[BUG] Не работает ChatGPT, подкоп возвращает левый IP

[hgcdtyt]

📝 Описание проблемы

Добрый день! Есть роутер на опенврт. Подкоп, маршрутизация по доменам в впн. Домен чата в списке-файле на заворачивание в туннель. Сегодня чат перестал работать. Если подключиться к впн с пк, все отлично, если просто через роутер - не работает.
Провел небольшое расследование, выяснилось - под впн или через сервер клаудфлеара/гугла домен резолвится в корректные айпишники, через подкоп диг выдает следующее: ➜ ~ dig chatgpt.com

; <<>> DiG 9.20.11-1ubuntu2.2-Ubuntu <<>> chatgpt.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 54149
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 65494
;; QUESTION SECTION:
;chatgpt.com. IN A

;; ANSWER SECTION:
chatgpt.com. 0 IN A 45.155.204.190

;; Query time: 1 msec
;; SERVER: 127.0.0.53#53(127.0.0.53) (UDP)
;; WHEN: Wed May 20 11:54:50 EET 2026
;; MSG SIZE rcvd: 56

Я загуглили по WHOIS, написано что айпишник принадлежит подсетям cloud.ru, соответственно он не открывается и чат не работает, запросы просто висят. Перечитал ридми, но не нашел подходящего кейса, подскажите, что может быть не так. Ничего не менял, ночью роутер автоматически перезагружался по крону и все.
Также стоит запрет, но раньше все работало.

ПОдскажите, что может быть не так? Спасибо!

Диагностика:
📡 Global check run!
━━━━━━━━━━━━━━━━━━━━━━━━━━━
🛠️ System info
🕳️ Podkop: v0.7.14 (latest: 0.7.17)
🕳️ LuCI App: v0.7.14
📦 Sing-box: 1.12.22
🛜 OpenWrt: OpenWrt 24.10.2 r28739-d9340319c6
🛜 Device: Xiaomi Mi Router AX3000T
━━━━━━━━━━━━━━━━━━━━━━━━━━━
➡️ DNS status
✅ Bootstrap DNS: 77.88.8.8
✅ Main DNS: 1.1.1.1 [doh]
✅ DNS on router
✅ /etc/config/dhcp
━━━━━━━━━━━━━━━━━━━━━━━━━━━
📦 Sing-box status
✅ Sing-box installed
✅ Sing-box version is compatible (newer than 1.12.4)
✅ Sing-box service exist
✅ Sing-box autostart disabled
✅ Sing-box process running
✅ Sing-box listening ports
━━━━━━━━━━━━━━━━━━━━━━━━━━━
🧱 NFT rules status
✅ Table exist
✅ Rules mangle exist
✅ Rules mangle counters
✅ Rules mangle output exist
✅ Rules mangle output counters
✅ Rules proxy exist
✅ Rules proxy counters
⚠️ Additional marking rules found:
meta mark & 0x40000000 == 0x00000000 jump postrouting
oifname @WANIF udp length >= 28 @ih,32,32 0x2112a442 @ih,0,8 & 0xc0 == 0x0 @ih,24,8 & 0x3 == 0x0 ip daddr != @nozapret meta mark set meta mark | 0x20000000 ct mark set ct mark | 0x40000000 queue flags bypass to 65400
oifname @WANIF udp dport { 88, 443, 1024-2407, 2409-4499, 4502-65535 } ct original packets 1-9 ip daddr != @nozapret meta mark set meta mark | 0x20000000 ct mark set ct mark | 0x40000000 queue flags bypass to 200
oifname @WANIF tcp dport { 80, 443, 2053, 2083, 2087, 2096, 2302, 2502, 2802, 6112-6119, 6695-6710, 8443, 25565, 27015-27030, 27036-27037, 50001 } ct original packets 1-9 ip daddr != @nozapret meta mark set meta mark | 0x20000000 ct mark set ct mark | 0x40000000 queue flags bypass to 200
meta mark & 0x40000000 == 0x00000000 jump postnat
iifname @WANIF tcp sport { 80, 443, 2053, 2083, 2087, 2096, 2302, 2502, 2802, 6112-6119, 6695-6710, 8443, 25565, 27015-27030, 27036-27037, 50001 } ct reply packets 1-3 ip saddr != @nozapret ct mark set ct mark | 0x40000000 queue flags bypass to 200
meta mark & 0x40000000 != 0x00000000 jump predefrag_nfqws comment "nfqws generated : avoid drop by INVALID conntrack state"
meta mark & 0x20000000 != 0x00000000 notrack comment "postnat traffic"
━━━━━━━━━━━━━━━━━━━━━━━━━━━
📄 Podkop config

config settings 'settings'
option dns_type 'doh'
option dns_server '1.1.1.1'
option bootstrap_dns_server '77.88.8.8'
option dns_rewrite_ttl '60'
option enable_output_network_interface '0'
option enable_badwan_interface_monitoring '0'
option enable_yacd '0'
option disable_quic '0'
option update_interval '1d'
option download_lists_via_proxy '0'
option dont_touch_dhcp '0'
option config_path '/etc/sing-box/config.json'
option cache_path '/tmp/sing-box/cache.db'
option log_level 'warn'
option exclude_ntp '0'
option shutdown_correctly '0'
list source_network_interfaces 'br-lan'
list source_network_interfaces 'VPN'

config section 'main'
option connection_type 'proxy'
option proxy_config_type 'url'
option enable_udp_over_tcp '0'
option proxy_string 'MASKED'
option user_domain_list_type 'text'
option user_domains_text '2ip.io
//googlevideo.com
4pda.to
'
option user_subnet_list_type 'disabled'
option mixed_proxy_enabled '1'
option mixed_proxy_port '1081'
list local_domain_lists '/root/vpn_domain_list.txt'

