[{"data":1,"prerenderedAt":598},["ShallowReactive",2],{"content:\u002Ffiddling\u002Fdebian-as-bypass-router":3,"surround:\u002Ffiddling\u002Fdebian-as-bypass-router":589},{"id":4,"title":5,"body":6,"categories":562,"date":564,"description":565,"draft":566,"extension":567,"image":568,"meta":569,"navigation":571,"path":572,"permalink":568,"published":568,"readingTime":573,"recommend":568,"references":568,"seo":578,"sitemap":579,"stem":580,"tags":581,"type":587,"__hash__":588},"content\u002Fposts\u002Ffiddling\u002Fdebian-as-bypass-router.md","debian 旁路由方案",{"type":7,"value":8,"toc":539},"minimark",[9,13,17,33,36,39,46,49,52,55,58,61,64,70,73,79,82,86,89,94,102,112,115,147,150,158,165,170,176,179,182,185,191,195,198,204,207,210,214,217,223,226,232,238,248,256,263,269,272,278,281,288,295,301,304,307,310,316,320,323,327,330,336,339,344,350,353,359,370,376,379,382,385,393,399,402,406,412,420,423,431,434,448,451,455,458,464,470,476,479,485,488,494,497,503,509,512,518,524,527,530],[10,11,12],"h3",{"id":12},"前言",[14,15,16],"p",{},"大部分旁路由方案都是基于 OpenWRT 搭建 —— 这是一个单独的 Linux 发行版，拥有自己的软件包系统。再其中大部分方案又是基于 LuCI —— 专用于 OpenWRT 的 Web GUI，教程中使用的软件也是 luci-app-xxx，专为 LuCI 打造。这些方案很好，但不够好：",[18,19,20,24,27,30],"ol",{},[21,22,23],"li",{},"过于依赖 GUI 配置：LuCI 的软件包通常在 web 端只能进行有限的配置",[21,25,26],{},"LuCI 不够稳定：不是 OpenWRT 不稳定，而是 LuCI 不稳定。我的 LuCI 曾因为 OpenClash 崩溃过三次（也可能是我的问题）",[21,28,29],{},"尽管我们可以自编译 OpenWRT，但是大部分教程都直接使用了一些预编译好的固件，有些可能会过时",[21,31,32],{},"无法完全掌控系统（被 LuCI 架空啦",[14,34,35],{},"我也曾经折腾过一两年的 OpenWRT 透明代理方案，主路由方案旁路由方案，最终都因为其不够稳定而放弃。很长一段时间都直接使用各种客户端（Surge、loon、clash verge rev 等）勉强用着。大概一周前，绝区零上线。由于国服版号问题，PS5 仅上线了国际服。即使选择亚服，勉强可以直连，网速和延迟也让人绝望。本着不给网易 UU 送钱的态度，我又想起了透明代理。正好，我手头有一台闲置的零刻小主机。预先装好了 Debian，本来打算用来做开发机来着，结果因为我太懒，也一直吃灰。于是折腾了一个周末，最终完成了使用 Debian 作为旁路由进行透明代理的方案。",[14,37,38],{},"最终形态的网络拓扑如下：",[14,40,41],{},[42,43],"img",{"alt":44,"src":45},"topo","https:\u002F\u002Fblog-img.774352199.xyz\u002F2025\u002Fc4347103c787f3d28b50a679e80aa0fe.png",[14,47,48],{},"可以看到，整个内网被划分成了两个网段：192.168.6.0\u002F24，192.168.7.0\u002F24。其中 6.0\u002F24 为默认网段，用于无需越墙的设备，而 7.0\u002F24 为需要越墙的设备，其流量都会经过旁路由小主机转发。",[14,50,51],{},"主要方案为 AdguardHome + Clash，其中 AdguardHome 用于广告过滤等功能，Clash 用于 DNS 分流和流量代理。",[10,53,54],{"id":54},"主路由配置",[14,56,57],{},"在配置之前，内网 IP 段为 192.168.6.0\u002F24，我们需要新开一个网段 192.168.7.0\u002F24",[14,59,60],{},"我的主路由是 iKuai，下面是 iKuai 新开网段的方法，OpenWRT 或者其他路由系统可以自行 Google",[14,62,63],{},"iKuai 下网络设置 - 内外网设置 - lan1，高级设置中添加一个扩展 IP，IP 为 192.168.7.1，子网掩码 255.255.255.0",[14,65,66],{},[42,67],{"alt":68,"src":69},"iKuai 配置","https:\u002F\u002Fblog-img.774352199.xyz\u002F2025\u002F9fc87b145274f1fb0cba1ed0d2329ac0.png",[14,71,72],{},"DHCP 设置中添加一个 192.168.7.0\u002F24 网段的 DHCP 配置",[14,74,75],{},[42,76],{"alt":77,"src":78},"DHCP 配置","https:\u002F\u002Fblog-img.774352199.xyz\u002F2025\u002F2de91498b256d08c92a3c8844ca14dbe.png",[14,80,81],{},"网关设置为 192.168.7.2，即后面要配置的旁路由的地址，首选 DNS 和备选 DNS 也都设置为 192.168.7.2，因为该网段下的 