mirror of
https://github.com/Ysurac/openmptcprouter-feeds.git
synced 2025-03-09 15:40:03 +00:00
Add IPv6 support with v2ray
This commit is contained in:
Ycarus (Yannick Chabanois)
parent
eefd3ac89a
commit
b6b6d2fc29
3 changed files with 310 additions and 12 deletions
|
|
@ -411,8 +411,12 @@ add_v2ray_redirect_rules() {
|
|||
local ipset_dst_direct="$IPSET_DST_DIRECT_V4"
|
||||
|
||||
test -n "$port" || return
|
||||
#logger -t "v2ray" "v2ray-rules -l ${port} -L ${port} -s $OUTBOUND_SERVERS_V4 --rule-name def --src-default forward --dst-default forward --local-default forward"
|
||||
logger -t "v2ray" "v2ray-rules -l ${port} -L ${port} -s $OUTBOUND_SERVERS_V4 --rule-name def --src-default forward --dst-default forward --local-default forward"
|
||||
v2ray-rules -l ${port} -L ${port} -s $OUTBOUND_SERVERS_V4 --rule-name def --src-default forward --dst-default forward --local-default forward
|
||||
logger -t "v2ray" "v2ray-rules2 -l $((port+1)) -L $((port+1)) -s $OUTBOUND_SERVERS_V6 --rule-name def --src-default forward --dst-default forward --local-default forward"
|
||||
v2ray-rules6 -l $((port+1)) -L $((port+1)) --rule-name def --src-default forward --dst-default forward --local-default forward
|
||||
logger -t "V2Ray" "Reload omr-bypass rules"
|
||||
/etc/init.d/omr-bypass reload_rules
|
||||
}
|
||||
|
||||
init_rules_for_listfile() {
|
||||
|
|
@ -1268,18 +1272,18 @@ add_inbound_setting() {
|
|||
|
||||
json_add_object "sockopt"
|
||||
|
||||
if [ -n "$port" ] && [ "x$port" = "x$TRANSPARENT_PROXY_PORT" ] ; then
|
||||
if [ "x$TRANSPARENT_PROXY_USE_TPROXY" = "x1" ] ; then
|
||||
json_add_string "tproxy" "tproxy"
|
||||
else
|
||||
json_add_string "tproxy" "redirect"
|
||||
fi
|
||||
else
|
||||
# if [ -n "$port" ] && [ "x$port" = "x$TRANSPARENT_PROXY_PORT" ] ; then
|
||||
# if [ "x$TRANSPARENT_PROXY_USE_TPROXY" = "x1" ] ; then
|
||||
# json_add_string "tproxy" "tproxy"
|
||||
# else
|
||||
# json_add_string "tproxy" "redirect"
|
||||
# fi
|
||||
# else
|
||||
test -n "$ss_sockopt_tcp_fast_open" && \
|
||||
json_add_boolean "tcpFastOpen" "$ss_sockopt_tcp_fast_open"
|
||||
test -n "$ss_sockopt_tproxy" && \
|
||||
json_add_string "tproxy" "$ss_sockopt_tproxy"
|
||||
fi
|
||||
# fi
|
||||
|
||||
json_close_object # sockopt
|
||||
|
||||
|
|
@ -2082,10 +2086,11 @@ rules_up() {
|
|||
config_get enabled main enabled "0"
|
||||
[ "$enabled" = "0" ] && return
|
||||
logger -t "V2Ray" "Rules UP"
|
||||
#local bin="/usr/bin/v2ray-rules"
|
||||
[ -x "$bin" ] && {
|
||||
"$bin" >/dev/null 2>&1
|
||||
}
|
||||
local bin6="/usr/bin/v2ray-rules6"
|
||||
#local bin6="/usr/bin/v2ray-rules6"
|
||||
[ -x "$bin6" ] && {
|
||||
"$bin6" >/dev/null 2>&1
|
||||
}
|
||||
|
|
@ -2122,6 +2127,7 @@ start_service() {
|
|||
|
||||
setup_transparent_proxy
|
||||
gracefully_restart_dnsmasq
|
||||
rules_up
|
||||
|
||||
unset OUTBOUND_SERVERS_V4 \
|
||||
OUTBOUND_SERVERS_V6 \
|
||||
|
|
@ -2138,8 +2144,8 @@ stop_service() {
|
|||
fi
|
||||
|
||||
clear_transparent_proxy
|
||||
rules_down
|
||||
gracefully_restart_dnsmasq
|
||||
|
||||
test -d "$CONFIG_FOLDER" && rm -rf "$CONFIG_FOLDER"
|
||||
}
|
||||
|
||||
|
|
|
|||
|
|
@ -12,6 +12,7 @@ if [ -z "$(uci -q get v2ray.main)" ]; then
|
|||
set v2ray.main.enabled='0'
|
||||
set v2ray.main.outbounds='omrout'
|
||||
set v2ray.main.inbounds='omr'
|
||||
add_list v2ray.main.inbounds='omr6'
|
||||
add_list v2ray.main.inbounds='omrtest'
|
||||
set v2ray.main_dns=dns
|
||||
set v2ray.main_dns.hosts='example.com|127.0.0.1'
|
||||
|
|
@ -62,7 +63,7 @@ if [ -z "$(uci -q get v2ray.main)" ]; then
|
|||
set v2ray.omrout.mux_concurrency='8'
|
||||
set v2ray.omr=inbound
|
||||
set v2ray.omr.alias='V2RayServer'
|
||||
set v2ray.omr.listen='::'
|
||||
set v2ray.omr.listen='0.0.0.0'
|
||||
set v2ray.omr.port='1897'
|
||||
set v2ray.omr.protocol='dokodemo-door'
|
||||
set v2ray.omr.s_dokodemo_door_network='tcp'
|
||||
|
|
@ -70,6 +71,16 @@ if [ -z "$(uci -q get v2ray.main)" ]; then
|
|||
set v2ray.omr.ss_sockopt_tproxy='redirect'
|
||||
set v2ray.omr.ss_sockopt_tcp_fast_open='1'
|
||||
set v2ray.omr.s_dokodemo_door_follow_redirect='1'
|
||||
set v2ray.omr6=inbound
|
||||
set v2ray.omr6.alias='V2RayServer'
|
||||
set v2ray.omr6.listen='::'
|
||||
set v2ray.omr6.port='1898'
|
||||
set v2ray.omr6.protocol='dokodemo-door'
|
||||
set v2ray.omr6.s_dokodemo_door_network='tcp'
|
||||
add_list v2ray.omr6.s_dokodemo_door_network='udp'
|
||||
set v2ray.omr6.ss_sockopt_tproxy='tproxy'
|
||||
set v2ray.omr6.ss_sockopt_tcp_fast_open='1'
|
||||
set v2ray.omr6.s_dokodemo_door_follow_redirect='1'
|
||||
set v2ray.omrtest=inbound
|
||||
set v2ray.omrtest.port='1111'
|
||||
set v2ray.omrtest.protocol='socks'
