From 1c147c31370fcffb325874f8dd68f47ac22bf812 Mon Sep 17 00:00:00 2001
From: "github-actions[bot]" <github-actions[bot]@users.noreply.github.com>
Date: Thu, 2 Jul 2026 00:17:29 +0800
Subject: [PATCH] =?UTF-8?q?=F0=9F=90=A4=20Sync=202026-07-02=2000:17:29?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 luci-app-ssr-plus/Makefile                    |  2 +-
 .../luasrc/controller/shadowsocksr.lua        |  4 ++--
 luci-app-ssr-plus/root/usr/bin/ssr-rules      | 24 +++++++++++++++++++
 3 files changed, 27 insertions(+), 3 deletions(-)

diff --git a/luci-app-ssr-plus/Makefile b/luci-app-ssr-plus/Makefile
index 052b2c8e1..885949f76 100644
--- a/luci-app-ssr-plus/Makefile
+++ b/luci-app-ssr-plus/Makefile
@@ -4,7 +4,7 @@ LUCI_TITLE:=luci-app-ssr-plus
 LUCI_PKGARCH:=all
 PKG_NAME:=luci-app-ssr-plus
 PKG_VERSION:=196
-PKG_RELEASE:=36
+PKG_RELEASE:=37
 
 PKG_CONFIG_DEPENDS:= \
 	CONFIG_PACKAGE_$(PKG_NAME)_Iptables_Transparent_Proxy \
diff --git a/luci-app-ssr-plus/luasrc/controller/shadowsocksr.lua b/luci-app-ssr-plus/luasrc/controller/shadowsocksr.lua
index 4e677264f..78826aeca 100644
--- a/luci-app-ssr-plus/luasrc/controller/shadowsocksr.lua
+++ b/luci-app-ssr-plus/luasrc/controller/shadowsocksr.lua
@@ -1463,8 +1463,8 @@ function act_ping()
 			iret = luci.sys.call("ipset add ss_spec_wan_ac " .. domain .. " 2>/dev/null") == 0
 		end
 	end
-	-- Hysteria2 节点轻量 UDP 端口检测
-	if proto:find("hysteria2") or type:find("hysteria2") then
+	-- Hysteria2、TUIC 节点轻量 UDP 端口检测
+	if proto:find("hysteria2") or type:find("hysteria2") or proto:find("tuic") or type:find("tuic") then
 		local udp_cmd = string.format("nping --udp -c 1 -p %d %s 2>/dev/null", port, domain)
 		local udp_raw = luci.sys.exec(udp_cmd) or ""
 		local udp_rtt = udp_raw:match("Avg rtt:%s*([0-9.]+)ms")
diff --git a/luci-app-ssr-plus/root/usr/bin/ssr-rules b/luci-app-ssr-plus/root/usr/bin/ssr-rules
index de945169c..0eaf0266f 100755
--- a/luci-app-ssr-plus/root/usr/bin/ssr-rules
+++ b/luci-app-ssr-plus/root/usr/bin/ssr-rules
@@ -136,6 +136,26 @@ check_ip_list_changed() {
 	fi
 }
 
+# Configure kernel parameters for TPROXY support
+set_tproxy_sysctl() {
+	# Disable IPv4 rp_filter for TPROXY compatibility.
+	# rp_filter (Reverse Path Filtering) must be disabled for TPROXY to work properly
+	sysctl -w net.ipv4.conf.all.rp_filter=0 >/dev/null 2>&1
+	sysctl -w net.ipv4.conf.default.rp_filter=0 >/dev/null 2>&1
+
+	# Disable redirects to prevent routing issues
+	# sysctl -w net.ipv4.conf.all.accept_redirects=0 >/dev/null 2>&1
+	# sysctl -w net.ipv4.conf.all.send_redirects=0 >/dev/null 2>&1
+
+	# Disable rp_filter for all network interfaces
+	local f
+	for f in /proc/sys/net/ipv4/conf/*/rp_filter; do
+		echo 0 > "$f" 2>/dev/null
+	done
+
+	loger 6 "TPROXY sysctl settings applied"
+}
+
 # Cleanup persistence and runtime module files
 cleanup_persistence_files() {
 	if [ "$USE_NFT" != "1" ]; then
@@ -807,6 +827,10 @@ ac_rule_iptables() {
 
 tp_rule() {
 	[ -n "$TPROXY" ] || return 0
+
+	# Apply sysctl settings for TPROXY
+	set_tproxy_sysctl
+
 	if [ "$USE_NFT" = "1" ]; then
 		tp_rule_nft
 	else