DNS 都由旁路由处理。",[10,83,85],{"id":84},"debian-配置","Debian 配置",[14,87,88],{},"以下操作如果不做说明，都是在旁路由机器上进行。",[90,91,93],"h4",{"id":92},"配置-ip","配置 IP",[14,95,96,97,101],{},"编辑 Debian 的网络配置：输入 ",[98,99,100],"code",{"code":100},"sudo nano \u002Fetc\u002Fnetwork\u002Finterfaces","，编辑为以下内容，并保存退出：",[103,104,109],"pre",{"className":105,"code":107,"language":108},[106],"language-text","# This file describes the network interfaces available on your system\n# and how to activate them. For more information, see interfaces(5).\n\nsource \u002Fetc\u002Fnetwork\u002Finterfaces.d\u002F*\n\n# The loopback network interface\nauto lo\niface lo inet loopback\n\n# The primary network interface\nallow-hotplug enp1s0\niface enp1s0 inet static\naddress 192.168.7.2\nnetmask 255.255.255.0\ngateway 192.168.7.1\ndns-nameservers 127.0.0.1\n","text",[98,110,107],{"__ignoreMap":111},"",[14,113,114],{},"该配置中：",[116,117,118,128],"ul",{},[21,119,120,123,124,127],{},[98,121,122],{"code":122},"enp1s0"," 是我的网卡设备名，请将其改为你自己的设备名，可以通过 ",[98,125,126],{"code":126},"ip a"," 查看",[21,129,130,131,134,135,138,139,142,143,146],{},"IPV4 网络进行静态配置 ",[98,132,133],{"code":133},"inet static","，并固定设备 IP 为 ",[98,136,137],{"code":137},"192.168.7.2\u002F24","，网关指向主路由 ",[98,140,141],{"code":141},"192.168.7.1","，DNS 在配置完成前可以先设置为可用的 DNS Server，等待本机上的 AdguardHome 配置完成后再改为 ",[98,144,145],{"code":145},"127.0.0.1","，以防在配置过程中无法上网",[14,148,149],{},"保存配置后可以通过如下命令重启网络",[103,151,156],{"className":152,"code":154,"language":155,"meta":111},[153],"language-shell","sudo systemctl restart networking.service\n","shell",[98,157,154],{"__ignoreMap":111},[14,159,160,161,164],{},"注意这个时候 SSH 连接可能会断开，因为设备 IP 已经改变了。应当通过新的 IP ",[98,162,163],{"code":163},"192.168.7.2"," 重新 SSH 登陆。",[14,166,167,169],{},[98,168,126],{"code":126}," 查看配置结果：",[103,171,174],{"className":172,"code":173,"language":155,"meta":111},[153],"ip a\n1: lo: \u003CLOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000\n    link\u002Floopback 00:00:00:00:00:00 brd 00:00:00:00:00:00\n    inet 127.0.0.1\u002F8 scope host lo\n       valid_lft forever preferred_lft forever\n    inet6 ::1\u002F128 scope host noprefixroute\n       valid_lft forever preferred_lft forever\n2: enp1s0: \u003CBROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000\n    link\u002Fether 70:70:fc:00:e3:36 brd ff:ff:ff:ff:ff:ff\n    inet 192.168.7.2\u002F24 brd 192.168.7.255 scope global enp1s0\n       valid_lft forever preferred_lft forever\n    inet6 ■■■:■■■■:■■■■:■■■:■■■■:■■■■\u002F64 scope global dynamic mngtmpaddr\n       valid_lft 1741sec preferred_lft 1741sec\n    inet6 fe80::7270:fcff:fe00:e336\u002F64 scope link\n       valid_lft forever preferred_lft forever\n",[98,175,173],{"__ignoreMap":111},[14,177,178],{},"可以看到本机的内网 IP 已经变成了 192.168.7.2\u002F24",[90,180,181],{"id":181},"配置转发",[14,183,184],{},"只有拥有流量转发功能的机器才可以作为路由和网关：",[103,186,189],{"className":187,"code":188,"language":155,"meta":111},[153],"sudo