vault: add 家庭网络基础设施 area note with full topology, devices, services
This commit is contained in:
Yaojia Wang
@@ -1,218 +1,218 @@
|
||||
# iStoreOS 主网关配置文档
|
||||
|
||||
> 主网关：`192.168.68.63` (iStoreOS 24.10.2, aarch64, EasePi Pro)
|
||||
> WiFi：Deco BE65（AP 模式）
|
||||
> 服务器：`8.138.1.192`（阿里云广州）
|
||||
> 用途：翻墙回国 + 全家广告拦截 + 内网 DNS
|
||||
> 状态：**已完成，正常工作** (2026-03-15)
|
||||
|
||||
---
|
||||
|
||||
## 1. 网络拓扑
|
||||
|
||||
```
|
||||
光猫 (拨号, Dynamic IP)
|
||||
│
|
||||
▼ WAN (eth0, DHCP)
|
||||
iStoreOS (192.168.68.63) ← 主网关
|
||||
├── dnsmasq (:53) → 内网 DNS + 转发到 OpenClash
|
||||
├── OpenClash / mihomo (:7874) → fake-ip + TUN → 翻墙回国 + 广告拦截
|
||||
├── 端口映射 (2200, 443, 51888)
|
||||
├── DHCP (网关=.63, DNS=.63)
|
||||
│
|
||||
▼ LAN (eth1/eth2/eth3)
|
||||
├── Deco BE65 (AP) → WiFi → 手机/平板/笔记本
|
||||
└── 交换机 (2楼) → PVE + NAS
|
||||
```
|
||||
|
||||
### DNS 解析链路
|
||||
|
||||
```
|
||||
设备 → dnsmasq (:53)
|
||||
├─ 内网域名 (*.colacoder.com, *.k8s.home) → 直接返回真实 IP
|
||||
└─ 外部域名 → OpenClash (:7874, fake-ip)
|
||||
├─ fake-ip-filter 匹配 → 返回真实 IP
|
||||
├─ 广告域名 → REJECT
|
||||
├─ 国内域名 → fake-ip → VLESS 代理回国
|
||||
└─ 海外域名 → fake-ip → 直连
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## 2. OpenClash 配置
|
||||
|
||||
### LuCI 后台设置
|
||||
|
||||
| 设置 | 值 |
|
||||
|------|-----|
|
||||
| 运行模式 | Fake-IP (TUN) |
|
||||
| 代理模式 | Rule 策略代理 |
|
||||
| 区域绕过 | **停用** |
|
||||
| 域名嗅探 | 启用 |
|
||||
| DNS 代理 | 停用 |
|
||||
| 本地 DNS 劫持 | 使用 Dnsmasq 转发 |
|
||||
|
||||
### 覆写设置 → DNS
|
||||
|
||||
| 设置 | 值 |
|
||||
|------|-----|
|
||||
| Default-NameServer | `8.8.8.8`, `1.1.1.1` |
|
||||
| NameServer | `8.8.8.8`, `1.1.1.1` |
|
||||
| Fallback | `dns.google`, `cloudflare-dns.com` |
|
||||
|
||||
> **重要：** NameServer 必须用海外 DNS，不能用国内 DNS（114、119、223 等），
|
||||
> 否则会产生 DNS 环路（国内 DNS IP 匹配 GEOIP,CN → 走代理 → 代理需要 DNS → 死循环）。
|
||||
|
||||
### 配置文件
|
||||
|
||||
- 源配置：`/etc/openclash/config/vless-reality.yaml`
|
||||
- 运行配置：`/etc/openclash/vless-reality.yaml`（自动生成，勿手动改）
|
||||
- API Secret：`Dc7jZkmO`
|
||||
- Dashboard：http://192.168.68.63:9090
|
||||
|
||||
### 自定义文件（持久化，不被覆盖）
|
||||
|
||||
| 文件 | 用途 |
|
||||
|------|------|
|
||||
| `/etc/openclash/custom/openclash_custom_hosts.list` | 内网 DNS 映射 |
|
||||
| `/etc/openclash/custom/openclash_custom_fake_filter.list` | fake-ip 排除域名 |
|
||||
|
||||
---
|
||||
|
||||
## 3. 内网 DNS
|
||||
|
||||
双重保障：dnsmasq 和 OpenClash hosts 都配了内网记录。
|
||||
|
||||
### dnsmasq 配置
|
||||
|
||||
文件：`/etc/dnsmasq.d/internal-dns.conf`
|
||||
|
||||
```
|
||||
address=/k8s.home/192.168.68.70
|
||||
address=/nas.colacoder.com/192.168.68.70
|
||||
address=/pve.colacoder.com/192.168.68.70
