OpenClash 调试日志

生成时间: 2026-08-03 15:19:34
插件版本: 0.47.133
隐私提示: 上传此日志前请注意检查、屏蔽公网IP、节点、密码等相关敏感信息

系统信息

项目 值
主机型号 Phicomm N1
固件版本 LEDE R25.10.10
LuCI版本 git-26.034.10143-64f3163-1
内核版本 6.18.12-flippy-94+
处理器架构 aarch64_generic
系统运行时间 15:19:37 up 25 days, 17:31, load average: 1.03, 0.61, 0.45
IPV6-DHCP 未配置
DNS劫持 Dnsmasq 转发

磁盘与内存

⎗
✓
1
2
3
4
# df -h / /tmp /etc/openclash
Filesystem                Size      Used Available Use% Mounted on
/dev/mmcblk2p2            2.0G    801.6M      1.0G  43% /
tmpfs                   894.3M     22.8M    871.4M   3% /tmp
⎗
✓
1
2
3
4
# free -m
              total        used        free      shared  buff/cache   available
Mem:        1831512      377388      572844       26144      881280     1235772
Swap:             0           0           0
⎗
✓
1
2
3
4
5
# cat /proc/meminfo | grep -E '^(MemTotal|MemAvailable|SwapTotal|SwapFree)'
MemTotal:        1831512 kB
MemAvailable:    1235772 kB
SwapTotal:             0 kB
SwapFree:              0 kB

Dnsmasq 配置

⎗
✓
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
# uci show dhcp.@dnsmasq[0]
dhcp.cfg01411c=dnsmasq
dhcp.cfg01411c.domainneeded='1'
dhcp.cfg01411c.boguspriv='1'
dhcp.cfg01411c.filterwin2k='0'
dhcp.cfg01411c.localise_queries='1'
dhcp.cfg01411c.rebind_protection='1'
dhcp.cfg01411c.rebind_localhost='1'
dhcp.cfg01411c.local='/lan/'
dhcp.cfg01411c.domain='lan'
dhcp.cfg01411c.expandhosts='1'
dhcp.cfg01411c.nonegcache='0'
dhcp.cfg01411c.authoritative='1'
dhcp.cfg01411c.readethers='1'
dhcp.cfg01411c.leasefile='/tmp/dhcp.leases'
dhcp.cfg01411c.nonwildcard='1'
dhcp.cfg01411c.localservice='1'
dhcp.cfg01411c.ednspacket_max='1232'
dhcp.cfg01411c.filter_aaaa='0'
dhcp.cfg01411c.filter_a='0'
dhcp.cfg01411c.localuse='1'
dhcp.cfg01411c.cachesize='0'
dhcp.cfg01411c.port='53'
dhcp.cfg01411c.server='127.0.*.*#7874'
dhcp.cfg01411c.noresolv='1'

依赖检查

依赖 状态
dnsmasq-full 已安装 (2.91-1)
dnsmasq-full(ipset) 已安装 (Compile time options: IPv6 GNU-getopt no-DBus UBus no-i18n no-IDN DHCP DHCPv6 no-Lua no-TFTP no-conntrack ipset no-nftset no-auth no-DNSSEC loop-detect inotify dumpfile)
dnsmasq-full(nftset) 已安装 (Compile time options: IPv6 GNU-getopt no-DBus UBus no-i18n no-IDN DHCP DHCPv6 no-Lua no-TFTP no-conntrack ipset no-nftset no-auth no-DNSSEC loop-detect inotify dumpfile)
bash 已安装 (5.2.15-2)
curl 已安装 (8.15.0-1)
ca-bundle 已安装 (20250419-1)
ipset 已安装 (7.21-1)
ip-full 已安装 (6.2.0-1)
ruby 已安装 (3.3.6-1)
ruby-yaml 已安装 (3.3.6-1)
ruby-psych 已安装 (3.3.6-1)
ruby-pstore 已安装 (3.3.6-1)
ruby功能测试 正常
kmod-tun(TUN模式) 已安装 (6.6.123-1)
luci-compat 已安装 (git-26.034.10143-64f3163-1)
kmod-inet-diag 已安装 (6.6.123-1)
unzip 已安装 (6.0-8)
iptables-mod-tproxy 已安装 (1.8.7-2)
kmod-ipt-tproxy 已安装 (6.6.123-1)
iptables-mod-extra 已安装 (1.8.7-2)
kmod-ipt-extra 已安装 (6.6.123-1)
kmod-ipt-nat 已安装 (6.6.123-1)

内核模块加载状态

⎗
✓
1
2
3
4
# lsmod | grep -E 'tun|tproxy|inet_diag'
nf_tproxy_ipv6         16384  1 xt_TPROXY
nf_tproxy_ipv4         16384  1 xt_TPROXY
tun                    57344  2

内核检查

项目 值
运行状态 运行中
运行内核 Meta
进程pid 18919
运行用户 root
已选择的架构 linux-arm64
Meta 内核版本 alpha-g9ae1cc2
Meta 内核文件 存在
Meta 内核运行权限 正常

GEO 数据文件

⎗
✓
1
2
3
4
5
# ls -lh /etc/openclash/Country.mmdb /etc/openclash/GeoIP.dat /etc/openclash/GeoSite.dat /etc/openclash/ASN.mmdb
-rw-r--r--    1 root     root       11.5M Aug  1 14:02 /etc/openclash/ASN.mmdb
-rw-r--r--    1 root     root      207.1K Aug  3 07:46 /etc/openclash/Country.mmdb
-rw-r--r--    1 root     root       16.7M Aug  3 07:46 /etc/openclash/GeoIP.dat
-rw-r--r--    1 root     root        4.0M Aug  2 22:23 /etc/openclash/GeoSite.dat

模型、缓存文件状态

文件 状态
Model.bin 不存在
cache.db lrwxrwxrwx 1 root root 32 Aug 3 15:11 /etc/openclash/cache.db -> /etc/openclash/history/哄哄.db

冲突插件检测

⎗
✓
1
2
# ps | grep -E 'passwall|ssr-plus|bypass|helloworld'
未检测到冲突插件

插件设置

设置项 值
当前配置文件 /etc/openclash/config/哄哄.yaml
启动配置文件 /etc/openclash/哄哄.yaml
运行模式 fake-ip
默认代理模式 rule
UDP流量转发 启用
自定义DNS 停用
IPV6代理 停用
IPV6-DNS解析 停用
禁用Dnsmasq缓存 启用
自定义规则 停用
仅允许内网 启用
仅代理命中规则流量 停用
仅允许常用端口流量 停用
绕过中国大陆IP 启用
路由本机代理 启用
TUN堆栈类型 system
启动延迟 0秒
日志大小 1024KB
旁路由兼容 启用
禁用quic-go GSO 启用
小闪存模式 停用
域名嗅探 停用
DNS代理 启用
绕过服务器地址 停用
禁用QUIC 启用
访问控制模式 Black
IPv6模式 未知
绕过IPv6区域 停用

Cron 定时任务

⎗
✓
1
2
# crontab -l | grep -i openclash
0 4 * * * /usr/share/openclash/openclash_chnroute.sh #openclash-cron-task

覆写模块设置

⎗
✓
1
# uci show openclash.@overwrite[0]

配置文件

⎗
✓
  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
# ruby_read [config] (filtered: without proxies/proxy-providers)
port: 7890
socks-port: 7891
allow-lan: true
mode: rule
log-level: info
geodata-mode: true
geo-auto-update: true
geodata-loader: standard
geo-update-interval: 24
geox-url:
  geoip: https://testingcf.jsdelivr.net/gh/MetaCubeX/meta-rules-dat@release/geoip.dat
  geosite: https://testingcf.jsdelivr.net/gh/MetaCubeX/meta-rules-dat@release/geosite.dat
  mmdb: https://testingcf.jsdelivr.net/gh/MetaCubeX/meta-rules-dat@release/country.mmdb
  asn: https://github.com/xishang0128/geoip/releases/download/latest/GeoLite2-ASN.mmdb
rule-providers:
  category-ai-!cn:
    type: http
    format: mrs
    behavior: domain
    url: https://gh-proxy.com/https://github.com/MetaCubeX/meta-rules-dat/raw/refs/heads/meta/geo/geosite/category-ai-!cn.mrs
    path: "./rule_provider/category-ai-!cn.mrs"
    interval: 86400
  youtube:
    type: http
    format: mrs
    behavior: domain
    url: https://gh-proxy.com/https://github.com/MetaCubeX/meta-rules-dat/raw/refs/heads/meta/geo/geosite/youtube.mrs
    path: "./rule_provider/youtube.mrs"
    interval: 86400
  google:
    type: http
    format: mrs
    behavior: domain
    url: https://gh-proxy.com/https://github.com/MetaCubeX/meta-rules-dat/raw/refs/heads/meta/geo/geosite/google.mrs
    path: "./rule_provider/google.mrs"
    interval: 86400
  geolocation-cn:
    type: http
    format: mrs
    behavior: domain
    url: https://gh-proxy.com/https://github.com/MetaCubeX/meta-rules-dat/raw/refs/heads/meta/geo/geosite/geolocation-cn.mrs
    path: "./rule_provider/geolocation-cn.mrs"
    interval: 86400
  cn:
    type: http
    format: mrs
    behavior: domain
    url: https://gh-proxy.com/https://github.com/MetaCubeX/meta-rules-dat/raw/refs/heads/meta/geo/geosite/cn.mrs
    path: "./rule_provider/cn.mrs"
    interval: 86400
  github:
    type: http
    format: mrs
    behavior: domain
    url: https://gh-proxy.com/https://github.com/MetaCubeX/meta-rules-dat/raw/refs/heads/meta/geo/geosite/github.mrs
    path: "./rule_provider/github.mrs"
    interval: 86400
  gitlab:
    type: http
    format: mrs
    behavior: domain
    url: https://gh-proxy.com/https://github.com/MetaCubeX/meta-rules-dat/raw/refs/heads/meta/geo/geosite/gitlab.mrs
    path: "./rule_provider/gitlab.mrs"
    interval: 86400
  geolocation-!cn:
    type: http
    format: mrs
    behavior: domain
    url: https://gh-proxy.com/https://github.com/MetaCubeX/meta-rules-dat/raw/refs/heads/meta/geo/geosite/geolocation-!cn.mrs
    path: "./rule_provider/geolocation-!cn.mrs"
    interval: 86400
  google-ip:
    type: http
    format: mrs
    behavior: ipcidr
    url: https://gh-proxy.com/https://github.com/MetaCubeX/meta-rules-dat/raw/refs/heads/meta/geo/geoip/google.mrs
    path: "./rule_provider/google-ip.mrs"
    interval: 86400
  private-ip:
    type: http
    format: mrs
    behavior: ipcidr
    url: https://gh-proxy.com/https://github.com/MetaCubeX/meta-rules-dat/raw/refs/heads/meta/geo/geoip/private.mrs
    path: "./rule_provider/private-ip.mrs"
    interval: 86400
  cn-ip:
    type: http
    format: mrs
    behavior: ipcidr
    url: https://gh-proxy.com/https://github.com/MetaCubeX/meta-rules-dat/raw/refs/heads/meta/geo/geoip/cn.mrs
    path: "./rule_provider/cn-ip.mrs"
    interval: 86400
  telegram-ip:
    type: http
    format: mrs
    behavior: ipcidr
    url: https://gh-proxy.com/https://github.com/MetaCubeX/meta-rules-dat/raw/refs/heads/meta/geo/geoip/telegram.mrs
    path: "./rule_provider/telegram-ip.mrs"
    interval: 86400
  oc-cn-domain:
    type: http
    interval: 43200
    behavior: domain
    format: mrs
    url: https://raw.githubusercontent.com/MetaCubeX/meta-rules-dat/meta/geo/geosite/cn.mrs
    path: "./rule_provider/oc-cn-domain.mrs"
dns:
  enable: true
  ipv6: false
  respect-rules: true
  enhanced-mode: fake-ip
  nameserver:
  - https://120.53.*.*/dns-query
  - https://223.5.*.*/dns-query
  proxy-server-nameserver:
  - https://120.53.*.*/dns-query
  - https://223.5.*.*/dns-query
  nameserver-policy:
    geosite:cn,private:
    - https://120.53.*.*/dns-query
    - https://223.5.*.*/dns-query
    geosite:geolocation-!cn:
    - https://dns.cloudflare.com/dns-query
    - https://dns.google/dns-query
  fake-ip-range: 198.18.*.*/16
  listen: 0.0.*.*:7874
  fake-ip-filter-mode: blacklist
  fake-ip-filter:
  - "*.lan"
  - "*.localdomain"
  - "*.example"
  - "*.invalid"
  - "*.localhost"
  - "*.test"
  - "*.local"
  - "*.home.arpa"
  - "*.direct"
  - cable.auth.com
  - network-test.debian.org
  - detectportal.firefox.com
  - resolver1.opendns.com
  - global.turn.twilio.com
  - global.stun.twilio.com
  - app.yinxiang.com
  - injections.adguard.org
  - localhost.*.weixin.qq.com
  - "*.blzstatic.cn"
  - "*.cmpassport.com"
  - id6.me
  - open.e.189.cn
  - opencloud.wostore.cn
  - id.mail.wo.cn
  - mdn.open.wo.cn
  - hmrz.wo.cn
  - nishub1.10010.com
  - enrichgw.10010.com
  - "*.wosms.cn"
  - "*.jegotrip.com.cn"
  - "*.icitymobile.mobi"
  - "*.pingan.com.cn"
  - "*.cmbchina.com"
  - "*.10099.com.cn"
  - "*.microdone.cn"
  - PDC._msDCS.*.*
  - DC._msDCS.*.*
  - GC._msDCS.*.*
  - time.*.com
  - time.*.gov
  - time.*.edu.cn
  - time.*.apple.com
  - time-ios.apple.com
  - time1.*.com
  - time2.*.com
  - time3.*.com
  - time4.*.com
  - time5.*.com
  - time6.*.com
  - time7.*.com
  - ntp.*.com
  - ntp1.*.com
  - ntp2.*.com
  - ntp3.*.com
  - ntp4.*.com
  - ntp5.*.com
  - ntp6.*.com
  - ntp7.*.com
  - "*.time.edu.cn"
  - "*.ntp.org.cn"
  - "+.pool.ntp.org"
  - time1.cloud.tencent.com
  - music.163.com
  - "*.music.163.com"
  - "*.126.net"
  - musicapi.taihe.com
  - music.taihe.com
  - songsearch.kugou.com
  - trackercdn.kugou.com
  - "*.kuwo.cn"
  - api-jooxtt.sanook.com
  - api.joox.com
  - joox.com
  - y.qq.com
  - "*.y.qq.com"
  - streamoc.music.tc.qq.com
  - mobileoc.music.tc.qq.com
  - isure.stream.qqmusic.qq.com
  - dl.stream.qqmusic.qq.com
  - aqqmusic.tc.qq.com
  - amobile.music.tc.qq.com
  - "*.xiami.com"
  - "*.music.migu.cn"
  - music.migu.cn
  - "+.msftconnecttest.com"
  - "+.msftncsi.com"
  - localhost.ptlogin2.qq.com
  - localhost.sec.qq.com
  - "+.qq.com"
  - "+.tencent.com"
  - "+.srv.nintendo.net"
  - "*.n.n.srv.nintendo.net"
  - "+.cdn.nintendo.net"
  - "+.stun.playstation.net"
  - xbox.*.*.microsoft.com
  - "*.*.xboxlive.com"
  - xbox.*.microsoft.com
  - xnotify.xboxlive.com
  - "+.battle.net"
  - "+.battlenet.com.cn"
  - "+.wotgame.cn"
  - "+.wggames.cn"
  - "+.wowsgame.cn"
  - "+.wargaming.net"
  - proxy.golang.org
  - stun.*.*
  - stun.*.*.*
  - "+.stun.*.*"
  - "+.stun.*.*.*"
  - "+.stun.*.*.*.*"
  - "+.stun.*.*.*.*.*"
  - heartbeat.belkin.com
  - "*.linksys.com"
  - "*.linksyssmartwifi.com"
  - "*.router.asus.com"
  - mesu.apple.com
  - swscan.apple.com
  - swquery.apple.com
  - swdownload.apple.com
  - swcdn.apple.com
  - swdist.apple.com
  - lens.l.google.com
  - stun.l.google.com
  - na.b.g-tun.com
  - "+.nflxvideo.net"
  - "*.square-enix.com"
  - "*.finalfantasyxiv.com"
  - "*.ffxiv.com"
  - "*.ff14.sdo.com"
  - ff.dorado.sdo.com
  - "*.mcdn.bilivideo.cn"
  - "+.media.dssott.com"
  - shark007.net
  - Mijia Cloud
  - "+.cmbchina.com"
  - "+.cmbimg.com"
  - local.adguard.org
  - "+.sandai.net"
  - "+.n0808.com"
  - "+.uu.163.com"
  - ps.res.netease.com
  - "+.pub.3gppnetwork.org"
  - rule-set:oc-cn-domain
proxy-groups:
- type: select
  name: "\U0001F680 节点选择"
  proxies:
  - "⚡ 自动选择"
  - DIRECT
  - REJECT
  use:
  - _auto_provider_17kxi94
- name: "⚡ 自动选择"
  type: url-test
  proxies: []
  url: http://www.gstatic.com/generate_204
  interval: 300
  lazy: false
  use:
  - _auto_provider_17kxi94
- type: select
  name: "\U0001F4AC AI 服务"
  proxies:
  - "\U0001F680 节点选择"
  - DIRECT
  - REJECT
  use:
  - _auto_provider_17kxi94
- type: select
  name: "\U0001F4F9 油管视频"
  proxies:
  - "\U0001F680 节点选择"
  - DIRECT
  - REJECT
  use:
  - _auto_provider_17kxi94
- type: select
  name: "\U0001F50D 谷歌服务"
  proxies:
  - "\U0001F680 节点选择"
  - DIRECT
  - REJECT
  use:
  - _auto_provider_17kxi94
- type: select
  name: "\U0001F3E0 私有网络"
  proxies:
  - DIRECT
  - "\U0001F680 节点选择"
  - REJECT
  use:
  - _auto_provider_17kxi94
- type: select
  name: "\U0001F512 国内服务"
  proxies:
  - DIRECT
  - "\U0001F680 节点选择"
  - REJECT
  use:
  - _auto_provider_17kxi94
- type: select
  name: "\U0001F4F2 电报消息"
  proxies:
  - "\U0001F680 节点选择"
  - DIRECT
  - REJECT
  use:
  - _auto_provider_17kxi94
- type: select
  name: "\U0001F431 Github"
  proxies:
  - "\U0001F680 节点选择"
  - DIRECT
  - REJECT
  use:
  - _auto_provider_17kxi94
- type: select
  name: "\U0001F310 非中国"
  proxies:
  - "\U0001F680 节点选择"
  - DIRECT
  - REJECT
  use:
  - _auto_provider_17kxi94
- type: select
  name: "\U0001F41F 漏网之鱼"
  proxies:
  - "\U0001F680 节点选择"
  - DIRECT
  - REJECT
  use:
  - _auto_provider_17kxi94
rules:
- "RULE-SET,category-ai-!cn,\U0001F4AC AI 服务"
- "RULE-SET,youtube,\U0001F4F9 油管视频"
- "RULE-SET,google,\U0001F50D 谷歌服务"
- "RULE-SET,geolocation-cn,\U0001F512 国内服务"
- "RULE-SET,cn,\U0001F512 国内服务"
- "RULE-SET,github,\U0001F431 Github"
- "RULE-SET,gitlab,\U0001F431 Github"
- "RULE-SET,geolocation-!cn,\U0001F310 非中国"
- "RULE-SET,google-ip,\U0001F50D 谷歌服务,no-resolve"
- "RULE-SET,private-ip,\U0001F3E0 私有网络,no-resolve"
- "RULE-SET,cn-ip,\U0001F512 国内服务,no-resolve"
- "RULE-SET,telegram-ip,\U0001F4F2 电报消息,no-resolve"
- "MATCH,\U0001F41F 漏网之鱼"
redir-port: 7892
tproxy-port: 7895
mixed-port: 7893
external-controller: 0.0.*.*:9090
bind-address: "*"
external-ui: "/usr/share/openclash/ui"
external-ui-name: zashboard
external-ui-url: https://codeload.github.com/Zephyruso/zashboard/zip/refs/heads/gh-pages-cdn-fonts
keep-alive-interval: 15
keep-alive-idle: 600
ipv6: false
experimental:
  quic-go-disable-gso: true
profile:
  store-selected: true
  store-fake-ip: true
ntp:
  enable: true
  server: time.apple.com
  port: 123
  interval: 30
  write-to-system: true

