"
  - "*.finalfantasyxiv.com"
  - "*.ffxiv.com"
  - "*.ff14.sdo.com"
  - ff.dorado.sdo.com
  - "*.mcdn.bilivideo.cn"
  - "+.media.dssott.com"
  - shark007.net
  - Mijia Cloud
  - "+.cmbchina.com"
  - "+.cmbimg.com"
  - local.adguard.org
  - "+.sandai.net"
  - "+.n0808.com"
  - "+.uu.163.com"
  - ps.res.netease.com
  - "+.pub.3gppnetwork.org"
  - geosite:category-games
  - "+.szsandstone.com"
  - "+.services.googleapis.cn"
  - "+.googleapis.cn"
  - "+.xn--ngstr-lra8j.com"
  - "+.clientservices.googleapis.com"
  - geosite:cn
redir-port: 7892
tproxy-port: 7895
mixed-port: 7893
bind-address: "*"
external-ui: "/usr/share/openclash/ui"
keep-alive-interval: 15
keep-alive-idle: 600
ipv6: false
geodata-loader: standard
tcp-concurrent: true
unified-delay: true
sniffer:
  enable: true
  parse-pure-ip: true
  force-dns-mapping: true
  override-destination: false
  sniff:
    QUIC:
      ports:
      - 443
    TLS:
      ports:
      - 443
      - 8443
    HTTP:
      ports:
      - 80
      - 8080-8880
      override-destination: true
  force-domain:
  - "+.netflix.com"
  - "+.nflxvideo.net"
  - "+.amazonaws.com"
  - "+.media.dssott.com"
  skip-domain:
  - "+.apple.com"
  - Mijia Cloud
  - dlg.io.mi.com
  - "+.push.apple.com"
profile:
  store-selected: true

#===================== 自定义覆写设置 =====================#

#!/bin/sh
. /usr/share/openclash/ruby.sh
. /usr/share/openclash/log.sh
. /lib/functions.sh

# This script is called by /etc/init.d/openclash
# Add your custom overwrite scripts here, they will be take effict after the OpenClash own srcipts

LOG_OUT "Tip: Start Running Custom Overwrite Scripts..."
LOGTIME=$(echo $(date "+%Y-%m-%d %H:%M:%S"))
LOG_FILE="/tmp/openclash.log"
#Config Path
CONFIG_FILE="$1"

    #Simple Demo:
    #Key Overwrite Demo
    #1--config path
    #2--key name
    #3--value
    #ruby_edit "$CONFIG_FILE" "['redir-port']" "7892"
    #ruby_edit "$CONFIG_FILE" "['secret']" "123456"
    #ruby_edit "$CONFIG_FILE" "['dns']['enable']" "true"
    #ruby_edit "$CONFIG_FILE" "['dns']['proxy-server-nameserver']" "['https://doh.pub/dns-query','https://223.5.*.*:443/dns-query']"

    #Hash Overwrite Demo
    #1--config path
    #2--key name
    #3--hash type value
    #ruby_edit "$CONFIG_FILE" "['dns']['nameserver-policy']" "{'+.msftconnecttest.com'=>'114.114.*.*', '+.msftncsi.com'=>'114.114.*.*', 'geosite:gfw'=>['https://dns.cloudflare.com/dns-query', 'https://dns.google/dns-query#ecs=1.1.*.*/24&ecs-override=true'], 'geosite:cn'=>['114.114.*.*'], 'geosite:geolocation-!cn'=>['https://dns.cloudflare.com/dns-query', 'https://dns.google/dns-query#ecs=1.1.*.*/24&ecs-override=true']}"
    #ruby_edit "$CONFIG_FILE" "['sniffer']" "{'enable'=>true, 'parse-pure-ip'=>true, 'force-domain'=>['+.netflix.com', '+.nflxvideo.net', '+.amazonaws.com', '+.media.dssott.com'], 'skip-domain'=>['+.apple.com', 'Mijia Cloud', 'dlg.io.mi.com', '+.oray.com', '+.sunlogin.net'], 'sniff'=>{'TLS'=>false, 'HTTP'=>{'ports'=>[80, '8080-8880'], 'override-destination'=>true}}}"

    #Hash Merge Demo
    #1--config path
    #2--key name
    #3--hash
    #ruby_merge_hash "$CONFIG_FILE" "['proxy-providers']" "'TW'=>{'type'=>'http', 'path'=>'./proxy_provider/TW.yaml', 'url'=>'https://gist.githubusercontent.com/raw/tw_clash', 'interval'=>3600, 'health-check'=>{'enable'=>true, 'url'=>'http://cp.cloudflare.com/generate_204', 'interval'=>300}}"
    #ruby_merge_hash "$CONFIG_FILE" "['rule-providers']" "'Reject'=>{'type'=>'http', 'behavior'=>'classical', 'url'=>'https://testingcf.jsdelivr.net/gh/dler-io/Rules@main/Clash/Provider/Reject.yaml', 'path'=>'./rule_provider/Reject', 'interval'=>86400}"

    #Array Insert Value Demo:
    #1--config path
    #2--key name
    #3--position(start from 0, end with -1)
    #4--value
    #ruby_arr_insert "$CONFIG_FILE" "['dns']['nameserver']" "0" "114.114.*.*"

    #Array Insert Hash Demo:
    #1--config path
    #2--key name
    #3--position(start from 0, end with -1)
    #4--hash
    #ruby_arr_insert_hash "$CONFIG_FILE" "['proxy-groups']" "0" "{'name'=>'Disney', 'type'=>'select', 'disable-udp'=>false, 'use'=>['TW', 'SG', 'HK']}"
    #ruby_arr_insert_hash "$CONFIG_FILE" "['proxies']" "0" "{'name'=>'HKG 01', 'type'=>'ss', 'server'=>'cc.hd.abc', 'port'=>'12345', 'cipher'=>'aes-128-gcm', 'password'=>'123456', 'udp'=>true, 'plugin'=>'obfs', 'plugin-opts'=>{'mode'=>'http', 'host'=>'microsoft.com'}}"
    #ruby_arr_insert_hash "$CONFIG_FILE" "['listeners']" "0" "{'name'=>'name', 'type'=>'shadowsocks', 'port'=>'12345', 'listen'=>'0.0.*.*', 'rule'=>'sub-rule-1', 'proxy'=>'proxy'}"

    #Array Insert Other Array Demo:
    #1--config path
    #2--key name
    #3--position(start from 0, end with -1)
    #4--array
    #ruby_arr_insert_arr "$CONFIG_FILE" "['dns']['proxy-server-nameserver']" "0" "['https://doh.pub/dns-query','https://223.5.*.*:443/dns-query']"

    #Array Insert From Yaml File Demo:
    #1--config path
    #2--key name
    #3--position(start from 0, end with -1)
    #4--value file path
    #5--value key name in #4 file
    #ruby_arr_add_file "$CONFIG_FILE" "['dns']['fallback-filter']['ipcidr']" "0" "/etc/openclash/custom/openclash_custom_fallback_filter.yaml" "['fallback-filter']['ipcidr']"

    #Delete Array Value Demo:
    #1--config path
    #2--key name
    #3--value
    #ruby_delete "$CONFIG_FILE" "['dns']['nameserver']" "114.114.*.*"

    #Delete Key Demo:
    #1--config path
    #2--key name
    #3--key name
    #ruby_delete "$CONFIG_FILE" "['dns']" "nameserver"
    #ruby_delete "$CONFIG_FILE" "" "dns"