echo \"net.ipv4.ip_forward = 1\" >> \u002Fetc\u002Fsysctl.conf\nsudo sysctl -p\n",[98,190,188],{"__ignoreMap":111},[10,192,194],{"id":193},"adguardhome-配置","AdguardHome 配置",[14,196,197],{},"以下说明下 DNS 思路",[14,199,200],{},[42,201],{"alt":202,"src":203},"DNS 链路","https:\u002F\u002Fblog-img.774352199.xyz\u002F2025\u002Fbb62d86943fdce26364eea909c4621a9.png",[14,205,206],{},"当客户端需要解析 DNS 时，监听在 53 端口上的 AdguardHome 会转发给其上游 Clash，然后 Clash 根据设置来进行分流，中国大陆部分使用国内的公共 DNS 服务器进行解析，非中国大陆部分通过代理向国外公共 DNS 服务器进行解析",[14,208,209],{},"而当 Clash 出现异常时，AdguardHome 则直接向国内公共 DNS 服务器请求解析（实际上意义不大，即使解析出来的 IP，流量还是要通过 Clash）",[90,211,213],{"id":212},"安装-adguardhome","安装 AdguardHome",[14,215,216],{},"以下命令以 root 身份运行",[103,218,221],{"className":219,"code":220,"language":155,"meta":111},[153],"## 检查最新稳定版的版本号，如果获取不到请检查网络\nremote_ver=$(curl -sS https:\u002F\u002Fapi.github.com\u002Frepos\u002FAdguardTeam\u002FAdGuardHome\u002Freleases\u002Flatest | jq -r .tag_name | sed 's|v||' | grep -v \"null\"); echo $remote_ver\n\n## 下载最新稳定版（前一句有输出这一句才能正常执行）\ncd \u002Ftmp\nwget -q --progress=bar:dot --show-progress -O \"AdGuardHome_linux_amd64.tar.gz\" \"https:\u002F\u002Fgithub.com\u002FAdguardTeam\u002FAdGuardHome\u002Freleases\u002Fdownload\u002Fv${remote_ver}\u002FAdGuardHome_linux_amd64.tar.gz\"\n\n## 解压\ntar --no-same-owner -xf \"AdGuardHome_linux_amd64.tar.gz\" --strip-components 2 --directory=.\n\n## 安装\ninstall -ps AdGuardHome \u002Fusr\u002Flocal\u002Fbin\u002Fadguardhome\n",[98,222,220],{"__ignoreMap":111},[90,224,225],{"id":225},"创建服务",[14,227,228,229],{},"创建工作目录 ",[98,230,231],{"code":231},"\u002Fvar\u002Flib\u002Fadguardhome",[103,233,236],{"className":234,"code":235,"language":155,"meta":111},[153],"mkdir -p \u002Fvar\u002Flib\u002Fadguardhome\n",[98,237,235],{"__ignoreMap":111},[14,239,240,241,244,245],{},"创建 ",[98,242,243],{"code":243},"\u002Fetc\u002Fsystemd\u002Fsystem\u002Fadguardhome.service"," 如下，这时配置文件为 ",[98,246,247],{"code":247},"\u002Fvar\u002Flib\u002Fadguardhome\u002FAdGuardHome.yaml",[103,249,254],{"className":250,"code":252,"language":253,"meta":111},[251],"language-ini","[Unit]\nDescription = Network-wide ads & trackers blocking DNS server.\nWants       = network-online.target mosdns.service\nAfter       = network-online.target mosdns.service\n\n[Service]\nType               = simple\nRestart            = always\nStartLimitInterval = 5\nStartLimitBurst    = 10\nExecStart          = \u002Fusr\u002Flocal\u002Fbin\u002Fadguardhome -w \u002Fvar\u002Flib\u002Fadguardhome\nRestartSec         = 10\n\n[Install]\nWantedBy = multi-user.target\n","ini",[98,255,252],{"__ignoreMap":111},[14,257,258,259,262],{},"保存后通过 ",[98,260,261],{"code":261},"systemctl enable --now adguardhome.service"," 设置开机启动并立刻启动。