关于 REDIR-HOST 兼容模式下 UDP 转发的问题 #2780

liby · 2022-11-05T17:31:11Z

liby
Nov 5, 2022

OpenClash Version: v0.45.69-beta
处理器架构：x86_64
Meta 内核版本：alpha-g4c5853e
系统环境：Lean

前情提要：发现 REDIR-HOST 兼容模式下，PS5 的流媒体应用会出现问题，无法使用，比如 Youtube 会提示「未连接互联网」（局域网内其他设备，笔记本、手机等等可以正常访问）。

运行模式改成 Fake-IP，可以成功在 PS5 上访问 YouTube。

根据帖子下面的评论怀疑是 Redir 没有配置 UDP 代理导致，在 REDIR-HOST 兼容模式下，开启 UDP 转发，在 PS5 上依旧无法使用 Youtube 等流媒体应用。

调试日志：

OpenClash 调试日志

生成时间: 2022-11-06 23:19:24
插件版本: v0.45.69-beta
隐私提示: 上传此日志前请注意检查、屏蔽公网IP、节点、密码等相关敏感信息


#===================== 系统信息 =====================#

主机型号: QEMU Standard PC (i440FX + PIIX - Common KVM processor : 4 Core 8 Thread
固件版本: OpenWrt SNAPSHOT r5127-98a38cf20
LuCI版本: git-22.268.36978-97fc663-1
内核版本: 5.15.70
处理器架构: x86_64

#此项有值时,如不使用IPv6,建议到网络-接口-lan的设置中禁用IPV6的DHCP
IPV6-DHCP: 

#此项结果应仅有配置文件的DNS监听地址
Dnsmasq转发设置: 127.0.0.1#7874

#===================== 依赖检查 =====================#

dnsmasq-full: 已安装
coreutils: 已安装
coreutils-nohup: 已安装
bash: 已安装
curl: 已安装
ca-certificates: 已安装
ipset: 已安装
ip-full: 已安装
libcap: 已安装
libcap-bin: 已安装
ruby: 已安装
ruby-yaml: 已安装
ruby-psych: 已安装
ruby-pstore: 已安装
kmod-tun(TUN模式): 已安装
luci-compat(Luci >= 19.07): 已安装
kmod-inet-diag(PROCESS-NAME): 未安装
unzip: 已安装
iptables-mod-tproxy: 已安装
kmod-ipt-tproxy: 已安装
iptables-mod-extra: 已安装
kmod-ipt-extra: 已安装
kmod-ipt-nat: 已安装

#===================== 内核检查 =====================#

运行状态: 运行中
进程pid: 21574
运行权限: 21574: cap_dac_override,cap_net_bind_service,cap_net_admin,cap_net_raw,cap_sys_ptrace,cap_sys_resource=eip
运行用户: nobody
已选择的架构: linux-amd64

#下方无法显示内核版本号时请确认您的内核版本是否正确或者有无权限
Tun内核版本: 2022.08.26-16-gb4d832d
Tun内核文件: 存在
Tun内核运行权限: 正常

Dev内核版本: v1.11.12-1-gde264c4
Dev内核文件: 存在
Dev内核运行权限: 正常

Meta内核版本: alpha-g4c5853e
Meta内核文件: 存在
Meta内核运行权限: 正常

#===================== 插件设置 =====================#

当前配置文件: /etc/openclash/config/custom.yaml
启动配置文件: /etc/openclash/custom.yaml
运行模式: redir-host
默认代理模式: rule
UDP流量转发(tproxy): 启用
DNS劫持: 启用
自定义DNS: 停用
IPV6代理: 启用
IPV6-DNS解析: 启用
禁用Dnsmasq缓存: 启用
自定义规则: 停用
仅允许内网: 启用
仅代理命中规则流量: 启用
仅允许常用端口流量: 停用
绕过中国大陆IP: 停用
DNS远程解析: 停用
路由本机代理: 启用

