From 19166a0c58cfcc4eb1632412436789669dcb3f43 Mon Sep 17 00:00:00 2001
From: "Ycarus (Yannick Chabanois)" <ycarus@zugaina.org>
Date: Tue, 22 Dec 2020 10:59:19 +0000
Subject: [PATCH 01/18] Fix v2ray update

---
 debian9-x86_64.sh | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/debian9-x86_64.sh b/debian9-x86_64.sh
index 1e8a1d3..18fcc3e 100644
--- a/debian9-x86_64.sh
+++ b/debian9-x86_64.sh
@@ -568,7 +568,6 @@ fi
 
 if [ "$V2RAY" = "yes" ]; then
 	#apt-get -y -o Dpkg::Options::="--force-overwrite" install v2ray
-	rm -f /etc/systemd/system/v2ray.service
 	wget -O /tmp/v2ray-${V2RAY_VERSION}-amd64.deb ${VPSURL}/debian/v2ray-${V2RAY_VERSION}-amd64.deb
 	dpkg --force-all -i -B /tmp/v2ray-${V2RAY_VERSION}-amd64.deb
 	rm -f /tmp/v2ray-${V2RAY_VERSION}-amd64.deb
@@ -578,6 +577,9 @@ if [ "$V2RAY" = "yes" ]; then
 		rm /etc/v2ray/config.json
 		ln -s /etc/v2ray/v2ray-server.json /etc/v2ray/config.json
 	fi
+	if [ -f /etc/systemd/system/v2ray.service.dpkg-dist ]; then
+		mv -f /etc/systemd/system/v2ray.service.dpkg-dist /etc/systemd/system/v2ray.service
+	fi
 	systemctl daemon-reload
 	systemctl enable v2ray.service
 fi

From 6e53e22761383f8620ff27913aef423837b1370d Mon Sep 17 00:00:00 2001
From: "Ycarus (Yannick Chabanois)" <ycarus@zugaina.org>
Date: Tue, 22 Dec 2020 12:16:02 +0000
Subject: [PATCH 02/18] Force fix previous error

---
 debian9-x86_64.sh |  3 +++
 old-v2ray.service | 25 +++++++++++++++++++++++++
 2 files changed, 28 insertions(+)
 create mode 100644 old-v2ray.service

diff --git a/debian9-x86_64.sh b/debian9-x86_64.sh
index 18fcc3e..fd1219f 100644
--- a/debian9-x86_64.sh
+++ b/debian9-x86_64.sh
@@ -569,6 +569,9 @@ fi
 if [ "$V2RAY" = "yes" ]; then
 	#apt-get -y -o Dpkg::Options::="--force-overwrite" install v2ray
 	wget -O /tmp/v2ray-${V2RAY_VERSION}-amd64.deb ${VPSURL}/debian/v2ray-${V2RAY_VERSION}-amd64.deb
+	if [ -f /etc/v2ray/v2ray-server.conf ] && [ ! -f /etc/systemd/system/v2ray.service ]; then
+		wget -O /etc/systemd/system/v2ray.service ${VPSURL}${VPSPATH}/old-v2ray.service
+	fi
 	dpkg --force-all -i -B /tmp/v2ray-${V2RAY_VERSION}-amd64.deb
 	rm -f /tmp/v2ray-${V2RAY_VERSION}-amd64.deb
 	if [ ! -f /etc/v2ray/v2ray-server.json ]; then
diff --git a/old-v2ray.service b/old-v2ray.service
new file mode 100644
index 0000000..9ed715a
--- /dev/null
+++ b/old-v2ray.service
@@ -0,0 +1,25 @@
+[Unit]
+Description=V2Ray - A unified platform for anti-censorship
+Documentation=https://v2ray.com https://guide.v2fly.org
+After=network.target nss-lookup.target
+Wants=network-online.target
+
+[Service]
+# If the version of systemd is 240 or above, then uncommenting Type=exec and commenting out Type=simple
+#Type=exec
+Type=simple
+# Runs as root or add CAP_NET_BIND_SERVICE ability can bind 1 to 1024 port.
+# This service runs as root. You may consider to run it as another user for security concerns.
+# By uncommenting User=v2ray and commenting out User=root, the service will run as user v2ray.
+# More discussion at https://github.com/v2ray/v2ray-core/issues/1011
+User=root
+#User=v2ray
+CapabilityBoundingSet=CAP_NET_BIND_SERVICE CAP_NET_RAW
+NoNewPrivileges=yes
+ExecStart=/usr/bin/v2ray -config /etc/v2ray/config.json
+Restart=on-failure
+# Don't restart in the case of configuration error
+RestartPreventExitStatus=23
+
+[Install]
+WantedBy=multi-user.target

From 960cf901fe3ff622789faeaa3f0ce0e5e02942b0 Mon Sep 17 00:00:00 2001
From: "Ycarus (Yannick Chabanois)" <ycarus@zugaina.org>
Date: Wed, 30 Dec 2020 11:44:39 +0000
Subject: [PATCH 03/18] Fix script and update API

---
 debian9-x86_64.sh | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/debian9-x86_64.sh b/debian9-x86_64.sh
index fd1219f..fd1d386 100644
--- a/debian9-x86_64.sh
+++ b/debian9-x86_64.sh
@@ -15,7 +15,7 @@ OBFS=${OBFS:-yes}
 V2RAY_PLUGIN=${V2RAY_PLUGIN:-yes}
 V2RAY=${V2RAY:-yes}
 V2RAY_UUID=${V2RAY_UUID:-$(cat /proc/sys/kernel/random/uuid | tr -d "\n")}
-UPDATE_O7S=${UPDATE_OS:-yes}
+UPDATE_OS=${UPDATE_OS:-yes}
 UPDATE=${UPDATE:-yes}
 TLS=${TLS:-yes}
 OMR_ADMIN=${OMR_ADMIN:-yes}
@@ -40,7 +40,7 @@ GLORYTUN_UDP_VERSION="32267e86a6da05b285bb3bf2b136c105dc0af4bb"
 MLVPN_VERSION="f45cec350a6879b8b020143a78134a022b5df2a7"
 UBOND_VERSION="672100fb57913ffd29caad63517e145a5974b078"
 OBFS_VERSION="486bebd9208539058e57e23a12f23103016e09b4"
-OMR_ADMIN_VERSION="a3ffef1222177bb48d3de121c5be9159bdfaeb7a"
+OMR_ADMIN_VERSION="f52acee888a39cc812ba6848aec5eeb1a82ab7ba"
 DSVPN_VERSION="3b99d2ef6c02b2ef68b5784bec8adfdd55b29b1a"
 V2RAY_VERSION="4.31.0"
 V2RAY_PLUGIN_VERSION="v1.4.3"

From 6a0c3d32472833174f171018680e58def7b637a9 Mon Sep 17 00:00:00 2001
From: "Ycarus (Yannick Chabanois)" <ycarus@zugaina.org>
Date: Wed, 30 Dec 2020 11:44:54 +0000
Subject: [PATCH 04/18] Fix glorytun UDP timeout

---
 glorytun-udp-post.sh | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/glorytun-udp-post.sh b/glorytun-udp-post.sh
index 2c1dc40..51a20f0 100644
--- a/glorytun-udp-post.sh
+++ b/glorytun-udp-post.sh
@@ -13,4 +13,5 @@ done
 	ip addr add ${LOCALIP}/30 brd ${BROADCASTIP} dev ${INTF} 2>&1 >/dev/null
 }
 tc qdisc replace dev $INTF root cake
-ip link set $INTF txqlen 100
\ No newline at end of file
+ip link set $INTF txqlen 100
+glorytun set dev gt-udp-tun0 kxtimeout 7d 2>&1 >/dev/null
\ No newline at end of file

From e6d3bb727981eb27f6e609aafde53077cc67dde1 Mon Sep 17 00:00:00 2001
From: "Ycarus (Yannick Chabanois)" <ycarus@zugaina.org>
Date: Tue, 5 Jan 2021 14:11:09 +0000
Subject: [PATCH 05/18] Update kernel

---
 debian9-x86_64.sh | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/debian9-x86_64.sh b/debian9-x86_64.sh
index fd1d386..e3c515e 100644
--- a/debian9-x86_64.sh
+++ b/debian9-x86_64.sh
@@ -32,8 +32,8 @@ NOINTERNET=${NOINTERNET:-no}
 SPEEDTEST=${SPEEDTEST:-no}
 LOCALFILES=${LOCALFILES:-no}
 INTERFACE=${INTERFACE:-$(ip -o -4 route show to default | grep -m 1 -Po '(?<=dev )(\S+)' | tr -d "\n")}
-KERNEL_VERSION="5.4.81"
-KERNEL_PACKAGE_VERSION="1.15+9d3f35b"
+KERNEL_VERSION="5.4.86"
+KERNEL_PACKAGE_VERSION="1.16+9d3f35b"
 KERNEL_RELEASE="${KERNEL_VERSION}-mptcp_${KERNEL_PACKAGE_VERSION}"
 GLORYTUN_UDP_VERSION="32267e86a6da05b285bb3bf2b136c105dc0af4bb"
 #MLVPN_VERSION="8f9720978b28c1954f9f229525333547283316d2"
@@ -51,7 +51,7 @@ VPS_DOMAIN=${VPS_DOMAIN:-$(wget -4 -qO- -T 2 http://hostname.openmptcprouter.com
 VPSPATH="server"
 VPSURL="https://www.openmptcprouter.com/"
 
-OMR_VERSION="0.1023"
+OMR_VERSION="0.1024"
 
 DIR=$( pwd )
 #"

From db95630ef98657da896dcdeefa212224b2ef9357 Mon Sep 17 00:00:00 2001
From: "Ycarus (Yannick Chabanois)" <ycarus@zugaina.org>
Date: Mon, 29 Mar 2021 14:32:39 +0000
Subject: [PATCH 06/18] Disable TLS from let's encrypt in China

---
 debian9-x86_64.sh | 1 +
 1 file changed, 1 insertion(+)

diff --git a/debian9-x86_64.sh b/debian9-x86_64.sh
index 6a3e7e2..a7f8d39 100755
--- a/debian9-x86_64.sh
+++ b/debian9-x86_64.sh
@@ -210,6 +210,7 @@ if [ "$CHINA" = "yes" ]; then
 		git checkout master
 	fi
 	LOCALFILES="yes"
+	TLS="no"
 	DIR="/usr/share/omr-server-git"
 else
 	echo "deb [arch=amd64] https://${REPO} buster main" > /etc/apt/sources.list.d/openmptcprouter.list

From 950b704495a080ee65b4f39554aca34a97102916 Mon Sep 17 00:00:00 2001
From: "Ycarus (Yannick Chabanois)" <ycarus@zugaina.org>
Date: Wed, 14 Apr 2021 19:16:45 +0000
Subject: [PATCH 07/18] Update server API

---
 debian9-x86_64.sh | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/debian9-x86_64.sh b/debian9-x86_64.sh
index a7f8d39..34e2969 100755
--- a/debian9-x86_64.sh
+++ b/debian9-x86_64.sh
@@ -46,8 +46,8 @@ MLVPN_BINARY_VERSION="3.0.0+20201216.git.2263bab"
 UBOND_VERSION="672100fb57913ffd29caad63517e145a5974b078"
 OBFS_VERSION="486bebd9208539058e57e23a12f23103016e09b4"
 OBFS_BINARY_VERSION="0.0.5-1"
-OMR_ADMIN_VERSION="2694612565aba58cc0a9bd2ad5d550aa4ef7bcf5"
-OMR_ADMIN_BINARY_VERSION="0.3+20210325"
+OMR_ADMIN_VERSION="b40c6b615eca1a7171d83e3a3f58c7d4d17e0fd5"
+OMR_ADMIN_BINARY_VERSION="0.3+20210414"
 DSVPN_VERSION="3b99d2ef6c02b2ef68b5784bec8adfdd55b29b1a"
 DSVPN_BINARY_VERSION="0.1.4-2"
 V2RAY_VERSION="4.35.1"
@@ -1295,7 +1295,7 @@ if [ "$update" = "0" ]; then
 	echo 'Your glorytun key: '
 	echo $GLORYTUN_PASS
 	if [ "$DSVPN" = "yes" ]; then
-		echo 'A Dead Simple VPN port: 65011'
+		echo 'A Dead Simple VPN port: 65401'
 		echo 'A Dead Simple VPN key: '
 		echo $DSVPN_PASS
 	fi
@@ -1342,7 +1342,7 @@ if [ "$update" = "0" ]; then
 	EOF
 	if [ "$DSVPN" = "yes" ]; then
 		cat >> /root/openmptcprouter_config.txt <<-EOF
-		A Dead Simple VPN port: 65011
+		A Dead Simple VPN port: 65401
 		A Dead Simple VPN key: ${DSVPN_PASS}
 		EOF
 	fi

From 180a3fc0acc21e51b906ebde2f1dccf8139eb939 Mon Sep 17 00:00:00 2001
From: "Ycarus (Yannick Chabanois)" <ycarus@zugaina.org>
Date: Mon, 19 Apr 2021 19:15:43 +0000
Subject: [PATCH 08/18] Remove bad dsvpn ipv6 route

---
 omr-service | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/omr-service b/omr-service
index 6fe97bf..ff51abe 100755
--- a/omr-service
+++ b/omr-service
@@ -40,6 +40,11 @@ _glorytun_tcp() {
 	fi
 }
 
+_dsvpn() {
+	[ -n "$(ip -6 r show 64:ff9b::/96 dev dsvpn0)" ] && ip -6 r del 64:ff9b::/96 dev dsvpn0 2>&1 >/dev/null
+}
+
+
 _omr_api() {
 	[ -z "$(curl -s -k -m 30 https://127.0.0.1:65500/)" ] && {
 		logger -t "OMR-Service" "Restart OMR-Admin"
@@ -109,6 +114,7 @@ ip link add omr-bonding type bond 2>&1 >/dev/null
 while true; do
 	_glorytun_udp
 	_glorytun_tcp
+	_dsvpn
 	_multipath
 	_omr_api
 	_lan_route

From c39b07eaa57fdd0c86652b80f3b42ddadf5388f5 Mon Sep 17 00:00:00 2001
From: "Ycarus (Yannick Chabanois)" <ycarus@zugaina.org>
Date: Tue, 27 Apr 2021 08:24:10 +0000
Subject: [PATCH 09/18] Doesn't download each firewall file for update