后续如想查看日志，我们直接使用 Debian 自带的工具来查看：",[103,264,267],{"className":265,"code":266,"language":155,"meta":111},[153],"journalctl -efu adguardhome.service\n",[98,268,266],{"__ignoreMap":111},[14,270,271],{},"如果想要重启：",[103,273,276],{"className":274,"code":275,"language":155,"meta":111},[153],"systemctl restart adguardhome.service\n",[98,277,275],{"__ignoreMap":111},[90,279,280],{"id":280},"初始化配置",[14,282,283,284,287],{},"打开 ",[98,285,286],{"code":286},"http:\u002F\u002F192.168.7.2:3000"," 进行初始化配置，网络管理界面端口可以保持 3000，DNS 服务器端口设置为 53",[14,289,290,291,294],{},"设置 - DNS 设置中，上游 DNS 设置为我们暂未配置的 Clash DNS ",[98,292,293],{"code":293},"127.0.0.1:1053","，后备 DNS 服务器可以填写几个国内的 DNS，如",[103,296,299],{"className":297,"code":298,"language":108},[106],"223.5.5.5\n119.29.29.29\n",[98,300,298],{"__ignoreMap":111},[14,302,303],{},"记得点击应用",[14,305,306],{},"随后 DNS 服务配置 - 速度限制 设置为 0 即可。",[14,308,309],{},"如果需要去广告的话，可以在 过滤器 - DNS 黑名单 中添加，这里推荐两个大陆使用效果较好的规则集：",[103,311,314],{"className":312,"code":313,"language":108},[106],"easylist:  https:\u002F\u002Fanti-ad.net\u002Feasylist.txt\nhalf-life: https:\u002F\u002Fadguard.yojigen.tech\u002FHalfLifeList.txt\n",[98,315,313],{"__ignoreMap":111},[10,317,319],{"id":318},"clash-配置","Clash 配置",[14,321,322],{},"Clash 在整个方案中负责国内外 DNS 解析分流，另外就是老本行穿墙了。由于 Clash 原仓库已删库跑路，衣钵由 mihomo 集成（米哈游你坏事做尽）",[90,324,326],{"id":325},"安装-clash","安装 Clash",[14,328,329],{},"以下命令以 root 身份运行：",[103,331,334],{"className":332,"code":333,"language":155,"meta":111},[153],"## 检查最新稳定版的版本号，如果获取不到请检查网络\nremote_ver=$(curl -sS https:\u002F\u002Fapi.github.com\u002Frepos\u002FMetaCubeX\u002Fmihomo\u002Freleases\u002Flatest | jq -r .tag_name | sed 's|v||' | grep -v \"null\"); echo $remote_ver\n\n## 下载最新稳定版（前一句有输出这一句才能正常执行）\ncd \u002Ftmp\nwget -q --progress=bar:dot --show-progress -O \"mihomo-linux-amd64-v${remote_ver}.gz\" \"https:\u002F\u002Fgithub.com\u002FMetaCubeX\u002Fmihomo\u002Freleases\u002Fdownload\u002Fv${remote_ver}\u002Fmihomo-linux-amd64-v${remote_ver}.gz\"\n\n## 解压\ngzip -d \"mihomo-linux-amd64-v${remote_ver}.gz\"\n\n## 安装\ninstall -ps mihomo-linux-amd64-v${remote_ver} \u002Fusr\u002Flocal\u002Fbin\u002Fclash\n",[98,335,333],{"__ignoreMap":111},[90,337,225],{"id":338},"创建服务-1",[14,340,228,341],{},[98,342,343],{"code":343},"\u002Fvar\u002Flib\u002Fclash",[103,345,348],{"className":346,"code":347,"language":155,"meta":111},[153],"mkdir -p \u002Fvar\u002Flib\u002Fclash\n",[98,349,347],{"__ignoreMap":111},[14,351,352],{},"创建用户 clash",[103,354,357],{"className":355,"code":356,"language":155,"meta":111},[153],"useradd -M -s \u002Fusr\u002Fsbin\u002Fnologin clash\n",[98,358,356],{"__ignoreMap":111},[14,360,361,362,365,366,369],{},"创建文件 ",[98,363,364],{"code":364},"\u002Fetc\u002Fsystemd\u002Fsystem\u002Fclash.service","，内容如下。这时 clash 的配置文件为 ",[98,367,368],{"code":368},"\u002Fvar\u002Flib\u002Fclash\u002Fconfig.yaml","。",[103,371,374],{"className":372,"code":373,"language":253,"meta":111},[251],"[Unit]\nDescription = Clash-Meta tproxy daemon.