Replies: 4 comments 2 replies
-
|
照下面的改一下，再试试 `iptables -F ip rule add fwmark 1 table 100 让当前机器成为一个网关服务器iptables -t filter -A FORWARD -j ACCEPT iptables -t mangle -N XRAY iptables -t mangle -A XRAY -d ### vpsip/32 -j RETURN #把ip加上 iptables -t mangle -A PREROUTING -j XRAY` |
Beta Was this translation helpful? Give feedback.
-
|
更新了新的iptables.sh，问题依旧。 这是最新 xray 25.1.30 和 xray .25.3.6的access日志： access 日志#xray 25.1.30 日志 #xray 25.3.6 日志： 2025/03/20 20:58:00.151671 from 192.168.50.169:65166 accepted udp:8.8.8.8:53 [all-in -> dns-out] error 日志Xray 25.1.30~ # tail -f error Xray 25.3.6:2025/03/20 21:03:02.576379 [Info] app/dns: DNS: created DOH client for https://1.1.1.1/dns-query, with h2c false |
Beta Was this translation helpful? Give feedback.
-
|
加上 iptables -t mangle -I PREROUTING -p tcp -m socket -j ACCEPT再试试看 |
Beta Was this translation helpful? Give feedback.
-
|
解决了吗？最新版本tproxy也不正常 |
Beta Was this translation helpful? Give feedback.
-
|
话说 Windows 支持将网关设为本地某个 IP 并且绕过特定程序吗， |
Beta Was this translation helpful? Give feedback.
-
|
找到原因了，跟 #4493 一模一样 ，设置net.mptcp.enabled=0，tproxy 模块就正常了，没设置这个玩意启动会报错，transport/internet: failed to apply socket options to incoming connection > transport/internet: failed to set IP_TRANSPARENT > operation not supported 大佬能不能加个文档，ubuntu 22/24 都已经是很新的linux了，这个参数导致linux透明代理整个功能都失效了几个月 :( |
Beta Was this translation helpful? Give feedback.
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
-
背景：
最近半年出现crush情况（也可能是cp geoip和geosite到透明网关时候数据不完整导致的），于是决定升级服务器和客户端的版本。
家庭服务情况：
其中，192.168.1.100 上有两个主要服务，hystira2 以及 xray，因为地区问题xray的访问速度受限，所以主要就是考虑 hystira2作为主要通讯服务，xray作为分流，配合iptables实现了透明网关参考的https://xtls.github.io/document/level-2/tproxy.html#netfilter-配置
问题描述：
2.[Xray-core v24.12.31] 透明网关正常工作 ✅
xray1.8.1 版本：
panic: runtime error: slice bounds out of range [:2072] with capacity 2048
goroutine 8326 [running]:
github.com/xtls/xray-core/common/protocol/quic.SniffQUIC({0x4000e9e000, 0xc1b, 0x2000})
github.com/xtls/xray-core/common/protocol/quic/sniff.go:220 +0x15d0
github.com/xtls/xray-core/app/dispatcher.NewSniffer.func4({0x4002e02d88?, 0x43e4a4?}, {0x4000e9e000?, 0x28?, 0x4002e02d01?})
github.com/xtls/xray-core/app/dispatcher/sniffer.go:41 +0x2c
github.com/xtls/xray-core/app/dispatcher.(*Sniffer).Sniff(0x400395e318, {0x105b9c0, 0x40085b8510}, {0x4000e9e000, 0xc1b, 0x2000}, 0x3)
github.com/xtls/xray-core/app/dispatcher/sniffer.go:65 +0xb4
github.com/xtls/xray-core/app/dispatcher.sniffer.func1({0x105b9c0, 0x40085b8510}, 0x4006417230, 0x4006417290, 0x400395e318, 0x3)
github.com/xtls/xray-core/app/dispatcher/default.go:367 +0xf0
github.com/xtls/xray-core/app/dispatcher.sniffer({0x105b9c0, 0x40085b8510}, 0x4006417230, 0x0, 0x3)
github.com/xtls/xray-core/app/dispatcher/default.go:377 +0xb8
github.com/xtls/xray-core/app/dispatcher.(*DefaultDispatcher).Dispatch.func1()
github.com/xtls/xray-core/app/dispatcher/default.go:259 +0xd8
created by github.com/xtls/xray-core/app/dispatcher.(*DefaultDispatcher).Dispatch in goroutine 8325
github.com/xtls/xray-core/app/dispatcher/default.go:254 +0x3dc
#我的配置如下：
hysteria2.yaml:
server: ip:port
tls:
sni: bing.com
insecure: True
auth: password
socks5:
listen: 127.0.0.1:10881
#my.json:
{
"log": {