#启动异常时建议关闭此项后重试
混合节点: 停用
保留配置: 停用

#启动异常时建议关闭此项后重试
第三方规则: 停用

#===================== 配置文件 =====================#

mixed-port: 7893
tcp-concurrent: true
allow-lan: true
bind-address: "*"
mode: rule
log-level: error
ipv6: true
external-controller: 0.0.0.0:9090
sniffer:
  enable: true
  sniffing:
  - tls
  - http
  ForceDnsMapping: true
  ParsePureIp: false
  force-domain:
  - "+.netflix.com"
  - "+.nflxvideo.net"
  - "+.amazonaws.com"
  - "+.media.dssott.com"
  - "+.youtube.com"
  skip-domain:
  - "+.apple.com"
  - Mijia Cloud
  - "+.jd.com"
  - dlg.io.mi.com
  port-whitelist:
  - 443
  - 80
hosts:
  mtalk.google.com: 108.177.125.188
  dl.google.com: 180.163.151.161
  dl.l.google.com: 180.163.151.161
profile:
  store-selected: true
  store-fake-ip: true
dns:
  enable: true
  listen: 0.0.0.0:7874
  default-nameserver:
  - ''
  proxy-server-nameserver:
  - 119.29.29.29
  - 223.5.5.5
  enhanced-mode: redir-host
  fake-ip-filter:
  - "*.lan"
  - localhost.ptlogin2.qq.com
  - "+.srv.nintendo.net"
  - "+.stun.playstation.net"
  - "+.msftconnecttest.com"
  - "+.msftncsi.com"
  - "+.xboxlive.com"
  - msftconnecttest.com
  - xbox.*.microsoft.com
  - "*.battlenet.com.cn"
  - "*.battlenet.com"
  - "*.blzstatic.cn"
  - "*.battle.net"
  nameserver:
  - tls://223.5.5.5:853
  - https://1.12.12.12/dns-query
  fallback:
  - tcp://185.222.222.222#PROXY
  - tcp://94.140.15.15#PROXY
  - tcp://8.8.4.4#PROXY
  fallback-filter:
    geoip: true
    geoip-code: CN
    geosite:
    - geolocation-!cn
    ipcidr:
    - 240.0.0.0/4
    domain:
    - "+.google.com"
    - "+.facebook.com"
    - "+.youtube.com"
  ipv6: true
proxy-groups:
- name: "\U0001F1ED\U0001F1F0 香港"
  type: url-test
  use:
  - CloudList1
  - CloudList2
  - CloudList3
  filter: 香港
  url: http://cp.cloudflare.com
  interval: 300
  lazy: true
- name: "\U0001F1E8\U0001F1F3 台湾"
  type: url-test
  use:
  - CloudList1
  - CloudList2
  - CloudList3
  filter: 台湾
  url: http://cp.cloudflare.com
  interval: 300
  lazy: true
- name: "\U0001F1F8\U0001F1EC 新加坡"
  type: url-test
  use:
  - CloudList1
  - CloudList2
  - CloudList3
  filter: 新加坡
  url: http://cp.cloudflare.com
  interval: 300
  lazy: true
- name: "\U0001F1EF\U0001F1F5 日本"
  type: url-test
  use:
  - CloudList1
  - CloudList2
  - CloudList3
  filter: 日本
  url: http://cp.cloudflare.com
  interval: 300
  lazy: true
- name: "\U0001F1FA\U0001F1F8 美国"
  type: url-test
  use:
  - CloudList1
  - CloudList2
  - CloudList3
  filter: 美国
  url: http://cp.cloudflare.com
  interval: 300
  lazy: true
- name: FALLBACK
  type: fallback
  use:
  - CloudList2
  - CloudList1
  - CloudList3
  url: http://wifi.vivo.com.cn/generate_204
  interval: 300
- name: PROXY
  type: select
  proxies:
  - "\U0001F1ED\U0001F1F0 香港"
  - "\U0001F1E8\U0001F1F3 台湾"
  - "\U0001F1F8\U0001F1EC 新加坡"
  - "\U0001F1EF\U0001F1F5 日本"
  - "\U0001F1FA\U0001F1F8 美国"
  - FALLBACK
- name: MATCH
  type: select
  proxies:
  - PROXY
  - DIRECT
- name: Streaming
  type: select
  proxies:
  - PROXY
rule-providers:
  Unbreak:
    type: http
    behavior: classical
    path: "./rule_provider/Unbreak.yaml"
    url: https://cdn.jsdelivr.net/gh/DivineEngine/Profiles@master/Clash/RuleSet/Unbreak.yaml
    interval: 86400
  Streaming:
    type: http
    behavior: classical
    path: "./rule_provider/Streaming.yaml"
    url: https://cdn.jsdelivr.net/gh/DivineEngine/Profiles@master/Clash/RuleSet/StreamingMedia/Streaming.yaml
