pfSense 配置 clash(mihomo) 透明代理教程

2025-1-12 8:32

5,693

1200 字

5 分钟

Clash（mihomo）是一款功能强大的跨平台代理工具，主要用于管理代理规则和流量分流。支持多种代理协议（如 HTTP(S)、SOCKS5、Shadowsocks、VMess等）。提供灵活的规则分流功能，可根据域名、IP和GeoIP分流流量。支持YAML配置文件，易于配置和扩展。

MosDNS是一款高性能的DNS解析工具，专注于解决DNS劫持、分流和缓存问题。支持多上游DNS查询，按规则分流。提供DNS-over-HTTPS (DoH)、DNS-over-TLS (DoT) 等加密查询支持。内置缓存功能，提高DNS解析效率。支持复杂的过滤和规则匹配，用于屏蔽广告或定向解析。

Clash（mihomo）官方版本在freebsd平台上tun功能不可用。近期 Vincent-Loeng 大佬对mihomo代码进行了更新，让freebsd平台的mihomo有了tun功能。现在只需mihomo一个软件就可以在pfSense上实现透明代理。同时配合使用MosDNS进行DNS精准分流，可以组成一个完整的代理与流量管理解决方案。

下面介绍在pfSense CE（或plus）上配置Clash（mihomo）透明代理的方法。

测试环境：pfSense CE 2.8.0/pfSense plus 25.03-BETA。

前提条件

测试有效的Clash配置文件
防火墙基础网络连通性正常
已启用 SSH 并完成系统备份

安装方法

使用一键脚本进行安装，在系统重置或升级后插件功将继续保留。

访问Clash for pfSense项目，下载安装包并解压缩，使用finalShell软件将文件上传至pfSense的/root目录，进入安装目录，运行命令安装：

sh install.sh

安装过程如下图所示：

代理配置

1.修改配置

导航到VPN>Proxy Suite 菜单，修改clash（ proxies和rules部分) 内容并保存。安装包默认配置DNS指向MosDNS，通过MosDNS进行DNS分流。点击启动按钮，根据日志信息排查配置错误。

2.DNS设置

clash默认配置使用53端口接管防火墙DNS解析，为避免冲突，需要将DNS解析器修改为非53端口或直接禁用。

3.添加接口

转到接口>分配，添加tun_3000接口，不用分配IP和网关。

4.路由设置

clash配置文件中”auto-route”选项设置为true，开启自动路由。如下图所示：

tun:
  mtu: 9000
  enable: true
  stack: system
  device: tun_3000
  auto-route: true
  strict-route: true
  auto-detect-interface: true
  dns-hijack:
    - any:53
    - tcp://any:53

5.添加规则

在tun接口上添加一条规则，允许tun子网互相访问。

6.开机启动

转到服务>shellcmd，添加两条开机启动条目，分别启动clash和mosdns。如下图所示：

7.检查测试

设置完成，客户端检查是否能正常进行透明代理，访问 ip111.cn，查看分流是否正常。

访问ip.skk.moe，检查是否可以正常访问国外网站。

8.仪表盘

默认配置文件开启了clash api功能，可以访问http://lan_ip:9090/ui登录clash仪表盘查看代理连接信息。

9.订阅更新

安装脚本已集成clash订阅在线转换程序，除了在Web端手动更新外，也可以设置定时任务，自动更新。转到服务>cron，单击添加任务，设置和命令如下图所示，表示每周六的凌晨3点自动更新订阅。

10.程序更新

安装包集成了mosdns所使用GeoIP数据和clash程序更新脚本，使用clash的socks5（7891端口）代理进行更新。设置和命令如下图所示，表示每周六的2点自动开始更新。

注意事项

卸载插件，运行sh uninstall.sh。
如果无法正常分流或访问外网，可以通过clash运行日志进行分析排查。
为保证顺利进行路由，系统>路由管理，v4和v6的默认网关必须设置为Automatic。
默认安装配置已针透明代理进行了优化，用户仅需修改clash的proxy和rule部分配置即可实现透明代理。

附件下载

Clash(mihomo) for pfSense

OPNsense 配置clash(mihomo)透明代理教程

clash mihomo mosdns 透明代理

1510m

3 年前
2023-3-18 22:40:10

我的clash for windows配置文件中有一句 listen: ‘127.0.0.1:35353’。请问这个应该怎么改？
—————–
dns:
enable: true
listen: ‘127.0.0.1:35353’
default-nameserver: [223.5.5.5, 114.114.114.114]
enhanced-mode: fake-ip
fake-ip-range: 198.18.0.1/16
…
——————–
- 1510m
  
