🌴 Sync 2026-03-05 23:51:42

luci-app-ttl/root/etc/hotplug.d/iface/90-ttl

@@ -0,0 +1,18 @@
+. /lib/functions.sh
+
+handle_config(){
+	config_get iface "$1" iface
+	[ "$iface" = "$INTERFACE" ] && {
+		run_ttl=1
+	}
+}
+
+config_load ttl
+config_foreach handle_config ttl
+
+case $run_ttl in
+	1) /etc/init.d/ttl reload ;;
+esac
+
+exit 0
+

luci-app-ttl/root/etc/init.d/ttl

@@ -0,0 +1,17 @@
+#!/bin/sh /etc/rc.common
+
+START=96
+USE_PROCD=1
+
+start_service(){
+	/usr/share/ttl.sh
+	logger -t "TTL" "TTL reload"
+}
+
+reload_service(){
+	sleep 10 && start &
+}
+
+service_triggers() {
+	procd_add_reload_trigger ttl
+}

luci-app-ttl/root/usr/share/luci/menu.d/luci-app-ttl.json

@@ -0,0 +1,24 @@
+{
+	"admin/network/firewall": {
+		"title": "Firewall",
+		"order": 60,
+		"action": {
+			"type": "alias",
+			"path": "admin/network/firewall/zones"
+		},
+		"depends": {
+			"acl": [ "luci-app-firewall" ],
+			"fs": { "/sbin/fw3": "executable" },
+			"uci": { "firewall": true }
+		}
+	},
+
+	"admin/network/firewall/ttl": {
+		"title": "TTL",
+		"order": 45,
+		"action": {
+			"type": "view",
+			"path": "firewall/ttl"
+		}
+	}
+}

luci-app-ttl/root/usr/share/rpcd/acl.d/luci-app-ttl.json

@@ -0,0 +1,25 @@
+{
+	"luci-app-ttl": {
+		"description": "Grant access to TTL configuration",
+		"read": {
+			"file": {
+				"/etc/init.d/ttl": [ "exec" ],
+				"/etc/init.d/firewall": [ "exec" ]
+			},
+			"cgi-io": [ "exec" ],
+			"ubus": {
+				"file": [ "exec" ],
+				"uci": [ "changes", "get" ]
+			},
+			"uci": [ "ttl" ]
+		},
+		"write": {
+			"cgi-io": [ "exec" ],
+			"ubus": {
+				"file": [ "exec" ],
+				"uci": [ "add", "apply", "confirm", "delete", "order", "rename", "set" ]
+			},
+			"uci": [ "ttl" ]
+		}
+	}
+}

luci-app-ttl/root/usr/share/ttl.sh

@@ -0,0 +1,19 @@
+#!/bin/sh
+
+
+SECTIONS=$(echo $(uci show ttl | awk -F [\]\[\@=] '/=ttl/{print $3}'))
+
+get_vars(){
+	for v in method advanced inet ports ttl iface proxy; do
+		eval $v=$(uci -q get ttl.@ttl[${s}].${v} 2>/dev/nul)
+	done
+}
+
+
+# check iptables or nft 
+#
+if [ -x /usr/sbin/iptables -o /usr/sbin/ip6tables -a ! -x /usr/sbin/nft ]; then
+	. /usr/share/ttlipt.sh
+else
+	. /usr/share/ttlnft.sh
+fi