    interval: 86400
  Global:
    type: http
    behavior: classical
    path: "./rule_provider/Global.yaml"
    url: https://cdn.jsdelivr.net/gh/DivineEngine/Profiles@master/Clash/RuleSet/Global.yaml
    interval: 86400
  China:
    type: http
    behavior: classical
    path: "./rule_provider/China.yaml"
    url: https://cdn.jsdelivr.net/gh/DivineEngine/Profiles@master/Clash/RuleSet/China.yaml
    interval: 86400
  ChinaIP:
    type: http
    behavior: ipcidr
    path: "./rule_provider/ChinaIP.yaml"
    url: https://cdn.jsdelivr.net/gh/DivineEngine/Profiles@master/Clash/RuleSet/Extra/ChinaIP.yaml
    interval: 86400
script:
rules:
- DST-PORT,7895,REJECT
- DST-PORT,7892,REJECT
- IP-CIDR,198.18.0.1/16,REJECT,no-resolve
- DOMAIN-SUFFIX,awesome-hd.me,DIRECT
- DOMAIN-SUFFIX,broadcasthe.net,DIRECT
- DOMAIN-SUFFIX,chdbits.co,DIRECT
- DOMAIN-SUFFIX,classix-unlimited.co.uk,DIRECT
- DOMAIN-SUFFIX,empornium.me,DIRECT
- DOMAIN-SUFFIX,gazellegames.net,DIRECT
- DOMAIN-SUFFIX,hdchina.org,DIRECT
- DOMAIN-SUFFIX,hdsky.me,DIRECT
- DOMAIN-SUFFIX,icetorrent.org,DIRECT
- DOMAIN-SUFFIX,jpopsuki.eu,DIRECT
- DOMAIN-SUFFIX,keepfrds.com,DIRECT
- DOMAIN-SUFFIX,madsrevolution.net,DIRECT
- DOMAIN-SUFFIX,m-team.cc,DIRECT
- DOMAIN-SUFFIX,nanyangpt.com,DIRECT
- DOMAIN-SUFFIX,ncore.cc,DIRECT
- DOMAIN-SUFFIX,open.cd,DIRECT
- DOMAIN-SUFFIX,ourbits.club,DIRECT
- DOMAIN-SUFFIX,passthepopcorn.me,DIRECT
- DOMAIN-SUFFIX,privatehd.to,DIRECT
- DOMAIN-SUFFIX,redacted.ch,DIRECT
- DOMAIN-SUFFIX,springsunday.net,DIRECT
- DOMAIN-SUFFIX,tjupt.org,DIRECT
- DOMAIN-SUFFIX,totheglory.im,DIRECT
- DOMAIN-SUFFIX,smtp,DIRECT
- DOMAIN-KEYWORD,announce,DIRECT
- DOMAIN-KEYWORD,torrent,DIRECT
- DOMAIN-KEYWORD,tracker,DIRECT
- RULE-SET,Unbreak,DIRECT
- RULE-SET,Streaming,Streaming
- RULE-SET,Global,PROXY
- RULE-SET,China,DIRECT
- IP-CIDR,192.168.0.0/16,DIRECT
- IP-CIDR,10.0.0.0/8,DIRECT
- IP-CIDR,172.16.0.0/12,DIRECT
- IP-CIDR,127.0.0.0/8,DIRECT
- IP-CIDR,100.64.0.0/10,DIRECT
- IP-CIDR,224.0.0.0/4,DIRECT
- IP-CIDR,fe80::/10,DIRECT
- RULE-SET,ChinaIP,DIRECT
- PROCESS-NAME,aria2c,DIRECT
- PROCESS-NAME,BitComet,DIRECT
- PROCESS-NAME,fdm,DIRECT
- PROCESS-NAME,NetTransport,DIRECT
- PROCESS-NAME,qbittorrent,DIRECT
- PROCESS-NAME,Thunder,DIRECT
- PROCESS-NAME,transmission-daemon,DIRECT
- PROCESS-NAME,transmission-qt,DIRECT
- PROCESS-NAME,uTorrent,DIRECT
- PROCESS-NAME,WebTorrent,DIRECT
- PROCESS-NAME,aria2c,DIRECT
- PROCESS-NAME,fdm,DIRECT
- PROCESS-NAME,Folx,DIRECT
- PROCESS-NAME,NetTransport,DIRECT
- PROCESS-NAME,qbittorrent,DIRECT
- PROCESS-NAME,Thunder,DIRECT
- PROCESS-NAME,Transmission,DIRECT
- PROCESS-NAME,transmission,DIRECT
- PROCESS-NAME,uTorrent,DIRECT
- PROCESS-NAME,WebTorrent,DIRECT
- PROCESS-NAME,WebTorrent Helper,DIRECT
- PROCESS-NAME,v2ray,DIRECT
- PROCESS-NAME,ss-local,DIRECT
- PROCESS-NAME,ssr-local,DIRECT
- PROCESS-NAME,ss-redir,DIRECT
- PROCESS-NAME,ssr-redir,DIRECT
- PROCESS-NAME,ss-server,DIRECT
- PROCESS-NAME,trojan-go,DIRECT
- PROCESS-NAME,xray,DIRECT
- PROCESS-NAME,hysteria,DIRECT
- PROCESS-NAME,UUBooster,DIRECT
- PROCESS-NAME,uugamebooster,DIRECT
- DST-PORT,80,MATCH
- DST-PORT,443,MATCH
- DST-PORT,22,MATCH
- MATCH,DIRECT
redir-port: 7892
tproxy-port: 7895
port: 7890
socks-port: 7891
external-ui: "/usr/share/openclash/ui"
geodata-mode: true
geodata-loader: standard
authentication:
- Clash:PED0UFXI

