mptcp/openmptcprouter-feeds
1
0
Fork 0
mirror of https://github.com/Ysurac/openmptcprouter-feeds.git synced 2025-03-09 15:40:03 +00:00
Code Issues Releases Wiki Activity

Fix shadowsocks iptables rules

Browse source
This commit is contained in:
Ycarus (Yannick Chabanois) 2021-02-04 11:03:03 +01:00
parent 78799489c8
commit bdbdc201ec
3 changed files with 5 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

4
shadowsocks-libev/files/shadowsocks-libev.init
View file

@ -308,6 +308,7 @@ start_service() {
# Add rule to match traffic marked by firewall for bypass # Add rule to match traffic marked by firewall for bypass
ip rule add prio 1 fwmark 0x539 lookup 991337 > /dev/null 2>&1 ip rule add prio 1 fwmark 0x539 lookup 991337 > /dev/null 2>&1
rules_up rules_up
[ -f /etc/firewall.gre-tunnel ] && sh /etc/firewall.gre-tunnel > /dev/null 2>&1
} }
stop_service() { stop_service() {
@ -320,7 +321,7 @@ reload_service() {
} }
rules_exist() { rules_exist() {
[ -n "$(iptables -t nat -L -n | grep ssr)" ] && return 0 [ -n "$(iptables-save | grep 'A ssr')" ] && return 0
return 1 return 1
} }
@ -347,6 +348,7 @@ rules_up() {
config_foreach ss_rules_restart "$cfgtype" "$cfgtype" config_foreach ss_rules_restart "$cfgtype" "$cfgtype"
done done
config_foreach ss_rules ss_rules config_foreach ss_rules ss_rules
[ -z "$(iptables-save | grep :ssr)" ] && logger -t "Shadowsocks" "Rules not applied"
[ -f /etc/init.d/omr-bypass ] && { [ -f /etc/init.d/omr-bypass ] && {
logger -t "Shadowsocks" "Reload omr-bypass rules" logger -t "Shadowsocks" "Reload omr-bypass rules"
/etc/init.d/omr-bypass reload_rules /etc/init.d/omr-bypass reload_rules

2
shadowsocks-libev/files/ss-rules
View file

@ -187,7 +187,7 @@ ss_rules_iptchains_init_tcp() {
forward) local_target=ssr_${rule}_forward ;; forward) local_target=ssr_${rule}_forward ;;
bypass|*) return 0;; bypass|*) return 0;;
esac esac
if [ "$(iptables -t nat -L ssr_${rule}_local_out | grep ssr_${rule}_dst_bypass)" = "" ]; then if [ "$(iptables-save | grep ssr_${rule}_local_out | grep ssr_${rule}_dst_bypass)" = "" ]; then
iptables-restore -w --noflush <<-EOF iptables-restore -w --noflush <<-EOF
*nat *nat
:ssr_${rule}_local_out - :ssr_${rule}_local_out -

2
shadowsocks-libev/files/ss-rules6
View file

@ -175,7 +175,7 @@ ss_rules6_iptchains_init_tcp() {
:ssr6_${rule}_local_out - :ssr6_${rule}_local_out -
-I OUTPUT 1 -p tcp -j ssr6_${rule}_local_out -I OUTPUT 1 -p tcp -j ssr6_${rule}_local_out
-A ssr6_${rule}_local_out -m set --match-set ssr6_${rule}_dst_bypass dst -j RETURN -A ssr6_${rule}_local_out -m set --match-set ssr6_${rule}_dst_bypass dst -j RETURN
-A ssr6_${rule}_local_out -m set --match-set ssr6_${rule}_dst_bypass_all dst -j RETURN -A ssr6_${rule}_local_out -m set --match-set ss_rules6_dst_bypass_all dst -j RETURN
-A ssr6_${rule}_local_out -m set --match-set ssr6_${rule}_dst_bypass_ dst -j RETURN -A ssr6_${rule}_local_out -m set --match-set ssr6_${rule}_dst_bypass_ dst -j RETURN
-A ssr6_${rule}_local_out -m mark --mark 0x6539 -j RETURN -A ssr6_${rule}_local_out -m mark --mark 0x6539 -j RETURN
-A ssr6_${rule}_local_out -p tcp $o_ipt_extra -j $local_target -m comment --comment "local_default: $o_local_default" -A ssr6_${rule}_local_out -p tcp $o_ipt_extra -j $local_target -m comment --comment "local_default: $o_local_default"