    #Ruby Script Demo:
    #ruby -ryaml -rYAML -I "/usr/share/openclash" -E UTF-8 -e "
    #   begin
    #      Value = YAML.load_file('$CONFIG_FILE');
    #   rescue Exception => e
    #      puts '${LOGTIME} Error: Load File Failed,【' + e.message + '】';
    #   end;

        #General
    #   begin
    #   Thread.new{
    #      Value['redir-port']=7892;
    #      Value['tproxy-port']=7895;
    #      Value['port']=7890;
    #      Value['socks-port']=7891;
    #      Value['mixed-port']=7893;
    #   }.join;

    #   rescue Exception => e
    #      puts '${LOGTIME} Error: Set General Failed,【' + e.message + '】';
    #   ensure
    #      File.open('$CONFIG_FILE','w') {|f| YAML.dump(Value, f)};
    #   end" 2>/dev/null >> $LOG_FILE

exit 0
#===================== 自定义防火墙设置 =====================#

#!/bin/sh
. /usr/share/openclash/log.sh
. /lib/functions.sh

# This script is called by /etc/init.d/openclash
# Add your custom firewall rules here, they will be added after the end of the OpenClash iptables rules

LOG_OUT "Tip: Start Add Custom Firewall Rules..."


exit 0
#===================== IPTABLES 防火墙设置 =====================#

#IPv4 NAT chain

# Generated by iptables-save v1.8.7 on Wed Feb 12 16:26:58 2025
*nat
:PREROUTING ACCEPT [2091:393550]
:INPUT ACCEPT [1585:263877]
:OUTPUT ACCEPT [3182:225475]
:POSTROUTING ACCEPT [3292:231956]
:MINIUPNPD - [0:0]
:MINIUPNPD-POSTROUTING - [0:0]
:openclash - [0:0]
:openclash_output - [0:0]
:openclash_post - [0:0]
:postrouting_docker_rule - [0:0]
:postrouting_lan_rule - [0:0]
:postrouting_rule - [0:0]
:postrouting_wan_rule - [0:0]
:prerouting_docker_rule - [0:0]
:prerouting_lan_rule - [0:0]
:prerouting_rule - [0:0]
:prerouting_wan_rule - [0:0]
:zone_docker_postrouting - [0:0]
:zone_docker_prerouting - [0:0]
:zone_lan_postrouting - [0:0]
:zone_lan_prerouting - [0:0]
:zone_wan_postrouting - [0:0]
:zone_wan_prerouting - [0:0]
-A PREROUTING -p tcp -m tcp --dport 53 -m comment --comment "OpenClash DNS Hijack" -j REDIRECT --to-ports 53
-A PREROUTING -p udp -m udp --dport 53 -m comment --comment "OpenClash DNS Hijack" -j REDIRECT --to-ports 53
-A PREROUTING -m comment --comment "!fw3: Custom prerouting rule chain" -j prerouting_rule
-A PREROUTING -i br-lan -m comment --comment "!fw3" -j zone_lan_prerouting
-A PREROUTING -i docker0 -m comment --comment "!fw3" -j zone_docker_prerouting
-A PREROUTING -p tcp -j openclash
-A OUTPUT -d 127.0.*.*/32 -p udp -m owner ! --uid-owner 65534 -m comment --comment "OpenClash DNS Hijack" -m udp --dport 53 -j REDIRECT --to-ports 53
-A OUTPUT -d 127.0.*.*/32 -p tcp -m owner ! --uid-owner 65534 -m comment --comment "OpenClash DNS Hijack" -m tcp --dport 53 -j REDIRECT --to-ports 53
-A OUTPUT -j openclash_output
-A POSTROUTING -m comment --comment "!fw3: Custom postrouting rule chain" -j postrouting_rule
-A POSTROUTING -o br-lan -m comment --comment "!fw3" -j zone_lan_postrouting
-A POSTROUTING -o docker0 -m comment --comment "!fw3" -j zone_docker_postrouting
-A POSTROUTING -m comment --comment "OpenClash Bypass Gateway Compatible" -j openclash_post
-A openclash -p tcp -m tcp --sport 8897 -j RETURN
-A openclash -m set --match-set localnetwork dst -j RETURN
-A openclash -d 198.18.*.*/16 -p tcp -j REDIRECT --to-ports 7892
-A openclash -m set --match-set china_ip_route dst -m set ! --match-set china_ip_route_pass dst -j RETURN
-A openclash -p tcp -j REDIRECT --to-ports 7892
-A openclash_output -p tcp -m tcp --sport 8897 -j RETURN
-A openclash_output -d 198.18.*.*/16 -p tcp -m owner ! --uid-owner 65534 -j REDIRECT --to-ports 7892
-A openclash_output -m set --match-set localnetwork dst -j RETURN
-A openclash_output -m owner ! --uid-owner 65534 -m set --match-set china_ip_route dst -m set ! --match-set china_ip_route_pass dst -j RETURN
-A openclash_output -p tcp -m owner ! --uid-owner 65534 -j REDIRECT --to-ports 7892
-A openclash_post -m mark --mark 0x162 -j ACCEPT
-A openclash_post -m set --match-set localnetwork dst -j RETURN
-A openclash_post -m addrtype ! --src-type LOCAL -m owner ! --uid-owner 65534 -j MASQUERADE
-A zone_docker_postrouting -m comment --comment "!fw3: Custom docker postrouting rule chain" -j postrouting_docker_rule
-A zone_docker_prerouting -m comment --comment "!fw3: Custom docker prerouting rule chain" -j prerouting_docker_rule
-A zone_lan_postrouting -m comment --comment "!fw3: Custom lan postrouting rule chain" -j postrouting_lan_rule
-A zone_lan_postrouting -j MINIUPNPD-POSTROUTING
-A zone_lan_postrouting -i docker0 -m comment --comment "!fw3: DockerNAT" -j MASQUERADE
-A zone_lan_prerouting -m comment --comment "!fw3: Custom lan prerouting rule chain" -j prerouting_lan_rule
-A zone_lan_prerouting -j MINIUPNPD
-A zone_wan_postrouting -m comment --comment "!fw3: Custom wan postrouting rule chain" -j postrouting_wan_rule
-A zone_wan_postrouting -m comment --comment "!fw3" -j FULLCONENAT
-A zone_wan_prerouting -m comment --comment "!fw3: Custom wan prerouting rule chain" -j prerouting_wan_rule
-A zone_wan_prerouting -m comment --comment "!fw3" -j FULLCONENAT
COMMIT
# Completed on Wed Feb 12 16:26:58 2025

#IPv4 Mangle chain

# Generated by iptables-save v1.8.7 on Wed Feb 12 16:26:58 2025
*mangle
:PREROUTING ACCEPT [603459:71389493]
:INPUT ACCEPT [63637:32961242]
:FORWARD ACCEPT [539431:38482035]
:OUTPUT ACCEPT [36866:29983147]
:POSTROUTING ACCEPT [575817:68417510]
:openclash - [0:0]
:openclash_output - [0:0]
:openclash_upnp - [0:0]
-A PREROUTING -p udp -j openclash
-A OUTPUT -p udp -j openclash_output
-A openclash -p udp -m udp --sport 500 -j RETURN
-A openclash -p udp -m udp --sport 68 -j RETURN
-A openclash -i lo -j RETURN
-A openclash -m set --match-set localnetwork dst -j RETURN
-A openclash -p udp -m udp --dport 53 -j RETURN
-A openclash -d 198.18.*.*/16 -p udp -j TPROXY --on-port 7895 --on-ip 0.0.*.* --tproxy-mark 0x162/0xffffffff
-A openclash -m set --match-set china_ip_route dst -m set ! --match-set china_ip_route_pass dst -j RETURN
-A openclash -p udp -j openclash_upnp
-A openclash -p udp -j TPROXY --on-port 7895 --on-ip 0.0.*.* --tproxy-mark 0x162/0xffffffff
-A openclash_output -p udp -m udp --sport 500 -j RETURN
-A openclash_output -p udp -m udp --sport 68 -j RETURN
-A openclash_output -d 198.18.*.*/16 -p udp -m owner ! --uid-owner 65534 -j MARK --set-xmark 0x162/0xffffffff
COMMIT
# Completed on Wed Feb 12 16:26:58 2025