|
||||
|
|
|
|||
281
v2ray-core/files/usr/bin/v2ray-rules6
Executable file
281
v2ray-core/files/usr/bin/v2ray-rules6
Executable file
|
|
@ -0,0 +1,281 @@
|
|||
#!/bin/sh -e
|
||||
#
|
||||
# Copyright (C) 2017 Yousong Zhou <yszhou4tech@gmail.com>
|
||||
# Copyright (C) 2018-2020 Ycarus (Yannick Chabanois) <ycarus@zugaina.org>
|
||||
#
|
||||
# The design idea was derived from ss-rules by Jian Chang <aa65535@live.com>
|
||||
#
|
||||
# This is free software, licensed under the GNU General Public License v3.
|
||||
# See /LICENSE for more information.
|
||||
#
|
||||
|
||||
v2ray_rules6_usage() {
|
||||
cat >&2 <<EOF
|
||||
Usage: v2ray-rules6 [options]
|
||||
|
||||
-h, --help Show this help message then exit
|
||||
-f, --flush Flush rules, ipset then exit
|
||||
-l <port> Local port number of ss-redir with TCP mode
|
||||
-L <port> Local port number of ss-redir with UDP mode
|
||||
-s <ips> List of ip addresses of remote shadowsocks server
|
||||
--ifnames Only apply rules on packets from these ifnames
|
||||
--src-bypass <ips|cidr>
|
||||
--src-forward <ips|cidr>
|
||||
--src-checkdst <ips|cidr>
|
||||
--src-default <bypass|forward|checkdst>
|
||||
Packets will have their src ip checked in order against
|
||||
bypass, forward, checkdst list and will bypass, forward
|
||||
through, or continue to have their dst ip checked
|
||||
respectively on the first match. Otherwise, --src-default
|
||||
decide the default action
|
||||
--dst-bypass <ips|cidr>
|
||||
--dst-forward <ips|cidr>
|
||||
--dst-bypass-file <file>
|
||||
--dst-forward-file <file>
|
||||
--dst-default <bypass|forward>
|
||||
Same as with their --src-xx equivalent
|
||||
--dst-forward-recentrst
|
||||
Forward those packets whose destinations have recently
|
||||
sent to us multiple tcp-rst packets
|
||||
--local-default <bypass|forward|checkdst>
|
||||
Default action for local out TCP traffic
|
||||
|
||||
The following ipsets will be created by ss-rules. They are also intended to be
|
||||
populated by other programs like dnsmasq with ipset support
|
||||
|
||||
v2ray_rules6_src_bypass
|
||||
v2ray_rules6_src_forward
|
||||
v2ray_rules6_src_checkdst
|
||||
v2ray_rules6_dst_bypass
|
||||
v2ray_rules6_dst_forward
|
||||
EOF
|
||||
}
|
||||
|
||||
o_dst_bypass_="
|
||||
fe80::/10
|
||||
fd00::/8
|
||||
::1
|
||||
"
|
||||
o_src_default=bypass
|
||||
o_dst_default=bypass
|
||||
o_local_default=bypass
|
||||
|
||||
__errmsg() {
|
||||
echo "ss-rules6: $*" >&2
|
||||
}
|
||||
|
||||
v2ray_rules6_parse_args() {
|
||||
while [ "$#" -gt 0 ]; do
|
||||
case "$1" in
|
||||
-h|--help) v2ray_rules6_usage; exit 0;;
|
||||
-f|--flush) v2ray_rules6_flush; exit 0;;
|
||||
-l) o_redir_tcp_port="$2"; shift 2;;
|
||||
-L) o_redir_udp_port="$2"; shift 2;;
|
||||
-s) o_remote_servers="$2"; shift 2;;
|
||||
--ifnames) o_ifnames="$2"; shift 2;;
|
||||
--ipt-extra) o_ipt_extra="$2"; shift 2;;
|
||||
--src-default) o_src_default="$2"; shift 2;;
|
||||
--dst-default) o_dst_default="$2"; shift 2;;
|
||||
--local-default) o_local_default="$2"; shift 2;;
|
||||
--src-bypass) o_src_bypass="$2"; shift 2;;
|
||||
--src-forward) o_src_forward="$2"; shift 2;;
|
||||
--src-checkdst) o_src_checkdst="$2"; shift 2;;
|
||||
--dst-bypass) o_dst_bypass="$2"; shift 2;;
|
||||
--dst-bypass_all) o_dst_bypass_all="$2"; shift 2;;
|
||||
--dst-forward) o_dst_forward="$2"; shift 2;;
|
||||
--dst-forward-recentrst) o_dst_forward_recentrst=1; shift 1;;
|
||||
--dst-bypass-file) o_dst_bypass_file="$2"; shift 2;;
|
||||
--dst-forward-file) o_dst_forward_file="$2"; shift 2;;
|
||||
--rule-name) rule="$2"; shift 2;;
|
||||
*) __errmsg "unknown option $1"; return 1;;
|
||||
esac
|
||||
done
|
||||
|
||||
if [ -z "$o_redir_tcp_port" -a -z "$o_redir_udp_port" ]; then
|
||||
__errmsg "Requires at least -l or -L option"
|
||||
return 1
|
||||
fi
|
||||
if [ -n "$o_dst_forward_recentrst" ] && ! ip6tables -m recent -h >/dev/null; then
|
||||
__errmsg "Please install ip6tables-mod-conntrack-extra with opkg"
|
||||
return 1
|
||||
fi
|
||||
o_remote_servers="$(for s in $o_remote_servers; do resolveip -6 "$s"; done)"
|
||||
}
|
||||
|
||||
v2ray_rules6_flush() {
|
||||
local setname
|
||||
|
||||
ip6tables-save --counters | grep -v v2r6_ | ip6tables-restore -w --counters
|
||||
while ip -f inet6 rule del fwmark 1 lookup 100 2>/dev/null; do true; done
|
||||
ip -f inet6 route flush table 100 || true
|
||||
for setname in $(ipset -n list | grep "ss_rules6_"); do
|
||||
ipset destroy "$setname" 2>/dev/null || true
|
||||
done
|
||||
}
|
||||
|
||||
v2ray_rules6_ipset_init() {
|
||||
ipset --exist restore <<-EOF
|
||||
create ss_rules6_src_bypass hash:net family inet6 hashsize 64
|
||||
create ss_rules6_src_forward hash:net family inet6 hashsize 64
|
||||
create ss_rules6_src_checkdst hash:net family inet6 hashsize 64
|
||||
create ss_rules6_dst_bypass hash:net family inet6 hashsize 64
|
||||
create ss_rules6_dst_bypass_all hash:net family inet6 hashsize 64
|
||||
create ss_rules6_dst_bypass_ hash:net family inet6 hashsize 64
|
||||
create ss_rules6_dst_forward hash:net family inet6 hashsize 64
|
||||
create ss_rules6_dst_forward_recrst_ hash:ip family inet6 hashsize 64 timeout 3600
|
||||
$(v2ray_rules6_ipset_mkadd ss_rules6_dst_bypass_ "$o_dst_bypass_ $o_remote_servers")
|
||||
$(v2ray_rules6_ipset_mkadd ss_rules6_dst_bypass_all "$o_dst_bypass $(cat "$o_dst_bypass_file" 2>/dev/null | grep -o '\([0-9a-fA-F]\{0,4\}:\)\{1,7\}[0-9a-fA-F]\{0,4\}')")
|
||||
$(v2ray_rules6_ipset_mkadd ss_rules6_dst_bypass "$o_dst_bypass $(cat "$o_dst_bypass_file" 2>/dev/null | grep -o '\([0-9a-fA-F]\{0,4\}:\)\{1,7\}[0-9a-fA-F]\{0,4\}')")
|
||||
$(v2ray_rules6_ipset_mkadd ss_rules6_src_bypass "$o_src_bypass")
|
||||
$(v2ray_rules6_ipset_mkadd ss_rules6_src_forward "$o_src_forward")
|
||||
$(v2ray_rules6_ipset_mkadd ss_rules6_src_checkdst "$o_src_checkdst")
|
||||
$(v2ray_rules6_ipset_mkadd ss_rules6_dst_forward "$o_dst_forward $(cat "$o_dst_forward_file" 2>/dev/null | grep -o '\([0-9a-fA-F]\{0,4\}:\)\{1,7\}[0-9a-fA-F]\{0,4\}')")
|
||||
EOF
|
||||
}
|
||||
|
||||
v2ray_rules6_ipset_mkadd() {
|
||||
local setname="$1"; shift
|
||||
local i
|
||||
|
||||
for i in $*; do
|
||||
echo "add $setname $i"
|
||||
done
|
||||
}
|
||||
|
||||
v2ray_rules6_iptchains_init() {
|
||||
v2ray_rules6_iptchains_init_mark
|
||||
v2ray_rules6_iptchains_init_tcp
|
||||
v2ray_rules6_iptchains_init_udp
|
||||
}
|
||||
|
||||
v2ray_rules6_iptchains_init_mark() {
|
||||
ip6tables-restore -w --noflush <<-EOF
|
||||
*mangle
|
||||
-A PREROUTING -m set --match-set ss_rules6_dst_bypass_all dst -j MARK --set-mark 0x6539
|
||||
COMMIT
|
||||
EOF
|
||||
}
|
||||
|
||||
|
||||
v2ray_rules6_iptchains_init_tcp() {
|
||||
local local_target
|
||||
|
||||
[ -n "$o_redir_tcp_port" ] || return 0
|
||||
|
||||
#v2ray_rules6_iptchains_init_ nat tcp
|
||||
v2ray_rules6_iptchains_init_ mangle tcp
|
||||
|
||||
case "$o_local_default" in
|
||||
checkdst) local_target=v2r6_${rule}_dst ;;
|
||||
forward) local_target=v2r6_${rule}_forward ;;
|
||||
bypass|*) return 0;;
|
||||
esac
|
||||
|
||||
# echo "tcp mangle"
|
||||
# ip6tables-restore -w --noflush <<-EOF
|
||||
# *mangle
|
||||
# :v2r6_${rule}_local_out -
|
||||
# -I OUTPUT 1 -p tcp -j v2r6_${rule}_local_out
|
||||
# -A v2r6_${rule}_local_out -m set --match-set ss_rules6_dst_bypass dst -j RETURN
|
||||
# -A v2r6_${rule}_local_out -m set --match-set ss_rules6_dst_bypass_all dst -j RETURN
|
||||
# -A v2r6_${rule}_local_out -m set --match-set ss_rules6_dst_bypass_ dst -j RETURN
|
||||
# -A v2r6_${rule}_local_out -m mark --mark 0x6539 -j RETURN
|
||||
# -A v2r6_${rule}_local_out -p tcp $o_ipt_extra -j $local_target -m comment --comment "local_default: $o_local_default"
|
||||
# COMMIT
|
||||
# EOF
|
||||
# echo "done"
|
||||
}
|
||||
|
||||
v2ray_rules6_iptchains_init_udp() {
|
||||
[ -n "$o_redir_udp_port" ] || return 0
|
||||
echo "v2ray udp"
|
||||
v2ray_rules6_iptchains_init_ mangle udp
|
||||
}
|
||||
|
||||
v2ray_rules6_iptchains_init_() {
|
||||
local table="$1"
|
||||
local proto="$2"
|
||||
local forward_rules
|
||||
local src_default_target dst_default_target
|
||||
local recentrst_mangle_rules recentrst_addset_rules
|
||||
|
||||
case "$proto" in
|
||||
tcp)
|
||||
#forward_rules="-A v2r6_${rule}_forward -p tcp -j REDIRECT --to-ports $o_redir_tcp_port"
|
||||
forward_rules="-A v2r6_${rule}_forward -p tcp -j TPROXY --on-port $o_redir_tcp_port --tproxy-mark 0x01/0x01"
|
||||
if [ -n "$o_dst_forward_recentrst" ]; then
|
||||
recentrst_mangle_rules="
|
||||
*mangle
|
||||
-I PREROUTING 1 -p tcp -m tcp --tcp-flags RST RST -m recent --name ss_rules6_recentrst --set --rsource
|
||||
COMMIT
|
||||
"
|
||||
recentrst_addset_rules="
|
||||
-A v2r6_${rule}_dst -m recent --name ss_rules6_recentrst --rcheck --rdest --seconds 3 --hitcount 3 -j SET --add-set ss_rules6_dst_forward_recrst_ dst --exist
|
||||
-A v2r6_${rule}_dst -m set --match-set ss_rules6_dst_forward_recrst_ dst -j v2r6_${rule}_forward
|
||||
"
|
||||
fi
|
||||
;;
|
||||
udp)
|
||||
ip -f inet6 rule add fwmark 1 lookup 100
|
||||
ip -f inet6 route add local default dev lo table 100
|
||||
forward_rules="
|
||||
-A v2r6_${rule}_forward -p udp -j TPROXY --on-port "$o_redir_udp_port" --tproxy-mark 0x01/0x01
|
||||
-A v2r6_${rule}_forward -p tcp -j TPROXY --on-port "$o_redir_udp_port" --tproxy-mark 0x01/0x01
|
||||
"
|
||||
;;
|
||||
esac
|
||||
case "$o_src_default" in
|
||||
forward) src_default_target=v2r6_${rule}_forward ;;
|
||||
checkdst) src_default_target=v2r6_${rule}_dst ;;
|
||||
bypass|*) src_default_target=RETURN ;;
|
||||
esac
|
||||
case "$o_dst_default" in
|
||||
forward) dst_default_target=v2r6_${rule}_forward ;;
|
||||
bypass|*) dst_default_target=RETURN ;;
|
||||
esac
|
||||
sed -e '/^\s*$/d' -e 's/^\s\+//' <<-EOF | ip6tables-restore -w --noflush
|
||||
*$table
|
||||
:v2r6_${rule}_pre_src -
|
||||
:v2r6_${rule}_src -
|
||||
:v2r6_${rule}_dst -
|
||||
:v2r6_${rule}_forward -
|
||||
$(v2ray_rules6_iptchains_mkprerules "udp")
|
||||
$(v2ray_rules6_iptchains_mkprerules "tcp")
|
||||
-A v2r6_${rule}_pre_src -m set --match-set ss_rules6_dst_bypass_ dst -j RETURN
|
||||
-A v2r6_${rule}_pre_src -m set --match-set ss_rules6_dst_bypass_all dst -j MARK --set-mark 0x6539
|
||||
-A v2r6_${rule}_pre_src -m set --match-set ss_rules6_dst_bypass_all dst -j RETURN
|
||||
-A v2r6_${rule}_pre_src -m set --match-set ss_rules6_dst_bypass dst -j RETURN
|
||||
-A v2r6_${rule}_pre_src -m mark --mark 0x6539 -j RETURN
|
||||
-A v2r6_${rule}_dst -m set --match-set ss_rules6_dst_bypass_all dst -j RETURN
|
||||
-A v2r6_${rule}_dst -m set --match-set ss_rules6_dst_bypass dst -j RETURN
|
||||
-A v2r6_${rule}_pre_src -p tcp $o_ipt_extra -j v2r6_${rule}_src
|
||||
-A v2r6_${rule}_pre_src -p udp $o_ipt_extra -j v2r6_${rule}_src
|
||||
-A v2r6_${rule}_src -m set --match-set ss_rules6_src_bypass src -j RETURN
|
||||
-A v2r6_${rule}_src -m set --match-set ss_rules6_src_forward src -j v2r6_${rule}_forward
|
||||
-A v2r6_${rule}_src -m set --match-set ss_rules6_src_checkdst src -j v2r6_${rule}_dst
|
||||
-A v2r6_${rule}_src -j $src_default_target -m comment --comment "src_default: $o_src_default"
|
||||
-A v2r6_${rule}_dst -m set --match-set ss_rules6_dst_forward dst -j v2r6_${rule}_forward
|
||||
$recentrst_addset_rules
|
||||
-A v2r6_${rule}_dst -j $dst_default_target -m comment --comment "dst_default: $o_dst_default"
|
||||
$forward_rules
|
||||
COMMIT
|
||||
$recentrst_mangle_rules
|
||||
EOF
|
||||
}
|
||||
|
||||
v2ray_rules6_iptchains_mkprerules() {
|
||||
local proto="$1"
|
||||
|
||||
if [ -z "$o_ifnames" ]; then
|
||||
echo "-I PREROUTING 1 -p $proto -j v2r6_${rule}_pre_src"
|
||||
else
|
||||
echo $o_ifnames \
|
||||
| tr ' ' '\n' \
|
||||
| sed "s/.*/-I PREROUTING 1 -i \\0 -p $proto -j v2r6_${rule}_pre_src/"
|
||||
fi
|
||||
}
|
||||
|
||||
v2ray_rules6_parse_args "$@"
|
||||
v2ray_rules6_flush
|
||||
v2ray_rules6_ipset_init
|
||||
v2ray_rules6_iptchains_init
|
||||
Loading…
Add table
Add a link
Reference in a new issue