@
zhu327808 本质上都是按 fakeip 分流了，不管是本机用 ipt 、nft ，还是静态路由到旁路，其实没有太大的区别，都是先按域名分成 fakeip 和 realip ，体验的区别主要是分流的精细度，你的方案对于列表外的域名是怎么分的？可以看看我的
方案
https://v2ex.com/t/1057357再分享一个 nft 的规则，我简化了一下，没有写奈飞 ip 电报 ip 的国外公共 dns ip ，可以自己按需添加。
table inet singbox {
set local_ipv4 {
type ipv4_addr
flags interval
elements = {
28.0.0.0/8
}
}
set local_ipv6 {
type ipv6_addr
flags interval
elements = {
fc00::/18
}
}
set router_ipv4 {
type ipv4_addr
flags interval
elements = {
28.0.0.0/8
}
}
set router_ipv6 {
type ipv6_addr
flags interval
elements = {
fc00::/18
}
}
chain singbox-tproxy {
meta l4proto udp meta mark set 1 tproxy to :7895 accept
}
chain singbox-mark {
meta mark set 1
}
chain mangle-prerouting {
type filter hook prerouting priority mangle; policy accept;
ip daddr @
local_ipv4 meta l4proto udp ct direction original goto singbox-tproxy
ip6 daddr @
local_ipv6 meta l4proto udp ct direction original goto singbox-tproxy
}
chain mangle-output {
type route hook output priority mangle; policy accept;
ip daddr @
router_ipv4 meta l4proto udp ct direction original goto singbox-mark
ip6 daddr @
router_ipv6 meta l4proto udp ct direction original goto singbox-mark
}
chain nat-prerouting {
type nat hook prerouting priority dstnat; policy accept;
ip daddr @
local_ipv4 meta l4proto tcp redirect to :7899
ip6 daddr @
local_ipv6 meta l4proto tcp redirect to :7899
}
chain nat-output {
type nat hook output priority filter; policy accept;
ip daddr @
router_ipv4 meta l4proto tcp redirect to :7899
ip6 daddr @
router_ipv6 meta l4proto tcp redirect to :7899
}
}