#IPv4 Filter chain

# Generated by iptables-save v1.8.7 on Wed Feb 12 16:26:58 2025
*filter
:INPUT ACCEPT [17:680]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [0:0]
:MINIUPNPD - [0:0]
:forwarding_docker_rule - [0:0]
:forwarding_lan_rule - [0:0]
:forwarding_rule - [0:0]
:forwarding_wan_rule - [0:0]
:input_docker_rule - [0:0]
:input_lan_rule - [0:0]
:input_rule - [0:0]
:input_wan_rule - [0:0]
:output_docker_rule - [0:0]
:output_lan_rule - [0:0]
:output_rule - [0:0]
:output_wan_rule - [0:0]
:reject - [0:0]
:syn_flood - [0:0]
:zone_docker_dest_ACCEPT - [0:0]
:zone_docker_forward - [0:0]
:zone_docker_input - [0:0]
:zone_docker_output - [0:0]
:zone_docker_src_ACCEPT - [0:0]
:zone_lan_dest_ACCEPT - [0:0]
:zone_lan_forward - [0:0]
:zone_lan_input - [0:0]
:zone_lan_output - [0:0]
:zone_lan_src_ACCEPT - [0:0]
:zone_wan_dest_ACCEPT - [0:0]
:zone_wan_dest_REJECT - [0:0]
:zone_wan_forward - [0:0]
:zone_wan_input - [0:0]
:zone_wan_output - [0:0]
:zone_wan_src_REJECT - [0:0]
-A INPUT -p udp -m udp --dport 443 -m comment --comment "OpenClash QUIC REJECT" -m set ! --match-set china_ip_route dst -j REJECT --reject-with icmp-port-unreachable
-A INPUT -i lo -m comment --comment "!fw3" -j ACCEPT
-A INPUT -m comment --comment "!fw3: Custom input rule chain" -j input_rule
-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment "!fw3" -j ACCEPT
-A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -m comment --comment "!fw3" -j syn_flood
-A INPUT -i br-lan -m comment --comment "!fw3" -j zone_lan_input
-A INPUT -i docker0 -m comment --comment "!fw3" -j zone_docker_input
-A FORWARD -m comment --comment "!fw3: Custom forwarding rule chain" -j forwarding_rule
-A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment "!fw3" -j ACCEPT
-A FORWARD -i br-lan -m comment --comment "!fw3" -j zone_lan_forward
-A FORWARD -i docker0 -m comment --comment "!fw3" -j zone_docker_forward
-A FORWARD -m comment --comment "!fw3" -j reject
-A OUTPUT -o lo -m comment --comment "!fw3" -j ACCEPT
-A OUTPUT -m comment --comment "!fw3: Custom output rule chain" -j output_rule
-A OUTPUT -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment "!fw3" -j ACCEPT
-A OUTPUT -o br-lan -m comment --comment "!fw3" -j zone_lan_output
-A OUTPUT -o docker0 -m comment --comment "!fw3" -j zone_docker_output
-A reject -p tcp -m comment --comment "!fw3" -j REJECT --reject-with tcp-reset
-A reject -m comment --comment "!fw3" -j REJECT --reject-with icmp-port-unreachable
-A syn_flood -m limit --limit 25/sec --limit-burst 50 -m comment --comment "!fw3" -j RETURN
-A syn_flood -m comment --comment "!fw3" -j DROP
-A zone_docker_dest_ACCEPT -o docker0 -m comment --comment "!fw3" -j ACCEPT
-A zone_docker_forward -m comment --comment "!fw3: Custom docker forwarding rule chain" -j forwarding_docker_rule
-A zone_docker_forward -m comment --comment "!fw3: Zone docker to wan forwarding policy" -j zone_wan_dest_ACCEPT
-A zone_docker_forward -m comment --comment "!fw3: Zone docker to lan forwarding policy" -j zone_lan_dest_ACCEPT
-A zone_docker_forward -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port forwards" -j ACCEPT
-A zone_docker_forward -m comment --comment "!fw3" -j zone_docker_dest_ACCEPT
-A zone_docker_input -m comment --comment "!fw3: Custom docker input rule chain" -j input_docker_rule
-A zone_docker_input -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port redirections" -j ACCEPT
-A zone_docker_input -m comment --comment "!fw3" -j zone_docker_src_ACCEPT
-A zone_docker_output -m comment --comment "!fw3: Custom docker output rule chain" -j output_docker_rule
-A zone_docker_output -m comment --comment "!fw3" -j zone_docker_dest_ACCEPT
-A zone_docker_src_ACCEPT -i docker0 -m conntrack --ctstate NEW,UNTRACKED -m comment --comment "!fw3" -j ACCEPT
-A zone_lan_dest_ACCEPT -o br-lan -m comment --comment "!fw3" -j ACCEPT
-A zone_lan_forward -m comment --comment "!fw3: Custom lan forwarding rule chain" -j forwarding_lan_rule
-A zone_lan_forward -m comment --comment "!fw3: Zone lan to wan forwarding policy" -j zone_wan_dest_ACCEPT
-A zone_lan_forward -m comment --comment "!fw3: Zone lan to docker forwarding policy" -j zone_docker_dest_ACCEPT
-A zone_lan_forward -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port forwards" -j ACCEPT
-A zone_lan_forward -j MINIUPNPD
-A zone_lan_forward -m comment --comment "!fw3" -j zone_lan_dest_ACCEPT
-A zone_lan_input -m comment --comment "!fw3: Custom lan input rule chain" -j input_lan_rule
-A zone_lan_input -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port redirections" -j ACCEPT
-A zone_lan_input -j MINIUPNPD
-A zone_lan_input -m comment --comment "!fw3" -j zone_lan_src_ACCEPT
-A zone_lan_output -m comment --comment "!fw3: Custom lan output rule chain" -j output_lan_rule
-A zone_lan_output -m comment --comment "!fw3" -j zone_lan_dest_ACCEPT
-A zone_lan_src_ACCEPT -i br-lan -m conntrack --ctstate NEW,UNTRACKED -m comment --comment "!fw3" -j ACCEPT
-A zone_wan_forward -m comment --comment "!fw3: Custom wan forwarding rule chain" -j forwarding_wan_rule
-A zone_wan_forward -p esp -m comment --comment "!fw3: Allow-IPSec-ESP" -j zone_lan_dest_ACCEPT
-A zone_wan_forward -p udp -m udp --dport 500 -m comment --comment "!fw3: Allow-ISAKMP" -j zone_lan_dest_ACCEPT
-A zone_wan_forward -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port forwards" -j ACCEPT
-A zone_wan_forward -m comment --comment "!fw3" -j zone_wan_dest_REJECT
-A zone_wan_input -m comment --comment "!fw3: Custom wan input rule chain" -j input_wan_rule
-A zone_wan_input -p udp -m udp --dport 68 -m comment --comment "!fw3: Allow-DHCP-Renew" -j ACCEPT
-A zone_wan_input -p icmp -m icmp --icmp-type 8 -m comment --comment "!fw3: Allow-Ping" -j ACCEPT
-A zone_wan_input -p igmp -m comment --comment "!fw3: Allow-IGMP" -j ACCEPT
-A zone_wan_input -p tcp -m tcp --dport 8897 -m comment --comment "!fw3: linkease" -j ACCEPT
-A zone_wan_input -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port redirections" -j ACCEPT
-A zone_wan_input -m comment --comment "!fw3" -j zone_wan_src_REJECT
-A zone_wan_output -m comment --comment "!fw3: Custom wan output rule chain" -j output_wan_rule
-A zone_wan_output -m comment --comment "!fw3" -j zone_wan_dest_ACCEPT
COMMIT
# Completed on Wed Feb 12 16:26:58 2025

