41 lines
1.2 KiB
Markdown
41 lines
1.2 KiB
Markdown
|
# gfw.windy.lan — OpenWrt LAN gateway
|
||
|
|
|
||
|
|
## Role and access
|
||
|
|
|
||
|
|
| Item | Value |
|
||
|
|
|---|---|
|
||
|
|
| Role | LAN gateway and OpenClash transparent/explicit-proxy host |
|
||
|
|
| IPv4 | `192.168.66.1` |
|
||
|
|
| SSH | `ssh -4 root@192.168.66.1` |
|
||
|
|
| OS | OpenWrt, Linux `6.12.87` |
|
||
|
|
|
||
|
|
Do not store the root password in this repository. Prefer a verified SSH key for
|
||
|
|
future management access.
|
||
|
|
|
||
|
|
## OpenClash
|
||
|
|
|
||
|
|
OpenClash runs `/etc/openclash/clash` with configuration
|
||
|
|
`/etc/openclash/pass-cat.yaml`.
|
||
|
|
|
||
|
|
| Listener | Port |
|
||
|
|
|---|---:|
|
||
|
|
| HTTP | `7890` |
|
||
|
|
| SOCKS | `7891` |
|
||
|
|
| Redirect | `7892` |
|
||
|
|
| Mixed | `7893` |
|
||
|
|
| TPROXY | `7895` |
|
||
|
|
| DNS | `7874` |
|
||
|
|
|
||
|
|
`8443` is not an OpenClash listener and has no runtime nftables forwarding rule.
|
||
|
|
It is included only in OpenClash's common TLS-sniffing port list.
|
||
|
|
|
||
|
|
## Operational note
|
||
|
|
|
||
|
|
When OpenClash logs a LAN client request such as
|
||
|
|
`<client> --> localhost:8443` followed by a connection refusal, it is normally
|
||
|
|
an explicit-proxy client sending its own loopback request to the gateway. Fix
|
||
|
|
the originating host's `NO_PROXY` / `no_proxy` configuration; do not create a
|
||
|
|
listener on this router to mask the problem. See
|
||
|
|
[the UniFi localhost proxy note](../docs/unifi-openclash-localhost.md).
|
||
|
|
|