手搓tproxy 透明代理旁路由，fake-ip，nftables，mosdns->mihomo

[dnvcupid]

手搓tproxy 透明代理，fake-ip，nftables，客户端->mosdns（53）->mihomo（5353），但是没成功，有没大佬可以解惑

客户端：网关、dns为旁路由IP
mosdns：https://github.com/pmkol/easymosdns
mihomo：tproxy-port:7890，全局模式

mosdns配置

# https://apad.pro/easymosdns
log:
    file: "./mosdns.log"
    level: error

data_providers:
  - tag: chinalist
    file: ./rules/china_domain_list.txt
    auto_reload: true
  - tag: gfwlist
    file: ./rules/gfw_domain_list.txt
    auto_reload: true
  - tag: cdncn
    file: ./rules/cdn_domain_list.txt
    auto_reload: true
  - tag: chinaip
    file: ./rules/china_ip_list.txt
    auto_reload: true
  - tag: gfwip
    file: ./rules/gfw_ip_list.txt
    auto_reload: true
  - tag: adlist
    file: ./rules/ad_domain_list.txt
    auto_reload: true
  - tag: ecscn
    file: ./ecs_cn_domain.txt
    auto_reload: true
  - tag: ecsnoncn
    file: ./ecs_noncn_domain.txt
    auto_reload: true
  - tag: hosts
    file: ./hosts.txt
    auto_reload: true

plugins:
  # 缓存的插件
  # [lan|wan]
  - tag: cache_lan
    type: cache
    args:
      size: 8192
      redis: "redis://127.0.0.1:6379/0"
      lazy_cache_ttl: 86400
      cache_everything: true
      lazy_cache_reply_ttl: 1
  - tag: cache_wan
    type: cache
    args:
      size: 131072
      compress_resp: true
      redis: "redis://127.0.0.1:6379/0"
      lazy_cache_ttl: 86400
      cache_everything: true
      lazy_cache_reply_ttl: 5

  # Hosts的插件
  - tag: hosts
    type: hosts
    args:
      hosts:
        - "provider:hosts"

  # 获取ECS的插件
  - tag: ecs_auto
    type: ecs
    args:
      auto: true
      force_overwrite: false
      
  # 指定ECS的插件
  - tag: ecs_global
    type: ecs
    args:
      auto: false
      ipv4: "168.95.1.0"
      ipv6: "2001:b000:168::"
      force_overwrite: false

  # 匹配ECS的插件
  - tag: ecs_is_lan
    type: query_matcher
    args:
      ecs: 
        - "0.0.0.0/8"
        - "10.0.0.0/8"
        - "100.64.0.0/10"
        - "127.0.0.0/8"
        - "169.254.0.0/16"
        - "172.16.0.0/12"
        - "192.0.0.0/24"
        - "192.0.2.0/24"
        - "198.18.0.0/15"
        - "192.88.99.0/24"
        - "192.168.0.0/16"
        - "198.51.100.0/24"
        - "203.0.113.0/24"
        - "224.0.0.0/3"
        - "::1/128"
        - "fc00::/7"
        - "fe80::/10"
  - tag: ecs_is_cn
    type: query_matcher
    args:
      ecs: 
        - "provider:chinaip"

  # 调整TTL的插件
  # [1m|5m|1h]
  - tag: ttl_1m
    type: ttl
    args:
      minimal_ttl: 60
      maximum_ttl: 3600
  - tag: ttl_5m
    type: ttl
    args:
      minimal_ttl: 300
      maximum_ttl: 86400
  - tag: ttl_1h
    type: ttl
    args:
      minimal_ttl: 3600
      maximum_ttl: 86400

  # 匹配TYPE12类型请求的插件
  - tag: qtype12
    type: query_matcher
    args:
      qtype: [12]

  # 匹配TYPE65类型请求的插件
  - tag: qtype65
    type: query_matcher
    args:
      qtype: [65]

  # 匹配TYPE255类型请求的插件
  - tag: qtype255
    type: query_matcher
    args:
      qtype: [255]

  # 匹配RCODE2的插件
  - tag: response_server_failed
    type: response_matcher
    args:
      rcode: [2]

  # 屏蔽请求的插件
  - tag: black_hole
    type: blackhole
    args:
      rcode: 0
      ipv4: "0.0.0.0"
      ipv6: "::"

  # 匹配无效域名的插件
  - tag: query_is_non_domain
    type: query_matcher
    args:
      domain:
        - "keyword::"

  # 匹配本地域名的插件
  - tag: query_is_local_domain
    type: query_matcher
    args:
      domain:
        - "provider:chinalist"

  # 匹配污染域名的插件
  - tag: query_is_non_local_domain
    type: query_matcher
    args:
      domain:
        - "provider:gfwlist"