#IPv6 NAT chain

# Generated by ip6tables-save v1.8.7 on Wed Feb 12 16:26:58 2025
*nat
:PREROUTING ACCEPT [585038:86874805]
:INPUT ACCEPT [430868:66110572]
:OUTPUT ACCEPT [138681:16552396]
:POSTROUTING ACCEPT [138681:16552396]
COMMIT
# Completed on Wed Feb 12 16:26:58 2025

#IPv6 Mangle chain

# Generated by ip6tables-save v1.8.7 on Wed Feb 12 16:26:58 2025
*mangle
:PREROUTING ACCEPT [3123947:465550776]
:INPUT ACCEPT [2325701:396153685]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [354949:108385448]
:POSTROUTING ACCEPT [376231:110675300]
COMMIT
# Completed on Wed Feb 12 16:26:58 2025

#IPv6 Filter chain

# Generated by ip6tables-save v1.8.7 on Wed Feb 12 16:26:58 2025
*filter
:INPUT ACCEPT [90:27714]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [67:15869]
:MINIUPNPD - [0:0]
:forwarding_docker_rule - [0:0]
:forwarding_lan_rule - [0:0]
:forwarding_rule - [0:0]
:forwarding_wan_rule - [0:0]
:input_docker_rule - [0:0]
:input_lan_rule - [0:0]
:input_rule - [0:0]
:input_wan_rule - [0:0]
:output_docker_rule - [0:0]
:output_lan_rule - [0:0]
:output_rule - [0:0]
:output_wan_rule - [0:0]
:reject - [0:0]
:syn_flood - [0:0]
:zone_docker_dest_ACCEPT - [0:0]
:zone_docker_forward - [0:0]
:zone_docker_input - [0:0]
:zone_docker_output - [0:0]
:zone_docker_src_ACCEPT - [0:0]
:zone_lan_dest_ACCEPT - [0:0]
:zone_lan_forward - [0:0]
:zone_lan_input - [0:0]
:zone_lan_output - [0:0]
:zone_lan_src_ACCEPT - [0:0]
:zone_wan_dest_ACCEPT - [0:0]
:zone_wan_dest_REJECT - [0:0]
:zone_wan_forward - [0:0]
:zone_wan_input - [0:0]
:zone_wan_output - [0:0]
:zone_wan_src_REJECT - [0:0]
-A INPUT -i lo -m comment --comment "!fw3" -j ACCEPT
-A INPUT -m comment --comment "!fw3: Custom input rule chain" -j input_rule
-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment "!fw3" -j ACCEPT
-A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -m comment --comment "!fw3" -j syn_flood
-A INPUT -i br-lan -m comment --comment "!fw3" -j zone_lan_input
-A INPUT -i docker0 -m comment --comment "!fw3" -j zone_docker_input
-A FORWARD -m comment --comment "!fw3: Custom forwarding rule chain" -j forwarding_rule
-A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment "!fw3" -j ACCEPT
-A FORWARD -i br-lan -m comment --comment "!fw3" -j zone_lan_forward
-A FORWARD -i docker0 -m comment --comment "!fw3" -j zone_docker_forward
-A FORWARD -m comment --comment "!fw3" -j reject
-A OUTPUT -o lo -m comment --comment "!fw3" -j ACCEPT
-A OUTPUT -m comment --comment "!fw3: Custom output rule chain" -j output_rule
-A OUTPUT -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment "!fw3" -j ACCEPT
-A OUTPUT -o br-lan -m comment --comment "!fw3" -j zone_lan_output
-A OUTPUT -o docker0 -m comment --comment "!fw3" -j zone_docker_output
-A reject -p tcp -m comment --comment "!fw3" -j REJECT --reject-with tcp-reset
-A reject -m comment --comment "!fw3" -j REJECT --reject-with icmp6-port-unreachable
-A syn_flood -m limit --limit 25/sec --limit-burst 50 -m comment --comment "!fw3" -j RETURN
-A syn_flood -m comment --comment "!fw3" -j DROP
-A zone_docker_dest_ACCEPT -o docker0 -m comment --comment "!fw3" -j ACCEPT
-A zone_docker_forward -m comment --comment "!fw3: Custom docker forwarding rule chain" -j forwarding_docker_rule
-A zone_docker_forward -m comment --comment "!fw3: Zone docker to wan forwarding policy" -j zone_wan_dest_ACCEPT
-A zone_docker_forward -m comment --comment "!fw3: Zone docker to lan forwarding policy" -j zone_lan_dest_ACCEPT
-A zone_docker_forward -m comment --comment "!fw3" -j zone_docker_dest_ACCEPT
-A zone_docker_input -m comment --comment "!fw3: Custom docker input rule chain" -j input_docker_rule
-A zone_docker_input -m comment --comment "!fw3" -j zone_docker_src_ACCEPT
-A zone_docker_output -m comment --comment "!fw3: Custom docker output rule chain" -j output_docker_rule
-A zone_docker_output -m comment --comment "!fw3" -j zone_docker_dest_ACCEPT
-A zone_docker_src_ACCEPT -i docker0 -m conntrack --ctstate NEW,UNTRACKED -m comment --comment "!fw3" -j ACCEPT
-A zone_lan_dest_ACCEPT -o br-lan -m comment --comment "!fw3" -j ACCEPT
-A zone_lan_forward -m comment --comment "!fw3: Custom lan forwarding rule chain" -j forwarding_lan_rule
-A zone_lan_forward -m comment --comment "!fw3: Zone lan to wan forwarding policy" -j zone_wan_dest_ACCEPT
-A zone_lan_forward -m comment --comment "!fw3: Zone lan to docker forwarding policy" -j zone_docker_dest_ACCEPT
-A zone_lan_forward -j MINIUPNPD
-A zone_lan_forward -m comment --comment "!fw3" -j zone_lan_dest_ACCEPT
-A zone_lan_input -m comment --comment "!fw3: Custom lan input rule chain" -j input_lan_rule
-A zone_lan_input -j MINIUPNPD
-A zone_lan_input -m comment --comment "!fw3" -j zone_lan_src_ACCEPT
-A zone_lan_output -m comment --comment "!fw3: Custom lan output rule chain" -j output_lan_rule
-A zone_lan_output -m comment --comment "!fw3" -j zone_lan_dest_ACCEPT
-A zone_lan_src_ACCEPT -i br-lan -m conntrack --ctstate NEW,UNTRACKED -m comment --comment "!fw3" -j ACCEPT
-A zone_wan_forward -m comment --comment "!fw3: Custom wan forwarding rule chain" -j forwarding_wan_rule
-A zone_wan_forward -p ipv6-icmp -m icmp6 --icmpv6-type 128 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Forward" -j ACCEPT
-A zone_wan_forward -p ipv6-icmp -m icmp6 --icmpv6-type 129 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Forward" -j ACCEPT
-A zone_wan_forward -p ipv6-icmp -m icmp6 --icmpv6-type 1 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Forward" -j ACCEPT
-A zone_wan_forward -p ipv6-icmp -m icmp6 --icmpv6-type 2 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Forward" -j ACCEPT
-A zone_wan_forward -p ipv6-icmp -m icmp6 --icmpv6-type 3 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Forward" -j ACCEPT
-A zone_wan_forward -p ipv6-icmp -m icmp6 --icmpv6-type 4/0 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Forward" -j ACCEPT
-A zone_wan_forward -p ipv6-icmp -m icmp6 --icmpv6-type 4/1 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Forward" -j ACCEPT
-A zone_wan_forward -p esp -m comment --comment "!fw3: Allow-IPSec-ESP" -j zone_lan_dest_ACCEPT
-A zone_wan_forward -p udp -m udp --dport 500 -m comment --comment "!fw3: Allow-ISAKMP" -j zone_lan_dest_ACCEPT
-A zone_wan_forward -m comment --comment "!fw3" -j zone_wan_dest_REJECT
-A zone_wan_input -m comment --comment "!fw3: Custom wan input rule chain" -j input_wan_rule
-A zone_wan_input -p udp -m udp --dport 546 -m comment --comment "!fw3: Allow-DHCPv6" -j ACCEPT
-A zone_wan_input -s fe80::/10 -p ipv6-icmp -m icmp6 --icmpv6-type 130/0 -m comment --comment "!fw3: Allow-MLD" -j ACCEPT
-A zone_wan_input -s fe80::/10 -p ipv6-icmp -m icmp6 --icmpv6-type 131/0 -m comment --comment "!fw3: Allow-MLD" -j ACCEPT
-A zone_wan_input -s fe80::/10 -p ipv6-icmp -m icmp6 --icmpv6-type 132/0 -m comment --comment "!fw3: Allow-MLD" -j ACCEPT
-A zone_wan_input -s fe80::/10 -p ipv6-icmp -m icmp6 --icmpv6-type 143/0 -m comment --comment "!fw3: Allow-MLD" -j ACCEPT
-A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 128 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT
-A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 129 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT
-A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 1 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT
-A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 2 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT
-A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 3 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT
-A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 4/0 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT
-A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 4/1 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT
-A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 133 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT
-A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 135 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT
-A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 134 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT
-A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 136 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT
-A zone_wan_input -p tcp -m tcp --dport 8897 -m comment --comment "!fw3: linkease" -j ACCEPT
-A zone_wan_input -m comment --comment "!fw3" -j zone_wan_src_REJECT
-A zone_wan_output -m comment --comment "!fw3: Custom wan output rule chain" -j output_wan_rule
-A zone_wan_output -m comment --comment "!fw3" -j zone_wan_dest_ACCEPT
COMMIT
# Completed on Wed Feb 12 16:26:58 2025