#===================== IPTABLES 防火墙设置 =====================#

#IPv4 NAT chain

# Generated by iptables-save v1.8.7 on Sun Nov  6 23:19:25 2022
*nat
:PREROUTING ACCEPT [9:615]
:INPUT ACCEPT [34:2187]
:OUTPUT ACCEPT [250:17811]
:POSTROUTING ACCEPT [252:17931]
:MINIUPNPD - [0:0]
:MINIUPNPD-POSTROUTING - [0:0]
:openclash - [0:0]
:openclash_output - [0:0]
:postrouting_lan_rule - [0:0]
:postrouting_rule - [0:0]
:postrouting_wan_rule - [0:0]
:prerouting_lan_rule - [0:0]
:prerouting_rule - [0:0]
:prerouting_wan_rule - [0:0]
:zone_lan_postrouting - [0:0]
:zone_lan_prerouting - [0:0]
:zone_wan_postrouting - [0:0]
:zone_wan_prerouting - [0:0]
-A PREROUTING -d 8.8.4.4/32 -p tcp -m comment --comment "OpenClash Google DNS Hijack" -m tcp --dport 53 -j REDIRECT --to-ports 7892
-A PREROUTING -d 8.8.8.8/32 -p tcp -m comment --comment "OpenClash Google DNS Hijack" -m tcp --dport 53 -j REDIRECT --to-ports 7892
-A PREROUTING -p tcp -m tcp --dport 53 -m comment --comment "OpenClash DNS Hijack" -j REDIRECT --to-ports 53
-A PREROUTING -p udp -m udp --dport 53 -m comment --comment "OpenClash DNS Hijack" -j REDIRECT --to-ports 53
-A PREROUTING -p udp -m udp --dport 53 -j REDIRECT --to-ports 53
-A PREROUTING -p tcp -m tcp --dport 53 -j REDIRECT --to-ports 53
-A PREROUTING -m comment --comment "!fw3: Custom prerouting rule chain" -j prerouting_rule
-A PREROUTING -i br-lan -m comment --comment "!fw3" -j zone_lan_prerouting
-A PREROUTING -p tcp -j openclash
-A OUTPUT -j openclash_output
-A POSTROUTING -m comment --comment "!fw3: Custom postrouting rule chain" -j postrouting_rule
-A POSTROUTING -o br-lan -m comment --comment "!fw3" -j zone_lan_postrouting
-A openclash -m set --match-set localnetwork dst -j RETURN
-A openclash -p tcp -j REDIRECT --to-ports 7892
-A openclash_output -m set --match-set localnetwork dst -j RETURN
-A openclash_output -p tcp -m owner ! --uid-owner 65534 -j REDIRECT --to-ports 7892
-A zone_lan_postrouting -j MINIUPNPD-POSTROUTING
-A zone_lan_postrouting -j MINIUPNPD-POSTROUTING
-A zone_lan_postrouting -m comment --comment "!fw3: Custom lan postrouting rule chain" -j postrouting_lan_rule
-A zone_lan_prerouting -j MINIUPNPD
-A zone_lan_prerouting -j MINIUPNPD
-A zone_lan_prerouting -m comment --comment "!fw3: Custom lan prerouting rule chain" -j prerouting_lan_rule
-A zone_wan_postrouting -m comment --comment "!fw3: Custom wan postrouting rule chain" -j postrouting_wan_rule
-A zone_wan_postrouting -m comment --comment "!fw3" -j FULLCONENAT
-A zone_wan_prerouting -m comment --comment "!fw3: Custom wan prerouting rule chain" -j prerouting_wan_rule
-A zone_wan_prerouting -m comment --comment "!fw3" -j FULLCONENAT
COMMIT
# Completed on Sun Nov  6 23:19:25 2022

#IPv4 Mangle chain

# Generated by iptables-save v1.8.7 on Sun Nov  6 23:19:25 2022
*mangle
:PREROUTING ACCEPT [2096:506788]
:INPUT ACCEPT [2022:494243]
:FORWARD ACCEPT [74:12545]
:OUTPUT ACCEPT [2280:1223770]
:POSTROUTING ACCEPT [2354:1236315]
:RRDIPT_FORWARD - [0:0]
:RRDIPT_INPUT - [0:0]
:RRDIPT_OUTPUT - [0:0]
:openclash - [0:0]
-A PREROUTING -p udp -j openclash
-A INPUT -j RRDIPT_INPUT
-A FORWARD -j RRDIPT_FORWARD
-A OUTPUT -j RRDIPT_OUTPUT
-A RRDIPT_FORWARD -s 192.168.50.10/32 -j RETURN
-A RRDIPT_FORWARD -d 192.168.50.10/32 -j RETURN
-A RRDIPT_FORWARD -s 192.168.50.253/32 -j RETURN
-A RRDIPT_FORWARD -d 192.168.50.253/32 -j RETURN
-A RRDIPT_FORWARD -s 192.168.50.2/32 -j RETURN
-A RRDIPT_FORWARD -d 192.168.50.2/32 -j RETURN
-A RRDIPT_FORWARD -s 192.168.50.3/32 -j RETURN
-A RRDIPT_FORWARD -d 192.168.50.3/32 -j RETURN
-A RRDIPT_FORWARD -s 192.168.50.4/32 -j RETURN
-A RRDIPT_FORWARD -d 192.168.50.4/32 -j RETURN
-A RRDIPT_FORWARD -s 192.168.50.5/32 -j RETURN
-A RRDIPT_FORWARD -d 192.168.50.5/32 -j RETURN
-A RRDIPT_FORWARD -s 192.168.50.6/32 -j RETURN
-A RRDIPT_FORWARD -d 192.168.50.6/32 -j RETURN
-A RRDIPT_FORWARD -s 192.168.50.7/32 -j RETURN
-A RRDIPT_FORWARD -d 192.168.50.7/32 -j RETURN
-A RRDIPT_FORWARD -s 192.168.50.8/32 -j RETURN
-A RRDIPT_FORWARD -d 192.168.50.8/32 -j RETURN
-A RRDIPT_FORWARD -s 192.168.50.9/32 -j RETURN
-A RRDIPT_FORWARD -d 192.168.50.9/32 -j RETURN
-A RRDIPT_INPUT -i eth0 -j RETURN
-A RRDIPT_INPUT -i br-lan -j RETURN
-A RRDIPT_OUTPUT -o eth0 -j RETURN
-A RRDIPT_OUTPUT -o br-lan -j RETURN
-A openclash -p udp -m udp --sport 500 -j RETURN
-A openclash -p udp -m udp --sport 68 -j RETURN
-A openclash -m set --match-set localnetwork dst -j RETURN
-A openclash -p udp -m udp --dport 53 -j RETURN
-A openclash -p udp -j TPROXY --on-port 7895 --on-ip 0.0.0.0 --tproxy-mark 0x162/0xffffffff
COMMIT
# Completed on Sun Nov  6 23:19:25 2022

#IPv4 Filter chain

# Generated by iptables-save v1.8.7 on Sun Nov  6 23:19:25 2022
*filter
:INPUT ACCEPT [0:0]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [0:0]
:MINIUPNPD - [0:0]
:forwarding_lan_rule - [0:0]
:forwarding_rule - [0:0]
:forwarding_wan_rule - [0:0]
:input_lan_rule - [0:0]
:input_rule - [0:0]
:input_wan_rule - [0:0]
:output_lan_rule - [0:0]
:output_rule - [0:0]
:output_wan_rule - [0:0]
:reject - [0:0]
:syn_flood - [0:0]
:zone_lan_dest_ACCEPT - [0:0]
:zone_lan_forward - [0:0]
:zone_lan_input - [0:0]
:zone_lan_output - [0:0]
:zone_lan_src_ACCEPT - [0:0]
:zone_wan_dest_ACCEPT - [0:0]
:zone_wan_dest_REJECT - [0:0]
:zone_wan_forward - [0:0]
:zone_wan_input - [0:0]
:zone_wan_output - [0:0]
:zone_wan_src_REJECT - [0:0]
-A INPUT -p udp -m udp --dport 443 -m comment --comment "OpenClash QUIC REJECT" -m set ! --match-set china_ip_route dst -j REJECT --reject-with icmp-port-unreachable
-A INPUT -i lo -m comment --comment "!fw3" -j ACCEPT
-A INPUT -m comment --comment "!fw3: Custom input rule chain" -j input_rule
-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment "!fw3" -j ACCEPT
-A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -m comment --comment "!fw3" -j syn_flood
-A INPUT -i br-lan -m comment --comment "!fw3" -j zone_lan_input
-A FORWARD -m comment --comment "!fw3: Custom forwarding rule chain" -j forwarding_rule
-A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment "!fw3" -j ACCEPT
-A FORWARD -i br-lan -m comment --comment "!fw3" -j zone_lan_forward
-A FORWARD -m comment --comment "!fw3" -j reject
-A OUTPUT -o lo -m comment --comment "!fw3" -j ACCEPT
-A OUTPUT -m comment --comment "!fw3: Custom output rule chain" -j output_rule
-A OUTPUT -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment "!fw3" -j ACCEPT
-A OUTPUT -o br-lan -m comment --comment "!fw3" -j zone_lan_output
-A reject -p tcp -m comment --comment "!fw3" -j REJECT --reject-with tcp-reset
-A reject -m comment --comment "!fw3" -j REJECT --reject-with icmp-port-unreachable
-A syn_flood -m limit --limit 25/sec --limit-burst 50 -m comment --comment "!fw3" -j RETURN
-A syn_flood -m comment --comment "!fw3" -j DROP
-A zone_lan_dest_ACCEPT -o br-lan -m comment --comment "!fw3" -j ACCEPT
-A zone_lan_forward -j MINIUPNPD
-A zone_lan_forward -j MINIUPNPD
-A zone_lan_forward -m comment --comment "!fw3: Custom lan forwarding rule chain" -j forwarding_lan_rule
-A zone_lan_forward -m comment --comment "!fw3: Zone lan to wan forwarding policy" -j zone_wan_dest_ACCEPT
-A zone_lan_forward -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port forwards" -j ACCEPT
-A zone_lan_forward -m comment --comment "!fw3" -j zone_lan_dest_ACCEPT
-A zone_lan_input -m comment --comment "!fw3: Custom lan input rule chain" -j input_lan_rule
-A zone_lan_input -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port redirections" -j ACCEPT
-A zone_lan_input -m comment --comment "!fw3" -j zone_lan_src_ACCEPT
-A zone_lan_output -m comment --comment "!fw3: Custom lan output rule chain" -j output_lan_rule
-A zone_lan_output -m comment --comment "!fw3" -j zone_lan_dest_ACCEPT
-A zone_lan_src_ACCEPT -i br-lan -m conntrack --ctstate NEW,UNTRACKED -m comment --comment "!fw3" -j ACCEPT
-A zone_wan_forward -m comment --comment "!fw3: Custom wan forwarding rule chain" -j forwarding_wan_rule
-A zone_wan_forward -p esp -m comment --comment "!fw3: Allow-IPSec-ESP" -j zone_lan_dest_ACCEPT
-A zone_wan_forward -p udp -m udp --dport 500 -m comment --comment "!fw3: Allow-ISAKMP" -j zone_lan_dest_ACCEPT
-A zone_wan_forward -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port forwards" -j ACCEPT
-A zone_wan_forward -m comment --comment "!fw3" -j zone_wan_dest_REJECT
-A zone_wan_input -m comment --comment "!fw3: Custom wan input rule chain" -j input_wan_rule
-A zone_wan_input -p udp -m udp --dport 68 -m comment --comment "!fw3: Allow-DHCP-Renew" -j ACCEPT
-A zone_wan_input -p icmp -m icmp --icmp-type 8 -m comment --comment "!fw3: Allow-Ping" -j ACCEPT
-A zone_wan_input -p igmp -m comment --comment "!fw3: Allow-IGMP" -j ACCEPT
-A zone_wan_input -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port redirections" -j ACCEPT
-A zone_wan_input -m comment --comment "!fw3" -j zone_wan_src_REJECT
-A zone_wan_output -m comment --comment "!fw3: Custom wan output rule chain" -j output_wan_rule
-A zone_wan_output -m comment --comment "!fw3" -j zone_wan_dest_ACCEPT
COMMIT
# Completed on Sun Nov  6 23:19:25 2022

