mirror of
https://github.com/Ysurac/openmptcprouter-feeds.git
synced 2025-03-09 15:40:03 +00:00
Use iptables-legacy instead of iptables
This commit is contained in:
Ycarus (Yannick Chabanois)
parent
ca45d952c2
commit
827a93c478
10 changed files with 233 additions and 132 deletions
|
|
@ -1,18 +1,31 @@
|
|||
#!/bin/sh
|
||||
|
||||
if [ -f /usr/sbin/iptables-legacy ]; then
|
||||
IPTABLES="/usr/sbin/iptables-legacy"
|
||||
IP6TABLES="/usr/sbin/ip6tables-legacy"
|
||||
IPTABLESSAVE="/usr/sbin/iptables-legacy-save"
|
||||
IP6TABLESSAVE="/usr/sbin/ip6tables-legacy-save"
|
||||
else
|
||||
IPTABLES="/usr/sbin/iptables"
|
||||
IP6TABLES="/usr/sbin/ip6tables"
|
||||
IPTABLESSAVE="/usr/sbin/iptables-save"
|
||||
IP6TABLESSAVE="/usr/sbin/ip6tables-save"
|
||||
fi
|
||||
|
||||
ss_rules_fw_drop() {
|
||||
timeout 1 fw3 -4 print 2>/dev/null | awk '/iptables/&&/zone_lan_forward/&&/tcp/&&/-t filter/&&/-j reject/ {for(i=6; i<=NF; i++) { printf "%s ",$i } print "\n" }' |
|
||||
while IFS=$"\n" read -r c; do
|
||||
fwrule=$(echo "$c" | sed 's/reject/REDIRECT --to-ports 65535/')
|
||||
if [ -n "$fwrule" ] && [ -z "$(iptables-save 2>/dev/null | grep zone_lan_prerouting | grep '${fwrule}')" ]; then
|
||||
eval "iptables -w -t nat -A zone_lan_prerouting ${fwrule} 2>&1 >/dev/null"
|
||||
if [ -n "$fwrule" ] && [ -z "$($IPTABLESSAVE 2>/dev/null | grep zone_lan_prerouting | grep '${fwrule}')" ]; then
|
||||
eval "$IPTABLES-w -t nat -A zone_lan_prerouting ${fwrule} 2>&1 >/dev/null"
|
||||
fw=$((fw+1))
|
||||
fi
|
||||
done
|
||||
timeout 1 fw3 -4 print 2>/dev/null | awk '/iptables/&&/zone_lan_forward/&&/tcp/&&/-t filter/&&/-j DROP/ {for(i=6; i<=NF; i++) { printf "%s ",$i } print "\n" }' |
|
||||
while IFS=$"\n" read -r c; do
|
||||
fwrule=$(echo "$c" | sed 's/DROP/REDIRECT --to-ports 65535/')
|
||||
if [ -n "$fwrule" ] && [ -z "$(iptables-save 2>/dev/null | grep zone_lan_prerouting | grep '${fwrule}')" ]; then
|
||||
eval "iptables -w -t nat -A zone_lan_prerouting ${fwrule} 2>&1 >/dev/null"
|
||||
if [ -n "$fwrule" ] && [ -z "$($IPTABLESSAVE 2>/dev/null | grep zone_lan_prerouting | grep '${fwrule}')" ]; then
|
||||
eval "$IPTABLES-w -t nat -A zone_lan_prerouting ${fwrule} 2>&1 >/dev/null"
|
||||
fw=$((fw+1))
|
||||
fi
|
||||
done
|
||||
|
|
@ -22,16 +35,16 @@ ss_rules6_fw_drop() {
|
|||
timeout 1 fw3 -6 print 2>/dev/null | awk '/iptables/&&/zone_lan_forward/&&/tcp/&&/-t filter/&&/-j reject/ {for(i=6; i<=NF; i++) { printf "%s ",$i } print "\n" }' |
|
||||
while IFS=$"\n" read -r c; do
|
||||
fwrule=$(echo "$c" | sed 's/reject/REDIRECT --to-ports 65535/')
|
||||
if [ -n "$fwrule" ] && [ -z "$(iptables-save 2>/dev/null | grep zone_lan_prerouting | grep '${fwrule}')" ]; then
|
||||
eval "ip6tables -w -t nat -A zone_lan_prerouting ${fwrule} 2>&1 >/dev/null"
|
||||
if [ -n "$fwrule" ] && [ -z "$($IPTABLESSAVE 2>/dev/null | grep zone_lan_prerouting | grep '${fwrule}')" ]; then
|
||||
eval "$IP6TABLES-w -t nat -A zone_lan_prerouting ${fwrule} 2>&1 >/dev/null"
|
||||
fw=$((fw+1))
|
||||
fi
|
||||
done
|
||||
timeout 1 fw3 -6 print 2>/dev/null | awk '/iptables/&&/zone_lan_forward/&&/tcp/&&/-t filter/&&/-j DROP/ {for(i=6; i<=NF; i++) { printf "%s ",$i } print "\n" }' |
|
||||
while IFS=$"\n" read -r c; do
|
||||
fwrule=$(echo "$c" | sed 's/DROP/REDIRECT --to-ports 65535/')
|
||||
if [ -n "$fwrule" ] && [ -z "$(iptables-save 2>/dev/null | grep zone_lan_prerouting | grep '${fwrule}')" ]; then
|
||||
eval "ip6tables -w -t nat -A zone_lan_prerouting ${fwrule} 2>&1 >/dev/null"
|
||||
if [ -n "$fwrule" ] && [ -z "$($IPTABLESSAVE 2>/dev/null | grep zone_lan_prerouting | grep '${fwrule}')" ]; then
|
||||
eval "$IP6TABLES-w -t nat -A zone_lan_prerouting ${fwrule} 2>&1 >/dev/null"
|
||||
fw=$((fw+1))
|
||||
fi
|
||||
done
|
||||
|
|
@ -41,16 +54,16 @@ v2r_rules_fw_drop() {
|
|||
timeout 1 fw3 -4 print 2>/dev/null | awk '/iptables/&&/zone_lan_forward/&&/tcp/&&/-t filter/&&/-j reject/ {for(i=6; i<=NF; i++) { printf "%s ",$i } print "\n" }' |
|
||||
while IFS=$"\n" read -r c; do
|
||||
fwrule=$(echo "$c" | sed 's/reject/REDIRECT --to-ports 65535/')
|
||||
if [ -n "$fwrule" ] && [ -z "$(iptables-save 2>/dev/null | grep zone_lan_prerouting | grep '${fwrule}')" ]; then
|
||||
eval "iptables -w -t nat -I zone_lan_prerouting 1 ${fwrule} 2>&1 >/dev/null"
|
||||
if [ -n "$fwrule" ] && [ -z "$($IPTABLESSAVE 2>/dev/null | grep zone_lan_prerouting | grep '${fwrule}')" ]; then
|
||||
eval "$IPTABLES-w -t nat -I zone_lan_prerouting 1 ${fwrule} 2>&1 >/dev/null"
|
||||
fw=$((fw+1))
|
||||
fi
|
||||
done
|
||||
timeout 1 fw3 -4 print 2>/dev/null | awk '/iptables/&&/zone_lan_forward/&&/tcp/&&/-t filter/&&/-j DROP/ {for(i=6; i<=NF; i++) { printf "%s ",$i } print "\n" }' |
|
||||
while IFS=$"\n" read -r c; do
|
||||
fwrule=$(echo "$c" | sed 's/DROP/REDIRECT --to-ports 65535/')
|
||||
if [ -n "$fwrule" ] && [ -z "$(iptables-save 2>/dev/null | grep zone_lan_prerouting | grep '${fwrule}')" ]; then
|
||||
eval "iptables -w -t nat -I zone_lan_prerouting 1 ${fwrule} 2>&1 >/dev/null"
|
||||
if [ -n "$fwrule" ] && [ -z "$($IPTABLESSAVE 2>/dev/null | grep zone_lan_prerouting | grep '${fwrule}')" ]; then
|
||||
eval "$IPTABLES-w -t nat -I zone_lan_prerouting 1 ${fwrule} 2>&1 >/dev/null"
|
||||
fw=$((fw+1))
|
||||
fi
|
||||
done
|
||||
|
|
@ -60,21 +73,21 @@ v2ray_rules6_fw_drop() {
|
|||
timeout 1 fw3 -6 print 2>/dev/null | awk '/iptables/&&/zone_lan_forward/&&/tcp/&&/-t filter/&&/-j reject/ {for(i=6; i<=NF; i++) { printf "%s ",$i } print "\n" }' |
|
||||
while IFS=$"\n" read -r c; do
|
||||
fwrule=$(echo "$c" | sed 's/reject/REDIRECT --to-ports 65535/')
|
||||
if [ -n "$fwrule" ] && [ -z "$(iptables-save 2>/dev/null | grep zone_lan_prerouting | grep '${fwrule}')" ]; then
|
||||
eval "ip6tables -w -t nat -I zone_lan_prerouting 1 ${fwrule} 2>&1 >/dev/null"
