透明代理时只有路由器本身可以连通，局域网设备connection reset by peer错误

[JosephVuoto]

你正在使用哪个版本的 V2Ray？

V2Ray 5.7.0

你的使用场景是什么？

Ubuntu 22.04当主路由，路由器有6个网口，其中一个当WAN口，另外5个用bridge连通，网关地址为192.168.10.1。路由器通过DHCP从光猫获得IP地址为192.168.1.2。 路由和NAT相关的iptables config如下

WAN_NAME='enp3s0'

iptables -t nat -N mt_rtr_4_n_rtr
iptables -t nat -A POSTROUTING -j mt_rtr_4_n_rtr
iptables -t nat -A mt_rtr_4_n_rtr -o ${WAN_NAME} -j MASQUERADE

iptables -t mangle -N mt_rtr_4_m_rtr
iptables -t mangle -A FORWARD -j mt_rtr_4_m_rtr
iptables -t mangle -A mt_rtr_4_m_rtr -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -t mangle -A mt_rtr_4_m_rtr -m conntrack --ctstate INVALID -j DROP
iptables -t mangle -A mt_rtr_4_m_rtr -p tcp -m tcp ! --tcp-flags FIN,SYN,RST,ACK SYN -m state --state NEW -j DROP
iptables -t mangle -A mt_rtr_4_m_rtr -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,SYN,RST,PSH,ACK,URG -j DROP
iptables -t mangle -A mt_rtr_4_m_rtr -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG NONE -j DROP
iptables -t mangle -A mt_rtr_4_m_rtr -i br_lan -o ${WAN_NAME} -j ACCEPT

ip6tables -t nat -N mt_rtr_6_n_rtr
ip6tables -t nat -A POSTROUTING -j mt_rtr_6_n_rtr
ip6tables -t nat -A mt_rtr_6_n_rtr -o ${WAN_NAME} -j MASQUERADE

ip6tables -t mangle -N mt_rtr_6_m_rtr
ip6tables -t mangle -A FORWARD -j mt_rtr_6_m_rtr
ip6tables -t mangle -A mt_rtr_6_m_rtr -m state --state RELATED,ESTABLISHED -j ACCEPT
ip6tables -t mangle -A mt_rtr_6_m_rtr -m conntrack --ctstate INVALID -j DROP
ip6tables -t mangle -A mt_rtr_6_m_rtr -p tcp -m tcp ! --tcp-flags FIN,SYN,RST,ACK SYN -m state --state NEW -j DROP
ip6tables -t mangle -A mt_rtr_6_m_rtr -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,SYN,RST,PSH,ACK,URG -j DROP
ip6tables -t mangle -A mt_rtr_6_m_rtr -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG NONE -j DROP
ip6tables -t mangle -A mt_rtr_6_m_rtr -i br_lan -o ${WAN_NAME} -j ACCEPT

