mirror of
https://github.com/Ysurac/openmptcprouter-feeds.git
synced 2025-03-09 15:40:03 +00:00
Better iptables rules for omr-bypass
This commit is contained in:
Ycarus
parent
469830a076
commit
06a28d4227
7 changed files with 50 additions and 59 deletions
2
luci-app-omr-bypass/root/etc/firewall.omr-bypass
Normal file
2
luci-app-omr-bypass/root/etc/firewall.omr-bypass
Normal file
|
|
@ -0,0 +1,2 @@
|
|||
#!/bin/sh
|
||||
/etc/init.d/omr-bypass restart
|
||||
|
|
@ -14,9 +14,9 @@ _bypass_ip() {
|
|||
valid_ip4=$( valid_subnet4 $ip)
|
||||
valid_ip6=$( valid_subnet6 $ip)
|
||||
if [ "$valid_ip4" = "ok" ]; then
|
||||
ipset -q add ss_rules_dst_bypass_$type $ip
|
||||
ipset -q add omr_rules_dst_bypass_$type $ip
|
||||
elif [ "$valid_ip6" = "ok" ]; then
|
||||
ipset -q add ss_rules6_dst_bypass_$type $ip
|
||||
ipset -q add omr_rules6_dst_bypass_$type $ip
|
||||
fi
|
||||
}
|
||||
|
||||
|
|
@ -36,7 +36,7 @@ _bypass_domain() {
|
|||
for ip in $resolve; do
|
||||
_bypass_ip $ip $intf
|
||||
done
|
||||
uci -q add_list dhcp.@dnsmasq[0].ipset="/$domain/ss_rules_dst_bypass_$intf,ss_rules6_dst_bypass_$intf"
|
||||
uci -q add_list dhcp.@dnsmasq[0].ipset="/$domain/omr_rules_dst_bypass_$intf,omr_rules6_dst_bypass_$intf"
|
||||
fi
|
||||
}
|
||||
|
||||
|
|
@ -50,7 +50,6 @@ _bypass_proto() {
|
|||
[ -z "$intf" ] && intf="all"
|
||||
[ -z "$proto" ] && return
|
||||
if [ "$intf" = "all" ]; then
|
||||
echo "Add $proto"
|
||||
iptables-restore --wait=60 --noflush <<-EOF
|
||||
*mangle
|
||||
-A omr-bypass-dpi -m ndpi --$proto -j MARK --set-mark 0x539
|
||||
|
|
@ -83,49 +82,49 @@ _intf_rule() {
|
|||
config_get mode $1 multipath "off"
|
||||
[ "$mode" = "off" ] && return
|
||||
[ "$(echo $1 | grep _dev)" != "" ] && return
|
||||
ipset -q flush ss_rules_dst_bypass_$intf > /dev/null 2>&1
|
||||
ipset -q flush ss_rules6_dst_bypass_$intf > /dev/null 2>&1
|
||||
ipset -q flush omr_rules_dst_bypass_$intf > /dev/null 2>&1
|
||||
ipset -q flush omr_rules6_dst_bypass_$intf > /dev/null 2>&1
|
||||
ipset -q --exist restore <<-EOF
|
||||
create ss_rules_dst_bypass_$intf hash:net hashsize 64
|
||||
create ss_rules6_dst_bypass_$intf hash:net family inet6 hashsize 64
|
||||
create omr_rules_dst_bypass_$intf hash:net hashsize 64
|
||||
create omr_rules6_dst_bypass_$intf hash:net family inet6 hashsize 64
|
||||
EOF
|
||||
ip rule add prio 1 fwmark 0x539$count lookup $count > /dev/null 2>&1
|
||||
ip -6 rule add prio 1 fwmark 0x539$count lookup $count > /dev/null 2>&1
|
||||
if [ "$(iptables -w 40 -t mangle -L | grep ss_rules_dst_bypass_$intf)" = "" ]; then
|
||||
if [ "$(iptables -w 40 -t mangle -L | grep omr_rules_dst_bypass_$intf)" = "" ]; then
|
||||
iptables-restore --wait=60 --noflush <<-EOF
|
||||
*mangle
|
||||
-I PREROUTING 1 -m set --match-set ss_rules_dst_bypass_$intf dst -j MARK --set-mark 0x539$count
|
||||
-I PREROUTING 1 -m set --match-set omr_rules_dst_bypass_$intf dst -j MARK --set-mark 0x539$count
|
||||
COMMIT
|
||||
EOF
|
||||
fi
|
||||
if [ "$(iptables -w 40 -t nat -L | grep ss_rules_pre_src)" != "" ] && [ "$(iptables -w 40 -t nat -L | grep ss_rules_dst_bypass_$intf)" = "" ]; then
|
||||
if [ "$(iptables -w 40 -t nat -L | grep ss_rules_pre_src)" != "" ] && [ "$(iptables -w 40 -t nat -L | grep omr_rules_dst_bypass_$intf)" = "" ]; then
|
||||
echo "add nat rules..."