#===================== IPSET状态 =====================#

Name: china_ip_route
Type: hash:net
Revision: 6
Header: family inet hashsize 4096 maxelem 1000000
Size in memory: 245448
References: 4
Number of entries: 8616

Name: china_ip_route_pass
Type: hash:net
Revision: 6
Header: family inet hashsize 1024 maxelem 1000000
Size in memory: 512
References: 3
Number of entries: 1

Name: localnetwork
Type: hash:net
Revision: 6
Header: family inet hashsize 1024 maxelem 65536
Size in memory: 1280
References: 4
Number of entries: 13

#===================== 路由表状态 =====================#

#IPv4

#route -n
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.*.*         10.30.*.*       0.0.*.*         UG    0      0        0 br-lan
10.30.*.*       0.0.*.*         255.255.*.*   U     0      0        0 br-lan
172.17.*.*      0.0.*.*         255.255.*.*     U     0      0        0 docker0

#ip route list
default via 10.30.*.* dev br-lan proto static 
10.30.*.*/23 dev br-lan proto kernel scope link src 10.30.*.* 
172.17.*.*/16 dev docker0 proto kernel scope link src 172.17.*.* linkdown 

#ip rule show
0:	from all lookup local
32765:	from all fwmark 0x162 lookup 354
32766:	from all lookup main
32767:	from all lookup default

#IPv6

#route -A inet6
Kernel IPv6 routing table
Destination                                 Next Hop                                Flags Metric Ref    Use Iface
fd2d:301f:d9fd::/48                         ::                                      !n    2147483647 2        0 lo      
fe80::/64                                   ::                                      U     256    7        0 br-lan  
::/0                                        ::                                      !n    -1     1        0 lo      
::1/128                                     ::                                      Un    0      8        0 lo      
fe80::/128                                  ::                                      Un    0      3        0 br-lan  
fe80::*:*:*:7a0a/128                ::                                      Un    0      9        0 br-lan  
ff00::/8                                    ::                                      U     256    7        0 br-lan  
::/0                                        ::                                      !n    -1     1        0 lo      

#ip -6 route list
unreachable fd2d:301f:d9fd::/48 dev lo proto static metric 2147483647 pref medium
fe80::/64 dev br-lan proto kernel metric 256 pref medium

#ip -6 rule show
0:	from all lookup local
32766:	from all lookup main

#===================== 端口占用状态 =====================#

tcp        0      0 :::7890                 :::*                    LISTEN      32655/clash
tcp        0      0 :::7891                 :::*                    LISTEN      32655/clash
tcp        0      0 :::7892                 :::*                    LISTEN      32655/clash
tcp        0      0 :::7893                 :::*                    LISTEN      32655/clash
tcp        0      0 :::7895                 :::*                    LISTEN      32655/clash
tcp        0      0 :::9090                 :::*                    LISTEN      32655/clash
udp        0      0 :::7874                 :::*                                32655/clash
udp        0      0 :::7891                 :::*                                32655/clash
udp        0      0 :::7892                 :::*                                32655/clash
udp        0      0 :::7893                 :::*                                32655/clash
udp        0      0 :::7895                 :::*                                32655/clash

#===================== 测试本机DNS查询(www.baidu.com) =====================#

Server:		127.0.*.*
Address:	127.0.*.*:53


www.baidu.com	canonical name = www.a.shifen.com
Name:	www.a.shifen.com
Address: 183.2.*.*
Name:	www.a.shifen.com
Address: 183.2.*.*


#===================== 测试内核DNS查询(www.instagram.com) =====================#

Status: 0
TC: false
RD: true
RA: true
AD: false
CD: false

Question: 
  Name: www.instagram.com.
  Qtype: 1
  Qclass: 1

Answer: 
  TTL: 1
  data: 31.13.*.*
  name: www.instagram.com.
  type: 1

Status: 0
TC: false
RD: true
RA: true
AD: false
CD: false

Question: 
  Name: www.instagram.com.
  Qtype: 28
  Qclass: 1

Answer: 
  TTL: 1
  data: 2a03:*:*:*:face:b00c:0:25de
  name: www.instagram.com.
  type: 28


Dnsmasq 当前默认 resolv 文件：/tmp/resolv.conf.d/resolv.conf.auto

#===================== /tmp/resolv.conf.d/resolv.conf.auto =====================#

# Interface lan
nameserver 119.29.*.*
nameserver 8.8.*.*

#===================== 测试本机网络连接(www.baidu.com) =====================#

HTTP/1.1 200 OK
Accept-Ranges: bytes
Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform
Connection: keep-alive
Content-Length: 277
Content-Type: text/html
Date: Wed, 12 Feb 2025 08:26:58 GMT
Etag: "575e1f71-115"
Last-Modified: Mon, 13 Jun 2016 02:50:25 GMT
Pragma: no-cache
Server: bfe/1.0.*.*


