分享一份OpenWrt主路由代理LAN的配置（v4代理v6直连）

[Mapleshade20]

这份是我抄别人的基础上经过多次试验自己改出来的。

场景：

1. OpenWrt 作主路由，仅代理LAN设备
2. 我的宽带提供 ipv6，我订阅的机场的节点不支持 ipv6，但我有些场景仍然要用 ipv6（spotify）
3. 我的网络环境下非 53 的 UDP 丢包有点严重

注意：我自己 fork 了一个 geosite.dat 生成器，修改了 geosite:spotify 和 geosite:2kgames，其中对 spotify 的修改对于正确地返回其 cdn 的 AAAA record 来说很重要。见 https://github.com/Mapleshade20/domain-list-community.git 和 https://github.com/Mapleshade20/v2ray-rules-dat.git

你需要在使用前修改的部分：

• routing 部分的 MAC
• lan_interface: eth0
• 节点订阅信息和分组

global {
    ##### Software options.

    tproxy_port: 12345
    tproxy_port_protect: true
    pprof_port: 0
    so_mark_from_dae: 0

    # Log level: error, warn, info, debug, trace.
    log_level: info

    # Disable waiting for network before pulling subscriptions.
    disable_waiting_network: false
    
    # Enable fast redirect for local TCP connections. There's a known kernel issue breaking certain clients/proxies, eg. nadoo/glider. 
    # Enable this experimental option at your own risk.
    enable_local_tcp_fast_redirect: true


    ##### Interface and kernel options.

    lan_interface: eth0
    auto_config_kernel_parameter: true


    ##### Node connectivity check.

    tcp_check_url: 'http://cp.cloudflare.com,1.1.1.1'

    # The HTTP request method to `tcp_check_url`. Use 'HEAD' by default because some server implementations bypass
    # accounting for this kind of traffic.
    tcp_check_http_method: HEAD

    udp_check_dns: 'dns.google.com:53,8.8.8.8'

    check_interval: 40s

    # Group will switch node only when new_latency <= old_latency - tolerance.
    check_tolerance: 300ms


    ##### Connecting options.

    dial_mode: domain++

    allow_insecure: false

    # Timeout to waiting for first data sending for sniffing. It is always 0 if dial_mode is ip. Set it higher is useful
    # in high latency LAN network.
    sniffing_timeout: 100ms

    # TLS implementation. tls is to use Go's crypto/tls. utls can imitate browser's Client Hello, but seems to cause bug.
    tls_implementation: tls

    # The Client Hello ID for uTLS to imitate. This takes effect only if tls_implementation is utls.
    utls_imitate: chrome_auto
    
    # Multipath TCP (MPTCP) support. If is true, dae will try to use MPTCP to connect all nodes, but it will only take
    # effects when the node supports MPTCP. It can use for load balance and failover to multiple interfaces and IPs.
    mptcp: false
    
    # The maximum bandwidth for accessing the Internet. It is useful for some specific protocols (e.g., Hysteria2),
    # which will perform better with bandwith information provided. The unit can be b, kb, mb, gb, tb or bytes per second.
    # supported formats: https://v2.hysteria.network/docs/advanced/Full-Client-Config/#bandwidth
    bandwidth_max_tx: '90 mbps' # uplink, or '200 m' or '200 mb' or '200 mbps' or 25000000(which is 200/8*1000*1000)
    bandwidth_max_rx: '360 mbps' # downlink, or '1 g' or '1 gb' or '1 gbps' or 125000000(which is 1000/8*1000*1000)
}

# Subscriptions defined here will be resolved as nodes and merged as a part of the global node pool.
# Support to give the subscription a tag, and filter nodes from a given subscription in the group section.
subscription {
        #自己写
}

# Nodes defined here will be merged as a part of the global node pool.
node {
        #自己写
}

group {
    experimental {
        #自己写
    }

    stream {
        #自己写
    }
    
    us {
        #自己写
    }
}

dns {
    upstream {
        alidns: 'udp://223.5.5.5'
        googledns: 'https://dns.google:443'
    }
    routing {
        request {
            qname(geosite: category-ads, suffix: cn.bing.com, suffix: cn.mm.bing.net) -> reject
            qname(geosite: google@cn, geosite: connectivity-check, keyword: apple, geosite: apple, keyword: spotify, geosite: spotify, suffix: cloudmessaging.edge.microsoft.com, suffix: delivery.mp.microsoft.com) -> alidns
            qname(suffix: app-ads-services.com, suffix: braze.com, suffix: busuu.com, geosite: firebase) -> googledns

            !qname(geosite: cn, geosite: apple, keyword: apple) && qtype(aaaa) -> reject
            
            qname(geosite: bing, geosite: msn, geosite: category-ai-chat-!cn, suffix: a-msedge.net, suffix: aadg.akadns.net, geosite: gfw, geosite: google, suffix: challenges.cloudflare.com) -> googledns
            fallback: alidns
        }
        response {
            upstream(googledns) && qtype(aaaa) -> reject
            fallback: accept
        }
    }
}


# See https://github.com/daeuniverse/dae/blob/main/docs/en/configuration/routing.md for full examples.
routing {
    # --- Builtin ---
    dip(224.0.0.0/3, 'ff00::/8') -> direct(must)
    dip(geoip: private) -> direct(must)
    domain(geosite: private) && !domain(suffix: cloudflare.com) -> direct(must)
    
    # --- Device ---
    !mac(        #自己写         ) -> direct(must)
    
    # --- Port & Proto ---
    l4proto(udp) && dport(443) && domain(geosite: youtube) -> block
    dport(5223, 1080, 441) && l4proto(tcp) -> direct(must)
    dport(22, 23) -> direct
    l4proto(udp) && !dport(53) -> direct(must)
    
    # --- IP & Domain (tcp only) ---
    domain(geosite: category-ads) -> block
    domain(full: dns.google) -> stream
    ipversion(4) && domain(suffix: perplexity.ai, suffix: challenges.cloudflare.com) -> experimental
    dip(geoip: cn) -> direct
    ipversion(4) && domain(keyword: login) && domain(keyword: spotify) -> stream
    ipversion(4) && domain(suffix: app-ads-services.com, suffix: braze.com, suffix: busuu.com, geosite: firebase) -> stream
    domain(geosite: google@cn, geosite: connectivity-check, keyword: ntp, geosite: cn, geosite: nvidia, geosite: spotify, geosite: category-cas, geosite: apple, keyword: apple, geosite: duolingo) -> direct
    domain(suffix: immortalwrt.org, suffix: ankiweb.net, keyword: mozilla, suffix: spocs.getpocket.com, suffix: hp.com, suffix: cloudfront.net, suffix: ohmyz.sh, keyword: hcaptcha, geosite: 2kgames, suffix: steamcontent.com, suffix: flowercloud.net, suffix: marxists.org, suffix: cloudmessaging.edge.microsoft.com, suffix: delivery.mp.microsoft.com) -> direct
    ipversion(4) -> stream
    fallback: direct
}