mirror of
https://github.com/Ysurac/openmptcprouter-feeds.git
synced 2025-02-13 02:51:50 +00:00
Better iptables rules for omr-bypass
This commit is contained in:
Ycarus
parent
469830a076
commit
06a28d4227
7 changed files with 50 additions and 59 deletions
2
luci-app-omr-bypass/root/etc/firewall.omr-bypass
Normal file
2
luci-app-omr-bypass/root/etc/firewall.omr-bypass
Normal file
|
|
@ -0,0 +1,2 @@
|
|||
#!/bin/sh
|
||||
/etc/init.d/omr-bypass restart
|
||||
|
|
@ -14,9 +14,9 @@ _bypass_ip() {
|
|||
valid_ip4=$( valid_subnet4 $ip)
|
||||
valid_ip6=$( valid_subnet6 $ip)
|
||||
if [ "$valid_ip4" = "ok" ]; then
|
||||
ipset -q add ss_rules_dst_bypass_$type $ip
|
||||
ipset -q add omr_rules_dst_bypass_$type $ip
|
||||
elif [ "$valid_ip6" = "ok" ]; then
|
||||
ipset -q add ss_rules6_dst_bypass_$type $ip
|
||||
ipset -q add omr_rules6_dst_bypass_$type $ip
|
||||
fi
|
||||
}
|
||||
|
||||
|
|
@ -36,7 +36,7 @@ _bypass_domain() {
|
|||
for ip in $resolve; do
|
||||
_bypass_ip $ip $intf
|
||||
done
|
||||
uci -q add_list dhcp.@dnsmasq[0].ipset="/$domain/ss_rules_dst_bypass_$intf,ss_rules6_dst_bypass_$intf"
|
||||
uci -q add_list dhcp.@dnsmasq[0].ipset="/$domain/omr_rules_dst_bypass_$intf,omr_rules6_dst_bypass_$intf"
|
||||
fi
|
||||
}
|
||||
|
||||
|
|
@ -50,7 +50,6 @@ _bypass_proto() {
|
|||
[ -z "$intf" ] && intf="all"
|
||||
[ -z "$proto" ] && return
|
||||
if [ "$intf" = "all" ]; then
|
||||
echo "Add $proto"
|
||||
iptables-restore --wait=60 --noflush <<-EOF
|
||||
*mangle
|
||||
-A omr-bypass-dpi -m ndpi --$proto -j MARK --set-mark 0x539
|
||||
|
|
@ -83,49 +82,49 @@ _intf_rule() {
|
|||
config_get mode $1 multipath "off"
|
||||
[ "$mode" = "off" ] && return
|
||||
[ "$(echo $1 | grep _dev)" != "" ] && return
|
||||
ipset -q flush ss_rules_dst_bypass_$intf > /dev/null 2>&1
|
||||
ipset -q flush ss_rules6_dst_bypass_$intf > /dev/null 2>&1
|
||||
ipset -q flush omr_rules_dst_bypass_$intf > /dev/null 2>&1
|
||||
ipset -q flush omr_rules6_dst_bypass_$intf > /dev/null 2>&1
|
||||
ipset -q --exist restore <<-EOF
|
||||
create ss_rules_dst_bypass_$intf hash:net hashsize 64
|
||||
create ss_rules6_dst_bypass_$intf hash:net family inet6 hashsize 64
|
||||
create omr_rules_dst_bypass_$intf hash:net hashsize 64
|
||||
create omr_rules6_dst_bypass_$intf hash:net family inet6 hashsize 64
|
||||
EOF
|
||||
ip rule add prio 1 fwmark 0x539$count lookup $count > /dev/null 2>&1
|
||||
ip -6 rule add prio 1 fwmark 0x539$count lookup $count > /dev/null 2>&1
|
||||
if [ "$(iptables -w 40 -t mangle -L | grep ss_rules_dst_bypass_$intf)" = "" ]; then
|
||||
if [ "$(iptables -w 40 -t mangle -L | grep omr_rules_dst_bypass_$intf)" = "" ]; then
|
||||
iptables-restore --wait=60 --noflush <<-EOF
|
||||
*mangle
|
||||
-I PREROUTING 1 -m set --match-set ss_rules_dst_bypass_$intf dst -j MARK --set-mark 0x539$count
|
||||
-I PREROUTING 1 -m set --match-set omr_rules_dst_bypass_$intf dst -j MARK --set-mark 0x539$count
|
||||
COMMIT
|
||||
EOF
|
||||
fi
|
||||
if [ "$(iptables -w 40 -t nat -L | grep ss_rules_pre_src)" != "" ] && [ "$(iptables -w 40 -t nat -L | grep ss_rules_dst_bypass_$intf)" = "" ]; then
|
||||
if [ "$(iptables -w 40 -t nat -L | grep ss_rules_pre_src)" != "" ] && [ "$(iptables -w 40 -t nat -L | grep omr_rules_dst_bypass_$intf)" = "" ]; then
|
||||
echo "add nat rules..."