#===================== 测试本机网络下载(raw.githubusercontent.com) =====================#

HTTP/2 200 
cache-control: max-age=300
content-security-policy: default-src 'none'; style-src 'unsafe-inline'; sandbox
content-type: text/plain; charset=utf-8
etag: "f6037a93c68519d7041a3b4df325b61c424ec255b45dfeb063371319e39b0d96"
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
x-frame-options: deny
x-xss-protection: 1; mode=block
x-github-request-id: E932:290660:5F0500:644305:67AC57B8
accept-ranges: bytes
date: Wed, 12 Feb 2025 08:26:58 GMT
via: 1.1 varnish
x-served-by: cache-bfi-krnt7300096-BFI
x-cache: HIT
x-cache-hits: 0
x-timer: S1739348819.877271,VS0,VE113
vary: Authorization,Accept-Encoding,Origin
access-control-allow-origin: *
cross-origin-resource-policy: cross-origin
x-fastly-request-id: 32beea5e1494c761d360adf0d34524ff2df1ae00
expires: Wed, 12 Feb 2025 08:31:58 GMT
source-age: 0
content-length: 1071


#===================== 最近运行日志(自动切换为Debug模式) =====================#

time="2025-02-12T08:26:19.557704413Z" level=warning msg="[TCP] dial Ⓜ️ 微软服务 (match DomainSuffix/microsoft.com) 10.30.*.*:50718 --> settings-win.data.microsoft.com:443 error: dial tcp 20.72.*.*:443: i/o timeout"
time="2025-02-12T08:26:19.663442989Z" level=debug msg="[Rule] use default rules"
time="2025-02-12T08:26:19.663503984Z" level=debug msg="[DNS] cache hit settings-win.data.microsoft.com --> [52.140.*.*] A, expire at 2025-02-12 08:26:16"
time="2025-02-12T08:26:19.663513451Z" level=debug msg="[DNS] settings-win.data.microsoft.com --> 52.140.*.*"
time="2025-02-12T08:26:19.663584064Z" level=debug msg="[DNS] resolve settings-win.data.microsoft.com A from udp://10.10.*.*:53"
time="2025-02-12T08:26:19.663685472Z" level=debug msg="[DNS] resolve settings-win.data.microsoft.com A from udp://10.30.*.*:53"
time="2025-02-12T08:26:19.663707007Z" level=debug msg="[Process] find process error for settings-win.data.microsoft.com: process not found"
time="2025-02-12T08:26:19.663714797Z" level=debug msg="[DNS] resolve settings-win.data.microsoft.com A from udp://223.5.*.*:53"
time="2025-02-12T08:26:19.663770107Z" level=debug msg="[DNS] resolve settings-win.data.microsoft.com A from udp://211.137.*.*:53"
time="2025-02-12T08:26:19.663976702Z" level=debug msg="[DNS] cache hit settings-win.data.microsoft.com --> [20.72.*.*] A, expire at 2025-02-12 08:26:30"
time="2025-02-12T08:26:19.667546126Z" level=debug msg="[DNS] settings-win.data.microsoft.com --> [52.167.*.*] A from udp://223.5.*.*:53"
time="2025-02-12T08:26:24.664910658Z" level=warning msg="[TCP] dial Ⓜ️ 微软服务 (match DomainSuffix/microsoft.com) 10.30.*.*:50723 --> settings-win.data.microsoft.com:443 error: dial tcp 20.72.*.*:443: i/o timeout"
time="2025-02-12T08:26:24.759993645Z" level=debug msg="[Rule] use default rules"
time="2025-02-12T08:26:24.760050328Z" level=debug msg="[DNS] cache hit settings-win.data.microsoft.com --> [52.167.*.*] A, expire at 2025-02-12 08:26:49"
time="2025-02-12T08:26:24.760057643Z" level=debug msg="[DNS] settings-win.data.microsoft.com --> 52.167.*.*"
time="2025-02-12T08:26:24.760203515Z" level=debug msg="[Process] find process error for settings-win.data.microsoft.com: process not found"
time="2025-02-12T08:26:24.760358901Z" level=debug msg="[DNS] cache hit settings-win.data.microsoft.com --> [20.72.*.*] A, expire at 2025-02-12 08:26:30"
time="2025-02-12T08:26:29.761306331Z" level=warning msg="[TCP] dial Ⓜ️ 微软服务 (match DomainSuffix/microsoft.com) 10.30.*.*:50727 --> settings-win.data.microsoft.com:443 error: dial tcp 20.72.*.*:443: i/o timeout"
time="2025-02-12T08:26:29.848201239Z" level=debug msg="[Rule] use default rules"
time="2025-02-12T08:26:29.848258782Z" level=debug msg="[DNS] cache hit settings-win.data.microsoft.com --> [52.167.*.*] A, expire at 2025-02-12 08:26:49"
time="2025-02-12T08:26:29.848265226Z" level=debug msg="[DNS] settings-win.data.microsoft.com --> 52.167.*.*"
time="2025-02-12T08:26:29.848384524Z" level=debug msg="[Process] find process error for settings-win.data.microsoft.com: process not found"
time="2025-02-12T08:26:29.848485155Z" level=debug msg="[DNS] cache hit settings-win.data.microsoft.com --> [20.72.*.*] A, expire at 2025-02-12 08:26:30"
time="2025-02-12T08:26:34.849140371Z" level=warning msg="[TCP] dial Ⓜ️ 微软服务 (match DomainSuffix/microsoft.com) 10.30.*.*:50731 --> settings-win.data.microsoft.com:443 error: dial tcp 20.72.*.*:443: i/o timeout"
time="2025-02-12T08:26:41.439469443Z" level=debug msg="[Rule] use default rules"
time="2025-02-12T08:26:41.439519230Z" level=debug msg="[DNS] cache hit settings-win.data.microsoft.com --> [52.167.*.*] A, expire at 2025-02-12 08:26:49"
time="2025-02-12T08:26:41.439527402Z" level=debug msg="[DNS] settings-win.data.microsoft.com --> 52.167.*.*"
time="2025-02-12T08:26:41.439705747Z" level=debug msg="[Process] find process error for settings-win.data.microsoft.com: process not found"
time="2025-02-12T08:26:41.439831601Z" level=debug msg="[DNS] cache hit settings-win.data.microsoft.com --> [20.72.*.*] A, expire at 2025-02-12 08:26:30"
time="2025-02-12T08:26:41.439891941Z" level=debug msg="[DNS] resolve settings-win.data.microsoft.com A from udp://10.10.*.*:53"
time="2025-02-12T08:26:41.470768514Z" level=debug msg="[DNS] settings-win.data.microsoft.com --> [51.11.*.*] A from udp://10.10.*.*:53"
time="2025-02-12T08:26:46.440804650Z" level=warning msg="[TCP] dial Ⓜ️ 微软服务 (match DomainSuffix/microsoft.com) 10.30.*.*:50739 --> settings-win.data.microsoft.com:443 error: dial tcp 20.72.*.*:443: i/o timeout"
time="2025-02-12T08:26:46.535044343Z" level=debug msg="[Rule] use default rules"
time="2025-02-12T08:26:46.535097750Z" level=debug msg="[DNS] cache hit settings-win.data.microsoft.com --> [52.167.*.*] A, expire at 2025-02-12 08:26:49"
time="2025-02-12T08:26:46.535108485Z" level=debug msg="[DNS] settings-win.data.microsoft.com --> 52.167.*.*"
time="2025-02-12T08:26:46.535252810Z" level=debug msg="[Process] find process error for settings-win.data.microsoft.com: process not found"
time="2025-02-12T08:26:46.535356755Z" level=debug msg="[DNS] cache hit settings-win.data.microsoft.com --> [51.11.*.*] A, expire at 2025-02-12 08:27:00"
time="2025-02-12T08:26:48.445311874Z" level=debug msg="[DNS] cache hit api-std.sunlogin.oray.com --> [120.27.*.* 121.199.*.* 47.96.*.*] A, expire at 2025-02-12 08:26:19"
time="2025-02-12T08:26:48.445424058Z" level=debug msg="[DNS] resolve api-std.sunlogin.oray.com A from udp://10.10.*.*:53"
time="2025-02-12T08:26:48.445538777Z" level=debug msg="[DNS] resolve api-std.sunlogin.oray.com A from udp://10.30.*.*:53"
time="2025-02-12T08:26:48.445539520Z" level=debug msg="[DNS] resolve api-std.sunlogin.oray.com A from udp://211.137.*.*:53"
time="2025-02-12T08:26:48.445550277Z" level=debug msg="[DNS] resolve api-std.sunlogin.oray.com A from udp://223.5.*.*:53"
time="2025-02-12T08:26:48.448860279Z" level=debug msg="[DNS] api-std.sunlogin.oray.com --> [121.199.*.* 120.27.*.* 47.96.*.*] A from udp://211.137.*.*:53"
time="2025-02-12T08:26:51.536011058Z" level=warning msg="[TCP] dial Ⓜ️ 微软服务 (match DomainSuffix/microsoft.com) 10.30.*.*:50743 --> settings-win.data.microsoft.com:443 error: dial tcp 51.11.*.*:443: i/o timeout"
time="2025-02-12T08:26:55.171363148Z" level=debug msg="[Rule] use default rules"
time="2025-02-12T08:26:55.171439760Z" level=debug msg="[DNS] cache hit edge.microsoft.com --> [204.79.*.* 13.107.*.*] A, expire at 2025-02-12 08:24:13"