"access": "/root/access",
"error": "/root/error",
"loglevel": "info",
"dnsLog": true
},
"policy": {
"levels": {
"0": {
"statsUserUplink": false,
"statsUserDownlink": false
}
}
},
"dns": {
"hosts": {
"dns.google": "8.8.8.8",
"dns.pub": "119.29.29.29",
"dns.alidns.com": "223.5.5.5",
"geosite:category-ads-all": "127.0.0.1"
},
"servers": [
{
"address": "https://1.1.1.1/dns-query",
"domains": ["geosite:geolocation-!cn"],
"expectIPs": ["geoip:!cn"]
},
"8.8.8.8",
{
"address": "114.114.114.114",
"port": 53,
"domains": ["geosite:cn", "geosite:category-games@cn"],
"expectIPs": ["geoip:cn"],
"skipFallback": true
}
]
},
"inbounds": [
{
"tag": "all-in",
"port": 12345,
"protocol": "dokodemo-door",
"settings": {
"network": "tcp,udp",
"followRedirect": true
},
"sniffing": {
"enabled": true,
"destOverride": ["http", "tls"]
},
"streamSettings": {
"sockopt": {
"tproxy": "tproxy"
}
}
}
],
"outbounds": [
{
"tag": "proxy",
"protocol": "socks",
"settings":
{
"servers": [
{
"address": "127.0.0.1",
"port": 10881
}
]
}
},
{
"tag": "direct",
"protocol": "freedom",
"settings": {
"domainStrategy": "UseIP"
},
"streamSettings": {
"sockopt": {
"mark": 255
}
}
},
{
"tag": "block",
"protocol": "blackhole",
"settings": {
"response": {
"type": "http"
}
}
},
{
"tag": "dns-out",
"protocol": "dns",
"streamSettings": {
"sockopt": {
"mark": 255
}
}
}
],
"routing": {
"domainStrategy": "IPIfNonMatch",
"domainMatcher": "mph",
"rules": [
{
"type": "field",
"domain": ["geosite:category-ads-all"],
"outboundTag": "block"
},
{
"type": "field",
"inboundTag": ["all-in"],
"port": 123,
"network": "udp",
"outboundTag": "direct"
},
{
"type": "field",
"inboundTag": ["all-in"],
"port": 53,
"network": "udp",
"outboundTag": "dns-out"
},
{
"type": "field",
"ip": ["119.29.29.29", "223.5.5.5"],
"outboundTag": "direct"
},
{
"type": "field",
"protocol": ["bittorrent"],
"outboundTag": "direct"
},
{
"type": "field",
"ip": ["geoip:private", "geoip:cn"]
"outboundTag": "direct"
},
{
"type": "field",
"domain": ["geosite:cn"],
"outboundTag": "direct"
},
{
"type": "field",
"ip": ["1.1.1.1", "8.8.8.8"],
"outboundTag": "proxy"
},
{
"type": "field",
"domain": [
"geosite:geolocation-!cn",
"domain:googleapis.cn",
"dns.google"
],
"outboundTag": "proxy"
}
]
}
}
iptables.sh:
`iptables -F
iptables -X
ip rule add fwmark 1 table 100
ip route add local 0.0.0.0/0 dev lo table 100
iptables -t mangle -N XRAY
iptables -t mangle -A XRAY -d 0.0.0.0/8 -j RETURN
iptables -t mangle -A XRAY -d 10.0.0.0/8 -j RETURN
iptables -t mangle -A XRAY -d 127.0.0.0/8 -j RETURN
iptables -t mangle -A XRAY -d 169.254.0.0/16 -j RETURN
iptables -t mangle -A XRAY -d 172.16.0.0/12 -j RETURN
iptables -t mangle -A XRAY -d 192.168.50.0/16 -j RETURN
iptables -t mangle -A XRAY -d ### vpsip/32 -j RETURN
iptables -t mangle -A XRAY -d 224.0.0.0/4 -j RETURN
iptables -t mangle -A XRAY -d 240.0.0.0/4 -j RETURN
iptables -t mangle -A XRAY -p tcp -j TPROXY --on-port 12345 --tproxy-mark 1
iptables -t mangle -A XRAY -p udp -j TPROXY --on-port 12345 --tproxy-mark 1
iptables -t mangle -A PREROUTING -j XRAY`
我出现的问题仅在透明网关模式出现了，如果直接在用户机器（macos:192.168.1.200，网关改成默认家庭网关）直接启动xray run -c ok.json, 用户机器是可以正常打来浏览器科学上网的。
Beta Was this translation helpful? Give feedback.
All reactions