  # 匹配CDN域名的插件
  - tag: query_is_cdn_cn_domain
    type: query_matcher
    args:
      domain:
        - "provider:cdncn"

  # 匹配广告域名的插件
  - tag: query_is_ad_domain
    type: query_matcher
    args:
      domain:
        - "provider:adlist"

  # 匹配强制本地解析域名的插件
  - tag: query_is_cn_domain
    type: query_matcher
    args:
      domain:
        - "provider:ecscn"

  # 匹配强制非本地解析域名的插件
  - tag: query_is_noncn_domain
    type: query_matcher
    args:
      domain:
        - "provider:ecsnoncn"

  # 匹配本地IP的插件
  - tag: response_has_local_ip
    type: response_matcher
    args:
      ip:
        - "provider:chinaip"

  # 匹配污染IP的插件
  - tag: response_has_gfw_ip
    type: response_matcher
    args:
      ip:
        - "provider:gfwip"

  # 转发至本地服务器的插件
  - tag: forward_local
    type: fast_forward
    args:
      upstream:
        - addr: "223.6.6.6"
        - addr: "tls://120.53.53.53:853"
          enable_pipeline: true

  # 转发至远程服务器的插件
  - tag: forward_remote
    type: fast_forward
    args:
      upstream:
        - addr: "127.0.0.1:5353"
          enable_pipeline: true

  # 转发至分流服务器的插件
  - tag: forward_easymosdns
    type: fast_forward
    args:
      upstream:
        - addr: "https://doh.apad.pro/dns-query"
          bootstrap: "223.6.6.6"
          #dial_addr: "ip:port"
          enable_http3: true

  # 主要的运行逻辑插件
  # sequence 插件中调用的插件 tag 必须在 sequence 前定义
  # 否则 sequence 找不到对应插件
  - tag: main_sequence
    type: sequence
    args:
      exec:
        # 域名映射IP
        - hosts

        # 屏蔽TYPE65与无效类型请求
        - if: "[qtype65] || (query_is_non_domain)"
          exec:
            - _new_nxdomain_response
            - _return

        # 优化PRT与ANY类型请求
        - if: "[qtype12] || [qtype255]"
          exec:
            - _no_ecs
            - forward_local
            - ttl_1h
            - _return

        # 缓存ECS
        - ecs_auto
        - _edns0_filter_ecs_only
        - if: ecs_is_lan
          exec:
            - cache_lan
            - _no_ecs
          else_exec:
            - cache_wan

        # 强制用本地服务器解析
        - if: query_is_cn_domain
          exec:
            - forward_local
            - ttl_5m
            - _return

        # 强制用非本地服务器解析
        - if: query_is_noncn_domain
          exec:
            # 优先返回ipv4结果
            - _prefer_ipv4
            - ecs_global
            - primary:
                # 默认用分流服务器
                - forward_easymosdns
              secondary:
                # 超时用远程服务器
                - forward_remote
              fast_fallback: 2500
              always_standby: false
            - ttl_5m
            - _return

        # 屏蔽广告域名
        - if: query_is_ad_domain
          exec:
          - forward_local
          - ttl_1h
          - _return

        # 已知的本地域名或CDN域名用本地服务器解析
        - if: "(query_is_local_domain) || (query_is_cdn_cn_domain)"
          exec:
            - primary:
                # 默认用本地服务器
                - forward_local
                - ttl_1m
              secondary:
                # 超时用分流服务器
                - forward_easymosdns
                - ttl_5m
              fast_fallback: 25
              always_standby: false
            # 预防已知的本地域名临时污染
            - if: "(! response_has_gfw_ip)"
              exec:
                - _return

        # 已知的污染域名用分流服务器或远程服务器解析
        - if: query_is_non_local_domain
          exec:
            # 优先返回ipv4结果
            - _prefer_ipv4
            - ecs_global
            - primary:
                # 默认用分流服务器
                - forward_easymosdns
              secondary:
                # 超时用远程服务器
                - forward_remote
              fast_fallback: 2500
              always_standby: false
            - ttl_5m
            - _return

        # 剩下的未知域名用IP分流
        # 优先返回ipv4结果
        - _prefer_ipv4
        - primary:
            # 默认用分流服务器
            - forward_easymosdns
            - if: response_server_failed
              exec:
                - forward_local
                - _return
            - ecs_global
            - if: "(! ecs_is_cn) && (! response_has_local_ip) && [_response_valid_answer]"
              exec:
                - forward_easymosdns
          secondary:
            # 超时用本地分流器
            - forward_remote
            - if: response_has_local_ip
              exec:
                - forward_local
                - _return
            - ecs_global
            - if: "(! ecs_is_cn) && [_response_valid_answer]"
              exec:
                - forward_remote
          fast_fallback: 2500
          always_standby: false
        - ttl_5m

servers:
  - exec: main_sequence
    timeout: 6
    listeners:
      - protocol: udp
        addr: "0.0.0.0:53"
      - protocol: tcp
        addr: "0.0.0.0:53"
      #- protocol: http
      #  addr: "127.0.0.1:9053"
      #  url_path: "/dns-query"
      #  get_user_ip_from_header: "X-Forwarded-For"
      #- protocol: tls             
      #  addr: "0.0.0.0:853"
      #  cert: "/etc/mosdns/yourdomain.cert"  # TLS 所需证书文件。
      #  key: "/etc/mosdns/yourdomain.key"    # TLS 所需密钥文件。

