258 lines
5.9 KiB
Markdown
258 lines
5.9 KiB
Markdown
---
|
||
tags:
|
||
- openclash
|
||
- vless-reality
|
||
- clash-config
|
||
- router
|
||
- dns
|
||
- homelab
|
||
---
|
||
|
||
# OpenClash 配置备份
|
||
|
||
> 路由器：`192.168.68.63` (iStoreOS, EasePi Pro)
|
||
> 最后更新：2026-03-19
|
||
> 用途：仅国内视频/音乐走代理回国，其余全部直连
|
||
|
||
---
|
||
|
||
## 1. 源配置
|
||
|
||
路径：`/etc/openclash/config/vless-reality.yaml`
|
||
|
||
> DNS 段只写了最小声明，其余由 LuCI 覆写生成。
|
||
|
||
```yaml
|
||
# ============================================================
|
||
# VLESS + XTLS-Vision + REALITY（翻墙回国 - 旁路由）
|
||
# 用途：仅国内视频/音乐走代理，其余全部直连
|
||
# 更新：2026-03-19 精简规则 + 安全加固 + sniffer 清理
|
||
# ============================================================
|
||
|
||
mixed-port: 7890
|
||
redir-port: 7892
|
||
tproxy-port: 7895
|
||
allow-lan: true
|
||
bind-address: "*"
|
||
mode: rule
|
||
log-level: warning
|
||
unified-delay: true
|
||
external-controller: 192.168.68.63:9090
|
||
|
||
dns:
|
||
enable: true
|
||
listen: 0.0.0.0:7874
|
||
|
||
proxies:
|
||
- name: "CN-Proxy"
|
||
type: vless
|
||
server: 8.138.1.192
|
||
port: 443
|
||
uuid: 04a7cfe3-10f6-4e38-8319-22a604e24018
|
||
network: tcp
|
||
udp: true
|
||
tls: true
|
||
flow: xtls-rprx-vision
|
||
servername: www.microsoft.com
|
||
reality-opts:
|
||
public-key: RTO_UOk5ncr3DAAYR08g08L0fo5ax9pmGFj8c8lXWgk
|
||
short-id: ""
|
||
client-fingerprint: chrome
|
||
|
||
proxy-groups:
|
||
- name: "Proxy"
|
||
type: select
|
||
proxies:
|
||
- CN-Proxy
|
||
- DIRECT
|
||
|
||
rules:
|
||
# K8s 节点直连（绕过 OpenClash）
|
||
- SRC-IP-CIDR,192.168.68.11/32,DIRECT
|
||
- SRC-IP-CIDR,192.168.68.21/32,DIRECT
|
||
- SRC-IP-CIDR,192.168.68.22/32,DIRECT
|
||
|
||
# 代理服务器本身必须直连（防环路）
|
||
- IP-CIDR,8.138.1.192/32,DIRECT
|
||
|
||
# 广告拦截
|
||
- GEOSITE,category-ads-all,REJECT
|
||
|
||
# 私有网络直连
|
||
- IP-CIDR,127.0.0.0/8,DIRECT
|
||
- IP-CIDR,10.0.0.0/8,DIRECT
|
||
- IP-CIDR,172.16.0.0/12,DIRECT
|
||
- IP-CIDR,192.168.0.0/16,DIRECT
|
||
|
||
# === 国内视频/流媒体（走代理回国） ===
|
||
# Bilibili
|
||
- DOMAIN-SUFFIX,bilibili.com,Proxy
|
||
- DOMAIN-SUFFIX,bilivideo.com,Proxy
|
||
- DOMAIN-SUFFIX,bilivideo.cn,Proxy
|
||
- DOMAIN-SUFFIX,biliapi.net,Proxy
|
||
- DOMAIN-SUFFIX,hdslb.com,Proxy
|
||
- DOMAIN-SUFFIX,acgvideo.com,Proxy
|
||
# 爱奇艺
|
||
- DOMAIN-SUFFIX,iqiyi.com,Proxy
|
||
- DOMAIN-SUFFIX,iqiyipic.com,Proxy
|
||
# 优酷
|
||
- DOMAIN-SUFFIX,youku.com,Proxy
|
||
# 芒果TV
|
||
- DOMAIN-SUFFIX,mgtv.com,Proxy
|
||
# 搜狐视频
|
||
- DOMAIN-SUFFIX,sohu.com,Proxy
|
||
# 腾讯视频
|
||
- DOMAIN-SUFFIX,v.qq.com,Proxy
|
||
- DOMAIN-SUFFIX,video.qq.com,Proxy
|
||
- DOMAIN-SUFFIX,livep.l.qq.com,Proxy
|
||
- DOMAIN-SUFFIX,vd.l.qq.com,Proxy
|
||
# 抖音/西瓜/字节
|
||
- DOMAIN-SUFFIX,douyin.com,Proxy
|
||
- DOMAIN-SUFFIX,douyinpic.com,Proxy
|
||
- DOMAIN-SUFFIX,douyincdn.com,Proxy
|
||
- DOMAIN-SUFFIX,douyinstatic.com,Proxy
|
||
- DOMAIN-SUFFIX,snssdk.com,Proxy
|
||
- DOMAIN-SUFFIX,amemv.com,Proxy
|
||
- DOMAIN-SUFFIX,ixigua.com,Proxy
|
||
- DOMAIN-SUFFIX,pstatp.com,Proxy
|
||
- DOMAIN-SUFFIX,bytedance.com,Proxy
|
||
- DOMAIN-SUFFIX,byteimg.com,Proxy
|
||
# 小红书
|
||
- DOMAIN-SUFFIX,xiaohongshu.com,Proxy
|
||
- DOMAIN-SUFFIX,xhscdn.com,Proxy
|
||
- DOMAIN-SUFFIX,xhslink.com,Proxy
|
||
|
||
# === 国内音乐（走代理回国） ===
|
||
# 网易云音乐
|
||
- DOMAIN-SUFFIX,music.163.com,Proxy
|
||
- DOMAIN-SUFFIX,163yun.com,Proxy
|
||
- DOMAIN-SUFFIX,126.net,Proxy
|
||
- DOMAIN-SUFFIX,netease.com,Proxy
|
||
# 酷狗
|
||
- DOMAIN-SUFFIX,kugou.com,Proxy
|
||
# 酷我
|
||
- DOMAIN-SUFFIX,kuwo.cn,Proxy
|
||
# QQ音乐
|
||
- DOMAIN-SUFFIX,y.qq.com,Proxy
|
||
- DOMAIN-SUFFIX,c.y.qq.com,Proxy
|
||
- DOMAIN-SUFFIX,streamoc.music.tc.qq.com,Proxy
|
||
|
||
# === 其他全部直连 ===
|
||
- MATCH,DIRECT
|
||
|
||
hosts:
|
||
"nas.colacoder.com": 192.168.68.70
|
||
"pve.colacoder.com": 192.168.68.70
|
||
"npm.colacoder.com": 192.168.68.70
|
||
"router.colacoder.com": 192.168.68.63
|
||
"adguard.colacoder.com": 192.168.68.63
|
||
"claw.colacoder.com": 192.168.68.70
|
||
"openvas.colacoder.com": 192.168.68.70
|
||
"invest-api.k8s.home": 192.168.68.240
|
||
"argocd.k8s.home": 192.168.68.240
|
||
"drone.k8s.home": 192.168.68.240
|
||
```
|
||
|
||
---
|
||
|
||
## 2. 自定义文件
|
||
|
||
### 2.1 Fake-IP 排除列表
|
||
|
||
路径：`/etc/openclash/custom/openclash_custom_fake_filter.list`
|
||
|
||
```
|
||
+.colacoder.com
|
||
+.k8s.home
|
||
*.lan
|
||
*.local
|
||
*.localdomain
|
||
*.home.arpa
|
||
+.quay.io
|
||
+.ghcr.io
|
||
+.docker.io
|
||
+.docker.com
|
||
+.gcr.io
|
||
+.k8s.io
|
||
+.registry.k8s.io
|
||
+.ecr.aws
|
||
+.billo.life
|
||
+.finance.yahoo.com
|
||
```
|
||
|
||
### 2.2 自定义 Hosts
|
||
|
||
路径：`/etc/openclash/custom/openclash_custom_hosts.list`
|
||
|
||
```yaml
|
||
nas.colacoder.com: 192.168.68.70
|
||
pve.colacoder.com: 192.168.68.70
|
||
npm.colacoder.com: 192.168.68.70
|
||
router.colacoder.com: 192.168.68.63
|
||
adguard.colacoder.com: 192.168.68.63
|
||
claw.colacoder.com: 192.168.68.70
|
||
openvas.colacoder.com: 192.168.68.70
|
||
invest-api.k8s.home: 192.168.68.240
|
||
argocd.k8s.home: 192.168.68.240
|
||
drone.k8s.home: 192.168.68.240
|
||
```
|
||
|
||
### 2.3 自定义 Sniffer
|
||
|
||
路径：`/etc/openclash/custom/openclash_custom_sniffer.yaml`
|
||
|
||
```yaml
|
||
sniffer:
|
||
force-dns-mapping: true
|
||
parse-pure-ip: true
|
||
override-destination: true
|
||
sniff:
|
||
QUIC:
|
||
ports: [443]
|
||
TLS:
|
||
ports: [443, 8443]
|
||
HTTP:
|
||
ports: [80, 8080-8880]
|
||
override-destination: true
|
||
force-domain: []
|
||
skip-domain:
|
||
- Mijia Cloud
|
||
- dlg.io.mi.com
|
||
- +.oray.com
|
||
- +.sunlogin.net
|
||
- +.push.apple.com
|
||
```
|
||
|
||
---
|
||
|
||
## 3. LuCI 覆写设置
|
||
|
||
以下设置通过 LuCI 后台配置，会覆盖源配置中的对应字段：
|
||
|
||
| 设置 | 值 |
|
||
|------|-----|
|
||
| 运行模式 | Fake-IP (TUN) |
|
||
| 代理模式 | Rule 策略代理 |
|
||
| 区域绕过 | 停用 |
|
||
| 域名嗅探 | 启用 |
|
||
| Default-NameServer | `8.8.8.8`, `1.1.1.1` |
|
||
| NameServer | `8.8.8.8`, `1.1.1.1` |
|
||
| Fallback | `dns.google`, `cloudflare-dns.com` (DoH) |
|
||
| store-fake-ip | 启用 |
|
||
| respect-rules | 启用 |
|
||
| custom-fakeip-filter | 启用 (blacklist 模式) |
|
||
| custom-host | 启用 |
|
||
| custom-fallback-filter | 启用 |
|
||
| china_ip_route | 启用 |
|
||
| tcp-concurrent | 启用 |
|
||
| IPv6 | 关闭 |
|
||
| QUIC | 禁用 |
|
||
|
||
---
|
||
|
||
## 相关文档
|
||
|
||
- [[VLESS-REALITY-Router-iStoreOS]] -- 主网关配置文档
|
||
- [[OpenClash-Config-Review-2026-03-19]] -- 配置审计报告
|
||
- [[家庭网络基础设施]] -- 网络拓扑总览
|