@@ -1596,6 +1596,9 @@ if [ -n "$FW4" ]; then
1596
1596
elif [ " $enable_redirect_dns " -eq 1 ]; then
1597
1597
nft insert rule inet fw4 dstnat position 0 meta nfproto {ipv4} tcp dport 53 counter accept comment \" OpenClash TCP DNS Hijack\"
1598
1598
fi
1599
+ if [ " $router_self_proxy " = 1 ]; then
1600
+ nft insert rule inet fw4 nat_output position 0 skuid ! = 65534 meta nfproto {ipv4} tcp dport 53 counter accept comment \" OpenClash TCP DNS Hijack\"
1601
+ fi
1599
1602
1600
1603
# TUN FORWORD
1601
1604
nft insert rule inet fw4 forward position 0 meta l4proto {tcp,udp} oifname utun counter accept comment \" OpenClash TUN Forward\"
@@ -1663,14 +1666,16 @@ if [ -n "$FW4" ]; then
1663
1666
fi
1664
1667
fi
1665
1668
fi
1666
- if [ " $en_mode " = " fake-ip" ] && [ " $china_ip_route " != " 0" ] && [ " $enable_redirect_dns " != " 2" ]; then
1667
- nft insert rule inet fw4 dstnat position 0 meta nfproto {ipv6} tcp dport 53 counter redirect to " $dns_port " comment \" OpenClash DNS Hijack\"
1668
- nft insert rule inet fw4 dstnat position 0 meta nfproto {ipv6} udp dport 53 counter redirect to " $dns_port " comment \" OpenClash DNS Hijack\"
1669
- nft ' add chain inet fw4 nat_output { type nat hook output priority -1; }'
1670
- nft add rule inet fw4 nat_output position 0 meta nfproto {ipv6} tcp dport 53 meta skuid ! = 65534 counter redirect to " $dns_port " comment \" OpenClash DNS Hijack\"
1671
- nft add rule inet fw4 nat_output position 0 meta nfproto {ipv6} udp dport 53 meta skuid ! = 65534 counter redirect to " $dns_port " comment \" OpenClash DNS Hijack\"
1672
- nft add rule inet fw4 nat_output position 0 meta nfproto {ipv6} tcp dport 12353 meta skuid ! = 65534 counter redirect to " $DNSPORT " comment \" OpenClash DNS Hijack\"
1673
- nft add rule inet fw4 nat_output position 0 meta nfproto {ipv6} udp dport 12353 meta skuid ! = 65534 counter redirect to " $DNSPORT " comment \" OpenClash DNS Hijack\"
1669
+
1670
+ if [ " $enable_redirect_dns " -eq 2 ]; then
1671
+ local position=$( nft -a list chain inet fw4 openclash_dns_redirect | grep " DNS" | grep -v " redirect" | awk -F ' # handle ' ' {print$2}' | sort -rn | head -1)
1672
+ [ -z " $position " ] && position=0
1673
+ nft insert rule inet fw4 openclash_dns_redirect position " $position " meta nfproto {ipv6} tcp dport 53 counter accept comment \" OpenClash TCP DNS Hijack\"
1674
+ elif [ " $enable_redirect_dns " -eq 1 ]; then
1675
+ nft insert rule inet fw4 dstnat position 0 meta nfproto {ipv6} tcp dport 53 counter accept comment \" OpenClash TCP DNS Hijack\"
1676
+ fi
1677
+ if [ " $router_self_proxy " = 1 ]; then
1678
+ nft insert rule inet fw4 nat_output position 0 skuid ! = 65534 meta nfproto {ipv6} tcp dport 53 counter accept comment \" OpenClash TCP DNS Hijack\"
1674
1679
fi
1675
1680
1676
1681
if [ " $china_ip6_route " != " 0" ] || [ " $disable_udp_quic " = " 1" ]; then
@@ -2378,6 +2383,9 @@ if [ -z "$FW4" ]; then
2378
2383
elif [ " $enable_redirect_dns " -eq 1 ]; then
2379
2384
iptables -t nat -I PREROUTING -m comment --comment " OpenClash TCP DNS Hijack" -p tcp --dport 53 -j ACCEPT
2380
2385
fi
2386
+ if [ " $router_self_proxy " = 1 ]; then
2387
+ iptables -t nat -I OUTPUT -m owner ! --uid-owner 65534 -m comment --comment " OpenClash TCP DNS Hijack" -p tcp --dport 53 -j ACCEPT
2388
+ fi
2381
2389
2382
2390
# TUN FORWORD
2383
2391
iptables -I FORWARD -m comment --comment " OpenClash TUN Forward" -o utun -j ACCEPT > /dev/null 2>&1
@@ -2446,15 +2454,20 @@ if [ -z "$FW4" ]; then
2446
2454
fi
2447
2455
fi
2448
2456
fi
2449
- if [ " $en_mode " = " fake-ip" ] && [ " $china_ip_route " != " 0" ] && [ " $enable_redirect_dns " != " 2" ]; then
2450
- ip6tables -t nat -I PREROUTING -p udp --dport 53 -j REDIRECT --to-ports " $dns_port " -m comment --comment " OpenClash DNS Hijack"
2451
- ip6tables -t nat -I PREROUTING -p tcp --dport 53 -j REDIRECT --to-ports " $dns_port " -m comment --comment " OpenClash DNS Hijack"
2452
- ip6tables -t nat -I OUTPUT -p udp --dport 53 -m owner ! --uid-owner 65534 -j REDIRECT --to-ports " $dns_port " -m comment --comment " OpenClash DNS Hijack"
2453
- ip6tables -t nat -I OUTPUT -p tcp --dport 53 -m owner ! --uid-owner 65534 -j REDIRECT --to-ports " $dns_port " -m comment --comment " OpenClash DNS Hijack"
2454
- ip6tables -t nat -I OUTPUT -p udp --dport 12353 -m owner ! --uid-owner 65534 -j REDIRECT --to-ports " $DNSPORT " -m comment --comment " OpenClash DNS Hijack"
2455
- ip6tables -t nat -I OUTPUT -p tcp --dport 12353 -m owner ! --uid-owner 65534 -j REDIRECT --to-ports " $DNSPORT " -m comment --comment " OpenClash DNS Hijack"
2456
- fi
2457
2457
2458
+ if [ " $ipv6_mode " -eq 2 ]; then
2459
+ if [ " $enable_redirect_dns " -eq 2 ]; then
2460
+ local position=$( ip6tables -nvL openclash_dns_redirect -t nat | grep " DNS" | grep -v " REDIRECT" | wc -l)
2461
+ let position++
2462
+ ip6tables -t nat -I openclash_dns_redirect " $position " -m comment --comment " OpenClash TCP DNS Hijack" -p tcp --dport 53 -j ACCEPT
2463
+ elif [ " $enable_redirect_dns " -eq 1 ]; then
2464
+ ip6tables -t nat -I PREROUTING -m comment --comment " OpenClash TCP DNS Hijack" -p tcp --dport 53 -j ACCEPT
2465
+ fi
2466
+ if [ " $router_self_proxy " = 1 ]; then
2467
+ ip6tables -t nat -I OUTPUT -p tcp --dport 53 -d ::/0 -m owner ! --uid-owner 65534 -j ACCEPT -m comment --comment " OpenClash DNS Hijack"
2468
+ fi
2469
+ fi
2470
+
2458
2471
if [ " $china_ip6_route " != " 0" ] || [ " $disable_udp_quic " = " 1" ]; then
2459
2472
ipset -! flush china_ip6_route
2460
2473
ipset -! restore < /etc/openclash/china_ip6_route.ipset
0 commit comments