Notes
- If your local network use public IP ranges instead of private ones, make sure to add respecive
RETURN
rules to iptables to prevent looping issue - Set clash as DHCP's only DNS server to allow domain-based filter (shunting) rules work
- Use
lsof -i udp:53
to check if clash's DNS module work fine, otherwise you may have to killsystemd-resolved
and any other processes occupying the UDP 53 port - The given scripts will NOT hangle the traffic of gateway itself since it is not recommend to do so. If you want to redirect the egress traffic of the gateway, the following material may be useful
Reference