mirror of
https://github.com/Ysurac/openmptcprouter-feeds.git
synced 2025-02-13 02:51:50 +00:00
Bypass changes
This commit is contained in:
Ycarus
parent
008cdcc468
commit
703e376d60
5 changed files with 62 additions and 40 deletions
|
|
@ -50,11 +50,28 @@ _bypass_proto() {
|
|||
[ -z "$intf" ] && intf="all"
|
||||
[ -z "$proto" ] && return
|
||||
if [ "$intf" = "all" ]; then
|
||||
ndpi_rules="-A omr-bypass-dpi -m ndpi --$proto -j MARK --set-mark 0x539
|
||||
$ndpi_rules"
|
||||
echo "Add $proto"
|
||||
iptables-restore --wait=60 --noflush <<-EOF
|
||||
*mangle
|
||||
-A omr-bypass-dpi -m ndpi --$proto -j MARK --set-mark 0x539
|
||||
COMMIT
|
||||
EOF
|
||||
ip6tables-restore --wait=60 --noflush <<-EOF
|
||||
*mangle
|
||||
-A omr-bypass-dpi -m ndpi --$proto -j MARK --set-mark 0x539
|
||||
COMMIT
|
||||
EOF
|
||||
else
|
||||
ndpi_rules="-A omr-bypass-dpi -m ndpi --$proto -j MARK --set-mark 0x539$intfid
|
||||
$ndpi_rules"
|
||||
iptables-restore --wait=60 --noflush <<-EOF
|
||||
*mangle
|
||||
-A omr-bypass-dpi -m ndpi --$proto -j MARK --set-mark 0x539$intfid
|
||||
COMMIT
|
||||
EOF
|
||||
ip6tables-restore --wait=60 --noflush <<-EOF
|
||||
*mangle
|
||||
-A omr-bypass-dpi -m ndpi --$proto -j MARK --set-mark 0x539$intfid
|
||||
COMMIT
|
||||
EOF
|
||||
fi
|
||||
}
|
||||
|
||||
|
|
@ -82,14 +99,15 @@ _intf_rule() {
|
|||
EOF
|
||||
fi
|
||||
if [ "$(iptables -w 40 -t nat -L | grep ss_rules_pre_src)" != "" ] && [ "$(iptables -w 40 -t nat -L | grep ss_rules_dst_bypass_$intf)" = "" ]; then
|
||||
echo "add nat rules..."
|
||||
iptables-restore --wait=60 --noflush <<-EOF
|
||||
*nat
|
||||
-I ss_rules_dst 1 -m set --match-set ss_rules_dst_bypass_$intf dst -j RETURN
|
||||
-I ss_rules_local_out 1 -m set --match-set ss_rules_dst_bypass_$intf dst -j RETURN
|
||||
-I ss_rules_local_out 2 -m mark --mark 0x539$count -j RETURN
|
||||
-I ss_rules_pre_src 1 -m set --match-set ss_rules_dst_bypass_$intf dst -j MARK --set-xmark 0x539$count
|
||||
-I ss_rules_pre_src 2 -m set --match-set ss_rules_dst_bypass_$intf dst -j RETURN
|
||||
-I ss_rules_pre_src 3 -m mark --mark 0x539$count -j RETURN
|
||||
-I ss_rules_local_out 1 -m mark --mark 0x539$count -j RETURN
|
||||
COMMIT
|
||||
EOF
|
||||
fi
|
||||
|
|
@ -105,10 +123,10 @@ _intf_rule() {
|
|||
*nat
|
||||
-I ss_rules6_dst 1 -m set --match-set ss_rules6_dst_bypass_$intf dst -j RETURN
|
||||
-I ss_rules6_local_out 1 -m set --match-set ss_rules6_dst_bypass_$intf dst -j RETURN
|
||||
-I ss_rules6_local_out 2 -m mark --mark 0x539$count -j RETURN
|
||||
-I ss_rules6_pre_src 1 -m set --match-set ss_rules6_dst_bypass_$intf dst -j MARK --set-xmark 0x539$count
|
||||
-I ss_rules6_pre_src 2 -m set --match-set ss_rules6_dst_bypass_$intf dst -j RETURN