  1510m
  
  3 年前
  2023-3-19 9:03:51
  
  解决了，这里不用改。
  注意上边allow-lan: false 改成allow-lan:true
- - 鉄血男兒
    博主
    1510m
    
    3 年前
    2023-3-22 12:23:31
    
    OK
being

3 年前
2023-4-22 12:36:25

外网访问clash的socks代理怎么访问，能出一期教程吗？
- being
  
  being
  
  3 年前
  2023-4-22 16:45:22
  
  设置透明代理后，无线ap无法访问网络
- - 鉄血男兒
    博主
    being
    
    3 年前
    2023-4-23 11:29:57
    
    有线能访问，无线不能访问，找找无线配置的问题。
luo

2 年前
2023-6-23 23:53:36

配置了透明代理之后内网的设备可以正常透明代理上网，但是防火墙本身不走代理访问网站，博主知道该咋设置吗？
- 鉄血男兒
  博主
  luo
  
  2 年前
  2023-6-25 11:01:00
  
  目前还没找到办法，也没有这种需求。
lim

2 年前
2023-10-16 23:53:29

如果从clash复制出来config后又自己修改过的话，一定要记得不能有空行！！！！这个插件估计文件检查比较严格，clash客户端或者直接运行clash core的话，config带有空行不影响运行，但是这个插件不行。今天换成clash premium core，一度以为是不支持，结果就是单纯我的config有空行。。。。
- 鉄血男兒
  博主
  lim
  
  2 年前
  2023-10-18 22:36:37
  
  clash.meta内核没这么讲究。
鉄血男兒
博主

已编辑

2 年前
2023-12-19 9:59:10

clash已删库，可以使用clash meta(mihomo)内核来替换。
dadada

2 年前
2024-4-06 19:53:10

I can’t find the clash.meta kerne and also Clash script program what do you name it? system proxy? i hope there a tutorial for this on youtube it will be great to have this.
- 鉄血男兒
  博主
  dadada
  
  已编辑
  
  2 年前
  2024-4-07 11:43:12
  
  😔
蓝

已编辑

1 年前
2024-8-02 18:53:06

版本
OPNsense 24.7-amd64
FreeBSD 14.1-RELEASE-p2
OpenSSL 3.0.14
运行安装脚本之后 service clash start 端口没起来 service clash status 显示没运行
root@OPN:~/clash # service clash status
clash is not running.
- 鉄血男兒
  博主
  蓝
  
  1 年前
  2024-8-03 10:32:28
  
  检查CLASH配置文件是否正确，你可以运行“/usr/local/bin/clash -d /usr/local/etc/clash”进行测试，看是否能正常跑码
- - 蓝
    
    鉄血男兒
    
    已编辑
    
    1 年前
    2024-8-03 11:53:05
    
    回复 This program can only be run on AMD64 processors with v3 microarchitecture support.
    是因为cpu不支持么？CPU为j1900v4
  - - 蓝
      
      蓝
      
      1 年前
      2024-8-03 12:05:47
      
      OK我找到原因了是站长下载的内核非兼容版无法运行起来替换兼容版mihomo-freebsd-amd64-compatible-v1.18.7.gz
      解决问题
    - - 蓝
        