\nWants       = network-online.target\nAfter       = network-online.target\n\n[Service]\nEnvironment   = PATH=\u002Fusr\u002Flocal\u002Fsbin:\u002Fusr\u002Flocal\u002Fbin:\u002Fusr\u002Fsbin:\u002Fusr\u002Fbin:\u002Fsbin:\u002Fb>\nType          = simple\nUser          = clash\nGroup         = clash\n\nCapabilityBoundingSet = CAP_NET_ADMIN CAP_NET_BIND_SERVICE CAP_NET_RAW\nAmbientCapabilities   = CAP_NET_ADMIN CAP_NET_BIND_SERVICE CAP_NET_RAW\n\nRestart       = always\nExecStartPre  = +\u002Fusr\u002Fbin\u002Fbash \u002Fvar\u002Flib\u002Fclash\u002Fclean.sh\nExecStart     = clash -d \u002Fvar\u002Flib\u002Fclash\nExecStartPost = +\u002Fusr\u002Fbin\u002Fbash \u002Fvar\u002Flib\u002Fclash\u002Fiptables.sh\n\nExecStopPost  = +\u002Fusr\u002Fbin\u002Fbash \u002Fvar\u002Flib\u002Fclash\u002Fclean.sh\n",[98,375,373],{"__ignoreMap":111},[14,377,378],{},"可以从这个文件中看到，clash 二进制文件是以 clash:clash 用户身份运行的，这是为了方便区分 clash 自身程序发出来的流量，和 clash 转发的流量。",[14,380,381],{},"注意到 ExecStartPost 和 ExecStopPost 阶段我们执行了两个文件 iptables.sh 和 clean.sh，用来设置和清空路由表。",[14,383,384],{},"iptables.sh 和 clean.sh 内容如下：",[103,386,391],{"className":387,"code":389,"language":390,"meta":111},[388],"language-sh","#!\u002Fusr\u002Fbin\u002Fenv bash\n\nset -ex\n\n# ENABLE ipv4 forward\nsysctl -w net.ipv4.ip_forward=1\n\n# ROUTE RULES\nip rule add fwmark 666 lookup 666\nip route add local 0.0.0.0\u002F0 dev lo table 666\n\n# clash 链负责处理转发流量\niptables -t mangle -N clash\n\n# 目标地址为局域网或保留地址的流量跳过处理\n# 保留地址参考：https:\u002F\u002Fzh.wikipedia.org\u002Fwiki\u002F%E5%B7%B2%E5%88%86%E9%85%8D%E7%9A%84\u002F8_IPv4%E5%9C%B0%E5%9D%80%E5%9D%97%E5%88%97%E8%A1%A8\niptables -t mangle -A clash -d 0.0.0.0\u002F8 -j RETURN\niptables -t mangle -A clash -d 127.0.0.0\u002F8 -j RETURN\niptables -t mangle -A clash -d 10.0.0.0\u002F8 -j RETURN\niptables -t mangle -A clash -d 172.16.0.0\u002F12 -j RETURN\niptables -t mangle -A clash -d 192.168.0.0\u002F16 -j RETURN\niptables -t mangle -A clash -d 169.254.0.0\u002F16 -j RETURN\n\niptables -t mangle -A clash -d 224.0.0.0\u002F4 -j RETURN\niptables -t mangle -A clash -d 240.0.0.0\u002F4 -j RETURN\n\n# 其他所有流量转向到 7893 端口，并打上 mark\niptables -t mangle -A clash -p tcp -j TPROXY --on-port 7893 --tproxy-mark 666\niptables -t mangle -A clash -p udp -j TPROXY --on-port 7893 --tproxy-mark 666\n\n# 最后让所有流量通过 clash 链进行处理\niptables -t mangle -A PREROUTING -j clash\n\n# clash_local 链负责处理网关本身发出的流量\niptables -t mangle -N clash_local\n\n# 跳过内网流量\niptables -t mangle -A clash_local -d 0.0.0.0\u002F8 -j RETURN\niptables -t mangle -A clash_local -d 127.0.0.0\u002F8 -j RETURN\niptables -t mangle -A clash_local -d 10.0.0.0\u002F8 -j RETURN\niptables -t mangle -A clash_local -d 172.16.0.0\u002F12 -j RETURN\niptables -t mangle -A clash_local -d 192.168.0.0\u002F16 -j RETURN\niptables -t mangle -A clash_local -d 169.254.0.0\u002F16 -j RETURN\n\niptables -t mangle -A clash_local -d 224.0.0.0\u002F4 -j RETURN\niptables -t mangle -A clash_local -d 240.0.0.0\u002F4 -j RETURN\n\n# 为本机发出的流量打 mark\niptables -t mangle -A clash_local -p