mirror of
https://github.com/MHSanaei/3x-ui.git
synced 2026-05-26 07:08:01 +00:00
d7f47d8b6a
Xray-core v26.4.17 added a default policy that blocks private IPs in the freedom outbound for vless/vmess/trojan/hysteria/wireguard inbounds, even when the panel's routing rules send traffic to direct (#4420). The legacy ipsBlocked override was deprecated in the same release. Default template now seeds the direct outbound with a finalRules entry that explicitly allows geoip:private, so users who intentionally remove the geoip:private->blocked routing rule actually regain LAN access. Defense in depth is preserved: the routing rule still blocks private IPs by default, so unmodified configs keep the same behavior. OutboundFormModal exposes a Final Rules editor under the Freedom section: per-rule action (allow/block), network, port, IP/CIDR/geoip tags, and an optional blockDelay for block actions.
86 lines
1.5 KiB
JSON
86 lines
1.5 KiB
JSON
{
|
|
"api": {
|
|
"services": [
|
|
"HandlerService",
|
|
"LoggerService",
|
|
"StatsService"
|
|
],
|
|
"tag": "api"
|
|
},
|
|
"inbounds": [{
|
|
"listen": "127.0.0.1",
|
|
"port": 62789,
|
|
"protocol": "tunnel",
|
|
"settings": {
|
|
"rewriteAddress": "127.0.0.1"
|
|
},
|
|
"tag": "api"
|
|
}],
|
|
"log": {
|
|
"access": "none",
|
|
"dnsLog": false,
|
|
"error": "",
|
|
"loglevel": "warning",
|
|
"maskAddress": ""
|
|
},
|
|
"metrics": {
|
|
"listen": "127.0.0.1:11111",
|
|
"tag": "metrics_out"
|
|
},
|
|
"outbounds": [{
|
|
"protocol": "freedom",
|
|
"settings": {
|
|
"domainStrategy": "AsIs",
|
|
"finalRules": [
|
|
{ "action": "allow", "ip": ["geoip:private"] }
|
|
]
|
|
},
|
|
"tag": "direct"
|
|
},
|
|
{
|
|
"protocol": "blackhole",
|
|
"settings": {},
|
|
"tag": "blocked"
|
|
}
|
|
],
|
|
"policy": {
|
|
"levels": {
|
|
"0": {
|
|
"statsUserDownlink": true,
|
|
"statsUserUplink": true
|
|
}
|
|
},
|
|
"system": {
|
|
"statsInboundDownlink": true,
|
|
"statsInboundUplink": true,
|
|
"statsOutboundDownlink": false,
|
|
"statsOutboundUplink": false
|
|
}
|
|
},
|
|
"routing": {
|
|
"domainStrategy": "AsIs",
|
|
"rules": [{
|
|
"inboundTag": [
|
|
"api"
|
|
],
|
|
"outboundTag": "api",
|
|
"type": "field"
|
|
},
|
|
{
|
|
"ip": [
|
|
"geoip:private"
|
|
],
|
|
"outboundTag": "blocked",
|
|
"type": "field"
|
|
},
|
|
{
|
|
"outboundTag": "blocked",
|
|
"protocol": [
|
|
"bittorrent"
|
|
],
|
|
"type": "field"
|
|
}
|
|
]
|
|
},
|
|
"stats": {}
|
|
} |