[Bug] v0.47.028版本配置文件中的hosts解析超时 #4829
Description
Verify Steps
- Tracker 我已经在 Issue Tracker 中找过我要提出的问题
- Branch 我知道 OpenClash 的 Dev 分支切换开关位于插件设置-版本更新中，或者我会手动下载并安装 Dev 分支的 OpenClash
- Latest 我已经使用最新 Dev 版本测试过，问题依旧存在
- Relevant 我知道 OpenClash 与 内核(Core)、控制面板(Dashboard)、在线订阅转换(Subconverter)等项目之间无直接关系，仅相互调用
- Definite 这确实是 OpenClash 出现的问题
- Contributors 我有能力协助 OpenClash 开发并解决此问题
- Meaningless 我提交的是无意义的催促更新或修复请求
OpenClash Version
v0.47.028
Bug on Environment
Immortalwrt
OpenWrt Version
21.02-SNAPSHOT r0-8a8561c
Bug on Platform
Linux-arm64
Describe the Bug
host也废了,解析不出配置文件中的指定的,指向路由器本身内网ipv4的hosts
To Reproduce
在config中使用hosts,把某个域名指向路由器本身的内网 IPv4,这个域名会解析超时
OpenClash Log
OpenClash 调试日志
生成时间: 2025-11-03 15:28:00
插件版本: 0.47.028
隐私提示: 上传此日志前请注意检查、屏蔽公网IP、节点、密码等相关敏感信息
#===================== 系统信息 =====================#
主机型号: JDCloud RE-CP-03
固件版本: ImmortalWrt 21.02-SNAPSHOT r0-8a8561c
LuCI版本: git-20.074.84698-ead5e81
内核版本: 5.4.255
处理器架构: aarch64_cortex-a53
#此项有值时,如不使用IPv6,建议到网络-接口-lan的设置中禁用IPV6的DHCP
IPV6-DHCP:
DNS劫持: Firewall 转发
#DNS劫持为Dnsmasq时，此项结果应仅有配置文件的DNS监听地址
Dnsmasq转发设置:
#===================== 依赖检查 =====================#
dnsmasq-full: 已安装
dnsmasq-full(ipset): 已安装
dnsmasq-full(nftset): 未安装
bash: 已安装
curl: 已安装
ca-bundle: 已安装
ipset: 已安装
ip-full: 已安装
ruby: 已安装
ruby-yaml: 已安装
ruby-psych: 已安装
ruby-pstore: 已安装
kmod-tun(TUN模式): 已安装
luci-compat(Luci >= 19.07): 已安装
kmod-inet-diag(PROCESS-NAME): 已安装
unzip: 已安装
iptables-mod-tproxy: 已安装
kmod-ipt-tproxy: 已安装
iptables-mod-extra: 已安装
kmod-ipt-extra: 已安装
kmod-ipt-nat: 已安装
#===================== 内核检查 =====================#
运行状态: 运行中
运行内核：Meta
进程pid: 22581
运行用户: root
已选择的架构: linux-arm64
#下方无法显示内核版本号时请确认您的内核版本是否正确或者有无权限
Meta内核版本: alpha-g99e68e9
Meta内核文件: 存在
Meta内核运行权限: 正常
#===================== 插件设置 =====================#
当前配置文件: /etc/openclash/config/Merge.yaml
启动配置文件: /etc/openclash/Merge.yaml
运行模式: fake-ip
默认代理模式: rule
UDP流量转发(tproxy): 启用
自定义DNS: 停用
IPV6代理: 启用
IPV6-DNS解析: 启用
禁用Dnsmasq缓存: 停用
自定义规则: 停用
仅允许内网: 启用
仅代理命中规则流量: 停用
仅允许常用端口流量: 停用
绕过中国大陆IP: 启用
路由本机代理: 启用
#启动异常时建议关闭此项后重试
混合节点: 停用
保留配置: 停用
#启动异常时建议关闭此项后重试
第三方规则: 停用
#===================== 覆写模块设置 =====================#
#===================== 配置文件 =====================#
proxy-groups:
- name: URLTEST
type: url-test
interval: 600
url: https://www.gstatic.com/generate_204
include-all: true
- name: BYPASS
type: url-test
use:
- tsmeow
interval: 600
url: https://www.gstatic.com/generate_204
rule-providers:
ads:
type: http
behavior: domain
format: yaml
path: "./rule_provider/ads.yaml"
url: https://raw.githubusercontent.com/psychosispy/router/refs/heads/main/rules/adblockmihomo.yaml
interval: 86400
fakeip-filter:
type: http
behavior: domain
format: mrs
path: "./rule_provider/fakeip-filter.mrs"
url: https://github.com/DustinWin/ruleset_geodata/releases/download/mihomo-ruleset/fakeip-filter.mrs
interval: 86400
microsoft:
type: http
behavior: domain
format: mrs
path: "./rule_provider/microsoft.mrs"
url: https://raw.githubusercontent.com/MetaCubeX/meta-rules-dat/refs/heads/meta/geo-lite/geosite/microsoft.mrs
interval: 86400
rules:
- RULE-SET,ads,REJECT-DROP
- RULE-SET,microsoft,DIRECT
- GEOSITE,googlefcm,DIRECT
- GEOSITE,cn,DIRECT
- GEOSITE,openai,BYPASS
- GEOSITE,google-gemini,BYPASS
- GEOSITE,youtube,BYPASS
- MATCH,URLTEST
allow-lan: true
bind-address: "*"
mode: rule
log-level: silent
external-controller: 0.0.*.*:9090
port: 7890
socks-port: 7891
redir-port: 7892
mixed-port: 7893
tproxy-port: 7895
external-ui: "/usr/share/openclash/ui"
ipv6: true
tcp-concurrent: true
find-process-mode: 'off'
dns:
enable: true
cache-algorithm: arc
ipv6: true
use-hosts: true
enhanced-mode: fake-ip
fake-ip-range: 198.18.*.*/16
listen: 0.0.*.*:7874
fake-ip-filter:
- rule-set:fakeip-filter,microsoft
- geosite:cn
- geosite:googlefcm
nameserver-policy:
rule-set:ads: rcode://success
nameserver:
- 223.5.*.*
- https://[2a07:a8c0::]/dns-query#h3=true&skip-cert-verify=true&DIRECT&ecs=112.32.*.*/20
- dhcp://"pppoe-wan"
- 100.72.*.*
- "[fe80::*:*:*:13a]:53"
- 211.138.*.*
- 211.138.*.*
- "[2409:8030:2000::1]:53"
- "[2409:8030:2000::2]:53"
fake-ip-range6: fdfe:dcba:9876::1/64
profile:
store-selected: true
store-fake-ip: true
hosts:
services.googleapis.cn: services.googleapis.com
"+.1234.1234y": 10.0.*.*
external-ui-name: metacubexd
geox-url:
geoip: https://testingcf.jsdelivr.net/gh/Loyalsoldier/v2ray-rules-dat@release/geoip.dat
geosite: https://testingcf.jsdelivr.net/gh/Loyalsoldier/v2ray-rules-dat@release/geosite.dat
keep-alive-interval: 15
keep-alive-idle: 600
#===================== 自定义覆写设置 =====================#
#!/bin/sh
. /usr/share/openclash/ruby.sh
. /usr/share/openclash/log.sh
. /lib/functions.sh
# This script is called by /etc/init.d/openclash
# Add your custom overwrite scripts here, they will be take effict after the OpenClash own srcipts
LOG_OUT "Tip: Start Running Custom Overwrite Scripts..."
LOGTIME=$(echo $(date "+%Y-%m-%d %H:%M:%S"))
LOG_FILE="/tmp/openclash.log"
CONFIG_FILE="$1" #config path
#Simple Demo:
#General Demo
#1--config path
#2--key name
#3--value
#ruby_edit "$CONFIG_FILE" "['redir-port']" "7892"
#ruby_edit "$CONFIG_FILE" "['secret']" "123456"
#ruby_edit "$CONFIG_FILE" "['dns']['enable']" "true"
#Hash Demo
#1--config path
#2--key name
#3--hash type value
#ruby_edit "$CONFIG_FILE" "['experimental']" "{'sniff-tls-sni'=>true}"
#ruby_edit "$CONFIG_FILE" "['sniffer']" "{'sniffing'=>['tls','http']}"
#Array Demo:
#1--config path
#2--key name
#3--position(start from 0, end with -1)
#4--value
#ruby_arr_insert "$CONFIG_FILE" "['dns']['nameserver']" "0" "114.114.*.*"
#Array Add From Yaml File Demo:
#1--config path
#2--key name
#3--position(start from 0, end with -1)
#4--value file path
#5--value key name in #4 file
#ruby_arr_add_file "$CONFIG_FILE" "['dns']['fallback-filter']['ipcidr']" "0" "/etc/openclash/custom/openclash_custom_fallback_filter.yaml" "['fallback-filter']['ipcidr']"
#Ruby Script Demo:
#ruby -ryaml -rYAML -I "/usr/share/openclash" -E UTF-8 -e "
# begin
# Value = YAML.load_file('$CONFIG_FILE');
# rescue Exception => e
# puts '${LOGTIME} Error: Load File Failed,【' + e.message + '】';
# end;
#General
# begin
# Thread.new{
# Value['redir-port']=7892;
# Value['tproxy-port']=7895;
# Value['port']=7890;
# Value['socks-port']=7891;
# Value['mixed-port']=7893;
# }.join;
# rescue Exception => e
# puts '${LOGTIME} Error: Set General Failed,【' + e.message + '】';
# ensure
# File.open('$CONFIG_FILE','w') {|f| YAML.dump(Value, f)};
# end" 2>/dev/null >> $LOG_FILE
exit 0
#===================== 自定义防火墙设置 =====================#
#!/bin/sh
. /usr/share/openclash/log.sh
. /lib/functions.sh
# This script is called by /etc/init.d/openclash
# Add your custom firewall rules here, they will be added after the end of the OpenClash iptables rules
LOG_OUT "Tip: Start Add Custom Firewall Rules..."