tcp -j MARK --set-mark 666\niptables -t mangle -A clash_local -p udp -j MARK --set-mark 666\n\n# 跳过 clash 程序本身发出的流量，防止死循环 (clash 程序需要使用 \"clash\" 用户启动)\niptables -t mangle -A OUTPUT -p tcp -m owner --uid-owner clash -j RETURN\niptables -t mangle -A OUTPUT -p udp -m owner --uid-owner clash -j RETURN\n\n# 让本机发出的流量跳转到 clash_local\n# clash_local 链会为本机流量打 mark, 打过 mark 的流量会重新回到 PREROUTING 上\niptables -t mangle -A OUTPUT -j clash_local\n\n# 修复 ICMP(ping)\n# 这并不能保证 ping 结果有效 (clash 等不支持转发 ICMP), 只是让它有返回结果而已\n# --to-destination 设置为一个可达的地址即可\nsysctl -w net.ipv4.conf.all.route_localnet=1\niptables -t nat -A PREROUTING -p icmp -d 198.18.0.0\u002F16 -j DNAT --to-destination 127.0.0.1\n","sh",[98,392,389],{"__ignoreMap":111},[103,394,397],{"className":395,"code":396,"language":390,"meta":111},[388],"#!\u002Fusr\u002Fbin\u002Fenv bash\n\nset -ex\n\nip rule del fwmark 666 table 666 || true\nip route del local 0.0.0.0\u002F0 dev lo table 666 || true\n\niptables -t nat -F\niptables -t nat -X\niptables -t mangle -F\niptables -t mangle -X clash || true\niptables -t mangle -X clash_local || true\n",[98,398,396],{"__ignoreMap":111},[14,400,401],{},"每行都有详细的注释，再细节可以去问 ChatGPT",[90,403,405],{"id":404},"clash-配置文件","clash 配置文件",[14,407,408,409,411],{},"clash 配置文件可以从各订阅商处获得，格式应当是 yaml。将其保存到 ",[98,410,368],{"code":368},"，并将其按照如下模块更改：",[103,413,418],{"className":414,"code":416,"language":417,"meta":111},[415],"language-yaml","tproxy-port: 7893   # iptables.sh 将所有流量转发到了 7893 端口\nmixed-port: 7890\nallow-lan: true\nfind-process-mode: off\nbind-address: \"*\"\nmode: rule\nlog-level: debug\nipv6: false # 不进行 IPv6 流量代理\n\nexternal-controller: 0.0.0.0:9090\nsecret: # 登陆 ui 的密码\nexternal-ui: ui # webui 的基础路径\nexternal-ui-name: xd # webui 的下级路径\nexternal-ui-url: https:\u002F\u002Fgithub.com\u002FMetaCubeX\u002Fmetacubexd\u002Farchive\u002Frefs\u002Fheads\u002Fgh-pages.zip\nunified-delay: true\ntcp-concurrent: true\nexperimental:\n  sniff-tls-sni: true\ngeodata-mode: true\ngeodata-loader: standard\ngeox-url:\n  geoip: https:\u002F\u002Ftestingcf.jsdelivr.net\u002Fgh\u002FMetaCubeX\u002Fmeta-rules-dat@release\u002Fgeoip.dat\n  geosite: https:\u002F\u002Ftestingcf.jsdelivr.net\u002Fgh\u002FMetaCubeX\u002Fmeta-rules-dat@release\u002Fgeosite.dat\n  mmdb: https:\u002F\u002Ftestingcf.jsdelivr.net\u002Fgh\u002FMetaCubeX\u002Fmeta-rules-dat@release\u002Fcountry.mmdb\nprofile:\n  tracing: true\n  store-selected: true\n  store-fake-ip: true\nsniffer:\n  enable: true\n  parse-pure-ip: true\n  override-destination: true\n\ndns:\n  enable: true\n  ipv6: false\n  listen: 0.0.0.0:1053 # DNS 监听端口\n  use-hosts: true\n  enhanced-mode: fake-ip\n  default-nameserver: # 建议修改为国内 DNS 服务器\n    - 223.5.5.5\n    - 119.29.29.29\n  nameserver:\n    - https:\u002F\u002Fdoh.pub\u002Fdns-query\n    - tls:\u002F\u002Fdot.pub\n    - tls:\u002F\u002Fdns.alidns.com\n    - https:\u002F\u002Fdns.alidns.com\u002Fdns-query\n  fallback:\n    - https:\u002F\u002Fdns.cloudflare.com\u002Fdns-query\n    - tls:\u002F\u002Fdns.google:853\n    - https:\u002F\u002F1.1.1.1\u002Fdns-query\n    - tls:\u002F\u002F1.1.1.1:853\n    - tls:\u002F\u002F8.8.8.8:853\n  fake-ip-filter:\n    - '+.lan'\n    - '+.cluster.local'\n    - 'time.