🌴 Sync 2026-03-05 23:51:42

luci-app-ipv6clientfilter/Makefile

@@ -0,0 +1,15 @@
+include $(TOPDIR)/rules.mk
+
+PKG_NAME:=luci-app-ipv6clientfilter
+PKG_VERSION:=1.2.1
+PKG_DATE:=20231112
+PKG_RELEASE:=1
+
+PKG_MAINTAINER:=nlf
+
+LUCI_TITLE:=ipv6 clients access control
+LUCI_PKGARCH:=all
+
+include $(TOPDIR)/feeds/luci/luci.mk
+
+# call BuildPackage - OpenWrt buildroot signature

luci-app-ipv6clientfilter/README.md

@@ -0,0 +1,3 @@
+# luci-app-ipv6clientfilter
+只支持js版本的luci，需要openwrt > 19，iptables/nftables都行
+![image](https://github.com/a904055262/luci-app-ipv6clientfilter/blob/main/pic.jpg?raw=true)

luci-app-ipv6clientfilter/htdocs/luci-static/resources/view/ipv6clientfilter/ipv6clientfilter.js

@@ -0,0 +1,46 @@
+'use strict';
+'require view';
+'require form';
+return view.extend({
+    render: function () {
+        var m,
+        s,
+        o;
+        m = new form.Map('ipv6clientfilter', _('ipv6 client filter'), _('Allow or deny specific clients from accessing ipv6 networks'));
+		
+        s = m.section(form.NamedSection, 'prefs', 'ipv6clientfilter', _('basic settings'));
+		
+        o = s.option(form.Flag, 'enabled', _('enable'));
+		o.rmempty = false;
+        o.default = '0';
+
+        o = s.option(form.ListValue, 'mode', _('mode'), _('blacklist: block clients in the list; whitelist: only allow clients in the list are allowed'));
+        o.value('blacklist', _('blacklist'));
+        o.value('whitelist', _('whitelist'));
+        o.rmempty = false;
+		
+        s = m.section(form.TableSection, 'client', _('clients'), _('please add some clients'));
+        s.anonymous = true;
+        s.addremove = true;
+		
+        o = s.option(form.Flag, 'enabled', _('enable'));
+		o.rmempty = false;
+		o.width = 50;
+        o.default = '1';
+
+		o = s.option(form.Value, 'mac', _('mac'));
+		o.rmempty = false;
+		o.width = 200;
+		o.validate = function (cfg, value) {
+			if ( ! /^([0-9A-Fa-f]{2}:){5}([0-9A-Fa-f]{2})$/.test(value)){
+				return _('format') + ' xx:xx:xx:xx:xx:xx';
+			}
+			return true;
+		};
+        
+		o = s.option(form.Value, 'comments', _('comments'));
+        o.rmempty = false;
+		
+        return m.render();
+    },
+});

luci-app-ipv6clientfilter/po/templates/ipv6clientfilter.pot

@@ -0,0 +1,58 @@
+msgid ""
+msgstr "Content-Type: text/plain; charset=UTF-8"
+
+#: package/nlf/luci-app-ipv6clientfilter/htdocs/luci-static/resources/view/ipv6clientfilter/ipv6clientfilter.js:9
+msgid "Allow or deny specific clients from accessing ipv6 networks"
+msgstr ""
+
+#: package/nlf/luci-app-ipv6clientfilter/htdocs/luci-static/resources/view/ipv6clientfilter/ipv6clientfilter.js:11
+msgid "basic settings"
+msgstr ""
+
+#: package/nlf/luci-app-ipv6clientfilter/htdocs/luci-static/resources/view/ipv6clientfilter/ipv6clientfilter.js:18
+msgid "blacklist"
+msgstr ""
+
+#: package/nlf/luci-app-ipv6clientfilter/htdocs/luci-static/resources/view/ipv6clientfilter/ipv6clientfilter.js:17
+msgid ""
+"blacklist: block clients in the list; whitelist: only allow clients in the "
+"list are allowed"
+msgstr ""
+
+#: package/nlf/luci-app-ipv6clientfilter/htdocs/luci-static/resources/view/ipv6clientfilter/ipv6clientfilter.js:22
+msgid "clients"
+msgstr ""
+
+#: package/nlf/luci-app-ipv6clientfilter/htdocs/luci-static/resources/view/ipv6clientfilter/ipv6clientfilter.js:41
+msgid "comments"
+msgstr ""
+
+#: package/nlf/luci-app-ipv6clientfilter/htdocs/luci-static/resources/view/ipv6clientfilter/ipv6clientfilter.js:13
+#: package/nlf/luci-app-ipv6clientfilter/htdocs/luci-static/resources/view/ipv6clientfilter/ipv6clientfilter.js:26
+msgid "enable"
+msgstr ""
+
+#: package/nlf/luci-app-ipv6clientfilter/htdocs/luci-static/resources/view/ipv6clientfilter/ipv6clientfilter.js:36
+msgid "format"
+msgstr ""
+
+#: package/nlf/luci-app-ipv6clientfilter/htdocs/luci-static/resources/view/ipv6clientfilter/ipv6clientfilter.js:9
+#: package/nlf/luci-app-ipv6clientfilter/root/usr/share/luci/menu.d/luci-app-ipv6clientfilter.json:3
+msgid "ipv6 client filter"
+msgstr ""
+
+#: package/nlf/luci-app-ipv6clientfilter/htdocs/luci-static/resources/view/ipv6clientfilter/ipv6clientfilter.js:31
+msgid "mac"
+msgstr ""
+
+#: package/nlf/luci-app-ipv6clientfilter/htdocs/luci-static/resources/view/ipv6clientfilter/ipv6clientfilter.js:17
+msgid "mode"
+msgstr ""
+
+#: package/nlf/luci-app-ipv6clientfilter/htdocs/luci-static/resources/view/ipv6clientfilter/ipv6clientfilter.js:22
+msgid "please add some clients"
+msgstr ""
+
+#: package/nlf/luci-app-ipv6clientfilter/htdocs/luci-static/resources/view/ipv6clientfilter/ipv6clientfilter.js:19
+msgid "whitelist"
+msgstr ""

luci-app-ipv6clientfilter/po/zh-cn

@@ -0,0 +1 @@
+zh_Hans

luci-app-ipv6clientfilter/po/zh_Hans/ipv6clientfilter.po

@@ -0,0 +1,58 @@
+msgid ""
+msgstr "Content-Type: text/plain; charset=UTF-8\n"
+
+#: package/nlf/luci-app-ipv6clientfilter/htdocs/luci-static/resources/view/ipv6clientfilter/ipv6clientfilter.js:9
+msgid "Allow or deny specific clients from accessing ipv6 networks"
+msgstr "仅允许或阻止特定客户端获访问ipv6网络"
+
+#: package/nlf/luci-app-ipv6clientfilter/htdocs/luci-static/resources/view/ipv6clientfilter/ipv6clientfilter.js:11
+msgid "basic settings"
+msgstr "基本设置"
+
+#: package/nlf/luci-app-ipv6clientfilter/htdocs/luci-static/resources/view/ipv6clientfilter/ipv6clientfilter.js:18
+msgid "blacklist"
+msgstr "黑名单"
+
+#: package/nlf/luci-app-ipv6clientfilter/htdocs/luci-static/resources/view/ipv6clientfilter/ipv6clientfilter.js:17
+msgid ""
+"blacklist: block clients in the list; whitelist: only allow clients in the "
+"list are allowed"
+msgstr "黑名单: 阻止列表客户端; 白名单: 仅允许列表客户端"
+
+#: package/nlf/luci-app-ipv6clientfilter/htdocs/luci-static/resources/view/ipv6clientfilter/ipv6clientfilter.js:22
+msgid "clients"
+msgstr "客户端"
+
+#: package/nlf/luci-app-ipv6clientfilter/htdocs/luci-static/resources/view/ipv6clientfilter/ipv6clientfilter.js:41
+msgid "comments"
+msgstr "注释"
+
+#: package/nlf/luci-app-ipv6clientfilter/htdocs/luci-static/resources/view/ipv6clientfilter/ipv6clientfilter.js:13
+#: package/nlf/luci-app-ipv6clientfilter/htdocs/luci-static/resources/view/ipv6clientfilter/ipv6clientfilter.js:26
+msgid "enable"
+msgstr "启用"
+
+#: package/nlf/luci-app-ipv6clientfilter/htdocs/luci-static/resources/view/ipv6clientfilter/ipv6clientfilter.js:36
+msgid "format"
+msgstr "格式"
+
+#: package/nlf/luci-app-ipv6clientfilter/htdocs/luci-static/resources/view/ipv6clientfilter/ipv6clientfilter.js:9
+#: package/nlf/luci-app-ipv6clientfilter/root/usr/share/luci/menu.d/luci-app-ipv6clientfilter.json:3
+msgid "ipv6 client filter"
+msgstr "ipv6客户端过滤"
+
+#: package/nlf/luci-app-ipv6clientfilter/htdocs/luci-static/resources/view/ipv6clientfilter/ipv6clientfilter.js:31
+msgid "mac"
+msgstr "mac"
+
+#: package/nlf/luci-app-ipv6clientfilter/htdocs/luci-static/resources/view/ipv6clientfilter/ipv6clientfilter.js:17
+msgid "mode"
+msgstr "模式"
+
+#: package/nlf/luci-app-ipv6clientfilter/htdocs/luci-static/resources/view/ipv6clientfilter/ipv6clientfilter.js:22
+msgid "please add some clients"
+msgstr "请添加客户端"
+
+#: package/nlf/luci-app-ipv6clientfilter/htdocs/luci-static/resources/view/ipv6clientfilter/ipv6clientfilter.js:19
+msgid "whitelist"
+msgstr "白名单"

