Document UniFi OpenClash proxy bypass

hosts/gfw.windy.lan.md

@@ -0,0 +1,40 @@
+# gfw.windy.lan — OpenWrt LAN gateway
+
+## Role and access
+
+| Item | Value |
+|---|---|
+| Role | LAN gateway and OpenClash transparent/explicit-proxy host |
+| IPv4 | `192.168.66.1` |
+| SSH | `ssh -4 root@192.168.66.1` |
+| OS | OpenWrt, Linux `6.12.87` |
+
+Do not store the root password in this repository. Prefer a verified SSH key for
+future management access.
+
+## OpenClash
+
+OpenClash runs `/etc/openclash/clash` with configuration
+`/etc/openclash/pass-cat.yaml`.
+
+| Listener | Port |
+|---|---:|
+| HTTP | `7890` |
+| SOCKS | `7891` |
+| Redirect | `7892` |
+| Mixed | `7893` |
+| TPROXY | `7895` |
+| DNS | `7874` |
+
+`8443` is not an OpenClash listener and has no runtime nftables forwarding rule.
+It is included only in OpenClash's common TLS-sniffing port list.
+
+## Operational note
+
+When OpenClash logs a LAN client request such as
+`<client> --> localhost:8443` followed by a connection refusal, it is normally
+an explicit-proxy client sending its own loopback request to the gateway. Fix
+the originating host's `NO_PROXY` / `no_proxy` configuration; do not create a
+listener on this router to mask the problem. See
+[the UniFi localhost proxy note](../docs/unifi-openclash-localhost.md).
+