自定义覆写设置

⎗
✓
  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
# cat /etc/openclash/custom/openclash_custom_overwrite.sh
#!/bin/sh
. /usr/share/openclash/ruby.sh
. /usr/share/openclash/log.sh
. /lib/functions.sh

# This script is called by /etc/init.d/openclash
# Add your custom overwrite scripts here, they will be take effict after the OpenClash own srcipts

LOG_OUT "Tip: Start Running Custom Overwrite Scripts..."
LOGTIME=$(echo $(date "+%Y-%m-%d %H:%M:%S"))
LOG_FILE="/tmp/openclash.log"
#Config Path
CONFIG_FILE="$1"

    #Simple Demo:
    #Key Overwrite Demo
    #1--config path
    #2--key name
    #3--value
    #ruby_edit "$CONFIG_FILE" "['redir-port']" "7892"
    #ruby_edit "$CONFIG_FILE" "['secret']" "123456"
    #ruby_edit "$CONFIG_FILE" "['dns']['enable']" "true"
    #ruby_edit "$CONFIG_FILE" "['dns']['proxy-server-nameserver']" "['https://doh.pub/dns-query','https://223.5.*.*:443/dns-query']"

    #Hash Overwrite Demo
    #1--config path
    #2--key name
    #3--hash type value
    #ruby_edit "$CONFIG_FILE" "['dns']['nameserver-policy']" "{'+.msftconnecttest.com'=>'114.114.*.*', '+.msftncsi.com'=>'114.114.*.*', 'geosite:gfw'=>['https://dns.cloudflare.com/dns-query', 'https://dns.google/dns-query#ecs=1.1.*.*/24&ecs-override=true'], 'geosite:cn'=>['114.114.*.*'], 'geosite:geolocation-!cn'=>['https://dns.cloudflare.com/dns-query', 'https://dns.google/dns-query#ecs=1.1.*.*/24&ecs-override=true']}"
    #ruby_edit "$CONFIG_FILE" "['sniffer']" "{'enable'=>true, 'parse-pure-ip'=>true, 'force-domain'=>['+.netflix.com', '+.nflxvideo.net', '+.amazonaws.com', '+.media.dssott.com'], 'skip-domain'=>['+.apple.com', 'Mijia Cloud', 'dlg.io.mi.com', '+.oray.com', '+.sunlogin.net'], 'sniff'=>{'TLS'=>nil, 'HTTP'=>{'ports'=>[80, '8080-8880'], 'override-destination'=>true}}}"

    #Map Edit Demo
    #1--config path
    #2--map name
    #3--key name
    #4--sub key name
    #5--value
    #ruby_map_edit "$CONFIG_FILE" "['proxy-providers']" "HK" "['url']" "http://test.com"

    #Hash Merge Demo
    #1--config path
    #2--key name
    #3--hash
    #ruby_merge_hash "$CONFIG_FILE" "['proxy-providers']" "'TW'=>{'type'=>'http', 'path'=>'./proxy_provider/TW.yaml', 'url'=>'https://gist.githubusercontent.com/raw/tw_clash', 'interval'=>3600, 'health-check'=>{'enable'=>true, 'url'=>'http://cp.cloudflare.com/generate_204', 'interval'=>300}}"
    #ruby_merge_hash "$CONFIG_FILE" "['rule-providers']" "'Reject'=>{'type'=>'http', 'behavior'=>'classical', 'url'=>'https://testingcf.jsdelivr.net/gh/dler-io/Rules@main/Clash/Provider/Reject.yaml', 'path'=>'./rule_provider/Reject', 'interval'=>86400}"

    #Array Edit Demo
    #1--config path
    #2--key name
    #3--match key name
    #4--match key value
    #5--target key name
    #6--target key value
    #ruby_arr_edit "$CONFIG_FILE" "['proxy-groups']" "['name']" "Proxy" "['type']" "Smart"
    #ruby_arr_edit "$CONFIG_FILE" "['dns']['nameserver']" "" "114.114.*.*" "" "119.29.*.*"

    #Array Insert Value Demo:
    #1--config path
    #2--key name
    #3--position(start from 0, end with -1)
    #4--value
    #ruby_arr_insert "$CONFIG_FILE" "['dns']['nameserver']" "0" "114.114.*.*"

    #Array Insert Hash Demo:
    #1--config path
    #2--key name
    #3--position(start from 0, end with -1)
    #4--hash
    #ruby_arr_insert_hash "$CONFIG_FILE" "['proxy-groups']" "0" "{'name'=>'Disney', 'type'=>'select', 'disable-udp'=>false, 'use'=>['TW', 'SG', 'HK']}"
    #ruby_arr_insert_hash "$CONFIG_FILE" "['proxies']" "0" "{'name'=>'HKG 01', 'type'=>'ss', 'server'=>'cc.hd.abc', 'port'=>'12345', 'cipher'=>'aes-128-gcm', 'password'=>'123456', 'udp'=>true, 'plugin'=>'obfs', 'plugin-opts'=>{'mode'=>'http', 'host'=>'microsoft.com'}}"
    #ruby_arr_insert_hash "$CONFIG_FILE" "['listeners']" "0" "{'name'=>'name', 'type'=>'shadowsocks', 'port'=>'12345', 'listen'=>'0.0.*.*', 'rule'=>'sub-rule-1', 'proxy'=>'proxy'}"

    #Array Insert Other Array Demo:
    #1--config path
    #2--key name
    #3--position(start from 0, end with -1)
    #4--array
    #ruby_arr_insert_arr "$CONFIG_FILE" "['dns']['proxy-server-nameserver']" "0" "['https://doh.pub/dns-query','https://223.5.*.*:443/dns-query']"

    #Array Insert From Yaml File Demo:
    #1--config path
    #2--key name
    #3--position(start from 0, end with -1)
    #4--value file path
    #5--value key name in #4 file
    #ruby_arr_add_file "$CONFIG_FILE" "['dns']['fallback-filter']['ipcidr']" "0" "/etc/openclash/custom/openclash_custom_fallback_filter.yaml" "['fallback-filter']['ipcidr']"

    #Delete Array Value Demo:
    #1--config path
    #2--key name
    #3--value
    #ruby_delete "$CONFIG_FILE" "['dns']['nameserver']" "114.114.*.*"

    #Delete Key Demo:
    #1--config path
    #2--key name
    #3--key name
    #ruby_delete "$CONFIG_FILE" "['dns']" "nameserver"
    #ruby_delete "$CONFIG_FILE" "" "dns"

    #Ruby Script Demo:
    #ruby -ryaml -rYAML -I "/usr/share/openclash" -E UTF-8 -e "
    #   begin
    #      Value = YAML.load_file('$CONFIG_FILE');
    #   rescue Exception => e
    #      puts '${LOGTIME} Error: Load File Failed,【' + e.message + '】';
    #   end;

        #General
    #   begin
    #   Thread.new{
    #      Value['redir-port']=7892;
    #      Value['tproxy-port']=7895;
    #      Value['port']=7890;
    #      Value['socks-port']=7891;
    #      Value['mixed-port']=7893;
    #   }.join;

    #   rescue Exception => e
    #      puts '${LOGTIME} Error: Set General Failed,【' + e.message + '】';
    #   ensure
    #      File.open('$CONFIG_FILE','w') {|f| YAML.dump(Value, f)};
    #   end" 2>/dev/null >> $LOG_FILE

exit 0

自定义防火墙设置

⎗
✓
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
# cat /etc/openclash/custom/openclash_custom_firewall_rules.sh
#!/bin/sh
. /usr/share/openclash/log.sh
. /lib/functions.sh

# This script is called by /etc/init.d/openclash
# Add your custom firewall rules here, they will be added after the end of the OpenClash iptables rules

LOG_OUT "Tip: Start Add Custom Firewall Rules..."