        蓝
        
        1 年前
        2024-8-03 13:16:08
        
        出现新问题配置透明代理完成后启动
        Starting squid.
        CPU Usage: 0.021 seconds = 0.021 user + 0.000 sys
        Maximum Resident Size: 62464 KB
        Page faults with physical i/o: 0
        2024/08/03 05:15:32| Processing Configuration File: /usr/local/etc/squid/squid.conf (depth 0)
        2024/08/03 05:15:32| Starting Authentication on port 127.0.0.1:3128
        2024/08/03 05:15:32| Disabling Authentication on port 127.0.0.1:3128 (interception enabled)
        2024/08/03 05:15:32| Starting Authentication on port [::1]:3128
        2024/08/03 05:15:32| Disabling Authentication on port [::1]:3128 (interception enabled)
        2024/08/03 05:15:32| Starting Authentication on port 127.0.0.1:3129
        2024/08/03 05:15:32| Disabling Authentication on port 127.0.0.1:3129 (interception enabled)
        2024/08/03 05:15:32| Starting Authentication on port [::1]:3129
        2024/08/03 05:15:32| Disabling Authentication on port [::1]:3129 (interception enabled)
        2024/08/03 05:15:32| WARNING: empty ACL: acl bump_nobumpsites ssl::server_name “/usr/local/etc/squid/nobumpsites.acl”
        2024/08/03 05:15:32| Processing Configuration File: /usr/local/etc/squid/pre-auth/40-snmp.conf (depth 1)
        2024/08/03 05:15:32| Processing Configuration File: /usr/local/etc/squid/pre-auth/dummy.conf (depth 1)
        2024/08/03 05:15:32| Processing Configuration File: /usr/local/etc/squid/pre-auth/parentproxy.conf (depth 1)
        2024/08/03 05:15:32| ERROR: ACL not found: Safe_ports
        2024/08/03 05:15:32| Not currently OK to rewrite swap log.
        2024/08/03 05:15:32| storeDirWriteCleanLogs: Operation aborted.
        2024/08/03 05:15:32| FATAL: Bungled /usr/local/etc/squid/squid.conf line 99: http_access deny !Safe_ports !unrestricted
        2024/08/03 05:15:32| Squid Cache (Version 6.10): Terminated abnormally.
        /usr/local/etc/rc.d/squid: WARNING: failed to start squid
        
        出现新问题配置透明代理完成后启动 Starting squid. CPU Usage: 0.021 seconds = 0.021 user + 0.000 sys Maximum Resident Size: 62464 KB Page faults with physical i/o: 0 2024/08/03 05:15:32| Processing Configuration File: /usr/local/etc/squid/squid.conf (depth 0) 2024/08/03 05:15:32| Starting Authentication on port 127.0.0.1:3128 2024/08/03 05:15:32| Disabling Authentication on port 127.0.0.1:3128 (interception enabled) 2024/08/03 05:15:32| Starting Authentication on port [::1]:3128 2024/08/03 05:15:32| Disabling Authentication on port [::1]:3128 (interception enabled) 2024/08/03 05:15:32| Starting Authentication on port 127.0.0.1:3129 2024/08/03 05:15:32| Disabling Authentication on port 127.0.0.1:3129 (interception enabled) 2024/08/03 05:15:32| Starting Authentication on port [::1]:3129 2024/08/03 05:15:32| Disabling Authentication on port [::1]:3129 (interception enabled) 2024/08/03 05:15:32| WARNING: empty ACL: acl bump_nobumpsites ssl::server_name "/usr/local/etc/squid/nobumpsites.acl" 2024/08/03 05:15:32| Processing Configuration File: /usr/local/etc/squid/pre-auth/40-snmp.conf (depth 1) 2024/08/03 05:15:32| Processing Configuration File: /usr/local/etc/squid/pre-auth/dummy.conf (depth 1) 2024/08/03 05:15:32| Processing Configuration File: /usr/local/etc/squid/pre-auth/parentproxy.conf (depth 1) 2024/08/03 05:15:32| ERROR: ACL not found: Safe_ports 2024/08/03 05:15:32| Not currently OK to rewrite swap log. 2024/08/03 05:15:32| storeDirWriteCleanLogs: Operation aborted. 2024/08/03 05:15:32| FATAL: Bungled /usr/local/etc/squid/squid.conf line 99: http_access deny !Safe_ports !unrestricted 2024/08/03 05:15:32| Squid Cache (Version 6.10): Terminated abnormally. /usr/local/etc/rc.d/squid: WARNING: failed to start squid
      - 蓝
        
        蓝
        
        1 年前
        2024-8-03 13:27:38
        
        最新版本
        缺少两条访问控制才能启动
        /usr/local/etc/squid/squid.conf
        acl Safe_ports port 80
        acl SSL_ports port 443
        启动成功！
      - 鉄血男兒
        博主
        蓝
        
        1 年前
        2024-8-04 11:25:36
        
        这两条命令，应该可以在正向代理>访问控制列表，允许目标tcp端口处进行添加，教程添加了这一部分内容。
      - 蓝
        
        鉄血男兒
        
        已编辑
        
        1 年前
        2024-8-12 17:20:17
        
        尝试按你说的加这两条规则发现不行会导致访问任何网站都报ssl错误
        。。。。。
        教程有完善我再测试一下
        。。。。。。
        再修改 app都能用就电报不行奇了怪了
      - 鉄血男兒
        博主
        蓝
        
        1 年前
        2024-8-13 8:48:08
        
        我测试了是可以的。下面是的我squid.conf的配置。
        #
        # Automatic generated configuration for Squid.
        # Do not edit this file manually.
        #
        
        # Setup transparent mode listeners on loopback interfaces
        http_port 127.0.0.1:3128 intercept ssl-bump cert=/var/squid/ssl/ca.pem dynamic_cert_mem_cache_size=10MB generate-host-certificates=on
        http_port [::1]:3128 intercept ssl-bump cert=/var/squid/ssl/ca.pem dynamic_cert_mem_cache_size=10MB generate-host-certificates=on
        https_port 127.0.0.1:3129 intercept ssl-bump cert=/var/squid/ssl/ca.pem dynamic_cert_mem_cache_size=10MB generate-host-certificates=on
        https_port [::1]:3129 intercept ssl-bump cert=/var/squid/ssl/ca.pem dynamic_cert_mem_cache_size=10MB generate-host-certificates=on
        
        # Setup regular listeners configuration
        http_port 192.168.101.250:3128 ssl-bump cert=/var/squid/ssl/ca.pem dynamic_cert_mem_cache_size=10MB generate-host-certificates=on
        
        # setup ssl re-cert
        sslcrtd_program /usr/local/libexec/squid/security_file_certgen -s /var/squid/ssl_crtd -M 10MB
        sslcrtd_children 25
        
        tls_outgoing_options options=NO_TLSv1 cipher=HIGH:MEDIUM:!RC4:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS
        
        # setup ssl bump acl’s
        acl bump_step1 at_step SslBump1
        acl bump_step2 at_step SslBump2
        acl bump_step3 at_step SslBump3
        acl bump_nobumpsites ssl::server_name “/usr/local/etc/squid/nobumpsites.acl”
        
        # configure bump
        ssl_bump peek bump_step1 all
        ssl_bump splice all
        ssl_bump peek bump_step2 all
        ssl_bump splice bump_step3 all
        ssl_bump bump
        
        sslproxy_cert_error deny all
        
        acl ftp proto FTP
        http_access allow ftp
        
        # Setup ftp proxy
        
        # Rules allowing access from your local networks.
        # Generated list of (internal) IP networks from where browsing
        # should be allowed. (Allow interface subnets).
        acl localnet src 192.168.101.0/24 # Possible internal network (interfaces v4)
        # Default allow for local-link and private networks
        acl localnet src fc00::/7 # RFC 4193 local private network range
        acl localnet src fe80::/10 # RFC 4291 link-local (directly plugged) machines
        
        # ACL – Allow localhost for PURGE cache if enabled
        
        # ACL lists
        
        # ACL – Remote fetched Blacklist (remoteblacklist)
        
        # ACL – Block browser/user-agent – User defined (browser)
        
        # ACL – SSL ports, default are configured in config.xml
        acl SSL_ports port 443 # https
        
        # Default Safe ports are now defined in config.xml
        # ACL – Safe_ports
        acl Safe_ports port 80 # http
        acl Safe_ports port 21 # ftp
        acl Safe_ports port 443 # https
        acl Safe_ports port 70 # gopher
        acl Safe_ports port 210 # wais
        acl Safe_ports port 1025-65535 # unregistered ports
        acl Safe_ports port 280 # http-mgmt
        acl Safe_ports port 488 # gss-http
        acl Safe_ports port 591 # filemaker
        acl Safe_ports port 777 # multiling http
        acl CONNECT method CONNECT
        
        # ICAP SETTINGS
        # disable icap
        icap_enable off
        
        # Pre-auth plugins
        include /usr/local/etc/squid/pre-auth/*.conf
        
        # Authentication Settings
        
        # Google Suite Filter
        
        # YouTube Filter
        request_header_add YouTube-Restrict moderate
        
        # Deny requests to certain unsafe ports
        
        http_access deny !Safe_ports
        # Deny CONNECT to other than secure SSL ports
        
        http_access deny CONNECT !SSL_ports
        
        # Only allow cachemgr access from localhost
        http_access allow localhost manager
        http_access deny manager
        
        # We strongly recommend the following be uncommented to protect innocent
        # web applications running on the proxy server who think the only
        # one who can access services on “localhost” is a local user
        http_access deny to_localhost
        
        # Auth plugins
        include /usr/local/etc/squid/auth/*.conf
        
        #
        # Access Permission configuration:
        #
        # Deny request from unauthorized clients
        
        #
        # ACL – localnet – default these include ranges from selected interfaces (Allow local subnets)
        http_access allow localnet
        
        # ACL – localhost
        http_access allow localhost
        
        # Deny all other access to this proxy
        http_access deny all
        # Post-auth plugins
        include /usr/local/etc/squid/post-auth/*.conf
        
        # Caching settings
        cache deny all
        cache_mem 0
        
        # Leave coredumps in the first cache dir
        coredump_dir /var/squid/cache
        
        #
        # Add any of your own refresh_pattern entries above these.
        #
        
        refresh_pattern ^ftp: 1440 20% 10080
        refresh_pattern ^gopher: 1440 0% 1440
        refresh_pattern -i (/cgi-bin/|\?) 0 0% 0
        refresh_pattern . 0 20% 4320
        
        # Squid Options
        pinger_enable off
        # Disable access logging
        access_log none
        
        # Disable cache store log
        cache_store_log none
        # Suppress http version string (default=off)
        httpd_suppress_version_string on
        # URI handling with Whitespaces (default=strip)
        uri_whitespace strip
        # Disable squid logfile rotate to use system defaults
        logfile_rotate 0
        # Define visible hostname
        visible_hostname wall.pfchina.org
        # Define visible email
        cache_mgr [email protected]
        
        # Set error directory language
        error_directory /usr/local/share/squid-langpack/en
        
        我测试了是可以的。下面是的我squid.conf的配置。 # # Automatic generated configuration for Squid. # Do not edit this file manually. # # Setup transparent mode listeners on loopback interfaces http_port 127.0.0.1:3128 intercept ssl-bump cert=/var/squid/ssl/ca.pem dynamic_cert_mem_cache_size=10MB generate-host-certificates=on http_port [::1]:3128 intercept ssl-bump cert=/var/squid/ssl/ca.pem dynamic_cert_mem_cache_size=10MB generate-host-certificates=on https_port 127.0.0.1:3129 intercept ssl-bump cert=/var/squid/ssl/ca.pem dynamic_cert_mem_cache_size=10MB generate-host-certificates=on https_port [::1]:3129 intercept ssl-bump cert=/var/squid/ssl/ca.pem dynamic_cert_mem_cache_size=10MB generate-host-certificates=on # Setup regular listeners configuration http_port 192.168.101.250:3128 ssl-bump cert=/var/squid/ssl/ca.pem dynamic_cert_mem_cache_size=10MB generate-host-certificates=on # setup ssl re-cert sslcrtd_program /usr/local/libexec/squid/security_file_certgen -s /var/squid/ssl_crtd -M 10MB sslcrtd_children 25 tls_outgoing_options options=NO_TLSv1 cipher=HIGH:MEDIUM:!RC4:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS # setup ssl bump acl's acl bump_step1 at_step SslBump1 acl bump_step2 at_step SslBump2 acl bump_step3 at_step SslBump3 acl bump_nobumpsites ssl::server_name "/usr/local/etc/squid/nobumpsites.acl" # configure bump ssl_bump peek bump_step1 all ssl_bump splice all ssl_bump peek bump_step2 all ssl_bump splice bump_step3 all ssl_bump bump sslproxy_cert_error deny all acl ftp proto FTP http_access allow ftp # Setup ftp proxy # Rules allowing access from your local networks. # Generated list of (internal) IP networks from where browsing # should be allowed. (Allow interface subnets). acl localnet src 192.168.101.0/24 # Possible internal network (interfaces v4) # Default allow for local-link and private networks acl localnet src fc00::/7 # RFC 4193 local private network range acl localnet src fe80::/10 # RFC 4291 link-local (directly plugged) machines # ACL - Allow localhost for PURGE cache if enabled # ACL lists # ACL - Remote fetched Blacklist (remoteblacklist) # ACL - Block browser/user-agent - User defined (browser) # ACL - SSL ports, default are configured in config.xml acl SSL_ports port 443 # https # Default Safe ports are now defined in config.xml # ACL - Safe_ports acl Safe_ports port 80 # http acl Safe_ports port 21 # ftp acl Safe_ports port 443 # https acl Safe_ports port 70 # gopher acl Safe_ports port 210 # wais acl Safe_ports port 1025-65535 # unregistered ports acl Safe_ports port 280 # http-mgmt acl Safe_ports port 488 # gss-http acl Safe_ports port 591 # filemaker acl Safe_ports port 777 # multiling http acl CONNECT method CONNECT # ICAP SETTINGS # disable icap icap_enable off # Pre-auth plugins include /usr/local/etc/squid/pre-auth/*.conf # Authentication Settings # Google Suite Filter # YouTube Filter request_header_add YouTube-Restrict moderate # Deny requests to certain unsafe ports http_access deny !Safe_ports # Deny CONNECT to other than secure SSL ports http_access deny CONNECT !SSL_ports # Only allow cachemgr access from localhost http_access allow localhost manager http_access deny manager # We strongly recommend the following be uncommented to protect innocent # web applications running on the proxy server who think the only # one who can access services on "localhost" is a local user http_access deny to_localhost # Auth plugins include /usr/local/etc/squid/auth/*.conf # # Access Permission configuration: # # Deny request from unauthorized clients # # ACL - localnet - default these include ranges from selected interfaces (Allow local subnets) http_access allow localnet # ACL - localhost http_access allow localhost # Deny all other access to this proxy http_access deny all # Post-auth plugins include /usr/local/etc/squid/post-auth/*.conf # Caching settings cache deny all cache_mem 0 # Leave coredumps in the first cache dir coredump_dir /var/squid/cache # # Add any of your own refresh_pattern entries above these. # refresh_pattern ^ftp: 1440 20% 10080 refresh_pattern ^gopher: 1440 0% 1440 refresh_pattern -i (/cgi-bin/|\?) 0 0% 0 refresh_pattern . 0 20% 4320 # Squid Options pinger_enable off # Disable access logging access_log none # Disable cache store log cache_store_log none # Suppress http version string (default=off) httpd_suppress_version_string on # URI handling with Whitespaces (default=strip) uri_whitespace strip # Disable squid logfile rotate to use system defaults logfile_rotate 0 # Define visible hostname visible_hostname wall.pfchina.org # Define visible email cache_mgr [email protected] # Set error directory language error_directory /usr/local/share/squid-langpack/en
      - 蓝
        