---
 debian9-x86_64.sh | 53 ++++++++++++++++++++---------------------------
 1 file changed, 22 insertions(+), 31 deletions(-)

diff --git a/debian9-x86_64.sh b/debian9-x86_64.sh
index 34e2969..2d6ddf7 100755
--- a/debian9-x86_64.sh
+++ b/debian9-x86_64.sh
@@ -1157,38 +1157,29 @@ if [ "$update" = "0" ]; then
 else
 	# Update only needed firewall files
 	if [ "$LOCALFILES" = "no" ]; then
-		wget -O /etc/shorewall/interfaces ${VPSURL}${VPSPATH}/shorewall4/interfaces
-		wget -O /etc/shorewall/snat ${VPSURL}${VPSPATH}/shorewall4/snat
-		wget -O /etc/shorewall/stoppedrules ${VPSURL}${VPSPATH}/shorewall4/stoppedrules
-		wget -O /etc/shorewall/tcinterfaces ${VPSURL}${VPSPATH}/shorewall4/tcinterfaces
-		wget -O /etc/shorewall/shorewall.conf ${VPSURL}${VPSPATH}/shorewall4/shorewall.conf
-		wget -O /etc/shorewall/policy ${VPSURL}${VPSPATH}/shorewall4/policy
-		wget -O /etc/shorewall/params ${VPSURL}${VPSPATH}/shorewall4/params
-		wget -O /etc/shorewall/params.vpn ${VPSURL}${VPSPATH}/shorewall4/params.vpn
-		wget -O /etc/shorewall/params.net ${VPSURL}${VPSPATH}/shorewall4/params.net
-		wget -O /etc/shorewall6/params ${VPSURL}${VPSPATH}/shorewall6/params
-		wget -O /etc/shorewall6/params.net ${VPSURL}${VPSPATH}/shorewall6/params.net
-		wget -O /etc/shorewall6/params.vpn ${VPSURL}${VPSPATH}/shorewall6/params.vpn
-		wget -O /etc/shorewall6/interfaces ${VPSURL}${VPSPATH}/shorewall6/interfaces
-		wget -O /etc/shorewall6/stoppedrules ${VPSURL}${VPSPATH}/shorewall6/stoppedrules
-		wget -O /etc/shorewall6/snat ${VPSURL}${VPSPATH}/shorewall6/snat
-	else
-		cp ${DIR}/shorewall4/interfaces /etc/shorewall/interfaces
-		cp ${DIR}/shorewall4/snat /etc/shorewall/snat
-		cp ${DIR}/shorewall4/stoppedrules /etc/shorewall/stoppedrules
-		cp ${DIR}/shorewall4/tcinterfaces /etc/shorewall/tcinterfaces
-		cp ${DIR}/shorewall4/shorewall.conf /etc/shorewall/shorewall.conf
-		cp ${DIR}/shorewall4/policy /etc/shorewall/policy
-		cp ${DIR}/shorewall4/params /etc/shorewall/params
-		cp ${DIR}/shorewall4/params.vpn /etc/shorewall/params.vpn
-		cp ${DIR}/shorewall4/params.net /etc/shorewall/params.net
-		cp ${DIR}/shorewall6/params /etc/shorewall6/params
-		cp ${DIR}/shorewall6/params.net /etc/shorewall6/params.net
-		cp ${DIR}/shorewall6/params.vpn /etc/shorewall6/params.vpn
-		cp ${DIR}/shorewall6/interfaces /etc/shorewall6/interfaces
-		cp ${DIR}/shorewall6/stoppedrules /etc/shorewall6/stoppedrules
-		cp ${DIR}/shorewall6/snat /etc/shorewall6/snat
+		mkdir -p ${DIR}
+		wget -O ${DIR}/openmptcprouter-shorewall.tar.gz ${VPSURL}${VPSPATH}/openmptcprouter-shorewall.tar.gz
+		wget -O ${DIR}/openmptcprouter-shorewall6.tar.gz ${VPSURL}${VPSPATH}/openmptcprouter-shorewall6.tar.gz
+		mkdir -p ${DIR}/shorewall4
+		tar xzvf ${DIR}/openmptcprouter-shorewall.tar.gz -C ${DIR}/shorewall4
+		mkdir -p ${DIR}/shorewall6
+		tar xzvf ${DIR}/openmptcprouter-shorewall6.tar.gz -C ${DIR}/shorewall6
 	fi
+	cp ${DIR}/shorewall4/interfaces /etc/shorewall/interfaces
+	cp ${DIR}/shorewall4/snat /etc/shorewall/snat
+	cp ${DIR}/shorewall4/stoppedrules /etc/shorewall/stoppedrules
+	cp ${DIR}/shorewall4/tcinterfaces /etc/shorewall/tcinterfaces
+	cp ${DIR}/shorewall4/shorewall.conf /etc/shorewall/shorewall.conf
+	cp ${DIR}/shorewall4/policy /etc/shorewall/policy
+	cp ${DIR}/shorewall4/params /etc/shorewall/params
+	cp ${DIR}/shorewall4/params.vpn /etc/shorewall/params.vpn
+	cp ${DIR}/shorewall4/params.net /etc/shorewall/params.net
+	cp ${DIR}/shorewall6/params /etc/shorewall6/params
+	cp ${DIR}/shorewall6/params.net /etc/shorewall6/params.net
+	cp ${DIR}/shorewall6/params.vpn /etc/shorewall6/params.vpn
+	cp ${DIR}/shorewall6/interfaces /etc/shorewall6/interfaces
+	cp ${DIR}/shorewall6/stoppedrules /etc/shorewall6/stoppedrules
+	cp ${DIR}/shorewall6/snat /etc/shorewall6/snat
 	sed -i "s:eth0:$INTERFACE:g" /etc/shorewall/*
 	sed -i 's/^.*#DNAT/#DNAT/g' /etc/shorewall/rules
 	sed -i 's:10.0.0.2:$OMR_ADDR:g' /etc/shorewall/rules

From df637bb0c455c4a3bf8360d6eca0407cd68cf4c9 Mon Sep 17 00:00:00 2001
From: "Ycarus (Yannick Chabanois)" <ycarus@zugaina.org>
Date: Sat, 8 May 2021 06:46:40 +0000
Subject: [PATCH 10/18] Fix VPS update via web and update omr-test-speed

---
 debian/postinst       |  3 ++-
 debian/rules          |  4 ++--
 debian9-x86_64.sh     | 11 +++++++--
 omr-test-speed        | 51 ++++++++++++++++++++++++---------------
 omr-test-speedv6      | 56 +++++++++++++++++++++++++++++++++++++++++++
 omr-update            | 11 +++++++++
 omr-update.service.in |  9 ++++---
 7 files changed, 116 insertions(+), 29 deletions(-)
 mode change 100755 => 100644 omr-test-speed
 create mode 100644 omr-test-speedv6
 create mode 100755 omr-update

diff --git a/debian/postinst b/debian/postinst
index bd08d7f..57ee50d 100644
--- a/debian/postinst
+++ b/debian/postinst
@@ -6,7 +6,8 @@ test $DEBIAN_SCRIPT_DEBUG && set -v -x
 . /usr/share/debconf/confmodule
 
 sed -i -e "s/^LOCALFILES=.*$/LOCALFILES=no/" -e "s/^SOURCES=.*$/SOURCES=no/" /usr/share/omr-server/debian9-x86_64.sh
-systemctl enable omr-update
+systemctl daemon-reload
+systemctl restart omr-update
 
 db_stop
 
diff --git a/debian/rules b/debian/rules
index d411dc4..9a69cc6 100755
--- a/debian/rules
+++ b/debian/rules
@@ -13,6 +13,6 @@ override_dh_auto_install:
 	cp -r ./shorewall4 $(CURDIR)/debian/omr-server/usr/share/omr-server/
 	cp -r ./shorewall6 $(CURDIR)/debian/omr-server/usr/share/omr-server/
 	cp -r ./bin $(CURDIR)/debian/omr-server/usr/share/omr-server/
-	mkdir -p $(CURDIR)/debian/omr-server/lib/systemd/system
-	cp omr-update.service.in $(CURDIR)/debian/omr-server/lib/systemd/system/omr-update.service
+	mkdir -p $(CURDIR)/debian/etc/openmptcprouter-vps-admin
+	touch $(CURDIR)/debian/etc/openmptcprouter-vps-admin/update-bin
 
diff --git a/debian9-x86_64.sh b/debian9-x86_64.sh
index 2d6ddf7..a75b4a4 100755
--- a/debian9-x86_64.sh
+++ b/debian9-x86_64.sh
@@ -46,8 +46,8 @@ MLVPN_BINARY_VERSION="3.0.0+20201216.git.2263bab"
 UBOND_VERSION="672100fb57913ffd29caad63517e145a5974b078"
 OBFS_VERSION="486bebd9208539058e57e23a12f23103016e09b4"
 OBFS_BINARY_VERSION="0.0.5-1"
-OMR_ADMIN_VERSION="b40c6b615eca1a7171d83e3a3f58c7d4d17e0fd5"
-OMR_ADMIN_BINARY_VERSION="0.3+20210414"
+OMR_ADMIN_VERSION="027d5c8e80ef469d33e43f6cbf3103b30e55ea1c"
+OMR_ADMIN_BINARY_VERSION="0.3+20210508"
 DSVPN_VERSION="3b99d2ef6c02b2ef68b5784bec8adfdd55b29b1a"
 DSVPN_BINARY_VERSION="0.1.4-2"
 V2RAY_VERSION="4.35.1"
@@ -582,6 +582,12 @@ if systemctl -q is-active shadowsocks-libev-manager@manager; then
 	systemctl -q stop shadowsocks-libev-manager@manager > /dev/null 2>&1
 fi
 
+if [ "$LOCALFILES" = "no" ]; then
+	wget -O /lib/systemd/system/omr-update.service ${VPSURL}${VPSPATH}/omr-update.service.in
+else
+	cp ${DIR}/omr-update.service.in /lib/systemd/system/omr-update.service
+fi
+
 # Install simple-obfs
 if [ "$OBFS" = "yes" ]; then
 	echo "Install OBFS"
@@ -1260,6 +1266,7 @@ fi
 
 if [ "$SOURCES" != "yes" ]; then
 	apt-get -y install omr-server=${OMR_VERSION} 2>&1 >/dev/null || true
+	rm -f /etc/openmtpcprouter-vps-admin/update-bin
 fi
 
 if [ "$update" = "0" ]; then
diff --git a/omr-test-speed b/omr-test-speed
old mode 100755
new mode 100644
index fa95ff2..863232f
--- a/omr-test-speed
+++ b/omr-test-speed
@@ -1,30 +1,43 @@
 #!/bin/sh
 # vim: set noexpandtab tabstop=4 shiftwidth=4 softtabstop=4 :
-INTERFACE="$1"
+OVH=false
+if [ "$1" = "ovh" ]; then
+	OVH=true
+	INTERFACE="$2"
+else
+	INTERFACE="$1"
+fi
 
-echo "Select best test server..."
-HOSTLST="http://speedtest.frankfurt.linode.com/garbage.php?ckSize=10000 http://speedtest.tokyo2.linode.com/garbage.php?ckSize=10000 http://speedtest.singapore.linode.com/garbage.php?ckSize=10000 http://speedtest.newark.linode.com/garbage.php?ckSize=10000 http://speedtest.atlanta.linode.com/garbage.php?ckSize=10000 http://speedtest.dallas.linode.com/garbage.php?ckSize=10000 http://speedtest.fremont.linode.com/garbage.php?ckSize=10000 http://speedtest.tele2.net/1000GB.zip http://www.ovh.net/files/10Gb.dat https://speed.hetzner.de/10GB.bin http://ipv4.bouygues.testdebit.info/10G.iso http://par.download.datapacket.com/10000mb.bin http://nyc.download.datapacket.com/10000mb.bin http://ams.download.datapacket.com/10000mb.bin http://fra.download.datapacket.com/10000mb.bin http://lon.download.datapacket.com/10000mb.bin http://mad.download.datapacket.com/10000mb.bin http://prg.download.datapacket.com/10000mb.bin http://sto.download.datapacket.com/10000mb.bin http://vie.download.datapacket.com/10000mb.bin http://war.download.datapacket.com/10000mb.bin http://atl.download.datapacket.com/10000mb.bin http://chi.download.datapacket.com/10000mb.bin http://lax.download.datapacket.com/10000mb.bin http://mia.download.datapacket.com/10000mb.bin http://nyc.download.datapacket.com/10000mb.bin"
-bestping="999"
-for pinghost in $HOSTLST; do
-	domain=$(echo $pinghost | awk -F/ '{print $3}')
-	if [ -z "$INTERFACE" ]; then
-		ping=$(ping -c1 -w2 $domain | cut -d "/" -s -f5 | cut -d "." -f1)
-	else
-		ping=$(ping -c1 -w2 -I $INTERFACE -B $domain | cut -d "/" -s -f5 | cut -d "." -f1)
-	fi
-	echo "host: $domain - ping: $ping"
-	if [ -n "$ping" ] && [ "$ping" -lt "$bestping" ]; then
-		bestping=$ping
-		HOST=$pinghost
-	fi
-done
+[ -n "$INTERFACE" ] && [ ! -d "/sys/class/net/$INTERFACE" ] && {
+	echo "You must use a real interface. You wan find them using 'ip a' for example"
+	exit 0
+}
+
+if [ "$OVH" = false ]; then
+	echo "Select best test server..."
+	HOSTLST="http://speedtest.frankfurt.linode.com/garbage.php?ckSize=10000 http://speedtest.tokyo2.linode.com/garbage.php?ckSize=10000 http://speedtest.singapore.linode.com/garbage.php?ckSize=10000 http://speedtest.newark.linode.com/garbage.php?ckSize=10000 http://speedtest.atlanta.linode.com/garbage.php?ckSize=10000 http://speedtest.dallas.linode.com/garbage.php?ckSize=10000 http://speedtest.fremont.linode.com/garbage.php?ckSize=10000 http://speedtest.tele2.net/1000GB.zip http://proof.ovh.net/files/10Gb.dat https://speed.hetzner.de/10GB.bin http://ipv4.bouygues.testdebit.info/10G.iso http://par.download.datapacket.com/10000mb.bin http://nyc.download.datapacket.com/10000mb.bin http://ams.download.datapacket.com/10000mb.bin http://fra.download.datapacket.com/10000mb.bin http://lon.download.datapacket.com/10000mb.bin http://mad.download.datapacket.com/10000mb.bin http://prg.download.datapacket.com/10000mb.bin http://sto.download.datapacket.com/10000mb.bin http://vie.download.datapacket.com/10000mb.bin http://war.download.datapacket.com/10000mb.bin http://atl.download.datapacket.com/10000mb.bin http://chi.download.datapacket.com/10000mb.bin http://lax.download.datapacket.com/10000mb.bin http://mia.download.datapacket.com/10000mb.bin http://nyc.download.datapacket.com/10000mb.bin"
+	bestping="9999"
+	for pinghost in $HOSTLST; do
+		domain=$(echo $pinghost | awk -F/ '{print $3}')
+		if [ -z "$INTERFACE" ]; then
+			ping=$(ping -c1 -w2 $domain | cut -d "/" -s -f5 | cut -d "." -f1)
+		else
+			ping=$(ping -c1 -w2 -I $INTERFACE -B $domain | cut -d "/" -s -f5 | cut -d "." -f1)
+		fi
+		echo "host: $domain - ping: $ping"
+		if [ -n "$ping" ] && [ "$ping" -lt "$bestping" ]; then
+			bestping=$ping
+			HOST=$pinghost
+		fi
+	done
+fi
 
 [ -z "$HOST" ] && HOST="http://proof.ovh.net/files/10Gio.dat"
 
 echo "Best server is $HOST, running test:"
 trap : HUP INT TERM
 if [ -z "$INTERFACE" ]; then
-	curl -4 $HOST >/dev/null || echo
+	curl -4 -o /dev/null $HOST || echo
 else
 	domain=$(echo $HOST | awk -F/ '{print $3}')
 	hostip=$(dig +nocmd +noall +answer A $domain | grep -v CNAME | awk '{print $5}' | tr '\n' ' ')
@@ -33,7 +46,7 @@ else
 			ipset add ss_rules_dst_bypass_all $ip
 		done
 	fi
-	curl -4 --interface $INTERFACE $HOST >/dev/null || echo
+	curl -4 -o /dev/null --interface $INTERFACE $HOST || echo
 	if [ -n "$(ipset list 2>/dev/null | grep ss_rules)" ]; then
 		for ip in $hostip; do
 			ipset del ss_rules_dst_bypass_all $ip
diff --git a/omr-test-speedv6 b/omr-test-speedv6
new file mode 100644
index 0000000..ca3d64d
--- /dev/null
+++ b/omr-test-speedv6
@@ -0,0 +1,56 @@
+#!/bin/sh
+# vim: set noexpandtab tabstop=4 shiftwidth=4 softtabstop=4 :
+OVH=false
+if [ "$1" = "ovh" ]; then
+	OVH=true
+	INTERFACE="$2"
+else
+	INTERFACE="$1"
+fi
+
+[ -n "$INTERFACE" ] && [ ! -d "/sys/class/net/$INTERFACE" ] && {
+	echo "You must use a real interface. You wan find them using 'ip a' for example"
+	exit 0
+}
+
+
+if [ "$OVH" = false ]; then
+	echo "Select best test server..."
+	HOSTLST="http://speedtest.frankfurt.linode.com/garbage.php?ckSize=10000 http://speedtest.tokyo2.linode.com/garbage.php?ckSize=10000 http://speedtest.singapore.linode.com/garbage.php?ckSize=10000 http://speedtest.newark.linode.com/garbage.php?ckSize=10000 http://speedtest.atlanta.linode.com/garbage.php?ckSize=10000 http://speedtest.dallas.linode.com/garbage.php?ckSize=10000 http://speedtest.fremont.linode.com/garbage.php?ckSize=10000 http://speedtest.tele2.net/1000GB.zip http://www.ovh.net/files/10Gb.dat https://speed.hetzner.de/10GB.bin http://ipv6.bouygues.testdebit.info/10G.iso http://par.download.datapacket.com/10000mb.bin http://nyc.download.datapacket.com/10000mb.bin http://ams.download.datapacket.com/10000mb.bin http://fra.download.datapacket.com/10000mb.bin http://lon.download.datapacket.com/10000mb.bin http://mad.download.datapacket.com/10000mb.bin http://prg.download.datapacket.com/10000mb.bin http://sto.download.datapacket.com/10000mb.bin http://vie.download.datapacket.com/10000mb.bin http://war.download.datapacket.com/10000mb.bin http://atl.download.datapacket.com/10000mb.bin http://chi.download.datapacket.com/10000mb.bin http://lax.download.datapacket.com/10000mb.bin http://mia.download.datapacket.com/10000mb.bin http://nyc.download.datapacket.com/10000mb.bin"
+	bestping="9999"
+	for pinghost in $HOSTLST; do
+		domain=$(echo $pinghost | awk -F/ '{print $3}')
+		if [ -z "$INTERFACE" ]; then
+			ping=$(ping -6 -c1 -w2 $domain | cut -d "/" -s -f5 | cut -d "." -f1)
+		else
+			ping=$(ping -6 -c1 -w2 -I $INTERFACE -B $domain | cut -d "/" -s -f5 | cut -d "." -f1)
+		fi
+		echo "host: $domain - ping: $ping"
+		if [ -n "$ping" ] && [ "$ping" -lt "$bestping" ]; then
+			bestping=$ping
+			HOST=$pinghost
+		fi
+	done
+fi
+
+[ -z "$HOST" ] && HOST="http://proof.ovh.net/files/10Gio.dat"
+
+echo "Best server is $HOST, running test:"
+trap : HUP INT TERM
+if [ -z "$INTERFACE" ]; then
+	curl -6 $HOST >/dev/null || echo
+else
+	domain=$(echo $HOST | awk -F/ '{print $3}')
+	hostip=$(dig +nocmd +noall +answer AAAA $domain | grep -v CNAME | awk '{print $5}' | tr '\n' ' ')
+	if [ -n "$(ipset list 2>/dev/null | grep ss_rules6)" ]; then
+		for ip in $hostip; do
+			ipset add ss_rules6_dst_bypass_all $ip
+		done
+	fi
+	curl -6 --interface $INTERFACE $HOST >/dev/null || echo
+	if [ -n "$(ipset list 2>/dev/null | grep ss_rules6)" ]; then
+		for ip in $hostip; do
+			ipset del ss_rules6_dst_bypass_all $ip
+		done
+	fi
+fi
diff --git a/omr-update b/omr-update
new file mode 100755
index 0000000..33b3fa6
--- /dev/null
+++ b/omr-update
@@ -0,0 +1,11 @@
+#!/bin/sh
+if [ -f /etc/openmptcprouter-vps-admin/update ]; then
+        wget -O - http://www.openmptcprouter.com/server-test/debian10-x86_64.sh | sh
+        rm -f /etc/openmptcprouter-vps-admin/update
+        reboot
+fi
+if [ -f /etc/openmptcprouter-vps-admin/update-bin ]; then
+        LOCALFILES=yes SOURCES=yes REINSTALL=no /usr/share/omr-server/debian9-x86_64.sh
+        rm -f /etc/openmptcprouter-vps-admin/update-bin
+        #reboot
+fi
diff --git a/omr-update.service.in b/omr-update.service.in
index 1a21135..231803a 100644
--- a/omr-update.service.in
+++ b/omr-update.service.in
@@ -4,11 +4,10 @@ After=network.target network-online.target
 