exit 0

IPTABLES 防火墙设置

IPv4 NAT chain

⎗
✓
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
# iptables-save -t nat
# Generated by iptables-save v1.8.7 on Mon Aug  3 15:19:39 2026
*nat
:PREROUTING ACCEPT [18:1052]
:INPUT ACCEPT [95:17850]
:OUTPUT ACCEPT [63:4381]
:POSTROUTING ACCEPT [85:5740]
:DOCKER - [0:0]
:MINIUPNPD - [0:0]
:MINIUPNPD-POSTROUTING - [0:0]
:openclash - [0:0]
:openclash_output - [0:0]
:openclash_post - [0:0]
:postrouting_VPN_rule - [0:0]
:postrouting_docker_rule - [0:0]
:postrouting_lan_rule - [0:0]
:postrouting_rule - [0:0]
:postrouting_vpn_rule - [0:0]
:postrouting_wan_rule - [0:0]
:prerouting_VPN_rule - [0:0]
:prerouting_docker_rule - [0:0]
:prerouting_lan_rule - [0:0]
:prerouting_rule - [0:0]
:prerouting_vpn_rule - [0:0]
:prerouting_wan_rule - [0:0]
:ts-postrouting - [0:0]
:zone_VPN_postrouting - [0:0]
:zone_VPN_prerouting - [0:0]
:zone_docker_postrouting - [0:0]
:zone_docker_prerouting - [0:0]
:zone_lan_postrouting - [0:0]
:zone_lan_prerouting - [0:0]
:zone_vpn_postrouting - [0:0]
:zone_vpn_prerouting - [0:0]
:zone_wan_postrouting - [0:0]
:zone_wan_prerouting - [0:0]
-A PREROUTING -p tcp -m tcp --dport 53 -m comment --comment "OpenClash DNS Hijack" -j REDIRECT --to-ports 53
-A PREROUTING -p udp -m udp --dport 53 -m comment --comment "OpenClash DNS Hijack" -j REDIRECT --to-ports 53
-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER
-A PREROUTING -m comment --comment "!fw3: Custom prerouting rule chain" -j prerouting_rule
-A PREROUTING -i br-lan -m comment --comment "!fw3" -j zone_lan_prerouting
-A PREROUTING -i docker0 -m comment --comment "!fw3" -j zone_docker_prerouting
-A PREROUTING -i ipsec0 -m comment --comment "!fw3" -j zone_VPN_prerouting
-A PREROUTING -i tun0 -m comment --comment "!fw3" -j zone_vpn_prerouting
-A PREROUTING -p tcp -j openclash
-A OUTPUT -d 127.0.*.*/32 -p udp -m owner ! --gid-owner 65534 -m comment --comment "OpenClash DNS Hijack" -m udp --dport 53 -j REDIRECT --to-ports 53
-A OUTPUT -d 127.0.*.*/32 -p tcp -m owner ! --gid-owner 65534 -m comment --comment "OpenClash DNS Hijack" -m tcp --dport 53 -j REDIRECT --to-ports 53
-A OUTPUT ! -d 127.0.*.*/8 -m addrtype --dst-type LOCAL -j DOCKER
-A OUTPUT -j openclash_output
-A POSTROUTING -j ts-postrouting
-A POSTROUTING -s 172.31.*.*/24 ! -o docker0 -j MASQUERADE
-A POSTROUTING -m comment --comment "!fw3: Custom postrouting rule chain" -j postrouting_rule
-A POSTROUTING -o br-lan -m comment --comment "!fw3" -j zone_lan_postrouting
-A POSTROUTING -o docker0 -m comment --comment "!fw3" -j zone_docker_postrouting
-A POSTROUTING -o ipsec0 -m comment --comment "!fw3" -j zone_VPN_postrouting
-A POSTROUTING -o tun0 -m comment --comment "!fw3" -j zone_vpn_postrouting
-A POSTROUTING -m comment --comment "OpenClash Bypass Gateway Compatible" -j openclash_post
-A openclash -m set --match-set localnetwork dst -j RETURN
-A openclash -m conntrack --ctdir REPLY -j RETURN
-A openclash -d 198.18.*.*/16 -p tcp -j REDIRECT --to-ports 7892
-A openclash -m set --match-set china_ip_route dst -m set ! --match-set china_ip_route_pass dst -j RETURN
-A openclash -p tcp -j REDIRECT --to-ports 7892
-A openclash_output -m owner --gid-owner 65534 -j RETURN
-A openclash_output -d 198.18.*.*/16 -p tcp -j REDIRECT --to-ports 7892
-A openclash_output -m set --match-set localnetwork dst -j RETURN
-A openclash_output -m conntrack --ctdir REPLY -j RETURN
-A openclash_output -m set --match-set china_ip_route dst -m set ! --match-set china_ip_route_pass dst -j RETURN
-A openclash_output -p tcp -j REDIRECT --to-ports 7892
-A openclash_post -m owner --gid-owner 65534 -j RETURN
-A openclash_post -m mark --mark 0x162 -j ACCEPT
-A openclash_post -m set --match-set localnetwork dst -j RETURN
-A openclash_post -m conntrack --ctdir REPLY -j RETURN
-A openclash_post -m addrtype ! --src-type LOCAL -j MASQUERADE
-A ts-postrouting -m mark --mark 0x40000/0xff0000 -j MASQUERADE
-A zone_VPN_postrouting -m comment --comment "!fw3: Custom VPN postrouting rule chain" -j postrouting_VPN_rule
-A zone_VPN_prerouting -m comment --comment "!fw3: Custom VPN prerouting rule chain" -j prerouting_VPN_rule
-A zone_docker_postrouting -m comment --comment "!fw3: Custom docker postrouting rule chain" -j postrouting_docker_rule
-A zone_docker_prerouting -m comment --comment "!fw3: Custom docker prerouting rule chain" -j prerouting_docker_rule
-A zone_lan_postrouting -j MINIUPNPD-POSTROUTING
-A zone_lan_postrouting -m comment --comment "!fw3: Custom lan postrouting rule chain" -j postrouting_lan_rule
-A zone_lan_prerouting -j MINIUPNPD
-A zone_lan_prerouting -m comment --comment "!fw3: Custom lan prerouting rule chain" -j prerouting_lan_rule
-A zone_vpn_postrouting -m comment --comment "!fw3: Custom vpn postrouting rule chain" -j postrouting_vpn_rule
-A zone_vpn_postrouting -m comment --comment "!fw3" -j MASQUERADE --mode fullcone
-A zone_vpn_prerouting -m comment --comment "!fw3: Custom vpn prerouting rule chain" -j prerouting_vpn_rule
-A zone_wan_postrouting -m comment --comment "!fw3: Custom wan postrouting rule chain" -j postrouting_wan_rule
-A zone_wan_postrouting -m comment --comment "!fw3" -j MASQUERADE --mode fullcone
-A zone_wan_prerouting -m comment --comment "!fw3: Custom wan prerouting rule chain" -j prerouting_wan_rule
COMMIT
# Completed on Mon Aug  3 15:19:39 2026

IPv4 Mangle chain

⎗
✓
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
# iptables-save -t mangle
# Generated by iptables-save v1.8.7 on Mon Aug  3 15:19:39 2026
*mangle
:PREROUTING ACCEPT [7742:7440059]
:INPUT ACCEPT [7740:7439995]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [6507:8420998]
:POSTROUTING ACCEPT [6511:8421540]
:openclash - [0:0]
:openclash_output - [0:0]
:openclash_upnp - [0:0]
-A PREROUTING -p udp -j openclash
-A OUTPUT -p udp -j openclash_output
-A openclash -m set --match-set localnetwork dst -j RETURN
-A openclash -m conntrack --ctdir REPLY -j RETURN
-A openclash -d 198.18.*.*/16 -p udp -j TPROXY --on-port 7895 --on-ip 0.0.*.* --tproxy-mark 0x162/0xffffffff
-A openclash -m set --match-set china_ip_route dst -m set ! --match-set china_ip_route_pass dst -j RETURN
-A openclash -p udp -j openclash_upnp
-A openclash -p udp -j TPROXY --on-port 7895 --on-ip 0.0.*.* --tproxy-mark 0x162/0xffffffff
-A openclash_output -m owner --gid-owner 65534 -j RETURN
-A openclash_output -m set --match-set localnetwork dst -j RETURN
-A openclash_output -m conntrack --ctdir REPLY -j RETURN
-A openclash_output -d 198.18.*.*/16 -p udp -j MARK --set-xmark 0x162/0xffffffff
-A openclash_output -m set --match-set china_ip_route dst -m set ! --match-set china_ip_route_pass dst -j RETURN
-A openclash_output -p udp -j MARK --set-xmark 0x162/0xffffffff
COMMIT
# Completed on Mon Aug  3 15:19:39 2026

