cwx/op-packages
1
0 Fork 0
mirror of https://github.com/kiddin9/op-packages.git synced 2026-11-10 09:07:51 +08:00
Code Issues Actions 1 Packages Projects Releases Wiki Activity

💐 Sync 2026-10-01 01:11:54

Browse Source
This commit is contained in:
github-actions[bot] committed 2026-10-01 01:11:54 +08:00
1 parent 8f2ec5c4da
commit 2909cae209
44 files changed
+1092 -2287
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

luci-app-homeproxy-pro/root/etc/homeproxy-pro/scripts/firewall_post.ut
+5 -29
View File
@@ -281,12 +281,7 @@ set homeproxy_mainland_addr_v4 {
{% endfor %}
}
}
{# The v6 mainland set is only ever matched inside `ipv6_support === '1'`
blocks - every reference to it below is gated on that - so the old
`|| china_dns_server` alternative only ever built a set nothing pointed
at: 1033 prefixes loaded into the kernel on every fw4 reload for nothing.
china_dns_server is a DNS-side setting and has no bearing on v6 routing. #}
{% if (ipv6_support === '1'): %}
{% if ((ipv6_support === '1') || china_dns_server): %}
set homeproxy_mainland_addr_v6 {
type ipv6_addr
flags interval
@@ -352,25 +347,6 @@ set homeproxy_routing_port {
}
{% endif %}
{# IPv6 forwarding is refused outright when the switch is off.
The DNS side already answers AAAA with REFUSED, but that only covers clients
that ask *this* router: a cached address, a client with its own resolver, or
an IPv6-only destination still reaches the WAN and bypasses both the proxy
and the mainland split.
fw4's own forward chain cannot be used for this - it jumps into the zone
chains, whose accept rules end the traversal before anything appended at the
end of the chain is reached - so this is a base chain of its own, ordered
before fw4's forward (priority filter == 0).
Intra-LAN IPv6 is covered as well, which is what "this router does not do
IPv6" means for `ipv6_support` off. #}
{% if (ipv6_support !== '1'): %}
chain homeproxy_ipv6_guard {
type filter hook forward priority mangle; policy accept
meta nfproto ipv6 counter reject comment "!{{ cfgname }}: IPv6 forwarding is disabled (ipv6_support is off)"
}
{% endif %}
{# DNS hijack & TCP redirect #}
chain dstnat {
{% if ((dns_redirect === '1') && (dns_hijacked !== '1')): %}
@@ -586,14 +562,14 @@ chain homeproxy_mangle_prerouting {
{% if (ipv6_support === '1'): %}
ip6 daddr != @homeproxy_gfw_list_v6 counter return
{% endif /* ipv6_support */ %}
udp dport { 80, 443 } counter reject comment "!{{ cfgname }}: reject QUIC (UDP 80/443), clients fall back to TCP"
udp dport { 80, 443 } counter reject comment "!{{ cfgname }}: Block QUIC (not proxyable)"
{% elif (routing_mode === 'bypass_mainland_china' || bypass_cn_traffic === '1'): %}
ip daddr @homeproxy_mainland_addr_v4 counter return
{% if (ipv6_support === '1'): %}
ip6 daddr @homeproxy_mainland_addr_v6 counter return
{% endif /* ipv6_support */ %}
{% if (routing_mode !== 'custom'): %}
udp dport { 80, 443 } counter reject comment "!{{ cfgname }}: reject QUIC (UDP 80/443), clients fall back to TCP"
udp dport { 80, 443 } counter reject comment "!{{ cfgname }}: Block QUIC (not proxyable)"
{% endif /* routing_mode */ %}
{% elif (routing_mode === 'proxy_mainland_china'): %}
ip daddr != @homeproxy_mainland_addr_v4 counter return
@@ -747,14 +723,14 @@ chain homeproxy_mangle_tun {
{% if (ipv6_support === '1'): %}
ip6 daddr != @homeproxy_gfw_list_v6 counter return
{% endif /* ipv6_support */ %}
udp dport { 80, 443 } counter reject comment "!{{ cfgname }}: reject QUIC (UDP 80/443), clients fall back to TCP"
udp dport { 80, 443 } counter reject comment "!{{ cfgname }}: Block QUIC (not proxyable)"
{% elif (routing_mode === 'bypass_mainland_china' || bypass_cn_traffic === '1'): %}
ip daddr @homeproxy_mainland_addr_v4 counter return
{% if (ipv6_support === '1'): %}
ip6 daddr @homeproxy_mainland_addr_v6 counter return
{% endif /* ipv6_support */ %}
{% if (routing_mode !== 'custom'): %}
udp dport { 80, 443 } counter reject comment "!{{ cfgname }}: reject QUIC (UDP 80/443), clients fall back to TCP"
udp dport { 80, 443 } counter reject comment "!{{ cfgname }}: Block QUIC (not proxyable)"
{% endif /* routing_mode */ %}
{% elif (routing_mode === 'proxy_mainland_china'): %}
ip daddr != @homeproxy_mainland_addr_v4 counter return