exit 0
#===================== IPTABLES 防火墙设置 =====================#
#IPv4 NAT chain
# Generated by iptables-save v1.8.7 on Mon Nov 3 15:28:02 2025
*nat
:PREROUTING ACCEPT [594:73884]
:INPUT ACCEPT [866:54849]
:OUTPUT ACCEPT [2360:254640]
:POSTROUTING ACCEPT [142:9610]
:DOCKER - [0:0]
:MINIUPNPD - [0:0]
:MINIUPNPD-POSTROUTING - [0:0]
:openclash - [0:0]
:openclash_dns_redirect - [0:0]
:openclash_output - [0:0]
:postrouting_docker_rule - [0:0]
:postrouting_lan_rule - [0:0]
:postrouting_rule - [0:0]
:postrouting_wan_rule - [0:0]
:prerouting_docker_rule - [0:0]
:prerouting_lan_rule - [0:0]
:prerouting_rule - [0:0]
:prerouting_wan_rule - [0:0]
:zone_docker_postrouting - [0:0]
:zone_docker_prerouting - [0:0]
:zone_lan_postrouting - [0:0]
:zone_lan_prerouting - [0:0]
:zone_wan_postrouting - [0:0]
:zone_wan_prerouting - [0:0]
-A PREROUTING -p tcp -m tcp --dport 53 -j openclash_dns_redirect
-A PREROUTING -p udp -m udp --dport 53 -j openclash_dns_redirect
-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER
-A PREROUTING -m comment --comment "!fw3: Custom prerouting rule chain" -j prerouting_rule
-A PREROUTING -i br-lan -m comment --comment "!fw3" -j zone_lan_prerouting
-A PREROUTING -i pppoe-wan -m comment --comment "!fw3" -j zone_wan_prerouting
-A PREROUTING -i docker0 -m comment --comment "!fw3" -j zone_docker_prerouting
-A PREROUTING -p tcp -j openclash
-A OUTPUT -d 127.0.*.*/32 -p tcp -m tcp --dport 53 -m owner ! --gid-owner 65534 -m comment --comment "OpenClash DNS Hijack" -j REDIRECT --to-ports 7874
-A OUTPUT -d 127.0.*.*/32 -p udp -m udp --dport 53 -m owner ! --gid-owner 65534 -m comment --comment "OpenClash DNS Hijack" -j REDIRECT --to-ports 7874
-A OUTPUT ! -d 127.0.*.*/8 -m addrtype --dst-type LOCAL -j DOCKER
-A OUTPUT -j openclash_output
-A POSTROUTING -s 172.17.*.*/16 ! -o docker0 -j MASQUERADE
-A POSTROUTING -s 172.18.*.*/16 ! -o br-5ed7c552c81e -j MASQUERADE
-A POSTROUTING -s 172.19.*.*/16 ! -o br-03c53bca8fad -j MASQUERADE
-A POSTROUTING -s 172.21.*.*/16 ! -o br-e5ba47e8b7c0 -j MASQUERADE
-A POSTROUTING -s 172.20.*.*/16 ! -o br-88fbd09805a9 -j MASQUERADE
-A POSTROUTING -s 172.18.*.*/32 -d 172.18.*.*/32 -p tcp -m tcp --dport 5001 -j MASQUERADE
-A POSTROUTING -s 172.19.*.*/32 -d 172.19.*.*/32 -p tcp -m tcp --dport 1200 -j MASQUERADE
-A POSTROUTING -s 172.19.*.*/32 -d 172.19.*.*/32 -p tcp -m tcp --dport 443 -j MASQUERADE
-A POSTROUTING -m comment --comment "!fw3: Custom postrouting rule chain" -j postrouting_rule
-A POSTROUTING -o br-lan -m comment --comment "!fw3" -j zone_lan_postrouting
-A POSTROUTING -o pppoe-wan -m comment --comment "!fw3" -j zone_wan_postrouting
-A POSTROUTING -o docker0 -m comment --comment "!fw3" -j zone_docker_postrouting
-A POSTROUTING -s 172.20.*.*/32 -d 172.20.*.*/32 -p tcp -m tcp --dport 5244 -j MASQUERADE
-A DOCKER -i docker0 -j RETURN
-A DOCKER -i br-5ed7c552c81e -j RETURN
-A DOCKER -i br-03c53bca8fad -j RETURN
-A DOCKER -i br-e5ba47e8b7c0 -j RETURN
-A DOCKER -i br-88fbd09805a9 -j RETURN
-A DOCKER ! -i br-5ed7c552c81e -p tcp -m tcp --dport 5001 -j DNAT --to-destination 172.18.*.*:5001
-A DOCKER ! -i br-03c53bca8fad -p tcp -m tcp --dport 1200 -j DNAT --to-destination 172.19.*.*:1200
-A DOCKER ! -i br-03c53bca8fad -p tcp -m tcp --dport 66 -j DNAT --to-destination 172.19.*.*:443
-A DOCKER ! -i br-88fbd09805a9 -p tcp -m tcp --dport 5244 -j DNAT --to-destination 172.20.*.*:5244
-A openclash -p tcp -m tcp --sport 16601 -j RETURN
-A openclash -p tcp -m tcp --sport 66 -j RETURN
-A openclash -p tcp -m tcp --sport 5244 -j RETURN
-A openclash -m set --match-set localnetwork dst -j RETURN
-A openclash -m conntrack --ctdir REPLY -j RETURN
-A openclash -d 198.18.*.*/16 -p tcp -j REDIRECT --to-ports 7892
-A openclash -m set --match-set lan_ac_black_macs src -j RETURN
-A openclash -m set --match-set china_ip_route dst -j RETURN
-A openclash -p tcp -j REDIRECT --to-ports 7892
-A openclash_dns_redirect -p udp -m udp --dport 53 -m set ! --match-set lan_ac_black_macs src -m comment --comment "OpenClash DNS Hijack" -j REDIRECT --to-ports 7874
-A openclash_dns_redirect -p tcp -m tcp --dport 53 -m set ! --match-set lan_ac_black_macs src -m comment --comment "OpenClash DNS Hijack" -j REDIRECT --to-ports 7874
-A openclash_output -p tcp -m tcp --sport 16601 -j RETURN
-A openclash_output -p tcp -m tcp --sport 66 -j RETURN
-A openclash_output -p tcp -m tcp --sport 5244 -j RETURN
-A openclash_output -m owner --gid-owner 65534 -j RETURN
-A openclash_output -d 198.18.*.*/16 -p tcp -j REDIRECT --to-ports 7892
-A openclash_output -m set --match-set localnetwork dst -j RETURN
-A openclash_output -m conntrack --ctdir REPLY -j RETURN
-A openclash_output -m set --match-set china_ip_route dst -j RETURN
-A openclash_output -p tcp -j REDIRECT --to-ports 7892
-A zone_docker_postrouting -m comment --comment "!fw3: Custom docker postrouting rule chain" -j postrouting_docker_rule
-A zone_docker_prerouting -m comment --comment "!fw3: Custom docker prerouting rule chain" -j prerouting_docker_rule
-A zone_lan_postrouting -m comment --comment "!fw3: Custom lan postrouting rule chain" -j postrouting_lan_rule
-A zone_lan_prerouting -m comment --comment "!fw3: Custom lan prerouting rule chain" -j prerouting_lan_rule
-A zone_wan_postrouting -m comment --comment "!fw3: Custom wan postrouting rule chain" -j postrouting_wan_rule
-A zone_wan_postrouting -j MINIUPNPD-POSTROUTING
-A zone_wan_postrouting -j MINIUPNPD-POSTROUTING
-A zone_wan_postrouting -m comment --comment "!fw3" -j MASQUERADE
-A zone_wan_prerouting -m comment --comment "!fw3: Custom wan prerouting rule chain" -j prerouting_wan_rule
-A zone_wan_prerouting -j MINIUPNPD
-A zone_wan_prerouting -j MINIUPNPD
COMMIT
# Completed on Mon Nov 3 15:28:02 2025
#IPv4 Mangle chain
# Generated by iptables-save v1.8.7 on Mon Nov 3 15:28:02 2025
*mangle
:PREROUTING ACCEPT [29588:8084542]
:INPUT ACCEPT [23813:6605919]
:FORWARD ACCEPT [5741:1504375]
:OUTPUT ACCEPT [25043:9419348]
:POSTROUTING ACCEPT [30786:10923996]
:openclash - [0:0]
:openclash_output - [0:0]
:openclash_upnp - [0:0]
-A PREROUTING -p udp -j openclash
-A FORWARD -o pppoe-wan -p tcp -m tcp --tcp-flags SYN,RST SYN -m comment --comment "!fw3: Zone wan MTU fixing" -j TCPMSS --clamp-mss-to-pmtu
-A FORWARD -i pppoe-wan -p tcp -m tcp --tcp-flags SYN,RST SYN -m comment --comment "!fw3: Zone wan MTU fixing" -j TCPMSS --clamp-mss-to-pmtu
-A OUTPUT -p udp -j openclash_output
-A openclash -p udp -m udp --sport 16601 -j RETURN
-A openclash -p udp -m udp --sport 66 -j RETURN
-A openclash -p udp -m udp --sport 5244 -j RETURN
-A openclash -p udp -m udp --sport 500 -j RETURN
-A openclash -p udp -m udp --sport 68 -j RETURN
-A openclash -m set --match-set localnetwork dst -j RETURN
-A openclash -m conntrack --ctdir REPLY -j RETURN