IPv4 Filter chain

⎗
✓
  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
# iptables-save -t filter
# Generated by iptables-save v1.8.7 on Mon Aug  3 15:19:39 2026
*filter
:INPUT ACCEPT [0:0]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [0:0]
:DOCKER - [0:0]
:DOCKER-BRIDGE - [0:0]
:DOCKER-CT - [0:0]
:DOCKER-FORWARD - [0:0]
:DOCKER-INTERNAL - [0:0]
:DOCKER-MAN - [0:0]
:DOCKER-USER - [0:0]
:MINIUPNPD - [0:0]
:forwarding_VPN_rule - [0:0]
:forwarding_docker_rule - [0:0]
:forwarding_lan_rule - [0:0]
:forwarding_rule - [0:0]
:forwarding_vpn_rule - [0:0]
:forwarding_wan_rule - [0:0]
:input_VPN_rule - [0:0]
:input_docker_rule - [0:0]
:input_lan_rule - [0:0]
:input_rule - [0:0]
:input_vpn_rule - [0:0]
:input_wan_rule - [0:0]
:output_VPN_rule - [0:0]
:output_docker_rule - [0:0]
:output_lan_rule - [0:0]
:output_rule - [0:0]
:output_vpn_rule - [0:0]
:output_wan_rule - [0:0]
:reject - [0:0]
:syn_flood - [0:0]
:ts-forward - [0:0]
:ts-input - [0:0]
:zone_VPN_dest_ACCEPT - [0:0]
:zone_VPN_forward - [0:0]
:zone_VPN_input - [0:0]
:zone_VPN_output - [0:0]
:zone_VPN_src_ACCEPT - [0:0]
:zone_docker_dest_ACCEPT - [0:0]
:zone_docker_forward - [0:0]
:zone_docker_input - [0:0]
:zone_docker_output - [0:0]
:zone_docker_src_ACCEPT - [0:0]
:zone_lan_dest_ACCEPT - [0:0]
:zone_lan_forward - [0:0]
:zone_lan_input - [0:0]
:zone_lan_output - [0:0]
:zone_lan_src_ACCEPT - [0:0]
:zone_vpn_dest_ACCEPT - [0:0]
:zone_vpn_forward - [0:0]
:zone_vpn_input - [0:0]
:zone_vpn_output - [0:0]
:zone_vpn_src_ACCEPT - [0:0]
:zone_wan_dest_ACCEPT - [0:0]
:zone_wan_dest_DROP - [0:0]
:zone_wan_dest_REJECT - [0:0]
:zone_wan_forward - [0:0]
:zone_wan_input - [0:0]
:zone_wan_output - [0:0]
:zone_wan_src_REJECT - [0:0]
-A INPUT -d 198.18.*.*/16 -p icmp -m icmp --icmp-type 8 -m comment --comment "OpenClash ICMP INPUT REJECT" -j REJECT --reject-with icmp-admin-prohibited
-A INPUT -p udp -m udp --dport 443 -m comment --comment "OpenClash QUIC REJECT" -m set ! --match-set china_ip_route dst -j REJECT --reject-with icmp-port-unreachable
-A INPUT -m mark --mark 0x162 -m comment --comment "OpenClash TPROXY Accept" -j ACCEPT
-A INPUT -m conntrack --ctstate DNAT -m comment --comment "OpenClash Redirect Accept" -j ACCEPT
-A INPUT -j ts-input
-A INPUT -m policy --dir in --pol ipsec --proto esp -j ACCEPT
-A INPUT -i lo -m comment --comment "!fw3" -j ACCEPT
-A INPUT -m comment --comment "!fw3: Custom input rule chain" -j input_rule
-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment "!fw3" -j ACCEPT
-A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -m comment --comment "!fw3" -j syn_flood
-A INPUT -i br-lan -m comment --comment "!fw3" -j zone_lan_input
-A INPUT -i docker0 -m comment --comment "!fw3" -j zone_docker_input
-A INPUT -i ipsec0 -m comment --comment "!fw3" -j zone_VPN_input
-A INPUT -i tun0 -m comment --comment "!fw3" -j zone_vpn_input
-A FORWARD -d 198.18.*.*/16 -p icmp -m icmp --icmp-type 8 -m comment --comment "OpenClash ICMP FORWARD REJECT" -j REJECT --reject-with icmp-admin-prohibited
-A FORWARD -p udp -m udp --dport 443 -m comment --comment "OpenClash QUIC REJECT" -m set ! --match-set china_ip_route dst -j REJECT --reject-with icmp-port-unreachable
-A FORWARD -j ts-forward
-A FORWARD -m policy --dir out --pol ipsec --proto esp -j ACCEPT
-A FORWARD -m policy --dir in --pol ipsec --proto esp -j ACCEPT
-A FORWARD -j DOCKER-USER
-A FORWARD -j DOCKER-FORWARD
-A FORWARD -m comment --comment "!fw3: Custom forwarding rule chain" -j forwarding_rule
-A FORWARD -m comment --comment "!fw3: Traffic offloading" -m conntrack --ctstate RELATED,ESTABLISHED -j FLOWOFFLOAD
-A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment "!fw3" -j ACCEPT
-A FORWARD -i br-lan -m comment --comment "!fw3" -j zone_lan_forward
-A FORWARD -i docker0 -m comment --comment "!fw3" -j zone_docker_forward
-A FORWARD -i ipsec0 -m comment --comment "!fw3" -j zone_VPN_forward
-A FORWARD -i tun0 -m comment --comment "!fw3" -j zone_vpn_forward
-A FORWARD -m comment --comment "!fw3" -j reject
-A OUTPUT -d 198.18.*.*/16 -p icmp -m icmp --icmp-type 8 -m owner ! --gid-owner 65534 -m comment --comment "OpenClash ICMP OUTPUT REJECT" -j REJECT --reject-with icmp-admin-prohibited
-A OUTPUT -m policy --dir out --pol ipsec --proto esp -j ACCEPT
-A OUTPUT -o lo -m comment --comment "!fw3" -j ACCEPT
-A OUTPUT -m comment --comment "!fw3: Custom output rule chain" -j output_rule
-A OUTPUT -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment "!fw3" -j ACCEPT
-A OUTPUT -o br-lan -m comment --comment "!fw3" -j zone_lan_output
-A OUTPUT -o docker0 -m comment --comment "!fw3" -j zone_docker_output
-A OUTPUT -o ipsec0 -m comment --comment "!fw3" -j zone_VPN_output
-A OUTPUT -o tun0 -m comment --comment "!fw3" -j zone_vpn_output
-A DOCKER ! -i docker0 -o docker0 -j DROP
-A DOCKER-BRIDGE -o docker0 -j DOCKER
-A DOCKER-CT -o docker0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A DOCKER-FORWARD -j DOCKER-CT
-A DOCKER-FORWARD -j DOCKER-INTERNAL
-A DOCKER-FORWARD -j DOCKER-BRIDGE
-A DOCKER-FORWARD -i docker0 -j ACCEPT
-A DOCKER-MAN -i br-lan -o docker0 -j RETURN
-A DOCKER-MAN -o docker0 -m conntrack --ctstate RELATED,ESTABLISHED -j RETURN
-A DOCKER-MAN -o docker0 -m conntrack --ctstate INVALID,NEW -j DROP
-A DOCKER-MAN -j RETURN
-A DOCKER-USER -j DOCKER-MAN
-A forwarding_rule -i pppoe+ -j RETURN
-A forwarding_rule -o pppoe+ -j RETURN
-A forwarding_rule -i ppp+ -m conntrack --ctstate NEW -j ACCEPT
-A forwarding_rule -o ppp+ -m conntrack --ctstate NEW -j ACCEPT
-A reject -p tcp -m comment --comment "!fw3" -j REJECT --reject-with tcp-reset
-A reject -m comment --comment "!fw3" -j REJECT --reject-with icmp-port-unreachable
-A syn_flood -m limit --limit 25/sec --limit-burst 50 -m comment --comment "!fw3" -j RETURN
-A syn_flood -m comment --comment "!fw3" -j DROP
-A ts-forward -i tailscale0 -j MARK --set-xmark 0x40000/0xff0000
-A ts-forward -m mark --mark 0x40000/0xff0000 -j ACCEPT
-A ts-forward -s 100.64.*.*/10 -o tailscale0 -j DROP
-A ts-forward -o tailscale0 -j ACCEPT
-A ts-input -s 100.123.*.*/32 -i lo -j ACCEPT
-A ts-input -s 100.115.*.*/23 ! -i tailscale0 -j RETURN
-A ts-input -s 100.64.*.*/10 ! -i tailscale0 -j DROP
-A ts-input -i tailscale0 -j ACCEPT
-A ts-input -p udp -m udp --dport 41641 -j ACCEPT
-A zone_VPN_dest_ACCEPT -o ipsec0 -m comment --comment "!fw3" -j ACCEPT
-A zone_VPN_forward -m comment --comment "!fw3: Custom VPN forwarding rule chain" -j forwarding_VPN_rule
-A zone_VPN_forward -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port forwards" -j ACCEPT
-A zone_VPN_forward -m comment --comment "!fw3" -j zone_VPN_dest_ACCEPT
-A zone_VPN_input -m comment --comment "!fw3: Custom VPN input rule chain" -j input_VPN_rule
-A zone_VPN_input -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port redirections" -j ACCEPT
-A zone_VPN_input -m comment --comment "!fw3" -j zone_VPN_src_ACCEPT
-A zone_VPN_output -m comment --comment "!fw3: Custom VPN output rule chain" -j output_VPN_rule
-A zone_VPN_output -m comment --comment "!fw3" -j zone_VPN_dest_ACCEPT
-A zone_VPN_src_ACCEPT -i ipsec0 -m conntrack --ctstate NEW,UNTRACKED -m comment --comment "!fw3" -j ACCEPT
-A zone_docker_dest_ACCEPT -o docker0 -m comment --comment "!fw3" -j ACCEPT
-A zone_docker_forward -m comment --comment "!fw3: Custom docker forwarding rule chain" -j forwarding_docker_rule
-A zone_docker_forward -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port forwards" -j ACCEPT
-A zone_docker_forward -m comment --comment "!fw3" -j zone_docker_dest_ACCEPT
-A zone_docker_input -m comment --comment "!fw3: Custom docker input rule chain" -j input_docker_rule
-A zone_docker_input -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port redirections" -j ACCEPT
-A zone_docker_input -m comment --comment "!fw3" -j zone_docker_src_ACCEPT
-A zone_docker_output -m comment --comment "!fw3: Custom docker output rule chain" -j output_docker_rule
-A zone_docker_output -m comment --comment "!fw3" -j zone_docker_dest_ACCEPT
-A zone_docker_src_ACCEPT -i docker0 -m conntrack --ctstate NEW,UNTRACKED -m comment --comment "!fw3" -j ACCEPT
-A zone_lan_dest_ACCEPT -o br-lan -m comment --comment "!fw3" -j ACCEPT
-A zone_lan_forward -j MINIUPNPD
-A zone_lan_forward -m comment --comment "!fw3: Custom lan forwarding rule chain" -j forwarding_lan_rule
-A zone_lan_forward -m comment --comment "!fw3: Zone lan to wan forwarding policy" -j zone_wan_dest_ACCEPT
-A zone_lan_forward -m comment --comment "!fw3: Zone lan to vpn forwarding policy" -j zone_vpn_dest_ACCEPT
-A zone_lan_forward -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port forwards" -j ACCEPT
-A zone_lan_forward -m comment --comment "!fw3" -j zone_lan_dest_ACCEPT
-A zone_lan_input -m comment --comment "!fw3: Custom lan input rule chain" -j input_lan_rule
-A zone_lan_input -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port redirections" -j ACCEPT
-A zone_lan_input -m comment --comment "!fw3" -j zone_lan_src_ACCEPT
-A zone_lan_output -m comment --comment "!fw3: Custom lan output rule chain" -j output_lan_rule
-A zone_lan_output -m comment --comment "!fw3" -j zone_lan_dest_ACCEPT
-A zone_lan_src_ACCEPT -i br-lan -m conntrack --ctstate NEW,UNTRACKED -m comment --comment "!fw3" -j ACCEPT
-A zone_vpn_dest_ACCEPT -o tun0 -m conntrack --ctstate INVALID -m comment --comment "!fw3: Prevent NAT leakage" -j DROP
-A zone_vpn_dest_ACCEPT -o tun0 -m comment --comment "!fw3" -j ACCEPT
-A zone_vpn_forward -m comment --comment "!fw3: Custom vpn forwarding rule chain" -j forwarding_vpn_rule
-A zone_vpn_forward -m comment --comment "!fw3: Zone vpn to wan forwarding policy" -j zone_wan_dest_ACCEPT
-A zone_vpn_forward -m comment --comment "!fw3: Zone vpn to lan forwarding policy" -j zone_lan_dest_ACCEPT
-A zone_vpn_forward -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port forwards" -j ACCEPT
-A zone_vpn_forward -m comment --comment "!fw3" -j zone_vpn_dest_ACCEPT
-A zone_vpn_input -m comment --comment "!fw3: Custom vpn input rule chain" -j input_vpn_rule
-A zone_vpn_input -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port redirections" -j ACCEPT
-A zone_vpn_input -m comment --comment "!fw3" -j zone_vpn_src_ACCEPT
-A zone_vpn_output -m comment --comment "!fw3: Custom vpn output rule chain" -j output_vpn_rule
-A zone_vpn_output -m comment --comment "!fw3" -j zone_vpn_dest_ACCEPT
-A zone_vpn_src_ACCEPT -i tun0 -m conntrack --ctstate NEW,UNTRACKED -m comment --comment "!fw3" -j ACCEPT
-A zone_wan_forward -m comment --comment "!fw3: Custom wan forwarding rule chain" -j forwarding_wan_rule
-A zone_wan_forward -p esp -m comment --comment "!fw3: Allow-IPSec-ESP" -j zone_lan_dest_ACCEPT
-A zone_wan_forward -p udp -m udp --dport 500 -m comment --comment "!fw3: Allow-ISAKMP" -j zone_lan_dest_ACCEPT
-A zone_wan_forward -p tcp -m tcp --dport 22 -m comment --comment "!fw3: drop-wan-ssh" -j zone_wan_dest_DROP
-A zone_wan_forward -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port forwards" -j ACCEPT
-A zone_wan_forward -m comment --comment "!fw3" -j zone_wan_dest_REJECT
-A zone_wan_input -m comment --comment "!fw3: Custom wan input rule chain" -j input_wan_rule
-A zone_wan_input -p udp -m udp --dport 68 -m comment --comment "!fw3: Allow-DHCP-Renew" -j ACCEPT
-A zone_wan_input -p icmp -m icmp --icmp-type 8 -m comment --comment "!fw3: Allow-Ping" -j ACCEPT
-A zone_wan_input -p igmp -m comment --comment "!fw3: Allow-IGMP" -j ACCEPT
-A zone_wan_input -p udp -m udp --dport 500 -m comment --comment "!fw3: ike" -j ACCEPT
-A zone_wan_input -p udp -m udp --dport 4500 -m comment --comment "!fw3: ipsec" -j ACCEPT
-A zone_wan_input -p ah -m comment --comment "!fw3: ah" -j ACCEPT
-A zone_wan_input -p esp -m comment --comment "!fw3: esp" -j ACCEPT
-A zone_wan_input -p tcp -m tcp --dport 1194 -m comment --comment "!fw3: openvpn" -j ACCEPT
-A zone_wan_input -p udp -m udp --dport 1194 -m comment --comment "!fw3: openvpn" -j ACCEPT
-A zone_wan_input -p tcp -m tcp --dport 1723 -m comment --comment "!fw3: pptp" -j ACCEPT
-A zone_wan_input -p gre -m comment --comment "!fw3: gre" -j ACCEPT
-A zone_wan_input -p tcp -m tcp --dport 1688 -m comment --comment "!fw3: kms" -j ACCEPT
-A zone_wan_input -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port redirections" -j ACCEPT
-A zone_wan_input -m comment --comment "!fw3" -j zone_wan_src_REJECT
-A zone_wan_output -m comment --comment "!fw3: Custom wan output rule chain" -j output_wan_rule
-A zone_wan_output -m comment --comment "!fw3" -j zone_wan_dest_ACCEPT
COMMIT
# Completed on Mon Aug  3 15:19:39 2026

IPv6 NAT chain

⎗
✓
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
# ip6tables-save -t nat
# Generated by ip6tables-save v1.8.7 on Mon Aug  3 15:19:39 2026
*nat
:PREROUTING ACCEPT [36323:10473393]
:INPUT ACCEPT [537807:123933966]
:OUTPUT ACCEPT [5263:448433]
:POSTROUTING ACCEPT [5263:448433]
:DOCKER - [0:0]
:ts-postrouting - [0:0]
-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER
-A OUTPUT ! -d ::1/128 -m addrtype --dst-type LOCAL -j DOCKER
-A POSTROUTING -j ts-postrouting
-A ts-postrouting -m mark --mark 0x40000/0xff0000 -j MASQUERADE
COMMIT
# Completed on Mon Aug  3 15:19:39 2026

IPv6 Mangle chain

⎗
✓
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
# ip6tables-save -t mangle
# Generated by ip6tables-save v1.8.7 on Mon Aug  3 15:19:39 2026
*mangle
:PREROUTING ACCEPT [1106047:167004517]
:INPUT ACCEPT [736374:139586313]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [131748:10133593]
:POSTROUTING ACCEPT [243223:18168015]
COMMIT
# Completed on Mon Aug  3 15:19:39 2026