#IPv6 NAT chain

# Generated by ip6tables-save v1.8.7 on Sun Nov  6 23:19:25 2022
*nat
:PREROUTING ACCEPT [2358:530463]
:INPUT ACCEPT [1780:459313]
:OUTPUT ACCEPT [212920:17059595]
:POSTROUTING ACCEPT [212920:17059595]
-A PREROUTING -p udp -m udp --dport 53 -j REDIRECT --to-ports 53
-A PREROUTING -p tcp -m tcp --dport 53 -j REDIRECT --to-ports 53
COMMIT
# Completed on Sun Nov  6 23:19:25 2022

#IPv6 Mangle chain


#IPv6 Filter chain

# Generated by ip6tables-save v1.8.7 on Sun Nov  6 23:19:25 2022
*filter
:INPUT ACCEPT [21374:1282460]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [0:0]
:MINIUPNPD - [0:0]
:forwarding_lan_rule - [0:0]
:forwarding_rule - [0:0]
:forwarding_wan_rule - [0:0]
:input_lan_rule - [0:0]
:input_rule - [0:0]
:input_wan_rule - [0:0]
:output_lan_rule - [0:0]
:output_rule - [0:0]
:output_wan_rule - [0:0]
:reject - [0:0]
:syn_flood - [0:0]
:zone_lan_dest_ACCEPT - [0:0]
:zone_lan_forward - [0:0]
:zone_lan_input - [0:0]
:zone_lan_output - [0:0]
:zone_lan_src_ACCEPT - [0:0]
:zone_wan_dest_ACCEPT - [0:0]
:zone_wan_dest_REJECT - [0:0]
:zone_wan_forward - [0:0]
:zone_wan_input - [0:0]
:zone_wan_output - [0:0]
:zone_wan_src_REJECT - [0:0]
-A INPUT -i lo -m comment --comment "!fw3" -j ACCEPT
-A INPUT -m comment --comment "!fw3: Custom input rule chain" -j input_rule
-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment "!fw3" -j ACCEPT
-A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -m comment --comment "!fw3" -j syn_flood
-A INPUT -i br-lan -m comment --comment "!fw3" -j zone_lan_input
-A FORWARD -m comment --comment "!fw3: Custom forwarding rule chain" -j forwarding_rule
-A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment "!fw3" -j ACCEPT
-A FORWARD -i br-lan -m comment --comment "!fw3" -j zone_lan_forward
-A FORWARD -m comment --comment "!fw3" -j reject
-A OUTPUT -o lo -m comment --comment "!fw3" -j ACCEPT
-A OUTPUT -m comment --comment "!fw3: Custom output rule chain" -j output_rule
-A OUTPUT -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment "!fw3" -j ACCEPT
-A OUTPUT -o br-lan -m comment --comment "!fw3" -j zone_lan_output
-A reject -p tcp -m comment --comment "!fw3" -j REJECT --reject-with tcp-reset
-A reject -m comment --comment "!fw3" -j REJECT --reject-with icmp6-port-unreachable
-A syn_flood -m limit --limit 25/sec --limit-burst 50 -m comment --comment "!fw3" -j RETURN
-A syn_flood -m comment --comment "!fw3" -j DROP
-A zone_lan_dest_ACCEPT -o br-lan -m comment --comment "!fw3" -j ACCEPT
-A zone_lan_forward -j MINIUPNPD
-A zone_lan_forward -j MINIUPNPD
-A zone_lan_forward -m comment --comment "!fw3: Custom lan forwarding rule chain" -j forwarding_lan_rule
-A zone_lan_forward -m comment --comment "!fw3: Zone lan to wan forwarding policy" -j zone_wan_dest_ACCEPT
-A zone_lan_forward -m comment --comment "!fw3" -j zone_lan_dest_ACCEPT
-A zone_lan_input -m comment --comment "!fw3: Custom lan input rule chain" -j input_lan_rule
-A zone_lan_input -m comment --comment "!fw3" -j zone_lan_src_ACCEPT
-A zone_lan_output -m comment --comment "!fw3: Custom lan output rule chain" -j output_lan_rule
-A zone_lan_output -m comment --comment "!fw3" -j zone_lan_dest_ACCEPT
-A zone_lan_src_ACCEPT -i br-lan -m conntrack --ctstate NEW,UNTRACKED -m comment --comment "!fw3" -j ACCEPT
-A zone_wan_forward -m comment --comment "!fw3: Custom wan forwarding rule chain" -j forwarding_wan_rule
-A zone_wan_forward -p ipv6-icmp -m icmp6 --icmpv6-type 128 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Forward" -j ACCEPT
-A zone_wan_forward -p ipv6-icmp -m icmp6 --icmpv6-type 129 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Forward" -j ACCEPT
-A zone_wan_forward -p ipv6-icmp -m icmp6 --icmpv6-type 1 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Forward" -j ACCEPT
-A zone_wan_forward -p ipv6-icmp -m icmp6 --icmpv6-type 2 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Forward" -j ACCEPT
-A zone_wan_forward -p ipv6-icmp -m icmp6 --icmpv6-type 3 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Forward" -j ACCEPT
-A zone_wan_forward -p ipv6-icmp -m icmp6 --icmpv6-type 4/0 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Forward" -j ACCEPT
-A zone_wan_forward -p ipv6-icmp -m icmp6 --icmpv6-type 4/1 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Forward" -j ACCEPT
-A zone_wan_forward -p esp -m comment --comment "!fw3: Allow-IPSec-ESP" -j zone_lan_dest_ACCEPT
-A zone_wan_forward -p udp -m udp --dport 500 -m comment --comment "!fw3: Allow-ISAKMP" -j zone_lan_dest_ACCEPT
-A zone_wan_forward -m comment --comment "!fw3" -j zone_wan_dest_REJECT
-A zone_wan_input -m comment --comment "!fw3: Custom wan input rule chain" -j input_wan_rule
-A zone_wan_input -s fc00::/6 -d fc00::/6 -p udp -m udp --dport 546 -m comment --comment "!fw3: Allow-DHCPv6" -j ACCEPT
-A zone_wan_input -s fe80::/10 -p ipv6-icmp -m icmp6 --icmpv6-type 130/0 -m comment --comment "!fw3: Allow-MLD" -j ACCEPT
-A zone_wan_input -s fe80::/10 -p ipv6-icmp -m icmp6 --icmpv6-type 131/0 -m comment --comment "!fw3: Allow-MLD" -j ACCEPT
-A zone_wan_input -s fe80::/10 -p ipv6-icmp -m icmp6 --icmpv6-type 132/0 -m comment --comment "!fw3: Allow-MLD" -j ACCEPT
-A zone_wan_input -s fe80::/10 -p ipv6-icmp -m icmp6 --icmpv6-type 143/0 -m comment --comment "!fw3: Allow-MLD" -j ACCEPT
-A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 128 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT
-A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 129 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT
-A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 1 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT
-A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 2 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT
-A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 3 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT
-A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 4/0 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT
-A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 4/1 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT
-A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 133 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT
-A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 135 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT
-A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 134 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT
-A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 136 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT
-A zone_wan_input -m comment --comment "!fw3" -j zone_wan_src_REJECT
-A zone_wan_output -m comment --comment "!fw3: Custom wan output rule chain" -j output_wan_rule
-A zone_wan_output -m comment --comment "!fw3" -j zone_wan_dest_ACCEPT
COMMIT
# Completed on Sun Nov  6 23:19:25 2022

#===================== IPSET状态 =====================#

Name: cn
Name: ct
Name: cnc
Name: cmcc
Name: crtc
Name: cernet
Name: gwbn
Name: othernet
Name: china_ip_route
Name: china_ip_route_pass
Name: localnetwork
Name: music
Name: mwan3_connected_v4
Name: mwan3_connected_v6
Name: mwan3_source_v6
Name: mwan3_dynamic_v4
Name: mwan3_dynamic_v6
Name: mwan3_custom_v4
Name: mwan3_custom_v6
Name: mwan3_connected

#===================== 路由表状态 =====================#

#route -n
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         192.168.50.253  0.0.0.0         UG    0      0        0 br-lan
192.168.50.0    0.0.0.0         255.255.255.0   U     0      0        0 br-lan
#ip route list
default via 192.168.50.253 dev br-lan proto static 
192.168.50.0/24 dev br-lan proto kernel scope link src 192.168.50.252 
#ip rule show
0:	from all lookup local
32765:	from all fwmark 0x162 lookup 354
32766:	from all lookup main
32767:	from all lookup default

#===================== 端口占用状态 =====================#

tcp        0      0 :::7895                 :::*                    LISTEN      21574/clash
tcp        0      0 :::7893                 :::*                    LISTEN      21574/clash
tcp        0      0 :::7892                 :::*                    LISTEN      21574/clash
tcp        0      0 :::7891                 :::*                    LISTEN      21574/clash
tcp        0      0 :::7890                 :::*                    LISTEN      21574/clash
tcp        0      0 :::9090                 :::*                    LISTEN      21574/clash
udp        0      0 :::7874                 :::*                                21574/clash
udp        0      0 :::7891                 :::*                                21574/clash
udp        0      0 :::7892                 :::*                                21574/clash
udp        0      0 :::7893                 :::*                                21574/clash
udp        0      0 :::7895                 :::*                                21574/clash

#===================== 测试本机DNS查询 =====================#

Server:		127.0.0.1
Address:	127.0.0.1:53

www.baidu.com	canonical name = www.a.shifen.com
Name:	www.a.shifen.com
Address: 110.242.68.4
Name:	www.a.shifen.com
Address: 110.242.68.3

www.baidu.com	canonical name = www.a.shifen.com


#===================== resolv.conf.d =====================#

# Interface IPV6
nameserver 2001:4860:4860::8888
nameserver 2001:da8::666

#===================== 测试本机网络连接 =====================#

HTTP/1.1 200 OK
Accept-Ranges: bytes
Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform
Connection: keep-alive
Content-Length: 277
Content-Type: text/html
Date: Sun, 06 Nov 2022 15:19:26 GMT
Etag: "575e1f59-115"
Last-Modified: Mon, 13 Jun 2016 02:50:01 GMT
Pragma: no-cache
Server: bfe/1.0.8.18


