使用场景:
openwrt主路由iptables透明代理
版本:
服务端,客户端都是1.2.2
现象:
局域网内各客户端正常
主路由自身不能解析国内、境外所有域名(dig
返回status: REFUSED
)
dig baidu.com
; <<>> DiG 9.16.8 <<>> baidu.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: REFUSED, id: 40939
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;baidu.com. IN A
;; Query time: 20 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Tue Jan 19 01:58:38 CST 2021
;; MSG SIZE rcvd: 38
xray客户端配置(小幅修改自 https://xtls.github.io/documents/level-2/tproxy/ ):
{
"log": {
"loglevel": "error",
"error": "/var/log/xray_error.log"
},
"inbounds": [
{
"tag": "all-in",
"port": 12345,
"protocol": "dokodemo-door",
"settings": {
"network": "tcp,udp",
"followRedirect": true
},
"sniffing": {
"enabled": true,
"destOverride": ["http", "tls"]
},
"streamSettings": {
"sockopt": {
"tproxy": "tproxy"
}
}
}
],
"outbounds": [
{
"tag": "direct",
"protocol": "freedom",
"settings": {
"domainStrategy": "UseIPv4"
},
"streamSettings": {
"sockopt": {
"mark": 2
}
}
},
{
"tag": "proxy",
"protocol": "vless",
"settings": {
"vnext": [{
"address": "服务器域名",
"port": 443,
"users": [{
"id": "uuid",
"flow": "xtls-rprx-splice",
"encryption": "none"
}]
}]
},
"streamSettings": {
"network": "tcp",
"security": "xtls",
"sockopt": {
"mark": 2
}
}
},
{
"tag": "block",
"protocol": "blackhole",
"settings": {
"response": {
"type": "http"
}
}
},
{
"tag": "dns-out",
"protocol": "dns",
"settings": {
"address": "1.1.1.1"
},
"proxySettings": {
"tag": "proxy"
},
"streamSettings": {
"sockopt": {
"mark": 2
}
}
}
],
"dns": {
"hosts": {
"服务器域名": "服务器IP",
},
"servers": [
{
"address": "223.5.5.5",
"port": 53,
"domains": ["geosite:cn"],
"expectIPs": ["geoip:cn"]
},
{
"address": "1.1.1.1",
"port": 53,
"domains": ["geosite:geolocation-!cn"]
},
"8.8.8.8"
]
},
"routing": {
"domainStrategy": "IPIfNonMatch",
"rules": [
{
"type": "field",
"inboundTag": ["all-in"],
"port": 53,
"outboundTag": "dns-out"
},
{
"type": "field",
"ip": [
"223.5.5.5"
],
"outboundTag": "direct"
},
{
"type": "field",
"ip": [
"8.8.8.8",
"1.1.1.1"
],
"outboundTag": "proxy"
},
{
"type": "field",
"domain": [
"geosite:category-ads-all"
],
"outboundTag": "block"
},
{
"type": "field",
"domain": [
"geosite:cn"
],
"outboundTag": "direct"
},
{
"type": "field",
"ip": [
"geoip:cn",
"geoip:private"
],
"outboundTag": "direct"
},
{
"type": "field",
"domain": [
"geosite:geolocation-!cn"
],
"outboundTag": "proxy"
},
{
"type": "field",
"ip": [
"geoip:jp",
"geoip:us",
"geoip:sg",
"geoip:hk",
"geoip:tw",
"109.239.140.0/24",
"14.102.250.18",
"14.102.250.19",
"149.154.164.0/22",
"149.154.168.0/22",
"149.154.172.0/22",
"174.142.105.153",
"50.7.31.230",
"67.220.91.15",
"67.220.91.18",
"67.220.91.23",
"69.65.19.160",
"72.52.81.22",
"85.17.73.31",
"91.108.4.0/22",
"91.108.56.0/22",
"91.108.56.0/23",
"108.177.120.94",
"108.177.120.0/24",
"172.217.0.0/16",
"74.125.0.0/16",
"23.246.0.0/18",
"37.77.184.0/21",
"45.57.0.0/17",
"64.120.128.0/17",
"66.197.128.0/17",
"108.175.32.0/20",
"192.173.64.0/18",
"198.38.96.0/19",
"198.45.48.0/20",
"173.245.48.0/20",
"103.21.244.0/22",
"103.22.200.0/22",
"103.31.4.0/22",
"141.101.64.0/18",
"108.162.192.0/18",
"190.93.240.0/20",
"188.114.96.0/20",
"197.234.240.0/22",