V2Ray的设置如下：

{
    "log": {
        "access": "/var/log/v2ray/access.log",
        "error": "/var/log/v2ray/error.log",
        "loglevel": "info"
    },
    "dns": {
        "servers": [
            "8.8.8.8",
            "1.1.1.1",
            "114.114.114.114",
            {
                "address": "223.5.5.5",
                "port": 53,
                "domains": [
                    "geosite:cn",
                    "ntp.org"
                ]
            }
        ]
    },
    "inbounds": [
        {
            "tag": "transparent",
            "port": 12345,
            "protocol": "dokodemo-door",
            "settings": {
                "network": "tcp,udp",
                "followRedirect": true
            },
            "sniffing": {
                "enabled": true,
                "destOverride": [
                    "http",
                    "tls"
                ]
            },
            "streamSettings": {
                "sockopt": {
                    "tproxy": "tproxy",
                    "mark":255
                }
            }
        },
        {
            "protocol": "socks",
            "listen": "0.0.0.0",
            "port": 10808,
            "tag": "Socks-In",
            "settings": {
                "ip": "127.0.0.1",
                "udp": true,
                "auth": "noauth"
            },
            "sniffing": {
                "enabled": true,
                "destOverride": [
                    "http",
                    "tls"
                ]
            }
        },
        {
            "protocol": "http",
            "listen": "0.0.0.0",
            "port": 10809,
            "tag": "Http-In",
            "sniffing": {
                "enabled": true,
                "destOverride": [
                    "http",
                    "tls"
                ]
            }
        }
    ],
    "outbounds": [
        {
            "protocol": "freedom",
            "settings": {
                "domainStrategy": "UseIP"
            },
            "streamSettings": {
                "sockopt": {
                    "mark": 255
                }
            },
            "tag": "direct"
        },
        {
            "tag": "proxy",
            "protocol": "vmess",
            "settings": {
                "vnext": [
                    {
                        "address": "xxx",
                        "port": xxx,
                        "users": [
                            {
                                "id": "xxx",
                                "alterId": 0,
                                "security": "auto"
                            }
                        ]
                    }
                ]
            },
            "streamSettings": {
                "network": "tcp",
                "tcpSettings": {
                    "header": {
                        "type": "http"
                    }
                },
                "sockopt": {
                    "mark": 255
                }
            },
            "mux": {
                "enabled": true
            }
        },
        {
            "protocol": "blackhole",
            "settings": {
                "response": {
                    "type": "http"
                }
            },
            "tag": "block"
        },
        {
            "protocol": "dns",
            "tag": "dns-out",
            "streamSettings": {
                "sockopt": {
                    "mark": 255
                }
            }
        }
    ],
    "routing": {
        "domainStrategy": "IPOnDemand",
        "rules": [
            {
                "type": "field",
                "inboundTag": [
                    "transparent"
                ],
                "port": 53,
                "network": "udp",
                "outboundTag": "dns-out"
            },
            {
                "type": "field",
                "inboundTag": [
                    "transparent"
                ],
                "port": 123,
                "network": "udp",
                "outboundTag": "direct"
            },
            {
                "type": "field",
                "ip": [
                    "223.5.5.5",
                    "114.114.114.114"
                ],
                "outboundTag": "direct"
            },
            {
                "type": "field",
                "ip": [
                    "8.8.8.8",
                    "1.1.1.1"
                ],
                "outboundTag": "proxy"
            },
            {
                "type": "field",
                "protocol": [
                    "bittorrent"
                ],
                "outboundTag": "direct"
            },
            {
                "type": "field",
                "ip": [
                    "geoip:!cn"
                ],
                "outboundTag": "proxy"
            },
            {
                "type": "field",
                "domain": [
                    "geosite:gfw"
                ],
                "outboundTag": "proxy"
            }
        ]
    }
}

透明代理配置如下

ip rule add fwmark 1 table 100
ip route add local 0.0.0.0/0 dev lo table 100

iptables -t mangle -N V2RAY
iptables -t mangle -A V2RAY -d 127.0.0.1/32 -j RETURN
iptables -t mangle -A V2RAY -d 224.0.0.0/4 -j RETURN
iptables -t mangle -A V2RAY -d 255.255.255.255/32 -j RETURN
iptables -t mangle -A V2RAY -d 192.168.0.0/16 -p tcp ! --dport 53 -j RETURN
iptables -t mangle -A V2RAY -d 192.168.0.0/16 -p udp ! --dport 53 -j RETURN
iptables -t mangle -A V2RAY -j RETURN -m mark --mark 0xff
iptables -t mangle -A V2RAY -p udp -j TPROXY --on-port 12345 --tproxy-mark 1
iptables -t mangle -A V2RAY -p tcp -j TPROXY --on-port 12345 --tproxy-mark 1
iptables -t mangle -A PREROUTING -j V2RAY

iptables -t mangle -N V2RAY_MASK
iptables -t mangle -A V2RAY_MASK -d 224.0.0.0/4 -j RETURN
iptables -t mangle -A V2RAY_MASK -d 255.255.255.255/32 -j RETURN
iptables -t mangle -A V2RAY_MASK -d 192.168.0.0/16 -p tcp ! --dport 53 -j RETURN
iptables -t mangle -A V2RAY_MASK -d 192.168.0.0/16 -p udp ! --dport 53 -j RETURN
iptables -t mangle -A V2RAY_MASK -j RETURN -m mark --mark 0xff
iptables -t mangle -A V2RAY_MASK -p udp -j MARK --set-mark 1
iptables -t mangle -A V2RAY_MASK -p tcp -j MARK --set-mark 1
iptables -t mangle -A OUTPUT -j V2RAY_MASK