|
||||
-I ss_rules6_pre_src 3 -m mark --mark 0x539$count -j RETURN
|
||||
-I ss_rules6_local_out 1 -m mark --mark 0x539$count -j RETURN
|
||||
COMMIT
|
||||
EOF
|
||||
fi
|
||||
|
|
@ -144,7 +162,7 @@ start_service() {
|
|||
config_foreach _bypass_domain domains
|
||||
uci -q commit dhcp
|
||||
/etc/init.d/dnsmasq reload
|
||||
config_foreach _bypass_proto dpis
|
||||
#config_foreach _bypass_proto dpis
|
||||
|
||||
ip rule add prio 1 fwmark 0x539 lookup 991337 > /dev/null 2>&1
|
||||
ip -6 rule add prio 1 fwmark 0x539 lookup 991337 > /dev/null 2>&1
|
||||
|
|
@ -167,28 +185,26 @@ start_service() {
|
|||
iptables-save --counters | grep -v omr-bypass-dpi | iptables-restore --counters
|
||||
ip6tables-save --counters | grep -v omr-bypass-dpi | ip6tables-restore --counters
|
||||
ndpi_rules=$(echo $ndpi_rules | awk 'NF')
|
||||
if [ "$ndpi_rules" != "" ]; then
|
||||
iptables-restore --wait=60 --noflush <<-EOF
|
||||
*mangle
|
||||
:omr-bypass-dpi -
|
||||
-A PREROUTING -m addrtype ! --dst-type LOCAL -j omr-bypass-dpi
|
||||
$ndpi_rules
|
||||
COMMIT
|
||||
EOF
|
||||
ip6tables-restore --wait=60 --noflush <<-EOF
|
||||
*mangle
|
||||
:omr-bypass-dpi -
|
||||
-A PREROUTING -m addrtype ! --dst-type LOCAL -j omr-bypass-dpi
|
||||
$ndpi_rules
|
||||
COMMIT
|
||||
EOF
|
||||
fi
|
||||
#iptables-restore --wait=60 --noflush <<-EOF
|
||||
#*mangle
|
||||
#:omr-bypass-dpi -
|
||||
#-A PREROUTING -m addrtype ! --dst-type LOCAL -j omr-bypass-dpi
|
||||
#COMMIT
|
||||
#EOF
|
||||
ip6tables-restore --wait=60 --noflush <<-EOF
|
||||
*mangle
|
||||
:omr-bypass-dpi -
|
||||
-A PREROUTING -m addrtype ! --dst-type LOCAL -j omr-bypass-dpi
|
||||
COMMIT
|
||||
EOF
|
||||
config_load omr-bypass
|
||||
config_foreach _bypass_proto dpis
|
||||
logger -t "omr-bypass" "OMR-ByPass is running"
|
||||
}
|
||||
|
||||
service_triggers() {
|
||||
PROCD_RELOAD_DELAY=1000
|
||||
procd_add_reload_trigger omr-bypass shadowsocks-libev
|
||||
procd_add_reload_trigger omr-bypass
|
||||
procd_add_raw_trigger "interface.*" 2000 /etc/init.d/omr-bypass restart
|
||||
}
|
||||
|
||||
|
|
|
|||
|
|
@ -198,7 +198,7 @@ if [ "$OMR_TRACKER_INTERFACE" = "glorytun" ] || [ "$OMR_TRACKER_INTERFACE" = "om
|
|||
uci -q set openmptcprouter.$OMR_TRACKER_INTERFACE.mtu=$mtu
|
||||
ip link set dev $OMR_TRACKER_DEVICE mtu $mtu > /dev/null 2>&1
|
||||
uci -q set openmptcprouter.$OMR_TRACKER_INTERFACE.lc=$(date +"%s")
|
||||
elif [ -z "$(uci -q get openmptcprouter.$OMR_TRACKER_INTERFACE.mtu)" ] || [ "$(uci -q get openmptcprouter.$OMR_TRACKER_INTERFACE.mtu)" = "1500" ]; then
|
||||
elif [ -z "$(uci -q get openmptcprouter.$OMR_TRACKER_INTERFACE.mtu)" ]; then
|
||||
[ -n "$serverip" ] && {
|
||||
local mtu=$(omr-mtu $OMR_TRACKER_DEVICE_IP $serverip)
