1. return incoming connection directly, v2ray tproxy seems not work for this situation, maybe a v2ray bug 2. exclude lo to avoid local bind problem, for example if your dns is 127.0.0.1:53 for doh, then v2ray can't bind to reply back result