time="2025-02-12T08:26:55.171472720Z" level=debug msg="[DNS] resolve edge.microsoft.com A from udp://10.30.*.*:53"
time="2025-02-12T08:26:55.171484520Z" level=debug msg="[DNS] resolve edge.microsoft.com A from udp://10.10.*.*:53"
time="2025-02-12T08:26:55.171566810Z" level=debug msg="[DNS] resolve edge.microsoft.com A from udp://223.5.*.*:53"
time="2025-02-12T08:26:55.171481434Z" level=debug msg="[DNS] resolve edge.microsoft.com A from udp://211.137.*.*:53"
time="2025-02-12T08:26:55.171593972Z" level=debug msg="[DNS] edge.microsoft.com --> 13.107.*.*"
time="2025-02-12T08:26:55.171793506Z" level=debug msg="[Process] find process error for edge.microsoft.com: process not found"
time="2025-02-12T08:26:55.171918151Z" level=debug msg="[DNS] cache hit edge.microsoft.com --> [13.107.*.* 204.79.*.*] A, expire at 2025-02-12 08:23:55"
time="2025-02-12T08:26:55.172026819Z" level=debug msg="[DNS] resolve edge.microsoft.com A from udp://10.10.*.*:53"
time="2025-02-12T08:26:55.177155966Z" level=debug msg="[DNS] edge.microsoft.com --> [204.79.*.* 13.107.*.*] A from udp://211.137.*.*:53"
time="2025-02-12T08:26:55.177196120Z" level=debug msg="[DNS] edge.microsoft.com --> [204.79.*.* 13.107.*.*] A from udp://223.5.*.*:53"
time="2025-02-12T08:26:55.208050261Z" level=debug msg="[DNS] edge.microsoft.com --> [13.107.*.* 204.79.*.*] A from udp://10.10.*.*:53"
time="2025-02-12T08:26:55.253873767Z" level=info msg="[TCP] 10.30.*.*:50757 --> edge.microsoft.com:443 match DomainSuffix(microsoft.com) using Ⓜ️ 微软服务[DIRECT]"
time="2025-02-12T08:26:58.304349432Z" level=debug msg="[DNS] cache hit www.baidu.com --> [183.2.*.* 183.2.*.*] A, expire at 2025-02-12 08:12:11"
time="2025-02-12T08:26:58.304414009Z" level=debug msg="[DNS] resolve www.baidu.com A from udp://10.10.*.*:53"
time="2025-02-12T08:26:58.304447107Z" level=debug msg="[DNS] resolve www.baidu.com A from udp://10.30.*.*:53"
time="2025-02-12T08:26:58.304494958Z" level=debug msg="[DNS] resolve www.baidu.com A from udp://223.5.*.*:53"
time="2025-02-12T08:26:58.304526698Z" level=debug msg="[DNS] resolve www.baidu.com A from udp://211.137.*.*:53"
time="2025-02-12T08:26:58.307788137Z" level=debug msg="[DNS] www.baidu.com --> [183.2.*.* 183.2.*.*] A from udp://211.137.*.*:53"
time="2025-02-12T08:26:58.314022911Z" level=debug msg="[DNS] cache hit www.instagram.com --> [31.13.*.*] A, expire at 2025-02-12 08:13:15"
time="2025-02-12T08:26:58.314138159Z" level=debug msg="[DNS] resolve www.instagram.com A from udp://10.10.*.*:53"
time="2025-02-12T08:26:58.314195308Z" level=debug msg="[DNS] resolve www.instagram.com A from udp://10.30.*.*:53"
time="2025-02-12T08:26:58.314207194Z" level=debug msg="[DNS] resolve www.instagram.com A from udp://211.137.*.*:53"
time="2025-02-12T08:26:58.314198538Z" level=debug msg="[DNS] resolve www.instagram.com A from udp://223.5.*.*:53"
time="2025-02-12T08:26:58.317544288Z" level=debug msg="[DNS] www.instagram.com --> [199.59.*.*] A from udp://223.5.*.*:53"
time="2025-02-12T08:26:58.317585647Z" level=debug msg="[DNS] www.instagram.com --> [199.59.*.*] A from udp://211.137.*.*:53"
time="2025-02-12T08:26:58.317955395Z" level=debug msg="[DNS] cache hit www.instagram.com --> [2a03:*:*:*:face:b00c:0:25de] AAAA, expire at 2025-02-12 08:13:00"
time="2025-02-12T08:26:58.318103442Z" level=debug msg="[DNS] resolve www.instagram.com AAAA from udp://10.10.*.*:53"
time="2025-02-12T08:26:58.318204218Z" level=debug msg="[DNS] resolve www.instagram.com AAAA from udp://10.30.*.*:53"
time="2025-02-12T08:26:58.318211925Z" level=debug msg="[DNS] resolve www.instagram.com AAAA from udp://211.137.*.*:53"
time="2025-02-12T08:26:58.318215674Z" level=debug msg="[DNS] resolve www.instagram.com AAAA from udp://223.5.*.*:53"
time="2025-02-12T08:26:58.323690015Z" level=debug msg="[DNS] cache hit www.baidu.com --> [183.2.*.* 183.2.*.*] A, expire at 2025-02-12 08:27:17"
time="2025-02-12T08:26:58.332371485Z" level=debug msg="[DNS] www.instagram.com --> [2a03:*:*:*:face:b00c:0:25de] AAAA from udp://223.5.*.*:53"
time="2025-02-12T08:26:58.332403279Z" level=debug msg="[DNS] www.instagram.com --> [2a03:*:*:*:face:b00c:0:25de] AAAA from udp://211.137.*.*:53"
time="2025-02-12T08:26:58.404587483Z" level=debug msg="[Rule] use default rules"
time="2025-02-12T08:26:58.404643305Z" level=debug msg="[DNS] cache hit raw.githubusercontent.com --> [185.199.*.* 185.199.*.* 185.199.*.* 185.199.*.*] A, expire at 2025-02-12 08:16:07"
time="2025-02-12T08:26:58.404664557Z" level=debug msg="[DNS] resolve raw.githubusercontent.com A from udp://10.10.*.*:53"
time="2025-02-12T08:26:58.404727338Z" level=debug msg="[DNS] resolve raw.githubusercontent.com A from udp://223.5.*.*:53"
time="2025-02-12T08:26:58.404831223Z" level=debug msg="[DNS] resolve raw.githubusercontent.com A from udp://211.137.*.*:53"
time="2025-02-12T08:26:58.404842037Z" level=debug msg="[DNS] resolve raw.githubusercontent.com A from udp://10.30.*.*:53"
time="2025-02-12T08:26:58.404739823Z" level=debug msg="[DNS] raw.githubusercontent.com --> 185.199.*.*"
time="2025-02-12T08:26:58.405872720Z" level=debug msg="[DNS] cache hit 30823.ie.1a005gka.song.ting-wo-shuo-xiexieni.com --> [120.241.*.*] A, expire at 2025-02-12 08:26:17"
time="2025-02-12T08:26:58.405956614Z" level=debug msg="[DNS] resolve 30823.ie.1a005gka.song.ting-wo-shuo-xiexieni.com A from udp://10.10.*.*:53"
time="2025-02-12T08:26:58.405997264Z" level=debug msg="[DNS] resolve 30823.ie.1a005gka.song.ting-wo-shuo-xiexieni.com A from udp://10.30.*.*:53"
time="2025-02-12T08:26:58.406009696Z" level=debug msg="[DNS] resolve 30823.ie.1a005gka.song.ting-wo-shuo-xiexieni.com A from udp://223.5.*.*:53"
time="2025-02-12T08:26:58.406030286Z" level=debug msg="[DNS] resolve 30823.ie.1a005gka.song.ting-wo-shuo-xiexieni.com A from udp://211.137.*.*:53"
time="2025-02-12T08:26:58.406997480Z" level=debug msg="[DNS] raw.githubusercontent.com --> [185.199.*.* 185.199.*.* 185.199.*.* 185.199.*.*] A from udp://223.5.*.*:53"
time="2025-02-12T08:26:58.409789670Z" level=debug msg="[DNS] 30823.ie.1a005gka.song.ting-wo-shuo-xiexieni.com --> [120.241.*.*] A from udp://211.137.*.*:53"
time="2025-02-12T08:26:58.440973555Z" level=info msg="[TCP] 10.30.*.*:54670(curl) --> raw.githubusercontent.com:443 match DomainSuffix(githubusercontent.com) using 🚀 GitHub[🇭🇰 香港IX03 [IEPL] 30823高级版 1.5x]"
time="2025-02-12T08:27:07.730608544Z" level=debug msg="[DNS] cache hit sl-tk.oray.com --> [116.62.*.* 47.97.*.* 47.99.*.* 120.26.*.* 121.41.*.* 121.40.*.* 47.96.*.* 121.40.*.* 47.99.*.* 120.26.*.* 101.37.*.* 116.62.*.* 101.37.*.* 112.124.*.* 47.99.*.* 116.62.*.* 47.99.*.* 121.40.*.*] A, expire at 2025-02-12 08:26:29"
time="2025-02-12T08:27:07.730709757Z" level=debug msg="[DNS] resolve sl-tk.oray.com A from udp://10.10.*.*:53"
time="2025-02-12T08:27:07.730799691Z" level=debug msg="[DNS] resolve sl-tk.oray.com A from udp://211.137.*.*:53"
time="2025-02-12T08:27:07.730829559Z" level=debug msg="[DNS] resolve sl-tk.oray.com A from udp://223.5.*.*:53"
time="2025-02-12T08:27:07.730810003Z" level=debug msg="[DNS] resolve sl-tk.oray.com A from udp://10.30.*.*:53"
time="2025-02-12T08:27:07.734453861Z" level=debug msg="[DNS] sl-tk.oray.com --> [121.40.*.* 47.99.*.* 120.26.*.* 121.41.*.* 121.40.*.* 47.97.*.* 47.96.*.* 116.62.*.* 121.40.*.* 101.37.*.* 101.37.*.* 47.99.*.* 120.26.*.* 116.62.*.* 116.62.*.* 47.99.*.* 112.124.*.* 47.99.*.*] A from udp://223.5.*.*:53"

