#!/usr/sbin/nft -f flush ruleset define RESERVED_IP = { 10.0.0.0/8, 100.64.0.0/10, 127.0.0.0/8, 169.254.0.0/16, 172.16.0.0/12, 192.0.0.0/24, 224.0.0.0/4, 240.0.0.0/4, 255.255.255.255/32 } table ip xray { chain prerouting { type filter hook prerouting priority mangle; policy accept; ip daddr $RESERVED_IP return ip daddr 192.168.0.0/16 tcp dport != 53 return ip daddr 192.168.0.0/16 udp dport != 53 return ip protocol tcp tproxy to 127.0.0.1:12345 meta mark set 1 ip protocol udp tproxy to 127.0.0.1:12345 meta mark set 1 } chain output { type route hook output priority mangle; policy accept; ip daddr $RESERVED_IP return ip daddr 192.168.0.0/16 tcp dport != 53 return ip daddr 192.168.0.0/16 udp dport != 53 return meta mark 2 return ip protocol tcp meta mark set 1 ip protocol udp meta mark set 1 } }

使用方法

将上述配置写入一个文件（如 nft.conf），欧博abg之后将该文件赋予可执行权限，欧博官网最后使用 root 权限执行该文件即可（# ./nft.conf）。