mirror of
https://github.com/kiddin9/op-packages.git
synced 2026-10-29 01:35:13 +08:00
83 lines
2.5 KiB
YAML
83 lines
2.5 KiB
YAML
# Default meow-rs configuration shipped with the OpenWrt package.
|
|
# Edit this file, then restart the service: /etc/init.d/meow restart
|
|
# Full reference: https://github.com/madeye/meow-rs/blob/main/config.example.yaml
|
|
|
|
# Combined HTTP + SOCKS5 proxy for LAN clients.
|
|
mixed-port: 7890
|
|
allow-lan: true
|
|
bind-address: "0.0.0.0"
|
|
|
|
mode: rule
|
|
log-level: info
|
|
ipv6: false
|
|
|
|
# REST API + built-in web panel (served at /ui). The init script overrides
|
|
# the address with `--ext-ctl 0.0.0.0:<panel_port>` and, when set, the secret
|
|
# with `--secret <secret>` from /etc/config/meow, so LuCI always knows how to
|
|
# reach it. OpenWrt's default firewall still blocks WAN-side access.
|
|
external-controller: 0.0.0.0:9090
|
|
secret: ""
|
|
|
|
# SO_MARK for DIRECT sockets (loop avoidance on Linux).
|
|
routing-mark: 9527
|
|
|
|
# Transparent-proxy listener for forwarded LAN traffic (gateway / side-router
|
|
# mode, enabled in LuCI or via `uci set meow.tproxy.enabled=1`). Must bind a
|
|
# non-loopback IPv4 address; the port must match `tproxy_port` in
|
|
# /etc/config/meow.
|
|
#
|
|
# `firewall: false` leaves all rule management to gateway.sh (this package's
|
|
# nftables rules) — meow makes no nft calls itself. `udp: true` enables UDP
|
|
# TPROXY, which requires `firewall: false`, an IPv4 listen, and the
|
|
# deployer-owned fwmark + policy routing that gateway.sh's `tproxy` mode sets
|
|
# up. In `redirect` mode gateway.sh uses nat REDIRECT and only TCP is proxied;
|
|
# the same listener accepts it (UDP is simply never delivered).
|
|
listeners:
|
|
- name: tproxy-lan
|
|
type: tproxy
|
|
listen: 0.0.0.0
|
|
port: 7893
|
|
udp: true
|
|
firewall: false
|
|
# A gateway serves many concurrent flows from every LAN client; the 256
|
|
# default saturates under a few busy devices and stalls new connections.
|
|
# 0 = unlimited.
|
|
max-connections: 4096
|
|
|
|
# Recover hostnames for connections made to raw IPs.
|
|
sniffer:
|
|
enable: true
|
|
override-destination: false
|
|
sniff:
|
|
TLS: { ports: [443] }
|
|
HTTP: { ports: [80] }
|
|
|
|
dns:
|
|
enable: true
|
|
# dnsmasq owns :53; meow's resolver listens on 1053. LAN DNS is redirected
|
|
# here when transparent proxy + DNS hijack are enabled (`dns_port`).
|
|
listen: 0.0.0.0:1053
|
|
enhanced-mode: fake-ip
|
|
fake-ip-range: 198.18.0.0/16
|
|
nameserver:
|
|
- 223.5.5.5
|
|
- 8.8.8.8
|
|
|
|
# Add your proxies and groups here, e.g.:
|
|
# proxies:
|
|
# - name: "ss-example"
|
|
# type: ss
|
|
# server: 1.2.3.4
|
|
# port: 8388
|
|
# cipher: aes-256-gcm
|
|
# password: "your-password"
|
|
# udp: true
|
|
#
|
|
# proxy-groups:
|
|
# - name: "PROXY"
|
|
# type: select
|
|
# proxies: ["ss-example", "DIRECT"]
|
|
|
|
rules:
|
|
- MATCH,DIRECT
|