        鉄血男兒
        
        1 年前
        2024-8-13 9:30:55
        
        使用是可以了我后面加了分割线
        但是电报不能用其他能用
      - 鉄血男兒
        博主
        蓝
        
        1 年前
        2024-8-13 10:41:45
        
        我测试电报可以正常使用，可能是clash配置文件本身的问题。你可以试试sing-box。
      - 蓝
        
        鉄血男兒
        
        1 年前
        2024-8-13 16:43:44
        
        奇怪了同配置我在openwrt是可以使用的
PC27149

1 年前
2024-8-07 16:13:52

是不是可以再写一个脚本定时下载配置，达到订阅更新的目的？
- 鉄血男兒
  博主
  PC27149
  
  1 年前
  2024-8-10 10:48:12
  
  pfSense可以安装cron插件解决这个问题，OPNsense稍微复杂一点，参考这个就可以：https://gist.github.com/PiDroid-B/078198bc84c1e8451d5fd331b46b332d
tankren

已编辑

1 年前
2024-10-07 17:20:18

/usr/local/bin/clash -d /usr/local/etc/clash
重启后这个bin文件和目录全部消失了。。。
忽略，我的在root下
- 鉄血男兒
  博主
  tankren
  
  1 年前
  2024-10-08 14:25:53
  
  除非是在线运行模式，否则是不可能出现这种情况的。
wings3

8 月前
2025-3-03 20:37:37

我在最新版PFSENSE CE 安装后，在SUB里面输入订阅网址，然后保存点开始订阅出现这个提示
/usr/bin/sub: bash: not found
[2025-03-03 20:32:49] 订阅操作执行完毕。
- 鉄血男兒
  博主
  wings3
  
  已编辑
  
  8 月前
  2025-3-04 10:01:50
  
  运行以下命令安装bash：pkg install -y bash
- - wings3
    
    鉄血男兒
    
    8 月前
    2025-3-04 10:17:22
    
    谢谢群主，安装BASH后能正常运行，但是先报错没有LOGS目录，手动新建LOGS目录后又报格式错误，这个怎么解决？
    正在检测订阅地址…
    Clash订阅地址可访问！ OK
    正在下载Clash配置文件…
    配置文件config.yaml下载成功！ OK
    判断订阅内容是否符合clash配置文件标准:
    解码后的内容不符合clash标准，尝试将其转换为标准格式
    ELF binary type “0” not known.
    配置文件转换标准格式失败！
    root@OPNsense:/usr/local/etc/clash/sub #
    
    谢谢群主，安装BASH后能正常运行，但是先报错没有LOGS目录，手动新建LOGS目录后又报格式错误，这个怎么解决？正在检测订阅地址... Clash订阅地址可访问！ OK 正在下载Clash配置文件... 配置文件config.yaml下载成功！ OK 判断订阅内容是否符合clash配置文件标准: 解码后的内容不符合clash标准，尝试将其转换为标准格式 ELF binary type "0" not known. 配置文件转换标准格式失败！ root@OPNsense:/usr/local/etc/clash/sub #
  - - 鉄血男兒
      博主
      wings3
      
      已编辑
      
      8 月前
      2025-3-04 10:44:35
      
      建议使用sublinkX搭建节点订阅系统，可以将自建节点和机场放入一个订阅链接进行订阅。
    - - wings3
        
        鉄血男兒
        
        8 月前
        2025-3-19 11:20:13
        
        谢谢已经成功运行了，待会再研究下群主的透明代理TUN2SOCKS,谢谢群主百忙之中回复
      - 鉄血男兒
        博主
        wings3
        
        8 月前
        2025-3-19 11:37:26
        
        tun2socks已经改成hev-socks5-tunnel了，转发效率大大提高。
      - xiaohu
        
        wings3
        
        7 月前
        2025-4-17 11:56:12
        
        我也是这个问题，你怎么成功的？谢谢
Suancs

已编辑

7 月前
2025-4-03 23:58:57
/usr/local/bin/clash -d /usr/local/etc/clash 这个指令可以启动，但是web面板点击启动并不会正常运行clash
```
singbox_enable="NO"
mosdns_enable="NO"
clash_enable="YES"
tun2socks_enable="YES"
root@OPNsense:/usr/local/etc/rc.d # onerestart clash
onerestart: Command not found.
root@OPNsense:/usr/local/etc/rc.d # onerestart clash
onerestart: Command not found.
root@OPNsense:/usr/local/etc/rc.d # onestart clash
onestart: Command not found.
```
/usr/local/bin/clash -d /usr/local/etc/clash 这个指令可以启动，但是web面板点击启动并不会正常运行clash ```root@OPNsense:/usr/local/etc/rc.d # cat /etc/rc.conf singbox_enable="NO" mosdns_enable="NO" clash_enable="YES" tun2socks_enable="YES" root@OPNsense:/usr/local/etc/rc.d # onerestart clash onerestart: Command not found. root@OPNsense:/usr/local/etc/rc.d # onerestart clash onerestart: Command not found. root@OPNsense:/usr/local/etc/rc.d # onestart clash onestart: Command not found. ```
鉄血男兒
博主

7 月前
2025-4-04 9:18:19

去看看/etc/rc.conf里是否有clash_enable=”YES”，把clash的开机自启打开，那个是控制这个选项的。
xiaohu

7 月前
2025-4-17 12:03:06

root@OPNsense:~/OPNsense-Proxy-Suite # sub
检测订阅地址…
Clash订阅地址可以访问！
正在下载Clash配置文件…
文件下载成功！
检测到非标准Clash配置，尝试解码…
解码失败，尝试转换…
/usr/local/etc/clash/sub/sub.sh: line 75: /usr/local/etc/clash/sub/logs/sub.log: No such file or directory 这个怎么办，在客户端和openwrt上都没问题。

root@OPNsense:~/OPNsense-Proxy-Suite # sub 检测订阅地址... Clash订阅地址可以访问！正在下载Clash配置文件... 文件下载成功！检测到非标准Clash配置，尝试解码... 解码失败，尝试转换... /usr/local/etc/clash/sub/sub.sh: line 75: /usr/local/etc/clash/sub/logs/sub.log: No such file or directory 这个怎么办，在客户端和openwrt上都没问题。
- 鉄血男兒
  博主
  xiaohu
  
  7 月前
  2025-4-18 8:09:03
  
  用sublink搭建转换站点