#===================== 测试本机网络下载 =====================#

HTTP/1.1 200 OK
Connection: keep-alive
Content-Length: 80
Cache-Control: max-age=300
Content-Security-Policy: default-src 'none'; style-src 'unsafe-inline'; sandbox
Content-Type: text/plain; charset=utf-8
ETag: "f9b464e93b2bdfda94b649d5d067b155764d97951465058cb1643f9ffc3c6e51"
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
X-Frame-Options: deny
X-XSS-Protection: 1; mode=block
X-GitHub-Request-Id: 883E:46EC:1B2372:247144:6366AE42
Accept-Ranges: bytes
Date: Sun, 06 Nov 2022 15:19:26 GMT
Via: 1.1 varnish
X-Served-By: cache-tyo11950-TYO
X-Cache: HIT
X-Cache-Hits: 1
X-Timer: S1667747967.529800,VS0,VE1
Vary: Authorization,Accept-Encoding,Origin
Access-Control-Allow-Origin: *
X-Fastly-Request-ID: 9d8b9153df8a6ed5b376ed52052605738fc29394
Expires: Sun, 06 Nov 2022 15:24:26 GMT
Source-Age: 52


#===================== 最近运行日志 =====================#

2022-11-06 23:14:06 OpenClash Start Successful!
2022-11-06 23:18:39 OpenClash Stoping...
2022-11-06 23:18:39 Step 1: Backup The Current Groups State...
2022-11-06 23:18:39 Step 2: Delete OpenClash Firewall Rules...
2022-11-06 23:18:40 Step 3: Close The OpenClash Daemons...
2022-11-06 23:18:40 Step 4: Close The Clash Core Process...
2022-11-06 23:18:40 Step 5: Restart Dnsmasq...
2022-11-06 23:18:40 Step 6: Delete OpenClash Residue File...
2022-11-06 23:18:40 OpenClash Start Running...
2022-11-06 23:18:40 Step 1: Get The Configuration...
2022-11-06 23:18:40 Step 2: Check The Components...
2022-11-06 23:18:41 Tip: Because of the file【 /etc/openclash/config/custom.yaml 】modificated, Pause quick start...
2022-11-06 23:18:41 Step 3: Modify The Config File...
2022-11-06 23:18:41 Tip: You have seted the authentication of SOCKS5/HTTP(S) proxy with【Clash:PED0UFXI】
2022-11-06 23:18:41 Step 4: Start Running The Clash Core...
2022-11-06 23:18:41 Tip: Detected The Exclusive Function of The Meta Core, Use Meta Core to Start...
2022-11-06 23:18:42 Step 5: Check The Core Status...
time="2022-11-06T15:18:42Z" level=info msg="Start initial configuration in progress"
time="2022-11-06T15:18:42Z" level=info msg="Geodata Loader mode: standard"
time="2022-11-06T15:18:42Z" level=info msg="Start initial GeoSite dns fallback filter `geolocation-!cn`, records: 34429"
time="2022-11-06T15:18:42Z" level=info msg="Initial configuration complete, total time: 187ms"
time="2022-11-06T15:18:42Z" level=info msg="Authentication of local server updated"
time="2022-11-06T15:18:42Z" level=info msg="Sniffer is loaded and working"
time="2022-11-06T15:18:42Z" level=info msg="DNS server listening at: [::]:7874"
time="2022-11-06T15:18:42Z" level=info msg="Start initial compatible provider default"
time="2022-11-06T15:18:42Z" level=info msg="Start initial provider CloudList2"
time="2022-11-06T15:18:42Z" level=info msg="Start initial provider CloudList1"
time="2022-11-06T15:18:42Z" level=info msg="Start initial compatible provider PROXY"
time="2022-11-06T15:18:42Z" level=info msg="Start initial provider CloudList3"
time="2022-11-06T15:18:42Z" level=info msg="RESTful API listening at: [::]:9090"
time="2022-11-06T15:18:42Z" level=info msg="Start initial compatible provider MATCH"
time="2022-11-06T15:18:42Z" level=info msg="Start initial compatible provider Streaming"
time="2022-11-06T15:18:42Z" level=info msg="Start initial provider ChinaIP"
time="2022-11-06T15:18:42Z" level=info msg="Start initial provider China"
time="2022-11-06T15:18:42Z" level=info msg="Start initial provider Streaming"
time="2022-11-06T15:18:42Z" level=info msg="Start initial provider Global"
time="2022-11-06T15:18:42Z" level=info msg="Start initial provider Unbreak"
time="2022-11-06T15:18:42Z" level=info msg="Start initial GeoIP rule NETFLIX => , records: 18"
time="2022-11-06T15:18:42Z" level=info msg="Use IPv6"
time="2022-11-06T15:18:42Z" level=info msg="Use tcp concurrent"
time="2022-11-06T15:18:42Z" level=info msg="HTTP proxy listening at: [::]:7890"
time="2022-11-06T15:18:42Z" level=info msg="SOCKS proxy listening at: [::]:7891"
time="2022-11-06T15:18:42Z" level=info msg="Redirect proxy listening at: [::]:7892"
time="2022-11-06T15:18:42Z" level=info msg="TProxy server listening at: [::]:7895"
time="2022-11-06T15:18:42Z" level=info msg="Mixed(http+socks) proxy listening at: [::]:7893"
2022-11-06 23:18:45 Step 6: Wait For The File Downloading...
2022-11-06 23:18:45 Step 7: Set Firewall Rules...
2022-11-06 23:18:46 Step 8: Restart Dnsmasq...
2022-11-06 23:18:46 Step 9: Add Cron Rules, Start Daemons...
2022-11-06 23:18:46 OpenClash Start Successful!

请问在 REDIR-HOST 兼容模式下，如何解决这个问题呢？或者我还要提供什么信息？

cc @vernesong 🙏