我目前用的是 Docker 跑的 mihomo 和 paopaodns 。其中 mihomo 地址是 10.0.0.2 。paopaodns 是递归 dns ，可以解决 dns 污染问题。以下是部分关键脚本。
地址表：NoProxyLocalIP 可以写入不需要标记给 mihomo 的内网 IP 。
#IP 订阅脚本
/system script
add dont-require-permissions=no name=CN_IPAddress_Update owner=admin policy=\
ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon source="/\
tool fetch url=\"
https://ghfast.top/https://raw.githubusercontent.com/PaPe\
rseller/chn-iplist/master/cn.rsc\" \\\
\ndst-path=cn.rsc\
\n/import file-name=cn.rsc\
\n/file remove [find name=\"cn.rsc\"]\
\n:log info (\"update done\")"
#定时执行
/system scheduler
add comment=CN_IPAddress_Update interval=3d name=CN_IPAddress_Update \
on-event=CN_IPAddress_Update policy=\
ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon \
start-date=2024-11-03 start-time=05:00:00
#防火墙
/ip firewall mangle
add action=change-mss chain=forward comment="defconf: fix IPv4 mss for WAN" \
new-mss=clamp-to-pmtu protocol=tcp tcp-flags=syn
add action=accept chain=prerouting comment="Accept Clash" in-interface=\
bridge1 src-address=10.0.0.2
add action=mark-routing chain=prerouting comment="Mark Clash" \
dst-address-list=!CN dst-address-type=!local new-routing-mark=clash \
protocol=!icmp src-address-list=!NoProxyLocalIP
#路由
/routing table
add disabled=no fib name=clash
/ip route
add check-gateway=ping comment="To mihomo" disabled=no distance=1 \
dst-address=0.0.0.0/0 gateway=10.0.0.2 routing-table=clash scope=30 \
target-scope=10