*.com'\n    - 'time.*.gov'\n    - 'time.*.edu.cn'\n    - 'time.*.apple.com'\n    - 'ntp.*.com'\n    - 'localhost.ptlogin2.qq.com'\n    - '+.ntp.org.cn'\n    - '+.pool.ntp.org'\n    - '+.localhost'\n  fallback-filter:\n    geoip: true\n    geoip-code: CN\n    geosite:\n      - gfw\n    ipcidr:\n      - 224.0.0.0\u002F4\n      - 240.0.0.0\u002F4\n      - 169.254.0.0\u002F16\n      - 0.0.0.0\u002F8\n      - 127.0.0.1\u002F32\n    domain:\n      - '+.google.com'\n      - '+.facebook.com'\n      - '+.youtube.com'\n\nproxies:  # 以下为你的代理节点、分组及代理规则\nproxy-groups:\nrules:\n","yaml",[98,419,416],{"__ignoreMap":111},[14,421,422],{},"这里着重说一下 dns 部分，dns 分成了两个 dns server 组：",[116,424,425,428],{},[21,426,427],{},"nameserver 部分为国内的公共 DNS",[21,429,430],{},"fallback 部分为国外的公共 DNS",[14,432,433],{},"fallback-filter 控制了当域名满足什么条件时，使用 fallback 组的 DNS 解析结果",[116,435,436,439,442,445],{},[21,437,438],{},"geoip-code 为反向条件，即通过 nameserver 解析出的 IP 未命中 geoip-code 则会使用 fallback 的解析结果",[21,440,441],{},"geosite 为正向条件，匹配 geosite 中的域名会使用 fallback",[21,443,444],{},"ipcidr 为正向条件，nameserver 解析出这些结果时（即污染 IP）则会使用 fallback 的解析结果",[21,446,447],{},"domain 为正向条件，匹配到这些域名则会直接使用 fallback",[14,449,450],{},"由此即完成了 DNS 解析的分流。",[90,452,454],{"id":453},"clash-的其他相关文件","clash 的其他相关文件",[14,456,457],{},"clash 还需要一些配套文件，在启动前需要先下载下来",[103,459,462],{"className":460,"code":461,"language":155,"meta":111},[153],"cd \u002Fvar\u002Flib\u002Fclash\nwget -q --progress=bar:dot --show-progress -O country.mmdb https:\u002F\u002Fgithub.com\u002FMetaCubeX\u002Fmeta-rules-dat\u002Freleases\u002Fdownload\u002Flatest\u002Fcountry.mmdb\nwget -q --progress=bar:dot --show-progress -O geosite.dat  https:\u002F\u002Fgithub.com\u002FMetaCubeX\u002Fmeta-rules-dat\u002Freleases\u002Fdownload\u002Flatest\u002Fgeosite.dat\nwget -q --progress=bar:dot --show-progress -O GeoIP.dat    https:\u002F\u002Fgithub.com\u002FMetaCubeX\u002Fmeta-rules-dat\u002Freleases\u002Fdownload\u002Flatest\u002Fgeoip.dat\n\nmkdir -p ui\ncd ui\nwget -q --progress=bar:dot --show-progress -O xd.zip https:\u002F\u002Fgithub.com\u002FMetaCubeX\u002Fmetacubexd\u002Farchive\u002Frefs\u002Fheads\u002Fgh-pages.zip\nunzip -oqq xd.zip\nmv metacubexd-gh-pages xd\n",[98,463,461],{"__ignoreMap":111},[14,465,466,467,469],{},"最终 ",[98,468,343],{"code":343}," 目录下应当是这样的",[103,471,474],{"className":472,"code":473,"language":155,"meta":111},[153],"\u002Fvar\u002Flib\u002Fclash\n├── clean.sh\n├── config.yaml\n├── country.mmdb\n├── GeoIP.dat\n├── geosite.dat\n├── iptables.sh\n└── ui\n",[98,475,473],{"__ignoreMap":111},[14,477,478],{},"由于 clash 程序以 clash 