@
Reficul 是的,就是你的搞法,我直接把目的地址为 NF 的所属的 cidr 且目的端口为 443 的请求,通过 dnat 到了 sniproxy 的服务器地址,然后一切 ok 。RouterOS 的做法,我贴出来。
把 nf 的地址段都加入这个 list ,但是实际上亚洲解锁都是 23.246 段的,台湾比较特殊,本地 ISP 也有 CDN
/ip firewall address-list
add address=23.246.0.0/18 list=netflix
add address=37.77.184.0/21 list=netflix
add address=45.57.0.0/17 list=netflix
add address=64.120.128.0/17 list=netflix
add address=66.197.128.0/17 list=netflix
add address=108.175.32.0/20 list=netflix
add address=192.173.64.0/18 list=netflix
add address=198.38.96.0/19 list=netflix
add address=198.45.48.0/20 list=netflix
add address=210.201.93.0/24 comment="Asia Pacific Telecom" list=netflix
add address=203.75.0.0/16 comment="HiNet (Chunghwa Telecom)" list=netflix
#创建一个 DNAT
/ip/firewall/nat
add action=dst-nat chain=dstnat comment=netflix dst-address-list=netflix dst-port=443 protocol=tcp to-addresses="你的 DNS 解锁解析出来的 SNI 代理服务器地址" to-ports=443
最后做个定时任务,如果解析地址变化,自动更新
/system/scheduler
add comment=netflix interval=2m name=schedule99 on-event=":local NAME \"
www.netflix.com\"\r\
\n:local CURRENT [:resolve \$NAME]\r\
\n:local CONTENT [/ip/firewall/nat/get value-name=to-addresses [find comment=\"netflix\"]]\r\
\n:if (\$CURRENT != \$CONTENT) do={\r\
\n/ip/firewall/nat/set to-addresses=\$CURRENT [find comment=\"netflix\"];\r\
\n:log/info \"DOMAIN: \$NAME ,SNIPROXY: \$CURRENT updated\"\r\
\n};" policy=ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon start-date=2021-01-01 start-time=08:00:00