|
||||
iptables-restore --wait=60 --noflush <<-EOF
|
||||
*nat
|
||||
-I ss_rules_dst 1 -m set --match-set ss_rules_dst_bypass_$intf dst -j RETURN
|
||||
-I ss_rules_local_out 1 -m set --match-set ss_rules_dst_bypass_$intf dst -j RETURN
|
||||
-I ss_rules_dst 1 -m set --match-set omr_rules_dst_bypass_$intf dst -j RETURN
|
||||
-I ss_rules_local_out 1 -m set --match-set omr_rules_dst_bypass_$intf dst -j RETURN
|
||||
-I ss_rules_local_out 2 -m mark --mark 0x539$count -j RETURN
|
||||
-I ss_rules_pre_src 1 -m set --match-set ss_rules_dst_bypass_$intf dst -j MARK --set-xmark 0x539$count
|
||||
-I ss_rules_pre_src 2 -m set --match-set ss_rules_dst_bypass_$intf dst -j RETURN
|
||||
-I ss_rules_pre_src 1 -m set --match-set omr_rules_dst_bypass_$intf dst -j MARK --set-xmark 0x539$count
|
||||
-I ss_rules_pre_src 2 -m set --match-set omr_rules_dst_bypass_$intf dst -j RETURN
|
||||
-I ss_rules_pre_src 3 -m mark --mark 0x539$count -j RETURN
|
||||
COMMIT
|
||||
EOF
|
||||
fi
|
||||
if [ "$(ip6tables -w 40 -t mangle -L | grep ss_rules6_dst_bypass_$intf)" = "" ]; then
|
||||
if [ "$(ip6tables -w 40 -t mangle -L | grep omr_rules6_dst_bypass_$intf)" = "" ]; then
|
||||
ip6tables-restore --wait=60 --noflush <<-EOF
|
||||
*mangle
|
||||
-I PREROUTING 1 -m set --match-set ss_rules6_dst_bypass_$intf dst -j MARK --set-mark 0x539$count
|
||||
-I PREROUTING 1 -m set --match-set omr_rules6_dst_bypass_$intf dst -j MARK --set-mark 0x539$count
|
||||
COMMIT
|
||||
EOF
|
||||
fi
|
||||
if [ "$(ip6tables -w 40 -t nat -L | grep ss_rules6_pre_src)" != "" ] && [ "$(ip6tables -w 40 -t nat -L | grep ss_rules6_dst_bypass_$intf)" = "" ]; then
|
||||
if [ "$(ip6tables -w 40 -t nat -L | grep ss_rules6_pre_src)" != "" ] && [ "$(ip6tables -w 40 -t nat -L | grep omr_rules6_dst_bypass_$intf)" = "" ]; then
|
||||
ip6tables-restore --wait=60 --noflush <<-EOF
|
||||
*nat
|
||||
-I ss_rules6_dst 1 -m set --match-set ss_rules6_dst_bypass_$intf dst -j RETURN
|
||||
-I ss_rules6_local_out 1 -m set --match-set ss_rules6_dst_bypass_$intf dst -j RETURN
|
||||
-I ss_rules6_dst 1 -m set --match-set omr_rules6_dst_bypass_$intf dst -j RETURN
|
||||
-I ss_rules6_local_out 1 -m set --match-set omr_rules6_dst_bypass_$intf dst -j RETURN
|
||||
-I ss_rules6_local_out 2 -m mark --mark 0x539$count -j RETURN
|
||||
-I ss_rules6_pre_src 1 -m set --match-set ss_rules6_dst_bypass_$intf dst -j MARK --set-xmark 0x539$count
|
||||
-I ss_rules6_pre_src 2 -m set --match-set ss_rules6_dst_bypass_$intf dst -j RETURN
|
||||
-I ss_rules6_pre_src 1 -m set --match-set omr_rules6_dst_bypass_$intf dst -j MARK --set-xmark 0x539$count
|
||||
-I ss_rules6_pre_src 2 -m set --match-set omr_rules6_dst_bypass_$intf dst -j RETURN
|
||||
-I ss_rules6_pre_src 3 -m mark --mark 0x539$count -j RETURN
|
||||
COMMIT
|
||||
EOF
|
||||
|
|
@ -145,11 +144,11 @@ _bypass_ip_set() {
|
|||
start_service() {
|
||||
local count
|
||||
logger -t "omr-bypass" "Starting OMR-ByPass..."