IPv6 Filter chain

⎗
✓
  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
# ip6tables-save -t filter
# Generated by ip6tables-save v1.8.7 on Mon Aug  3 15:19:39 2026
*filter
:INPUT ACCEPT [22:6816]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [24:5200]
:DOCKER - [0:0]
:DOCKER-BRIDGE - [0:0]
:DOCKER-CT - [0:0]
:DOCKER-FORWARD - [0:0]
:DOCKER-INTERNAL - [0:0]
:DOCKER-USER - [0:0]
:MINIUPNPD - [0:0]
:forwarding_VPN_rule - [0:0]
:forwarding_docker_rule - [0:0]
:forwarding_lan_rule - [0:0]
:forwarding_rule - [0:0]
:forwarding_vpn_rule - [0:0]
:forwarding_wan_rule - [0:0]
:input_VPN_rule - [0:0]
:input_docker_rule - [0:0]
:input_lan_rule - [0:0]
:input_rule - [0:0]
:input_vpn_rule - [0:0]
:input_wan_rule - [0:0]
:output_VPN_rule - [0:0]
:output_docker_rule - [0:0]
:output_lan_rule - [0:0]
:output_rule - [0:0]
:output_vpn_rule - [0:0]
:output_wan_rule - [0:0]
:reject - [0:0]
:syn_flood - [0:0]
:ts-forward - [0:0]
:ts-input - [0:0]
:zone_VPN_dest_ACCEPT - [0:0]
:zone_VPN_forward - [0:0]
:zone_VPN_input - [0:0]
:zone_VPN_output - [0:0]
:zone_VPN_src_ACCEPT - [0:0]
:zone_docker_dest_ACCEPT - [0:0]
:zone_docker_forward - [0:0]
:zone_docker_input - [0:0]
:zone_docker_output - [0:0]
:zone_docker_src_ACCEPT - [0:0]
:zone_lan_dest_ACCEPT - [0:0]
:zone_lan_forward - [0:0]
:zone_lan_input - [0:0]
:zone_lan_output - [0:0]
:zone_lan_src_ACCEPT - [0:0]
:zone_vpn_dest_ACCEPT - [0:0]
:zone_vpn_forward - [0:0]
:zone_vpn_input - [0:0]
:zone_vpn_output - [0:0]
:zone_vpn_src_ACCEPT - [0:0]
:zone_wan_dest_ACCEPT - [0:0]
:zone_wan_dest_DROP - [0:0]
:zone_wan_dest_REJECT - [0:0]
:zone_wan_forward - [0:0]
:zone_wan_input - [0:0]
:zone_wan_output - [0:0]
:zone_wan_src_REJECT - [0:0]
-A INPUT -j ts-input
-A INPUT -i lo -m comment --comment "!fw3" -j ACCEPT
-A INPUT -m comment --comment "!fw3: Custom input rule chain" -j input_rule
-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment "!fw3" -j ACCEPT
-A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -m comment --comment "!fw3" -j syn_flood
-A INPUT -i br-lan -m comment --comment "!fw3" -j zone_lan_input
-A INPUT -i docker0 -m comment --comment "!fw3" -j zone_docker_input
-A INPUT -i ipsec0 -m comment --comment "!fw3" -j zone_VPN_input
-A INPUT -i tun0 -m comment --comment "!fw3" -j zone_vpn_input
-A FORWARD -j ts-forward
-A FORWARD -j DOCKER-USER
-A FORWARD -j DOCKER-FORWARD
-A FORWARD -m comment --comment "!fw3: Custom forwarding rule chain" -j forwarding_rule
-A FORWARD -m comment --comment "!fw3: Traffic offloading" -m conntrack --ctstate RELATED,ESTABLISHED -j FLOWOFFLOAD
-A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment "!fw3" -j ACCEPT
-A FORWARD -i br-lan -m comment --comment "!fw3" -j zone_lan_forward
-A FORWARD -i docker0 -m comment --comment "!fw3" -j zone_docker_forward
-A FORWARD -i ipsec0 -m comment --comment "!fw3" -j zone_VPN_forward
-A FORWARD -i tun0 -m comment --comment "!fw3" -j zone_vpn_forward
-A FORWARD -m comment --comment "!fw3" -j reject
-A OUTPUT -o lo -m comment --comment "!fw3" -j ACCEPT
-A OUTPUT -m comment --comment "!fw3: Custom output rule chain" -j output_rule
-A OUTPUT -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment "!fw3" -j ACCEPT
-A OUTPUT -o br-lan -m comment --comment "!fw3" -j zone_lan_output
-A OUTPUT -o docker0 -m comment --comment "!fw3" -j zone_docker_output
-A OUTPUT -o ipsec0 -m comment --comment "!fw3" -j zone_VPN_output
-A OUTPUT -o tun0 -m comment --comment "!fw3" -j zone_vpn_output
-A DOCKER-FORWARD -j DOCKER-CT
-A DOCKER-FORWARD -j DOCKER-INTERNAL
-A DOCKER-FORWARD -j DOCKER-BRIDGE
-A reject -p tcp -m comment --comment "!fw3" -j REJECT --reject-with tcp-reset
-A reject -m comment --comment "!fw3" -j REJECT --reject-with icmp6-port-unreachable
-A syn_flood -m limit --limit 25/sec --limit-burst 50 -m comment --comment "!fw3" -j RETURN
-A syn_flood -m comment --comment "!fw3" -j DROP
-A ts-forward -i tailscale0 -j MARK --set-xmark 0x40000/0xff0000
-A ts-forward -m mark --mark 0x40000/0xff0000 -j ACCEPT
-A ts-forward -o tailscale0 -j ACCEPT
-A ts-input -s fd7a:115c:a1e0::b201:6dcf/128 -i lo -j ACCEPT
-A ts-input -i tailscale0 -j ACCEPT
-A ts-input -p udp -m udp --dport 41641 -j ACCEPT
-A zone_VPN_dest_ACCEPT -o ipsec0 -m comment --comment "!fw3" -j ACCEPT
-A zone_VPN_forward -m comment --comment "!fw3: Custom VPN forwarding rule chain" -j forwarding_VPN_rule
-A zone_VPN_forward -m comment --comment "!fw3" -j zone_VPN_dest_ACCEPT
-A zone_VPN_input -m comment --comment "!fw3: Custom VPN input rule chain" -j input_VPN_rule
-A zone_VPN_input -m comment --comment "!fw3" -j zone_VPN_src_ACCEPT
-A zone_VPN_output -m comment --comment "!fw3: Custom VPN output rule chain" -j output_VPN_rule
-A zone_VPN_output -m comment --comment "!fw3" -j zone_VPN_dest_ACCEPT
-A zone_VPN_src_ACCEPT -i ipsec0 -m conntrack --ctstate NEW,UNTRACKED -m comment --comment "!fw3" -j ACCEPT
-A zone_docker_dest_ACCEPT -o docker0 -m comment --comment "!fw3" -j ACCEPT
-A zone_docker_forward -m comment --comment "!fw3: Custom docker forwarding rule chain" -j forwarding_docker_rule
-A zone_docker_forward -m comment --comment "!fw3" -j zone_docker_dest_ACCEPT
-A zone_docker_input -m comment --comment "!fw3: Custom docker input rule chain" -j input_docker_rule
-A zone_docker_input -m comment --comment "!fw3" -j zone_docker_src_ACCEPT
-A zone_docker_output -m comment --comment "!fw3: Custom docker output rule chain" -j output_docker_rule
-A zone_docker_output -m comment --comment "!fw3" -j zone_docker_dest_ACCEPT
-A zone_docker_src_ACCEPT -i docker0 -m conntrack --ctstate NEW,UNTRACKED -m comment --comment "!fw3" -j ACCEPT
-A zone_lan_dest_ACCEPT -o br-lan -m comment --comment "!fw3" -j ACCEPT
-A zone_lan_forward -j MINIUPNPD
-A zone_lan_forward -m comment --comment "!fw3: Custom lan forwarding rule chain" -j forwarding_lan_rule
-A zone_lan_forward -m comment --comment "!fw3: Zone lan to wan forwarding policy" -j zone_wan_dest_ACCEPT
-A zone_lan_forward -m comment --comment "!fw3: Zone lan to vpn forwarding policy" -j zone_vpn_dest_ACCEPT
-A zone_lan_forward -m comment --comment "!fw3" -j zone_lan_dest_ACCEPT
-A zone_lan_input -m comment --comment "!fw3: Custom lan input rule chain" -j input_lan_rule
-A zone_lan_input -m comment --comment "!fw3" -j zone_lan_src_ACCEPT
-A zone_lan_output -m comment --comment "!fw3: Custom lan output rule chain" -j output_lan_rule
-A zone_lan_output -m comment --comment "!fw3" -j zone_lan_dest_ACCEPT
-A zone_lan_src_ACCEPT -i br-lan -m conntrack --ctstate NEW,UNTRACKED -m comment --comment "!fw3" -j ACCEPT
-A zone_vpn_dest_ACCEPT -o tun0 -m conntrack --ctstate INVALID -m comment --comment "!fw3: Prevent NAT leakage" -j DROP
-A zone_vpn_dest_ACCEPT -o tun0 -m comment --comment "!fw3" -j ACCEPT
-A zone_vpn_forward -m comment --comment "!fw3: Custom vpn forwarding rule chain" -j forwarding_vpn_rule
-A zone_vpn_forward -m comment --comment "!fw3: Zone vpn to wan forwarding policy" -j zone_wan_dest_ACCEPT
-A zone_vpn_forward -m comment --comment "!fw3: Zone vpn to lan forwarding policy" -j zone_lan_dest_ACCEPT
-A zone_vpn_forward -m comment --comment "!fw3" -j zone_vpn_dest_ACCEPT
-A zone_vpn_input -m comment --comment "!fw3: Custom vpn input rule chain" -j input_vpn_rule
-A zone_vpn_input -m comment --comment "!fw3" -j zone_vpn_src_ACCEPT
-A zone_vpn_output -m comment --comment "!fw3: Custom vpn output rule chain" -j output_vpn_rule
-A zone_vpn_output -m comment --comment "!fw3" -j zone_vpn_dest_ACCEPT
-A zone_vpn_src_ACCEPT -i tun0 -m conntrack --ctstate NEW,UNTRACKED -m comment --comment "!fw3" -j ACCEPT
-A zone_wan_forward -m comment --comment "!fw3: Custom wan forwarding rule chain" -j forwarding_wan_rule
-A zone_wan_forward -p ipv6-icmp -m icmp6 --icmpv6-type 128 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Forward" -j ACCEPT
-A zone_wan_forward -p ipv6-icmp -m icmp6 --icmpv6-type 129 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Forward" -j ACCEPT
-A zone_wan_forward -p ipv6-icmp -m icmp6 --icmpv6-type 1 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Forward" -j ACCEPT
-A zone_wan_forward -p ipv6-icmp -m icmp6 --icmpv6-type 2 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Forward" -j ACCEPT
-A zone_wan_forward -p ipv6-icmp -m icmp6 --icmpv6-type 3 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Forward" -j ACCEPT
-A zone_wan_forward -p ipv6-icmp -m icmp6 --icmpv6-type 4/0 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Forward" -j ACCEPT
-A zone_wan_forward -p ipv6-icmp -m icmp6 --icmpv6-type 4/1 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Forward" -j ACCEPT
-A zone_wan_forward -p esp -m comment --comment "!fw3: Allow-IPSec-ESP" -j zone_lan_dest_ACCEPT
-A zone_wan_forward -p udp -m udp --dport 500 -m comment --comment "!fw3: Allow-ISAKMP" -j zone_lan_dest_ACCEPT
-A zone_wan_forward -p tcp -m tcp --dport 22 -m comment --comment "!fw3: drop-wan-ssh" -j zone_wan_dest_DROP
-A zone_wan_forward -m comment --comment "!fw3" -j zone_wan_dest_REJECT
-A zone_wan_input -m comment --comment "!fw3: Custom wan input rule chain" -j input_wan_rule
-A zone_wan_input -s fc00::/6 -d fc00::/6 -p udp -m udp --dport 546 -m comment --comment "!fw3: Allow-DHCPv6" -j ACCEPT
-A zone_wan_input -s fe80::/10 -p ipv6-icmp -m icmp6 --icmpv6-type 130/0 -m comment --comment "!fw3: Allow-MLD" -j ACCEPT
-A zone_wan_input -s fe80::/10 -p ipv6-icmp -m icmp6 --icmpv6-type 131/0 -m comment --comment "!fw3: Allow-MLD" -j ACCEPT
-A zone_wan_input -s fe80::/10 -p ipv6-icmp -m icmp6 --icmpv6-type 132/0 -m comment --comment "!fw3: Allow-MLD" -j ACCEPT
-A zone_wan_input -s fe80::/10 -p ipv6-icmp -m icmp6 --icmpv6-type 143/0 -m comment --comment "!fw3: Allow-MLD" -j ACCEPT
-A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 128 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT
-A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 129 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT
-A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 1 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT
-A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 2 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT
-A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 3 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT
-A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 4/0 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT
-A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 4/1 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT
-A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 133 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT
-A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 135 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT
-A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 134 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT
-A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 136 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT
-A zone_wan_input -p udp -m udp --dport 500 -m comment --comment "!fw3: ike" -j ACCEPT
-A zone_wan_input -p udp -m udp --dport 4500 -m comment --comment "!fw3: ipsec" -j ACCEPT
-A zone_wan_input -p ah -m comment --comment "!fw3: ah" -j ACCEPT
-A zone_wan_input -p esp -m comment --comment "!fw3: esp" -j ACCEPT
-A zone_wan_input -p tcp -m tcp --dport 1194 -m comment --comment "!fw3: openvpn" -j ACCEPT
-A zone_wan_input -p udp -m udp --dport 1194 -m comment --comment "!fw3: openvpn" -j ACCEPT
-A zone_wan_input -p tcp -m tcp --dport 1723 -m comment --comment "!fw3: pptp" -j ACCEPT
-A zone_wan_input -p gre -m comment --comment "!fw3: gre" -j ACCEPT
-A zone_wan_input -p tcp -m tcp --dport 1688 -m comment --comment "!fw3: kms" -j ACCEPT
-A zone_wan_input -m comment --comment "!fw3" -j zone_wan_src_REJECT
-A zone_wan_output -m comment --comment "!fw3: Custom wan output rule chain" -j output_wan_rule
-A zone_wan_output -m comment --comment "!fw3" -j zone_wan_dest_ACCEPT
COMMIT
# Completed on Mon Aug  3 15:19:39 2026

IPSET状态

⎗
✓
  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
# ipset list
Name: cn
Type: hash:net
Revision: 7
Header: family inet hashsize 4096 maxelem 65536 bucketsize 12 initval 0x58d0115c
Size in memory: 256128
References: 0
Number of entries: 8618
Members:
43.246.*.*/22
43.248.*.*/22
103.3.*.*/22
103.131.*.*/22
45.249.*.*/22
43.226.*.*/22
103.135.*.*/22
203.25.*.*/24
101.96.*.*/22
202.21.*.*/22
...

Name: ct
Type: hash:net
Revision: 7
Header: family inet hashsize 1024 maxelem 65536 bucketsize 12 initval 0x6d91cf73
Size in memory: 59880
References: 0
Number of entries: 1962
Members:
42.88.*.*/13
203.25.*.*/24
203.17.*.*/24
203.32.*.*/24
203.33.*.*/23
203.26.*.*/24
117.64.*.*/13
116.0.*.*/21
49.128.*.*/23
103.218.*.*/22
...

Name: cnc
Type: hash:net
Revision: 7
Header: family inet hashsize 1024 maxelem 65536 bucketsize 12 initval 0x9369d808
Size in memory: 32520
References: 0
Number of entries: 915
Members:
120.52.*.*/16
157.156.*.*/16
103.73.*.*/22
221.7.*.*/19
221.195.*.*/16
103.211.*.*/22
103.5.*.*/22
203.135.*.*/20
124.64.*.*/15
103.220.*.*/22
...

Name: cmcc
Type: hash:net
Revision: 7
Header: family inet hashsize 1024 maxelem 65536 bucketsize 12 initval 0xf59a827b
Size in memory: 3096
References: 0
Number of entries: 55
Members:
103.20.*.*/22
223.96.*.*/12
45.125.*.*/22
103.193.*.*/22
112.0.*.*/10
45.124.*.*/22
36.128.*.*/10
223.121.*.*/17
103.21.*.*/22
103.203.*.*/22
...

Name: crtc
Type: hash:net
Revision: 7
Header: family inet hashsize 1024 maxelem 65536 bucketsize 12 initval 0xf0cf2117
Size in memory: 1224
References: 0
Number of entries: 16
Members:
123.64.*.*/11
103.3.*.*/22
43.247.*.*/22
115.180.*.*/15
211.98.*.*/16
101.144.*.*/12
118.204.*.*/14
110.96.*.*/11
222.32.*.*/11
120.90.*.*/15
...

Name: cernet
Type: hash:net
Revision: 7
Header: family inet hashsize 1024 maxelem 65536 bucketsize 12 initval 0xb2db1d01
Size in memory: 7992
References: 0
Number of entries: 171
Members:
202.113.*.*/20
218.192.*.*/16
218.196.*.*/14
180.201.*.*/16
202.114.*.*/17
59.77.*.*/16
125.222.*.*/15
222.200.*.*/14
58.154.*.*/15
111.114.*.*/15
...

Name: gwbn
Type: hash:net
Revision: 7
Header: family inet hashsize 1024 maxelem 65536 bucketsize 12 initval 0xc99ce431
Size in memory: 12408
References: 0
Number of entries: 290
Members:
43.242.*.*/22
103.62.*.*/22
103.203.*.*/22
103.222.*.*/22
59.152.*.*/22
103.222.*.*/22
203.207.*.*/20
45.124.*.*/22
45.254.*.*/22
103.204.*.*/22
...

