使用的机场，在旁路由配置透明代理，DNS无法正常解析

[cyboca]

配置参考的这个教程：
https://xtls.github.io/document/level-2/tproxy_ipv4_and_ipv6.html#%E5%AE%A2%E6%88%B7%E7%AB%AF%E9%85%8D%E7%BD%AE

config.json如下：

{
  "log": {
    "access": "/var/log/xray/access.log",
    "error": "/var/log/xray/error.log",
    "loglevel": "warning",
    "dnslog": true
  },
  "inbounds": [
    {
      "tag": "all-in",
      "port": 12345,
      "protocol": "tunnel",
      "settings": {
        "allowedNetwork": "tcp,udp",
        "followRedirect": true
      },
      "sniffing": {
        "enabled": true,
        "destOverride": [
          "http",
          "tls",
          "quic"
        ]
      },
      "streamSettings": {
        "sockopt": {
          "tproxy": "tproxy"
        }
      }
    },
    {
      "port": 10808,
      "protocol": "socks",
      "sniffing": {
        "enabled": true,
        "destOverride": [
          "http",
          "tls",
          "quic"
        ]
      },
      "settings": {
        "auth": "noauth",
        "udp": true
      }
    }
  ],
  "outbounds": [
    {
      "tag": "proxy",
      "protocol": "vless",
      "settings": {
        "vnext": [
          {
            "address": "example.com",
            "port": 443,
            "users": [
              {
                "id": "example.id",
                "email": "t@t.tt",
                "security": "auto",
                "encryption": "none",
                "flow": "xtls-rprx-vision"
              }
            ]
          }
        ]
      },
      "streamSettings": {
        "sockopt": {
          "mark": 255
        },
        "network": "raw",
        "security": "reality",
        "realitySettings": {
          "serverName": "portal.citygrainla.com",
          "fingerprint": "chrome",
          "show": false,
          "publicKey": "examplepubkey",
          "shortId": "shortid",
          "spiderX": "",
          "mldsa65Verify": ""
        }
      },
      "mux": {
        "enabled": false,
        "concurrency": -1
      }
    },
    {
      "tag": "direct",
      "protocol": "freedom",
      "settings": {
        "domainStrategy": "UseIP"
      },
      "streamSettings": {
        "sockopt": {
          "mark": 255
        }
      }
    },
    {
      "tag": "block",
      "protocol": "blackhole",
      "settings": {
        "response": {
          "type": "http"
        }
      }
    },
    {
      "tag": "dns-out",
      "protocol": "dns",
      "streamSettings": {
        "sockopt": {
          "mark": 255
        }
      }
    }
  ],
  "dns": {
    "hosts": {
      "domain:googleapis.cn": "googleapis.com",
      "dns.google": "8.8.8.8",
      "example.com": "1.2.3.4"
    },
    "servers": [
      "223.5.5.5",
      {
        "address": "119.29.29.29",
        "domains": [
          "geosite:cn"
        ],
        "expectIPs": [
          "geoip:cn"
        ]
      },
      "https://1.1.1.1/dns-query",
      "https://dns.google/dns-query",
      "localhost"
    ]
  },
  "routing": {
    "domainMatcher": "mph",
    "domainStrategy": "IPIfNonMatch",
    "rules": [
      {
        "ip": [
          "119.29.29.29",
          "223.5.5.5"
        ],
        "outboundTag": "direct"
      },
      {
        "domain": [
          "geosite:category-ads-all"
        ],
        "outboundTag": "block"
      },
      {
        "inboundTag": [
          "all-in"
        ],
        "port": 123,
        "network": "udp",
        "outboundTag": "direct"
      },
      {
        "inboundTag": [
          "all-in"
        ],
        "port": 53,
        "network": "udp",
        "outboundTag": "dns-out"
      },
      {
        "protocol": [
          "bittorrent"
        ],
        "outboundTag": "direct"
      },
      {
        "ip": [
          "geoip:private",
          "geoip:cn"
        ],
        "outboundTag": "direct"
      },
      {
        "domain": [
          "geosite:cn"
        ],
        "outboundTag": "direct"
      },
      {
        "ip": [
          "1.1.1.1",
          "8.8.8.8"
        ],
        "outboundTag": "proxy"
      },
      {
        "domain": [
          "geosite:geolocation-!cn",
          "domain:googleapis.cn",
          "dns.google"
        ],
        "outboundTag": "proxy"
      }
    ]
  }
}

iptables如下：

# 代理网关本机 v4
iptables -t mangle -N XRAY_MASK
iptables -t mangle -A XRAY_MASK -d 224.0.0.0/4 -j RETURN
iptables -t mangle -A XRAY_MASK -d 255.255.255.255/32 -j RETURN
iptables -t mangle -A XRAY_MASK -d 192.168.31.0/24 -p tcp -j RETURN
iptables -t mangle -A XRAY_MASK -d 192.168.31.0/24 -p udp ! --dport 53 -j RETURN
iptables -t mangle -A XRAY_MASK -j RETURN -m mark --mark 0xff
iptables -t mangle -A XRAY_MASK -p udp -j MARK --set-mark 1
iptables -t mangle -A XRAY_MASK -p tcp -j MARK --set-mark 1
iptables -t mangle -A OUTPUT -j XRAY_MASK




# 新建 DIVERT 规则，避免已有连接的包二次通过 TPROXY，理论上有一定的性能提升 v4
iptables -t mangle -N DIVERT
iptables -t mangle -A DIVERT -j MARK --set-mark 1
iptables -t mangle -A DIVERT -j ACCEPT
iptables -t mangle -I PREROUTING -p tcp -m socket -j DIVERT


iptables -t mangle -S XRAY
iptables -t mangle -S XRAY_MASK
iptables -t mangle -S DIVERT

从抓包看，DNS的流量mark走到了1，而不是255，所有DNS解析全都失败

[Smallthing]

你自己配错 这不属于issues
交给ai矫正iptables规则吧

[cyboca]

第一，问题已经解决了，不是iptables的问题，是inbound里的protocol tunnel错了，改回dokodemo-door就好了。这个tunnel知道为什么就是不行，教程上是这么写的。
第二，我这个也不是提的issue啊……