vps/hosts/gfw.windy.lan.md

gfw.windy.lan — OpenWrt LAN gateway

Role and access

Item	Value
Role	LAN gateway and OpenClash transparent/explicit-proxy host
IPv4	192.168.66.1
SSH	ssh -4 root@192.168.66.1 (key-only, verified 2026-08-06)
OS	ImmortalWrt 25.12.0 (r37854), Linux 6.12.87, x86/64

Do not store the root password in this repository.

OpenClash

OpenClash runs /etc/openclash/clash (clash_meta core) with configuration /etc/openclash/pass-cat.yaml.

• Core: Mihomo Meta v1.19.29 (linux-amd64, with_gvisor; upgraded from alpha-g9ae1cc2 on 2026-08-06, backup clash_meta.bak.alpha-g9ae1cc2) — tracked in Linear W1N-50

• OpenClash app: luci-app-openclash 0.47.133 (GitHub latest)

• Mode: fake-ip + TPROXY transparent proxy (operation_mode=fake-ip, en_mode=fake-ip, proxy_mode=rule); fake-ip network 198.18.0.0/16

• DNS path: dnsmasq → clash DNS 127.0.0.1#7874 (server=127.0.0.1#7874 in dnsmasq config); mosdns also listens on 127.0.0.1:6052 but is not the active resolver path

• nft: OpenClash injects TPROXY/redirect + DNS-hijack rules into table inet fw4; a residual table inet passwall exists with 0 packets (unused)

Listener	Port
HTTP	7890
SOCKS	7891
Redirect	7892
Mixed	7893
TPROXY	7895
DNS	7874
Dashboard	9090

8443 is not an OpenClash listener and has no runtime nftables forwarding rule. It is included only in OpenClash's common TLS-sniffing port list.

Operational note

When OpenClash logs a LAN client request such as <client> --> localhost:8443 followed by a connection refusal, it is normally an explicit-proxy client sending its own loopback request to the gateway. Fix the originating host's NO_PROXY / no_proxy configuration; do not create a listener on this router to mask the problem. See the UniFi localhost proxy note.