 [Service]
 Type=simple
-Restart=no
-Environment="SOURCES=no"
-Environment="REINSTALL=no"
-Environment="LOCALFILES=yes"
-ExecStart=/usr/share/omr-server/debian9-x86_64.sh
+Restart=never
+ExecStart=/usr/bin/omr-update
+#ExecStart=/usr/share/omr-server/debian9-x86_64.sh
+AmbientCapabilities=
 StandardOutput=file:/var/log/omr-update.log
 StandardError=file:/var/log/omr-update.log
 

From 4b8a9432cd91f68f38d26ad56e33b170715cc0b4 Mon Sep 17 00:00:00 2001
From: "Ycarus (Yannick Chabanois)" <ycarus@zugaina.org>
Date: Sun, 9 May 2021 08:35:34 +0000
Subject: [PATCH 11/18] Replace gitee by gitlab

---
 debian9-x86_64.sh | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/debian9-x86_64.sh b/debian9-x86_64.sh
index a75b4a4..9e9b397 100755
--- a/debian9-x86_64.sh
+++ b/debian9-x86_64.sh
@@ -143,7 +143,8 @@ fi
 [ -f /etc/apt/sources.list.d/openmptcprouter.list ] && {
 	echo "Update ${REPO} key"
 	if [ "$CHINA" = "yes" ]; then
-		wget -O - https://gitee.com/ysurac/openmptcprouter-vps-debian/raw/main/openmptcprouter.gpg.key | apt-key add -
+		#wget -O - https://gitee.com/ysurac/openmptcprouter-vps-debian/raw/main/openmptcprouter.gpg.key | apt-key add -
+		wget -O - https://gitlab.com/ysurac/openmptcprouter-vps-debian/raw/main/openmptcprouter.gpg.key | apt-key add -
 	else
 		wget -O - https://${REPO}/openmptcprouter.gpg.key | apt-key add -
 	fi
@@ -188,7 +189,8 @@ if [ "$CHINA" = "yes" ]; then
 	echo "Install git..."
 	apt-get -y install git
 	if [ ! -d /var/lib/openmptcprouter-vps-debian ]; then
-		git clone https://gitee.com/ysurac/openmptcprouter-vps-debian.git /var/lib/openmptcprouter-vps-debian
+		#git clone https://gitee.com/ysurac/openmptcprouter-vps-debian.git /var/lib/openmptcprouter-vps-debian
+		git clone https://gitlab.com/ysurac/openmptcprouter-vps-debian.git /var/lib/openmptcprouter-vps-debian
 	fi
 	cd /var/lib/openmptcprouter-vps-debian
 	git pull
@@ -200,7 +202,8 @@ if [ "$CHINA" = "yes" ]; then
 	echo "deb [arch=amd64] file:/var/lib/openmptcprouter-vps-debian ./" > /etc/apt/sources.list.d/openmptcprouter.list
 	cat /var/lib/openmptcprouter-vps-debian/openmptcprouter.gpg.key | apt-key add -
 	if [ ! -d /usr/share/omr-server-git ]; then
-	git clone https://gitee.com/ysurac/openmptcprouter-vps.git /usr/share/omr-server-git
+		#git clone https://gitee.com/ysurac/openmptcprouter-vps.git /usr/share/omr-server-git
+		git clone https://gitlab.com/ysurac/openmptcprouter-vps.git /usr/share/omr-server-git
 	fi
 	cd /usr/share/omr-server-git
 	git pull

From a02b30624347dfc4d056c180c2f0300cff61a615 Mon Sep 17 00:00:00 2001
From: "Ycarus (Yannick Chabanois)" <ycarus@zugaina.org>
Date: Sun, 9 May 2021 08:35:55 +0000
Subject: [PATCH 12/18] Check wireguard ip

---
 omr-service | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/omr-service b/omr-service
index ff51abe..d6d751d 100755
--- a/omr-service
+++ b/omr-service
@@ -44,6 +44,10 @@ _dsvpn() {
 	[ -n "$(ip -6 r show 64:ff9b::/96 dev dsvpn0)" ] && ip -6 r del 64:ff9b::/96 dev dsvpn0 2>&1 >/dev/null
 }
 
+_wireguard() {
+	[ -n "$(ip a show dev wg0)" ] && ip a add 10.255.247.1/24 dev wg0 2>&1 >/dev/null
+}
+
 
 _omr_api() {
 	[ -z "$(curl -s -k -m 30 https://127.0.0.1:65500/)" ] && {
@@ -115,6 +119,7 @@ while true; do
 	_glorytun_udp
 	_glorytun_tcp
 	_dsvpn
+	_wireguard
 	_multipath
 	_omr_api
 	_lan_route

From c19bade451c2e9380edaf539f38208af962370b4 Mon Sep 17 00:00:00 2001
From: "Ycarus (Yannick Chabanois)" <ycarus@zugaina.org>
Date: Tue, 8 Jun 2021 17:42:39 +0000
Subject: [PATCH 13/18] Add latest omr vps script changes

---
 debian/control                   |   4 ++--
 debian9-x86_64.sh                |  20 ++++++++++++++------
 omr-service                      |  11 ++++++++++-
 openmptcprouter-shorewall.tar.gz | Bin 4106 -> 4136 bytes
 shadowsocks.conf                 |   3 +++
 shorewall4/snat                  |   9 ++++++++-
 6 files changed, 37 insertions(+), 10 deletions(-)

diff --git a/debian/control b/debian/control
index 0da3629..72af96a 100644
--- a/debian/control
+++ b/debian/control
@@ -17,8 +17,8 @@ Depends:
  unzip,
  tracebox,
  omr-iperf3,
- omr-shadowsocks-libev (= 3.3.5-1),
- omr-vps-admin (= 0.3+20210304),
+ omr-shadowsocks-libev (= 3.3.5-2),
+ omr-vps-admin (= 0.3+20210508),
  omr-simple-obfs,
  omr-mlvpn (= 3.0.0+20201216.git.2263bab),
  omr-glorytun (= 0.3.4-4),
diff --git a/debian9-x86_64.sh b/debian9-x86_64.sh
index 9e9b397..99f120a 100755
--- a/debian9-x86_64.sh
+++ b/debian9-x86_64.sh
@@ -31,7 +31,7 @@ WIREGUARD=${WIREGUARD:-yes}
 SOURCES=${SOURCES:-no}
 NOINTERNET=${NOINTERNET:-no}
 REINSTALL=${REINSTALL:-yes}
-SPEEDTEST=${SPEEDTEST:-no}
+SPEEDTEST=${SPEEDTEST:-yes}
 LOCALFILES=${LOCALFILES:-no}
 INTERFACE=${INTERFACE:-$(ip -o -4 route show to default | grep -m 1 -Po '(?<=dev )(\S+)' | tr -d "\n")}
 KERNEL_VERSION="5.4.100"
@@ -53,8 +53,8 @@ DSVPN_BINARY_VERSION="0.1.4-2"
 V2RAY_VERSION="4.35.1"
 V2RAY_PLUGIN_VERSION="4.35.1"
 EASYRSA_VERSION="3.0.6"
-SHADOWSOCKS_VERSION="cadf278d476d0e5679c3e67390b271276a8dc54a"
-SHADOWSOCKS_BINARY_VERSION="3.3.5-1"
+SHADOWSOCKS_VERSION="bf44f710b4a0c451809279383acc847995c35ead"
+SHADOWSOCKS_BINARY_VERSION="3.3.5-2"
 DEFAULT_USER="openmptcprouter"
 VPS_DOMAIN=${VPS_DOMAIN:-$(wget -4 -qO- -T 2 http://hostname.openmptcprouter.com)}
 VPSPATH="server-test"
@@ -100,6 +100,13 @@ if [ "$ARCH" != "amd64" ]; then
 	exit 1
 fi
 
+echo "Check virtualized environment"
+VIRT="$(systemd-detect-virt 2>/dev/null || true)"
+if [ -z "$(uname -a | grep mptcp)" ] && [ -n "$VIRT" ] && ([ "$VIRT" = "openvz" ] || [ "$VIRT" = "lxc" ] || [ "$VIRT" = "docker" ]); then
+	echo "Container are not supported: kernel can't be modified."
+	exit 1
+fi
+
 # Check if DPKG is locked and for broken packages
 #dpkg -i /dev/zero 2>/dev/null
 #if [ "$?" -eq 2 ]; then
@@ -269,6 +276,7 @@ else
 		apt-get -y install linux-image-${KERNEL_VERSION}-mptcp=${KERNEL_PACKAGE_VERSION} linux-headers-${KERNEL_VERSION}-mptcp=${KERNEL_PACKAGE_VERSION}
 	fi
 fi
+
 # Check if mptcp kernel is grub default kernel
 echo "Set MPTCP kernel as grub default..."
 if [ "$LOCALFILES" = "no" ]; then
@@ -280,7 +288,7 @@ fi
 rm -f /etc/grub.d/30_os-prober
 bash update-grub.sh ${KERNEL_VERSION}-mptcp
 bash update-grub.sh ${KERNEL_RELEASE}
-sed -i 's/default="1>0"/default="0"/' /boot/grub/grub.cfg 2>&1 >/dev/null
+[ -f /boot/grub/grub.cfg ] && sed -i 's/default="1>0"/default="0"/' /boot/grub/grub.cfg 2>&1 >/dev/null
 
 echo "Install tracebox OpenMPTCProuter edition"
 apt-get -y -o Dpkg::Options::="--force-overwrite" install tracebox
@@ -1240,9 +1248,9 @@ if [ "$TLS" = "yes" ]; then
 fi
 
 if [ "$SPEEDTEST" = "yes" ]; then
-	if [ ! -f /usr/share/omr-server/speedtest/test.img ]; then
+	mkdir -p /usr/share/omr-server/speedtest
+	if [ ! -f /usr/share/omr-server/speedtest/test.img ] && [ "$(df /usr/share/omr-server/speedtest | awk '/[0-9]%/{print $(NF-2)}')" -gt 2000000 ]; then
 		echo "Generate speedtest image..."
-		mkdir -p /usr/share/omr-server/speedtest
 		dd if=/dev/urandom of=/usr/share/omr-server/speedtest/test.img count=1024 bs=1048576
 		echo "Done"
 	fi
diff --git a/omr-service b/omr-service
index d6d751d..e1eaa5e 100755
--- a/omr-service
+++ b/omr-service
@@ -44,8 +44,15 @@ _dsvpn() {
 	[ -n "$(ip -6 r show 64:ff9b::/96 dev dsvpn0)" ] && ip -6 r del 64:ff9b::/96 dev dsvpn0 2>&1 >/dev/null
 }
 
+_shadowsocks() {
+	[ -z "$(pgrep ss-server)" ] && {
+		logger -t "OMR-Service" "ss-server not detected, restart Shadowsocks"
+		systemctl restart shadowsocks-libev-manager@manager
+	}
+}
+
 _wireguard() {
-	[ -n "$(ip a show dev wg0)" ] && ip a add 10.255.247.1/24 dev wg0 2>&1 >/dev/null
+	[ -z "$(ip a show dev wg0 | grep '10.255.247.1')" ] && ip a add 10.255.247.1/24 dev wg0 2>&1 >/dev/null
 }
 
 
@@ -113,11 +120,13 @@ _openvpn_bonding() {
 	fi
 }
 
+sysctl -p /etc/sysctl.d/90-shadowsocks.conf 2>&1 >/dev/null
 modprobe bonding 2>&1 >/dev/null
 ip link add omr-bonding type bond 2>&1 >/dev/null
 while true; do
 	_glorytun_udp
 	_glorytun_tcp
+	_shadowsocks
 	_dsvpn
 	_wireguard
 	_multipath
diff --git a/openmptcprouter-shorewall.tar.gz b/openmptcprouter-shorewall.tar.gz
index f45840887cfcf10e3701975cb3de7fd86e8e40d0..356841434047882f570e6ccb2c8c8c84ccfd1e9a 100644
GIT binary patch
delta 4121
zcmV+!5a#cSAgCaJABzY8l5?7100Zqje{-YAj`J`66kW;O+nKr~HpD+RdF9(9fNd@q
zSis3<>#8VXlZ0B^_yA8fw>97Wq;9|%JL7pfcILf3lo<nRwbbfXOKNBshx2(7dE?*S
z9S#}*?Pil60m?_d1LypChi?kaM*F<;uEF!ocKaP^9I#D)IV|JEiwJoag<<j~x?Sb}
zqHtV0CiYVp`On^TN={En-A~5#IK$M(nSIodvKK}qm_LNk%u9lBPQ3eYnGhc+0zZZl
zk~{@5c?hQd2}xcSJ~^6sbCPpA&AA-`yPtZ7H546kUORphs2z)vqZ&HLakeqCB!%N-
z#dbK(v<%08;AGRV;KHVdk*!#qeXBaspjP`Scp&e^kz))L%~UL#{OxbVbtT7jM60hj
zjKFopp{UEE%ZO@{bNS>?7k+f<K_5)KOVi*^IsCVrEI7W=__0y@$)8Vxhpc|jF*hqe
zB#TweWW3-6zEo{+E}U=HvqZZjvBO^!%6~q)IOo@YIrAN%+$7bKHdzPJc)en~-R_hs
z>WXuv8n&z3oAu{@avy~8={zpA@Vv~$G`DrhVo~lBX!&`msx9iuX4Tl6`=z$G+U;^x
zb&JqASgg0U)o7P{%hre6YR+e+s(iaVhR)WpPu2z>Yql>|71{Ay=YKFy{OG|O`|&=!
z$#&R(;r|6*Xuso|5C__=&UvGW{=a=LRQ~@hVBP<J@}n62dh@J7PKoW!7E_<7xrvY-
zcy<ErpCr%WX>K|M-1<ZCxQu8}I0KGSxOj<z$ESpRkUkOthW}J(@J(|60ujP52y}dJ
zMk9-ZfnyrnM_%+oFos0FPvY<)dG;dz@8l(aT#_+_lE|L~F+`jDW#W?{A>di-VFdMO
zA<TvsL@nnNKcZrwd9#>=5A>q1kBH{SF_iWFxgU8`VlMBe!5AuQ!PuY2KJj9*KwSLf
zPqMc5upxHZ5D0+4o~rqG;s;QUva?<j&iG7P%JGCiUw!ZrY=1<;1y=kBjea3h4_cRh
z)jXqJV1pp6i{X=4iYO12v*h=L_V>dwLSba$Ctfg(p~C52VGpr=<w=hA9nkYsLD)Oz
z<6jM3A%v*9qgXvr!gB<}#8knqL9pW9Lo{<$EaWCn<HZTYjfbiC7@tJYLq7BfD1I^z
z<JmHLh)-e|>akCYx{cbW#hiOgPLt(-{NFh)r^z^E#o*f+$##m_6n<Z=|0UkfkFOR@
z;x93MjQrCjOqSQ06wad4`w&9V{BaA#_x5TPd@U@z$eSH7_9N_C{|Q2~wEk;!I*ls+
zzXj}C|1tZZ@kxy1;Bii)*C#Iuy!$D{h2)7vH!}AjW<rSaSuj%*jN<X~@zIZe6DXl{
zSv4~EW>ELue}u5|3}F<QlH~$&UI_9Kho^p$(8!vE1mit8nI!~ejE*zN48mEV0pO%2
zgvOpZwD*Owqru8w(`*rikGUqw?=-Wy#0!o&_pYBjHPWjqNwl3Vf8IC~S`gD4cx<I*
zX<X>8yZ-25%wO<77MYU|rJh`W#Yf0u#$h!1$mACy498BWe0G|JA(kTfP%~am6HpRV
zx@YM^41I~2OTaP@#+y8OkiqyqbZ-<uXU=m`s3*sjl;d7iXV2kQ)g^5tD}<TV88oPj
zg5dJK=fwXfSPjJCWbE+&5CPid`+u$0dFB7#0`k<BI>7JUnhM?;-oopD?wtRf&H3M{
z?*G3D+?cj2%CgnvX(B-X^EG2=ZD55O(lTGcR<w<3o%b&fi*Oo@Uk)o{=kvdIgWmrY
zgpSZ|3poE9jb=6f-vYkk{;x?*q`LQ8-TQs@-Y@ea`@ipd%pTN|4Dfj^DS&Bcs&u!y
z){H*Ulp96MuGOLHTwaZTEZeE!ZOdX^0&AYNYf+LE)7c<<c-}@;!jf{WSIAzGSw`dZ
zD1vMmCcW*-(I0vV^Jbuso}p>Rt*ZC4z8H?6i>?%+iJ&v^;W+wZDgUKN&<W-FA1$Yc
zeDp_QhyQOjo8|o<KwdrndlUEy|8Jp*e5?CEfwN8(1OCD>fO?XDy@!DB1leAp+yj>a
z(PkvVJwye3nclF}zN(8^U?P_2D8>4?;iwMBp=e#>wPffzjb3TFqYl^T2Vft#6)A5Y
z-K$hAr<+NR$)5w<1eF~>*dKFzS?yvI5&D)fGHXBC3hO;l(^eNyRlL$vd!WcGq@`%k
z69t5---w!8K#X*M#}cLMB8{%x)^gS4aQ;Jr5i@*7Z#4JE)O;7g__yVPJuSdlg}0iI
zYwG-yHw`8qFoL31y8>@AUeLM8Kpc<#MM7lVE=Y=3G9H4|ttDY5^Er%g>l{@1z+ye?
z%lEz8H94$xxg4sD8O$Fk?|RDa#?*lb(M4Y6%mY|&(3Hi0L7msd?NDVG?@Sdr3Ku1&
zNB7?3i1zvahI9Yy4Ba<bME)o6GR#Fz!<78qr!}WxIPoWE)In0g*}!cM-8Q|q(cpuS
zbRY}nLWM5EC?Wqr+AYXRsN0R7yh->RhvVO3+SbQu7`-IRISJ=$y#!2|)U|FXi!NIh
zJyKz(?N;l5y!8+BSWY&1d_g_i9%RG0mxc?1K*h-e$;9r02st4uTirA!oCrYs@I1)|
zi39F5sill8i0%=zm`+1F7?cH%Oxw+ii;E)n@iaiQDNgXzLXTx#bU6C73t3;j&u(Y2
z&4Q<t)fcGf9=(+6d*^3|hCF_sVJ3GN8DGx-d4X?#w=n;2wmPjAFJS&JG+Wj4|2KiX
z=S>(@R{8x+ni{vZY%N$fJyvsj5=tL)`w8v?_=-%FvO8k@hTeSPJwj$bjYDwS(_jwg
z33*DA#bv$z{QP{jss^5*K4bK8sc~md$!xm+yBi#r`c#`ZL?jmcj))1@3W3~-ToDb<
z<h{#(twADYIV00mbV$e)xqIiwwL@sf)Vl#CEKtS(HC0gYZvP71DAtu>tIl1QKcFH2
zCJaj-_1V7;rr1}k?g5+MgWk8G?YE$VMzsBF&{Hkt7E=C0DgjFlFr+^GsW3<S`&Z&h
zgT)4{QXE$^`Yyeh2>PU}k~JKjU*XC`m(weMSiCu^sM}pVWQdhr3KRjI18WyX-BUHC
zTmR%mbx3;aGe3^e@vtJg+qHX?`_apPi}BwPEp^1cp=)=U5V`~dmP1i0H5(mit(LB^
z)|zgaAl*@{4PyH>{BUITHnFK60sKmn;*Q`TIRjL!=18X7)5N~L!6IMXt+j98qk7DL
zq18xW_zu{OL3A)CgY-C@66j-b9W8=A$#9g@X(9ow0cR?f@88Zu%f#idVuQM{*zc)*
z*A$&W_vrl}cqyya=T%o;zW>7>h?cUB1#{>thH3(~TVKWzlz5R}|2=UZ{V-V6H3bZJ
zB}FyqkF7Y=0HtecfnYd>JOT>jQmg5IJ;=<FfHkHb-v{%{I{l#%^0WM88jihb`4Z`%
zd8T4%-Hg1x@S`c(qwN@$LWM_uoPaW5NdtrV4%Z$i;6W&T`~(G~EBnsI)^?AM(2x$}
zTx1yJ9+<!g%)z0?AZ4Zk#!)9jim@<;9l#XmTF8}^o;cE+?i|*}1viwTkFKJB(3_0C
zIAM$6li_lj1cmDfEV%VBv0q><lTRj!P49XX(YQL7bvyDG1?*7`IeoRnBe0gAN6JW9
zZ~7J#d;0JXFg{EGv0y9*Fq#&OrO8P!nnOCWIPniKt`>Mb$r$2mf!!ZsST?`^1C!SH
zGo0XZ;`4vL|08~h6Myy@CiujE$BnKu?fv{i&9VoDy7ALy6~K(c8NOQx<Ok`mQo=xe
zrn#CH2bl;41O!#@vy^mo?NTq+Wjj=%K$czAbRi^*w!*?KqHI{vmyknMS8egiR&)nW
z<t*97w>hzU0lh+`uXnBxL-AUne6B=Wm0T7Z8RvX{c8?&UpQQQ0NgmFB(1fLdsOqjQ
zS>S|Iu97AW&7sYBNSY#AF1R#SWDHGBahO1uDG-HWg1X=?4Q+(CJsFv-Ad%|~6dmtY
zWJrh3FVtT(@g@e7AfxV@0=SztLx3ZNER&t;m@J5xyvTRDI0Ow>T2Z#jFDBTZOP?&N
zik%}3%SnR<L-j<+1gH~#qnsgqxfLzhW%}VAZ4i-lE`*@I4$gk0U+cy#bepBJ0EIPG
z=mHSsfa&9~k633MtGcG@3UG3yK}Lyj%mpzzSV!6nu!vMNT97fX)vguAbS=kqRw9m3
z<@8-k+og#Vt(>J#>xPzN9gU_~dLMdoec3b=p?_rdxPXa3ja?Xj`Me*{4p<3T<H*!a
znKgxVqHB+OJ@uFFZ%6>{QKj3@Df!4zesS^EzcF&U?FNMB5rjw!t`yhmNw`Uy65=-T
zq57-RZLH4S!feuM9!PyKYbfS`%FiQ6*xmfir<95&bu==2QId!2%y%>4O!cgYqEKl&
z!#imB#fiw8%q9?jBeKOCXkwlOArVE<fo0c@ly|iq;G;-}`UOVL$p}nKg=uPbj|6f~
z|M1AepRoRixdYBjs9@ZvayE?_&KhM+7}*6)(^-Hxb8rV9K-65ACk0Y4trdbL`(UPu
zZNpkF?F=+gun$Qzq1?`=@vUK9i_j~&%qst?Scc2`kX{-fx+36D_w+En-J}W4HF$R?
z&3SF`?b#BYdiX=Gt-vvvlY|X8e~{imy2b^vNbX<&N5t8`Se$cLs)K$!n@JnjMz6;f
z8AH*&&Pvgk*?F~X^q&Y~$T$xzW7qrt=e&UXKb!4lhi|g|Kh0LP|MN|t^!{JA=La+C
z`p}F2XX!`Y#P`2(`%k;t`STav`GY>>C|4wXwzBKF3av$-t57v(fG#%Tf1ha|(UuPf
zaa;HQaP-?jn88XM=5oc)2ywUrh<<MfNUy{zRa2ci=ro9tKaUhkl!0sZwnejZ)~E~3
zlmD)91>}!gkgdixB)<(QY(t)JLpHY|TSa91f{_7^Z>P8pOoBE;2`TCVQ9q_+T;V$k
zXe!`g*u#5#m=BW^W(2hafBM)kf4(2rj*;@i`|L%Pj~v%Hqkr`Vu*}~{sgjC61#uEC
z7XIX*+kkh*f1$&^|I^|5hS0+2|3dZspSOY6_W!mDxj?~0{&XI|3snm6S55&6HgbU1
zK)!J^?s~m%+7w&d44YnW?4V1(_mf|rZcv<-IHxtXamqdo^!1#we;OOK*=K}yb77Pl
zWZ5T!b~9j<8)WQLMZ2qSZ9e^$(eAoHw)vV%1+PFdKKvH|cfJ43x6AMU2z;wm#s9Z}
z<MM~k7&v!k0io)rSE4T8s<M;6VqlD%6|z?NL>j03&OXLdTP5clr>0-%`QG|gunxEp
z|2x0`$G0}W|J80*Z{L4-6Znev|9(Xisb2rCvj11Jf9gaIkoKqF=FEao`Y|+8236lc
zWg+UTbN$zNXCGk8UgXYSWyxNX2^OE4`8(tEqDnq1sGx!hDyX1>3M#0ef(k0Apn?i2
XsGx!hDyX1>?+X71gZNS90C)fZ9&A2V

delta 4091
zcmV<X4+QY2Ac`P=ABzY8F_J%E00ZqjVRNHMuJaZDimqhd?M%Hmwu$X*a^<&=0Jgbc
zU;!tatye`6n<UiQ;0JiJd0X?}PwEDYu``~#u`_r3P-YCM)l#clEvcbl5(YsMxs%`C
z9S)iR-FBNE0m{eLIh?o7&RcE1-Rz#7ziYNy?QZuSX&$hDO*t&%#El4f7lmQ+CAwYZ
z|E6$UJ0{js7<td`Y)0yJ((sZ=BhE05NoF54r0j<g@q>pjn!AY~2E@G&mkIHJ!uMh*
zA<2^;lLvq1osi^Z;gO@c8<3n^J?C}=?0)L&=18!~S?%~upmr>XwxVks$65N=6lIQ+
zWXt9_!_;kmos$gRgbRxv#+Gby)~#ZT!&>bp|AD+0#<o6`RYNu{@|V95#}RGE7R-Tc
zGXlpEMuH{@4kN0G_T`f|TX@l>3w<zkFAbfmbNFvLU2v^t^T%fGCoh=#4_W=bZERM4
zNEWM_$z;Lttx~n&8Gp7}&lIeZ#Pilgq5S95i?h~$I_K6oUv83OikqzcXtG|h+wGp0
zDr&NQrRbKUS)26(FS+-_xE{o%7M_*47{<0PSuDzZ0xdr)RkZ|7-mDtCfmdpKr`s)8
zRkjF?{l$7~JI!vnw=8Y6t!6MURc&?4V`y(3`($nKv1a#TRgoRPb^iN7;zbYc#EbXg
zO}4{-4*$=$`0l$_8{$B>bAHxrqyO)o@s<C73t0F6pS&nWzurD=k~*>6`C{e~B{vb$
z2hUEx{gdQ5tmmdfz^y;{kIRS#g;U@thKrZTe|$>F2k|4}VfgEOv(+Z|FAyQTf<W7I
z=QOg|7&vDBedI<j1Y=0#c_a=Wl4m#a{z_hd!X=qND2cqOA49acUnU;$69S&K5k^pd
z9>Q#RLDVvsdJz=^&6~$0e4rNtZA?@zj-hPe1zzONh_Sq%`4gzD`V%jRJ>te>fw=g|
zn`Uk8V?(U8ArJt8Jyr9s#PgvXWoNy{pSCh-DaR86ef7aju>BDU7g+HlH2Q_iTxeZ?
zR`Zm0fdzuFE{0EH%7QeKPm|vh+TRb$2!)ZUm$?2ch6?q)!X9G#%99-JJD}&O0>5|8
z$G_^DObAglTQ>WGi025pfvJL3gJ8wIhiK*~SjbJECW{k@8xJ%0F+Pc)hdk&JQ2Zna
z<M}drh)-e|>WN2-dd=FWMZi5K^<)`;{3pldG#Q7i7<@Y;*-kN^!SAc}zr_3b@ztVf
z{3WK3kyl^BWO=Pg;XJC}hY*5-$1N1!+pAUZwXkp_cYeUwkFaa~$Mfyd`mcF@-mK#P
zTfnaMAF~e{pM*H}9|Ib_KDm+a-p?Q|Bu^~5k-&qP2_ed3!AwaoipR^xM=wr)poG$8
z)kxsZq3*r+2w~+J!YD8$%LU}T5ab~a&%7j|ku?bk#(QuwO9;vs9p{i4g!4iJz)4LB
zjXeRh_l2^f!OC0HY!QWzxhC@OG_$$H3ywMWo|il|)2k~{u<Tyzta-|JAf`9**h$OM
zxX@d7{n5jub<z5<$eesA_2eplK0+2V38U#pCchA2ICetiv(qdLu@uRJn(=a$fRdon
zJxdp2=u6C8e3p4I-sH)J494@Idm|q@Gss1uo*Y+Fj(b&|J%?LG6V<UK6J}PY(4aC3
zg3I@w6aSxJH4ulBvBUpE1n8FU|8+WNmH&SW$WvSD0Ka!@DtK#n3$MF>bN-)i&j0i3
z{{Nf6jbS;0B$>SyO$6xwR!tw78(6-Ew9Hqq6>YOx=l$EmBAoe?m&3}~`TVcjr1yV$
z{+#c2d7S^vX1kjIZvkI%|JR@<Qr-Kl?)|=c@0WRz{onUJW)Esf2Kc;|6u{6`MZ8;G
ztNMVb@{O!!*UCt-FR#Xbre)Xgwq>y{fi=(CwIGVJVQ-K<Ja3~aVM)2xD`c<8ETeIH
z6hSg|gWh)K=nuVwc{7wrUsqNAR?!AoUyR1kMOQLW1<)Dza2)+H<-f@ybV7OlN6XnE
zAN^6-;s4w1c6t8?kXO(D-UPnF|C?wc-|GHP;OxAL0e|8cKt0KS-b285f^4r)?tx2z
zXfqPw9-;!iOs|{DK+%LOFcDL*<zju@aMXa~NHDMQTGTa-Mz6HoRz_>|L$D9rij=pH
z?o}$5)6FEu<evlF1eF~>SRZqIS?yvI5eB9{HfldvGV47-RaX~KRk%_WYbZ-Aq$#V=
z69t5#-3Y2uK#Vni+Z4p>B8?{B)^gRPF!&+Ch#5YkHwwH7HQ$9l`E9viPYZBX;jQN5
zni70+Xa4j9Mo`phSKv)13pzI$2$PAoNQk6a1xfKr#)F@_wIs}BK8F!*or5YLSgdD#
z`M!U<CWo~ymqV2?{NR!DZlvsP3=N17UF22HJb?8EO<5d&)OlUp4pnyX&Qy`2a8Y7<
zbni}&XrKRI7<i|r=)TD!@;-r=VJ>nOrsVe?tvL(BsW&~P4w4Ga25xicw&}f%1|Ni^
z16eQ^Ds&M>3HdM5?LbyS-EREkPQ&LooctEkwm#0n=p|VOBn;Mi379geYu!*5UA8QG
zq{8amPUozD^AGb_PB(dcK|RYFX2ZFchVwj6#Ysca!0v(wIVCGw-83eg2tfPrJk17)
z1MW1brHo97?h&+@PD45vltl}fcH0*h7e(%qnU7{uoZzX29!r{FbM$E!vc7zu-Ogg0
z1?!a67pUkSy_D*E=Vyn8Jbs^ICU+PaU(Wwqe5>1k!Ti77Iq!5@Jm&v=yHh>?e-qey
z-h@$QmEYf_sc~n^)`E4@V>P!Yq4Y7gm*75tugF9xyCcSL<OU1(5i<K(9D>uH`2n0K
z<S9uOmyO2r^YiJd8hC=noYBXn#+^PT^V$CIZg5=cQ!Qc>ftc_+CI(!~1ac>GMN~MG
z_Aa-728ozyj}1rGAR&{b-klfM4xt@W?*^1GK^Yy?R6xbM{VQ}Mn^(G}*mu3w0Tlr-
zU|0sI&;E5Vgn?}K4%qxY^u7sgzXcssqV8XVzGBL^kn$f=30QJ~Ar0V9fjKhRzY<p}
zEH+@3VmqonaOllM&?jA$tl{wd3RfnYlwQGq;>}hB&FX0(L#*tQrwHgASi3OlzM{&#
z#wRywK+@ZodvT18hZWJ?uDzq&k6!*qjQ@^ksVxk2O})#6&?OkK90_8n+2}}XwRDBG
z)^yVV>9%Zc5L>U|M`N?UiB0_o;8&UycLe*%DWGaKTQr=$Dh#X*7WwLKt$q6*)ng8S
ztwsdHx4~|7qJc5#q|f1$Kp%_iXaVd=f}@m96A@^2I8(5E|8^#r1}=wX3)F?heqR|l
zhF}kSNALf@OGz<5ue$Q`{U6p)Fy(bDn8QHU6$7xn#xjne#Erbh?}_v1h5n+U%3!!F
zDT+aVEZL?8C|*+w1jEs#F;F0vT21SJLuQTytTB!F-VZJt^oL5w&+?O5IB{p?OQeJ5
z8M3MNGV;d4i)Lt#maUsI6&`tU0?L3T4Rz)_9BU|p2ch)w6BLZEtUC)^+dDc!LpqFe
zkzkPfU;<+>2b&s$n3)O~M}v$g#>5zQ08^lAAxDz?!dSI?0j!M+ZYV<^T}7dPJDs?3
z!WO|Nqvb5|3)fRvaBE>=y}()~pG*{+-t{P=adj?fR^%-T*rOV9`f7<sU@bq7<*~fp
z^erg%^x+?1e3$@Y!dMPrG))*wgA-viM|5Oy;vZmKP4If6KEl@mdq2dmY<~X-Cav*j
zIKkz_=l_2HNBj~e-uyF6@TrG?8(nGI`}v2OX$=c?<EPCkfSH7Ie76wD57J+ygn{}@
zV>K-fG7)qL2#PjfDe3Ckp<b-VcBn#uBsq%VKu8uWnT1<KS+JrnAxDa)Si+ShYc`xp
zS+a|7b7J=bdWA?|?_429!nI8KTnUyUIxIFa&iVZ89YI7tN%Mn~Je;9_35!EP(Hu)O
z!3n2aMO7FXBa876Rar0{aA~Ya9~r7_Gl4KuAPU0-b--Qf>KJc(GBQa<BF7%e8s4qQ
zkT#uPsJ~+1O$;VMLfusva5r6s07nX0COg$ISr9OJk?u5M1RAciqHN_~46r|kK3P;`
zD@W?4odykt>I;wwP$x!zIYat#E0~hQ^us&aAR_Br2tfl4oc&n4*7RHGHdA2%3TrCR
z1t7`>)5l>Sv(7kHG*!`L;AD%#j1uFR17b9=j<gwI5vgdjAU&wnu4UP9Oxv+nB92kz
z^j%BKp@|f&oTX3ehL&S(m8MwQ0D5zM*)$TMe<b#}fQdkj9T@q4ydTgGSP59;*w74#
zHHCGeV~zWL<(J-XNC56pq1(?X`Pi0!aq!l^KDK+^CWPlPgh&&vWXJ4_xJjE5;x_S-
z@~hlyuFjppY|>~RNPRGCDCU6j&tpi~o&3$Gl!_*GG%~wUl85WecQfHk^{j}ZP-!c}
z+i3X3iO8DFCJ-ZkvV<FGVx9yc5k=8~W!JWtceUl?qezDO1xC)!2n<t!X=?P2cydPn
z@YsSse*F(~2b`HuLBCO?Y#KA1InJ6ewhEf2vjB0%@D4nHpgJ&53Z!6KD+EjS!Axb#
zg0)=Q8EB$lAEIDDxs^}jTiv`CpjR}BRsK~rb%*sKz0@@yna7`A{V=}Wpb5=2cy~L^
zc`fkm*%F<4_(QI(z%dz<g$+1=h~7cE#s#uK?qC4N#NNMHoO4%-jeb0vNgLOCzt0vK
zBf+}PO3|3vd9`iyUkGBzI1epj*ZcoXcK^S)|EJxl_J6+#l-~c#_WWQb-59y?|1Q1A
zoqFCkZvW|4JAeMfJAcrJ9Oa6n&sKIlSE04&a}}!Q9MHu^{44Dv+VbIlAa3jaAC7)I
z2s2ob!(6WT86ggL0MYLa0qK=+rKpO12b~5n^5?N^3KDQl-?nI;HXE(($^X<qPOEzX
zxb`~k9PF*jP<)EIK-7;Z8CUpZ0gehxX7-#MpPR!x0OO;bPM^@_kJ97XF;aebpS=_E
zk>i@D^smtbmig-+Rs8;c^FW-0i-k8m=r-V8@&AlJXW#!hZ?&3y2cQ4*)%Sni2436$
z+bQG%1rzzF^MDp#r2v2C6rf-u2Y3zS8#m*w*ZZbTvBk}>>Gj4Ay7YTL`E`ARqF&;h
z*4V}=`!vwkbINLL&}N?z+RcSgZjfc44BE|rQErg2PZjO1zP0&(^jk)|>jK&4Yc3VM
z0?Fj?UjW?o{&%Zee*cGWbvjl2e+xJ+fB1}neP<L9idMf8H0f56?EDo2eQd9gwZbRT
zIQe(>F`n9L#lUe&`h}kFt#1YEfE)3@^ZS3T&gS>Oy6x)z-<!Z!y#Mzrnn?Bfca{CW
zn*CEJa)7iy{WfP(7L3x5p^-8u+6F2MQD2?wzs5WJ09*DVcm66%_L_{p_|(qd8K)Oj
t@>xLz6;x0`1r=0KK?N05P(cM1R8T<$6;x0`1r>Z(_&YCMBK81y001LV57qzx

diff --git a/shadowsocks.conf b/shadowsocks.conf
index 302bbe0..5fb5da0 100644
--- a/shadowsocks.conf
+++ b/shadowsocks.conf
@@ -23,6 +23,8 @@ net.ipv4.tcp_tw_reuse = 1
 #net.ipv4.tcp_tw_recycle = 0
 # short FIN timeout
 net.ipv4.tcp_fin_timeout = 80
+# Increase max orphans
+net.ipv4.tcp_max_orphans = 16384
 # short keepalive time
 net.ipv4.tcp_keepalive_time = 7200
 # outbound port range
@@ -49,6 +51,7 @@ net.ipv4.tcp_congestion_control = cubic
 net.core.default_qdisc = fq
 # Default conntrack is too small
 net.netfilter.nf_conntrack_max = 131072
+net.netfilter.nf_conntrack_tcp_timeout_established = 86400
 
 net.ipv4.conf.all.log_martians = 0
 net.ipv4.conf.default.log_martians = 0
diff --git a/shorewall4/snat b/shorewall4/snat
index a240a09..8435e40 100644
--- a/shorewall4/snat
+++ b/shorewall4/snat
@@ -15,7 +15,14 @@
 ###########################################################################################################################################
 #ACTION			SOURCE			DEST            PROTO	PORT	IPSEC	MARK	USER	SWITCH	ORIGDEST	PROBABILITY
 #
-MASQUERADE		10.255.0.0/16,\
+MASQUERADE		10.255.247.0/24,\
+			10.255.248.0/24,\
+			10.255.250.0/24,\
+			10.255.251.0/24,\
+			10.255.252.0/24,\
+			10.255.253.0/24,\
+			10.255.254.0/24,\
+			10.255.255.0/24,\
 			169.254.0.0/16,\
 			172.16.0.0/12,\
 			192.168.0.0/16		$NET_IFACE

From 33cf1b4718ad8ff70e1b0f6a451a4906808e0fe9 Mon Sep 17 00:00:00 2001
From: "Ycarus (Yannick Chabanois)" <ycarus@zugaina.org>
Date: Mon, 14 Jun 2021 05:46:38 +0000
Subject: [PATCH 14/18] Update to 0.1026

---
 debian/changelog  | 6 ++++++
 debian9-x86_64.sh | 2 +-
 2 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/debian/changelog b/debian/changelog
index 33cf21b..12a86ee 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,9 @@
+omr-server (0.1026) unstable; urgency=medium
+
+    * Many changes
+
+ -- OpenMPTCProuter <contact@openmptcprouter.com>  Mon, 14 Jun 2021 07:43:42 +0200
+
 omr-server (0.1025-test) unstable; urgency=medium
 
     * Wireguard support and fixed
diff --git a/debian9-x86_64.sh b/debian9-x86_64.sh
index 99f120a..098148c 100755
--- a/debian9-x86_64.sh
+++ b/debian9-x86_64.sh
@@ -62,7 +62,7 @@ VPSURL="https://www.openmptcprouter.com/"
 REPO="repo.openmptcprouter.com"
 CHINA=${CHINA:-no}
 
-OMR_VERSION="0.1025-test"
+OMR_VERSION="0.1026"
 
 DIR=$( pwd )
 #"

From a5cf11a449aaec4090e691486b5201f4ddc5c27d Mon Sep 17 00:00:00 2001
From: "Ycarus (Yannick Chabanois)" <ycarus@zugaina.org>
Date: Mon, 14 Jun 2021 05:47:42 +0000
Subject: [PATCH 15/18] Update server script

---
 debian9-x86_64.sh | 12 +++++++++---
 omr-service       | 26 ++++++++++++++------------
 2 files changed, 23 insertions(+), 15 deletions(-)

diff --git a/debian9-x86_64.sh b/debian9-x86_64.sh
index e3c515e..02baec9 100644
--- a/debian9-x86_64.sh
+++ b/debian9-x86_64.sh
@@ -123,6 +123,11 @@ if [ "$UPDATE" = "yes" ]; then
 	fi
 	echo "Update mode"
 fi
+# Force update key
+[ -f /etc/apt/sources.list.d/openmptcprouter.list ] && {
+	echo "Update OpenMPTCProuter repo key"
+	wget -O - http://repo.openmptcprouter.com/openmptcprouter.gpg.key | apt-key add -
+}
 
 echo "Remove lock and update packages list..."
 rm -f /var/lib/dpkg/lock
@@ -211,7 +216,7 @@ fi
 rm -f /etc/grub.d/30_os-prober
 bash update-grub.sh ${KERNEL_VERSION}-mptcp
 bash update-grub.sh ${KERNEL_RELEASE}
-sed -i 's/default="1>0"/default="0"/' /boot/grub/grub.cfg 2>&1 >/dev/null
+[ -f /boot/grub/grub.cfg ] && sed -i 's/default="1>0"/default="0"/' /boot/grub/grub.cfg 2>&1 >/dev/null
 
 echo "Install tracebox OpenMPTCProuter edition"
 apt-get -y -o Dpkg::Options::="--force-overwrite" install tracebox
@@ -1157,7 +1162,7 @@ if [ "$update" = "0" ]; then
 	echo 'Your glorytun key: '
 	echo $GLORYTUN_PASS
 	if [ "$DSVPN" = "yes" ]; then
-		echo 'A Dead Simple VPN port: 65011'
+		echo 'A Dead Simple VPN port: 65401'
 		echo 'A Dead Simple VPN key: '
 		echo $DSVPN_PASS
 	fi
@@ -1204,7 +1209,7 @@ if [ "$update" = "0" ]; then
 	EOF
 	if [ "$DSVPN" = "yes" ]; then
 		cat >> /root/openmptcprouter_config.txt <<-EOF
-		A Dead Simple VPN port: 65011
+		A Dead Simple VPN port: 65401
 		A Dead Simple VPN key: ${DSVPN_PASS}
 		EOF
 	fi
@@ -1227,6 +1232,7 @@ if [ "$update" = "0" ]; then
 		Your OpenMPTCProuter Server username: openmptcprouter
 		EOF
 	fi
+	systemctl -q restart sshd
 else
 	echo '===================================================================================='
 	echo "OpenMPTCProuter Server is now updated to version $OMR_VERSION !"
diff --git a/omr-service b/omr-service
index 1aa788f..6074fb6 100755
--- a/omr-service
+++ b/omr-service
@@ -60,19 +60,21 @@ _lan_route() {
 
 _gre_tunnels() {
 	. "$(readlink -f "/etc/shorewall/params.vpn")"
-	for intf in /etc/openmptcprouter-vps-admin/intf/*; do
-		if [ -f "$intf" ]; then
-			. "$(readlink -f "$intf")"
-			iface="$(basename $intf)"
-			if [ "$(ip tunnel show $iface 2>/dev/null | awk '{print $4}')" != "$OMR_ADDR" ]; then
-				ip tunnel del $iface 2>&1 >/dev/null
-				ip tunnel add $iface mode gre local $INTFADDR remote $OMR_ADDR
-				ip link set $iface up
-				ip addr add $LOCALIP dev $iface
-				ip route add $NETWORK dev $iface 2>&1 >/dev/null
+	if [ -n "$OMR_ADDR" ]; then
+		for intf in /etc/openmptcprouter-vps-admin/intf/*; do
+			if [ -f "$intf" ]; then
+				. "$(readlink -f "$intf")"
+				iface="$(basename $intf)"
+				if [ "$(ip tunnel show $iface 2>/dev/null | awk '{print $4}')" != "$OMR_ADDR" ]; then
+					ip tunnel del $iface 2>&1 >/dev/null
+					ip tunnel add $iface mode gre local $INTFADDR remote $OMR_ADDR 2>&1 >/dev/null
+					ip link set $iface up 2>&1 >/dev/null
+					ip addr add $LOCALIP dev $iface 2>&1 >/dev/null
+					ip route add $NETWORK dev $iface 2>&1 >/dev/null
+				fi
 			fi
-		fi
-	done
+		done
+	fi
 }
 
 _openvpn_bonding() {

From d7dacc3e728fa9747bbf629d5ef51052d017ec85 Mon Sep 17 00:00:00 2001
From: "Ycarus (Yannick Chabanois)" <ycarus@zugaina.org>
Date: Mon, 23 Aug 2021 13:51:22 +0000
Subject: [PATCH 16/18] Update ubond

---
 debian9-x86_64.sh | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/debian9-x86_64.sh b/debian9-x86_64.sh
index 098148c..f970370 100755
--- a/debian9-x86_64.sh
+++ b/debian9-x86_64.sh
@@ -43,7 +43,7 @@ GLORYTUN_TCP_BINARY_VERSION="0.0.35-3"
 #MLVPN_VERSION="8f9720978b28c1954f9f229525333547283316d2"
 MLVPN_VERSION="f45cec350a6879b8b020143a78134a022b5df2a7"
 MLVPN_BINARY_VERSION="3.0.0+20201216.git.2263bab"
-UBOND_VERSION="672100fb57913ffd29caad63517e145a5974b078"
+UBOND_VERSION="f9fb6aa0a65e8e20950977bda970c90012f830d7"
 OBFS_VERSION="486bebd9208539058e57e23a12f23103016e09b4"
 OBFS_BINARY_VERSION="0.0.5-1"
 OMR_ADMIN_VERSION="027d5c8e80ef469d33e43f6cbf3103b30e55ea1c"
@@ -62,7 +62,7 @@ VPSURL="https://www.openmptcprouter.com/"
 REPO="repo.openmptcprouter.com"
 CHINA=${CHINA:-no}
 
-OMR_VERSION="0.1026"
+OMR_VERSION="0.1026-test"
 
 DIR=$( pwd )
 #"
@@ -1189,11 +1189,11 @@ else
 	cp ${DIR}/shorewall4/shorewall.conf /etc/shorewall/shorewall.conf
 	cp ${DIR}/shorewall4/policy /etc/shorewall/policy
 	cp ${DIR}/shorewall4/params /etc/shorewall/params
-	cp ${DIR}/shorewall4/params.vpn /etc/shorewall/params.vpn
-	cp ${DIR}/shorewall4/params.net /etc/shorewall/params.net
+	#cp ${DIR}/shorewall4/params.vpn /etc/shorewall/params.vpn
+	#cp ${DIR}/shorewall4/params.net /etc/shorewall/params.net
 	cp ${DIR}/shorewall6/params /etc/shorewall6/params
-	cp ${DIR}/shorewall6/params.net /etc/shorewall6/params.net
-	cp ${DIR}/shorewall6/params.vpn /etc/shorewall6/params.vpn
+	#cp ${DIR}/shorewall6/params.net /etc/shorewall6/params.net
+	#cp ${DIR}/shorewall6/params.vpn /etc/shorewall6/params.vpn
 	cp ${DIR}/shorewall6/interfaces /etc/shorewall6/interfaces
 	cp ${DIR}/shorewall6/stoppedrules /etc/shorewall6/stoppedrules
 	cp ${DIR}/shorewall6/snat /etc/shorewall6/snat