"198.41.128.0/17",
"162.158.0.0/15",
"104.16.0.0/12",
"172.64.0.0/13",
"131.0.72.0/22",
"144.220.0.0/16",
"52.124.128.0/17",
"54.230.0.0/16",
"54.239.128.0/18",
"52.82.128.0/19",
"99.84.0.0/16",
"204.246.172.0/24",
"54.239.192.0/19",
"70.132.0.0/18",
"13.32.0.0/15",
"205.251.208.0/20",
"13.224.0.0/14",
"13.35.0.0/16",
"204.246.164.0/22",
"204.246.168.0/22",
"71.152.0.0/17",
"216.137.32.0/19",
"205.251.249.0/24",
"99.86.0.0/16",
"52.46.0.0/18",
"52.84.0.0/15",
"204.246.173.0/24",
"130.176.0.0/16",
"205.251.200.0/21",
"204.246.174.0/23",
"64.252.128.0/18",
"205.251.254.0/24",
"143.204.0.0/16",
"205.251.252.0/23",
"204.246.176.0/20",
"13.249.0.0/16",
"54.240.128.0/18",
"205.251.250.0/23",
"52.222.128.0/17",
"54.182.0.0/16",
"54.192.0.0/16",
"103.2.30.0/23",
"125.209.208.0/20",
"147.92.128.0/17",
"203.104.144.0/21",
"91.108.8.0/22",
"91.108.12.0/22",
"91.108.16.0/22",
"149.154.160.0/20",
"3.123.36.126/32",
"35.157.215.84/32",
"35.157.217.255/32",
"52.58.209.134/32",
"54.93.124.31/32",
"54.162.243.80/32",
"54.173.34.141/32",
"54.235.23.242/32",
"169.45.248.118/32"
],
"outboundTag": "proxy"
}
]
}
}
iptables规则(小幅修改自 https://xtls.github.io/documents/level-2/tproxy/ ):
ip rule add fwmark 1 table 100
ip route add local 0.0.0.0/0 dev lo table 100
iptables -t mangle -N XRAY
iptables -t mangle -A XRAY ! -s 192.168.50.0/24 -j RETURN
iptables -t mangle -A XRAY -s 192.168.50.122/32 -j RETURN
iptables -t mangle -A XRAY -d 10.0.0.0/8 -j RETURN
iptables -t mangle -A XRAY -d 100.64.0.0/10 -j RETURN
iptables -t mangle -A XRAY -d 127.0.0.0/8 -j RETURN
iptables -t mangle -A XRAY -d 169.254.0.0/16 -j RETURN
iptables -t mangle -A XRAY -d 172.16.0.0/12 -j RETURN
iptables -t mangle -A XRAY -d 192.0.0.0/24 -j RETURN
iptables -t mangle -A XRAY -d 224.0.0.0/4 -j RETURN
iptables -t mangle -A XRAY -d 240.0.0.0/4 -j RETURN
iptables -t mangle -A XRAY -d 255.255.255.255/32 -j RETURN
iptables -t mangle -A XRAY -d 192.168.0.0/16 -p tcp ! --dport 53 -j RETURN
iptables -t mangle -A XRAY -d 192.168.0.0/16 -p udp ! --dport 53 -j RETURN
iptables -t mangle -A XRAY -p tcp -j TPROXY --on-port 12345 --tproxy-mark 1
iptables -t mangle -A XRAY -p udp -j TPROXY --on-port 12345 --tproxy-mark 1
iptables -t mangle -A PREROUTING -j XRAY
iptables -t mangle -N XRAY_SELF
iptables -t mangle -A XRAY_SELF -d 10.0.0.0/8 -j RETURN
iptables -t mangle -A XRAY_SELF -d 100.64.0.0/10 -j RETURN
iptables -t mangle -A XRAY_SELF -d 127.0.0.0/8 -j RETURN
iptables -t mangle -A XRAY_SELF -d 169.254.0.0/16 -j RETURN
iptables -t mangle -A XRAY_SELF -d 172.16.0.0/12 -j RETURN
iptables -t mangle -A XRAY_SELF -d 192.0.0.0/24 -j RETURN
iptables -t mangle -A XRAY_SELF -d 224.0.0.0/4 -j RETURN
iptables -t mangle -A XRAY_SELF -d 240.0.0.0/4 -j RETURN
iptables -t mangle -A XRAY_SELF -d 255.255.255.255/32 -j RETURN
iptables -t mangle -A XRAY_SELF -d 192.168.0.0/16 -p tcp ! --dport 53 -j RETURN
iptables -t mangle -A XRAY_SELF -d 192.168.0.0/16 -p udp ! --dport 53 -j RETURN
iptables -t mangle -A XRAY_SELF -m mark --mark 2 -j RETURN
iptables -t mangle -A XRAY_SELF -p tcp -j MARK --set-mark 1
iptables -t mangle -A XRAY_SELF -p udp -j MARK --set-mark 1
iptables -t mangle -A OUTPUT -j XRAY_SELF