update 2026-07-01 22:23:49

luci-app-ssr-plus/luasrc/controller/shadowsocksr.lua

@@ -1407,8 +1407,8 @@ function act_ping()
 			iret = luci.sys.call("ipset add ss_spec_wan_ac " .. domain .. " 2>/dev/null") == 0
 		end
 	end
-	-- Hysteria2 节点轻量 UDP 端口检测
-	if proto:find("hysteria2") or type:find("hysteria2") then
+	-- Hysteria2、TUIC 节点轻量 UDP 端口检测
+	if proto:find("hysteria2") or type:find("hysteria2") or proto:find("tuic") or type:find("tuic") then
 		local udp_cmd = string.format("nping --udp -c 1 -p %d %s 2>/dev/null", port, domain)
 		local udp_raw = luci.sys.exec(udp_cmd) or ""
 		local udp_rtt = udp_raw:match("Avg rtt:%s*([0-9.]+)ms")

luci-app-ssr-plus/root/usr/bin/ssr-rules

@@ -136,6 +136,26 @@ check_ip_list_changed() {
 	fi
 }
 
+# Configure kernel parameters for TPROXY support
+set_tproxy_sysctl() {
+	# Disable IPv4 rp_filter for TPROXY compatibility.
+	# rp_filter (Reverse Path Filtering) must be disabled for TPROXY to work properly
+	sysctl -w net.ipv4.conf.all.rp_filter=0 >/dev/null 2>&1
+	sysctl -w net.ipv4.conf.default.rp_filter=0 >/dev/null 2>&1
+
+	# Disable redirects to prevent routing issues
+	# sysctl -w net.ipv4.conf.all.accept_redirects=0 >/dev/null 2>&1
+	# sysctl -w net.ipv4.conf.all.send_redirects=0 >/dev/null 2>&1
+
+	# Disable rp_filter for all network interfaces
+	local f
+	for f in /proc/sys/net/ipv4/conf/*/rp_filter; do
+		echo 0 > "$f" 2>/dev/null
+	done
+
+	loger 6 "TPROXY sysctl settings applied"
+}
+
 # Cleanup persistence and runtime module files
 cleanup_persistence_files() {
 	if [ "$USE_NFT" != "1" ]; then
@@ -807,6 +827,10 @@ ac_rule_iptables() {
 
 tp_rule() {
 	[ -n "$TPROXY" ] || return 0
+
+	# Apply sysctl settings for TPROXY
+	set_tproxy_sysctl
+
 	if [ "$USE_NFT" = "1" ]; then
 		tp_rule_nft
 	else