FAQ

❓ FAQ

During upgrade/reinstall it says: Existing conffile is different from the conffile in the new package.

You can ignore it. If you want to know why (and can’t understand it), use a translator.

LuCI-related issues: can’t open / version not shown / wrong status / can’t find new features, etc.

Try clearing your browser cache / using private browsing / using a different browser.

Plugin log shows: timeout, tun device is not online

1. When using TUN mode, the plugin must wait for the TUN device to be created before continuing.
2. This usually happens because the device is underpowered or the configuration is too complex. You can increase the timeout via Proxy Configuration → Misc → TUN Wait Timeout.
3. It may also be caused by the core failing to start. Check the core logs to confirm.

Plugin log shows: hijack failed

1. Confirm the environment meets the requirements: Prerequisites.
2. Make sure dependencies are installed correctly: Dependencies.
3. Ensure kernel modules are loaded. Run:
   lsmod | grep -e '^inet_diag' -e '^nft_socket' -e '^nft_tproxy' -e '^tun'
   If loaded correctly, you should see 4 lines. If any are missing, they are not loaded properly—consider switching firmware.
4. If all above are fine, open an Issue. Ideally include the output of: service nikki restart.

Core logs show “direct connection failed” messages

If it doesn’t affect normal internet usage, ignore it. The cause is on the remote side—possible reasons include legacy app/site code, incorrect domain names, wrong DNS records, services being offline, etc. You just didn’t see these logs before when you weren’t using transparent proxying; now you can.

Core logs show “loopback rejected” messages

1. If you cannot access the internet, try disabling Router Proxy and test again. (Common on older Linux kernels or when OpenWrt runs in a container.)
2. If internet works but some services are affected, it may be a false positive (e.g. certain UDP connections like Bilibili live streaming). Try enabling:
   Plugin Configuration → procd Configuration → Environment Variables → Disable Loopback Detection.

Some protocols (e.g. Hysteria2) disconnect / don’t work

Check if your Linux kernel is 6.6. If yes, try one of the following:

1. Enable Core Environment Variables → Disable quic-go Generic Segmentation Offload (may reduce speed).
2. Switch to an OpenWrt build with a higher (6.12) or lower (5.15) Linux kernel.

Connections match the wrong routing rules

1. Check whether your rules are written correctly.
2. If only UDP connections have issues, check whether the node supports UDP or whether UDP is enabled in that node’s configuration in the config file.

I want to enable auto-route, auto-redirect, auto-detect-interface, but the plugin forces them off. Why?

1. They can cause firewall rule conflicts. After enabling auto-route, the core configures firewall rules itself, which conflicts with the plugin’s firewall rules and can break networking/proxying.
2. auto-route does not solve any plugin-related issues. It only auto-creates firewall rules to send traffic into the core. auto-redirect merely uses Redirect for TCP instead of TUN—no other effect.
3. If you insist on enabling them, use Core Only mode. This disables the plugin’s mixin and firewall rules and follows your config file exactly. Then you can enable auto-route and/or auto-redirect. This is essentially a “bare core mode”: the plugin becomes only a launcher/manager.

How to bypass specific destination ports

Configure Proxy Target Ports (TCP/UDP). See the Wiki Home page for details.

After opening the panel, only the frame shows and no data is displayed

Click Settings (the gear icon at the top), then click Switch Backend.

Cannot access successfully when using HTTP/SOCKS5 proxy

1. The plugin sets default authentication during installation. You can disable Override Authentication, or configure the correct username/password when setting up the proxy.
2. For SOCKS5, use socks5h://ip:port instead of socks5://ip:port.

How to configure automatic subscription updates

1. Enable scheduled restart.
2. Set your subscription priority to Remote.
3. Save and apply.
4. The plugin will restart on your cron schedule and update the subscription before startup.

In Fake-IP mode, how to make Bypass Mainland China IP and Proxy Target Ports (TCP/UDP) work correctly?

1. Add GEOSITE:cn or your mainland domain RULE-SET to the Fake-IP Filter List.
2. Set Fake-IP Filter Mode to Blacklist.

After mainland domains return real IPs, those features will work properly.

Why do some mainland China IP connections still enter the core even with Bypass Mainland China IP enabled?

Because there is no perfect list of China mainland domains/IPs.

High battery drain on iPhone and similar devices under transparent proxy

Adjust TCP Keep Alive Idle and TCP Keep Alive Interval:
Set TCP Keep Alive Idle to 600, and TCP Keep Alive Interval to 15.

With Bypass Mainland China IP enabled, Google Play cannot download

Currently unsolved and there are no plans to add a blacklist/whitelist for Bypass Mainland China IP. Recommended: disable it.

Cannot fetch rule sets / proxy sets hosted on intranet services; cannot access intranet services via configured inbound

Set Outbound Interface to Unspecified.

Why do the chains still exist even after I disable some transparent proxy options?

Those chains are not actually being used (you can check by observing chain counters). They simply exist.

How to replace the core?

The core is located at /usr/bin/mihomo. Download the core you want and replace it.

Auto-download of the panel / GeoX data fails. How do I upload the panel / GeoX database manually?

1. The plugin does not provide this functionality, but you can upload via SFTP. By default:
   • Panel path: /etc/nikki/run/ui
   • GeoX database path: /etc/nikki/run Upload to the correct location with the correct filenames. Note: if you changed External Control → UI Path, adjust the panel location accordingly.
2. A better approach is to migrate to rule sets (MRS format) for a better startup experience.