luci-app-ttl/root/usr/share/ttlipt.sh

@@ -0,0 +1,152 @@
+method_ttl(){
+
+	ttl=${ttl:=64}
+
+	#case $(($ttl % 2)) in
+	#	0) TTL_INC=$(($ttl-1)) ;;
+	#	*) TTL_INC=$ttl ;;
+	#esac
+	TTL_INC=$(($ttl-1))
+
+	for T in $IPT; do
+		case $T in
+			iptables)
+				SUFFIX="TTL --ttl-set"
+				if [ $iface ]; then
+					$T -t mangle -A TTLFIX -i $DEV -m ttl --ttl 1 -j TTL --ttl-inc $TTL_INC
+				else
+					$T -t mangle -A TTLFIX -m ttl --ttl 1 -j TTL --ttl-inc $TTL_INC
+				fi
+			;;
+			ip6tables)
+				SUFFIX="HL --hl-set"
+				if [ $iface ]; then
+					$T -t mangle -A TTLFIX -i $DEV -m hl --hl 1 -j HL --hl-inc $TTL_INC
+				else
+					$T -t mangle -A TTLFIX -m hl --hl 1 -j HL --hl-inc $TTL_INC
+				fi
+			;;
+		esac
+
+		if [ $iface ]; then
+			$T -t mangle -A TTL_OUT -o $DEV -j $SUFFIX $ttl
+			$T -t mangle -A TTL_POST -o $DEV -j $SUFFIX $ttl
+		else
+			$T -t mangle -A TTL_OUT -j $SUFFIX $ttl
+			$T -t mangle -A TTL_POST -j $SUFFIX $ttl
+		fi
+	done
+}
+
+
+method_proxy(){
+
+	for T in $IPT; do
+		[ "$proxy" ] && {
+			IPADDR=${proxy%:*}
+			case $T in
+				iptables) END=${IPADDR}:${proxy#*:} ;;
+				ip6tables) END="[${IPADDR}]:${proxy#*:}" ;;
+			esac
+	        } || {
+			case $T in
+				iptables)
+					IPADDR=$(ifstatus $ifn | jsonfilter -e '@["ipv4-address"][*]["address"]')
+					END="${IPADDR}:3128"
+				;;
+				ip6tables)
+					for a in $(ifstatus $ifn | jsonfilter -e '@["ipv6-prefix-assignment"][*]["local-address"]["address"]'); do
+						IPADDR="$a"
+					done
+					END="[$IPADDR]:3128"
+				;;
+			esac
+		}
+
+		$T -t nat -A PROXY -i $DEV -j FIXPROXY
+
+		case $ports in
+			all)
+				$T -t nat -A FIXPROXY ! -d ${IPADDR} \
+					! -s ${IPADDR} -p tcp \
+					-j DNAT --to-destination $END
+			;;
+			http)
+				$T -t nat -A FIXPROXY ! -d ${IPADDR} \
+					! -s ${IPADDR} -p tcp -m multiport \
+					--dports 80,443 -j DNAT --to-destination $END
+			;;
+			*)
+				if [ $ports ]; then
+					$T -t nat -A FIXPROXY ! -d ${IPADDR} \
+						! -s ${IPADDR} -p tcp -m multiport \
+						--dports $ports -j DNAT --to-destination $END
+				else
+					$T -t nat -A FIXPROXY ! -d ${IPADDR} \
+						! -s ${IPADDR} -p tcp \
+						-j DNAT --to-destination $END
+				fi
+			;;
+		esac
+	done
+}
+
+# check nat66 module
+if [ -f /lib/modules/$(uname -r)/ip6table_nat.ko ]; then
+	IPT="iptables ip6tables"
+else
+	IPT="iptables"
+fi
+	
+# Create and flush mangle table
+for T in $IPT; do
+	for t in N F; do
+		for c in TTLFIX TTL_OUT TTL_POST; do
+			$T -t mangle -${t} ${c}
+		done
+	done
+	for a in D I; do
+		$T -t mangle -${a} PREROUTING -j TTLFIX
+		$T -t mangle -${a} OUTPUT -j TTL_OUT
+		$T -t mangle -${a} POSTROUTING -j TTL_POST
+	done
+done
+
+# Create and flush nat table
+for T in $IPT; do
+	for t in N F; do
+		$T -t nat -${t} PROXY
+		$T -t nat -${t} FIXPROXY
+	done
+	for a in D I; do
+		$T -t nat -${a} PREROUTING -j PROXY
+	done
+done
+
+for s in $SECTIONS; do
+	if [ "$s" ]; then
+		get_vars
+	else
+		exit 0
+	fi
+
+        [ -n $iface ] && {
+                ifn=$iface
+        } || {
+                ifn=lan
+        }
+
+	case $inet in
+		ipv4) IPT="iptables" ;;
+		ipv6) IPT="ip6tables" ;;
+		*) IPT="iptables ip6tables";;
+	esac
+	if ! [ -f /lib/modules/$(uname -r)/ip6table_nat.ko ]; then
+		IPT="iptables"
+	fi
+	DEV=$(ifstatus $iface | jsonfilter -e '@["l3_device"]')
+	case $method in
+		ttl) method_ttl ;;
+		proxy) method_proxy ;;
+	esac
+done