━━━━━━━━━━━━━━━━━━━━━━━━━━━
📄 WAN config
❌ WAN configuration not found
━━━━━━━━━━━━━━━━━━━━━━━━━━━
⚠️ Zapret detected
━━━━━━━━━━━━━━━━━━━━━━━━━━━
🥸 FakeIP status
✅ Router DNS is routed through sing-box
✅ Sing-box works with FakeIP: 198.18.0.7📡 Global check run!
━━━━━━━━━━━━━━━━━━━━━━━━━━━
🛠️ System info
🕳️ Podkop: v0.7.14 (latest: 0.7.17)
🕳️ LuCI App: v0.7.14
📦 Sing-box: 1.12.22
🛜 OpenWrt: OpenWrt 24.10.2 r28739-d9340319c6
🛜 Device: Xiaomi Mi Router AX3000T
━━━━━━━━━━━━━━━━━━━━━━━━━━━
➡️ DNS status
✅ Bootstrap DNS: 77.88.8.8
✅ Main DNS: 1.1.1.1 [doh]
✅ DNS on router
✅ /etc/config/dhcp
━━━━━━━━━━━━━━━━━━━━━━━━━━━
📦 Sing-box status
✅ Sing-box installed
✅ Sing-box version is compatible (newer than 1.12.4)
✅ Sing-box service exist
✅ Sing-box autostart disabled
✅ Sing-box process running
✅ Sing-box listening ports
━━━━━━━━━━━━━━━━━━━━━━━━━━━
🧱 NFT rules status
✅ Table exist
✅ Rules mangle exist
✅ Rules mangle counters
✅ Rules mangle output exist
✅ Rules mangle output counters
✅ Rules proxy exist
✅ Rules proxy counters
⚠️ Additional marking rules found:
meta mark & 0x40000000 == 0x00000000 jump postrouting
oifname @WANIF udp length >= 28 @ih,32,32 0x2112a442 @ih,0,8 & 0xc0 == 0x0 @ih,24,8 & 0x3 == 0x0 ip daddr != @nozapret meta mark set meta mark | 0x20000000 ct mark set ct mark | 0x40000000 queue flags bypass to 65400
oifname @WANIF udp dport { 88, 443, 1024-2407, 2409-4499, 4502-65535 } ct original packets 1-9 ip daddr != @nozapret meta mark set meta mark | 0x20000000 ct mark set ct mark | 0x40000000 queue flags bypass to 200
oifname @WANIF tcp dport { 80, 443, 2053, 2083, 2087, 2096, 2302, 2502, 2802, 6112-6119, 6695-6710, 8443, 25565, 27015-27030, 27036-27037, 50001 } ct original packets 1-9 ip daddr != @nozapret meta mark set meta mark | 0x20000000 ct mark set ct mark | 0x40000000 queue flags bypass to 200
meta mark & 0x40000000 == 0x00000000 jump postnat
iifname @WANIF tcp sport { 80, 443, 2053, 2083, 2087, 2096, 2302, 2502, 2802, 6112-6119, 6695-6710, 8443, 25565, 27015-27030, 27036-27037, 50001 } ct reply packets 1-3 ip saddr != @nozapret ct mark set ct mark | 0x40000000 queue flags bypass to 200
meta mark & 0x40000000 != 0x00000000 jump predefrag_nfqws comment "nfqws generated : avoid drop by INVALID conntrack state"
meta mark & 0x20000000 != 0x00000000 notrack comment "postnat traffic"
━━━━━━━━━━━━━━━━━━━━━━━━━━━
📄 Podkop config

config settings 'settings'
option dns_type 'doh'
option dns_server '1.1.1.1'
option bootstrap_dns_server '77.88.8.8'
option dns_rewrite_ttl '60'
option enable_output_network_interface '0'
option enable_badwan_interface_monitoring '0'
option enable_yacd '0'
option disable_quic '0'
option update_interval '1d'
option download_lists_via_proxy '0'
option dont_touch_dhcp '0'
option config_path '/etc/sing-box/config.json'
option cache_path '/tmp/sing-box/cache.db'
option log_level 'warn'
option exclude_ntp '0'
option shutdown_correctly '0'
list source_network_interfaces 'br-lan'
list source_network_interfaces 'VPN'

config section 'main'
option connection_type 'proxy'
option proxy_config_type 'url'
option enable_udp_over_tcp '0'
option proxy_string 'MASKED'
option user_domain_list_type 'text'
option user_domains_text '2ip.io
//googlevideo.com
4pda.to
'
option user_subnet_list_type 'disabled'
option mixed_proxy_enabled '1'
option mixed_proxy_port '1081'
list local_domain_lists '/root/vpn_domain_list.txt'