|
||||
if [ -n "$fwrule" ] && [ -z "$($IPTABLESSAVE 2>/dev/null | grep zone_lan_prerouting | grep '${fwrule}')" ]; then
|
||||
eval "$IP6TABLES-w -t nat -I zone_lan_prerouting 1 ${fwrule} 2>&1 >/dev/null"
|
||||
fi
|
||||
done
|
||||
timeout 1 fw3 -6 print 2>/dev/null | awk '/iptables/&&/zone_lan_forward/&&/tcp/&&/-t filter/&&/-j DROP/ {for(i=6; i<=NF; i++) { printf "%s ",$i } print "\n" }' |
|
||||
while IFS=$"\n" read -r c; do
|
||||
fwrule=$(echo "$c" | sed 's/DROP/REDIRECT --to-ports 65535/')
|
||||
if [ -n "$fwrule" ] && [ -z "$(iptables-save 2>/dev/null | grep zone_lan_prerouting | grep '${fwrule}')" ]; then
|
||||
eval "ip6tables -w -t nat -I zone_lan_prerouting 1 ${fwrule} 2>&1 >/dev/null"
|
||||
if [ -n "$fwrule" ] && [ -z "$($IPTABLESSAVE 2>/dev/null | grep zone_lan_prerouting | grep '${fwrule}')" ]; then
|
||||
eval "$IP6TABLES-w -t nat -I zone_lan_prerouting 1 ${fwrule} 2>&1 >/dev/null"
|
||||
fi
|
||||
done
|
||||
}
|
||||
|
||||
[ -n "$(pgrep blocklanfw)" ] && exit 0
|
||||
[ -z "$(iptables-save 2>/dev/null | grep zone_lan)" ] && exit 0
|
||||
[ -z "$($IPTABLESSAVE 2>/dev/null | grep zone_lan)" ] && exit 0
|
||||
fw=0
|
||||
if [ "$(uci -q get openmptcprouter.settings.proxy)" = "shadowsocks" ]; then
|
||||
ss_rules6_fw_drop
|
||||
|
|
|
|||
|
|
@ -1,6 +1,14 @@
|
|||
#!/bin/sh
|
||||
. /lib/functions.sh
|
||||
|
||||
if [ -f /usr/sbin/iptables-legacy ]; then
|
||||
IPTABLESSAVE="/usr/sbin/iptables-legacy-save"
|
||||
IPTABLESRESTORE="/usr/sbin/iptables-legacy-restore"
|
||||
else
|
||||
IPTABLESSAVE="/usr/sbin/iptables-save"
|
||||
IPTABLESRESTORE="/usr/sbin/iptables-restore"
|
||||
fi
|
||||
|
||||
_setup_rules() {
|
||||
config_get lookup $1 lookup
|
||||
[ -n "$lookup" ] && [ -z "$(ip rule list fwmark 0x${lookup})" ] && {
|
||||
|
|
@ -30,8 +38,8 @@ _setup_fw() {
|
|||
[ -n "$src_ips_forward" ] && rule="$rule -s $(echo "${src_ips_forward}" | sed 's/ /,/g')"
|
||||
[ -n "$ifnames" ] && rule="$rule -i $(echo "${ifnames}" | sed 's/ /-i /g')"
|
||||
if [ -n "$rule" ] && [ -n "$lookup" ]; then
|
||||
iptables-save --counters | grep -v "0x${lookup}" | iptables-restore -w --counters
|
||||
iptables-restore -w --wait=60 --noflush <<-EOF
|
||||
$IPTABLESAVE --counters | grep -v "0x${lookup}" | $IPTABLERESTORE -w --counters
|
||||
$IPTABLERESTORE -w --wait=60 --noflush <<-EOF
|
||||
*mangle
|
||||
-A omr-gre-tunnel ${rule} -j MARK --set-mark 0x${lookup}
|
||||
COMMIT
|
||||
|
|
@ -39,8 +47,8 @@ _setup_fw() {
|
|||
fi
|
||||
}
|
||||
|
||||
if [ -z "$(iptables-save | grep omr-gre-tunnel)" ]; then
|
||||
iptables-restore -w --wait=60 --noflush <<-EOF
|
||||
if [ -z "$($IPTABLESAVE | grep omr-gre-tunnel)" ]; then
|
||||
$IPTABLERESTORE -w --wait=60 --noflush <<-EOF
|
||||
*mangle
|
||||
:omr-gre-tunnel -
|
||||
-I PREROUTING 1 -m addrtype ! --dst-type LOCAL -j omr-gre-tunnel
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue