cwx/op-packages
1
0 Fork 0
mirror of https://github.com/kiddin9/op-packages.git synced 2026-11-10 15:37:51 +08:00
Code Issues Actions Packages Projects Releases Wiki Activity

🌴 Sync 2026-10-06 02:20:56

Browse Source
This commit is contained in:
github-actions[bot] committed 2026-10-06 02:20:56 +08:00
1 parent 5c201dd3af
commit 487c4fad50
111 files changed
+4641 -746
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

luci-app-homeproxy-pro/root/etc/homeproxy-pro/scripts/firewall_post.ut
+234 -105
View File
@@ -282,12 +282,22 @@ const v6_warn_comment = ((ipv6_support === '1') && !cn_ipv6_ready)
let self_mark, redirect_port,
tproxy_port, tproxy_mark,
tun_name, tun_mark;
tun_name, tun_mark, tun_self_mark;
if (match(proxy_mode, /redirect/)) {
self_mark = mark_value_or(uci.get(cfgname, 'infra', 'self_mark'), resolve_mark('100'));
redirect_port = port_or(uci.get(cfgname, 'infra', 'redirect_port'), '5331');
}
/* Whether UDP can actually be proxied in this configuration: there is a
* UDP-capable node, or the user took the decision over with custom rules.
* The UDP tproxy chain already uses exactly this condition, and the QUIC reject
* has to agree with it - it keyed off `routing_mode !== 'custom'` only, so a
* router with `main_udp_node` set still rejected QUIC on UDP 443 (measured on
* the device: 1722 QUIC packets rejected in one sample) and browsers that had
* learned HTTP/3 fell back to TCP needlessly. Now the reject is emitted only
* when UDP really is not proxyable. */
const udp_proxyable = (outbound_udp_node !== 'nil' || routing_mode === 'custom');
if (match(proxy_mode, /tproxy/))
if (outbound_udp_node !== 'nil' || routing_mode === 'custom') {
tproxy_port = port_or(uci.get(cfgname, 'infra', 'tproxy_port'), '5332');
@@ -296,6 +306,12 @@ if (match(proxy_mode, /tproxy/))
if (match(proxy_mode, /tun/)) {
tun_name = iface_or(uci.get(cfgname, 'infra', 'tun_name'), 'singtun0');
tun_mark = resolve_mark(uci.get(cfgname, 'infra', 'tun_mark') || '102') || resolve_mark('102');
/* The mark sing-box stamps on its own outbound sockets in tun mode
* (generator: route.default_mark, same UCI option as self_mark elsewhere).
* The TUN output chain has to return on it, otherwise the tunnel captures
* sing-box's own dial - including the one to the node - and the only guard
* it had was `iifname <tun>`, which cannot match on the output hook. */
tun_self_mark = mark_value_or(uci.get(cfgname, 'infra', 'self_mark'), resolve_mark('100'));
}
const control_options = [
@@ -312,6 +328,98 @@ const control_info = {};
for (let i in control_options)
control_info[i] = uci.get(cfgname, 'control', i);
/* Devices of the wan zone, resolved by fw4 itself.
*
* The intercept layer must not cover the wan side. When the user names
* interfaces the guards below use exactly those; when the option is empty the
* UI says "all", and "all" used to include wan - so wan-inbound traffic to the
* router's own address on a routing_port was captured by the redirect / tproxy
* jump and by the DNS hijack as well. It happened to be masked on the device
* (dnsmasq's own dns_redirect suppressed the DNS half, fw4's input policy
* dropped the rest), but the hole was structural: any wan-side service on one
* of the routing ports would have been hijacked. Empty now means "everything
* except the wan zone".
*
* fw4's own ruleset template renders zone devices from `zone.match_devices`,
* so this asks the same source. A render outside fw4 (the off-target test
* harness has no zone state) leaves the list empty and the guards below fall
* back to the previous behaviour. */
let wan_devices = [];
try {
/* fw4.load() is what resolves a zone's *logical* networks to the devices
* that actually appear in `iifname` - the wan zone is `network wan` but
* the device is `pppoe-wan`, and this template runs OUTSIDE fw4's own
* process, where the module has no state at all. Two wrong answers were
* measured on the device before this:
*
* - no load at all: `zones()` is null, the loop threw, the catch left
* the list empty and the guard silently disappeared from the rendered
* ruleset (that is the state this package shipped in r46);
* - fw4.read_state(): parses /var/run/fw4.state, which carries the
* LOGICAL names ("wan", "wan_6"), so the guard rendered as
* `meta iifname { wan }` and could never match - a guard that looks
* present and does nothing.
*
* load() builds the model through ubus the same way fw4 itself does, and
* yields match_devices = [ "pppoe-wan" ]. It is read-only, ~tens of ms,
* and its warnings go to stderr, which the caller discards. */
fw4.load();
for (let zone in (fw4.zones() || []))
if (zone.name === 'wan')
for (let device in zone.match_devices)
push(wan_devices, device);
}
catch (e) { }
wan_devices = sort(uniq(wan_devices));
/* Validated, nft-ready form of every UCI list, computed once.
*
* The template used to gate on the *raw* UCI value and interpolate the
* validator-backed helper. A list that is non-empty but has no usable entry -
* hand-edited UCI, an address in the wrong family - therefore rendered
* `ip daddr counter return`, an nft syntax error that fails the whole fw4
* transaction, or `elements = { }`. Gating on the helper's result instead
* means an unusable list simply emits no rule. The rendered output for a
* usable configuration is unchanged (the helpers already dropped invalid
* entries one by one). */
const NFTARR_FIELDS = {
listen_interfaces: iface_to_nftarr,
lan_proxy_ipv4_ips: ipv4_to_nftarr,
lan_proxy_ipv6_ips: ipv6_to_nftarr,
lan_proxy_mac_addrs: mac_to_nftarr,
lan_direct_ipv4_ips: ipv4_to_nftarr,
lan_direct_ipv6_ips: ipv6_to_nftarr,
lan_direct_mac_addrs: mac_to_nftarr,
lan_gaming_mode_ipv4_ips: ipv4_to_nftarr,
lan_gaming_mode_ipv6_ips: ipv6_to_nftarr,
lan_gaming_mode_mac_addrs: mac_to_nftarr,
lan_global_proxy_ipv4_ips: ipv4_to_nftarr,
lan_global_proxy_ipv6_ips: ipv6_to_nftarr,
lan_global_proxy_mac_addrs: mac_to_nftarr,
wan_proxy_ipv4_ips: ipv4_to_nftarr,
wan_proxy_ipv6_ips: ipv6_to_nftarr,
wan_direct_ipv4_ips: ipv4_to_nftarr,
wan_direct_ipv6_ips: ipv6_to_nftarr
};
const nftarr = {};
for (let field in NFTARR_FIELDS)
nftarr[field] = NFTARR_FIELDS[field](control_info[field] || []);
/* The local-output chain also exempts `lo`, which the tproxy guard adds by
* hand. Same precomputation, so the guard cannot disagree with the list. */
nftarr.listen_interfaces_lo = iface_to_nftarr([ ...(control_info.listen_interfaces || []), 'lo' ]);
/* The routing-port filter. Gating on the raw option while interpolating
* ports_to_nftarr() had the same defect, and there the fallback direction
* matters: an empty rendering would make `tcp dport != @homeproxy_routing_port`
* match everything and send all TCP traffic direct. An unusable list
* therefore disables the filter (ports are proxied) instead of widening it. */
const routing_port_set = routing_port ? ports_to_nftarr(routing_port) : null;
const dns_redirect = uci.get(cfgname, 'infra', 'dns_redirect') || '1';
const dns_hijacked = uci.get('dhcp', '@dnsmasq[0]', 'dns_redirect') || '0',
/* dnsmasq's own port - NOT the sing-box DNS inbound port (infra.dns_port,
@@ -417,8 +525,8 @@ set homeproxy_wan_proxy_addr_v4 {
type ipv4_addr
flags interval
auto-merge
{% if (control_info.wan_proxy_ipv4_ips): %}
elements = { {{ ipv4_to_nftarr(control_info.wan_proxy_ipv4_ips) }} }
{% if (nftarr.wan_proxy_ipv4_ips): %}
elements = { {{ nftarr.wan_proxy_ipv4_ips }} }
{% endif %}
}
@@ -427,8 +535,8 @@ set homeproxy_wan_proxy_addr_v6 {
type ipv6_addr
flags interval
auto-merge
{% if (control_info.wan_proxy_ipv6_ips): %}
elements = { {{ ipv6_to_nftarr(control_info.wan_proxy_ipv6_ips) }} }
{% if (nftarr.wan_proxy_ipv6_ips): %}
elements = { {{ nftarr.wan_proxy_ipv6_ips }} }
{% endif /* wan_proxy_ipv6_ips*/ %}
}
{% endif /* v6_handled */ %}
@@ -437,8 +545,8 @@ set homeproxy_wan_direct_addr_v4 {
type ipv4_addr
flags interval
auto-merge
{% if (control_info.wan_direct_ipv4_ips): %}
elements = { {{ ipv4_to_nftarr(control_info.wan_direct_ipv4_ips) }} }
{% if (nftarr.wan_direct_ipv4_ips): %}
elements = { {{ nftarr.wan_direct_ipv4_ips }} }
{% endif %}
}
@@ -447,18 +555,18 @@ set homeproxy_wan_direct_addr_v6 {
type ipv6_addr
flags interval
auto-merge
{% if (control_info.wan_direct_ipv6_ips): %}
elements = { {{ ipv6_to_nftarr(control_info.wan_direct_ipv6_ips) }} }
{% if (nftarr.wan_direct_ipv6_ips): %}
elements = { {{ nftarr.wan_direct_ipv6_ips }} }
{% endif /* wan_direct_ipv6_ips */ %}
}
{% endif /* v6_handled */ %}
{% if (routing_port): %}
{% if (routing_port_set): %}
set homeproxy_routing_port {
type inet_service
flags interval
auto-merge
elements = { {{ ports_to_nftarr(routing_port) }} }
elements = { {{ routing_port_set }} }
}
{% endif %}
@@ -501,8 +609,10 @@ set homeproxy_node_addr_v6 {
{# DNS hijack & TCP redirect #}
chain dstnat {
{% if ((dns_redirect === '1') && (dns_hijacked !== '1')): %}
{% if (control_info.listen_interfaces): %}
meta iifname {{ iface_to_nftarr(control_info.listen_interfaces) }}
{% if (nftarr.listen_interfaces): %}
meta iifname {{ nftarr.listen_interfaces }}
{%- elif (!isEmpty(wan_devices)): %}
meta iifname != {{ array_to_nftarr(wan_devices) }}
{%- endif /* listen_interfaces */ %}
meta nfproto { ipv4, ipv6 } udp dport 53 counter redirect to :{{ dnsmasq_port }} comment "!{{ cfgname }}: DNS hijack"
{% endif /* dns_hijacked */ %}
@@ -518,37 +628,39 @@ chain homeproxy_redirect_proxy {
}
chain homeproxy_redirect_proxy_port {
{% if (routing_port): %}
{% if (routing_port_set): %}
tcp dport != @homeproxy_routing_port counter return
{% endif %}
goto homeproxy_redirect_proxy
}
chain homeproxy_redirect_lanac {
{% if (control_info.listen_interfaces): %}
meta iifname != {{ iface_to_nftarr(control_info.listen_interfaces) }} counter return
{% if (nftarr.listen_interfaces): %}
meta iifname != {{ nftarr.listen_interfaces }} counter return
{% elif (!isEmpty(wan_devices)): %}
meta iifname {{ array_to_nftarr(wan_devices) }} counter return comment "!{{ cfgname }}: not the WAN side"
{% endif %}
meta mark {{ self_mark }} counter return
{% if (control_info.lan_proxy_mode === 'listed_only'): %}
{% if (!isEmpty(control_info.lan_proxy_ipv4_ips)): %}
ip saddr {{ ipv4_to_nftarr(control_info.lan_proxy_ipv4_ips) }} counter goto homeproxy_redirect
{% if (nftarr.lan_proxy_ipv4_ips): %}
ip saddr {{ nftarr.lan_proxy_ipv4_ips }} counter goto homeproxy_redirect
{% endif /* lan_proxy_ipv4_ips */ %}
{% if (!isEmpty(control_info.lan_proxy_ipv6_ips)): %}
ip6 saddr {{ ipv6_to_nftarr(control_info.lan_proxy_ipv6_ips) }} counter goto homeproxy_redirect
{% if (nftarr.lan_proxy_ipv6_ips): %}
ip6 saddr {{ nftarr.lan_proxy_ipv6_ips }} counter goto homeproxy_redirect
{% endif /* lan_proxy_ipv6_ips */ %}
{% if (!isEmpty(control_info.lan_proxy_mac_addrs)): %}
ether saddr {{ mac_to_nftarr(control_info.lan_proxy_mac_addrs) }} counter goto homeproxy_redirect
{% if (nftarr.lan_proxy_mac_addrs): %}
ether saddr {{ nftarr.lan_proxy_mac_addrs }} counter goto homeproxy_redirect
{% endif /* lan_proxy_mac_addrs */ %}
{% elif (control_info.lan_proxy_mode === 'except_listed'): %}
{% if (!isEmpty(control_info.lan_direct_ipv4_ips)): %}
ip saddr {{ ipv4_to_nftarr(control_info.lan_direct_ipv4_ips) }} counter return
{% if (nftarr.lan_direct_ipv4_ips): %}
ip saddr {{ nftarr.lan_direct_ipv4_ips }} counter return
{% endif /* lan_direct_ipv4_ips */ %}
{% if (!isEmpty(control_info.lan_direct_ipv6_ips)): %}
ip6 saddr {{ ipv6_to_nftarr(control_info.lan_direct_ipv6_ips) }} counter return
{% if (nftarr.lan_direct_ipv6_ips): %}
ip6 saddr {{ nftarr.lan_direct_ipv6_ips }} counter return
{% endif /* lan_direct_ipv6_ips */ %}
{% if (!isEmpty(control_info.lan_direct_mac_addrs)): %}
ether saddr {{ mac_to_nftarr(control_info.lan_direct_mac_addrs) }} counter return
{% if (nftarr.lan_direct_mac_addrs): %}
ether saddr {{ nftarr.lan_direct_mac_addrs }} counter return
{% endif /* lan_direct_mac_addrs */ %}
{% endif /* lan_proxy_mode */ %}
@@ -578,14 +690,14 @@ chain homeproxy_redirect {
{% endif %}
{% if (routing_mode !== 'custom'): %}
{% if (!isEmpty(control_info.lan_global_proxy_ipv4_ips)): %}
ip saddr {{ ipv4_to_nftarr(control_info.lan_global_proxy_ipv4_ips) }} counter goto homeproxy_redirect_proxy_port
{% if (nftarr.lan_global_proxy_ipv4_ips): %}
ip saddr {{ nftarr.lan_global_proxy_ipv4_ips }} counter goto homeproxy_redirect_proxy_port
{% endif /* lan_global_proxy_ipv4_ips */ %}
{% if (!isEmpty(control_info.lan_global_proxy_ipv6_ips)): %}
ip6 saddr {{ ipv6_to_nftarr(control_info.lan_global_proxy_ipv6_ips) }} counter goto homeproxy_redirect_proxy_port
{% if (nftarr.lan_global_proxy_ipv6_ips): %}
ip6 saddr {{ nftarr.lan_global_proxy_ipv6_ips }} counter goto homeproxy_redirect_proxy_port
{% endif /* lan_global_proxy_ipv6_ips */ %}
{% if (!isEmpty(control_info.lan_global_proxy_mac_addrs)): %}
ether saddr {{ mac_to_nftarr(control_info.lan_global_proxy_mac_addrs) }} counter goto homeproxy_redirect_proxy_port
{% if (nftarr.lan_global_proxy_mac_addrs): %}
ether saddr {{ nftarr.lan_global_proxy_mac_addrs }} counter goto homeproxy_redirect_proxy_port
{% endif /* lan_global_proxy_mac_addrs */ %}
{% endif /* routing_mode */ %}
@@ -594,6 +706,11 @@ chain homeproxy_redirect {
ip6 daddr @homeproxy_wan_direct_addr_v6 counter return
{% endif /* v6_handled */ %}
{# No QUIC reject here: this whole block only renders when UDP is
proxyable (see the gate above), so rejecting QUIC on UDP 443 would
break HTTP/3 for traffic that can be proxied. The TUN block below,
which renders either way, carries the reject when UDP cannot be
proxied. #}
{% if (routing_mode === 'gfwlist' && dnsmasq_nftset()): %}
ip daddr != @homeproxy_gfw_list_v4 counter return
{% if (v6_handled): %}
@@ -611,14 +728,14 @@ chain homeproxy_redirect {
{% endif /* v6_handled */ %}
{% endif /* routing_mode */ %}
{% if (!isEmpty(control_info.lan_gaming_mode_ipv4_ips)): %}
ip saddr {{ ipv4_to_nftarr(control_info.lan_gaming_mode_ipv4_ips) }} counter goto homeproxy_redirect_proxy
{% if (nftarr.lan_gaming_mode_ipv4_ips): %}
ip saddr {{ nftarr.lan_gaming_mode_ipv4_ips }} counter goto homeproxy_redirect_proxy
{% endif /* lan_gaming_mode_ipv4_ips */ %}
{% if (!isEmpty(control_info.lan_gaming_mode_ipv6_ips)): %}
ip6 saddr {{ ipv6_to_nftarr(control_info.lan_gaming_mode_ipv6_ips) }} counter goto homeproxy_redirect_proxy
{% if (nftarr.lan_gaming_mode_ipv6_ips): %}
ip6 saddr {{ nftarr.lan_gaming_mode_ipv6_ips }} counter goto homeproxy_redirect_proxy
{% endif /* lan_gaming_mode_ipv6_ips */ %}
{% if (!isEmpty(control_info.lan_gaming_mode_mac_addrs)): %}
ether saddr {{ mac_to_nftarr(control_info.lan_gaming_mode_mac_addrs) }} counter goto homeproxy_redirect_proxy
{% if (nftarr.lan_gaming_mode_mac_addrs): %}
ether saddr {{ nftarr.lan_gaming_mode_mac_addrs }} counter goto homeproxy_redirect_proxy
{% endif /* lan_gaming_mode_mac_addrs */ %}
counter goto homeproxy_redirect_proxy_port
@@ -640,45 +757,47 @@ chain homeproxy_mangle_tproxy {
}
chain homeproxy_mangle_tproxy_port {
{% if (routing_port): %}
{% if (routing_port_set): %}
udp dport != @homeproxy_routing_port counter return
{% endif %}
goto homeproxy_mangle_tproxy
}
chain homeproxy_mangle_mark {
{% if (routing_port): %}
{% if (routing_port_set): %}
udp dport != @homeproxy_routing_port counter return
{% endif %}
meta l4proto udp meta mark set {{ tproxy_mark }} counter accept
}
chain homeproxy_mangle_lanac {
{% if (control_info.listen_interfaces): %}
meta iifname != {{ iface_to_nftarr([...control_info.listen_interfaces, 'lo']) }} counter return
{% if (nftarr.listen_interfaces): %}
meta iifname != {{ nftarr.listen_interfaces_lo }} counter return
{% elif (!isEmpty(wan_devices)): %}
meta iifname {{ array_to_nftarr(wan_devices) }} counter return comment "!{{ cfgname }}: not the WAN side"
{% endif %}
meta iifname != lo udp dport 53 counter return
meta mark {{ self_mark }} counter return
{% if (control_info.lan_proxy_mode === 'listed_only'): %}
{% if (!isEmpty(control_info.lan_proxy_ipv4_ips)): %}
ip saddr {{ ipv4_to_nftarr(control_info.lan_proxy_ipv4_ips) }} counter goto homeproxy_mangle_prerouting
{% if (nftarr.lan_proxy_ipv4_ips): %}
ip saddr {{ nftarr.lan_proxy_ipv4_ips }} counter goto homeproxy_mangle_prerouting
{% endif /* lan_proxy_ipv4_ips */ %}
{% if (!isEmpty(control_info.lan_proxy_ipv6_ips)): %}
ip6 saddr {{ ipv6_to_nftarr(control_info.lan_proxy_ipv6_ips) }} counter goto homeproxy_mangle_prerouting
{% if (nftarr.lan_proxy_ipv6_ips): %}
ip6 saddr {{ nftarr.lan_proxy_ipv6_ips }} counter goto homeproxy_mangle_prerouting
{% endif /* lan_proxy_ipv6_ips */ %}
{% if (!isEmpty(control_info.lan_proxy_mac_addrs)): %}
ether saddr {{ mac_to_nftarr(control_info.lan_proxy_mac_addrs) }} counter goto homeproxy_mangle_prerouting
{% if (nftarr.lan_proxy_mac_addrs): %}
ether saddr {{ nftarr.lan_proxy_mac_addrs }} counter goto homeproxy_mangle_prerouting
{% endif /* lan_proxy_mac_addrs */ %}
{% elif (control_info.lan_proxy_mode === 'except_listed'): %}
{% if (!isEmpty(control_info.lan_direct_ipv4_ips)): %}
ip saddr {{ ipv4_to_nftarr(control_info.lan_direct_ipv4_ips) }} counter return
{% if (nftarr.lan_direct_ipv4_ips): %}
ip saddr {{ nftarr.lan_direct_ipv4_ips }} counter return
{% endif /* lan_direct_ipv4_ips */ %}
{% if (!isEmpty(control_info.lan_direct_ipv6_ips)): %}
ip6 saddr {{ ipv6_to_nftarr(control_info.lan_direct_ipv6_ips) }} counter return
{% if (nftarr.lan_direct_ipv6_ips): %}
ip6 saddr {{ nftarr.lan_direct_ipv6_ips }} counter return
{% endif /* lan_direct_ipv6_ips */ %}
{% if (!isEmpty(control_info.lan_direct_mac_addrs)): %}
ether saddr {{ mac_to_nftarr(control_info.lan_direct_mac_addrs) }} counter return
{% if (nftarr.lan_direct_mac_addrs): %}
ether saddr {{ nftarr.lan_direct_mac_addrs }} counter return
{% endif /* lan_direct_mac_addrs */ %}
{% endif /* lan_proxy_mode */ %}
@@ -706,14 +825,14 @@ chain homeproxy_mangle_prerouting {
{% endif %}
{% if (routing_mode !== 'custom'): %}
{% if (!isEmpty(control_info.lan_global_proxy_ipv4_ips)): %}
ip saddr {{ ipv4_to_nftarr(control_info.lan_global_proxy_ipv4_ips) }} counter goto homeproxy_mangle_tproxy_port
{% if (nftarr.lan_global_proxy_ipv4_ips): %}
ip saddr {{ nftarr.lan_global_proxy_ipv4_ips }} counter goto homeproxy_mangle_tproxy_port
{% endif /* lan_global_proxy_ipv4_ips */ %}
{% if (!isEmpty(control_info.lan_global_proxy_ipv6_ips)): %}
ip6 saddr {{ ipv6_to_nftarr(control_info.lan_global_proxy_ipv6_ips) }} counter goto homeproxy_mangle_tproxy_port
{% if (nftarr.lan_global_proxy_ipv6_ips): %}
ip6 saddr {{ nftarr.lan_global_proxy_ipv6_ips }} counter goto homeproxy_mangle_tproxy_port
{% endif /* lan_global_proxy_ipv6_ips */ %}
{% if (!isEmpty(control_info.lan_global_proxy_mac_addrs)): %}
ether saddr {{ mac_to_nftarr(control_info.lan_global_proxy_mac_addrs) }} counter goto homeproxy_mangle_tproxy_port
{% if (nftarr.lan_global_proxy_mac_addrs): %}
ether saddr {{ nftarr.lan_global_proxy_mac_addrs }} counter goto homeproxy_mangle_tproxy_port
{% endif /* lan_global_proxy_mac_addrs */ %}
{% endif /* routing_mode */ %}
@@ -727,15 +846,11 @@ chain homeproxy_mangle_prerouting {
{% if (v6_handled): %}
ip6 daddr != @homeproxy_gfw_list_v6 counter return
{% endif /* v6_handled */ %}
udp dport { 80, 443 } counter reject comment "!{{ cfgname }}: Block QUIC (not proxyable)"
{% elif (routing_mode === 'bypass_mainland_china' || bypass_cn_traffic === '1'): %}
ip daddr @homeproxy_mainland_addr_v4 counter return
{% if (v6_handled): %}
ip6 daddr @homeproxy_mainland_addr_v6 counter return
{% endif /* v6_handled */ %}
{% if (routing_mode !== 'custom'): %}
udp dport { 80, 443 } counter reject comment "!{{ cfgname }}: Block QUIC (not proxyable)"
{% endif /* routing_mode */ %}
{% elif (routing_mode === 'proxy_mainland_china'): %}
ip daddr != @homeproxy_mainland_addr_v4 counter return
{% if (v6_handled): %}
@@ -743,14 +858,14 @@ chain homeproxy_mangle_prerouting {
{% endif /* v6_handled */ %}
{% endif /* routing_mode */ %}
{% if (!isEmpty(control_info.lan_gaming_mode_ipv4_ips)): %}
ip saddr {{ ipv4_to_nftarr(control_info.lan_gaming_mode_ipv4_ips) }} counter goto homeproxy_mangle_tproxy
{% if (nftarr.lan_gaming_mode_ipv4_ips): %}
ip saddr {{ nftarr.lan_gaming_mode_ipv4_ips }} counter goto homeproxy_mangle_tproxy
{% endif /* lan_gaming_mode_ipv4_ips */ %}
{% if (!isEmpty(control_info.lan_gaming_mode_ipv6_ips)): %}
ip6 saddr {{ ipv6_to_nftarr(control_info.lan_gaming_mode_ipv6_ips) }} counter goto homeproxy_mangle_tproxy
{% if (nftarr.lan_gaming_mode_ipv6_ips): %}
ip6 saddr {{ nftarr.lan_gaming_mode_ipv6_ips }} counter goto homeproxy_mangle_tproxy
{% endif /* lan_gaming_mode_ipv6_ips */ %}
{% if (!isEmpty(control_info.lan_gaming_mode_mac_addrs)): %}
ether saddr {{ mac_to_nftarr(control_info.lan_gaming_mode_mac_addrs) }} counter goto homeproxy_mangle_tproxy
{% if (nftarr.lan_gaming_mode_mac_addrs): %}
ether saddr {{ nftarr.lan_gaming_mode_mac_addrs }} counter goto homeproxy_mangle_tproxy
{% endif /* lan_gaming_mode_mac_addrs */ %}
counter goto homeproxy_mangle_tproxy_port
@@ -816,29 +931,31 @@ chain homeproxy_mangle_lanac {
iifname {{ tun_name }} counter return
udp dport 53 counter return
{% if (control_info.listen_interfaces): %}
meta iifname != {{ iface_to_nftarr(control_info.listen_interfaces) }} counter return
{% if (nftarr.listen_interfaces): %}
meta iifname != {{ nftarr.listen_interfaces }} counter return
{% elif (!isEmpty(wan_devices)): %}
meta iifname {{ array_to_nftarr(wan_devices) }} counter return comment "!{{ cfgname }}: not the WAN side"
{% endif %}
{% if (control_info.lan_proxy_mode === 'listed_only'): %}
{% if (!isEmpty(control_info.lan_proxy_ipv4_ips)): %}
ip saddr {{ ipv4_to_nftarr(control_info.lan_proxy_ipv4_ips) }} counter goto homeproxy_mangle_tun
{% if (nftarr.lan_proxy_ipv4_ips): %}
ip saddr {{ nftarr.lan_proxy_ipv4_ips }} counter goto homeproxy_mangle_tun
{% endif /* lan_proxy_ipv4_ips */ %}
{% if (!isEmpty(control_info.lan_proxy_ipv6_ips)): %}
ip6 saddr {{ ipv6_to_nftarr(control_info.lan_proxy_ipv6_ips) }} counter goto homeproxy_mangle_tun
{% if (nftarr.lan_proxy_ipv6_ips): %}
ip6 saddr {{ nftarr.lan_proxy_ipv6_ips }} counter goto homeproxy_mangle_tun
{% endif /* lan_proxy_ipv6_ips */ %}
{% if (!isEmpty(control_info.lan_proxy_mac_addrs)): %}
ether saddr {{ mac_to_nftarr(control_info.lan_proxy_mac_addrs) }} counter goto homeproxy_mangle_tun
{% if (nftarr.lan_proxy_mac_addrs): %}
ether saddr {{ nftarr.lan_proxy_mac_addrs }} counter goto homeproxy_mangle_tun
{% endif /* lan_proxy_mac_addrs */ %}
{% elif (control_info.lan_proxy_mode === 'except_listed'): %}
{% if (!isEmpty(control_info.lan_direct_ipv4_ips)): %}
ip saddr {{ ipv4_to_nftarr(control_info.lan_direct_ipv4_ips) }} counter return
{% if (nftarr.lan_direct_ipv4_ips): %}
ip saddr {{ nftarr.lan_direct_ipv4_ips }} counter return
{% endif /* lan_direct_ipv4_ips */ %}
{% if (!isEmpty(control_info.lan_direct_ipv6_ips)): %}
ip6 saddr {{ ipv6_to_nftarr(control_info.lan_direct_ipv6_ips) }} counter return
{% if (nftarr.lan_direct_ipv6_ips): %}
ip6 saddr {{ nftarr.lan_direct_ipv6_ips }} counter return
{% endif /* lan_direct_ipv6_ips */ %}
{% if (!isEmpty(control_info.lan_direct_mac_addrs)): %}
ether saddr {{ mac_to_nftarr(control_info.lan_direct_mac_addrs) }} counter return
{% if (nftarr.lan_direct_mac_addrs): %}
ether saddr {{ nftarr.lan_direct_mac_addrs }} counter return
{% endif /* lan_direct_mac_addrs */ %}
{% endif /* lan_proxy_mode */ %}
@@ -848,7 +965,7 @@ chain homeproxy_mangle_lanac {
}
chain homeproxy_mangle_tun_mark {
{% if (routing_port): %}
{% if (routing_port_set): %}
{% if (proxy_mode === 'tun'): %}
tcp dport != @homeproxy_routing_port counter return
{% endif /* proxy_mode */ %}
@@ -860,6 +977,16 @@ chain homeproxy_mangle_tun_mark {
chain homeproxy_mangle_tun {
iifname {{ tun_name }} counter return
{% if (tun_self_mark): %}
meta mark {{ tun_self_mark }} counter return comment "!{{ cfgname }}: sing-box's own traffic"
{% endif %}
{% if (node_protect): %}
ip daddr @homeproxy_node_addr_v4 counter return comment "!{{ cfgname }}: node address"
{% endif %}
{% if (node_protect && v6_handled): %}
ip6 daddr @homeproxy_node_addr_v6 counter return comment "!{{ cfgname }}: node address"
{% endif %}
ip daddr @homeproxy_wan_proxy_addr_v4 counter goto homeproxy_mangle_tun_mark
{% if (v6_handled): %}
@@ -872,22 +999,22 @@ chain homeproxy_mangle_tun {
{% endif %}
{% if (routing_mode !== 'custom'): %}
{% if (!isEmpty(control_info.lan_global_proxy_ipv4_ips)): %}
ip saddr {{ ipv4_to_nftarr(control_info.lan_global_proxy_ipv4_ips) }} counter goto homeproxy_mangle_tun_mark
{% if (nftarr.lan_global_proxy_ipv4_ips): %}
ip saddr {{ nftarr.lan_global_proxy_ipv4_ips }} counter goto homeproxy_mangle_tun_mark
{% endif /* lan_global_proxy_ipv4_ips */ %}
{% if (!isEmpty(control_info.lan_global_proxy_ipv6_ips)): %}
ip6 saddr {{ ipv6_to_nftarr(control_info.lan_global_proxy_ipv6_ips) }} counter goto homeproxy_mangle_tun_mark
{% if (nftarr.lan_global_proxy_ipv6_ips): %}
ip6 saddr {{ nftarr.lan_global_proxy_ipv6_ips }} counter goto homeproxy_mangle_tun_mark
{% endif /* lan_global_proxy_ipv6_ips */ %}
{% if (!isEmpty(control_info.lan_global_proxy_mac_addrs)): %}
ether saddr {{ mac_to_nftarr(control_info.lan_global_proxy_mac_addrs) }} counter goto homeproxy_mangle_tun_mark
{% if (nftarr.lan_global_proxy_mac_addrs): %}
ether saddr {{ nftarr.lan_global_proxy_mac_addrs }} counter goto homeproxy_mangle_tun_mark
{% endif /* lan_global_proxy_mac_addrs */ %}
{% endif /* routing_mode */ %}
{% if (control_info.wan_direct_ipv4_ips): %}
ip daddr {{ ipv4_to_nftarr(control_info.wan_direct_ipv4_ips) }} counter return
{% if (nftarr.wan_direct_ipv4_ips): %}
ip daddr {{ nftarr.wan_direct_ipv4_ips }} counter return
{% endif /* wan_direct_ipv4_ips */ %}
{% if (control_info.wan_direct_ipv6_ips): %}
ip6 daddr {{ ipv6_to_nftarr(control_info.wan_direct_ipv6_ips) }} counter return
{% if (nftarr.wan_direct_ipv6_ips): %}
ip6 daddr {{ nftarr.wan_direct_ipv6_ips }} counter return
{% endif /* wan_direct_ipv6_ips */ %}
{% if (routing_mode === 'gfwlist' && dnsmasq_nftset()): %}
@@ -895,15 +1022,17 @@ chain homeproxy_mangle_tun {
{% if (v6_handled): %}
ip6 daddr != @homeproxy_gfw_list_v6 counter return
{% endif /* v6_handled */ %}
{% if (!udp_proxyable): %}
udp dport { 80, 443 } counter reject comment "!{{ cfgname }}: Block QUIC (not proxyable)"
{% endif /* udp_proxyable */ %}
{% elif (routing_mode === 'bypass_mainland_china' || bypass_cn_traffic === '1'): %}
ip daddr @homeproxy_mainland_addr_v4 counter return
{% if (v6_handled): %}
ip6 daddr @homeproxy_mainland_addr_v6 counter return
{% endif /* v6_handled */ %}
{% if (routing_mode !== 'custom'): %}
{% if (!udp_proxyable): %}
udp dport { 80, 443 } counter reject comment "!{{ cfgname }}: Block QUIC (not proxyable)"
{% endif /* routing_mode */ %}
{% endif /* udp_proxyable */ %}
{% elif (routing_mode === 'proxy_mainland_china'): %}
ip daddr != @homeproxy_mainland_addr_v4 counter return
{% if (v6_handled): %}
@@ -911,14 +1040,14 @@ chain homeproxy_mangle_tun {
{% endif /* v6_handled */ %}
{% endif /* routing_mode */ %}
{% if (!isEmpty(control_info.lan_gaming_mode_ipv4_ips)): %}
ip saddr {{ ipv4_to_nftarr(control_info.lan_gaming_mode_ipv4_ips) }} counter meta mark set {{ tun_mark }}
{% if (nftarr.lan_gaming_mode_ipv4_ips): %}
ip saddr {{ nftarr.lan_gaming_mode_ipv4_ips }} counter meta mark set {{ tun_mark }}
{% endif /* lan_gaming_mode_ipv4_ips */ %}
{% if (!isEmpty(control_info.lan_gaming_mode_ipv6_ips)): %}
ip6 saddr {{ ipv6_to_nftarr(control_info.lan_gaming_mode_ipv6_ips) }} counter meta mark set {{ tun_mark }}
{% if (nftarr.lan_gaming_mode_ipv6_ips): %}
ip6 saddr {{ nftarr.lan_gaming_mode_ipv6_ips }} counter meta mark set {{ tun_mark }}
{% endif /* lan_gaming_mode_ipv6_ips */ %}
{% if (!isEmpty(control_info.lan_gaming_mode_mac_addrs)): %}
ether saddr {{ mac_to_nftarr(control_info.lan_gaming_mode_mac_addrs) }} counter meta mark set {{ tun_mark }}
{% if (nftarr.lan_gaming_mode_mac_addrs): %}
ether saddr {{ nftarr.lan_gaming_mode_mac_addrs }} counter meta mark set {{ tun_mark }}
{% endif /* lan_gaming_mode_mac_addrs */ %}
counter goto homeproxy_mangle_tun_mark