-A openclash -m conntrack --ctdir REPLY -j RETURN
-A openclash -d 198.18.*.*/16 -p tcp -j REDIRECT --to-ports 7892
-A openclash -m set --match-set china_ip_route dst -m set ! --match-set china_ip_route_pass dst -j RETURN
-A openclash -p tcp -j REDIRECT --to-ports 7892
-A openclash_output -m owner --gid-owner 65534 -j RETURN
-A openclash_output -d 198.18.*.*/16 -p tcp -j REDIRECT --to-ports 7892
-A openclash_output -m set --match-set localnetwork dst -j RETURN
-A openclash_output -m conntrack --ctdir REPLY -j RETURN
-A openclash_output -m set --match-set china_ip_route dst -m set ! --match-set china_ip_route_pass dst -j RETURN
-A openclash_output -p tcp -j REDIRECT --to-ports 7892
-A ts-postrouting -m mark --mark 0x40000/0xff0000 -j MASQUERADE
-A zone_VPN_postrouting -m comment --comment "!fw3: Custom VPN postrouting rule chain" -j postrouting_VPN_rule
-A zone_VPN_prerouting -m comment --comment "!fw3: Custom VPN prerouting rule chain" -j prerouting_VPN_rule
-A zone_docker_postrouting -m comment --comment "!fw3: Custom docker postrouting rule chain" -j postrouting_docker_rule
-A zone_docker_prerouting -m comment --comment "!fw3: Custom docker prerouting rule chain" -j prerouting_docker_rule
-A zone_lan_postrouting -j MINIUPNPD-POSTROUTING
-A zone_lan_postrouting -m comment --comment "!fw3: Custom lan postrouting rule chain" -j postrouting_lan_rule
-A zone_lan_prerouting -j MINIUPNPD
-A zone_lan_prerouting -m comment --comment "!fw3: Custom lan prerouting rule chain" -j prerouting_lan_rule
-A zone_vpn_postrouting -m comment --comment "!fw3: Custom vpn postrouting rule chain" -j postrouting_vpn_rule
-A zone_vpn_postrouting -m comment --comment "!fw3" -j MASQUERADE --mode fullcone
-A zone_vpn_prerouting -m comment --comment "!fw3: Custom vpn prerouting rule chain" -j prerouting_vpn_rule
-A zone_wan_postrouting -m comment --comment "!fw3: Custom wan postrouting rule chain" -j postrouting_wan_rule
-A zone_wan_postrouting -m comment --comment "!fw3" -j MASQUERADE --mode fullcone
-A zone_wan_prerouting -m comment --comment "!fw3: Custom wan prerouting rule chain" -j prerouting_wan_rule
COMMIT
# Completed on Mon Aug 3 01:22:34 2026

### IPv4 Mangle chain

bash
# iptables-save -t mangle
# Generated by iptables-save v1.8.7 on Mon Aug 3 01:22:34 2026
*mangle
:PREROUTING ACCEPT [335662:571590751]
:INPUT ACCEPT [335161:571572026]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [224538:559840656]
:POSTROUTING ACCEPT [224654:559855132]
:openclash - [0:0]
:openclash_output - [0:0]
:openclash_upnp - [0:0]
-A PREROUTING -p udp -j openclash
-A OUTPUT -p udp -j openclash_output
-A openclash -m set --match-set localnetwork dst -j RETURN
-A openclash -m conntrack --ctdir REPLY -j RETURN
-A openclash -d 198.18.*.*/16 -p udp -j TPROXY --on-port 7895 --on-ip 0.0.*.* --tproxy-mark 0x162/0xffffffff
-A openclash -m set --match-set china_ip_route dst -m set ! --match-set china_ip_route_pass dst -j RETURN
-A openclash -p udp -j openclash_upnp
-A openclash -p udp -j TPROXY --on-port 7895 --on-ip 0.0.*.* --tproxy-mark 0x162/0xffffffff
-A openclash_output -m owner --gid-owner 65534 -j RETURN
-A openclash_output -m set --match-set localnetwork dst -j RETURN
-A openclash_output -m conntrack --ctdir REPLY -j RETURN
-A openclash_output -d 198.18.*.*/16 -p udp -j MARK --set-xmark 0x162/0xffffffff
-A openclash_output -m set --match-set china_ip_route dst -m set ! --match-set china_ip_route_pass dst -j RETURN
-A openclash_output -p udp -j MARK --set-xmark 0x162/0xffffffff
COMMIT
# Completed on Mon Aug 3 01:22:34 2026

### IPv4 Filter chain

bash
# iptables-save -t filter
# Generated by iptables-save v1.8.7 on Mon Aug 3 01:22:34 2026
*filter
:INPUT ACCEPT [6:312]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [0:0]
:DOCKER - [0:0]
:DOCKER-BRIDGE - [0:0]
:DOCKER-CT - [0:0]