iptables -t nat -I TP -p tcp --dport 4433 -j RETURN # bypass Port
# https://tools.ietf.org/html/rfc5735#page-6
iptables -t nat -A TP -d 0.0.0.0/8 -j RETURN
iptables -t nat -A TP -d 10.0.0.0/8 -j RETURN
iptables -t nat -A TP -d 127.0.0.0/8 -j RETURN
iptables -t nat -A TP -d 169.254.0.0/16 -j RETURN
iptables -t nat -A TP -d 172.16.0.0/12 -j RETURN
iptables -t nat -A TP -d 192.168.0.0/16 -j RETURN
iptables -t nat -A TP -d 224.0.0.0/4 -j RETURN
iptables -t nat -A TP -d 240.0.0.0/4 -j RETURN
# Anything else should be redirected to Dokodemo-door's local port
iptables -t nat -A TP -p tcp -j REDIRECT --to-ports 20088
iptables -t nat -I OUTPUT -p tcp -j TP
iptables -t nat -I PREROUTING -p tcp -j TP
iptables -t mangle -A TP -p udp --dport 53 -j TPROXY --on-port 20088 --tproxy-mark 0x01/0x01
iptables -t mangle -A PREROUTING -j TP
iptables -t mangle -N TP_MARK
iptables -t mangle -A TP_MARK -p udp --dport 53 -j MARK --set-mark 1
iptables -t mangle -A OUTPUT -j TP_MARK
ip route add local default dev lo table 100
ip rule add fwmark 1 lookup 100
ip rule del fwmark 1 lookup 100 # disable UDP