|
||||
address=/npm.colacoder.com/192.168.68.70
|
||||
address=/router.colacoder.com/192.168.68.63
|
||||
address=/adguard.colacoder.com/192.168.68.63
|
||||
address=/claw.colacoder.com/192.168.68.70
|
||||
address=/openvas.colacoder.com/192.168.68.70
|
||||
address=/invest-api.k8s.home/192.168.68.240
|
||||
```
|
||||
|
||||
### OpenClash 自定义 hosts
|
||||
|
||||
文件：`/etc/openclash/custom/openclash_custom_hosts.list`
|
||||
|
||||
```yaml
|
||||
nas.colacoder.com: 192.168.68.70
|
||||
pve.colacoder.com: 192.168.68.70
|
||||
npm.colacoder.com: 192.168.68.70
|
||||
router.colacoder.com: 192.168.68.63
|
||||
adguard.colacoder.com: 192.168.68.63
|
||||
claw.colacoder.com: 192.168.68.70
|
||||
openvas.colacoder.com: 192.168.68.70
|
||||
invest-api.k8s.home: 192.168.68.240
|
||||
```
|
||||
|
||||
### fake-ip 排除列表
|
||||
|
||||
文件：`/etc/openclash/custom/openclash_custom_fake_filter.list`
|
||||
|
||||
```
|
||||
*.colacoder.com
|
||||
+.colacoder.com
|
||||
*.k8s.home
|
||||
+.k8s.home
|
||||
*.lan
|
||||
*.local
|
||||
*.localdomain
|
||||
*.home.arpa
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## 4. 端口映射
|
||||
|
||||
| 规则名 | 外部端口 | 目标 |
|
||||
|--------|---------|------|
|
||||
| NAS-SSH-2200 | 2200 | 192.168.68.70:2200 |
|
||||
| NAS-HTTPS-443 | 443 | 192.168.68.70:443 |
|
||||
| Device-51888 | 51888 | 192.168.68.107:51888 |
|
||||
|
||||
---
|
||||
|
||||
## 5. DHCP 静态绑定（19 台设备）
|
||||
|
||||
| 名称 | IP | MAC |
|
||||
|------|-----|-----|
|
||||
| pve-docker | 192.168.68.102 | BC:24:11:3B:9C:8A |
|
||||
| wireguard | 192.168.68.107 | BC:24:11:00:4D:D2 |
|
||||
| Yaojia-ipad | 192.168.68.77 | 64:0B:D7:F0:D0:4C |
|
||||
| Yaojias-iPhone | 192.168.68.73 | 68:EF:DC:B7:36:40 |
|
||||
| Yiukai | 192.168.68.89 | 10:FF:E0:CC:1D:00 |
|
||||
| Yiukai-Asus-wifi | 192.168.68.79 | 08:3A:88:59:1F:A6 |
|
||||
| Yiukai-Asus-lan | 192.168.68.60 | 44:E5:17:DD:26:01 |
|
||||
| yiukai-ubuntu | 192.168.68.108 | 1C:79:2D:5C:2C:C4 |
|
||||
| YIUKAINAS | 192.168.68.70 | 24:5E:BE:5F:ED:38 |
|
||||
| Yiukais-MBP | 192.168.68.87 | 5C:E9:1E:B2:56:79 |
|
||||
| android-8fbbfff | 192.168.68.111 | 6C:2D:24:F8:F3:0C |
|
||||
| easepi | 192.168.68.63 | EE:61:98:11:AD:C4 |
|
||||
| homeassistant | 192.168.68.97 | BC:24:11:63:40:1E |
|
||||
| kai-desktop-jetson | 192.168.68.104 | 3C:6D:66:1E:D7:62 |
|
||||
| kuangxideiPhone | 192.168.68.88 | C4:C1:7D:7B:76:CC |
|
||||
| lingke | 192.168.68.69 | 84:47:09:20:70:DA |
|
||||
| network-scanner | 192.168.68.84 | BC:24:11:09:F1:9E |
|
||||
| pc | 192.168.68.176 | 12:D0:5B:A3:8B:4F |
|
||||
| adguard-vm | 192.168.68.112 | BC:24:11:C9:58:CB |
|
||||
|
