本帖最后由 Ryo_ 于 2022-8-18 00:26 编辑
博客最近没更新,其实已经换成BGP来做了,不过区别不大,而且ospf收敛速度还更快
我用BGP主要是不用和组播那些麻烦的东西打交道,防火墙规则可以简单一些(ospf的点对点模式应该也差不多)
现在这个配法没有mangle,也就是可以享受完整的硬件加速
bridge lan删掉ether5,这个口单独连跑BGP(或者ospf)的第二个路由,然后给划上网段配上ip,做通/隔离靠路由
![PIZ{FP5DNLK(9]{~Y(QD0]4.png](https://static.chiphell.com/forum/202208/18/002212v283o8vry3088tm0.png "PIZ{FP5DNLK(9]{~Y(QD0]4.png")
bird的配置和博客里的区别只有换成BGP,原来的ospf去掉,如果嫌BGP收敛慢可以自己调整超时之类的小参
- protocol bgp {
- local as 65531;
- neighbor 192.168.255.1 as 65530;
- source address 192.168.255.254;
- ipv4 {
- import none;
- export all;
- };
- }
去掉了smartdns,直接用clash来跑,然后在线检查的脚本稍微调整了一下,带有重试次数和停止icmp响应(用于触发ros在线检查切换dns的那个脚本)
- #!/usr/bin/bash
- COUNT=0
- MAX_COUNT=3
- while [ $COUNT -lt $MAX_COUNT ]
- do
- SER=0
- NET=0
- if [ $(curl --connect-timeout 5 --interface utun -w "%{http_code}" -s https://www.google.com/generate_204) -eq 204 ];then
- NET=1
- fi
- if /etc/init.d/bird status|grep Active|grep -q running;then
- SER=1
- fi
- if [ $NET -eq 1 ] && [ $SER -eq 0 ];then
- /etc/init.d/bird start
- echo 0 >/proc/sys/net/ipv4/icmp_echo_ignore_all
- exit 0
- fi
- if [ $NET -eq 0 ] && [ $SER -eq 1 ];then
- let COUNT+=1
- if [ $COUNT -eq $MAX_COUNT ];then
- /etc/init.d/bird stop
- echo 1 >/proc/sys/net/ipv4/icmp_echo_ignore_all
- fi
- continue
- fi
- exit 0
- done
clash用这个配置,订阅里的url改成你自己的,利用PROCESS-NAME走直连,需要clash的premium版本
启动之后用yacd之类的接进去确认下global是不是direct,然后在proxy组里选你要的节点
- dns:
- enable: true
- ipv6: false
- listen: 0.0.0.0:53
- enhanced-mode: redir-host
- use-hosts: true
- default-nameserver:
- - 119.29.29.29
- - 223.5.5.5
- nameserver:
- - 119.29.29.29
- - 223.5.5.5
- fallback:
- - https://dns.google/dns-query
- - https://cloudflare-dns.com/dns-query
- - https://1.1.1.1/dns-query
- - https://8.8.8.8/dns-query
- - https://8.8.4.4/dns-query
- fallback-filter:
- geoip: true
- ipcidr:
- - 240.0.0.0/4
- tun:
- enable: true
- stack: system
- auto-detect-interface: true
- port: 7890
- socks-port: 7891
- redir-port: 7893
- allow-lan: true
- mode: Rule
- log-level: silent
- external-controller: '0.0.0.0:8080'
- proxy-groups:
- - name: PROXY
- type: select
- proxies:
- - subscribe
- proxy-providers:
- subscribe:
- type: http
- url: [clash订阅链接]
- interval: 86400
- path: ./proxy/subscribe.yaml
- health-check:
- enable: false
- interval: 600
- # lazy: true
- url: http://www.gstatic.com/generate_204
- rule-providers:
- icloud:
- type: http
- behavior: domain
- url: "https://cdn.jsdelivr.net/gh/Loyalsoldier/clash-rules@release/icloud.txt"
- path: ./ruleset/icloud.yaml
- interval: 86400
- apple:
- type: http
- behavior: domain
- url: "https://cdn.jsdelivr.net/gh/Loyalsoldier/clash-rules@release/apple.txt"
- path: ./ruleset/apple.yaml
- interval: 86400
- google:
- type: http
- behavior: domain
- url: "https://cdn.jsdelivr.net/gh/Loyalsoldier/clash-rules@release/google.txt"
- path: ./ruleset/google.yaml
- interval: 86400
- proxy:
- type: http
- behavior: domain
- url: "https://cdn.jsdelivr.net/gh/Loyalsoldier/clash-rules@release/proxy.txt"
- path: ./ruleset/proxy.yaml
- interval: 86400
- direct:
- type: http
- behavior: domain
- url: "https://cdn.jsdelivr.net/gh/Loyalsoldier/clash-rules@release/direct.txt"
- path: ./ruleset/direct.yaml
- interval: 86400
- private:
- type: http
- behavior: domain
- url: "https://cdn.jsdelivr.net/gh/Loyalsoldier/clash-rules@release/private.txt"
- path: ./ruleset/private.yaml
- interval: 86400
- telegramcidr:
- type: http
- behavior: ipcidr
- url: "https://cdn.jsdelivr.net/gh/Loyalsoldier/clash-rules@release/telegramcidr.txt"
- path: ./ruleset/telegramcidr.yaml
- interval: 86400
- cncidr:
- type: http
- behavior: ipcidr
- url: "https://cdn.jsdelivr.net/gh/Loyalsoldier/clash-rules@release/cncidr.txt"
- path: ./ruleset/cncidr.yaml
- interval: 86400
- lancidr:
- type: http
- behavior: ipcidr
- url: "https://cdn.jsdelivr.net/gh/Loyalsoldier/clash-rules@release/lancidr.txt"
- path: ./ruleset/lancidr.yaml
- interval: 86400
- applications:
- type: http
- behavior: classical
- url: "https://cdn.jsdelivr.net/gh/Loyalsoldier/clash-rules@release/applications.txt"
- path: ./ruleset/applications.yaml
- interval: 86400
- rules:
- - PROCESS-NAME,clash,DIRECT
- - RULE-SET,applications,DIRECT
- - RULE-SET,private,DIRECT
- - RULE-SET,icloud,DIRECT
- - RULE-SET,apple,DIRECT
- - RULE-SET,google,DIRECT
- - RULE-SET,proxy,PROXY
- - RULE-SET,direct,DIRECT
- - RULE-SET,lancidr,DIRECT
- - RULE-SET,cncidr,DIRECT
- - RULE-SET,telegramcidr,PROXY
- - GEOIP,LAN,DIRECT
- - GEOIP,CN,DIRECT
- - MATCH,PROXY
|
楼主: guitengyue
310112100042806
发表于 2022-6-17 23:34