#===================== 最近运行日志获取完成(自动切换为silent模式) =====================#


#===================== 活动连接信息 =====================#

1. SourceIP:【10.30.*.*】 - Host:【giscus.app】 - DestinationIP:【76.223.*.*】 - Network:【tcp】 - RulePayload:【76.223.*.*/17】 - Lastchain:【🇭🇰 香港IX03 [IEPL] 30823高级版 1.5x】
2. SourceIP:【10.30.*.*】 - Host:【play.google.com】 - DestinationIP:【142.251.*.*】 - Network:【tcp】 - RulePayload:【google.com】 - Lastchain:【🇭🇰 香港IX03 [IEPL] 30823高级版 1.5x】
3. SourceIP:【10.30.*.*】 - Host:【alive.github.com】 - DestinationIP:【140.82.*.*】 - Network:【tcp】 - RulePayload:【github.com】 - Lastchain:【🇭🇰 香港IX03 [IEPL] 30823高级版 1.5x】
4. SourceIP:【10.30.*.*】 - Host:【giscus.app】 - DestinationIP:【76.223.*.*】 - Network:【tcp】 - RulePayload:【76.223.*.*/17】 - Lastchain:【🇭🇰 香港IX03 [IEPL] 30823高级版 1.5x】
5. SourceIP:【10.30.*.*】 - Host:【mail.google.com】 - DestinationIP:【142.251.*.*】 - Network:【tcp】 - RulePayload:【google.com】 - Lastchain:【🇭🇰 香港IX03 [IEPL] 30823高级版 1.5x】
6. SourceIP:【10.30.*.*】 - Host:【accounts.google.com】 - DestinationIP:【46.82.*.*】 - Network:【tcp】 - RulePayload:【google.com】 - Lastchain:【🇭🇰 香港IX03 [IEPL] 30823高级版 1.5x】
7. SourceIP:【10.30.*.*】 - Host:【edge.microsoft.com】 - DestinationIP:【13.107.*.*】 - Network:【tcp】 - RulePayload:【microsoft.com】 - Lastchain:【DIRECT】

我的问题

1. 首先我想确认下现象，这个现象应该是被向日葵服务器丢掉了这个tls握手包
2. 我该如何处理这种情况呢？即时我配置不经过openclash，也依然有这个现象
3. 非常感谢可以看到这个问题的大佬们，还请不吝赐教。

[vernesong]

绕过了不行就表示DNS有问题，你用第二DNS服务器尝试，服务器就填你lan的网关或者dns

[cicada-lewis]

我使用阿里的dns做向日葵域名的解析不行， 还是一样的现象，下面是路由器和我本地的抓包


或者你可以告诉我大概的排查方向

[cicada-lewis]

@vernesong 我知道为什么了，开启fake-ip模式后我的ip包的source address 可以返回我原始的ip吗？我的网络环境里向日葵是被ip限定访问的，感谢您的解答，btw，我想了解openclash更多的技术细节，我可以去哪里找到呢？

[vernesong]

流量不经过内核，只跟dns有关，或者你需要排查ipv6的问题