@DJCNMHG
原来 mullvad 和 tor 有合作啊
第一次见用 pf 的服务商😇

```
cat pfdump.txt
r scrub-anchor "com.apple/*" all fragment reassemble
r anchor "com.apple/*" all
r anchor "mullvad" all
n nat-anchor "com.apple/*" all
n rdr-anchor "com.apple/*" all
n rdr-anchor "mullvad" all
A com.apple
A mullvad
com.apple r anchor "200.AirDrop/*" all
com.apple r anchor "250.ApplicationFirewall/*" all
com.apple A com.apple/200.AirDrop
com.apple A com.apple/250.ApplicationFirewall
mullvad r pass quick on lo0 all flags any keep state
mullvad r pass out quick inet proto udp from any port = 68 to 255.255.255.255 port = 67 no state
mullvad r pass in quick inet proto udp from any port = 67 to any port = 68 no state
mullvad r pass out quick inet6 proto udp from fe80::/10 port = 546 to ff02::1:2 port = 547 no state
mullvad r pass out quick inet6 proto udp from fe80::/10 port = 546 to ff05::1:3 port = 547 no state
mullvad r pass in quick inet6 proto udp from fe80::/10 port = 547 to fe80::/10 port = 546 no state
mullvad r pass out quick inet6 proto ipv6-icmp from any to ff02::2 icmp6-type routersol no state
mullvad r pass in quick inet6 proto ipv6-icmp from fe80::/10 to any icmp6-type routeradv no state
mullvad r pass in quick inet6 proto ipv6-icmp from fe80::/10 to any icmp6-type redir no state
mullvad r pass out quick inet6 proto ipv6-icmp from any to ff02::1:ff00:0/104 icmp6-type neighbrsol no state
mullvad r pass out quick inet6 proto ipv6-icmp from any to fe80::/10 icmp6-type neighbrsol no state
mullvad r pass in quick inet6 proto ipv6-icmp from fe80::/10 to any icmp6-type neighbrsol no state
mullvad r pass out quick inet6 proto ipv6-icmp from any to fe80::/10 icmp6-type neighbradv no state
mullvad r pass in quick inet6 proto ipv6-icmp all icmp6-type neighbradv no state
mullvad r pass out quick on utun3 inet proto tcp from any to 100.64.0.31 port = 53 flags S/SA keep state
mullvad r pass out quick on utun3 inet proto udp from any to 100.64.0.31 port = 53 no state
mullvad r pass out quick inet proto tcp from any to 186.243.5.35 port = 443 user = 0 flags S/SA keep state
mullvad r block return out quick proto tcp from any to any port = 53
mullvad r block return out quick proto udp from any to any port = 53
mullvad r pass quick on utun3 all flags S/SA keep state
mullvad r pass out quick inet from any to 10.0.0.0/8 no state
mullvad r pass in quick inet from 10.0.0.0/8 to any no state
mullvad r pass out quick inet from any to 172.16.0.0/12 no state
mullvad r pass in quick inet from 172.16.0.0/12 to any no state
mullvad r pass out quick inet from any to 192.168.0.0/16 no state
mullvad r pass in quick inet from 192.168.0.0/16 to any no state
mullvad r pass out quick inet from any to 169.254.0.0/16 no state
mullvad r pass in quick inet from 169.254.0.0/16 to any no state
mullvad r pass out quick inet6 from any to fe80::/10 no state
mullvad r pass in quick inet6 from fe80::/10 to any no state
mullvad r pass out quick inet6 from any to fc00::/7 no state
mullvad r pass in quick inet6 from fc00::/7 to any no state
mullvad r pass out quick inet from any to 255.255.255.255 no state
mullvad r pass out quick inet from any to 224.0.0.0/24 no state
mullvad r pass out quick inet from any to 239.0.0.0/8 no state
mullvad r pass out quick inet6 from any to ff01::/16 no state
mullvad r pass out quick inet6 from any to ff02::/16 no state
mullvad r pass out quick inet6 from any to ff03::/16 no state
mullvad r pass out quick inet6 from any to ff04::/16 no state
mullvad r pass out quick inet6 from any to ff05::/16 no state
mullvad r pass out quick inet proto udp from any port = 67 to any port = 68 no state
mullvad r pass in quick inet proto udp from any port = 68 to 255.255.255.255 port = 67 no state
mullvad r block return out quick all
mullvad r block drop quick all

```

用 pf 的不多吧
这家 vpn 会用到 pf 吗

@wsjjacky 这个设置界面 ui 太难受了 还不如 ipad 呢

监管机?

只能说 nb.

波动厉害是因为 isp 限速策略不行吗

@FaiChou 要看各自的设置和 log 了

@lcdtyph
原来是这样啊 解惑了
https://www.v2ex.com/t/590555
不知道这哥们解决了吗

firewall 不是问题 macos 上有 pf

之前测试 google one vbn
它的 utun 会路由所有的 v4 v6
第一次遇到遇到路由 v6 的 即使本机没有 v6 地址
而且会修改 dns 到 8.8.8.8 4.4 和对应的 v6 地址
cat /etc/resolv.conf
里面是这样显示的

系统设置里面的自定义 dns 已经失效了 google 的 dns 最优先了
不知道用什么方法实现的

@MrGba2z 但是软件也可以不遵守规则强制使用某一个
哪个软件这么厉害?
要怎么应对?

@lcdtyph

所有路由给 utun33
小🐱遇到 ip direct 的时候是怎么处理的
比如让 223.5.5.5 直连 走 default en10 出去
从系统原理上和代码上怎么理解
怎么避免产生回环的?

netstat -rnf inet
Routing tables

Internet:
Destination Gateway Flags Netif Expire
default 192.168.88.1 UGScg en10
1 198.18.0.1 UGSc utun33
2/7 198.18.0.1 UGSc utun33
4/6 198.18.0.1 UGSc utun33
8/5 198.18.0.1 UGSc utun33
16/4 198.18.0.1 UGSc utun33
32/3 198.18.0.1 UGSc utun33
64/2 198.18.0.1 UGSc utun33
127 127.0.0.1 UCS lo0
127.0.0.1 127.0.0.1 UH lo0
128.0/1 198.18.0.1 UGSc utun33
169.254 link#7 UCS en10 !
192.168.88 link#7 UCS en10 !
192.168.88.1/32 link#7 UCS en10 !
192.168.88.1 cd:cd:cd:cd:cd:cd UHLWIir en10 1179
192.168.88.8/32 link#7 UCS en10 !
192.168.88.255 ff:ff:ff:ff:ff:ff UHLWbI en10 !
198.18.0.1 198.18.0.1 UH utun33

Flags：路由的标志位
U：Up: 路由处于活动状态。
H：Host: 路由目标是单个主机。
G：Gateway: 所有发到目的地的网络传到这一远程系统上， 并由它决定最后发到哪里。
S：Static: 这个路由是手工配置的，不是由系统自动生成的。
C：Clone: 生成一个新的路由， 通过这个路由我们可以连接上这些机子。 这种类型的路由通常用于本地网络。
W：WasCloned: 指明一个路由――它是基于本地区域网络 (克隆) 路由自动配置的。
L：Link: 路由涉及到了以太网硬件。
Netif： 网络接口，如 en0 ，是我的机器默认 wifi 接口，而 lo0 表示本机（“回环设备”），也就是这条规则的包不通过 Lan 来发出

差不多是这样:?
sudo route add -net 1.0.0.0/8 198.18.0.1
sudo route add -net 2.0.0.0/7 198.18.0.1
sudo route add -net 4.0.0.0/6 198.18.0.1
sudo route add -net 8.0.0.0/5 198.18.0.1
sudo route add -net 16.0.0.0/4 198.18.0.1
sudo route add -net 32.0.0.0/3 198.18.0.1
sudo route add -net 64.0.0.0/2 198.18.0.1
sudo route add -net 128.0.0.0/1 198.18.0.1
sudo route add -net 198.18.0.0/15 198.18.0.1

@ranaanna net.inet.ip.forwarding=1 后 ,其它设备设置网关为 macos 也能上网, nat 的意义是为了隐藏内网设备吗

@xxbing 和谐小组大佬?

问问网关

联通第二条宽带有加 10 元/月的活动吗