# gfw.windy.lan — OpenWrt LAN gateway

## Role and access

| Item | Value |
|---|---|
| Role | LAN gateway and OpenClash transparent/explicit-proxy host |
| IPv4 | `192.168.66.1` |
| SSH | `ssh -4 root@192.168.66.1` (key-only, verified 2026-08-06) |
| OS | ImmortalWrt 25.12.0 (r37854), Linux `6.12.87`, x86/64 |

Do not store the root password in this repository.

## OpenClash

OpenClash runs `/etc/openclash/clash` (clash_meta core) with configuration
`/etc/openclash/pass-cat.yaml`.

- Core: **Mihomo Meta v1.19.29** (linux-amd64, with_gvisor; upgraded from
  `alpha-g9ae1cc2` on 2026-08-06, backup `clash_meta.bak.alpha-g9ae1cc2`) —
  tracked in Linear W1N-50
- OpenClash app: **luci-app-openclash 0.47.133** (GitHub latest)

- Mode: **fake-ip + TPROXY transparent proxy** (`operation_mode=fake-ip`,
  `en_mode=fake-ip`, `proxy_mode=rule`); fake-ip network `198.18.0.0/16`
- DNS path: dnsmasq → clash DNS `127.0.0.1#7874` (`server=127.0.0.1#7874` in
  dnsmasq config); `mosdns` also listens on `127.0.0.1:6052` but is not the
  active resolver path
- nft: OpenClash injects TPROXY/redirect + DNS-hijack rules into
  `table inet fw4`; a residual `table inet passwall` exists with 0 packets (unused)

| Listener | Port |
|---|---:|
| HTTP | `7890` |
| SOCKS | `7891` |
| Redirect | `7892` |
| Mixed | `7893` |
| TPROXY | `7895` |
| DNS | `7874` |
| Dashboard | `9090` |

`8443` is not an OpenClash listener and has no runtime nftables forwarding rule.
It is included only in OpenClash's common TLS-sniffing port list.

## Operational note

When OpenClash logs a LAN client request such as
`<client> --> localhost:8443` followed by a connection refusal, it is normally
an explicit-proxy client sending its own loopback request to the gateway. Fix
the originating host's `NO_PROXY` / `no_proxy` configuration; do not create a
listener on this router to mask the problem. See
[the UniFi localhost proxy note](../docs/unifi-openclash-localhost.md).