|
||||
iptables-restore --wait=60 --noflush <<-EOF
|
||||
*nat
|
||||
-I ss_rules_dst 1 -m set --match-set ss_rules_dst_bypass_$intf dst -j RETURN
|
||||
-I ss_rules_local_out 1 -m set --match-set ss_rules_dst_bypass_$intf dst -j RETURN
|
||||
-I ss_rules_dst 1 -m set --match-set omr_rules_dst_bypass_$intf dst -j RETURN
|
||||
-I ss_rules_local_out 1 -m set --match-set omr_rules_dst_bypass_$intf dst -j RETURN
|
||||
-I ss_rules_local_out 2 -m mark --mark 0x539$count -j RETURN
|
||||
-I ss_rules_pre_src 1 -m set --match-set ss_rules_dst_bypass_$intf dst -j MARK --set-xmark 0x539$count
|
||||
-I ss_rules_pre_src 2 -m set --match-set ss_rules_dst_bypass_$intf dst -j RETURN
|
||||
-I ss_rules_pre_src 1 -m set --match-set omr_rules_dst_bypass_$intf dst -j MARK --set-xmark 0x539$count
|
||||
-I ss_rules_pre_src 2 -m set --match-set omr_rules_dst_bypass_$intf dst -j RETURN
|
||||
-I ss_rules_pre_src 3 -m mark --mark 0x539$count -j RETURN
|
||||
COMMIT
|
||||
EOF
|
||||
fi
|
||||
if [ "$(ip6tables -w 40 -t mangle -L | grep ss_rules6_dst_bypass_$intf)" = "" ]; then
|
||||
if [ "$(ip6tables -w 40 -t mangle -L | grep omr_rules6_dst_bypass_$intf)" = "" ]; then
|
||||
ip6tables-restore --wait=60 --noflush <<-EOF
|
||||
*mangle
|
||||
-I PREROUTING 1 -m set --match-set ss_rules6_dst_bypass_$intf dst -j MARK --set-mark 0x539$count
|
||||
-I PREROUTING 1 -m set --match-set omr_rules6_dst_bypass_$intf dst -j MARK --set-mark 0x539$count
|
||||
COMMIT
|
||||
EOF
|
||||
fi
|
||||
if [ "$(ip6tables -w 40 -t nat -L | grep ss_rules6_pre_src)" != "" ] && [ "$(ip6tables -w 40 -t nat -L | grep ss_rules6_dst_bypass_$intf)" = "" ]; then
|
||||
if [ "$(ip6tables -w 40 -t nat -L | grep ss_rules6_pre_src)" != "" ] && [ "$(ip6tables -w 40 -t nat -L | grep omr_rules6_dst_bypass_$intf)" = "" ]; then
|
||||
ip6tables-restore --wait=60 --noflush <<-EOF
|
||||
*nat
|
||||
-I ss_rules6_dst 1 -m set --match-set ss_rules6_dst_bypass_$intf dst -j RETURN
|
||||
-I ss_rules6_local_out 1 -m set --match-set ss_rules6_dst_bypass_$intf dst -j RETURN
|
||||
-I ss_rules6_dst 1 -m set --match-set omr_rules6_dst_bypass_$intf dst -j RETURN
|
||||
-I ss_rules6_local_out 1 -m set --match-set omr_rules6_dst_bypass_$intf dst -j RETURN
|
||||
-I ss_rules6_local_out 2 -m mark --mark 0x539$count -j RETURN
|
||||
-I ss_rules6_pre_src 1 -m set --match-set ss_rules6_dst_bypass_$intf dst -j MARK --set-xmark 0x539$count
|
||||
-I ss_rules6_pre_src 2 -m set --match-set ss_rules6_dst_bypass_$intf dst -j RETURN
|
||||
-I ss_rules6_pre_src 1 -m set --match-set omr_rules6_dst_bypass_$intf dst -j MARK --set-xmark 0x539$count
|
||||
-I ss_rules6_pre_src 2 -m set --match-set omr_rules6_dst_bypass_$intf dst -j RETURN
|
||||
-I ss_rules6_pre_src 3 -m mark --mark 0x539$count -j RETURN
|
||||
COMMIT
|
||||
EOF
|
||||
|
|
@ -145,11 +144,11 @@ _bypass_ip_set() {
|
|||
start_service() {
|
||||
local count
|
||||
logger -t "omr-bypass" "Starting OMR-ByPass..."
|
||||
ipset -q flush ss_rules_dst_bypass_all > /dev/null 2>&1
|
||||
ipset -q flush ss_rules6_dst_bypass_all > /dev/null 2>&1
|
||||
ipset -q flush omr_rules_dst_bypass_all > /dev/null 2>&1
|
||||
ipset -q flush omr_rules6_dst_bypass_all > /dev/null 2>&1
|
||||
ipset -q --exist restore <<-EOF
|
||||
create ss_rules_dst_bypass_all hash:net hashsize 64
|
||||
create ss_rules6_dst_bypass_all hash:net family inet6 hashsize 64
|
||||
create omr_rules_dst_bypass_all hash:net hashsize 64
|
||||
create omr_rules6_dst_bypass_all hash:net family inet6 hashsize 64
|
||||
EOF
|
||||
|
||||
config_load network
|
||||
|
|
@ -162,35 +161,33 @@ start_service() {
|
|||
config_foreach _bypass_domain domains
|
||||
uci -q commit dhcp
|
||||
/etc/init.d/dnsmasq reload
|
||||
#config_foreach _bypass_proto dpis
|
||||
|
||||
ip rule add prio 1 fwmark 0x539 lookup 991337 > /dev/null 2>&1
|
||||
ip -6 rule add prio 1 fwmark 0x539 lookup 991337 > /dev/null 2>&1
|
||||
|
||||
if [ "$(iptables -w 40 -t mangle -L | grep 'match-set ss_rules_dst_bypass_all dst MARK set')" = "" ]; then
|
||||
if [ "$(iptables -w 40 -t mangle -L | grep 'match-set omr_rules_dst_bypass_all dst MARK set')" = "" ]; then
|
||||
iptables-restore --wait=60 --noflush <<-EOF
|
||||
*mangle
|
||||
-A PREROUTING -m set --match-set ss_rules_dst_bypass_all dst -j MARK --set-mark 0x539
|
||||
-A PREROUTING -m set --match-set omr_rules_dst_bypass_all dst -j MARK --set-mark 0x539
|
||||
COMMIT
|
||||
EOF
|
||||
fi
|
||||
if [ "$(ip6tables -w 40 -t mangle -L | grep 'match-set ss_rules6_dst_bypass_all dst MARK set')" = "" ]; then
|
||||
if [ "$(ip6tables -w 40 -t mangle -L | grep 'match-set omr_rules6_dst_bypass_all dst MARK set')" = "" ]; then
|
||||
ip6tables-restore --wait=60 --noflush <<-EOF
|
||||
*mangle
|
||||
-A PREROUTING -m set --match-set ss_rules6_dst_bypass_all dst -j MARK --set-mark 0x539
|
||||
-A PREROUTING -m set --match-set omr_rules6_dst_bypass_all dst -j MARK --set-mark 0x539
|
||||
COMMIT
|
||||
EOF
|
||||
fi
|
||||
|
||||
iptables-save --counters | grep -v omr-bypass-dpi | iptables-restore --counters
|
||||
ip6tables-save --counters | grep -v omr-bypass-dpi | ip6tables-restore --counters
|
||||
ndpi_rules=$(echo $ndpi_rules | awk 'NF')
|
||||
#iptables-restore --wait=60 --noflush <<-EOF
|
||||
#*mangle
|
||||
#:omr-bypass-dpi -
|
||||
#-A PREROUTING -m addrtype ! --dst-type LOCAL -j omr-bypass-dpi
|
||||
#COMMIT
|
||||
#EOF
|
||||
iptables-restore --wait=60 --noflush <<-EOF
|
||||
*mangle
|
||||
:omr-bypass-dpi -
|
||||
-A PREROUTING -m addrtype ! --dst-type LOCAL -j omr-bypass-dpi
|
||||
COMMIT
|
||||
EOF
|
||||
ip6tables-restore --wait=60 --noflush <<-EOF
|
||||
*mangle
|
||||
:omr-bypass-dpi -
|
||||
|
|
|
|||
|
|
@ -54,5 +54,15 @@ if [ "$(uci -q get ucitrack.@shadowsocks-libev[-1].affects | grep omr-bypass)" =
|
|||
add_list ucitrack.@shadowsocks-libev[-1].affects=omr-bypass
|
||||
EOF
|
||||
fi
|
||||
s=firewall.omr-bypass
|
||||
uci get "$s" >/dev/null || {
|
||||
uci batch <<-EOF
|
||||
set $s=include
|
||||
set $s.path=/etc/firewall.omr-bypass
|
||||
set $s.reload=1
|
||||
commit firewall
|
||||
EOF
|
||||
}
|
||||
|
||||
rm -f /tmp/luci-indexcache
|
||||
exit 0
|
||||
|
|
|
|||
|
|
@ -166,7 +166,6 @@ if [ "$OMR_TRACKER_STATUS" = "ERROR" ]; then
|
|||
if /etc/init.d/shadowsocks-libev rules_exist ; then
|
||||
/etc/init.d/shadowsocks-libev rules_down
|
||||
/etc/init.d/shadowsocks-libev rules_up
|
||||
/etc/init.d/omr-bypass reload >/dev/null 2>&1
|
||||
fi
|
||||
fi
|
||||
fi
|
||||
|
|
@ -184,7 +183,6 @@ if [ "$OMR_TRACKER_INTERFACE" = "glorytun" ] || [ "$OMR_TRACKER_INTERFACE" = "om
|
|||
if /etc/init.d/shadowsocks-libev rules_exist ; then
|
||||
/etc/init.d/shadowsocks-libev rules_down
|
||||
/etc/init.d/shadowsocks-libev rules_up
|
||||
/etc/init.d/omr-bypass reload >/dev/null 2>&1
|
||||
fi
|
||||
fi
|
||||
|
||||
|
|
|
|||
|
|
@ -308,20 +308,12 @@ start_service() {
|
|||
config_foreach ss_xxx "$cfgtype" "$cfgtype"
|
||||
done
|
||||
rules_up
|
||||
#ss_rules
|
||||
#ss_rules6
|
||||
[ -f /etc/init.d/omr-bypass ] && /etc/init.d/omr-bypass restart
|
||||
# Add rule to match traffic marked by firewall for bypass
|
||||
ip rule add prio 1 fwmark 0x539 lookup 991337 > /dev/null 2>&1
|
||||
}
|
||||
|
||||
stop_service() {
|
||||
#local bin="$ss_bindir/ss-rules"
|
||||
#[ -x "$bin" ] && "$bin" -f
|
||||
#local bin6="$ss_bindir/ss-rules6"
|
||||
#[ -x "$bin6" ] && "$bin6" -f
|
||||
rules_down
|
||||
[ -f /etc/init.d/omr-bypass ] && /etc/init.d/omr-bypass restart
|
||||
rm -rf "$ss_confdir"
|
||||
}
|
||||
|
||||
|
|
@ -344,6 +336,7 @@ rules_up() {
|
|||
done
|
||||
ss_rules
|
||||
ss_rules6
|
||||
[ -f /etc/init.d/omr-bypass ] && /etc/init.d/omr-bypass restart
|
||||
}
|
||||
|
||||
rules_down() {
|
||||
|
|
|
|||
|
|
@ -9,12 +9,3 @@ uci get "$s" >/dev/null || {
|
|||
commit firewall
|
||||
EOF
|
||||
}
|
||||
#s=firewall.ss_rules6
|
||||
#uci get "$s" >/dev/null || {
|
||||
# uci batch <<-EOF
|
||||
# set $s=include
|
||||
# set $s.path=/etc/firewall.ss-rules6
|
||||
# set $s.reload=1
|
||||
# commit firewall
|
||||
# EOF
|
||||
#}
|
||||
|
|
|
|||
|
|
@ -174,7 +174,7 @@ ss_rules6_iptchains_init_tcp() {
|
|||
-A ss_rules6_local_out -m set --match-set ss_rules6_dst_bypass dst -j RETURN
|
||||
-A ss_rules6_local_out -m set --match-set ss_rules6_dst_bypass_all dst -j RETURN
|
||||
-A ss_rules6_local_out -m set --match-set ss_rules6_dst_bypass_ dst -j RETURN
|
||||
-A ss_rules6_local_out -m mark ! --mark 0 -j RETURN
|
||||
-A ss_rules6_local_out -m mark --mark 0x539 -j RETURN
|
||||
-A ss_rules6_local_out -p tcp $o_ipt_extra -j $local_target -m comment --comment "local_default: $o_local_default"
|
||||
COMMIT
|
||||
EOF
|
||||
|
|
@ -234,7 +234,7 @@ ss_rules6_iptchains_init_() {
|
|||
-A ss_rules6_pre_src -m set --match-set ss_rules6_dst_bypass_all dst -j MARK --set-mark 0x539
|
||||
-A ss_rules6_pre_src -m set --match-set ss_rules6_dst_bypass_all dst -j RETURN
|
||||
-A ss_rules6_pre_src -m set --match-set ss_rules6_dst_bypass dst -j RETURN
|
||||
-A ss_rules6_pre_src -m mark ! --mark 0 -j RETURN
|
||||
-A ss_rules6_pre_src -m mark --mark 0x539 -j RETURN
|
||||
-A ss_rules6_dst -m set --match-set ss_rules6_dst_bypass_all dst -j RETURN
|
||||
-A ss_rules6_dst -m set --match-set ss_rules6_dst_bypass dst -j RETURN
|
||||
-A ss_rules6_pre_src -p $proto $o_ipt_extra -j ss_rules6_src
|
||||
|
|
|
|||
Loading…
Reference in a new issue