From 2b5afea3a1a3fd2b1eeb7d7c9f7aaf4c42ac3e92 Mon Sep 17 00:00:00 2001
From: "Ycarus (Yannick Chabanois)" <ycarus@zugaina.org>
Date: Fri, 11 Feb 2022 15:54:58 +0000
Subject: [PATCH 17/18] Fix

---
 debian9-x86_64.sh | 128 +++++++++++++++++++++++++++++++++++++---------
 multipath         | 123 +++++++++++++++++++++++++++++++-------------
 omr-pihole.sh     |   1 +
 omr-service       |   6 ++-
 shadowsocks.conf  |   2 +-
 ubond.network     |  17 ++++++
 ubond0.conf       |  42 +++++++++++++++
 ubond@.service.in |  16 ++++++
 8 files changed, 273 insertions(+), 62 deletions(-)
 mode change 100644 => 100755 multipath
 create mode 100644 ubond.network
 create mode 100644 ubond0.conf
 create mode 100644 ubond@.service.in

diff --git a/debian9-x86_64.sh b/debian9-x86_64.sh
index 27938fc..3fcf1bc 100755
--- a/debian9-x86_64.sh
+++ b/debian9-x86_64.sh
@@ -6,6 +6,7 @@
 # See /LICENSE for more information.
 #
 
+UPSTREAM=${UPSTREAM:-no}
 SHADOWSOCKS_PASS=${SHADOWSOCKS_PASS:-$(head -c 32 /dev/urandom | base64 -w0)}
 GLORYTUN_PASS=${GLORYTUN_PASS:-$(od -vN "32" -An -tx1 /dev/urandom | tr '[:lower:]' '[:upper:]' | tr -d " \n")}
 DSVPN_PASS=${DSVPN_PASS:-$(od -vN "32" -An -tx1 /dev/urandom | tr '[:lower:]' '[:upper:]' | tr -d " \n")}
@@ -29,32 +30,47 @@ OPENVPN=${OPENVPN:-yes}
 DSVPN=${DSVPN:-yes}
 WIREGUARD=${WIREGUARD:-yes}
 SOURCES=${SOURCES:-no}
+if [ "$UPSTREAM" = "yes" ]; then
+	SOURCES="yes"
+fi
 NOINTERNET=${NOINTERNET:-no}
 REINSTALL=${REINSTALL:-yes}
 SPEEDTEST=${SPEEDTEST:-yes}
 LOCALFILES=${LOCALFILES:-no}
 INTERFACE=${INTERFACE:-$(ip -o -4 route show to default | grep -m 1 -Po '(?<=dev )(\S+)' | tr -d "\n")}
-KERNEL_VERSION="5.4.100"
-KERNEL_PACKAGE_VERSION="1.18+9d3f35b"
+KERNEL_VERSION="5.4.132"
+KERNEL_PACKAGE_VERSION="1.19+4f508aa"
 KERNEL_RELEASE="${KERNEL_VERSION}-mptcp_${KERNEL_PACKAGE_VERSION}"
+if [ "$UPSTREAM" = "yes" ]; then
+	KERNEL_VERSION="5.15.13"
+	KERNEL_PACKAGE_VERSION="1.5"
+	KERNEL_RELEASE="${KERNEL_VERSION}-mptcp_${KERNEL_VERSION}-${KERNEL_PACKAGE_VERSION}"
+fi
 GLORYTUN_UDP_VERSION="32267e86a6da05b285bb3bf2b136c105dc0af4bb"
-GLORYTUN_UDP_BINARY_VERSION="0.3.4-4"
+GLORYTUN_UDP_BINARY_VERSION="0.3.4-5"
 GLORYTUN_TCP_BINARY_VERSION="0.0.35-3"
 #MLVPN_VERSION="8f9720978b28c1954f9f229525333547283316d2"
-MLVPN_VERSION="f45cec350a6879b8b020143a78134a022b5df2a7"
-MLVPN_BINARY_VERSION="3.0.0+20201216.git.2263bab"
+MLVPN_VERSION="8aa1b16d843ea68734e2520e39a34cb7f3d61b2b"
+MLVPN_BINARY_VERSION="3.0.0+20211028.git.ddafba3"
 UBOND_VERSION="f9fb6aa0a65e8e20950977bda970c90012f830d7"
 OBFS_VERSION="486bebd9208539058e57e23a12f23103016e09b4"
 OBFS_BINARY_VERSION="0.0.5-1"
 OMR_ADMIN_VERSION="027d5c8e80ef469d33e43f6cbf3103b30e55ea1c"
+if [ "$UPSTREAM" = "yes" ]; then
+	OMR_ADMIN_VERSION="2a8f642f89a982d2c26c3e176f6c4c1e3e91ffcb"
+fi
 OMR_ADMIN_BINARY_VERSION="0.3+20210508"
 DSVPN_VERSION="3b99d2ef6c02b2ef68b5784bec8adfdd55b29b1a"
 DSVPN_BINARY_VERSION="0.1.4-2"
-V2RAY_VERSION="4.35.1"
+V2RAY_VERSION="4.43.0"
 V2RAY_PLUGIN_VERSION="4.35.1"
 EASYRSA_VERSION="3.0.6"
-SHADOWSOCKS_VERSION="bf44f710b4a0c451809279383acc847995c35ead"
-SHADOWSOCKS_BINARY_VERSION="3.3.5-2"
+SHADOWSOCKS_VERSION="7407b214f335f0e2068a8622ef3674d868218e17"
+if [ "$UPSTREAM" = "yes" ]; then
+	SHADOWSOCKS_VERSION="410950d87d8cdf8502d8f59a79dc0ff4c7677543"
+fi
+IPROUTE2_VERSION="29da83f89f6e1fe528c59131a01f5d43bcd0a000"
+SHADOWSOCKS_BINARY_VERSION="3.3.5-3"
 DEFAULT_USER="openmptcprouter"
 VPS_DOMAIN=${VPS_DOMAIN:-$(wget -4 -qO- -T 2 http://hostname.openmptcprouter.com)}
 VPSPATH="server-test"
@@ -62,7 +78,7 @@ VPSURL="https://www.openmptcprouter.com/"
 REPO="repo.openmptcprouter.com"
 CHINA=${CHINA:-no}
 
-OMR_VERSION="0.1026-test"
+OMR_VERSION="0.1027-test"
 
 DIR=$( pwd )
 #"
@@ -82,14 +98,14 @@ if test -f /etc/os-release ; then
 else
 	. /usr/lib/os-release
 fi
-if [ "$ID" = "debian" ] && [ "$VERSION_ID" != "9" ] && [ "$VERSION_ID" != "10" ]; then
-	echo "This script only work with Debian Stretch (9.x) or Debian Buster (10.x)"
+if [ "$ID" = "debian" ] && [ "$VERSION_ID" != "9" ] && [ "$VERSION_ID" != "10" ] && [ "$VERSION_ID" != "11" ]; then
+	echo "This script only work with Debian Stretch (9.x), Debian Buster (10.x) or Debian Bullseye (11.x)"
 	exit 1
 elif [ "$ID" = "ubuntu" ] && [ "$VERSION_ID" != "18.04" ] && [ "$VERSION_ID" != "19.04" ] && [ "$VERSION_ID" != "20.04" ]; then
 	echo "This script only work with Ubuntu 18.04, 19.04 or 20.04"
 	exit 1
 elif [ "$ID" != "debian" ] && [ "$ID" != "ubuntu" ]; then
-	echo "This script only work with Ubuntu 18.04, Ubuntu 19.04, Ubutun 20.04, Debian Stretch (9.x) or Debian Buster (10.x)"
+	echo "This script only work with Ubuntu 18.04, Ubuntu 19.04, Ubutun 20.04, Debian Stretch (9.x), Debian Buster (10.x) or Debian Bullseye (11.x)"
 	exit 1
 fi
 
@@ -166,7 +182,7 @@ echo "Remove lock and update packages list..."
 rm -f /var/lib/dpkg/lock
 rm -f /var/lib/dpkg/lock-frontend
 rm -f /var/cache/apt/archives/lock
-apt-get update
+apt-get update --allow-releaseinfo-change
 rm -f /var/lib/dpkg/lock
 rm -f /var/lib/dpkg/lock-frontend
 rm -f /var/cache/apt/archives/lock
@@ -179,7 +195,7 @@ if [ "$ID" = "debian" ] && [ "$VERSION_ID" = "9" ] && [ "$UPDATE_OS" = "yes" ];
 	apt-get -y -f --force-yes upgrade
 	apt-get -y -f --force-yes dist-upgrade
 	sed -i 's:stretch:buster:g' /etc/apt/sources.list
-	apt-get update
+	apt-get update --allow-releaseinfo-change
 	apt-get -y -o Dpkg::Options::="--force-confdef" -o Dpkg::Options::="--force-confnew" upgrade
 	apt-get -y -o Dpkg::Options::="--force-confdef" -o Dpkg::Options::="--force-confnew" dist-upgrade
 	VERSION_ID="10"
@@ -189,7 +205,7 @@ if [ "$ID" = "ubuntu" ] && [ "$VERSION_ID" = "18.04" ] && [ "$UPDATE_OS" = "yes"
 	apt-get -y -f --force-yes upgrade
 	apt-get -y -f --force-yes dist-upgrade
 	sed -i 's:bionic:focal:g' /etc/apt/sources.list
-	apt-get update
+	apt-get update --allow-releaseinfo-change
 	apt-get -y -o Dpkg::Options::="--force-confdef" -o Dpkg::Options::="--force-confnew" upgrade
 	apt-get -y -o Dpkg::Options::="--force-confdef" -o Dpkg::Options::="--force-confnew" dist-upgrade
 	VERSION_ID="20.04"
@@ -235,6 +251,17 @@ else
 		Pin: origin ${REPO}
 		Pin-Priority: 1001
 	EOF
+	if [ -n "$(echo $OMR_VERSION | grep test)" ]; then
+		echo "deb [arch=amd64] https://${REPO} next main" > /etc/apt/sources.list.d/openmptcprouter-test.list
+		cat <<-EOF | tee /etc/apt/preferences.d/openmptcprouter.pref
+			Explanation: Prefer OpenMPTCProuter provided packages over the Debian native ones
+			Package: *
+			Pin: origin ${REPO}
+			Pin-Priority: 1002
+		EOF
+	else
+		rm -f /etc/apt/sources.list.d/openmptcprouter-test.list
+	fi
 	wget -O - https://${REPO}/openmptcprouter.gpg.key | apt-key add -
 fi
 
@@ -252,9 +279,9 @@ elif [ "$ID" = "ubuntu" ]; then
 fi
 # Install mptcp kernel and shadowsocks
 echo "Install mptcp kernel and shadowsocks..."
-apt-get update
+apt-get update --allow-releaseinfo-change
 sleep 2
-apt-get -y install dirmngr patch rename curl libcurl4 unzip
+apt-get -y install dirmngr patch rename curl libcurl4 unzip pkg-config
 
 if [ "$SOURCES" = "yes" ]; then
 	wget -O /tmp/linux-image-${KERNEL_RELEASE}_amd64.deb ${VPSURL}kernel/linux-image-${KERNEL_RELEASE}_amd64.deb
@@ -267,7 +294,7 @@ if [ "$SOURCES" = "yes" ]; then
 	#dpkg --remove --force-remove-reinstreq linux-image-${KERNEL_VERSION}-mptcp
 	#dpkg --remove --force-remove-reinstreq linux-headers-${KERNEL_VERSION}-mptcp
 	if [ "$(dpkg -l | grep linux-image-${KERNEL_VERSION} | grep ${KERNEL_PACKAGE_VERSION})" = "" ]; then
-		echo "Install kernel linux-image-${KERNEL_RELEASE}"
+		echo "Install kernel linux-image-${KERNEL_RELEASE} source release"
 		echo "\033[1m !!! if kernel install fail run: dpkg --remove --force-remove-reinstreq linux-image-${KERNEL_VERSION}-mptcp !!! \033[0m"
 		dpkg --force-all -i -B /tmp/linux-headers-${KERNEL_RELEASE}_amd64.deb
 		dpkg --force-all -i -B /tmp/linux-image-${KERNEL_RELEASE}_amd64.deb
@@ -300,6 +327,32 @@ apt-get -y -o Dpkg::Options::="--force-overwrite" install tracebox
 echo "Install iperf3 OpenMPTCProuter edition"
 apt-get -y -o Dpkg::Options::="--force-overwrite" install omr-iperf3
 
+if [ "$UPSTREAM" = "yes" ]; then
+	echo "Compile and install mptcpize..."
+	apt-get -y install --no-install-recommends build-essential
+	cd /tmp
+	git clone https://github.com/Ysurac/mptcpize.git
+	cd mptcpize
+	make
+	make install
+	cd /tmp
+	rm -rf /tmp/mptcpize
+	echo "Compile and install iproute2..."
+	apt-get -y install --no-install-recommends bison libbison-dev flex
+	#wget https://mirrors.edge.kernel.org/pub/linux/utils/net/iproute2/iproute2-5.16.0.tar.gz
+	#tar xzf iproute2-5.16.0.tar.gz
+	#cd iproute2-5.16.0
+	git clone git://git.kernel.org/pub/scm/network/iproute2/iproute2.git 
+	cd iproute2
+	git checkout 29da83f89f6e1fe528c59131a01f5d43bcd0a000
+	make
+	make install
+	cd /tmp
+	rm -rf iproute2
+	echo "MPTCPize iperf3..."
+	mptcpize enable iperf3
+fi
+
 apt-get -y remove shadowsocks-libev
 
 if [ "$SOURCES" = "yes" ]; then
@@ -347,6 +400,7 @@ if [ "$SOURCES" = "yes" ]; then
 	rm -f /var/lib/dpkg/lock
 	rm -f /var/lib/dpkg/lock-frontend
 	apt-get -y install --no-install-recommends devscripts equivs apg libcap2-bin libpam-cap libc-ares2 libc-ares-dev libev4 haveged libpcre3-dev
+	apt-get -y install --no-install-recommends asciidoc-base asciidoc-common docbook-xml docbook-xsl libev-dev libmbedcrypto3 libmbedtls-dev libmbedtls12 libmbedx509-0 libxml2-utils libxslt1.1 pkg-config sgml-base sgml-data xml-core xmlto xsltproc
 	sleep 1
 	rm -f /var/lib/dpkg/lock
 	rm -f /var/lib/dpkg/lock-frontend
@@ -469,9 +523,14 @@ if [ "$OMR_ADMIN" = "yes" ]; then
 		apt-get -y remove python3-jwt
 		pip3 -q install pyjwt
 	else
-		apt-get -y install python3-passlib python3-jwt python3-netaddr libuv1 python3-uvloop
+		if [ "$ID" = "debian" ] && ([ "$VERSION_ID" = "10" ] || [ "$VERSION_ID" = "11" ]); then
+			apt-get -y --allow-downgrades install python3-passlib python3-jwt python3-netaddr libuv1
+			pip3 -q install uvloop
+		else
+			apt-get -y install python3-passlib python3-jwt python3-netaddr libuv1 python3-uvloop
+		fi
 	fi
-	apt-get -y install python3-uvicorn jq ipcalc python3-netifaces python3-aiofiles python3-psutil
+	apt-get -y --allow-downgrades install python3-uvicorn jq ipcalc python3-netifaces python3-aiofiles python3-psutil python3-requests
 	echo '-- pip3 install needed python modules'
 	#pip3 install pyjwt passlib uvicorn fastapi netjsonconfig python-multipart netaddr
 	#pip3 -q install fastapi netjsonconfig python-multipart uvicorn -U
@@ -534,6 +593,10 @@ if [ "$OMR_ADMIN" = "yes" ]; then
 		systemctl enable omr-admin-ipv6.service
 	}
 	systemctl enable omr-admin.service
+	if [ "$UPSTREAM" = "yes" ]; then
+		mptcpize enable omr-admin.service
+		[ "$(ip -6 a)" != "" ] && mptcpize enable omr-admin-ipv6.service
+	fi
 fi
 