|
||||
ipset -q flush ss_rules_dst_bypass_all > /dev/null 2>&1
|
||||
ipset -q flush ss_rules6_dst_bypass_all > /dev/null 2>&1
|
||||
ipset -q flush omr_rules_dst_bypass_all > /dev/null 2>&1
|
||||
ipset -q flush omr_rules6_dst_bypass_all > /dev/null 2>&1
|
||||
ipset -q --exist restore <<-EOF
|
||||
create ss_rules_dst_bypass_all hash:net hashsize 64
|
||||
create ss_rules6_dst_bypass_all hash:net family inet6 hashsize 64
|
||||
create omr_rules_dst_bypass_all hash:net hashsize 64
|
||||
create omr_rules6_dst_bypass_all hash:net family inet6 hashsize 64
|
||||
EOF
|
||||
|
||||
config_load network
|
||||
|
|
@ -162,35 +161,33 @@ start_service() {
|
|||
config_foreach _bypass_domain domains
|
||||
uci -q commit dhcp
|
||||
/etc/init.d/dnsmasq reload
|
||||
#config_foreach _bypass_proto dpis
|
||||
|
||||
ip rule add prio 1 fwmark 0x539 lookup 991337 > /dev/null 2>&1
|
||||
ip -6 rule add prio 1 fwmark 0x539 lookup 991337 > /dev/null 2>&1
|
||||
|
||||
if [ "$(iptables -w 40 -t mangle -L | grep 'match-set ss_rules_dst_bypass_all dst MARK set')" = "" ]; then
|
||||
if [ "$(iptables -w 40 -t mangle -L | grep 'match-set omr_rules_dst_bypass_all dst MARK set')" = "" ]; then
|
||||
iptables-restore --wait=60 --noflush <<-EOF
|
||||
*mangle
|
||||
-A PREROUTING -m set --match-set ss_rules_dst_bypass_all dst -j MARK --set-mark 0x539
|
||||
-A PREROUTING -m set --match-set omr_rules_dst_bypass_all dst -j MARK --set-mark 0x539
|
||||
COMMIT
|
||||
EOF
|
||||
fi
|
||||
if [ "$(ip6tables -w 40 -t mangle -L | grep 'match-set ss_rules6_dst_bypass_all dst MARK set')" = "" ]; then
|
||||
if [ "$(ip6tables -w 40 -t mangle -L | grep 'match-set omr_rules6_dst_bypass_all dst MARK set')" = "" ]; then
|
||||
ip6tables-restore --wait=60 --noflush <<-EOF
|
||||
*mangle
|
||||
-A PREROUTING -m set --match-set ss_rules6_dst_bypass_all dst -j MARK --set-mark 0x539
|
||||
-A PREROUTING -m set --match-set omr_rules6_dst_bypass_all dst -j MARK --set-mark 0x539
|
||||
COMMIT
|
||||
EOF
|
||||
fi
|
||||
|
||||
iptables-save --counters | grep -v omr-bypass-dpi | iptables-restore --counters
|
||||
ip6tables-save --counters | grep -v omr-bypass-dpi | ip6tables-restore --counters
|
||||
ndpi_rules=$(echo $ndpi_rules | awk 'NF')
|
||||
#iptables-restore --wait=60 --noflush <<-EOF
|
||||
#*mangle
|
||||
#:omr-bypass-dpi -
|
||||
#-A PREROUTING -m addrtype ! --dst-type LOCAL -j omr-bypass-dpi
|
||||
#COMMIT
|
||||
#EOF
|
||||
iptables-restore --wait=60 --noflush <<-EOF
|
||||
*mangle
|
||||
:omr-bypass-dpi -
|
||||
-A PREROUTING -m addrtype ! --dst-type LOCAL -j omr-bypass-dpi
|
||||
COMMIT
|
||||
EOF
|
||||
ip6tables-restore --wait=60 --noflush <<-EOF
|
||||
*mangle
|
||||
:omr-bypass-dpi -
|
||||
|
|
|
|||
|
|
@ -54,5 +54,15 @@ if [ "$(uci -q get ucitrack.@shadowsocks-libev[-1].affects | grep omr-bypass)" =
|
|||
add_list ucitrack.@shadowsocks-libev[-1].affects=omr-bypass
|
||||
EOF
|
||||
fi
|
||||
s=firewall.omr-bypass
|
||||
uci get "$s" >/dev/null || {
|
||||
uci batch <<-EOF
|
||||
set $s=include
|
||||
set $s.path=/etc/firewall.omr-bypass
|
||||
set $s.reload=1
|
||||
commit firewall
|
||||
EOF
|
||||
}
|
||||
|
||||
rm -f /tmp/luci-indexcache
|
||||
exit 0
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue