OpenWrt上直接使用mihomo通过nftables实现透明代理的经验分享 #1325
Replies: 5 comments 9 replies
-
|
其实很多步骤都可以用图形化界面实现，全部写成命令属实多此一举，但这或许也能作为其他情况的参考。 1）下载内核。 2）OpenClash运行时，复制其nftables配置。 3）修改DHCP/DNS，添加DNS转发：127.0.0.1#7874，也可以用命令实现。 4）添加路由规则： 5）创建一个配置文件。 6）以nobody用户组运行mihomo，这就是我之前漏掉从而失败的环节。 相比于OpenClash使用的命令，这里删去了后台运行和生成日志文件的内容，因为日志文件还需要额外操作，管理其大小等。 |
Beta Was this translation helpful? Give feedback.
-
|
1）要实现重启自动运行，首先需要创建脚本，修改防火墙等配置： 粘贴进以下内容： 保存退出。 然后就是赋予权限，启动脚本： 2）开启ipv6的情况下，防火墙有时会reload：firewall: Reloading firewall due to ifupdate of wan6 (eth0) 打开热插拔事件防火墙脚本进行编辑： 在最后添加对 nftables 脚本的调用。 保存退出。 3）最后，我们需要创建mihomo的脚本。 粘贴内容： 设置权限，启动脚本。 4）此外，我们还需要使用UI面板：
|
Beta Was this translation helpful? Give feedback.
-
|
更新：已经成功通过修改ShellCrash的防火墙配置实现了ipv6的tproxy本机代理！之后也会分享修改后的配置~ 最后，给大家提供一个tproxy代理tcp流量（除了路由本机，OpenClash开发者说这个只能用redirect）的nft配置~是我参考其他贴文摸索出来的，已经测试成功了！ 为了更加简洁，只展示与关闭代理时的防火墙不同的配置： |
Beta Was this translation helpful? Give feedback.
-
|
感谢分享，正好我也想这样搞 |
Beta Was this translation helpful? Give feedback.
-
先点个赞额试一下 sc ？ |
Beta Was this translation helpful? Give feedback.
-
|
谢谢！我试用了shellcrash，确实可以实现tproxy代理本机ipv4 tcp&udp！ 更新：已经成功通过修改sc的防火墙配置实现了ipv6的tproxy本机代理~ |
Beta Was this translation helpful? Give feedback.
-
|
（如果造成了meta开发者不满我可以道歉并删除） |
Beta Was this translation helpful? Give feedback.
-
哈哈哈，感觉meta对机场用户还是更友好，而且yaml文件更容易配置。sing-box的文件看得头大，主要还是太陌生，先把熟悉的工具运用好再去研究看看~ |
Beta Was this translation helpful? Give feedback.
-
|
个人感觉sing比clash/meta更适合路由器运行，clash/meta还是更偏向桌面端一些。 如果是为了机场订阅proxyprovider的话可以先用PuerNya大佬的修改版内核，前面有说到的shellcrash就有这个内核。教程的话可以看DustinWin大佬的，基本都有了。 sing的配置文件其实还好，json只要括号对上就行，缩进和换行不是必要的。 借sing官方的范例举例，下面三个实际上是一模一样的，第三个就和meta的挺像，反正是写给自己看的，怎么顺怎么来。
{
"dns": {
"servers": [
{
"tag": "google",
"address": "tls://8.8.8.8"
},
{
"tag": "local",
"address": "223.5.5.5",
"detour": "direct"
},
{
"tag": "remote",
"address": "fakeip"
}
],
"rules": [
{
"outbound": "any",
"server": "local"
},
{
"query_type": [
"A",
"AAAA"
],
"server": "remote"
}
],
"fakeip": {
"enabled": true,
"inet4_range": "198.18.0.0/15",
"inet6_range": "fc00::/18"
},
"independent_cache": true
},
"inbounds": [
{
"type": "tun",
"inet4_address": "172.19.0.1/30",
"inet6_address": "fdfe:dcba:9876::1/126",
"auto_route": true,
"strict_route": true
}
],
"outbounds": [
{
"type": "direct",
"tag": "direct"
},
{
"type": "dns",
"tag": "dns-out"
}
],
"route": {
"rules": [
{
"protocol": "dns",
"outbound": "dns-out"
},
{
"geoip": [
"private"
],
"outbound": "direct"
}
],
"auto_detect_interface": true
}
}{"dns":{"servers":[{"tag":"google","address":"tls://8.8.8.8"},{"tag":"local","address":"223.5.5.5","detour":"direct"},{"tag":"remote","address":"fakeip"}],"rules":[{"outbound":"any","server":"local"},{"query_type":["A","AAAA"],"server":"remote"}],"fakeip":{"enabled":true,"inet4_range":"198.18.0.0/15","inet6_range":"fc00::/18"},"independent_cache":true},"inbounds":[{"type":"tun","inet4_address":"172.19.0.1/30","inet6_address":"fdfe:dcba:9876::1/126","auto_route":true,"strict_route":true}],"outbounds":[{"type":"direct","tag":"direct"},{"type":"dns","tag":"dns-out"}],"route":{"rules":[{"protocol":"dns","outbound":"dns-out"},{"geoip":["private"],"outbound":"direct"}],"auto_detect_interface":true}}{"dns":{
"servers":[
{"tag":"google","address":"tls://8.8.8.8"},
{"tag":"local","address":"223.5.5.5","detour":"direct"},
{"tag":"remote","address":"fakeip"}],
"rules":[
{"outbound":"any","server":"local"},
{"query_type":["A","AAAA"],"server":"remote"}],
"fakeip":{"enabled":true,"inet4_range":"198.18.0.0/15","inet6_range":"fc00::/18"},
"independent_cache":true},
"inbounds":[
{"type":"tun","inet4_address":"172.19.0.1/30","inet6_address":"fdfe:dcba:9876::1/126","auto_route":true,"strict_route":true}],
"outbounds":[
{"type":"direct","tag":"direct"},
{"type":"dns","tag":"dns-out"}],
"route":{
"rules":[
{"protocol":"dns","outbound":"dns-out"},
{"geoip":["private"],"outbound":"direct"}],
"auto_detect_interface":true}} |
Beta Was this translation helpful? Give feedback.
-
|
@hoststgjrem 😄感谢您的推介！第三个看起来舒服多了~ |
Beta Was this translation helpful? Give feedback.
-
之前，在 #1320 这个issue中，我提到自己试图直接使用mihomo内核，实现软路由的透明代理。
之所以想要尝试，是因为使用OpenClash时出现bug，我觉得如果能直接运行内核，OpenClash的问题就更容易排查。不过当时我并未成功。但随着OpenClash的bug被修复，我也意识到问题可能出在什么地方~
我一开始的操作逻辑是，复制OpenClash运行时的nftables配置。关闭之后再应用它。然后设置Dnsmasq转发，最后开启mihomo。结果，直连流量出现了loopback错误。
通过观察OpenClash对bug的修复，我发现问题出在mihomo进程的uid上。为了实现路由本机代理（很多教程都没有涉及它），Openclash将进程的uid设置为nobody。而我之前漏掉了这一步，使得针对nobody的防火墙规则没有生效。
那么，接下来只需要模仿OpenClash的做法，让mihomo以nobody的用户等级运行即可。终于，之前的报错不再出现了~
因为增加了对防火墙的理解，现在，我可以自己配置，让tproxy代理ipv4 tcp了，这是OpenClash不支持的功能~下面是具体的命令分享！
更新：已经成功通过修改ShellCrash的防火墙配置实现了ipv6的tproxy本机代理！之后也会分享修改后的配置~
Beta Was this translation helpful? Give feedback.
All reactions