 # Get shadowsocks optimization
@@ -687,14 +750,17 @@ if [ "$V2RAY" = "yes" ]; then
 	if [ ! -f /etc/v2ray/v2ray-server.json ]; then
 		wget -O /etc/v2ray/v2ray-server.json ${VPSURL}${VPSPATH}/v2ray-server.json
 		sed -i "s:V2RAY_UUID:$V2RAY_UUID:g" /etc/v2ray/v2ray-server.json
-		rm /etc/v2ray/config.json
-		ln -s /etc/v2ray/v2ray-server.json /etc/v2ray/config.json
 	fi
+	rm -f /etc/v2ray/config.json
+	ln -s /etc/v2ray/v2ray-server.json /etc/v2ray/config.json
 	if [ -f /etc/systemd/system/v2ray.service.dpkg-dist ]; then
 		mv -f /etc/systemd/system/v2ray.service.dpkg-dist /etc/systemd/system/v2ray.service
 	fi
 	systemctl daemon-reload
 	systemctl enable v2ray.service
+	if [ "$UPSTREAM" = "yes" ]; then
+		mptcpize enable v2ray
+	fi
 fi
 
 if systemctl -q is-active mlvpn@mlvpn0.service; then
@@ -717,7 +783,8 @@ if [ "$MLVPN" = "yes" ]; then
 		rm -rf /tmp/mlvpn
 		cd /tmp
 		#git clone https://github.com/markfoodyburton/MLVPN.git /tmp/mlvpn
-		git clone https://github.com/flohoff/MLVPN.git /tmp/mlvpn
+		#git clone https://github.com/flohoff/MLVPN.git /tmp/mlvpn
+		git clone https://github.com/zehome/MLVPN.git /tmp/mlvpn
 		#git clone https://github.com/link4all/MLVPN.git /tmp/mlvpn
 		cd /tmp/mlvpn
 		git checkout ${MLVPN_VERSION}
@@ -936,6 +1003,9 @@ if [ "$OPENVPN" = "yes" ]; then
 	mkdir -p /etc/openvpn/ccd
 	systemctl enable openvpn@tun0.service
 	systemctl enable openvpn@tun1.service
+	if [ "$UPSTREAM" = "yes" ]; then
+		mptcpize enable openvpn@tun0
+	fi
 	systemctl enable openvpn@bonding1.service
 	systemctl enable openvpn@bonding2.service
 	systemctl enable openvpn@bonding3.service
@@ -1047,6 +1117,9 @@ if [ "$DSVPN" = "yes" ]; then
 		apt-get -y -o Dpkg::Options::="--force-confdef" -o Dpkg::Options::="--force-confold" -o Dpkg::Options::="--force-overwrite" install omr-dsvpn=${DSVPN_BINARY_VERSION}
 		DSVPN_PASS=$(cat /etc/dsvpn/dsvpn0.key | tr -d "\n")
 	fi
+	if [ "$UPSTREAM" = "yes" ]; then
+		mptcpize enable dsvpn-server@dsvpn0
+	fi
 fi
 
 # Install Glorytun TCP
@@ -1068,8 +1141,15 @@ if [ "$SOURCES" = "yes" ]; then
 	apt-get -y install build-essential pkg-config autoconf automake
 	rm -rf /tmp/glorytun-0.0.35
 	cd /tmp
-	wget -O /tmp/glorytun-0.0.35.tar.gz http://github.com/angt/glorytun/releases/download/v0.0.35/glorytun-0.0.35.tar.gz
+	if [ "$UPSTREAM" = "yes" ]; then
+		wget -O /tmp/glorytun-0.0.35.tar.gz https://github.com/Ysurac/glorytun/archive/refs/heads/tcp.tar.gz
+	else
+		wget -O /tmp/glorytun-0.0.35.tar.gz http://github.com/angt/glorytun/releases/download/v0.0.35/glorytun-0.0.35.tar.gz
+	fi
 	tar xzf glorytun-0.0.35.tar.gz
+	if [ "$UPSTREAM" = "yes" ]; then
+		mv /tmp/glorytun-tcp /tmp/glorytun-0.0.35
+	fi
 	cd glorytun-0.0.35
 	./autogen.sh
 	./configure
diff --git a/multipath b/multipath
old mode 100644
new mode 100755
index cee0743..e92d0c6
--- a/multipath
+++ b/multipath
@@ -6,9 +6,8 @@
 # Released under GPL 3 or later
 
 if [ -d "/proc/sys/net/mptcp" ]; then
-        if [ `cat /proc/sys/net/mptcp/mptcp_enabled` = 0 ]; then
+        if ([ -f /proc/sys/net/mptcp/mptcp_enabled ] && [ `cat /proc/sys/net/mptcp/mptcp_enabled` = 0 ]) || ([ -f /proc/sys/net/mptcp/enabled ] && [ `cat /proc/sys/net/mptcp/enabled` = 0 ]); then
                 echo "MPTCP is disabled!"
-                echo "Please set net.mptcp.mptcp_enabled = 1"
                 exit 1
         fi
 else
@@ -26,7 +25,7 @@ case $1 in
         echo "  multipath device {on | off | backup | handover}"
         echo
         echo "show established conections: -c"
-        echo "show mullmesh info: -f"
+        echo "show fullmesh info: -f"
         echo "show kernel config: -k"
         echo
         echo "Flag on the device, to enable/disable MPTCP for this interface. The backup-flag"
@@ -43,12 +42,28 @@ case $1 in
         cat /proc/net/mptcp_fullmesh
         exit 0;;
    "-k")
-        echo Enabled: `cat /proc/sys/net/mptcp/mptcp_enabled`
-        echo Path Manager: `cat /proc/sys/net/mptcp/mptcp_path_manager`
-        echo Use checksum: `cat /proc/sys/net/mptcp/mptcp_checksum`
-        echo Scheduler: `cat /proc/sys/net/mptcp/mptcp_scheduler`
-        echo Syn retries: `cat /proc/sys/net/mptcp/mptcp_syn_retries`
-        echo Debugmode: `cat /proc/sys/net/mptcp/mptcp_debug`
+        if [ -f /proc/sys/net/mptcp/mptcp_enabled ]; then
+            echo Enabled: `cat /proc/sys/net/mptcp/mptcp_enabled`
+        elif [ -f /proc/sys/net/mptcp/enabled ]; then
+            echo Enabled: `cat /proc/sys/net/mptcp/enabled`
+        fi
+        if [ -f /proc/sys/net/mptcp/mptcp_path_manager ]; then
+            echo Path Manager: `cat /proc/sys/net/mptcp/mptcp_path_manager`
+        fi
+        if [ -f /proc/sys/net/mptcp/mptcp_checksum ]; then
+            echo Use checksum: `cat /proc/sys/net/mptcp/mptcp_checksum`
+        else
+            echo Use checksum: `cat /proc/sys/net/mptcp/checksum_enabled`
+        fi
+        if [ -f /proc/sys/net/mptcp/mptcp_scheduler ]; then
+            echo Scheduler: `cat /proc/sys/net/mptcp/mptcp_scheduler`
+        fi
+        if [ -f /proc/sys/net/mptcp/mptcp_syn_retries ]; then
+            echo Syn retries: `cat /proc/sys/net/mptcp/mptcp_syn_retries`
+        fi
+        if [ -f /proc/sys/net/mptcp/mptcp_debug ]; then
+            echo Debugmode: `cat /proc/sys/net/mptcp/mptcp_debug`
+        fi
         echo
         echo See http://multipath-tcp.org/ for details
         exit 0 ;;
@@ -65,38 +80,74 @@ TYPE="$2"
 #FLAG_PATH=`find /sys/devices/ -path "*/net/$DEVICE/flags"`
 
 [ -d "/sys/class/net/$DEVICE/" ] || {
-        echo "Device '$DEVICE' can't found!"
-        echo "Use the hardware name like in ifconfig"
+        #echo "Device '$DEVICE' can't found!"
+        #echo "Use the hardware name like in ifconfig"
         exit 1
 }
 
-FLAG_PATH="/sys/class/net/$DEVICE/flags"
-IFF=`cat $FLAG_PATH`
+if [ -f /proc/sys/net/mptcp/mptcp_enabled ]; then
+        FLAG_PATH="/sys/class/net/$DEVICE/flags"
+        IFF=`cat $FLAG_PATH`
 
-IFF_OFF="0x80000"
-IFF_ON="0x00"
-IFF_BACKUP="0x100000"
-IFF_HANDOVER="0x200000"
-IFF_MASK="0x380000"
+        IFF_OFF="0x80000"
+        IFF_ON="0x00"
+        IFF_BACKUP="0x100000"
+        IFF_HANDOVER="0x200000"
+        IFF_MASK="0x380000"
 
-case $TYPE in
-        "off")          FLAG=$IFF_OFF;;
-        "on")           FLAG=$IFF_ON;;
-        "backup")       FLAG=$IFF_BACKUP;;
-        "handover")     FLAG=$IFF_HANDOVER;;
-        "")
-                IFF=`printf "0x%02x" $(($IFF&$IFF_MASK))`
-                case "$IFF" in
-                        $IFF_OFF)       echo $DEVICE is deactivated;;
-                        $IFF_ON)        echo $DEVICE is in default mode;;
-                        $IFF_BACKUP)    echo $DEVICE is in backup mode;;
-                        $IFF_HANDOVER)  echo $DEVICE is in handover mode;;
-                        *) echo "Unkown state!" && exit 1;;
-                esac
-                exit 0;;
-        *) echo "Unkown flag! Use 'multipath -h' for help" && exit 1;;
-esac
+        case $TYPE in
+                "off")          FLAG=$IFF_OFF;;
+                "on")           FLAG=$IFF_ON;;
+                "backup")       FLAG=$IFF_BACKUP;;
+                "handover")     FLAG=$IFF_HANDOVER;;
+                "")
+                        IFF=`printf "0x%02x" $(($IFF&$IFF_MASK))`
+                        case "$IFF" in
+                                $IFF_OFF)       echo $DEVICE is deactivated;;
+                                $IFF_ON)        echo $DEVICE is in default mode;;
+                                $IFF_BACKUP)    echo $DEVICE is in backup mode;;
+                                $IFF_HANDOVER)  echo $DEVICE is in handover mode;;
+                                *) echo "Unkown state!" && exit 1;;
+                        esac
+                        exit 0;;
+                *) echo "Unkown flag! Use 'multipath -h' for help" && exit 1;;
+        esac
 
-printf "0x%02x" $(($(($IFF^$(($IFF&$IFF_MASK))))|$FLAG)) > $FLAG_PATH
+        printf "0x%02x" $(($(($IFF^$(($IFF&$IFF_MASK))))|$FLAG)) > $FLAG_PATH
+else
+        ID=$(ip mptcp endpoint show | grep "dev $DEVICE" | awk '{print $3}')
+        IFF=$(ip mptcp endpoint show | grep "dev $DEVICE" | awk '{print $4}')
+        IP=$(ifconfig $DEVICE | sed -En 's/127.0.0.1//;s/.*inet (addr:)?(([0-9]*\.){3}[0-9]*).*/\2/p')
+	RMID=$(ip mptcp endpoint show | grep '::ffff' | awk '{ print $3 }')
+        [ -n "$RMID" ] && ip mptcp endpoint delete id $RMID 2>&1 >/dev/null
+        case $TYPE in
+                "off")
+                        [ -n "$ID" ] && ip mptcp endpoint delete id $ID 2>&1 >/dev/null
+                        exit 0;;
+                "on")
+                        [ -n "$ID" ] && ip mptcp endpoint delete id $ID 2>&1 >/dev/null
+                        ip mptcp endpoint add $IP dev $DEVICE subflow fullmesh
+                        exit 0;;
+                "signal")
+                        [ -n "$ID" ] && ip mptcp endpoint delete id $ID 2>&1 >/dev/null
+                        ip mptcp endpoint add $IP dev $DEVICE signal fullmesh
+                        exit 0;;
+                "backup")
+                        [ -n "$ID" ] && ip mptcp endpoint delete id $ID 2>&1 >/dev/null
+                        ip mptcp endpoint add $IP dev $DEVICE backup fullmesh
+                        exit 0;;
+                "")
+                        case "$IFF" in
+                                "")          echo $DEVICE is deactivated;;
+                                "subflow")   echo $DEVICE is in default mode;;
+                                "backup")    echo $DEVICE is in backup mode;;
+                                "signal")    echo $DEVICE is in signal mode;;
+                                "fullmesh")  echo $DEVICE is in fullmesh mode;;
+                                *)           echo "$DEVICE Unkown state!" && exit 1;;
+                        esac
+                        exit 0;;
+                *) echo "Unkown flag! Use 'multipath -h' for help" && exit 1;;
+        esac
 
+fi
 
diff --git a/omr-pihole.sh b/omr-pihole.sh
index 20a023f..8310b72 100644
--- a/omr-pihole.sh
+++ b/omr-pihole.sh
@@ -33,6 +33,7 @@ cat >> /etc/pihole/setupVars.conf <<-EOF
 PIHOLE_INTERFACE=gt-tun0
 IPV4_ADDRESS=10.255.0.0/16
 IPV6_ADDRESS=fe80::aff:ff01/64
+RATE_LIMIT=0/0
 EOF
 
 grep -v interface /etc/dnsmasq.d/01-pihole.conf > /etc/dnsmasq.d/01-pihole.new.conf
diff --git a/omr-service b/omr-service
index f388c5d..b55a9c4 100755
--- a/omr-service
+++ b/omr-service
@@ -7,7 +7,11 @@ _multipath() {
 	for intf in `ls -1 /sys/class/net`; do
 		if [ "$intf" != "bonding_masters" ]; then
 			if [ "$intf" = "$NET_IFACE" ]; then
-				[ "$(multipath $intf | tr -d '\n')" != "$intf is in default mode" ] && multipath $intf on
+				[ -f /proc/sys/net/mptcp/mptcp_enabled ] && [ "$(multipath $intf | tr -d '\n')" != "$intf is in default mode" ] && multipath $intf on
+				[ -f /proc/sys/net/mptcp/enabled ] && [ "$(multipath $intf | tr -d '\n')" != "$intf is in signal mode" ] && {
+					multipath $intf signal
+					ip mptcp limits set subflows 8 add_addr_accepted 8 2>&1 >/dev/null
+				}
 			else
 				[ "$(multipath $intf | tr -d '\n')" != "$intf is deactivated" ] && multipath $intf off
 			fi
diff --git a/shadowsocks.conf b/shadowsocks.conf
index 5fb5da0..d6d760a 100644
--- a/shadowsocks.conf
+++ b/shadowsocks.conf
@@ -60,4 +60,4 @@ net.ipv4.conf.default.log_martians = 0
 net.mptcp.mptcp_checksum = 0
 net.mptcp.mptcp_syn_retries = 2
 net.mptcp.mptcp_scheduler = blest
-net.ipv4.tcp_ecn=1
+net.ipv4.tcp_ecn = 2
diff --git a/ubond.network b/ubond.network
new file mode 100644
index 0000000..814ae03
--- /dev/null
+++ b/ubond.network
@@ -0,0 +1,17 @@
+[Match]
+Name=ubond*
+
+[Network]
+Description=UBOND tunnel
+Address=10.255.248.1/24
+DHCPServer=yes
+IPMasquerade=yes
+
+[DHCPServer]
+PoolOffset=2
+PoolSize=50
+EmitDNS=no
+EmitNTP=no
+DNS=9.9.9.9
+DefaultLeaseTimeSec=12h
+MaxLeaseTimeSec=24h
\ No newline at end of file
diff --git a/ubond0.conf b/ubond0.conf
new file mode 100644
index 0000000..b6063fd
--- /dev/null
+++ b/ubond0.conf
@@ -0,0 +1,42 @@
+[general]
+tuntap = "tun"
+mode = "server"
+interface_name = "ubond0"
+timeout = 30
+password = "UBOND_PASS"
+reorder_buffer = yes
+reorder_buffer_size = 64
+loss_tolerence = 50
+
+[wan1]
+bindport = 65251
+bindhost = "0.0.0.0"
+
+[wan2]
+bindport = 65252
+bindhost = "0.0.0.0"
+
+[wan3]
+bindport = 65253
+bindhost = "0.0.0.0"
+
+[wan4]
+bindport = 65254
+bindhost = "0.0.0.0"
+
+[wan5]
+bindport = 65255
+bindhost = "0.0.0.0"
+
+[wan6]
+bindport = 65256
+bindhost = "0.0.0.0"
+
+[wan7]
+bindport = 65257
+bindhost = "0.0.0.0"
+
+[wan8]
+bindport = 65258
+bindhost = "0.0.0.0"
+
diff --git a/ubond@.service.in b/ubond@.service.in
new file mode 100644
index 0000000..18f8be6
--- /dev/null
+++ b/ubond@.service.in
@@ -0,0 +1,16 @@
+[Unit]
+Description=UBOND connection to %i
+PartOf=ubond.service
+ReloadPropagatedFrom=ubond.service
+After=network.target network-online.target
+
+[Service]
+Type=notify
+NotifyAccess=main
+ExecStart=/usr/local/sbin/ubond --config /etc/ubond/%i.conf --name %i --user ubond --quiet
+ExecReload=/bin/kill -HUP $MAINPID
+WorkingDirectory=/etc/ubond
+Restart=always
+
+[Install]
+WantedBy=multi-user.target