luci-app-ipv6clientfilter/root/etc/config/ipv6clientfilter.default

@@ -0,0 +1,5 @@
+
+config ipv6clientfilter 'prefs'
+    option enabled '0'
+    option mode 'blacklist'
+

luci-app-ipv6clientfilter/root/etc/init.d/ipv6clientfilter

@@ -0,0 +1,163 @@
+#!/bin/sh /etc/rc.common
+
+USE_PROCD=1
+
+# firewall 之后启动
+START=20
+ 
+##########
+name="ipv6 client filter"
+conf=ipv6clientfilter
+
+# nft 
+usenft=false
+nft -v >/dev/null 2>&1 && usenft=true
+
+iptrule(){
+	ipset create $conf hash:mac
+	local mac
+	for mac in $macs;do
+		ipset add $conf $mac
+	done
+
+	local ip6shf=/tmp/.$conf
+
+	local sign='!'
+	if [ "$mode" = 'blacklist' ];then
+		sign=
+	fi
+	
+	cat << EOF > "$ip6shf"
+ip6tables -t raw -I PREROUTING -m set $sign --match-set $conf src -j DROP
+EOF
+
+	chmod +x "$ip6shf"
+	sh "$ip6shf"
+	
+	# 防火墙重载绑定
+	uci -q batch << EOF
+		set firewall.$conf=include
+		set firewall.$conf.reload=1
+		set firewall.$conf.type=script
+		set firewall.$conf.path="$ip6shf"
+		
+		commit firewall
+EOF
+
+}
+
+nftrule(){
+	nft add table ip6 $conf
+	nft add chain ip6 $conf raw_prer { type filter hook prerouting priority raw - 1 \;}
+
+	# 转成 mac, mac2, mac3 set格式
+	local macs_set=$(printf "%s, " $macs)
+	
+	local sign='!='
+	if [ "$mode" = 'blacklist' ];then
+		sign=
+	fi
+	
+	# pppoe-wan进来的数据包没有 ether saddr daddr，它会无视这条规则
+	nft add rule ip6 $conf raw_prer ether saddr $sign { $macs_set } counter drop comment \" 阻止特定mac的ipv6 \"
+}
+
+macs=
+getmacs(){
+	local cfgid=$1 enabled mac
+	
+	config_get_bool enabled $cfgid enabled
+	
+	[ "$enabled" = "1" ] || return 1
+
+	config_get mac $cfgid mac
+	
+	macs="$macs $mac"
+}
+
+
+mode=
+start_service(){
+	# 避免重复开启
+	local started=false
+	if $usenft;then
+		if nft list tables | grep -qF " $conf";then
+			started=true
+		fi
+	else
+		if ipset -n -q list $conf >/dev/null;then
+			started=true
+		fi
+	fi
+	
+	$started && {
+		echo 已经启动
+		return 1
+	}
+	
+	
+	# 是否启用？
+	local enabled
+	
+	config_load $conf
+	
+	config_get_bool enabled prefs enabled
+	
+	[ "$enabled" = "1" ] || {
+		echo "$name 已被禁用"
+		return 1
+	}
+	
+	echo "$name start"
+	config_get mode prefs mode
+	echo "模式: $mode"
+
+	echo 开始获取mac地址
+	config_foreach getmacs client
+	echo "macs:'$macs'"
+	[ "$macs" ] || {
+		echo 没有设置任何客户端mac,无需启动
+		return 3
+	}
+	
+	if $usenft;then
+		echo 生成nftables规则
+		nftrule
+	else
+		echo 生成ip6tables规则
+		iptrule
+	fi
+	
+	echo ok
+	logger -t "$name" "start" "$mode" "$macs"
+}
+
+stop_service(){
+	{
+	if $usenft;then
+		nft delete table ip6 $conf 
+	else
+		# 删除从数字大的索引开始，否则删除小的，后面的索引会变，如果删除了1，索引2就会变成1
+		ip6tables --line-numbers -t raw -nL PREROUTING \
+			| grep -F " $conf " | awk '{print $1}' | sort -nr \
+			| xargs -t -n 1 -r ip6tables -t raw -D PREROUTING 
+		
+		ipset destroy $conf
+		
+		uci delete firewall.$conf
+		uci commit
+	fi
+	} >/dev/null 2>&1
+	
+	echo "$name stopped"
+	logger -t "$name" "stopped"
+}
+
+reload_service() {
+	restart
+}
+
+service_triggers(){
+	procd_add_reload_trigger "$conf"
+}
+

luci-app-ipv6clientfilter/root/etc/uci-defaults/80_ipv6clientfilter

@@ -0,0 +1,16 @@
+#!/bin/sh
+
+# 默认设置文件，更新的时候，不要覆盖它
+if [ ! -f /etc/config/ipv6clientfilter ];then
+	mv /etc/config/ipv6clientfilter.default /etc/config/ipv6clientfilter
+else
+	rm /etc/config/ipv6clientfilter.default 
+fi
+
+chmod +x /etc/init.d/ipv6clientfilter
+service ipv6clientfilter enable
+
+
+return 0
+
+

luci-app-ipv6clientfilter/root/usr/share/luci/menu.d/luci-app-ipv6clientfilter.json

@@ -0,0 +1,13 @@
+{
+	"admin/services/ipv6clientfilter/": {
+		"title": "ipv6 client filter",
+		"order": 99,
+		"action": {
+			"type": "view",
+			"path": "ipv6clientfilter/ipv6clientfilter"
+		},
+		"depends": {
+			
+		},
+	},
+}

luci-app-ipv6clientfilter/root/usr/share/rpcd/acl.d/luci-app-ipv6clientfilter.json

@@ -0,0 +1,11 @@
+{
+	"luci-app-ipv6clientfilter": {
+		"description": "Grant UCI access for luci-app-ipv6clientfilter",
+		"read": {
+			"uci": [ "ipv6clientfilter.default" ]
+		},
+		"write": {
+			"uci": [ "ipv6clientfilter.default" ]
+		}
+	}
+}

luci-app-ipv6clientfilter/testupdate.sh

@@ -0,0 +1,16 @@
+#!/bin/bash
+
+sdir=$(cd "$(dirname "${BASH_SOURCE[0]}")"; pwd)
+cd "$sdir"
+
+echo 更新web
+cp -vrf htdocs/luci-static/ /www/
+echo 更新acl和menu
+cp -vrf root/usr/ /
+echo 更新启动脚本
+cp -vrf root/etc/init.d/ /etc/
+
+echo 重启rpcd 
+service rpcd restart
+
+echo done