#api:
#    http: "127.0.0.1:9080"```




**mihomo配置**

```ipv6: true
allow-lan: true
tproxy-port: 7890
mixed-port: 7891
log-level: warning
mode: global
find-process-mode: strict
global-client-fingerprint: chrome
keep-alive-interval: 15

unified-delay: false
tcp-concurrent: true

external-controller: 0.0.0.0:9090
secret: "123456"
external-ui: /etc/mihomo/ui
external-ui-name: xd
external-ui-url: "https://github.com/MetaCubeX/metacubexd/archive/refs/heads/gh-pages.zip"

profile:
  store-selected: true
  store-fake-ip: true

sniffer:
  enable: true
  sniff:
    HTTP:
      ports: [80, 8080-8880]
      override-destination: true
    TLS:
      ports: [443, 8443]
    QUIC:
      ports: [443, 8443]
  skip-domain:
    - "Mijia Cloud"
    - "+.push.apple.com"

dns:
  enable: true
  ipv6: true
  prefer-h3: true
  respect-rules: true
  listen: 0.0.0.0:5353
  enhanced-mode: fake-ip
  fake-ip-range: 198.18.0.1/16
  fake-ip-filter:
    - "*"
    - "+.lan"
    - "+.local"
    - "+.market.xiaomi.com"

# 1、默认 DNS, 用于解析 DNS 服务器 的域名；2、必须为 IP, 可为加密 DNS
  default-nameserver:
    - 223.6.6.6
    - 119.29.29.29
# 1、DNS 主要域名配置；2、支持 UDP，TCP，DoT，DoH，DoQ；3、这部分为主要 DNS 配置，影响所有直连，确保使用对大陆解析精准的 DNS
  nameserver:
    - https://1.1.1.1/dns-query#h3=true
    - https://1.0.0.1/dns-query#h3=true
    - https://8.8.8.8/dns-query#h3=true
    - https://8.8.4.4/dns-query#h3=true
    - https://dns.quad9.net/dns-query
    - https://doh.opendns.com/dns-query
  # 代理节点域名解析服务器，仅用于解析代理节点的域名
  proxy-server-nameserver:
    - https://223.6.6.6/dns-query#h3=true
    - https://120.53.53.53/dns-query

proxies:
  - name: "c1"
    type: vmess
    server: ip
    port: 19931
    uuid: uuid
    alterId: 0
    cipher: auto

proxy-groups:
  - name: PROXY
    type: select
    proxies:
      - c1

rules:
  - PROCESS-NAME,tailscale,DIRECT
  - PROCESS-NAME,tailscaled,DIRECT
  - MATCH,PROXY```



**nftables规则**

```#!/usr/sbin/nft -f

flush ruleset

table inet proxy {
    chain prerouting {
        type filter hook prerouting priority filter; policy accept;

        # 优先拦截 DNS 请求
         tcp dport 53 counter tproxy ip to 0.0.0.0:53
         udp dport 53 counter tproxy ip to 0.0.0.0:53

        meta l4proto != { tcp, udp } counter return

        # 避免源和目的都是本机公网 IP 时造成代理 UDP 无限回环
        fib daddr type local counter return
       
    }
    chain proxy {
        # 对其它数据包(其它内网机器访问公网的包)进行拦截，全部转发给代理。
        # 踩坑：一定 tproxy 到回环 ip (127.0.0.1和::1)，如果 tproxy 到 0.0.0.0和::，运行一段时间后，可能会导致 UDP 疯狂不停回环打满 CPU（本机外部IP到本机外部IP一直在lo网卡打转）
        meta l4proto { tcp, udp } tproxy ip to 127.0.0.1:7890 meta mark set 1 counter
        meta l4proto { tcp, udp } tproxy ip6 to [::1]:7890 meta mark set 1 counter
    }
    chain output {
        type route hook output priority filter; policy accept;

        # 不拦截代理自身发出的包。
        meta skgid eq 541 counter return

        # 不拦截公网回包
        ct mark 11 counter return

        # 避免源和目的都是本机公网 IP 时造成代理 UDP 无限回环
        fib daddr type local counter return

        # 主机内进程发出的包打上 mark，让报文走策略路由重新进入 PREROUTING，以便被代理。
        meta l4proto { tcp, udp } meta mark set 1 counter
    }
}```