Name: othernet
Type: hash:net
Revision: 7
Header: family inet hashsize 1024 maxelem 65536 bucketsize 12 initval 0xc5b4f5da
Size in memory: 138168
References: 0
Number of entries: 5209
Members:
103.46.*.*/22
103.217.*.*/22
103.230.*.*/22
45.250.*.*/22
103.99.*.*/22
103.146.*.*/23
146.196.*.*/22
103.92.*.*/22
103.102.*.*/22
160.202.*.*/22
...

Name: music
Type: hash:ip
Revision: 6
Header: family inet hashsize 1024 maxelem 65536 bucketsize 12 initval 0xbb42cf0d
Size in memory: 216
References: 0
Number of entries: 0
Members:

Name: mwan3_connected_v4
Type: hash:net
Revision: 7
Header: family inet hashsize 1024 maxelem 65536 bucketsize 12 initval 0x6bf5c706
Size in memory: 648
References: 1
Number of entries: 4
Members:
192.168.*.*/24
172.31.*.*/24
224.0.*.*/3
127.0.*.*/8

Name: mwan3_connected_v6
Type: hash:net
Revision: 7
Header: family inet6 hashsize 1024 maxelem 65536 bucketsize 12 initval 0xe6e9b0c1
Size in memory: 1384
References: 1
Number of entries: 2
Members:
fd24:c9bf:4ba::/64
fe80::/64

Name: mwan3_source_v6
Type: hash:net
Revision: 7
Header: family inet6 hashsize 1024 maxelem 65536 bucketsize 12 initval 0xd261f888
Size in memory: 1312
References: 0
Number of entries: 1
Members:
fd24:c9bf:4ba::1

Name: mwan3_dynamic_v4
Type: hash:net
Revision: 7
Header: family inet hashsize 1024 maxelem 65536 bucketsize 12 initval 0x0e39f4e5
Size in memory: 456
References: 1
Number of entries: 0
Members:

Name: mwan3_dynamic_v6
Type: hash:net
Revision: 7
Header: family inet6 hashsize 1024 maxelem 65536 bucketsize 12 initval 0x027d39f3
Size in memory: 1240
References: 1
Number of entries: 0
Members:

Name: mwan3_custom_v4
Type: hash:net
Revision: 7
Header: family inet hashsize 1024 maxelem 65536 bucketsize 12 initval 0x9eb02d61
Size in memory: 456
References: 1
Number of entries: 0
Members:

Name: mwan3_custom_v6
Type: hash:net
Revision: 7
Header: family inet6 hashsize 1024 maxelem 65536 bucketsize 12 initval 0x3c3aecfb
Size in memory: 1240
References: 1
Number of entries: 0
Members:

Name: china_ip_route
Type: hash:net
Revision: 7
Header: family inet hashsize 1024 maxelem 1000000 bucketsize 12 initval 0x2afe8502
Size in memory: 456
References: 6
Number of entries: 0
Members:

Name: china_ip_route_pass
Type: hash:net
Revision: 7
Header: family inet hashsize 1024 maxelem 1000000 bucketsize 12 initval 0xa8e3d2e2
Size in memory: 456
References: 4
Number of entries: 0
Members:

Name: localnetwork
Type: hash:net
Revision: 7
Header: family inet hashsize 1024 maxelem 65536 bucketsize 12 initval 0x8118f3c7
Size in memory: 936
References: 5
Number of entries: 10
Members:
192.168.*.*/24
192.168.*.*/16
169.254.*.*/16
10.0.*.*/8
100.64.*.*/10
127.0.*.*/8
224.0.*.*/4
172.16.*.*/12
0.0.*.*/8
240.0.*.*/4

Name: mwan3_connected
Type: list:set
Revision: 3
Header: size 8
Size in memory: 368
References: 0
Number of entries: 6
Members:
mwan3_connected_v4
mwan3_connected_v6
mwan3_dynamic_v4
mwan3_dynamic_v6
mwan3_custom_v4
mwan3_custom_v6

路由表状态

IPv4

⎗
✓
1
2
3
4
5
6
# route -n
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.*.*         192.168.*.*     0.0.*.*         UG    0      0        0 br-lan
172.31.*.*      0.0.*.*         255.255.*.*   U     0      0        0 docker0
192.168.*.*     0.0.*.*         255.255.*.*   U     0      0        0 br-lan
⎗
✓
1
2
3
4
# ip route list
default via 192.168.*.* dev br-lan proto static 
172.31.*.*/24 dev docker0 proto kernel scope link src 172.31.*.* linkdown 
192.168.*.*/24 dev br-lan proto kernel scope link src 192.168.*.*
⎗
✓
1
2
# ip route list table 354
local default dev lo scope host
⎗
✓
1
2
3
4
5
6
7
8
9
# ip rule show
0:  from all lookup local
5209:   from all fwmark 0x162 lookup 354
5210:   from all fwmark 0x80000/0xff0000 lookup main
5230:   from all fwmark 0x80000/0xff0000 lookup default
5250:   from all fwmark 0x80000/0xff0000 unreachable
5270:   from all lookup 52
32766:  from all lookup main
32767:  from all lookup default

IPv6

⎗
✓
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
# route -A inet6
Kernel IPv6 routing table
Destination                                 Next Hop                                Flags Metric Ref    Use Iface
fd7a:115c:a1e0::53/128                      ::                                      U     1024   1        0 tailscale0
fd7a:115c:a1e0::/48                         ::                                      U     1024   1        0 tailscale0
::/0                                        ::                                      !n    -1     1        0 lo      
::/0                                        ::                                      !n    -1     1        0 lo      
fd24:c9bf:4ba::/64                          ::                                      U     1024   1        0 br-lan  
fd24:c9bf:4ba::/48                          ::                                      !n    2147483647 3        0 lo      
fd7a:115c:a1e0::b201:6dcf/128               ::                                      U     256    1        0 tailscale0
fe80::/64                                   ::                                      U     256    5        0 br-lan  
fe80::/64                                   ::                                      U     256    1        0 tailscale0
::/0                                        ::                                      !n    -1     1        0 lo      
::1/128                                     ::                                      Un    0      6        0 lo      
fd24:c9bf:4ba::/128                         ::                                      Un    0      3        0 br-lan  
fd24:c9bf:4ba::1/128                        ::                                      Un    0      5        0 br-lan  
fd7a:115c:a1e0::b201:6dcf/128               ::                                      Un    0      2        0 tailscale0
fe80::/128                                  ::                                      Un    0      4        0 br-lan  
fe80::/128                                  ::                                      Un    0      3        0 tailscale0
fe80::*:*:*:ebc/128                ::                                      Un    0      2        0 tailscale0
fe80::*:*:*:7b14/128                ::                                      Un    0      7        0 br-lan  
ff00::/8                                    ::                                      U     256    6        0 br-lan  
ff00::/8                                    ::                                      U     256    5        0 tailscale0
::/0                                        ::                                      !n    -1     1        0 lo
⎗
✓
1
2
3
4
5
6
# ip -6 route list
fd24:c9bf:4ba::/64 dev br-lan proto static metric 1024 pref medium
unreachable fd24:c9bf:4ba::/48 dev lo proto static metric 2147483647 pref medium
fd7a:115c:a1e0::b201:6dcf dev tailscale0 proto kernel metric 256 pref medium
fe80::/64 dev br-lan proto kernel metric 256 pref medium
fe80::/64 dev tailscale0 proto kernel metric 256 pref medium
⎗
✓
1
# ip -6 route list table 354
⎗
✓
1
2
3
4
5
6
7
8
9
# ip -6 rule show
0:  from all lookup local
5210:   from all fwmark 0x80000/0xff0000 lookup main
5230:   from all fwmark 0x80000/0xff0000 lookup default
5250:   from all fwmark 0x80000/0xff0000 unreachable
5270:   from all lookup 52
32766:  from all lookup main
4200000001: from all iif lo failed_policy
4200000011: from all iif br-lan failed_policy

端口占用状态

⎗
✓
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
# netstat -nlp | grep clash
tcp        0      0 :::7874                 :::*                    LISTEN      18919/clash
tcp        0      0 :::7892                 :::*                    LISTEN      18919/clash
tcp        0      0 :::7893                 :::*                    LISTEN      18919/clash
tcp        0      0 :::7895                 :::*                    LISTEN      18919/clash
tcp        0      0 :::7890                 :::*                    LISTEN      18919/clash
tcp        0      0 :::7891                 :::*                    LISTEN      18919/clash
tcp        0      0 :::9090                 :::*                    LISTEN      18919/clash
udp        0      0 :::7874                 :::*                                18919/clash
udp        0      0 :::7891                 :::*                                18919/clash
udp        0      0 :::7892                 :::*                                18919/clash
udp        0      0 :::7893                 :::*                                18919/clash
udp        0      0 :::7895                 :::*                                18919/clash

网络接口状态

⎗
✓
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
# ip link show && ip addr show | grep -E 'inet |utun'
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN mode DEFAULT group default qlen 1000
    link/loopback 00:*:*:*:00:00 brd 00:00:00:00:00:00
2: sit0@NONE: <NOARP> mtu 1480 qdisc noop state DOWN mode DEFAULT group default qlen 1000
    link/sit 0.0.*.* brd 0.0.*.*
3: ip6tnl0@NONE: <NOARP> mtu 1452 qdisc noop state DOWN mode DEFAULT group default qlen 1000
    link/tunnel6 :: brd :: permaddr b6c1:fddd:87eb::
4: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq master br-lan state UP mode DEFAULT group default qlen 1000
    link/ether fc:*:*:*:7b:14 brd ff:ff:ff:ff:ff:ff
5: dummy0: <BROADCAST,NOARP> mtu 1500 qdisc noop state DOWN mode DEFAULT group default qlen 1000
    link/ether 36:*:*:*:4c:85 brd ff:ff:ff:ff:ff:ff
6: gre0@NONE: <NOARP> mtu 1476 qdisc noop state DOWN mode DEFAULT group default qlen 1000
    link/gre 0.0.*.* brd 0.0.*.*
7: gretap0@NONE: <BROADCAST,MULTICAST> mtu 1462 qdisc noop state DOWN mode DEFAULT group default qlen 1000
    link/ether 00:*:*:*:00:00 brd ff:ff:ff:ff:ff:ff
8: erspan0@NONE: <BROADCAST,MULTICAST> mtu 1450 qdisc noop state DOWN mode DEFAULT group default qlen 1000
    link/ether 00:*:*:*:00:00 brd ff:ff:ff:ff:ff:ff
9: teql0: <NOARP> mtu 1500 qdisc noop state DOWN mode DEFAULT group default qlen 100
    link/void 
10: wlan0: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN mode DEFAULT group default qlen 1000
    link/ether fc:*:*:*:7b:13 brd ff:ff:ff:ff:ff:ff
11: br-lan: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP mode DEFAULT group default qlen 1000
    link/ether fc:*:*:*:7b:14 brd ff:ff:ff:ff:ff:ff
18: tailscale0: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1280 qdisc pfifo_fast state UNKNOWN mode DEFAULT group default qlen 500
    link/none 
19: docker0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc noqueue state DOWN mode DEFAULT group default 
    link/ether 56:*:*:*:98:6d brd ff:ff:ff:ff:ff:ff
    inet 127.0.*.*/8 scope host lo
    inet 192.168.*.*/24 brd 192.168.*.* scope global br-lan
    inet 100.123.*.*/32 scope global tailscale0
    inet 172.31.*.*/24 brd 172.31.*.* scope global docker0

测试本机DNS查询(www.baidu.com)

⎗
✓
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
# nslookup www.baidu.com
Server:     127.0.*.*
Address:    127.0.*.*:53

www.baidu.com   canonical name = www.a.shifen.com
Name:   www.a.shifen.com
Address: 183.240.*.*
Name:   www.a.shifen.com
Address: 111.45.*.*

测试内核DNS查询(www.instagram.com)

⎗
✓
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
# openclash_debug_dns.lua www.instagram.com
Status: 0
TC: false
RD: true
RA: true
AD: false
CD: false

Question: 
  Name: www.instagram.com.
  Qtype: 1
  Qclass: 1

Answer: 
  TTL: 2247
  data: z-p42-instagram.c10r.instagram.com.
  name: www.instagram.com.
  type: 5

  TTL: 60
  data: 57.144.*.*
  name: z-p42-instagram.c10r.instagram.com.
  type: 1

Status: 0
TC: false
RD: true
RA: true
AD: false
CD: false

Question: 
  Name: www.instagram.com.
  Qtype: 28
  Qclass: 1

Answer: 
  TTL: 2246
  data: z-p42-instagram.c10r.instagram.com.
  name: www.instagram.com.
  type: 5

  TTL: 60
  data: 2a03:*:*:*:face:b00c:0:4420
  name: z-p42-instagram.c10r.instagram.com.
  type: 28

DNS 解析文件

Dnsmasq 当前默认 resolv 文件

⎗
✓
1
/tmp/resolv.conf.d/resolv.conf.auto

/tmp/resolv.conf.d/resolv.conf.auto

⎗
✓
1
2
3
4
# cat /tmp/resolv.conf.d/resolv.conf.auto
# Interface lan
nameserver 119.29.*.*
nameserver 8.8.*.*

测试本机网络连接(www.baidu.com)

⎗
✓
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
# curl -SsI -m 5 www.baidu.com
HTTP/1.1 200 OK
Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform
Content-Length: 0
Content-Type: text/html
Pragma: no-cache
Server: bfe
Date: Mon, 03 Aug 2026 07:19:41 GMT

测试本机网络下载(raw.githubusercontent.com)

⎗
✓
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
# curl -SsIL -m 3 --retry 2 https://raw.githubusercontent.com/vernesong/OpenClash/refs/heads/master/LICENSE
HTTP/1.1 200 OK
Connection: keep-alive
Content-Length: 1071
Cache-Control: max-age=300
Content-Security-Policy: default-src 'none'; style-src 'unsafe-inline'; sandbox
Content-Type: text/plain; charset=utf-8
ETag: "3cab33082d54dd519fe8c69e1075838506ba663312d8edc06a11635036b81276"
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
X-Frame-Options: deny
X-XSS-Protection: 1; mode=block
X-GitHub-Request-Id: 1570:23B79E:614B19:BAFA2C:6A702726
x-github-edge-region: japaneast
Accept-Ranges: bytes
Date: Mon, 03 Aug 2026 07:19:42 GMT
Via: 1.1 varnish
X-Served-By: cache-nrt-rjtf7700054-NRT
X-Cache: HIT
X-Cache-Hits: 0
X-Timer: S1785741583.800894,VS0,VE155
Vary: Authorization,Accept-Encoding
Access-Control-Allow-Origin: *
Cross-Origin-Resource-Policy: cross-origin
X-Fastly-Request-ID: 517ba3f0e258cef1f9310facb2d40b87302c8d64
Expires: Mon, 03 Aug 2026 07:24:42 GMT
Source-Age: 0

Mihomo API 健康检查

⎗
✓
1
2
# curl -Ss -m 3 -H "Authorization: Bearer [password]" http://127.0.*.*:[cn_port]/version
{"meta":true,"version":"alpha-g9ae1cc2"}

最近运行日志 (切换为Debug模式)

⎗
✓
  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
# tail -n 100 /tmp/openclash.log
time="2026-08-03T15:18:33.236365072+08:00" level=info msg="[TCP] 192.168.*.*:36890 --> api-ipv4.ip.sb:443 match RuleSet(geolocation-!cn) using 🌐 非中国[🇭🇰 VIP-香港 - Fast Network 01]"
time="2026-08-03T15:18:33.255418627+08:00" level=info msg="[TCP] 192.168.*.*:40886 --> api.ipify.org:443 match RuleSet(geolocation-!cn) using 🌐 非中国[🇭🇰 VIP-香港 - Fast Network 01]"
time="2026-08-03T15:18:33.386255889+08:00" level=info msg="[TCP] 192.168.*.*:43392 --> self.events.data.microsoft.com:443 match RuleSet(geolocation-!cn) using 🌐 非中国[🇭🇰 VIP-香港 - Fast Network 01]"
time="2026-08-03T15:18:33.706417085+08:00" level=info msg="[TCP] 192.168.*.*:43478 --> 192.168.*.*:9090 match RuleSet(private-ip) using 🏠 私有网络[DIRECT]"
time="2026-08-03T15:18:33.711230654+08:00" level=info msg="[TCP] 192.168.*.*:43486 --> 192.168.*.*:9090 match RuleSet(private-ip) using 🏠 私有网络[DIRECT]"
time="2026-08-03T15:18:33.966292531+08:00" level=info msg="[TCP] 192.168.*.*:57410 --> www.youtube.com:443 match RuleSet(youtube) using 📹 油管视频[🇭🇰 VIP-香港 - Fast Network 01]"
time="2026-08-03T15:18:34.095533021+08:00" level=info msg="[TCP] 192.168.*.*:36898 --> api-ipv4.ip.sb:443 match RuleSet(geolocation-!cn) using 🌐 非中国[🇭🇰 VIP-香港 - Fast Network 01]"
time="2026-08-03T15:18:34.282337787+08:00" level=info msg="[TCP] 192.168.*.*:43476 --> functional.events.data.microsoft.com:443 match RuleSet(geolocation-!cn) using 🌐 非中国[🇭🇰 VIP-香港 - Fast Network 01]"
time="2026-08-03T15:18:35.142305789+08:00" level=info msg="[TCP] 192.168.*.*:47796 --> www.baidu.com:443 match RuleSet(geolocation-cn) using 🔒 国内服务[DIRECT]"
time="2026-08-03T15:18:35.193689406+08:00" level=info msg="[TCP] 192.168.*.*:59452 --> s1.music.126.net:443 match RuleSet(cn) using 🔒 国内服务[DIRECT]"
time="2026-08-03T15:18:35.637338584+08:00" level=info msg="[TCP] 192.168.*.*:41704 --> github.com:443 match RuleSet(github) using 🐱 Github[🇭🇰 VIP-香港 - Fast Network 01]"
2026/08/03 15:18:35 Unsolicited response received on idle HTTP channel starting with "<h1>Not Found</h1>"; err=<nil>
time="2026-08-03T15:18:35.931223245+08:00" level=info msg="[TCP] 192.168.*.*:43502 --> 192.168.*.*:80 match RuleSet(private-ip) using 🏠 私有网络[DIRECT]"
time="2026-08-03T15:18:35.937414697+08:00" level=info msg="[TCP] 192.168.*.*:43508 --> 192.168.*.*:80 match RuleSet(private-ip) using 🏠 私有网络[DIRECT]"
time="2026-08-03T15:18:35.963130445+08:00" level=info msg="[TCP] 192.168.*.*:40492 --> 149.154.*.*:443 match RuleSet(telegram-ip) using 📲 电报消息[🇭🇰 VIP-香港 - Fast Network 01]"
time="2026-08-03T15:18:36.005934868+08:00" level=info msg="[TCP] 192.168.*.*:40508 --> [2001:*:*:*::a]:443 match RuleSet(telegram-ip) using 📲 电报消息[🇭🇰 VIP-香港 - Fast Network 01]"
time="2026-08-03T15:18:36.109375354+08:00" level=info msg="[TCP] 192.168.*.*:43516 --> avatars3.githubusercontent.com:443 match RuleSet(github) using 🐱 Github[🇭🇰 VIP-香港 - Fast Network 01]"
time="2026-08-03T15:18:36.125274784+08:00" level=info msg="[TCP] 192.168.*.*:57416 --> www.youtube.com:443 match RuleSet(youtube) using 📹 油管视频[🇭🇰 VIP-香港 - Fast Network 01]"
time="2026-08-03T15:18:36.149628691+08:00" level=info msg="[TCP] 192.168.*.*:43528 --> avatars2.githubusercontent.com:443 match RuleSet(github) using 🐱 Github[🇭🇰 VIP-香港 - Fast Network 01]"
time="2026-08-03T15:18:36.247632025+08:00" level=info msg="[TCP] 192.168.*.*:43548 --> 192.168.*.*:80 match RuleSet(private-ip) using 🏠 私有网络[DIRECT]"
time="2026-08-03T15:18:36.252108822+08:00" level=info msg="[TCP] 192.168.*.*:43532 --> 192.168.*.*:80 match RuleSet(private-ip) using 🏠 私有网络[DIRECT]"
time="2026-08-03T15:18:36.257166032+08:00" level=info msg="[TCP] 192.168.*.*:36246 --> raw.githubusercontent.com:443 match RuleSet(github) using 🐱 Github[🇭🇰 VIP-香港 - Fast Network 01]"
time="2026-08-03T15:18:36.594345690+08:00" level=info msg="[TCP] 192.168.*.*:43558 --> 192.168.*.*:9090 match RuleSet(private-ip) using 🏠 私有网络[DIRECT]"
time="2026-08-03T15:18:36.595542061+08:00" level=info msg="[TCP] 192.168.*.*:43568 --> 192.168.*.*:9090 match RuleSet(private-ip) using 🏠 私有网络[DIRECT]"
time="2026-08-03T15:18:36.605728862+08:00" level=info msg="[TCP] 192.168.*.*:43580 --> 192.168.*.*:9090 match RuleSet(private-ip) using 🏠 私有网络[DIRECT]"
time="2026-08-03T15:18:37.348192945+08:00" level=info msg="[TCP] 192.168.*.*:43590 --> avatars1.githubusercontent.com:443 match RuleSet(github) using 🐱 Github[🇭🇰 VIP-香港 - Fast Network 01]"
time="2026-08-03T15:18:37.934628428+08:00" level=info msg="[TCP] 192.168.*.*:43602 --> avatars.githubusercontent.com:443 match RuleSet(github) using 🐱 Github[🇭🇰 VIP-香港 - Fast Network 01]"
time="2026-08-03T15:18:38.697803093+08:00" level=info msg="[TCP] 192.168.*.*:60584 --> vip.zhaogw.kdns.fr:443 match Match using 🐟 漏网之鱼[🇭🇰 VIP-香港 - Fast Network 01]"
time="2026-08-03T15:18:38.922816060+08:00" level=info msg="[TCP] 192.168.*.*:43620 --> [2001:*:*:*::a]:443 match RuleSet(telegram-ip) using 📲 电报消息[🇭🇰 VIP-香港 - Fast Network 01]"
time="2026-08-03T15:18:38.923497230+08:00" level=info msg="[TCP] 192.168.*.*:43634 --> [2001:*:*:*::a]:443 match RuleSet(telegram-ip) using 📲 电报消息[🇭🇰 VIP-香港 - Fast Network 01]"
time="2026-08-03T15:18:38.969961854+08:00" level=info msg="[TCP] 192.168.*.*:43642 --> x.com:443 match RuleSet(geolocation-!cn) using 🌐 非中国[🇭🇰 VIP-香港 - Fast Network 01]"
time="2026-08-03T15:18:39.701971660+08:00" level=info msg="[TCP] 192.168.*.*:43608 --> avatars.githubusercontent.com:443 match RuleSet(github) using 🐱 Github[🇭🇰 VIP-香港 - Fast Network 01]"
time="2026-08-03T15:18:40.771692784+08:00" level=info msg="[TCP] 192.168.*.*:43650 --> avatars0.githubusercontent.com:443 match RuleSet(github) using 🐱 Github[🇭🇰 VIP-香港 - Fast Network 01]"
time="2026-08-03T15:18:42.473651762+08:00" level=info msg="[TCP] 192.168.*.*:53742 --> raw.githubusercontent.com:443 match RuleSet(github) using 🐱 Github[🇭🇰 VIP-香港 - Fast Network 01]"
time="2026-08-03T15:18:42.486778966+08:00" level=info msg="[TCP] 192.168.*.*:53748 --> raw.githubusercontent.com:443 match RuleSet(github) using 🐱 Github[🇭🇰 VIP-香港 - Fast Network 01]"
time="2026-08-03T15:18:43.324417154+08:00" level=info msg="[TCP] 192.168.*.*:49132 --> 192.168.*.*:80 match RuleSet(private-ip) using 🏠 私有网络[DIRECT]"
time="2026-08-03T15:18:43.482767908+08:00" level=info msg="[TCP] 192.168.*.*:53758 --> raw.githubusercontent.com:443 match RuleSet(github) using 🐱 Github[🇭🇰 VIP-香港 - Fast Network 01]"
time="2026-08-03T15:18:43.725366875+08:00" level=info msg="[TCP] 192.168.*.*:53762 --> raw.githubusercontent.com:443 match RuleSet(github) using 🐱 Github[🇭🇰 VIP-香港 - Fast Network 01]"
time="2026-08-03T15:18:43.836041675+08:00" level=info msg="[TCP] 192.168.*.*:42908 --> s1.music.126.net:443 match RuleSet(cn) using 🔒 国内服务[DIRECT]"
time="2026-08-03T15:18:43.931449712+08:00" level=info msg="[TCP] 192.168.*.*:49452 --> www.baidu.com:443 match RuleSet(geolocation-cn) using 🔒 国内服务[DIRECT]"
time="2026-08-03T15:18:43.940914298+08:00" level=info msg="[TCP] 192.168.*.*:33940 --> myip.ipip.net:80 match RuleSet(cn) using 🔒 国内服务[DIRECT]"
time="2026-08-03T15:18:43.958156983+08:00" level=info msg="[TCP] 192.168.*.*:39206 --> www.youtube.com:443 match RuleSet(youtube) using 📹 油管视频[🇭🇰 VIP-香港 - Fast Network 01]"
time="2026-08-03T15:18:43.992212409+08:00" level=info msg="[TCP] 192.168.*.*:42098 --> pubstatic.b0.upaiyun.com:443 match RuleSet(geolocation-cn) using 🔒 国内服务[DIRECT]"
time="2026-08-03T15:18:44.155419360+08:00" level=info msg="[TCP] 192.168.*.*:60598 --> github.com:443 match RuleSet(github) using 🐱 Github[🇭🇰 VIP-香港 - Fast Network 01]"
time="2026-08-03T15:18:44.181913951+08:00" level=info msg="[TCP] 192.168.*.*:43242 --> api-ipv4.ip.sb:443 match RuleSet(geolocation-!cn) using 🌐 非中国[🇭🇰 VIP-香港 - Fast Network 01]"
time="2026-08-03T15:18:44.199673545+08:00" level=info msg="[TCP] 192.168.*.*:46274 --> api.ipify.org:443 match RuleSet(geolocation-!cn) using 🌐 非中国[🇭🇰 VIP-香港 - Fast Network 01]"
time="2026-08-03T15:18:44.712506396+08:00" level=info msg="[TCP] 192.168.*.*:49136 --> 192.168.*.*:9090 match RuleSet(private-ip) using 🏠 私有网络[DIRECT]"
2026-08-03 15:18:45 [Info] Manually Reload Firewall Rules...
time="2026-08-03T15:18:45.875581629+08:00" level=info msg="[TCP] 192.168.*.*:43254 --> api-ipv4.ip.sb:443 match RuleSet(geolocation-!cn) using 🌐 非中国[🇭🇰 VIP-香港 - Fast Network 01]"
2026-08-03 15:18:48 [Tip] DNS Hijacking Mode is Dnsmasq Redirect...
2026-08-03 15:18:48 [Warning] Can't Settting Only Intranet Allowed Function, Get IPv4 WAN Interfaces error, Please Verify The Firewall's WAN Zone Name is wan, Ignore This IF The Device Does not Have a WAN Interfaces...
2026-08-03 15:18:49 [Info] Tip: Start Add Custom Firewall Rules...
2026-08-03 15:18:49 [Tip] Firewall Reload Successful!
time="2026-08-03T15:19:25.544876034+08:00" level=info msg="[TCP] 192.168.*.*:45362 --> 192.168.*.*:80 match RuleSet(private-ip) using 🏠 私有网络[DIRECT]"
time="2026-08-03T15:19:25.743318364+08:00" level=info msg="[TCP] 192.168.*.*:45336 --> 192.168.*.*:9090 match RuleSet(private-ip) using 🏠 私有网络[DIRECT]"
time="2026-08-03T15:19:25.776186753+08:00" level=info msg="[TCP] 192.168.*.*:45348 --> 192.168.*.*:9090 match RuleSet(private-ip) using 🏠 私有网络[DIRECT]"
time="2026-08-03T15:19:25.936704192+08:00" level=info msg="[TCP] 192.168.*.*:41470 --> 192.168.*.*:80 match RuleSet(private-ip) using 🏠 私有网络[DIRECT]"
time="2026-08-03T15:19:25.960009029+08:00" level=info msg="[TCP] 192.168.*.*:45370 --> 192.168.*.*:9090 match RuleSet(private-ip) using 🏠 私有网络[DIRECT]"
time="2026-08-03T15:19:25.963725151+08:00" level=info msg="[TCP] 192.168.*.*:45380 --> 192.168.*.*:9090 match RuleSet(private-ip) using 🏠 私有网络[DIRECT]"
time="2026-08-03T15:19:26.196825863+08:00" level=info msg="[TCP] 192.168.*.*:41472 --> 192.168.*.*:80 match RuleSet(private-ip) using 🏠 私有网络[DIRECT]"
time="2026-08-03T15:19:26.297901443+08:00" level=info msg="[TCP] mihomo --> 223.5.*.*:443 match RuleSet(cn-ip) using 🔒 国内服务[DIRECT]"
time="2026-08-03T15:19:26.307870396+08:00" level=info msg="[TCP] 192.168.*.*:47594 --> myip.ipip.net:80 match RuleSet(cn) using 🔒 国内服务[DIRECT]"
time="2026-08-03T15:19:26.319020677+08:00" level=info msg="[TCP] 192.168.*.*:56062 --> pubstatic.b0.upaiyun.com:443 match RuleSet(geolocation-cn) using 🔒 国内服务[DIRECT]"
time="2026-08-03T15:19:26.469579789+08:00" level=info msg="[TCP] 192.168.*.*:41634 --> api-ipv4.ip.sb:443 match RuleSet(geolocation-!cn) using 🌐 非中国[🇭🇰 VIP-香港 - Fast Network 01]"
time="2026-08-03T15:19:26.472077205+08:00" level=info msg="[TCP] 192.168.*.*:37848 --> api.ipify.org:443 match RuleSet(geolocation-!cn) using 🌐 非中国[🇭🇰 VIP-香港 - Fast Network 01]"
time="2026-08-03T15:19:26.581378621+08:00" level=info msg="[TCP] 192.168.*.*:52262 --> www.baidu.com:443 match RuleSet(geolocation-cn) using 🔒 国内服务[DIRECT]"
time="2026-08-03T15:19:26.620098690+08:00" level=info msg="[TCP] 192.168.*.*:37118 --> s1.music.126.net:443 match RuleSet(cn) using 🔒 国内服务[DIRECT]"
time="2026-08-03T15:19:26.736436657+08:00" level=info msg="[TCP] 192.168.*.*:45322 --> 192.168.*.*:80 match RuleSet(private-ip) using 🏠 私有网络[DIRECT]"
time="2026-08-03T15:19:27.524682860+08:00" level=info msg="[TCP] 192.168.*.*:45396 --> self.events.data.microsoft.com:443 match RuleSet(geolocation-!cn) using 🌐 非中国[🇭🇰 VIP-香港 - Fast Network 01]"
time="2026-08-03T15:19:27.652619596+08:00" level=info msg="[TCP] 192.168.*.*:59312 --> github.com:443 match RuleSet(github) using 🐱 Github[🇭🇰 VIP-香港 - Fast Network 01]"
time="2026-08-03T15:19:27.714864767+08:00" level=info msg="[TCP] 192.168.*.*:45400 --> 192.168.*.*:9090 match RuleSet(private-ip) using 🏠 私有网络[DIRECT]"
time="2026-08-03T15:19:27.717109874+08:00" level=info msg="[TCP] 192.168.*.*:45406 --> 192.168.*.*:9090 match RuleSet(private-ip) using 🏠 私有网络[DIRECT]"
time="2026-08-03T15:19:28.238527669+08:00" level=info msg="[TCP] 192.168.*.*:56568 --> www.youtube.com:443 match RuleSet(youtube) using 📹 油管视频[🇭🇰 VIP-香港 - Fast Network 01]"
2026/08/03 15:19:29 Unsolicited response received on idle HTTP channel starting with "<h1>Not Found</h1>The requested URL /luci-static/ifit/images/brand.png was not found on this server."; err=<nil>
time="2026-08-03T15:19:29.970684609+08:00" level=info msg="[TCP] 192.168.*.*:45306 --> 192.168.*.*:80 match RuleSet(private-ip) using 🏠 私有网络[DIRECT]"
time="2026-08-03T15:19:30.682080173+08:00" level=info msg="[TCP] 192.168.*.*:41414 --> 192.168.*.*:9090 match RuleSet(private-ip) using 🏠 私有网络[DIRECT]"
time="2026-08-03T15:19:31.609061787+08:00" level=info msg="[TCP] 192.168.*.*:41416 --> functional.events.data.microsoft.com:443 match RuleSet(geolocation-!cn) using 🌐 非中国[🇭🇰 VIP-香港 - Fast Network 01]"
time="2026-08-03T15:19:32.360258866+08:00" level=info msg="[TCP] 192.168.*.*:60260 --> raw.githubusercontent.com:443 match RuleSet(github) using 🐱 Github[🇭🇰 VIP-香港 - Fast Network 01]"
time="2026-08-03T15:19:32.922206391+08:00" level=info msg="[TCP] 192.168.*.*:60268 --> raw.githubusercontent.com:443 match RuleSet(github) using 🐱 Github[🇭🇰 VIP-香港 - Fast Network 01]"
time="2026-08-03T15:19:33.359594362+08:00" level=info msg="[TCP] 192.168.*.*:60278 --> raw.githubusercontent.com:443 match RuleSet(github) using 🐱 Github[🇭🇰 VIP-香港 - Fast Network 01]"
time="2026-08-03T15:19:36.233773389+08:00" level=info msg="[TCP] 192.168.*.*:41424 --> cn.bing.com:443 match RuleSet(cn) using 🔒 国内服务[DIRECT]"
time="2026-08-03T15:19:40.721789340+08:00" level=info msg="[TCP] mihomo --> dns.google:443 match RuleSet(google) using 🔍 谷歌服务[🇭🇰 VIP-香港 - Fast Network 01]"
time="2026-08-03T15:19:41.056267569+08:00" level=info msg="[TCP] 192.168.*.*:42212 --> www.xpost.cc:443 match Match using 🐟 漏网之鱼[🇭🇰 VIP-香港 - Fast Network 01]"
time="2026-08-03T15:19:41.126314882+08:00" level=info msg="[TCP] mihomo --> dns.cloudflare.com:443 match RuleSet(geolocation-!cn) using 🌐 非中国[🇭🇰 VIP-香港 - Fast Network 01]"
time="2026-08-03T15:19:41.255363692+08:00" level=info msg="[TCP] mihomo --> dns.cloudflare.com:443 match RuleSet(geolocation-!cn) using 🌐 非中国[🇭🇰 VIP-香港 - Fast Network 01]"
time="2026-08-03T15:19:41.428871159+08:00" level=info msg="[TCP] 192.168.*.*:45920 --> www.baidu.com:80 match RuleSet(geolocation-cn) using 🔒 国内服务[DIRECT]"
time="2026-08-03T15:19:42.260083921+08:00" level=info msg="[TCP] 192.168.*.*:52268 --> raw.githubusercontent.com:443 match RuleSet(github) using 🐱 Github[🇭🇰 VIP-香港 - Fast Network 01]"
time="2026-08-03T15:19:44.886632480+08:00" level=debug msg="Auth success from 192.168.*.*:42226 -> "
time="2026-08-03T15:19:44.887344069+08:00" level=debug msg="[Rule] use default rules"
time="2026-08-03T15:19:44.887947317+08:00" level=debug msg="[DNS] cache hit cn.bing.com --> [202.89.*.* 202.89.*.*] A, expire at 2026-08-03 15:19:58"
time="2026-08-03T15:19:44.942157788+08:00" level=info msg="[TCP] 192.168.*.*:42226 --> cn.bing.com:443 match RuleSet(cn) using 🔒 国内服务[DIRECT]"
time="2026-08-03T15:19:47.752473245+08:00" level=debug msg="Auth success from 192.168.*.*:42232 -> "
time="2026-08-03T15:19:47.753255797+08:00" level=debug msg="[Rule] use default rules"
time="2026-08-03T15:19:47.915721907+08:00" level=info msg="[TCP] 192.168.*.*:42232 --> www.google.com:443 match RuleSet(google) using 🔍 谷歌服务[🇭🇰 VIP-香港 - Fast Network 01]"
time="2026-08-03T15:19:48.529854685+08:00" level=debug msg="Auth success from 192.168.*.*:42242 -> "
time="2026-08-03T15:19:48.530561691+08:00" level=debug msg="[Rule] use default rules"
time="2026-08-03T15:19:48.705603343+08:00" level=info msg="[TCP] 192.168.*.*:42242 --> lh3.google.com:443 match RuleSet(google) using 🔍 谷歌服务[🇭🇰 VIP-香港 - Fast Network 01]"
time="2026-08-03T15:19:49.114826321+08:00" level=debug msg="Auth success from 192.168.*.*:42246 -> "
time="2026-08-03T15:19:49.115325313+08:00" level=debug msg="[Rule] use default rules"
time="2026-08-03T15:19:49.277035498+08:00" level=info msg="[TCP] 192.168.*.*:42246 --> lh3.googleusercontent.com:443 match RuleSet(google) using 🔍 谷歌服务[🇭🇰 VIP-香港 - Fast Network 01]"

活动连接信息

⎗
✓
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
# openclash_debug_getcon.lua
1. SourceIP:【192.168.*.*】 - Host:【cn.bing.com】 - DestinationIP:【】 - Network:【tcp】 - RulePayload:【cn】 - Lastchain:【DIRECT】
2. SourceIP:【192.168.*.*】 - Host:【www.google.com】 - DestinationIP:【】 - Network:【tcp】 - RulePayload:【google】 - Lastchain:【🇭🇰 VIP-香港 - Fast Network 01】
3. SourceIP:【192.168.*.*】 - Host:【pbs.twimg.com】 - DestinationIP:【】 - Network:【tcp】 - RulePayload:【geolocation-!cn】 - Lastchain:【VIP-自适应CDN线路】
4. SourceIP:【192.168.*.*】 - Host:【cn.bing.com】 - DestinationIP:【】 - Network:【tcp】 - RulePayload:【cn】 - Lastchain:【DIRECT】
5. SourceIP:【192.168.*.*】 - Host:【Empty】 - DestinationIP:【192.168.*.*】 - Network:【tcp】 - RulePayload:【private-ip】 - Lastchain:【DIRECT】
6. SourceIP:【】 - Host:【Empty】 - DestinationIP:【120.53.*.*】 - Network:【tcp】 - RulePayload:【cn-ip】 - Lastchain:【DIRECT】
7. SourceIP:【】 - Host:【dns.cloudflare.com】 - DestinationIP:【162.159.*.*】 - Network:【tcp】 - RulePayload:【geolocation-!cn】 - Lastchain:【🇭🇰 VIP-香港 - Fast Network 01】
8. SourceIP:【192.168.*.*】 - Host:【self.events.data.microsoft.com】 - DestinationIP:【】 - Network:【tcp】 - RulePayload:【geolocation-!cn】 - Lastchain:【🇭🇰 VIP-香港 - Fast Network 01】
9. SourceIP:【192.168.*.*】 - Host:【abs.twimg.com】 - DestinationIP:【】 - Network:【tcp】 - RulePayload:【geolocation-!cn】 - Lastchain:【VIP-自适应CDN线路】
10. SourceIP:【192.168.*.*】 - Host:【Empty】 - DestinationIP:【192.168.*.*】 - Network:【tcp】 - RulePayload:【private-ip】 - Lastchain:【DIRECT】
11. SourceIP:【192.168.*.*】 - Host:【Empty】 - DestinationIP:【192.168.*.*】 - Network:【tcp】 - RulePayload:【private-ip】 - Lastchain:【DIRECT】
12. SourceIP:【192.168.*.*】 - Host:【Empty】 - DestinationIP:【192.168.*.*】 - Network:【tcp】 - RulePayload:【private-ip】 - Lastchain:【DIRECT】
13. SourceIP:【192.168.*.*】 - Host:【Empty】 - DestinationIP:【192.168.*.*】 - Network:【tcp】 - RulePayload:【private-ip】 - Lastchain:【DIRECT】
14. SourceIP:【192.168.*.*】 - Host:【github.com】 - DestinationIP:【】 - Network:【tcp】 - RulePayload:【github】 - Lastchain:【VIP-自适应CDN线路】
15. SourceIP:【192.168.*.*】 - Host:【Empty】 - DestinationIP:【192.168.*.*】 - Network:【tcp】 - RulePayload:【private-ip】 - Lastchain:【DIRECT】
16. SourceIP:【192.168.*.*】 - Host:【functional.events.data.microsoft.com】 - DestinationIP:【】 - Network:【tcp】 - RulePayload:【geolocation-!cn】 - Lastchain:【🇭🇰 VIP-香港 - Fast Network 01】
17. SourceIP:【192.168.*.*】 - Host:【pbs.twimg.com】 - DestinationIP:【】 - Network:【tcp】 - RulePayload:【geolocation-!cn】 - Lastchain:【VIP-自适应CDN线路】
18. SourceIP:【192.168.*.*】 - Host:【Empty】 - DestinationIP:【192.168.*.*】 - Network:【tcp】 - RulePayload:【private-ip】 - Lastchain:【DIRECT】
19. SourceIP:【】 - Host:【Empty】 - DestinationIP:【223.5.*.*】 - Network:【tcp】 - RulePayload:【cn-ip】 - Lastchain:【DIRECT】
20. SourceIP:【192.168.*.*】 - Host:【Empty】 - DestinationIP:【192.168.*.*】 - Network:【tcp】 - RulePayload:【private-ip】 - Lastchain:【DIRECT】
21. SourceIP:【192.168.*.*】 - Host:【www.xpost.cc】 - DestinationIP:【】 - Network:【tcp】 - RulePayload:【】 - Lastchain:【🇭🇰 VIP-香港 - Fast Network 01】
22. SourceIP:【192.168.*.*】 - Host:【lh3.googleusercontent.com】 - DestinationIP:【】 - Network:【tcp】 - RulePayload:【google】 - Lastchain:【🇭🇰 VIP-香港 - Fast Network 01】
23. SourceIP:【192.168.*.*】 - Host:【lh3.google.com】 - DestinationIP:【】 - Network:【tcp】 - RulePayload:【google】 - Lastchain:【🇭🇰 VIP-香港 - Fast Network 01】
24. SourceIP:【192.168.*.*】 - Host:【app-measurement.com】 - DestinationIP:【】 - Network:【tcp】 - RulePayload:【google】 - Lastchain:【🇭🇰 VIP-香港 - Fast Network 01】
25. SourceIP:【192.168.*.*】 - Host:【x.com】 - DestinationIP:【】 - Network:【tcp】 - RulePayload:【geolocation-!cn】 - Lastchain:【VIP-自适应CDN线路】
26. SourceIP:【】 - Host:【dns.google】 - DestinationIP:【8.8.*.*】 - Network:【tcp】 - RulePayload:【google】 - Lastchain:【🇭🇰 VIP-香港 - Fast Network 01】

Warning

LINK

You are about to visit a link which has been flagged with the above content warnings. Do you wish to continue?

Cancel
Edit
Raw PDF PNG WebP JPG

Pub: 03 Aug 2026 07:21 UTC

Views: 2

new· what· how· langs· contacts· login