@@ -1596,6 +1596,9 @@ if [ -n "$FW4" ]; then
15961596 elif [ " $enable_redirect_dns " -eq 1 ]; then
15971597 nft insert rule inet fw4 dstnat position 0 meta nfproto {ipv4} tcp dport 53 counter accept comment \" OpenClash TCP DNS Hijack\"
15981598 fi
1599+ if [ " $router_self_proxy " = 1 ]; then
1600+ nft insert rule inet fw4 nat_output position 0 skuid ! = 65534 meta nfproto {ipv4} tcp dport 53 counter accept comment \" OpenClash TCP DNS Hijack\"
1601+ fi
15991602
16001603 # TUN FORWORD
16011604 nft insert rule inet fw4 forward position 0 meta l4proto {tcp,udp} oifname utun counter accept comment \" OpenClash TUN Forward\"
@@ -1663,14 +1666,16 @@ if [ -n "$FW4" ]; then
16631666 fi
16641667 fi
16651668 fi
1666- if [ " $en_mode " = " fake-ip" ] && [ " $china_ip_route " != " 0" ] && [ " $enable_redirect_dns " != " 2" ]; then
1667- nft insert rule inet fw4 dstnat position 0 meta nfproto {ipv6} tcp dport 53 counter redirect to " $dns_port " comment \" OpenClash DNS Hijack\"
1668- nft insert rule inet fw4 dstnat position 0 meta nfproto {ipv6} udp dport 53 counter redirect to " $dns_port " comment \" OpenClash DNS Hijack\"
1669- nft ' add chain inet fw4 nat_output { type nat hook output priority -1; }'
1670- nft add rule inet fw4 nat_output position 0 meta nfproto {ipv6} tcp dport 53 meta skuid ! = 65534 counter redirect to " $dns_port " comment \" OpenClash DNS Hijack\"
1671- nft add rule inet fw4 nat_output position 0 meta nfproto {ipv6} udp dport 53 meta skuid ! = 65534 counter redirect to " $dns_port " comment \" OpenClash DNS Hijack\"
1672- nft add rule inet fw4 nat_output position 0 meta nfproto {ipv6} tcp dport 12353 meta skuid ! = 65534 counter redirect to " $DNSPORT " comment \" OpenClash DNS Hijack\"
1673- nft add rule inet fw4 nat_output position 0 meta nfproto {ipv6} udp dport 12353 meta skuid ! = 65534 counter redirect to " $DNSPORT " comment \" OpenClash DNS Hijack\"
1669+
1670+ if [ " $enable_redirect_dns " -eq 2 ]; then
1671+ local position=$( nft -a list chain inet fw4 openclash_dns_redirect | grep " DNS" | grep -v " redirect" | awk -F ' # handle ' ' {print$2}' | sort -rn | head -1)
1672+ [ -z " $position " ] && position=0
1673+ nft insert rule inet fw4 openclash_dns_redirect position " $position " meta nfproto {ipv6} tcp dport 53 counter accept comment \" OpenClash TCP DNS Hijack\"
1674+ elif [ " $enable_redirect_dns " -eq 1 ]; then
1675+ nft insert rule inet fw4 dstnat position 0 meta nfproto {ipv6} tcp dport 53 counter accept comment \" OpenClash TCP DNS Hijack\"
1676+ fi
1677+ if [ " $router_self_proxy " = 1 ]; then
1678+ nft insert rule inet fw4 nat_output position 0 skuid ! = 65534 meta nfproto {ipv6} tcp dport 53 counter accept comment \" OpenClash TCP DNS Hijack\"
16741679 fi
16751680
16761681 if [ " $china_ip6_route " != " 0" ] || [ " $disable_udp_quic " = " 1" ]; then
@@ -2378,6 +2383,9 @@ if [ -z "$FW4" ]; then
23782383 elif [ " $enable_redirect_dns " -eq 1 ]; then
23792384 iptables -t nat -I PREROUTING -m comment --comment " OpenClash TCP DNS Hijack" -p tcp --dport 53 -j ACCEPT
23802385 fi
2386+ if [ " $router_self_proxy " = 1 ]; then
2387+ iptables -t nat -I OUTPUT -m owner ! --uid-owner 65534 -m comment --comment " OpenClash TCP DNS Hijack" -p tcp --dport 53 -j ACCEPT
2388+ fi
23812389
23822390 # TUN FORWORD
23832391 iptables -I FORWARD -m comment --comment " OpenClash TUN Forward" -o utun -j ACCEPT > /dev/null 2>&1
@@ -2446,15 +2454,20 @@ if [ -z "$FW4" ]; then
24462454 fi
24472455 fi
24482456 fi
2449- if [ " $en_mode " = " fake-ip" ] && [ " $china_ip_route " != " 0" ] && [ " $enable_redirect_dns " != " 2" ]; then
2450- ip6tables -t nat -I PREROUTING -p udp --dport 53 -j REDIRECT --to-ports " $dns_port " -m comment --comment " OpenClash DNS Hijack"
2451- ip6tables -t nat -I PREROUTING -p tcp --dport 53 -j REDIRECT --to-ports " $dns_port " -m comment --comment " OpenClash DNS Hijack"
2452- ip6tables -t nat -I OUTPUT -p udp --dport 53 -m owner ! --uid-owner 65534 -j REDIRECT --to-ports " $dns_port " -m comment --comment " OpenClash DNS Hijack"
2453- ip6tables -t nat -I OUTPUT -p tcp --dport 53 -m owner ! --uid-owner 65534 -j REDIRECT --to-ports " $dns_port " -m comment --comment " OpenClash DNS Hijack"
2454- ip6tables -t nat -I OUTPUT -p udp --dport 12353 -m owner ! --uid-owner 65534 -j REDIRECT --to-ports " $DNSPORT " -m comment --comment " OpenClash DNS Hijack"
2455- ip6tables -t nat -I OUTPUT -p tcp --dport 12353 -m owner ! --uid-owner 65534 -j REDIRECT --to-ports " $DNSPORT " -m comment --comment " OpenClash DNS Hijack"
2456- fi
24572457
2458+ if [ " $ipv6_mode " -eq 2 ]; then
2459+ if [ " $enable_redirect_dns " -eq 2 ]; then
2460+ local position=$( ip6tables -nvL openclash_dns_redirect -t nat | grep " DNS" | grep -v " REDIRECT" | wc -l)
2461+ let position++
2462+ ip6tables -t nat -I openclash_dns_redirect " $position " -m comment --comment " OpenClash TCP DNS Hijack" -p tcp --dport 53 -j ACCEPT
2463+ elif [ " $enable_redirect_dns " -eq 1 ]; then
2464+ ip6tables -t nat -I PREROUTING -m comment --comment " OpenClash TCP DNS Hijack" -p tcp --dport 53 -j ACCEPT
2465+ fi
2466+ if [ " $router_self_proxy " = 1 ]; then
2467+ ip6tables -t nat -I OUTPUT -p tcp --dport 53 -d ::/0 -m owner ! --uid-owner 65534 -j ACCEPT -m comment --comment " OpenClash DNS Hijack"
2468+ fi
2469+ fi
2470+
24582471 if [ " $china_ip6_route " != " 0" ] || [ " $disable_udp_quic " = " 1" ]; then
24592472 ipset -! flush china_ip6_route
24602473 ipset -! restore < /etc/openclash/china_ip6_route.ipset
0 commit comments