你看到的异常现象是什么？

代理网关本机没问题，curl google.com可以连同。局域网内机器无法打开任何网站，DNS正常

你期待看到的正常表现是怎样的？

NA

请附上出错时软件输出的错误日志

客户端错误日志：

2023/08/29 13:43:43 [Info] [376304070] proxy/dokodemo: received request for 192.168.1.2:39622
2023/08/29 13:43:43 [Info] [1538128591] app/dispatcher: taking detour [proxy] for [tcp:54.92.199.186:80]
2023/08/29 13:43:43 [Info] [2651641517] app/proxyman/inbound: connection ends > proxy/dokodemo: connection ends > proxy/dokodemo: failed to transport request > read tcp 3.95.117.96:80->192.168.1.2:56212: read: connection reset by peer
2023/08/29 13:43:43 [Info] [1538128591] common/mux: dispatching request to tcp:54.92.199.186:80
2023/08/29 13:43:43 [Info] [3209821110] proxy/dokodemo: received request for 192.168.1.2:57972
2023/08/29 13:43:43 [Info] [1538128591] common/mux: failed to write first payload > io: read/write on closed pipe
2023/08/29 13:43:43 [Info] [2651641517] app/dispatcher: taking detour [proxy] for [tcp:3.95.117.96:80]
2023/08/29 13:43:43 [Info] [2651641517] common/mux: dispatching request to tcp:3.95.117.96:80
2023/08/29 13:43:43 [Info] [2651641517] common/mux: failed to write first payload > io: read/write on closed pipe
2023/08/29 13:43:43 [Info] [376304070] app/proxyman/inbound: connection ends > proxy/dokodemo: connection ends > proxy/dokodemo: failed to transport request > read tcp 34.231.24.224:80->192.168.1.2:39622: read: connection reset by peer
2023/08/29 13:43:43 [Info] [3209821110] app/proxyman/inbound: connection ends > proxy/dokodemo: connection ends > proxy/dokodemo: failed to transport request > read tcp 3.210.88.6:80->192.168.1.2:57972: read: connection reset by peer
2023/08/29 13:43:43 [Info] [3209821110] app/dispatcher: taking detour [proxy] for [tcp:3.210.88.6:80]
2023/08/29 13:43:43 [Info] [3209821110] common/mux: dispatching request to tcp:3.210.88.6:80
2023/08/29 13:43:43 [Info] [1904660706] proxy/dokodemo: received request for 192.168.1.2:34392
2023/08/29 13:43:43 [Info] [3209821110] common/mux: failed to write first payload > io: read/write on closed pipe
2023/08/29 13:43:43 [Info] [2571824366] proxy/dokodemo: received request for 192.168.1.2:44784
2023/08/29 13:43:43 [Info] [3175368519] proxy/dokodemo: received request for 192.168.1.2:50080
2023/08/29 13:43:43 [Info] [1904660706] app/proxyman/inbound: connection ends > proxy/dokodemo: connection ends > proxy/dokodemo: failed to transport request > read tcp 54.163.235.119:80->192.168.1.2:34392: read: connection reset by peer
2023/08/29 13:43:43 [Info] [1904660706] app/dispatcher: taking detour [proxy] for [tcp:54.163.235.119:80]
2023/08/29 13:43:43 [Info] [3175368519] app/proxyman/inbound: connection ends > proxy/dokodemo: connection ends > proxy/dokodemo: failed to transport request > read tcp 34.196.46.202:80->192.168.1.2:50080: read: connection reset by peer
2023/08/29 13:43:43 [Info] [1904660706] common/mux: dispatching request to tcp:54.163.235.119:80
2023/08/29 13:43:43 [Info] [2571824366] app/proxyman/inbound: connection ends > proxy/dokodemo: connection ends > proxy/dokodemo: failed to transport request > read tcp 54.225.153.205:80->192.168.1.2:44784: read: connection reset by peer
2023/08/29 13:43:43 [Info] [1904660706] common/mux: failed to write first payload > io: read/write on closed pipe
2023/08/29 13:43:43 [Info] [3175368519] app/dispatcher: taking detour [proxy] for [tcp:34.196.46.202:80]
2023/08/29 13:43:43 [Info] [3175368519] common/mux: dispatching request to tcp:34.196.46.202:80
2023/08/29 13:43:43 [Info] [3175368519] common/mux: failed to write first payload > io: read/write on closed pipe
2023/08/29 13:43:43 [Info] [2571824366] app/dispatcher: taking detour [proxy] for [tcp:54.225.153.205:80]
2023/08/29 13:43:43 [Info] [2571824366] common/mux: dispatching request to tcp:54.225.153.205:80
2023/08/29 13:43:43 [Info] [2571824366] common/mux: failed to write first payload > io: read/write on closed pipe

请附上访问日志

// 在这里附上服务器端日志

其它相关的配置文件（如 Nginx）和相关日志

如果 V2Ray 无法启动，请附上 --test 命令的输出

如果 V2Ray 服务运行异常，请附上 journal 日志