Добрый день!
Пробую по такому же пути поднять следующую схему:
В гипервизоре две карты, виртуалка с Debian 12 является шлюзом всей сети.
И после запуска Sign-box интернет заканчивается на всех устройствах кроме Router.
Понимаю, что либо не доделал что-то в конфиге sign-box, либо в nftables.
Вот конфиг sing-box:
{
"log": {
"disabled": false,
"level": "debug",
"output": "/tmp/sing-box.log",
"timestamp": true
},
"dns": {
"strategy": "ipv4_only",
"servers": [
{
"tag": "google",
"address": "https://8.8.8.8/dns-query",
"detour": "direct"
},
{
"tag": "cloudflare",
"address": "https://1.1.1.1/dns-query",
"detour": "direct"
}
]
},
"inbounds": [
{
"type": "tun",
"interface_name": "tun0",
"domain_strategy": "ipv4_only",
"address": "172.16.250.1/30",
"auto_route": true,
"strict_route": false,
"auto_redirect": true,
"sniff": true,
"sniff_override_destination": true
}
],
"outbounds": [
{
"type": "direct",
"tag": "direct"
},
{
"domain_strategy": "",
"flow": "xtls-rprx-vision",
"packet_encoding": "",
"server": "server_ip",
"server_port": 443,
"tag": "proxy",
"tls": {
"enabled": true,
"reality": {
"enabled": true,
"public_key": "public_key",
"short_id": ""
},
"server_name": "server_name",
"utls": {
"enabled": true,
"fingerprint": "chrome"
}
},
"type": "vless",
"uuid": "uuid",
}
],
"route": {
"rules": [
{
"protocol": "dns",
"action": "hijack-dns"
},
{
"domain": [
"2ip.ru",
"2ip.io"
],
"domain_keyword": [],
"domain_regex": [],
"domain_suffix": [],
"geosite": [],
"outbound": "proxy"
},
{
"ip_is_private": true,
"outbound": "direct"
},
{
"rule_set": [
"antizapret"
],
"outbound": "proxy"
}
],
"rule_set": [
{
"tag": "antizapret",
"type": "remote",
"format": "binary",
"url": "https://cdn.jsdelivr.net/gh/runetfreedom/russia-v2ray-rules-dat@release/sing-box/rule-set-geosite/geosite-ru-blocked.srs",
"download_detour": "proxy",
"update_interval": "1d"
},
],
"final": "direct",
"auto_detect_interface": true
}
}
Вот вывод nft -a list ruleset после запуска sing-box.
table inet FILTER { # handle 33
chain FROM_WAN { # handle 1
ip saddr { 0.0.0.0/8, 10.0.0.0/8, 127.0.0.0/8, 169.254.0.0/16, 172.16.0.0/12, 192.0.0.0/24, 192.0.2.0/24, 192.168.0.0/16, 198.18.0.0/15, 198.51.100.0/24, 203.0.113.0/24, 224.0.0.0/3 } counter packets 0 bytes 0 drop # handle 6
counter packets 467 bytes 484950 drop # handle 7
}
chain FROM_LAN { # handle 2
tcp dport { 22, 53, 179, 2080, 3978, 12345 } counter packets 69 bytes 3588 accept # handle 9
udp dport { 53, 67, 161, 2080, 3978, 12345 } counter packets 865 bytes 65834 accept # handle 11
counter packets 32702 bytes 2358829 drop # handle 12
}
chain INPUT { # handle 3
type filter hook input priority filter; policy accept;
ct state established,related counter packets 50661 bytes 120505515 accept # handle 13
ct state invalid counter packets 277 bytes 13629 drop # handle 14
icmp type echo-request meta length 1529-65535 counter packets 0 bytes 0 drop # handle 15
ip protocol icmp limit rate 30/minute counter packets 0 bytes 0 accept # handle 16
iifname "lo" ip daddr != 127.0.0.0/8 counter packets 0 bytes 0 drop # handle 17
iifname "lo" counter packets 16 bytes 960 accept # handle 18
iifname "br0" counter packets 467 bytes 484950 jump FROM_WAN # handle 19
iifname "br1" counter packets 33636 bytes 2428251 jump FROM_LAN # handle 20
counter packets 43 bytes 2781 drop # handle 21
}
chain FORWARD { # handle 4
type filter hook forward priority filter; policy accept;
ct state established,related counter packets 691531 bytes 1040684086 accept # handle 22
ct state invalid counter packets 3244 bytes 413839 drop # handle 23
iifname { "lo", "br1" } counter packets 2481 bytes 337068 accept # handle 25
counter packets 0 bytes 0 drop # handle 26
}
}
table inet NAT { # handle 34
chain POSTROUTING { # handle 1
type nat hook postrouting priority filter; policy accept;
oifname "br0" masquerade # handle 2
}
}
table inet sing-box { # handle 35
set inet4_local_address_set { # handle 1
type ipv4_addr
flags interval
elements = { 10.0.1.0/24, 100.80.0.0/14,
127.0.0.0/8, 172.16.250.0/30 }
}
chain output { # handle 2
type nat hook output priority mangle; policy accept;
oifname "tun0" meta nfproto ipv4 meta l4proto tcp counter packets 0 bytes 0 redirect to :40635 return # handle 3
}
chain prerouting { # handle 4
type nat hook prerouting priority dstnat + 1; policy accept;
meta nfproto ipv4 meta l4proto { tcp, udp } th dport 53 dnat ip to 172.16.250.2 counter packets 0 bytes 0 # handle 6
ip daddr @inet4_local_address_set counter packets 334 bytes 305218 return # handle 7
meta nfproto ipv4 meta l4proto tcp counter packets 181 bytes 96235 redirect to :40635 return # handle 8
meta mark set 0x00002023 ct mark set meta mark counter packets 3 bytes 1917 # handle 9
}
}
ЧЯДНТ? Или если есть готовый конфиг или ссылка на настройку - буду премного благодарен.
Пытался сделать и через Xray, чтобы удобно роутить через x-ui, но потерпел фиаско с тем, что при попытке изменения конфига через JSON получал постоянные 500 и 502 после попытки перезапуска Xray из x-ui.