━━━━━━━━━━━━━━━━━━━━━━━━━━━
📄 WAN config
❌ WAN configuration not found
━━━━━━━━━━━━━━━━━━━━━━━━━━━
⚠️ Zapret detected
━━━━━━━━━━━━━━━━━━━━━━━━━━━
🥸 FakeIP status
✅ Router DNS is routed through sing-box
✅ Sing-box works with FakeIP: 198.18.0.7

Конфигурация синг бокса:

{
 "log": {
   "disabled": false,
   "level": "warn",
   "timestamp": false
 },
 "dns": {
   "servers": [
     {
       "type": "udp",
       "tag": "bootstrap-dns-server",
       "server": "MASKED",
       "server_port": "MASKED"
     },
     {
       "type": "https",
       "tag": "dns-server",
       "server": "MASKED",
       "server_port": "MASKED"
     },
     {
       "type": "fakeip",
       "tag": "fakeip-server",
       "inet4_range": "198.18.0.0/15"
     }
   ],
   "rules": [
     {
       "action": "reject",
       "query_type": "HTTPS"
     },
     {
       "action": "reject",
       "domain_suffix": "use-application-dns.net"
     },
     {
       "action": "route",
       "server": "MASKED",
       "rewrite_ttl": 60,
       "domain": [
         "fakeip.podkop.fyi",
         "ip.podkop.fyi"
       ],
       "rule_set": [
         "main-user-domains-ruleset",
         "main-local-domains-ruleset"
       ]
     }
   ],
   "final": "dns-server",
   "strategy": "ipv4_only",
   "independent_cache": true
 },
 "ntp": {},
 "certificate": {},
 "endpoints": [],
 "inbounds": [
   {
     "type": "tproxy",
     "tag": "tproxy-in",
     "listen": "127.0.0.1",
     "listen_port": 1602,
     "tcp_fast_open": true,
     "udp_fragment": true
   },
   {
     "type": "direct",
     "tag": "dns-in",
     "listen": "127.0.0.42",
     "listen_port": 53
   },
   {
     "type": "socks",
     "tag": "main-mixed-in",
     "listen": "192.168.0.1",
     "listen_port": 1081,
     "users": []
   }
 ],
 "outbounds": [
   {
     "type": "direct",
     "tag": "direct-out"
   },
   {
     "type": "vless",
     "tag": "main-out",
     "server": "MASKED",
     "server_port": "MASKED",
     "uuid": "MASKED"
   }
 ],
 "route": {
   "rules": [
     {
       "action": "sniff",
       "inbound": [
         "tproxy-in",
         "dns-in"
       ]
     },
     {
       "action": "hijack-dns",
       "protocol": "dns"
     },
     {
       "action": "route",
       "inbound": "tproxy-in",
       "outbound": "main-out",
       "domain": "ip.podkop.fyi"
     },
     {
       "action": "route-options",
       "domain": "fakeip.podkop.fyi",
       "override_port": 8443
     },
     {
       "action": "route",
       "inbound": "tproxy-in",
       "outbound": "main-out",
       "rule_set": [
         "main-user-domains-ruleset",
         "main-local-domains-ruleset"
       ]
     },
     {
       "action": "route",
       "inbound": "main-mixed-in",
       "outbound": "main-out"
     }
   ],
   "rule_set": [
     {
       "type": "local",
       "tag": "main-user-domains-ruleset",
       "format": "source",
       "path": "/tmp/sing-box/rulesets/main-user-domains-ruleset.json"
     },
     {
       "type": "local",
       "tag": "main-local-domains-ruleset",
       "format": "source",
       "path": "/tmp/sing-box/rulesets/main-local-domains-ruleset.json"
     }
   ],
   "final": "direct-out",
   "auto_detect_interface": true,
   "default_domain_resolver": "dns-server"
 },
 "services": [],
 "experimental": {
   "cache_file": {
     "enabled": true,
     "path": "/tmp/sing-box/cache.db",
     "store_fakeip": true
   },
   "clash_api": {
     "external_controller": "192.168.0.1:9090"
   }
 }
}  

Шаги для воспроизведения

1. Открываю чат джипити через выборочную маршрутизацию подкопа на роутере.
2. Все запросы висят бесконечно.

✅ Ожидаемое поведение

1. Сайт открывается и работает штатно.

🖥️ Информация о системе

- **OpenWrt версия**: 
- **Podkop версия**: 
- **Роутер модель**: 
- **Sing-box версия**:

⚙️ Конфигурация

[ampetelin]

Спрашивайте в чате https://t.me/itdogchat/81758

[ampetelin]

ПОдскажите, что может быть не так? Спасибо!

https://t.me/itdogchat/81758/1372647

Проверяйте ваш /etc/hosts на наличие посторонних записей

[hgcdtyt]

Спасибо большое, разобрался!