|
||||
[ -n "$mtu" ] && {
|
||||
|
|
|
|||
|
|
@ -307,17 +307,21 @@ start_service() {
|
|||
for cfgtype in ss_local ss_redir ss_server ss_tunnel; do
|
||||
config_foreach ss_xxx "$cfgtype" "$cfgtype"
|
||||
done
|
||||
ss_rules
|
||||
ss_rules6
|
||||
rules_up
|
||||
#ss_rules
|
||||
#ss_rules6
|
||||
[ -f /etc/init.d/omr-bypass ] && /etc/init.d/omr-bypass restart
|
||||
# Add rule to match traffic marked by firewall for bypass
|
||||
ip rule add prio 1 fwmark 0x539 lookup 991337 > /dev/null 2>&1
|
||||
}
|
||||
|
||||
stop_service() {
|
||||
local bin="$ss_bindir/ss-rules"
|
||||
[ -x "$bin" ] && "$bin" -f
|
||||
local bin6="$ss_bindir/ss-rules6"
|
||||
[ -x "$bin6" ] && "$bin6" -f
|
||||
#local bin="$ss_bindir/ss-rules"
|
||||
#[ -x "$bin" ] && "$bin" -f
|
||||
#local bin6="$ss_bindir/ss-rules6"
|
||||
#[ -x "$bin6" ] && "$bin6" -f
|
||||
rules_down
|
||||
[ -f /etc/init.d/omr-bypass ] && /etc/init.d/omr-bypass restart
|
||||
rm -rf "$ss_confdir"
|
||||
}
|
||||
|
||||
|
|
|
|||
|
|
@ -192,6 +192,7 @@ ss_rules_iptchains_init_tcp() {
|
|||
-A ss_rules_local_out -m set --match-set ss_rules_dst_bypass dst -j RETURN
|
||||
-A ss_rules_local_out -m set --match-set ss_rules_dst_bypass_all dst -j RETURN
|
||||
-A ss_rules_local_out -m set --match-set ss_rules_dst_bypass_ dst -j RETURN
|
||||
-A ss_rules_local_out -m mark --mark 0x539 -j RETURN
|
||||
-A ss_rules_local_out -p tcp $o_ipt_extra -j $local_target -m comment --comment "local_default: $o_local_default"
|
||||
COMMIT
|
||||
EOF
|
||||
|
|
@ -250,6 +251,7 @@ ss_rules_iptchains_init_() {
|
|||
-A ss_rules_pre_src -m set --match-set ss_rules_dst_bypass_all dst -j MARK --set-mark 0x539
|
||||
-A ss_rules_pre_src -m set --match-set ss_rules_dst_bypass_all dst -j RETURN
|
||||
-A ss_rules_pre_src -m set --match-set ss_rules_dst_bypass dst -j RETURN
|
||||
-A ss_rules_pre_src -m mark --mark 0x539 -j RETURN
|
||||
-A ss_rules_dst -m set --match-set ss_rules_dst_bypass_all dst -j RETURN
|
||||
-A ss_rules_dst -m set --match-set ss_rules_dst_bypass dst -j RETURN
|
||||
-A ss_rules_pre_src -p $proto $o_ipt_extra -j ss_rules_src
|
||||
|
|
|
|||
|
|
@ -9,12 +9,12 @@ uci get "$s" >/dev/null || {
|
|||
commit firewall
|
||||
EOF
|
||||
}
|
||||
s=firewall.ss_rules6
|
||||
uci get "$s" >/dev/null || {
|
||||
uci batch <<-EOF
|
||||
set $s=include
|
||||
set $s.path=/etc/firewall.ss-rules6
|
||||
set $s.reload=1
|
||||
commit firewall
|
||||
EOF
|
||||
}
|
||||
#s=firewall.ss_rules6
|
||||
#uci get "$s" >/dev/null || {
|
||||
# uci batch <<-EOF
|
||||
# set $s=include
|
||||
# set $s.path=/etc/firewall.ss-rules6
|
||||
# set $s.reload=1
|
||||
# commit firewall
|
||||
# EOF
|
||||
#}
|
||||
|
|
|
|||
Loading…
Reference in a new issue