tproxy透明代理占用大量CPU

[edisonleung1]

Update：移除iptables udp部分后cpu占用正常

#1124 v2ray/v2ray-core#2621
类似以上情况，排除Limit的影响，iptables -t mangle -I V2RAY -m mark --mark 0xff -j RETURN 已添加

部署环境：E5-2689的esxi上debian虚拟机分配了2个核心1g内存

操作系统版本

root@Debian:/usr/local/etc/v2ray# uname -r
4.19.0-16-amd64

v2ray客户端版本

root@Debian:/usr/local/etc/v2ray# v2ray -version
V2Ray 4.32.1 (V2Fly, a community-driven edition of V2Ray.) Custom (go1.15.4 linux/amd64)
A unified platform for anti-censorship.

客户端配置

{
    "log":
    {
        "loglevel": "warning",
        "access": "/var/log/v2ray/access.log",
        "error": "/var/log/v2ray/error.log"
    },
    "routing":
    {
        "domainStrategy": "IPOnDemand",
        "rules":
        [
            {
                "type": "field",
                "inboundTag":
                [
                    "transparent"
                ],
                "port": 53,
                "network": "udp",
                "outboundTag": "dns-out"
            },
            {
                "type": "field",
                "inboundTag":
                [
                    "transparent"
                ],
                "port": 123,
                "network": "udp",
                "outboundTag": "direct"
            },
            {
                "type": "field",
                "ip":
                [
                    "8.8.8.8"
                ],
                "outboundTag": "US_LA"
            },
            {
                "type": "field",
                "ip":
                [
                    "223.5.5.5"
                ],
                "outboundTag": "CN_GZ"
            },
            {
                "type": "field",
                "domain":
                [
                    "geosite:category-ads-all"
                ],
                "outboundTag": "block"
            },
            {
                "type": "field",
                "protocol":
                [
                    "bittorrent"
                ],
                "outboundTag": "direct"
            },
            {
                "type": "field",
                "inboundtag":
                [
                    "transparent"
                ],
                "outboundTag": "US_LA",
                "domain":
                [
                    "geosite:spotify",
                    "geosite:hbo",
                    "geosite:netflix",
                    "geosite:steam",
                    "geosite:amazon"
                ]
            },
            {
                "type": "field",
                "inboundtag":
                [
                    "transparent"
                ],
                "outboundTag": "US_IV",
                "domain":
                [
                    "geosite:hulu"
                ]
            },
            {
                "type": "field",
                "inboundtag":
                [
                    "transparent"
                ],
                "outboundTag": "CN_GZ",
                "domain":
                [
                    "domain:speedtest.cn",
                    "geosite:bilibili",
                    "geosite:iqiyi",
                    "geosite:youku",
                    "geosite:umeng",
                    "geosite:aliyun",
                    "vv.video.qq.com",
                    "domain:nos.netease.com",
                    "domain:music.163.com",
                    "domain:music.126.net",
                    "domain:music.qq.com",
                    "domain:qqmusic.qq.com",
                    "domain:tencentmusic.com"
                ]
            }
        ]
    },
    "inbounds":
    [
        {
            "tag": "transparent",
            "protocol": "dokodemo-door",
            "port": 5000,
            "settings":
            {
                "network": "tcp,udp",
                "followRedirect": true
            },
            "sniffing":
            {
                "enabled": true,
                "destOverride":
                [
                    "http",
                    "tls"
                ]
            },
            "streamSettings":
            {
                "sockopt":
                {
                    "tproxy": "tproxy",
                    "mark": 255
                }
            }
        },
        {
            "tag": "vless",
            "protocol": "vless",
            "port": 443,
            "settings":
            {
                "clients":
                [
                    {
                        "id": "x",
                        "flow": "xtls-rprx-direct",
                        "level": 0
                    }
                ],
                "decryption": "none",
                "fallbacks":
                [
                    {
                        "dest": "/dev/shm/default.sock",
                        "xver": 1
                    },
                    {
                        "alpn": "h2",
                        "dest": "/dev/shm/h2c.sock",
                        "xver": 1
                    }
                ]
            },
            "streamSettings":
            {
                "network": "tcp",
                "security": "xtls",
                "xtlsSettings":
                {
                    "allowInsecure": false,
                    "alpn":
                    [
                        "h2",
                        "http/1.1"
                    ],
                    "certificates":
                    [
                        {
                            "certificateFile": "x",
                            "keyFile": "x"
                        }
                    ]
                }
            }
        }
    ],
    "outbounds":
    [
        {
            "tag": "direct",
            "protocol": "freedom",
            "settings":
            {
                "domainStrategy": "UseIP",
                "streamSettings":
                {
                    "sockopt":
                    {
                        "mark": 255
                    }
                }
            }
        },
        {
            "tag": "block",
            "protocol": "blackhole",
            "settings":
            {
                "response":
                {
                    "type": "http"
                }
            }
        },
        {
            "tag": "dns-out",
            "protocol": "dns",
            "streamSettings":
            {
                "sockopt":
                {
                    "mark": 255
                }
            }
        },
        {
            "tag": "US_LA",
            "protocol": "vless",
            "settings":
            {
                "vnext":
                [
                    {
                        "address": "x",
                        "port": 443,
                        "users":
                        [
                            {
                                "email": "a@a.a",
                                "id": "x",
                                "flow": "xtls-rprx-direct",
                                "encryption": "none",
                                "level": 0
                            }
                        ]
                    }
                ]
            },
            "streamSettings":
            {
                "network": "tcp",
                "security": "xtls",
                "xtlsSettings":
                {
                    "serverName": "x",
                    "sockopt":
                    {
                        "mark": 255
                    }
                }
            }
        },
        {
            "tag": "US_IV",
            "protocol": "vless",
            "settings":
            {
                "vnext":
                [
                    {
                        "address": "x",
                        "port": 443,
                        "users":
                        [
                            {
                                "email": "love@v2fly.org",
                                "id": "x",
                                "flow": "xtls-rprx-direct",
                                "encryption": "none",
                                "level": 0
                            }
                        ]
                    }
                ]
            },
            "network": "tcp",
            "security": "xtls",
            "xtlsSettings":
            {
                "serverName": "x"
            },
            "streamSettings":
            {
                "sockopt":
                {
                    "mark": 255
                }
            }
        },
        {
            "tag": "CN_GZ",
            "protocol": "vless",
            "settings":
            {
                "vnext":
                [
                    {
                        "address": "x",
                        "port": ,
                        "users":
                        [
                            {
                                "id": "x",
                                "encryption": "none",
                                "level": 0
                            }
                        ]
                    }
                ]
            },
            "streamSettings":
            {
                "sockopt":
                {
                    "mark": 255
                }
            }
        },
        {
            "tag": "CN_via_US",
            "protocol": "vless",
            "settings":
            {
                "vnext":
                [
                    {
                        "address": "x",
                        "port": X,
                        "users":
                        [
                            {
                                "id": "X",
                                "encryption": "none",
                                "level": 0
                            }
                        ]
                    }
                ]
            },
            "streamSettings":
            {
                "sockopt":
                {
                    "mark": 255
                }
            }
        }
    ],
    "dns":
    {
        "servers":
        [
            {
                "address": "223.5.5.5",
                "port": 53,
                "domains":
                [
                    "geosite:bilibili",
                    "geosite:aliyun",
                    "geosite:iqiyi",
                    "geosite:youku",
                    "geosite:umeng"
                ]
            },
            {
                "address": "8.8.8.8",
                "port": 53,
                "domains":
                [
                    "geosite:spotify",
                    "geosite:hbo",
                    "geosite:netflix",
                    "geosite:steam",
                    "geosite:hulu"
                ]
            }
        ]
    }
}

开启iptables情况

root@Debian:/usr/local/etc/v2ray# iptables --version
iptables v1.8.2 (nf_tables)

ip rule add fwmark 1 table 100 
ip route add local 0.0.0.0/0 dev lo table 100
iptables -t mangle -N V2RAY
iptables -t mangle -A V2RAY -d 127.0.0.1/32 -j RETURN
iptables -t mangle -A V2RAY -d 224.0.0.0/4 -j RETURN 
iptables -t mangle -A V2RAY -d 255.255.255.255/32 -j RETURN 
iptables -t mangle -A V2RAY -d 10.0.3.0/16 -p tcp -j RETURN 
iptables -t mangle -A V2RAY -d 10.0.3.0/16 -p udp ! --dport 53 -j RETURN
iptables -t mangle -A V2RAY -j RETURN -m mark --mark 0xff 
iptables -t mangle -A V2RAY -p udp -j TPROXY --on-ip 127.0.0.1 --on-port 5000 --tproxy-mark 1
iptables -t mangle -A V2RAY -p tcp -j TPROXY --on-ip 127.0.0.1 --on-port 5000 --tproxy-mark 1
iptables -t mangle -A PREROUTING -j V2RAY 
iptables -t mangle -N DIVERT
iptables -t mangle -A DIVERT -j MARK --set-mark 1
iptables -t mangle -A DIVERT -j ACCEPT
iptables -t mangle -I PREROUTING -p tcp -m socket -j DIVERT

v2ray服务

root@Debian:/usr/local/etc/v2ray# v2ray -version
V2Ray 4.32.1 (V2Fly, a community-driven edition of V2Ray.) Custom (go1.15.4 linux/amd64)
A unified platform for anti-censorship.
root@Debian:/usr/local/etc/v2ray# iptables --version
iptables v1.8.2 (nf_tables)
root@Debian:/usr/local/etc/v2ray# cat /etc/systemd/system/v2ray.service 
[Unit]
Description=V2Ray Service
Documentation=https://www.v2fly.org/
After=network.target nss-lookup.target

[Service]
User=nobody
CapabilityBoundingSet=CAP_NET_ADMIN CAP_NET_BIND_SERVICE
AmbientCapabilities=CAP_NET_ADMIN CAP_NET_BIND_SERVICE
NoNewPrivileges=true
ExecStart=/usr/local/bin/v2ray -config /usr/local/etc/v2ray/config.json
Restart=on-failure
RestartPreventExitStatus=23

[Install]
WantedBy=multi-user.target

占用CPU

root@Debian:/usr/local/etc/v2ray# top

top - 03:51:01 up 47 min,  1 user,  load average: 2.00, 1.84, 1.52
Tasks: 186 total,   1 running, 185 sleeping,   0 stopped,   0 zombie
%Cpu(s): 28.8 us, 38.5 sy,  0.0 ni,  1.0 id,  0.0 wa,  0.0 hi, 31.7 si,  0.0 st
MiB Mem :    986.1 total,     85.6 free,    405.3 used,    495.1 buff/cache
MiB Swap:   2045.0 total,   2045.0 free,      0.0 used.    503.2 avail Mem 

  PID USER      PR  NI    VIRT    RES    SHR S  %CPU  %MEM     TIME+ COMMAND                                                                                                      
 1888 nobody    20   0 4986384  99848  13636 S 195.7   9.9  22:32.42 v2ray