-A openclash -d 198.18.*.*/16 -p udp -j TPROXY --on-port 7895 --on-ip 0.0.*.* --tproxy-mark 0x162/0xffffffff
-A openclash -m set --match-set lan_ac_black_macs src -j RETURN
-A openclash -m set --match-set china_ip_route dst -j RETURN
-A openclash -p udp -j openclash_upnp
-A openclash -p udp -j TPROXY --on-port 7895 --on-ip 0.0.*.* --tproxy-mark 0x162/0xffffffff
-A openclash_output -p udp -m udp --sport 16601 -j RETURN
-A openclash_output -p udp -m udp --sport 66 -j RETURN
-A openclash_output -p udp -m udp --sport 5244 -j RETURN
-A openclash_output -p udp -m udp --sport 500 -j RETURN
-A openclash_output -p udp -m udp --sport 68 -j RETURN
-A openclash_output -m owner --gid-owner 65534 -j RETURN
-A openclash_output -m set --match-set localnetwork dst -j RETURN
-A openclash_output -m conntrack --ctdir REPLY -j RETURN
-A openclash_output -d 198.18.*.*/16 -p udp -j MARK --set-xmark 0x162/0xffffffff
-A openclash_output -m set --match-set china_ip_route dst -j RETURN
-A openclash_output -p udp -j MARK --set-xmark 0x162/0xffffffff
COMMIT
# Completed on Mon Nov 3 15:28:02 2025
#IPv4 Filter chain
# Generated by iptables-save v1.8.7 on Mon Nov 3 15:28:02 2025
*filter
:INPUT ACCEPT [8:1296]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [0:0]
:DOCKER - [0:0]
:DOCKER-ISOLATION-STAGE-1 - [0:0]
:DOCKER-ISOLATION-STAGE-2 - [0:0]
:DOCKER-USER - [0:0]
:MINIUPNPD - [0:0]
:forwarding_docker_rule - [0:0]
:forwarding_lan_rule - [0:0]
:forwarding_rule - [0:0]
:forwarding_wan_rule - [0:0]
:input_docker_rule - [0:0]
:input_lan_rule - [0:0]
:input_rule - [0:0]
:input_wan_rule - [0:0]
:openclash_wan_input - [0:0]
:output_docker_rule - [0:0]
:output_lan_rule - [0:0]
:output_rule - [0:0]
:output_wan_rule - [0:0]
:reject - [0:0]
:syn_flood - [0:0]
:zone_docker_dest_ACCEPT - [0:0]
:zone_docker_forward - [0:0]
:zone_docker_input - [0:0]
:zone_docker_output - [0:0]
:zone_docker_src_ACCEPT - [0:0]
:zone_lan_dest_ACCEPT - [0:0]
:zone_lan_forward - [0:0]
:zone_lan_input - [0:0]
:zone_lan_output - [0:0]
:zone_lan_src_ACCEPT - [0:0]
:zone_wan_dest_ACCEPT - [0:0]
:zone_wan_dest_REJECT - [0:0]
:zone_wan_forward - [0:0]
:zone_wan_input - [0:0]
:zone_wan_output - [0:0]
:zone_wan_src_REJECT - [0:0]
-A INPUT -d 198.18.*.*/16 -p icmp -m icmp --icmp-type 8 -m comment --comment "OpenClash ICMP INPUT REJECT" -j REJECT --reject-with icmp-admin-prohibited
-A INPUT -i pppoe-wan -m set ! --match-set localnetwork src -j openclash_wan_input
-A INPUT -i lo -m comment --comment "!fw3" -j ACCEPT
-A INPUT -m comment --comment "!fw3: Custom input rule chain" -j input_rule
-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment "!fw3" -j ACCEPT
-A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -m comment --comment "!fw3" -j syn_flood
-A INPUT -i br-lan -m comment --comment "!fw3" -j zone_lan_input
-A INPUT -i pppoe-wan -m comment --comment "!fw3" -j zone_wan_input
-A INPUT -i docker0 -m comment --comment "!fw3" -j zone_docker_input
-A FORWARD -d 198.18.*.*/16 -p icmp -m icmp --icmp-type 8 -m comment --comment "OpenClash ICMP FORWARD REJECT" -j REJECT --reject-with icmp-admin-prohibited
-A FORWARD -j DOCKER-USER
-A FORWARD -j DOCKER-ISOLATION-STAGE-1
-A FORWARD -o docker0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -o docker0 -j DOCKER
-A FORWARD -i docker0 ! -o docker0 -j ACCEPT
-A FORWARD -i docker0 -o docker0 -j ACCEPT
-A FORWARD -o br-5ed7c552c81e -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -o br-5ed7c552c81e -j DOCKER
-A FORWARD -i br-5ed7c552c81e ! -o br-5ed7c552c81e -j ACCEPT
-A FORWARD -i br-5ed7c552c81e -o br-5ed7c552c81e -j ACCEPT
-A FORWARD -o br-03c53bca8fad -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -o br-03c53bca8fad -j DOCKER
-A FORWARD -i br-03c53bca8fad ! -o br-03c53bca8fad -j ACCEPT
-A FORWARD -i br-03c53bca8fad -o br-03c53bca8fad -j ACCEPT
-A FORWARD -o br-e5ba47e8b7c0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -o br-e5ba47e8b7c0 -j DOCKER
-A FORWARD -i br-e5ba47e8b7c0 ! -o br-e5ba47e8b7c0 -j ACCEPT
-A FORWARD -i br-e5ba47e8b7c0 -o br-e5ba47e8b7c0 -j ACCEPT
-A FORWARD -o br-88fbd09805a9 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -o br-88fbd09805a9 -j DOCKER
-A FORWARD -i br-88fbd09805a9 ! -o br-88fbd09805a9 -j ACCEPT
-A FORWARD -i br-88fbd09805a9 -o br-88fbd09805a9 -j ACCEPT
-A FORWARD -m comment --comment "!fw3: Custom forwarding rule chain" -j forwarding_rule
-A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment "!fw3" -j ACCEPT
-A FORWARD -i br-lan -m comment --comment "!fw3" -j zone_lan_forward
-A FORWARD -i pppoe-wan -m comment --comment "!fw3" -j zone_wan_forward
-A FORWARD -i docker0 -m comment --comment "!fw3" -j zone_docker_forward
-A FORWARD -m comment --comment "!fw3" -j reject
-A OUTPUT -d 198.18.*.*/16 -p icmp -m icmp --icmp-type 8 -m owner ! --gid-owner 65534 -m comment --comment "OpenClash ICMP OUTPUT REJECT" -j REJECT --reject-with icmp-admin-prohibited
-A OUTPUT -o lo -m comment --comment "!fw3" -j ACCEPT
-A OUTPUT -m comment --comment "!fw3: Custom output rule chain" -j output_rule
-A OUTPUT -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment "!fw3" -j ACCEPT
-A OUTPUT -o br-lan -m comment --comment "!fw3" -j zone_lan_output
-A OUTPUT -o pppoe-wan -m comment --comment "!fw3" -j zone_wan_output
-A OUTPUT -o docker0 -m comment --comment "!fw3" -j zone_docker_output
-A DOCKER -d 172.18.*.*/32 ! -i br-5ed7c552c81e -o br-5ed7c552c81e -p tcp -m tcp --dport 5001 -j ACCEPT
-A DOCKER -d 172.19.*.*/32 ! -i br-03c53bca8fad -o br-03c53bca8fad -p tcp -m tcp --dport 1200 -j ACCEPT
-A DOCKER -d 172.19.*.*/32 ! -i br-03c53bca8fad -o br-03c53bca8fad -p tcp -m tcp --dport 443 -j ACCEPT
-A DOCKER -d 172.20.*.*/32 ! -i br-88fbd09805a9 -o br-88fbd09805a9 -p tcp -m tcp --dport 5244 -j ACCEPT
-A DOCKER-ISOLATION-STAGE-1 -i docker0 ! -o docker0 -j DOCKER-ISOLATION-STAGE-2
-A DOCKER-ISOLATION-STAGE-1 -i br-5ed7c552c81e ! -o br-5ed7c552c81e -j DOCKER-ISOLATION-STAGE-2
-A DOCKER-ISOLATION-STAGE-1 -i br-03c53bca8fad ! -o br-03c53bca8fad -j DOCKER-ISOLATION-STAGE-2
-A DOCKER-ISOLATION-STAGE-1 -i br-e5ba47e8b7c0 ! -o br-e5ba47e8b7c0 -j DOCKER-ISOLATION-STAGE-2
-A DOCKER-ISOLATION-STAGE-1 -i br-88fbd09805a9 ! -o br-88fbd09805a9 -j DOCKER-ISOLATION-STAGE-2
-A DOCKER-ISOLATION-STAGE-1 -j RETURN
-A DOCKER-ISOLATION-STAGE-2 -o docker0 -j DROP
-A DOCKER-ISOLATION-STAGE-2 -o br-5ed7c552c81e -j DROP
-A DOCKER-ISOLATION-STAGE-2 -o br-03c53bca8fad -j DROP
-A DOCKER-ISOLATION-STAGE-2 -o br-e5ba47e8b7c0 -j DROP
-A DOCKER-ISOLATION-STAGE-2 -o br-88fbd09805a9 -j DROP
-A DOCKER-ISOLATION-STAGE-2 -j RETURN
-A DOCKER-USER -i eth1 -o docker0 -j REJECT --reject-with icmp-port-unreachable
-A DOCKER-USER -j RETURN
-A openclash_wan_input -p udp -m multiport --dports 7892,7895,9090,7890,7891,7893,7874 -j REJECT --reject-with icmp-port-unreachable