luci-app-ttl/root/usr/share/ttlnft.sh

@@ -0,0 +1,137 @@
+method_ttl(){
+
+    ttl=${ttl:=64}
+
+    # create mangle table
+    nft add table ip mangle 2>/dev/null
+    nft add table ip6 mangle 2>/dev/null
+
+    for fam in $family; do
+        [ "$fam" = "ip6" ] && [ "$inet" = "ipv4" ] && continue
+        [ "$fam" = "ip" ] && [ "$inet" = "ipv6" ] && continue
+
+        # define nftables chains
+        nft add chain $fam mangle TTLFIX { type filter hook prerouting priority -150 \; }
+        nft add chain $fam mangle TTL_OUT { type route hook output priority -150 \; }
+        nft add chain $fam mangle TTL_POST { type filter hook postrouting priority -150 \; }
+
+        # TTL/HL change rules
+	case $fam in
+		ip) TTLNAME=ttl ;;
+		ip6) TTLNAME=hoplimit ;;
+	esac
+	if [ $iface ]; then
+		nft add rule $fam mangle TTLFIX iif $DEV $fam $TTLNAME 1 $fam $TTLNAME set $ttl
+		nft add rule $fam mangle TTL_OUT oif $DEV $fam $TTLNAME set $ttl
+		nft add rule $fam mangle TTL_POST oif $DEV $fam $TTLNAME set $ttl
+	else
+		nft add rule $fam mangle TTLFIX $fam $TTLNAME 1 $fam $TTLNAME set $ttl
+		nft add rule $fam mangle TTL_OUT $fam $TTLNAME set $ttl
+		nft add rule $fam mangle TTL_POST $fam $TTLNAME set $ttl
+	fi
+    done
+}
+
+method_proxy(){
+    for fam in $family; do
+	# create nat table
+	nft add table $fam nat 2>/dev/null
+        [ "$fam" = "ip6" ] && [ "$inet" = "ipv4" ] && continue
+        [ "$fam" = "ip" ] && [ "$inet" = "ipv6" ] && continue
+
+	[ "$proxy" ] && {
+		IPADDR=${proxy%:*}
+		END=${IPADDR}:${proxy#*:}
+	} || {
+	        # get ipaddress from iface if not defined
+		case $fam in
+	        	ip)
+				IPADDR=$(ifstatus $ifn | jsonfilter -e '@["ipv4-address"][*]["address"]')
+				END="${IPADDR}:3128"
+			;;
+			ip6)
+				IPADDR=$(ifstatus $ifn | jsonfilter -e '@["ipv6-prefix-assignment"][*]["local-address"]["address"]' | head -n1)
+				END="${IPADDR}:3128"
+			;;
+		esac
+	}
+
+        # create NAT chains
+        nft add chain $fam nat PROXY { type nat hook prerouting priority -100 \; }
+        nft add chain $fam nat FIXPROXY
+
+        # add traffic rule
+	[ $iface ] && {
+	        nft add rule $fam nat PROXY iif $DEV jump FIXPROXY
+	} || {
+		nft add rule $fam nat PROXY jump FIXPROXY
+	}
+
+
+        case $ports in
+            all)
+                nft add rule $fam nat FIXPROXY $fam daddr != $IPADDR $fam saddr != $IPADDR \
+                    meta l4proto tcp dnat to $END
+                ;;
+            http)
+                nft add rule $fam nat FIXPROXY $fam daddr != $IPADDR $fam saddr != $IPADDR \
+                    meta l4proto tcp tcp dport {80,443} dnat to $END
+                ;;
+            *)
+                if [ $ports ]; then
+                    nft add rule $fam nat FIXPROXY $fam daddr != $IPADDR $fam saddr != $IPADDR \
+                        meta l4proto tcp tcp dport {$(echo $ports | tr ',' ',')} dnat to $END
+                else
+                    nft add rule $fam nat FIXPROXY $fam daddr != $IPADDR $fam saddr != $IPADDR \
+                        meta l4proto tcp dnat to $END
+                fi
+                ;;
+        esac
+    done
+}
+
+# init tables and chains
+for fml in ip ip6; do
+    # create table mangle
+    nft delete table $fml mangle 2>/dev/null
+    nft delete table $fml nat 2>/dev/null
+
+    # define chains
+    nft add table $fml mangle
+    nft add chain $fml mangle TTLFIX { type filter hook prerouting priority -150 \; }
+    nft add chain $fml mangle TTL_OUT { type route hook output priority -150 \; }
+    nft add chain $fml mangle TTL_POST { type filter hook postrouting priority -150 \; }
+done
+
+for s in $SECTIONS; do
+	if [ "$s" ]; then
+		get_vars
+	else
+		exit 0
+	fi
+
+	[ $iface ] && {
+                ifn=$iface
+	} || {
+		ifn=lan
+	}
+
+	case $inet in
+		ipv4) family="ip" ;;
+		ipv6) family="ip6" ;;
+		*) family="ip ip6" ;;
+	esac
+
+	#if [ ! -f /lib/modules/$(uname -r)/ip6table_nat.ko ]; then
+	#	family="ip"
+	#fi
+
+	DEV=$(ifstatus $iface | jsonfilter -e '@["l3_device"]')
+
+	case $method in
+		ttl) method_ttl ;;
+		proxy) method_proxy ;;
+	esac
+
+done
+