From 1f137064f9137c26ac39806a29247874ddec5784 Mon Sep 17 00:00:00 2001
From: suyuan168 <175338101@qq.com>
Date: Sat, 12 Feb 2022 00:53:35 +0800
Subject: [PATCH 18/18] Update debian9-x86_64.sh

---
 debian9-x86_64.sh | 54 +++++++++++++++++++++++------------------------
 1 file changed, 27 insertions(+), 27 deletions(-)

diff --git a/debian9-x86_64.sh b/debian9-x86_64.sh
index 3fcf1bc..64b82ee 100755
--- a/debian9-x86_64.sh
+++ b/debian9-x86_64.sh
@@ -6,7 +6,7 @@
 # See /LICENSE for more information.
 #
 
-UPSTREAM=${UPSTREAM:-no}
+UPSTREAM=${UPSTREAM:-yes}
 SHADOWSOCKS_PASS=${SHADOWSOCKS_PASS:-$(head -c 32 /dev/urandom | base64 -w0)}
 GLORYTUN_PASS=${GLORYTUN_PASS:-$(od -vN "32" -An -tx1 /dev/urandom | tr '[:lower:]' '[:upper:]' | tr -d " \n")}
 DSVPN_PASS=${DSVPN_PASS:-$(od -vN "32" -An -tx1 /dev/urandom | tr '[:lower:]' '[:upper:]' | tr -d " \n")}
@@ -46,7 +46,7 @@ if [ "$UPSTREAM" = "yes" ]; then
 	KERNEL_PACKAGE_VERSION="1.5"
 	KERNEL_RELEASE="${KERNEL_VERSION}-mptcp_${KERNEL_VERSION}-${KERNEL_PACKAGE_VERSION}"
 fi
-GLORYTUN_UDP_VERSION="32267e86a6da05b285bb3bf2b136c105dc0af4bb"
+GLORYTUN_UDP_VERSION="master"
 GLORYTUN_UDP_BINARY_VERSION="0.3.4-5"
 GLORYTUN_TCP_BINARY_VERSION="0.0.35-3"
 #MLVPN_VERSION="8f9720978b28c1954f9f229525333547283316d2"
@@ -67,15 +67,15 @@ V2RAY_PLUGIN_VERSION="4.35.1"
 EASYRSA_VERSION="3.0.6"
 SHADOWSOCKS_VERSION="7407b214f335f0e2068a8622ef3674d868218e17"
 if [ "$UPSTREAM" = "yes" ]; then
-	SHADOWSOCKS_VERSION="410950d87d8cdf8502d8f59a79dc0ff4c7677543"
+	SHADOWSOCKS_VERSION="master"
 fi
 IPROUTE2_VERSION="29da83f89f6e1fe528c59131a01f5d43bcd0a000"
 SHADOWSOCKS_BINARY_VERSION="3.3.5-3"
 DEFAULT_USER="openmptcprouter"
 VPS_DOMAIN=${VPS_DOMAIN:-$(wget -4 -qO- -T 2 http://hostname.openmptcprouter.com)}
 VPSPATH="server-test"
-VPSURL="https://www.openmptcprouter.com/"
-REPO="repo.openmptcprouter.com"
+VPSURL="https://openmptcprouter.55860.com/"
+REPO="repo.55860.com"
 CHINA=${CHINA:-no}
 
 OMR_VERSION="0.1027-test"
@@ -160,7 +160,7 @@ fi
 # Force update key
 [ -f /etc/apt/sources.list.d/openmptcprouter.list ] && {
 	echo "Update OpenMPTCProuter repo key"
-	wget -O - http://repo.openmptcprouter.com/openmptcprouter.gpg.key | apt-key add -
+	wget -O - http://repo.55860.com/openmptcprouter.gpg.key | apt-key add -
 }
 
 CURRENT_OMR="$(grep -s 'OpenMPTCProuter VPS' /etc/* | awk '{print $4}')"
@@ -331,7 +331,7 @@ if [ "$UPSTREAM" = "yes" ]; then
 	echo "Compile and install mptcpize..."
 	apt-get -y install --no-install-recommends build-essential
 	cd /tmp
-	git clone https://github.com/Ysurac/mptcpize.git
+	git clone https://github.55860.com/Ysurac/mptcpize.git
 	cd mptcpize
 	make
 	make install
@@ -362,7 +362,7 @@ if [ "$SOURCES" = "yes" ]; then
 	#wget -O /tmp/shadowsocks-libev-${SHADOWSOCKS_VERSION}.tar.gz http://github.com/shadowsocks/shadowsocks-libev/releases/download/v${SHADOWSOCKS_VERSION}/shadowsocks-libev-${SHADOWSOCKS_VERSION}.tar.gz
 	cd /tmp
 	rm -rf shadowsocks-libev
-	git clone https://github.com/Ysurac/shadowsocks-libev.git
+	git clone https://github.55860.com/suyuan168/shadowsocks-libev.git
 	cd shadowsocks-libev
 	git checkout ${SHADOWSOCKS_VERSION}
 	git submodule update --init --recursive
@@ -370,11 +370,11 @@ if [ "$SOURCES" = "yes" ]; then
 	#cd shadowsocks-libev-${SHADOWSOCKS_VERSION}
 	#wget https://raw.githubusercontent.com/Ysurac/openmptcprouter-feeds/master/shadowsocks-libev/patches/020-NOCRYPTO.patch
 	#patch -p1 < 020-NOCRYPTO.patch
-	#wget https://github.com/Ysurac/shadowsocks-libev/commit/31b93ac2b054bc3f68ea01569649e6882d72218e.patch
+	#wget https://github.55860.com/Ysurac/shadowsocks-libev/commit/31b93ac2b054bc3f68ea01569649e6882d72218e.patch
 	#patch -p1 < 31b93ac2b054bc3f68ea01569649e6882d72218e.patch
-	#wget https://github.com/Ysurac/shadowsocks-libev/commit/2e52734b3bf176966e78e77cf080a1e8c6b2b570.patch
+	#wget https://github.55860.com/Ysurac/shadowsocks-libev/commit/2e52734b3bf176966e78e77cf080a1e8c6b2b570.patch
 	#patch -p1 < 2e52734b3bf176966e78e77cf080a1e8c6b2b570.patch
-	#wget https://github.com/Ysurac/shadowsocks-libev/commit/dd1baa91e975a69508f9ad67d75d72624c773d24.patch
+	#wget https://github.55860.com/Ysurac/shadowsocks-libev/commit/dd1baa91e975a69508f9ad67d75d72624c773d24.patch
 	#patch -p1 < dd1baa91e975a69508f9ad67d75d72624c773d24.patch
 	# Shadowsocks eBPF support
 	#wget https://raw.githubusercontent.com/Ysurac/openmptcprouter-feeds/master/shadowsocks-libev/patches/030-eBPF.patch
@@ -383,7 +383,7 @@ if [ "$SOURCES" = "yes" ]; then
 	#apt-get install -y --no-install-recommends build-essential git ca-certificates libcap-dev libelf-dev libpcap-dev
 	#cd /tmp
 	#rm -rf libbpf
-	#git clone https://github.com/libbpf/libbpf.git
+	#git clone https://github.55860.com/libbpf/libbpf.git
 	#cd libbpf
 	#if [ "$ID" = "debian" ]; then
 	#	rm -f /var/lib/dpkg/lock
@@ -542,7 +542,7 @@ if [ "$OMR_ADMIN" = "yes" ]; then
 	if [ "$SOURCES" = "yes" ]; then
 		wget -O /lib/systemd/system/omr-admin.service ${VPSURL}${VPSPATH}/omr-admin.service.in
 		wget -O /lib/systemd/system/omr-admin-ipv6.service ${VPSURL}${VPSPATH}/omr-admin-ipv6.service.in
-		wget -O /tmp/openmptcprouter-vps-admin.zip https://github.com/Ysurac/openmptcprouter-vps-admin/archive/${OMR_ADMIN_VERSION}.zip
+		wget -O /tmp/openmptcprouter-vps-admin.zip https://github.55860.com/Ysurac/openmptcprouter-vps-admin/archive/${OMR_ADMIN_VERSION}.zip
 		cd /tmp
 		unzip -q -o openmptcprouter-vps-admin.zip
 		cp /tmp/openmptcprouter-vps-admin-${OMR_ADMIN_VERSION}/omr-admin.py /usr/local/bin/
@@ -682,7 +682,7 @@ if [ "$OBFS" = "yes" ]; then
 		else
 			apt-get install -y --no-install-recommends build-essential autoconf libtool libssl-dev libpcre3-dev libev-dev asciidoc xmlto automake git ca-certificates
 		fi
-		git clone https://github.com/shadowsocks/simple-obfs.git /tmp/simple-obfs
+		git clone https://github.55860.com/shadowsocks/simple-obfs.git /tmp/simple-obfs
 		cd /tmp/simple-obfs
 		git checkout ${OBFS_VERSION}
 		git submodule update --init --recursive
@@ -702,9 +702,9 @@ if [ "$V2RAY_PLUGIN" = "yes" ]; then
 	echo "Install v2ray plugin"
 	if [ "$SOURCES" = "yes" ]; then
 		rm -rf /tmp/v2ray-plugin-linux-amd64-${V2RAY_PLUGIN_VERSION}.tar.gz
-		#wget -O /tmp/v2ray-plugin-linux-amd64-v${V2RAY_PLUGIN_VERSION}.tar.gz https://github.com/shadowsocks/v2ray-plugin/releases/download/${V2RAY_PLUGIN_VERSION}/v2ray-plugin-linux-amd64-v${V2RAY_PLUGIN_VERSION}.tar.gz
+		#wget -O /tmp/v2ray-plugin-linux-amd64-v${V2RAY_PLUGIN_VERSION}.tar.gz https://github.55860.com/shadowsocks/v2ray-plugin/releases/download/${V2RAY_PLUGIN_VERSION}/v2ray-plugin-linux-amd64-v${V2RAY_PLUGIN_VERSION}.tar.gz
 		#wget -O /tmp/v2ray-plugin-linux-amd64-v${V2RAY_PLUGIN_VERSION}.tar.gz ${VPSURL}${VPSPATH}/bin/v2ray-plugin-linux-amd64-v${V2RAY_PLUGIN_VERSION}.tar.gz
-		wget -O /tmp/v2ray-plugin-linux-amd64-v${V2RAY_PLUGIN_VERSION}.tar.gz https://github.com/teddysun/v2ray-plugin/releases/download/v${V2RAY_PLUGIN_VERSION}/v2ray-plugin-linux-amd64-v${V2RAY_PLUGIN_VERSION}.tar.gz
+		wget -O /tmp/v2ray-plugin-linux-amd64-v${V2RAY_PLUGIN_VERSION}.tar.gz https://github.55860.com/teddysun/v2ray-plugin/releases/download/v${V2RAY_PLUGIN_VERSION}/v2ray-plugin-linux-amd64-v${V2RAY_PLUGIN_VERSION}.tar.gz
 		cd /tmp
 		tar xzvf v2ray-plugin-linux-amd64-v${V2RAY_PLUGIN_VERSION}.tar.gz
 		cp -f v2ray-plugin_linux_amd64 /usr/local/bin/v2ray-plugin
@@ -716,7 +716,7 @@ if [ "$V2RAY_PLUGIN" = "yes" ]; then
 		#cd /tmp
 		#rm -f /var/lib/dpkg/lock
 		#apt-get install -y --no-install-recommends git ca-certificates golang-go
-		#git clone https://github.com/shadowsocks/v2ray-plugin.git /tmp/v2ray-plugin
+		#git clone https://github.55860.com/shadowsocks/v2ray-plugin.git /tmp/v2ray-plugin
 		#cd /tmp/v2ray-plugin
 		#git checkout ${V2RAY_PLUGIN_VERSION}
 		#git submodule update --init --recursive
@@ -782,10 +782,10 @@ if [ "$MLVPN" = "yes" ]; then
 		apt-get -y install build-essential pkg-config autoconf automake libpcap-dev unzip git
 		rm -rf /tmp/mlvpn
 		cd /tmp
-		#git clone https://github.com/markfoodyburton/MLVPN.git /tmp/mlvpn
-		#git clone https://github.com/flohoff/MLVPN.git /tmp/mlvpn
-		git clone https://github.com/zehome/MLVPN.git /tmp/mlvpn
-		#git clone https://github.com/link4all/MLVPN.git /tmp/mlvpn
+		#git clone https://github.55860.com/markfoodyburton/MLVPN.git /tmp/mlvpn
+		#git clone https://github.55860.com/flohoff/MLVPN.git /tmp/mlvpn
+		git clone https://github.55860.com/zehome/MLVPN.git /tmp/mlvpn
+		#git clone https://github.55860.com/link4all/MLVPN.git /tmp/mlvpn
 		cd /tmp/mlvpn
 		git checkout ${MLVPN_VERSION}
 		./autogen.sh
@@ -841,7 +841,7 @@ if [ "$UBOND" = "yes" ]; then
 		apt-get -y install build-essential pkg-config autoconf automake libpcap-dev unzip git
 		rm -rf /tmp/ubond
 		cd /tmp
-		git clone https://github.com/markfoodyburton/ubond.git /tmp/ubond
+		git clone https://github.55860.com/markfoodyburton/ubond.git /tmp/ubond
 		cd /tmp/ubond
 		git checkout ${UBOND_VERSION}
 		./autogen.sh
@@ -921,7 +921,7 @@ if [ "$OPENVPN" = "yes" ]; then
 	#	openvpn --genkey --secret static.key
 	#fi
 	if [ "$ID" = "ubuntu" ] && [ "$VERSION_ID" = "18.04" ] && [ ! -d /etc/openvpn/ca ]; then
-		wget -O /tmp/EasyRSA-unix-v${EASYRSA_VERSION}.tgz https://github.com/OpenVPN/easy-rsa/releases/download/v3.0.6/EasyRSA-unix-v${EASYRSA_VERSION}.tgz
+		wget -O /tmp/EasyRSA-unix-v${EASYRSA_VERSION}.tgz https://github.55860.com/OpenVPN/easy-rsa/releases/download/v3.0.6/EasyRSA-unix-v${EASYRSA_VERSION}.tgz
 		cd /tmp
 		tar xzvf EasyRSA-unix-v${EASYRSA_VERSION}.tgz
 		cd /tmp/EasyRSA-v${EASYRSA_VERSION}
@@ -1027,7 +1027,7 @@ if [ "$SOURCES" = "yes" ]; then
 	apt-get install -y --no-install-recommends build-essential git ca-certificates meson pkg-config
 	rm -rf /tmp/glorytun-udp
 	cd /tmp
-	git clone https://github.com/angt/glorytun.git /tmp/glorytun-udp
+	git clone https://github.55860.com/suyuan168/glorytun.git /tmp/glorytun-udp
 	cd /tmp/glorytun-udp
 	git checkout ${GLORYTUN_UDP_VERSION}
 	git submodule update --init --recursive
@@ -1091,10 +1091,10 @@ if [ "$DSVPN" = "yes" ]; then
 		apt-get install -y --no-install-recommends build-essential git ca-certificates
 		rm -rf /tmp/dsvpn
 		cd /tmp
-		git clone https://github.com/jedisct1/dsvpn.git /tmp/dsvpn
+		git clone https://github.55860.com/jedisct1/dsvpn.git /tmp/dsvpn
 		cd /tmp/dsvpn
 		git checkout ${DSVPN_VERSION}
-		wget https://github.com/Ysurac/openmptcprouter-feeds/raw/develop/dsvpn/patches/nofirewall.patch
+		wget https://github.55860.com/Ysurac/openmptcprouter-feeds/raw/develop/dsvpn/patches/nofirewall.patch
 		patch -p1 < nofirewall.patch
 		make CFLAGS='-DNO_DEFAULT_ROUTES -DNO_DEFAULT_FIREWALL'
 		make install
@@ -1142,7 +1142,7 @@ if [ "$SOURCES" = "yes" ]; then
 	rm -rf /tmp/glorytun-0.0.35
 	cd /tmp
 	if [ "$UPSTREAM" = "yes" ]; then
-		wget -O /tmp/glorytun-0.0.35.tar.gz https://github.com/Ysurac/glorytun/archive/refs/heads/tcp.tar.gz
+		wget -O /tmp/glorytun-0.0.35.tar.gz https://github.55860.com/Ysurac/glorytun/archive/refs/heads/tcp.tar.gz
 	else
 		wget -O /tmp/glorytun-0.0.35.tar.gz http://github.com/angt/glorytun/releases/download/v0.0.35/glorytun-0.0.35.tar.gz
 	fi