-A openclash_wan_input -p tcp -m multiport --dports 7892,7895,9090,7890,7891,7893,7874 -j REJECT --reject-with icmp-port-unreachable
-A reject -p tcp -m comment --comment "!fw3" -j REJECT --reject-with tcp-reset
-A reject -m comment --comment "!fw3" -j REJECT --reject-with icmp-port-unreachable
-A syn_flood -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -m limit --limit 25/sec --limit-burst 50 -m comment --comment "!fw3" -j RETURN
-A syn_flood -m comment --comment "!fw3" -j DROP
-A zone_docker_dest_ACCEPT -o docker0 -m comment --comment "!fw3" -j ACCEPT
-A zone_docker_forward -m comment --comment "!fw3: Custom docker forwarding rule chain" -j forwarding_docker_rule
-A zone_docker_forward -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port forwards" -j ACCEPT
-A zone_docker_forward -m comment --comment "!fw3" -j zone_docker_dest_ACCEPT
-A zone_docker_input -m comment --comment "!fw3: Custom docker input rule chain" -j input_docker_rule
-A zone_docker_input -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port redirections" -j ACCEPT
-A zone_docker_input -m comment --comment "!fw3" -j zone_docker_src_ACCEPT
-A zone_docker_output -m comment --comment "!fw3: Custom docker output rule chain" -j output_docker_rule
-A zone_docker_output -m comment --comment "!fw3" -j zone_docker_dest_ACCEPT
-A zone_docker_src_ACCEPT -i docker0 -m conntrack --ctstate NEW,UNTRACKED -m comment --comment "!fw3" -j ACCEPT
-A zone_lan_dest_ACCEPT -o br-lan -m comment --comment "!fw3" -j ACCEPT
-A zone_lan_forward -m comment --comment "!fw3: Custom lan forwarding rule chain" -j forwarding_lan_rule
-A zone_lan_forward -m comment --comment "!fw3: Zone lan to wan forwarding policy" -j zone_wan_dest_ACCEPT
-A zone_lan_forward -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port forwards" -j ACCEPT
-A zone_lan_forward -m comment --comment "!fw3" -j zone_lan_dest_ACCEPT
-A zone_lan_input -m comment --comment "!fw3: Custom lan input rule chain" -j input_lan_rule
-A zone_lan_input -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port redirections" -j ACCEPT
-A zone_lan_input -m comment --comment "!fw3" -j zone_lan_src_ACCEPT
-A zone_lan_output -m comment --comment "!fw3: Custom lan output rule chain" -j output_lan_rule
-A zone_lan_output -m comment --comment "!fw3" -j zone_lan_dest_ACCEPT
-A zone_lan_src_ACCEPT -i br-lan -m conntrack --ctstate NEW,UNTRACKED -m comment --comment "!fw3" -j ACCEPT
-A zone_wan_dest_ACCEPT -o pppoe-wan -m conntrack --ctstate INVALID -m comment --comment "!fw3: Prevent NAT leakage" -j DROP
-A zone_wan_dest_ACCEPT -o pppoe-wan -m comment --comment "!fw3" -j ACCEPT
-A zone_wan_dest_REJECT -o pppoe-wan -m comment --comment "!fw3" -j reject
-A zone_wan_forward -m comment --comment "!fw3: Custom wan forwarding rule chain" -j forwarding_wan_rule
-A zone_wan_forward -p esp -m comment --comment "!fw3: Allow-IPSec-ESP" -j zone_lan_dest_ACCEPT
-A zone_wan_forward -p udp -m udp --dport 500 -m comment --comment "!fw3: Allow-ISAKMP" -j zone_lan_dest_ACCEPT
-A zone_wan_forward -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port forwards" -j ACCEPT
-A zone_wan_forward -j MINIUPNPD
-A zone_wan_forward -j MINIUPNPD
-A zone_wan_forward -m comment --comment "!fw3" -j zone_wan_dest_REJECT
-A zone_wan_input -m comment --comment "!fw3: Custom wan input rule chain" -j input_wan_rule
-A zone_wan_input -p udp -m udp --dport 68 -m comment --comment "!fw3: Allow-DHCP-Renew" -j ACCEPT
-A zone_wan_input -p icmp -m icmp --icmp-type 8 -m comment --comment "!fw3: Allow-Ping" -j ACCEPT
-A zone_wan_input -p igmp -m comment --comment "!fw3: Allow-IGMP" -j ACCEPT
-A zone_wan_input -p tcp -m tcp --dport 5244 -m limit --limit 10/sec -m comment --comment "!fw3: 端口" -j ACCEPT
-A zone_wan_input -p tcp -m tcp --dport 66 -m limit --limit 10/sec -m comment --comment "!fw3: 端口" -j ACCEPT
-A zone_wan_input -p tcp -m tcp --dport 16601 -m limit --limit 10/sec -m comment --comment "!fw3: 端口" -j ACCEPT
-A zone_wan_input -p udp -m udp --dport 5244 -m limit --limit 10/sec -m comment --comment "!fw3: 端口" -j ACCEPT
-A zone_wan_input -p udp -m udp --dport 66 -m limit --limit 10/sec -m comment --comment "!fw3: 端口" -j ACCEPT
-A zone_wan_input -p udp -m udp --dport 16601 -m limit --limit 10/sec -m comment --comment "!fw3: 端口" -j ACCEPT
-A zone_wan_input -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port redirections" -j ACCEPT
-A zone_wan_input -j MINIUPNPD
-A zone_wan_input -j MINIUPNPD
-A zone_wan_input -m comment --comment "!fw3" -j zone_wan_src_REJECT
-A zone_wan_output -m comment --comment "!fw3: Custom wan output rule chain" -j output_wan_rule
-A zone_wan_output -m comment --comment "!fw3" -j zone_wan_dest_ACCEPT
-A zone_wan_src_REJECT -i pppoe-wan -m comment --comment "!fw3" -j reject
COMMIT
# Completed on Mon Nov 3 15:28:02 2025
#IPv6 NAT chain
# Generated by ip6tables-save v1.8.7 on Mon Nov 3 15:28:02 2025
*nat
:PREROUTING ACCEPT [337:48458]
:INPUT ACCEPT [250:18048]
:OUTPUT ACCEPT [785:194544]
:POSTROUTING ACCEPT [1032:237258]
:openclash_dns_redirect - [0:0]
-A PREROUTING -p tcp -m tcp --dport 53 -j openclash_dns_redirect
-A PREROUTING -p udp -m udp --dport 53 -j openclash_dns_redirect
-A OUTPUT -p tcp -m tcp --dport 53 -m owner ! --gid-owner 65534 -m comment --comment "OpenClash DNS Hijack" -j REDIRECT --to-ports 7874
-A OUTPUT -p udp -m udp --dport 53 -m owner ! --gid-owner 65534 -m comment --comment "OpenClash DNS Hijack" -j REDIRECT --to-ports 7874
-A openclash_dns_redirect -p udp -m udp --dport 53 -m set ! --match-set lan_ac_black_macs src -m comment --comment "OpenClash DNS Hijack" -j REDIRECT --to-ports 7874
-A openclash_dns_redirect -p tcp -m tcp --dport 53 -m set ! --match-set lan_ac_black_macs src -m comment --comment "OpenClash DNS Hijack" -j REDIRECT --to-ports 7874
COMMIT
# Completed on Mon Nov 3 15:28:02 2025
#IPv6 Mangle chain
# Generated by ip6tables-save v1.8.7 on Mon Nov 3 15:28:02 2025
*mangle
:PREROUTING ACCEPT [89533:82609088]
:INPUT ACCEPT [6042:3079108]
:FORWARD ACCEPT [85707:80689454]
:OUTPUT ACCEPT [5915:4020106]
:POSTROUTING ACCEPT [91585:84707126]
:openclash - [0:0]
:openclash_output - [0:0]
-A PREROUTING -j openclash
-A FORWARD -o pppoe-wan -p tcp -m tcp --tcp-flags SYN,RST SYN -m comment --comment "!fw3: Zone wan MTU fixing" -j TCPMSS --clamp-mss-to-pmtu
-A FORWARD -i pppoe-wan -p tcp -m tcp --tcp-flags SYN,RST SYN -m comment --comment "!fw3: Zone wan MTU fixing" -j TCPMSS --clamp-mss-to-pmtu
-A OUTPUT -j openclash_output
-A openclash -p udp -m udp --sport 16601 -j RETURN
-A openclash -p tcp -m tcp --sport 16601 -j RETURN
-A openclash -p udp -m udp --sport 66 -j RETURN
-A openclash -p tcp -m tcp --sport 66 -j RETURN
-A openclash -p udp -m udp --sport 5244 -j RETURN
-A openclash -p tcp -m tcp --sport 5244 -j RETURN
-A openclash -p udp -m udp --sport 500 -j RETURN
-A openclash -p udp -m udp --sport 546 -j RETURN
-A openclash -d fdfe:dcba:9876::/64 -p udp -j TPROXY --on-port 7895 --on-ip :: --tproxy-mark 0x162/0xffffffff
-A openclash -d fdfe:dcba:9876::/64 -p tcp -j TPROXY --on-port 7895 --on-ip :: --tproxy-mark 0x162/0xffffffff
-A openclash -m set --match-set localnetwork6 dst -j RETURN
-A openclash -m conntrack --ctdir REPLY -j RETURN
-A openclash -m set --match-set lan_ac_black_macs src -j RETURN
-A openclash -m set --match-set china_ip6_route dst -j RETURN
-A openclash -p tcp -m comment --comment "OpenClash TCP Tproxy" -j TPROXY --on-port 7895 --on-ip :: --tproxy-mark 0x162/0xffffffff
-A openclash -p udp -m comment --comment "OpenClash UDP Tproxy" -j TPROXY --on-port 7895 --on-ip :: --tproxy-mark 0x162/0xffffffff
-A openclash_output -p udp -m udp --sport 16601 -j RETURN
-A openclash_output -p tcp -m tcp --sport 16601 -j RETURN
-A openclash_output -p udp -m udp --sport 66 -j RETURN
-A openclash_output -p tcp -m tcp --sport 66 -j RETURN
-A openclash_output -p udp -m udp --sport 5244 -j RETURN
-A openclash_output -p tcp -m tcp --sport 5244 -j RETURN
-A openclash_output -p udp -m udp --sport 500 -j RETURN
-A openclash_output -p udp -m udp --sport 546 -j RETURN
-A openclash_output -d fdfe:dcba:9876::/64 -p udp -j MARK --set-xmark 0x162/0xffffffff
-A openclash_output -d fdfe:dcba:9876::/64 -p tcp -j MARK --set-xmark 0x162/0xffffffff
-A openclash_output -m owner --gid-owner 65534 -j RETURN
-A openclash_output -m set --match-set localnetwork6 dst -j RETURN
-A openclash_output -m conntrack --ctdir REPLY -j RETURN
-A openclash_output -m set --match-set china_ip6_route dst -j RETURN
-A openclash_output -j MARK --set-xmark 0x162/0xffffffff
COMMIT
# Completed on Mon Nov 3 15:28:02 2025
#IPv6 Filter chain
# Generated by ip6tables-save v1.8.7 on Mon Nov 3 15:28:02 2025
*filter
:INPUT ACCEPT [12:1240]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [0:0]
:MINIUPNPD - [0:0]
:forwarding_docker_rule - [0:0]
:forwarding_lan_rule - [0:0]
:forwarding_rule - [0:0]
:forwarding_wan_rule - [0:0]
:input_docker_rule - [0:0]
:input_lan_rule - [0:0]
:input_rule - [0:0]
:input_wan_rule - [0:0]
:openclash_wan_input - [0:0]
:output_docker_rule - [0:0]
:output_lan_rule - [0:0]
:output_rule - [0:0]
:output_wan_rule - [0:0]
:reject - [0:0]
:syn_flood - [0:0]
:zone_docker_dest_ACCEPT - [0:0]
:zone_docker_forward - [0:0]
:zone_docker_input - [0:0]
:zone_docker_output - [0:0]
:zone_docker_src_ACCEPT - [0:0]
:zone_lan_dest_ACCEPT - [0:0]
:zone_lan_forward - [0:0]
:zone_lan_input - [0:0]
:zone_lan_output - [0:0]
:zone_lan_src_ACCEPT - [0:0]
:zone_wan_dest_ACCEPT - [0:0]
:zone_wan_dest_REJECT - [0:0]
:zone_wan_forward - [0:0]
:zone_wan_input - [0:0]
:zone_wan_output - [0:0]
:zone_wan_src_REJECT - [0:0]
-A INPUT -i pppoe-wan -m set ! --match-set localnetwork6 src -j openclash_wan_input
-A INPUT -i lo -m comment --comment "!fw3" -j ACCEPT
-A INPUT -m comment --comment "!fw3: Custom input rule chain" -j input_rule
-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment "!fw3" -j ACCEPT
-A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -m comment --comment "!fw3" -j syn_flood
-A INPUT -i br-lan -m comment --comment "!fw3" -j zone_lan_input
-A INPUT -i pppoe-wan -m comment --comment "!fw3" -j zone_wan_input
-A INPUT -i docker0 -m comment --comment "!fw3" -j zone_docker_input
-A FORWARD -m comment --comment "!fw3: Custom forwarding rule chain" -j forwarding_rule
-A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment "!fw3" -j ACCEPT
-A FORWARD -i br-lan -m comment --comment "!fw3" -j zone_lan_forward
-A FORWARD -i pppoe-wan -m comment --comment "!fw3" -j zone_wan_forward
-A FORWARD -i docker0 -m comment --comment "!fw3" -j zone_docker_forward
-A FORWARD -m comment --comment "!fw3" -j reject
-A OUTPUT -o lo -m comment --comment "!fw3" -j ACCEPT
-A OUTPUT -m comment --comment "!fw3: Custom output rule chain" -j output_rule
-A OUTPUT -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment "!fw3" -j ACCEPT
-A OUTPUT -o br-lan -m comment --comment "!fw3" -j zone_lan_output
-A OUTPUT -o pppoe-wan -m comment --comment "!fw3" -j zone_wan_output
-A OUTPUT -o docker0 -m comment --comment "!fw3" -j zone_docker_output
-A openclash_wan_input -p udp -m multiport --dports 7892,7895,9090,7890,7891,7893,7874 -j REJECT --reject-with icmp6-port-unreachable
-A openclash_wan_input -p tcp -m multiport --dports 7892,7895,9090,7890,7891,7893,7874 -j REJECT --reject-with icmp6-port-unreachable
-A reject -p tcp -m comment --comment "!fw3" -j REJECT --reject-with tcp-reset
-A reject -m comment --comment "!fw3" -j REJECT --reject-with icmp6-port-unreachable
-A syn_flood -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -m limit --limit 25/sec --limit-burst 50 -m comment --comment "!fw3" -j RETURN
-A syn_flood -m comment --comment "!fw3" -j DROP
-A zone_docker_dest_ACCEPT -o docker0 -m comment --comment "!fw3" -j ACCEPT
-A zone_docker_forward -m comment --comment "!fw3: Custom docker forwarding rule chain" -j forwarding_docker_rule
-A zone_docker_forward -m comment --comment "!fw3" -j zone_docker_dest_ACCEPT
-A zone_docker_input -m comment --comment "!fw3: Custom docker input rule chain" -j input_docker_rule
-A zone_docker_input -m comment --comment "!fw3" -j zone_docker_src_ACCEPT
-A zone_docker_output -m comment --comment "!fw3: Custom docker output rule chain" -j output_docker_rule
-A zone_docker_output -m comment --comment "!fw3" -j zone_docker_dest_ACCEPT
-A zone_docker_src_ACCEPT -i docker0 -m conntrack --ctstate NEW,UNTRACKED -m comment --comment "!fw3" -j ACCEPT
-A zone_lan_dest_ACCEPT -o br-lan -m comment --comment "!fw3" -j ACCEPT
-A zone_lan_forward -m comment --comment "!fw3: Custom lan forwarding rule chain" -j forwarding_lan_rule
-A zone_lan_forward -m comment --comment "!fw3: Zone lan to wan forwarding policy" -j zone_wan_dest_ACCEPT
-A zone_lan_forward -m comment --comment "!fw3" -j zone_lan_dest_ACCEPT
-A zone_lan_input -m comment --comment "!fw3: Custom lan input rule chain" -j input_lan_rule
-A zone_lan_input -m comment --comment "!fw3" -j zone_lan_src_ACCEPT
-A zone_lan_output -m comment --comment "!fw3: Custom lan output rule chain" -j output_lan_rule
-A zone_lan_output -m comment --comment "!fw3" -j zone_lan_dest_ACCEPT
-A zone_lan_src_ACCEPT -i br-lan -m conntrack --ctstate NEW,UNTRACKED -m comment --comment "!fw3" -j ACCEPT
-A zone_wan_dest_ACCEPT -o pppoe-wan -m conntrack --ctstate INVALID -m comment --comment "!fw3: Prevent NAT leakage" -j DROP
-A zone_wan_dest_ACCEPT -o pppoe-wan -m comment --comment "!fw3" -j ACCEPT
-A zone_wan_dest_REJECT -o pppoe-wan -m comment --comment "!fw3" -j reject
-A zone_wan_forward -m comment --comment "!fw3: Custom wan forwarding rule chain" -j forwarding_wan_rule
-A zone_wan_forward -p ipv6-icmp -m icmp6 --icmpv6-type 128 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Forward" -j ACCEPT
-A zone_wan_forward -p ipv6-icmp -m icmp6 --icmpv6-type 129 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Forward" -j ACCEPT
-A zone_wan_forward -p ipv6-icmp -m icmp6 --icmpv6-type 1 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Forward" -j ACCEPT
-A zone_wan_forward -p ipv6-icmp -m icmp6 --icmpv6-type 2 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Forward" -j ACCEPT
-A zone_wan_forward -p ipv6-icmp -m icmp6 --icmpv6-type 3 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Forward" -j ACCEPT
-A zone_wan_forward -p ipv6-icmp -m icmp6 --icmpv6-type 4/0 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Forward" -j ACCEPT
-A zone_wan_forward -p ipv6-icmp -m icmp6 --icmpv6-type 4/1 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Forward" -j ACCEPT
-A zone_wan_forward -p esp -m comment --comment "!fw3: Allow-IPSec-ESP" -j zone_lan_dest_ACCEPT
-A zone_wan_forward -p udp -m udp --dport 500 -m comment --comment "!fw3: Allow-ISAKMP" -j zone_lan_dest_ACCEPT
-A zone_wan_forward -j MINIUPNPD
-A zone_wan_forward -j MINIUPNPD
-A zone_wan_forward -m comment --comment "!fw3" -j zone_wan_dest_REJECT
-A zone_wan_input -m comment --comment "!fw3: Custom wan input rule chain" -j input_wan_rule
-A zone_wan_input -p udp -m udp --dport 546 -m comment --comment "!fw3: Allow-DHCPv6" -j ACCEPT
-A zone_wan_input -s fe80::/10 -p ipv6-icmp -m icmp6 --icmpv6-type 130/0 -m comment --comment "!fw3: Allow-MLD" -j ACCEPT
-A zone_wan_input -s fe80::/10 -p ipv6-icmp -m icmp6 --icmpv6-type 131/0 -m comment --comment "!fw3: Allow-MLD" -j ACCEPT
-A zone_wan_input -s fe80::/10 -p ipv6-icmp -m icmp6 --icmpv6-type 132/0 -m comment --comment "!fw3: Allow-MLD" -j ACCEPT
-A zone_wan_input -s fe80::/10 -p ipv6-icmp -m icmp6 --icmpv6-type 143/0 -m comment --comment "!fw3: Allow-MLD" -j ACCEPT
-A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 128 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT
-A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 129 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT
-A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 1 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT
-A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 2 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT
-A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 3 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT
-A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 4/0 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT
-A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 4/1 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT
-A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 133 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT
-A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 135 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT
-A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 134 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT
-A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 136 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT
-A zone_wan_input -p tcp -m tcp --dport 5244 -m limit --limit 10/sec -m comment --comment "!fw3: 端口" -j ACCEPT
-A zone_wan_input -p tcp -m tcp --dport 66 -m limit --limit 10/sec -m comment --comment "!fw3: 端口" -j ACCEPT
-A zone_wan_input -p tcp -m tcp --dport 16601 -m limit --limit 10/sec -m comment --comment "!fw3: 端口" -j ACCEPT
-A zone_wan_input -p udp -m udp --dport 5244 -m limit --limit 10/sec -m comment --comment "!fw3: 端口" -j ACCEPT
-A zone_wan_input -p udp -m udp --dport 66 -m limit --limit 10/sec -m comment --comment "!fw3: 端口" -j ACCEPT
-A zone_wan_input -p udp -m udp --dport 16601 -m limit --limit 10/sec -m comment --comment "!fw3: 端口" -j ACCEPT
-A zone_wan_input -j MINIUPNPD
-A zone_wan_input -j MINIUPNPD
-A zone_wan_input -m comment --comment "!fw3" -j zone_wan_src_REJECT
-A zone_wan_output -m comment --comment "!fw3: Custom wan output rule chain" -j output_wan_rule
-A zone_wan_output -m comment --comment "!fw3" -j zone_wan_dest_ACCEPT
-A zone_wan_src_REJECT -i pppoe-wan -m comment --comment "!fw3" -j reject
COMMIT
# Completed on Mon Nov 3 15:28:02 2025
#===================== IPSET状态 =====================#
Name: china_ip_route
Type: hash:net
Revision: 6
Header: family inet hashsize 4096 maxelem 1000000
Size in memory: 225672
References: 4
Number of entries: 7043
Name: lan_ac_black_macs
Type: hash:mac
Revision: 0
Header: hashsize 1024 maxelem 65536
Size in memory: 256
References: 7
Number of entries: 1
Name: localnetwork
Type: hash:net
Revision: 6
Header: family inet hashsize 1024 maxelem 65536
Size in memory: 1536
References: 5
Number of entries: 17
Name: china_ip6_route
Type: hash:net
Revision: 6
Header: family inet6 hashsize 1024 maxelem 1000000
Size in memory: 93072
References: 2
Number of entries: 1526
Name: localnetwork6
Type: hash:net
Revision: 6
Header: family inet6 hashsize 1024 maxelem 65536
Size in memory: 3136
References: 3
Number of entries: 17
#===================== 路由表状态 =====================#
#IPv4
#route -n
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
0.0.*.* 100.72.*.* 0.0.*.* UG 0 0 0 pppoe-wan
10.0.*.* 0.0.*.* 255.0.*.* U 0 0 0 br-lan
100.72.*.* 0.0.*.* 255.255.*.* UH 0 0 0 pppoe-wan
172.17.*.* 0.0.*.* 255.255.*.* U 0 0 0 docker0
172.18.*.* 0.0.*.* 255.255.*.* U 0 0 0 br-5ed7c552c81e
172.19.*.* 0.0.*.* 255.255.*.* U 0 0 0 br-03c53bca8fad
172.20.*.* 0.0.*.* 255.255.*.* U 0 0 0 br-88fbd09805a9
172.21.*.* 0.0.*.* 255.255.*.* U 0 0 0 br-e5ba47e8b7c0
#ip route list
default via 100.72.*.* dev pppoe-wan proto static
10.0.*.*/8 dev br-lan proto kernel scope link src 10.0.*.*
100.72.*.* dev pppoe-wan proto kernel scope link src 100.72.*.*
172.17.*.*/16 dev docker0 proto kernel scope link src 172.17.*.* linkdown
172.18.*.*/16 dev br-5ed7c552c81e proto kernel scope link src 172.18.*.*
172.19.*.*/16 dev br-03c53bca8fad proto kernel scope link src 172.19.*.*
172.20.*.*/16 dev br-88fbd09805a9 proto kernel scope link src 172.20.*.*
172.21.*.*/16 dev br-e5ba47e8b7c0 proto kernel scope link src 172.21.*.*
#ip rule show
0: from all lookup local
32765: from all fwmark 0x162 lookup 354
32766: from all lookup main
32767: from all lookup default
#IPv6
#route -A inet6
Kernel IPv6 routing table
Destination Next Hop Flags Metric Ref Use Iface
::/0 :: U 1024 2 0 lo
::/0 fe80::*:*:*:13a UG 512 1 0 pppoe-wan
::/0 fe80::*:*:*:13a UG 512 6 0 pppoe-wan
2409:*:*:*::/64 :: !n 2147483647 2 0 lo
2409:*:*:*::/64 :: U 1024 2 0 br-lan
2409:*:*:*::/60 :: !n 2147483647 1 0 lo
fe80::*:*:*:13a/128 :: U 256 1 0 pppoe-wan
fe80::*:*:*:948b/128 :: U 256 1 0 pppoe-wan
fe80::/64 :: U 256 5 0 br-lan
fe80::/64 :: U 256 1 0 eth1
fe80::/64 :: U 256 1 0 ra0
fe80::/64 :: U 256 1 0 br-03c53bca8fad
fe80::/64 :: U 256 1 0 veth0fbc583
fe80::/64 :: U 256 1 0 br-e5ba47e8b7c0
fe80::/64 :: U 256 1 0 vethb63e7c8
fe80::/64 :: U 256 1 0 veth8fd9b68
fe80::/64 :: U 256 1 0 br-5ed7c552c81e
fe80::/64 :: U 256 1 0 br-88fbd09805a9
fe80::/64 :: U 256 1 0 veth8287666
fe80::/64 :: U 256 1 0 veth5cd07e0
fe80::/64 :: U 256 1 0 rax0
fe80::/64 :: U 256 1 0 veth643ef40
::/0 :: !n -1 2 0 lo
::1/128 :: Un 0 7 0 lo
2409:*:*:*::/128 :: Un 0 3 0 pppoe-wan
2409:*:*:*:cc34:c701:3487:948b/128 :: Un 0 4 0 pppoe-wan
2409:*:*:*::/128 :: Un 0 3 0 br-lan
2409:*:*:*:ded8:7cff:fe5c:37a4/128 :: Un 0 7 0 br-lan
fe80::/128 :: Un 0 8 0 eth1
fe80::/128 :: Un 0 3 0 br-lan
fe80::/128 :: Un 0 3 0 ra0
fe80::/128 :: Un 0 3 0 br-03c53bca8fad
fe80::/128 :: Un 0 3 0 br-5ed7c552c81e
fe80::/128 :: Un 0 3 0 veth0fbc583
fe80::/128 :: Un 0 3 0 br-88fbd09805a9
fe80::/128 :: Un 0 3 0 veth8fd9b68
fe80::/128 :: Un 0 3 0 vethb63e7c8
fe80::/128 :: Un 0 3 0 br-e5ba47e8b7c0
fe80::/128 :: Un 0 3 0 veth8287666
fe80::/128 :: Un 0 3 0 veth5cd07e0
fe80::/128 :: Un 0 3 0 rax0
fe80::/128 :: Un 0 3 0 veth643ef40
fe80::*:*:*:43c4/128 :: Un 0 2 0 br-5ed7c552c81e
fe80::*:*:*:dd49/128 :: Un 0 2 0 br-e5ba47e8b7c0
fe80::*:*:*:cba7/128 :: Un 0 2 0 br-88fbd09805a9
fe80::*:*:*:edde/128 :: Un 0 5 0 br-03c53bca8fad
fe80::*:*:*:f429/128 :: Un 0 2 0 veth0fbc583
fe80::*:*:*:bdfb/128 :: Un 0 2 0 veth8287666
fe80::*:*:*:5f07/128 :: Un 0 2 0 veth643ef40
fe80::*:*:*:824a/128 :: Un 0 2 0 veth5cd07e0
fe80::*:*:*:360d/128 :: Un 0 3 0 veth8fd9b68
fe80::*:*:*:948b/128 :: Un 0 3 0 pppoe-wan
fe80::*:*:*:3710/128 :: Un 0 2 0 rax0
fe80::*:*:*:3710/128 :: Un 0 2 0 ra0
fe80::*:*:*:37a3/128 :: Un 0 8 0 eth1
fe80::*:*:*:37a4/128 :: Un 0 3 0 br-lan
fe80::*:*:*:6e23/128 :: Un 0 2 0 vethb63e7c8
ff00::/8 :: U 256 6 0 br-lan
ff00::/8 :: U 256 2 0 eth1
ff00::/8 :: U 256 5 0 pppoe-wan
ff00::/8 :: U 256 1 0 ra0
ff00::/8 :: U 256 1 0 br-03c53bca8fad
ff00::/8 :: U 256 1 0 veth0fbc583
ff00::/8 :: U 256 1 0 br-e5ba47e8b7c0
ff00::/8 :: U 256 1 0 vethb63e7c8
ff00::/8 :: U 256 1 0 veth8fd9b68
ff00::/8 :: U 256 1 0 br-5ed7c552c81e
ff00::/8 :: U 256 1 0 br-88fbd09805a9
ff00::/8 :: U 256 1 0 veth8287666
ff00::/8 :: U 256 1 0 veth5cd07e0
ff00::/8 :: U 256 1 0 rax0
ff00::/8 :: U 256 1 0 veth643ef40
::/0 :: !n -1 2 0 lo
#ip -6 route list
default from 2409:*:*:*::/64 via fe80::200:5eff:fe00:13a dev pppoe-wan proto static metric 512 pref medium
default from 2409:*:*:*::/60 via fe80::200:5eff:fe00:13a dev pppoe-wan proto static metric 512 pref medium
unreachable 2409:*:*:*::/64 dev lo proto static metric 2147483647 pref medium
2409:*:*:*::/64 dev br-lan proto static metric 1024 pref medium
unreachable 2409:*:*:*::/60 dev lo proto static metric 2147483647 pref medium
fe80::*:*:*:13a dev pppoe-wan proto kernel metric 256 pref medium
fe80::*:*:*:948b dev pppoe-wan proto kernel metric 256 pref medium
fe80::/64 dev br-lan proto kernel metric 256 pref medium
fe80::/64 dev eth1 proto kernel metric 256 pref medium
fe80::/64 dev ra0 proto kernel metric 256 pref medium
fe80::/64 dev br-03c53bca8fad proto kernel metric 256 pref medium
fe80::/64 dev veth0fbc583 proto kernel metric 256 pref medium
fe80::/64 dev br-e5ba47e8b7c0 proto kernel metric 256 pref medium
fe80::/64 dev vethb63e7c8 proto kernel metric 256 pref medium
fe80::/64 dev veth8fd9b68 proto kernel metric 256 pref medium
fe80::/64 dev br-5ed7c552c81e proto kernel metric 256 pref medium
fe80::/64 dev br-88fbd09805a9 proto kernel metric 256 pref medium
fe80::/64 dev veth8287666 proto kernel metric 256 pref medium
fe80::/64 dev veth5cd07e0 proto kernel metric 256 pref medium
fe80::/64 dev rax0 proto kernel metric 256 pref medium
fe80::/64 dev veth643ef40 proto kernel metric 256 pref medium
#ip -6 rule show
0: from all lookup local
32765: from all fwmark 0x162 lookup 354
32766: from all lookup main
4200000000: from 2409:*:*:*:ded8:7cff:fe5c:37a4/64 iif br-lan unreachable
4200000001: from all iif lo failed_policy
4200000007: from all iif br-lan failed_policy
4200000011: from all iif pppoe-wan failed_policy
4200000011: from all iif pppoe-wan failed_policy
#===================== 端口占用状态 =====================#
tcp 0 0 :::7892 :::* LISTEN 22581/clash
tcp 0 0 :::7893 :::* LISTEN 22581/clash
tcp 0 0 :::7895 :::* LISTEN 22581/clash
tcp 0 0 :::7874 :::* LISTEN 22581/clash
tcp 0 0 :::9090 :::* LISTEN 22581/clash
tcp 0 0 :::7890 :::* LISTEN 22581/clash
tcp 0 0 :::7891 :::* LISTEN 22581/clash
udp 0 0 :::60356 :::* 22581/clash
udp 0 0 :::47057 :::* 22581/clash
udp 0 0 :::39895 :::* 22581/clash
udp 0 0 :::49141 :::* 22581/clash
udp 0 0 :::32830 :::* 22581/clash
udp 0 0 :::53328 :::* 22581/clash
udp 0 0 :::47214 :::* 22581/clash
udp 0 0 :::57503 :::* 22581/clash
udp 0 0 :::34978 :::* 22581/clash
udp 0 0 :::48297 :::* 22581/clash
udp 0 0 :::39094 :::* 22581/clash
udp 0 0 :::53459 :::* 22581/clash
udp 0 0 :::43245 :::* 22581/clash
udp 0 0 :::39206 :::* 22581/clash
udp 0 0 :::44335 :::* 22581/clash
udp 0 0 :::41277 :::* 22581/clash
udp 0 0 :::33105 :::* 22581/clash
udp 0 0 :::60789 :::* 22581/clash
udp 0 0 :::34169 :::* 22581/clash
udp 0 0 :::59776 :::* 22581/clash
udp 0 0 :::33218 :::* 22581/clash
udp 0 0 :::52682 :::* 22581/clash
udp 0 0 :::36310 :::* 22581/clash
udp 0 0 :::43483 :::* 22581/clash
udp 0 0 :::36320 :::* 22581/clash
udp 0 0 :::48645 :::* 22581/clash
udp 0 0 :::37401 :::* 22581/clash
udp 0 0 :::41543 :::* 22581/clash
udp 0 0 :::49746 :::* 22581/clash
udp 0 0 :::33408 :::* 22581/clash
udp 0 0 :::41601 :::* 22581/clash
udp 0 0 :::55953 :::* 22581/clash
udp 0 0 :::38572 :::* 22581/clash
udp 0 0 :::37555 :::* 22581/clash
udp 0 0 :::7874 :::* 22581/clash
udp 0 0 :::34513 :::* 22581/clash
udp 0 0 :::7891 :::* 22581/clash
udp 0 0 :::7892 :::* 22581/clash
udp 0 0 :::7893 :::* 22581/clash
udp 0 0 :::7895 :::* 22581/clash
udp 0 0 :::33558 :::* 22581/clash
udp 0 0 :::53070 :::* 22581/clash
udp 0 0 :::43864 :::* 22581/clash
udp 0 0 :::37748 :::* 22581/clash
udp 0 0 :::44953 :::* 22581/clash
udp 0 0 :::56222 :::* 22581/clash
#===================== 测试本机DNS查询(www.baidu.com) =====================#
Server: 127.0.*.*
Address: 127.0.*.*#53
Name: www.baidu.com
www.baidu.com canonical name = www.a.shifen.com
Name: www.a.shifen.com
Address 1: 36.152.*.*
Address 2: 36.152.*.*
www.baidu.com canonical name = www.a.shifen.com
Address 3: 2409:*:*:*:0:ff:b0f6:b2d
Address 4: 2409:*:*:*:0:ff:b080:87f0
#===================== 测试内核DNS查询(www.instagram.com) =====================#
Status: 0
TC: false
RD: true
RA: true
AD: false
CD: false
Question:
Name: www.instagram.com.
Qtype: 1
Qclass: 1
Answer:
TTL: 429
data: 31.13.*.*
name: www.instagram.com.
type: 1
Status: 0
TC: false
RD: true
RA: true
AD: false
CD: false
Question:
Name: www.instagram.com.
Qtype: 28
Qclass: 1
Answer:
TTL: 373
data: z-p42-instagram.c10r.instagram.com.
name: www.instagram.com.
type: 5
TTL: 373
data: 2a03:*:*:*:face:b00c:0:25de
name: z-p42-instagram.c10r.instagram.com.
type: 28
Dnsmasq 当前默认 resolv 文件：/tmp/resolv.conf.d/resolv.conf.auto
#===================== /tmp/resolv.conf.auto =====================#
# Interface wan
nameserver 211.138.*.*
nameserver 211.138.*.*
# Interface wan_6
nameserver 2409:8030:2000::1
nameserver 2409:8030:2000::2
#===================== /tmp/resolv.conf.d/resolv.conf.auto =====================#
# Interface wan
nameserver 211.138.*.*
nameserver 211.138.*.*
# Interface wan_6
nameserver 2409:8030:2000::1
nameserver 2409:8030:2000::2
#===================== 测试本机网络连接(www.baidu.com) =====================#
HTTP/1.1 200 OK
Bdpagetype: 1
Bdqid: 0xc1de5f7a0001fa27
Connection: keep-alive
Content-Length: 638498
Content-Type: text/html; charset=utf-8
Date: Mon, 03 Nov 2025 07:28:02 GMT
Server: BWS/1.1
Set-Cookie: BIDUPSID=E3D235C933221CBB5CA45252E817CD55; expires=Thu, 31-Dec-37 23:55:55 GMT; max-age=2147483647; path=/; domain=.baidu.com
Set-Cookie: PSTM=1762154882; expires=Thu, 31-Dec-37 23:55:55 GMT; max-age=2147483647; path=/; domain=.baidu.com
Set-Cookie: BDSVRTM=0; path=/
Set-Cookie: BD_HOME=1; path=/
Set-Cookie: BAIDUID=E3D235C933221CBB5CA45252E817CD55:FG=1; Path=/; Domain=baidu.com; Max-Age=31536000
Set-Cookie: BAIDUID_BFESS=E3D235C933221CBB5CA45252E817CD55:FG=1; Path=/; Domain=baidu.com; Max-Age=31536000; Secure; SameSite=None
Tr_id: super_0xc1de5f7a0001fa27
Traceid: 1762154882153932340213969708071740635687
Vary: Accept-Encoding
X-Ua-Compatible: IE=Edge,chrome=1
X-Xss-Protection: 1;mode=block
#===================== 测试本机网络下载(raw.githubusercontent.com) =====================#
HTTP/2 200
cache-control: max-age=300
content-security-policy: default-src 'none'; style-src 'unsafe-inline'; sandbox
content-type: text/plain; charset=utf-8
etag: "f6037a93c68519d7041a3b4df325b61c424ec255b45dfeb063371319e39b0d96"
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
x-frame-options: deny
x-xss-protection: 1; mode=block
x-github-request-id: 9012:23701B:954E01:E2DECE:69082F99
accept-ranges: bytes
date: Mon, 03 Nov 2025 07:28:03 GMT
via: 1.1 varnish
x-served-by: cache-sin-wsat1880044-SIN
x-cache: HIT
x-cache-hits: 0
x-timer: S1762154883.072729,VS0,VE246
vary: Authorization,Accept-Encoding
access-control-allow-origin: *
cross-origin-resource-policy: cross-origin
x-fastly-request-id: 116cbe32da00d1dc4878b44ef0c1004b4fe4f310
expires: Mon, 03 Nov 2025 07:33:03 GMT
source-age: 0
content-length: 1071
#===================== 最近运行日志(自动切换为Debug模式) =====================#
#===================== 最近运行日志获取完成(自动切换为silent模式) =====================#
#===================== 活动连接信息 =====================#
1. SourceIP:【2409:*:*:*:fc0f:a696:d6a4:29f7】 - Host:【ws.chatgpt.com】 - DestinationIP:【】 - Network:【tcp】 - RulePayload:【openai】 - Lastchain:【🇨🇳香港7 💧 1x】
2. SourceIP:【2409:*:*:*:fc0f:a696:d6a4:29f7】 - Host:【sync.catsxp.com】 - DestinationIP:【】 - Network:【tcp】 - RulePayload:【】 - Lastchain:【日本 01 | 专线】
3. SourceIP:【2409:*:*:*:fc0f:a696:d6a4:29f7】 - Host:【avatars.githubusercontent.com】 - DestinationIP:【】 - Network:【tcp】 - RulePayload:【】 - Lastchain:【日本 01 | 专线】
4. SourceIP:【2409:*:*:*:fc0f:a696:d6a4:29f7】 - Host:【avatars1.githubusercontent.com】 - DestinationIP:【】 - Network:【tcp】 - RulePayload:【】 - Lastchain:【日本 01 | 专线】
5. SourceIP:【2409:*:*:*:fc0f:a696:d6a4:29f7】 - Host:【qqwry.api.skk.moe】 - DestinationIP:【】 - Network:【tcp】 - RulePayload:【】 - Lastchain:【日本 01 | 专线】
6. SourceIP:【2409:*:*:*:fc0f:a696:d6a4:29f7】 - Host:【avatars0.githubusercontent.com】 - DestinationIP:【】 - Network:【tcp】 - RulePayload:【】 - Lastchain:【日本 01 | 专线】
7. SourceIP:【2409:*:*:*:fc0f:a696:d6a4:29f7】 - Host:【d.skk.moe】 - DestinationIP:【】 - Network:【tcp】 - RulePayload:【】 - Lastchain:【日本 01 | 专线】
8. SourceIP:【2409:*:*:*:fc0f:a696:d6a4:29f7】 - Host:【cdn.oaistatic.com】 - DestinationIP:【】 - Network:【tcp】 - RulePayload:【openai】 - Lastchain:【🇯🇵日本2 💧 1x】
9. SourceIP:【2409:*:*:*:fc0f:a696:d6a4:29f7】 - Host:【avatars3.githubusercontent.com】 - DestinationIP:【】 - Network:【tcp】 - RulePayload:【】 - Lastchain:【日本 01 | 专线】
10. SourceIP:【2409:*:*:*:fc0f:a696:d6a4:29f7】 - Host:【api-ipv4.ip.sb】 - DestinationIP:【】 - Network:【tcp】 - RulePayload:【】 - Lastchain:【日本 01 | 专线】
11. SourceIP:【2409:*:*:*:fc0f:a696:d6a4:29f7】 - Host:【alive.github.com】 - DestinationIP:【】 - Network:【tcp】 - RulePayload:【】 - Lastchain:【🇨🇳香港7 💧 1x】
12. SourceIP:【2409:*:*:*:fc0f:a696:d6a4:29f7】 - Host:【client.wns.windows.com】 - DestinationIP:【】 - Network:【tcp】 - RulePayload:【microsoft】 - Lastchain:【DIRECT】
13. SourceIP:【2409:*:*:*:fc0f:a696:d6a4:29f7】 - Host:【avatars2.githubusercontent.com】 - DestinationIP:【】 - Network:【tcp】 - RulePayload:【】 - Lastchain:【日本 01 | 专线】
14. SourceIP:【2409:*:*:*:fc0f:a696:d6a4:29f7】 - Host:【www.catsxp.com】 - DestinationIP:【】 - Network:【tcp】 - RulePayload:【】 - Lastchain:【日本 01 | 专线】
15. SourceIP:【2409:*:*:*:fc0f:a696:d6a4:29f7】 - Host:【api.ipify.org】 - DestinationIP:【】 - Network:【tcp】 - RulePayload:【】 - Lastchain:【日本 01 | 专线】
OpenClash Config
hosts:
services.googleapis.cn: services.googleapis.com
"+.1234.123.army": 10.0.0.1Expected Behavior
正常解析
Additional Context
No response