||||
---
|
||||
|
||||
## 6. 踩坑记录
|
||||
|
||||
### DNS 环路（最关键）
|
||||
|
||||
OpenClash 的 nameserver 不能用国内 DNS（114.114.114.114、119.29.29.29 等），
|
||||
因为这些 IP 匹配 GEOIP,CN 规则 → 走代理 → 代理需要 DNS → 死循环。
|
||||
**必须用海外 DNS（8.8.8.8、1.1.1.1）。**
|
||||
|
||||
### OpenClash 配置覆盖
|
||||
|
||||
OpenClash 每次重启都会从源配置重新生成运行配置。
|
||||
自定义 hosts 和 fake-ip-filter 必须放在 `/etc/openclash/custom/` 目录下的专用文件里。
|
||||
直接改 yaml 文件会被覆盖。
|
||||
DNS 相关设置必须在 LuCI 覆写设置里改，不能改 yaml。
|
||||
|
||||
### 区域绕过必须停用
|
||||
|
||||
翻墙回国场景下，"大陆"和"海外"绕过都不合适，必须选"停用"，
|
||||
让配置文件里的分流规则来决定。
|
||||
|
||||
---
|
||||
|
||||
## 7. 紧急恢复
|
||||
|
||||
```bash
|
||||
SSH_AUTH_SOCK="$HOME/Library/Group Containers/2BUA8C4S2C.com.1password/t/agent.sock" ssh root@192.168.68.63
|
||||
|
||||
# 停止 OpenClash（恢复直连上网）
|
||||
/etc/init.d/openclash stop
|
||||
|
||||
# 如果 DNS 也断了，临时用 8.8.8.8
|
||||
echo "nameserver 8.8.8.8" > /etc/resolv.conf
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## 8. 更新维护
|
||||
|
||||
```bash
|
||||
# 更新 mihomo 内核
|
||||
cd /tmp
|
||||
curl -L -o mihomo.gz "https://github.com/MetaCubeX/mihomo/releases/latest/download/mihomo-linux-arm64.gz"
|
||||
gunzip -f mihomo.gz && chmod +x mihomo
|
||||
mv mihomo /etc/openclash/core/clash_meta
|
||||
/etc/init.d/openclash restart
|
||||
|
||||
# 更新 OpenClash 插件
|
||||
opkg install /tmp/luci-app-openclash_*.ipk
|
||||
```
|
||||
# iStoreOS 主网关配置文档
|
||||
|
||||
> 主网关：`192.168.68.63` (iStoreOS 24.10.2, aarch64, EasePi Pro)
|
||||
> WiFi：Deco BE65（AP 模式）
|
||||
> 服务器：`8.138.1.192`（阿里云广州）
|
||||
> 用途：翻墙回国 + 全家广告拦截 + 内网 DNS
|
||||
> 状态：**已完成，正常工作** (2026-03-15)
|
||||
|
||||
---
|
||||
|
||||
## 1. 网络拓扑
|
||||
|
||||
```
|
||||
光猫 (拨号, Dynamic IP)
|
||||
│
|
||||
▼ WAN (eth0, DHCP)
|
||||
iStoreOS (192.168.68.63) ← 主网关
|
||||
├── dnsmasq (:53) → 内网 DNS + 转发到 OpenClash
|
||||
├── OpenClash / mihomo (:7874) → fake-ip + TUN → 翻墙回国 + 广告拦截
|
||||
├── 端口映射 (2200, 443, 51888)
|
||||
├── DHCP (网关=.63, DNS=.63)
|
||||
│
|
||||
▼ LAN (eth1/eth2/eth3)
|
||||
├── Deco BE65 (AP) → WiFi → 手机/平板/笔记本
|
||||
└── 交换机 (2楼) → PVE + NAS
|
||||
```
|
||||
|
||||
### DNS 解析链路
|
||||
|
||||
```
|
||||
设备 → dnsmasq (:53)
|
||||
├─ 内网域名 (*.colacoder.com, *.k8s.home) → 直接返回真实 IP
|
||||
└─ 外部域名 → OpenClash (:7874, fake-ip)
|
||||
├─ fake-ip-filter 匹配 → 返回真实 IP
|
||||
├─ 广告域名 → REJECT
|
||||
├─ 国内域名 → fake-ip → VLESS 代理回国
|
||||
└─ 海外域名 → fake-ip → 直连
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## 2. OpenClash 配置
|
||||
|
||||
### LuCI 后台设置
|
||||
|
||||
| 设置 | 值 |
|
||||
|------|-----|
|
||||
| 运行模式 | Fake-IP (TUN) |
|
||||
| 代理模式 | Rule 策略代理 |
|
||||
| 区域绕过 | **停用** |
|
||||
| 域名嗅探 | 启用 |
