kr328 / clash-premium-installer Goto Github PK

if [ ! -d "/sys/fs/cgroup/net_cls" ];then
	mkdir -p /sys/fs/cgroup/net_cls
	exit 0
fi
mount -t cgroup -onet_cls net_cls /sys/fs/cgroup/net_cls
mkdir -p /sys/fs/cgroup/net_cls/bypass_proxy
echo "$PROXY_BYPASS_CGROUP" > /sys/fs/cgroup/net_cls/bypass_proxy/net_cls.classid
chmod 666 /sys/fs/cgroup/net_cls/bypass_proxy/tasks

#!/bin/bash
# https://comzyh.gitbook.io/clash/real-ip-tun-example

# 创建 Clash Chain
iptables -t mangle -N clash

# 放行内网内部数据
iptables -t mangle -A clash -d 0.0.0.0/8 -j RETURN
iptables -t mangle -A clash -d 10.0.0.0/8 -j RETURN
iptables -t mangle -A clash -d 127.0.0.0/8 -j RETURN
iptables -t mangle -A clash -d 169.254.0.0/16 -j RETURN
iptables -t mangle -A clash -d 172.16.0.0/12 -j RETURN
iptables -t mangle -A clash -d 192.168.0.0/16 -j RETURN
iptables -t mangle -A clash -d 224.0.0.0/4 -j RETURN
iptables -t mangle -A clash -d 240.0.0.0/4 -j RETURN

# 其他数据打上标记
iptables -t mangle -A clash -j MARK --set-xmark 100

# 给转发流量打上fwmark
iptables -t mangle -A PREROUTING -j clash

# 放行root用户数据避免回环
# iptables -t mangle -A OUTPUT -m owner --uid-owner 0 -j RETURN

# utun添加策略路由表
ip route add default dev utun table 100
# 标记为100的包由策略路由表100处理
ip rule add fwmark 100 lookup 100

exec "$@"

mixed-port: 7890
redir-port: 7892
#tproxy-port: 7893
allow-lan: true
mode: rule
log-level: warning # info / warning / error / debug / silent
ipv6: false
external-controller: 0.0.0.0:9090
# external-ui: /ui
#interface-name: ens18
tun:
  enable: true
  stack: system # or `gvisor'
#  dns-listen: 0.0.0.0:53
  dns-hijack:
    - 1.0.0.1:53
#  auto-route: true
dns: # DNS server settings
  enable: true
#  listen: 0.0.0.0:53
  ipv6: false
  default-nameserver:
    - 119.29.29.29
  enhanced-mode: redir-host # or fake-ip redir-host
  fake-ip-range: 198.18.0.1/16 # Fake IP addresses pool CIDR
  # use-hosts: true # lookup hosts and return IP record
  fake-ip-filter:
    - '*.lan'
    - localhost.ptlogin2.qq.com
    - '+.srv.nintendo.net'
    - '+.stun.playstation.net'
    - '+.msftconnecttest.com'
    - '+.msftncsi.com'
    - '+.xboxlive.com'
    - 'msftconnecttest.com'
    - 'xbox.*.microsoft.com'
    - '*.battlenet.com.cn'
    - '*.battlenet.com'
    - '*.blzstatic.cn'
    - '*.battle.net'
  nameserver: # 国内域名使用 nameserver 请求
    - https://doh.pub/dns-query #腾讯DNS
    - https://dns.alidns.com/dns-query #阿里DNS
    # - 119.29.29.29
  fallback: # 国外域名使用 fallback 请求 (没有被污染的DNS)
    - https://cloudflare-dns.com/dns-query #Cloudflare DNS
    - https://doh.dns.sb/dns-query #DNS.SB
  fallback-filter: # fallback请求过滤
    geoip: true
    ipcidr:
      - 240.0.0.0/4
    domain:
      - '+.google.com'
      - '+.youtube.com'

utun: flags=4305<UP,POINTOPOINT,RUNNING,NOARP,MULTICAST>  mtu 9000
        inet 198.18.0.1  netmask 255.255.0.0  destination 198.18.0.1
        inet6 fe80::5a70:e37f:3785:97e8  prefixlen 64  scopeid 0x20<link>
        unspec 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  txqueuelen 500  (UNSPEC)
        RX packets 1040  bytes 115856 (113.1 KiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 1042  bytes 115952 (113.2 KiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

table ip clash {
        chain local {
                type route hook output priority 0; policy accept;
                ip protocol != { tcp, udp } accept
                cgroup 114514 accept
                ip daddr { 10.0.0.0/8, 127.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 224.0.0.0/4 } accept
                ct state new ct mark set 0x0001bf52
                ct mark 0x0001bf52 mark set 0x0001bf52
        }

        chain forward {
                type filter hook prerouting priority 0; policy accept;
                ip protocol != { tcp, udp } accept
                iif "utun" accept
                ip daddr { 10.0.0.0/8, 127.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 224.0.0.0/4 } accept
                mark set 0x0001bf52
        }

        chain local-dns-redirect {
                type nat hook output priority 0; policy accept;
                ip protocol != { tcp, udp } accept
                cgroup 114514 accept
                ip daddr 127.0.0.0/8 accept
                udp dport domain dnat to 1.0.0.1:domain
                tcp dport domain dnat to 1.0.0.1:domain
        }

        chain forward-dns-redirect {
                type nat hook prerouting priority 0; policy accept;
                ip protocol != { tcp, udp } accept
                udp dport domain dnat to 1.0.0.1:domain
                tcp dport domain dnat to 1.0.0.1:domain
        }
}