用户身份启动，所以需要更改下所有权：",[103,480,483],{"className":481,"code":482,"language":155,"meta":111},[153],"chown -R clash:clash \u002Fvar\u002Flib\u002Fclash\n",[98,484,482],{"__ignoreMap":111},[14,486,487],{},"并设置 iptables.sh 和 clean.sh 可执行",[103,489,492],{"className":490,"code":491,"language":155,"meta":111},[153],"chmod +x iptables.sh\nchmod +x clean.sh\n",[98,493,491],{"__ignoreMap":111},[90,495,496],{"id":496},"服务启动",[14,498,499,500,502],{},"完全配置好以后，我们可以设置 ",[98,501,364],{"code":364}," 为开启自动启动，并立即启动起来。",[103,504,507],{"className":505,"code":506,"language":155,"meta":111},[153],"systemctl enable --now clash.service\n",[98,508,506],{"__ignoreMap":111},[14,510,511],{},"后续如想查看日志，我们直接使用 Debian 自带的工具来查看：",[103,513,516],{"className":514,"code":515,"language":155,"meta":111},[153],"journalctl -efu clash.service\n",[98,517,515],{"__ignoreMap":111},[14,519,520,521],{},"访问 webui：",[98,522,523],{"code":523},"http:\u002F\u002F192.168.7.2:9090\u002Fui\u002Fxd",[14,525,526],{},"webui 的配置大家就很熟悉了。如果配置完成没啥问题，就可以将本机的 dns 改为 127.0.0.1 了（上文提到），并将内网设备的网关和 DNS 都指向 192.168.7.2",[10,528,529],{"id":529},"端口映射",[14,531,532,533,538],{},"如果你在主路由上配置了端口映射，且被映射端口的机器网关配置的是旁路由，那此时端口映射应当是失效了。可以在 ",[534,535,537],"a",{"href":536},"\u002Ffiddling\u002Ffix-port-forward-in-bypass-router","旁路由端口映射失效解决"," 这篇文章中找到解决方案。",{"title":111,"searchDepth":540,"depth":540,"links":541},4,[542,544,545,549,554,561],{"id":12,"depth":543,"text":12},3,{"id":54,"depth":543,"text":54},{"id":84,"depth":543,"text":85,"children":546},[547,548],{"id":92,"depth":540,"text":93},{"id":181,"depth":540,"text":181},{"id":193,"depth":543,"text":194,"children":550},[551,552,553],{"id":212,"depth":540,"text":213},{"id":225,"depth":540,"text":225},{"id":280,"depth":540,"text":280},{"id":318,"depth":543,"text":319,"children":555},[556,557,558,559,560],{"id":325,"depth":540,"text":326},{"id":338,"depth":540,"text":225},{"id":404,"depth":540,"text":405},{"id":453,"depth":540,"text":454},{"id":496,"depth":540,"text":496},{"id":529,"depth":543,"text":529},[563],"折腾","2024-07-13 17:49:00","Debian 旁路由方案为用户提供了一种更为稳定和灵活的选择，摆脱了对 OpenWRT 和 LuCI 的依赖。通过直接在 Debian 上进行配置，用户可以享受更高的系统控制权，避免了 GUI 带来的种种限制和不稳定性。相比于常见的旁路由方案，Debian 的方法使得透明代理的设置更加可靠，为那些追求性能和效率的用户提供了新的可能性。",false,"md",null,{"slots":570},{},true,"\u002Ffiddling\u002Fdebian-as-bypass-router",{"text":574,"minutes":575,"time":576,"words":577},"17 min read",16.17,970200,3234,{"title":5,"description":565},{"loc":572},"posts\u002Ffiddling\u002Fdebian-as-bypass-router",[563,582,583,584,585,586],"debian","旁路由","翻墙","透明代理","mihomo","tech","fQfq_WSCtFBtoVtSQ_AQkedX5wzdrPf1az_t8F8BGg4",[590,595],{"title":591,"path":592,"stem":593,"date":594,"type":587,"children":-1},"GFW 原理考","\u002Ffiddling\u002Ftech-about-gfw","posts\u002Ffiddling\u002Ftech-about-gfw","2024-06-23 15:31:32",{"title":537,"path":536,"stem":596,"date":597,"type":587,"children":-1},"posts\u002Ffiddling\u002Ffix-port-forward-in-bypass-router","2024-08-15 23:50:00",1787554444726]