|
||||
| DNS 代理 | 停用 |
|
||||
| 本地 DNS 劫持 | 使用 Dnsmasq 转发 |
|
||||
|
||||
### 覆写设置 → DNS
|
||||
|
||||
| 设置 | 值 |
|
||||
|------|-----|
|
||||
| Default-NameServer | `8.8.8.8`, `1.1.1.1` |
|
||||
| NameServer | `8.8.8.8`, `1.1.1.1` |
|
||||
| Fallback | `dns.google`, `cloudflare-dns.com` |
|
||||
|
||||
> **重要：** NameServer 必须用海外 DNS，不能用国内 DNS（114、119、223 等），
|
||||
> 否则会产生 DNS 环路（国内 DNS IP 匹配 GEOIP,CN → 走代理 → 代理需要 DNS → 死循环）。
|
||||
|
||||
### 配置文件
|
||||
|
||||
- 源配置：`/etc/openclash/config/vless-reality.yaml`
|
||||
- 运行配置：`/etc/openclash/vless-reality.yaml`（自动生成，勿手动改）
|
||||
- API Secret：`Dc7jZkmO`
|
||||
- Dashboard：http://192.168.68.63:9090
|
||||
|
||||
### 自定义文件（持久化，不被覆盖）
|
||||
|
||||
| 文件 | 用途 |
|
||||
|------|------|
|
||||
| `/etc/openclash/custom/openclash_custom_hosts.list` | 内网 DNS 映射 |
|
||||
| `/etc/openclash/custom/openclash_custom_fake_filter.list` | fake-ip 排除域名 |
|
||||
|
||||
---
|
||||
|
||||
## 3. 内网 DNS
|
||||
|
||||
双重保障：dnsmasq 和 OpenClash hosts 都配了内网记录。
|
||||
|
||||
### dnsmasq 配置
|
||||
|
||||
文件：`/etc/dnsmasq.d/internal-dns.conf`
|
||||
|
||||
```
|
||||
address=/k8s.home/192.168.68.70
|
||||
address=/nas.colacoder.com/192.168.68.70
|
||||
address=/pve.colacoder.com/192.168.68.70
|
||||
address=/npm.colacoder.com/192.168.68.70
|
||||
address=/router.colacoder.com/192.168.68.63
|
||||
address=/adguard.colacoder.com/192.168.68.63
|
||||
address=/claw.colacoder.com/192.168.68.70
|
||||
address=/openvas.colacoder.com/192.168.68.70
|
||||
address=/invest-api.k8s.home/192.168.68.240
|
||||
```
|
||||
|
||||
### OpenClash 自定义 hosts
|
||||
|
||||
文件：`/etc/openclash/custom/openclash_custom_hosts.list`
|
||||
|
||||
```yaml
|
||||
nas.colacoder.com: 192.168.68.70
|
||||
pve.colacoder.com: 192.168.68.70
|
||||
npm.colacoder.com: 192.168.68.70
|
||||
router.colacoder.com: 192.168.68.63
|
||||
adguard.colacoder.com: 192.168.68.63
|
||||
claw.colacoder.com: 192.168.68.70
|
||||
openvas.colacoder.com: 192.168.68.70
|
||||
invest-api.k8s.home: 192.168.68.240
|
||||
```
|
||||
|
||||
### fake-ip 排除列表
|
||||
|
||||
文件：`/etc/openclash/custom/openclash_custom_fake_filter.list`
|
||||
|
||||
```
|
||||
*.colacoder.com
|
||||
+.colacoder.com
|
||||
*.k8s.home
|
||||
+.k8s.home
|
||||
*.lan
|
||||
*.local
|
||||
*.localdomain
|
||||
*.home.arpa
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## 4. 端口映射
|
||||
|
||||
| 规则名 | 外部端口 | 目标 |
|
||||
|--------|---------|------|
|
||||
| NAS-SSH-2200 | 2200 | 192.168.68.70:2200 |
|
||||
| NAS-HTTPS-443 | 443 | 192.168.68.70:443 |
|
||||
| Device-51888 | 51888 | 192.168.68.107:51888 |
|
||||
|
||||
---
|
||||
|
||||
## 5. DHCP 静态绑定（19 台设备）
|
||||
|
||||
| 名称 | IP | MAC |
|
||||
|------|-----|-----|
|
||||
| pve-docker | 192.168.68.102 | BC:24:11:3B:9C:8A |
|
||||
| wireguard | 192.168.68.107 | BC:24:11:00:4D:D2 |
|
||||
| Yaojia-ipad | 192.168.68.77 | 64:0B:D7:F0:D0:4C |
|
||||
| Yaojias-iPhone | 192.168.68.73 | 68:EF:DC:B7:36:40 |
|
||||
| Yiukai | 192.168.68.89 | 10:FF:E0:CC:1D:00 |
|
||||
| Yiukai-Asus-wifi | 192.168.68.79 | 08:3A:88:59:1F:A6 |
|
||||
| Yiukai-Asus-lan | 192.168.68.60 | 44:E5:17:DD:26:01 |
|
||||
| yiukai-ubuntu | 192.168.68.108 | 1C:79:2D:5C:2C:C4 |
|
||||
| YIUKAINAS | 192.168.68.70 | 24:5E:BE:5F:ED:38 |
|
||||
| Yiukais-MBP | 192.168.68.87 | 5C:E9:1E:B2:56:79 |
|
||||
| android-8fbbfff | 192.168.68.111 | 6C:2D:24:F8:F3:0C |
|
||||
| easepi | 192.168.68.63 | EE:61:98:11:AD:C4 |
|
||||
| homeassistant | 192.168.68.97 | BC:24:11:63:40:1E |
|
||||
| kai-desktop-jetson | 192.168.68.104 | 3C:6D:66:1E:D7:62 |
|
||||
| kuangxideiPhone | 192.168.68.88 | C4:C1:7D:7B:76:CC |
|
||||
| lingke | 192.168.68.69 | 84:47:09:20:70:DA |
|
||||
| network-scanner | 192.168.68.84 | BC:24:11:09:F1:9E |
|
||||
| pc | 192.168.68.176 | 12:D0:5B:A3:8B:4F |
|
||||
| adguard-vm | 192.168.68.112 | BC:24:11:C9:58:CB |
|
||||
|
||||
---
|
||||
|
||||
## 6. 踩坑记录
|
||||
|
||||
### DNS 环路（最关键）
|
||||
|
||||
OpenClash 的 nameserver 不能用国内 DNS（114.114.114.114、119.29.29.29 等），
|
||||
因为这些 IP 匹配 GEOIP,CN 规则 → 走代理 → 代理需要 DNS → 死循环。
|
||||
**必须用海外 DNS（8.8.8.8、1.1.1.1）。**
|
||||
|
||||
### OpenClash 配置覆盖
|
||||
|
||||
OpenClash 每次重启都会从源配置重新生成运行配置。
|
||||
自定义 hosts 和 fake-ip-filter 必须放在 `/etc/openclash/custom/` 目录下的专用文件里。
|
||||
直接改 yaml 文件会被覆盖。
|
||||
DNS 相关设置必须在 LuCI 覆写设置里改，不能改 yaml。
|
||||
|
||||
### 区域绕过必须停用
|
||||
|
||||
翻墙回国场景下，"大陆"和"海外"绕过都不合适，必须选"停用"，
|
||||
让配置文件里的分流规则来决定。
|
||||
|
||||
---
|
||||
|
||||
## 7. 紧急恢复
|
||||
|
||||
```bash
|
||||
SSH_AUTH_SOCK="$HOME/Library/Group Containers/2BUA8C4S2C.com.1password/t/agent.sock" ssh root@192.168.68.63
|
||||
|
||||
# 停止 OpenClash（恢复直连上网）
|
||||
/etc/init.d/openclash stop
|
||||
|
||||
# 如果 DNS 也断了，临时用 8.8.8.8
|
||||
echo "nameserver 8.8.8.8" > /etc/resolv.conf
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## 8. 更新维护
|
||||
|
||||
```bash
|
||||
# 更新 mihomo 内核
|
||||
cd /tmp
|
||||
curl -L -o mihomo.gz "https://github.com/MetaCubeX/mihomo/releases/latest/download/mihomo-linux-arm64.gz"
|
||||
gunzip -f mihomo.gz && chmod +x mihomo
|
||||
mv mihomo /etc/openclash/core/clash_meta
|
||||
/etc/init.d/openclash restart
|
||||
|
||||
# 更新 OpenClash 插件
|
||||
opkg install /tmp/luci-app-openclash_*.ipk
|
||||
```
|
||||
|
||||
Reference in New Issue
Block a user