openwrt 下配置 dnsmasq 指定域名 的 ipv6 流量到 wireguard 接口

[wuruxu]

dnsmasq ipset 配置

config ipset
	list name 'wgset'
	list name 'wgset6'
	list domain 'mvnrepository.com'
	list domain '.googlemail.com'
	list domain '.astrill.com'
	list domain '.panoramio.com'
	list domain '.googlezip.net'
	list domain '.gvt0.com'
	list domain '.gmodules.com'
	list domain '.blogger.com'

添加文件 nftables.d/20-mangle-wgset.nft

chain mangle_prerouting_wgset {
	type filter hook prerouting priority mangle; policy accept;
	ip daddr @wgset meta mark set 0x00003c85 counter accept
	ip6 daddr @wgset6 meta mark set 0x00003c86 counter accept
}

chain mangle_output_wgset {
	type route hook output priority mangle; policy accept;
	ip daddr @wgset meta mark set 0x00003c85 counter accept
	ip6 daddr @wgset6 meta mark set 0x0000386 counter accept
}

添加路由规则到 /etc/config/network

config route
        option interface 'wg1'
        option target '0.0.0.0/0'
        option table '110'

config route6
        option interface 'wg1'
        option target '::0/0'
        option table '120'

config rule
        option mark '0x3c85'
        option lookup '110'

config rule6
        option mark '0x3c86'
        option lookup '120'

添加 wireguard zone 到 /etc/config/firewall
```
config zone
option name 'wireguard'
list network 'wg1'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'ACCEPT'
option masq '1'
option masq6 '1'
option mtu_fix '1'

```

[laucenmi]

一直没空去研究 fw4 ，有这些规则可以升级 openwrt22 去了