🌴 Sync 2026-03-05 23:51:42

luci-app-school/root/usr/share/rpcd/acl.d/luci-app-school.json

@@ -0,0 +1,11 @@
+{
+	"luci-app-school": {
+		"description": "Grant UCI access for luci-app-school",
+		"read": {
+			"uci": [ "school" ]
+		},
+		"write": {
+			"uci": [ "school" ]
+		}
+	}
+}

luci-app-school/root/usr/share/school/iac.rules

@@ -0,0 +1,8 @@
+#!/usr/sbin/nft -f
+
+table ip iac {
+    chain FORWARD {
+		type filter hook forward priority filter; policy accept;
+		meta l4proto tcp tcp sport 80 tcp flags & (ack) == ack # STRING match  " src=\"http://1.1.1." ALGO name bm TO 65535 counter packets 0 bytes 0 drop
+	}
+}

luci-app-school/root/usr/share/school/idns.rules

@@ -0,0 +1,9 @@
+#!/usr/sbin/nft -f
+
+table ip idns {
+    chain PREROUTING {
+		type nat hook prerouting priority dstnat; policy accept;
+		meta l4proto udp udp dport 53 counter packets 0 bytes 0 redirect to :53
+		meta l4proto tcp tcp dport 53 counter packets 0 bytes 0 redirect to :53
+	}
+}

luci-app-school/root/usr/share/school/intp.rules

@@ -0,0 +1,15 @@
+#!/usr/sbin/nft -f
+
+table ip intp {
+    chain PREROUTING {
+		type nat hook prerouting priority dstnat; policy accept;
+		meta l4proto udp udp dport 123 counter packets 0 bytes 0 jump ntp_force_local
+	}
+
+    chain ntp_force_local {
+		ip daddr 0.0.0.0/8 counter packets 0 bytes 0 return
+		ip daddr 127.0.0.0/8 counter packets 0 bytes 0 return
+		ip daddr 192.168.0.0/16 counter packets 0 bytes 0 return
+		ip saddr 192.168.0.0/16 counter packets 0 bytes 0 dnat to 192.168.10.1
+	}
+}

luci-app-school/root/usr/share/school/ipid.rules

@@ -0,0 +1,23 @@
+#!/usr/sbin/nft -f
+
+table ip ipid {
+    chain FORWARD {
+		type filter hook forward priority mangle; policy accept;
+		counter packets 0 bytes 0 jump IPID_MOD
+	}
+
+	chain OUTPUT {
+		type route hook output priority mangle; policy accept;
+		counter packets 0 bytes 0 jump IPID_MOD
+	}
+    
+    chain IPID_MOD {
+		ip daddr 0.0.0.0/8 counter packets 0 bytes 0 return
+		ip daddr 127.0.0.0/8 counter packets 0 bytes 0 return
+		ip daddr 10.0.0.0/8 counter packets 0 bytes 0 return
+		ip daddr 172.16.0.0/12 counter packets 0 bytes 0 return
+		ip daddr 192.168.0.0/16 counter packets 0 bytes 0 return
+		ip daddr 255.0.0.0/8 counter packets 0 bytes 0 return
+		counter packets 0 bytes 0 meta mark set mark or 0x10 
+	}
+}

luci-app-school/root/usr/share/school/ittl.rules

@@ -0,0 +1,8 @@
+#!/usr/sbin/nft -f
+
+table ip ittl {
+    chain POSTROUTING {
+		type filter hook postrouting priority mangle; policy accept;
+		counter packets 0 bytes 0 # TTL set to 64
+	}
+}

luci-app-school/root/usr/share/school/iua2f.rules

@@ -0,0 +1,17 @@
+#!/usr/sbin/nft -f
+
+table ip iua2f {
+    chain wan_patch {
+		type filter hook postrouting priority mangle; policy accept;
+		oif "wan" meta nfproto ipv4 counter mark set mark or 0x10 ip ttl set 64 jump ua2f
+		oif "wan6" meta nfproto ipv6 counter ip6 hoplimit set 64 jump ua2f
+	}
+
+	chain ua2f {
+		tcp flags syn tcp option timestamp exists counter queue num 10010-10013 fanout
+		ct mark 43 counter return
+		meta l4proto != tcp counter return
+		tcp dport { ssh, https } counter return
+		counter queue num 10010-10013 fanout
+	}
+}

luci-app-school/root/usr/share/ucitrack/luci-app-school.json

@@ -0,0 +1,4 @@
+{
+	"config": "school",
+	"init": "school"
+}