mirror of
https://github.com/kiddin9/op-packages.git
synced 2026-09-10 18:34:18 +08:00
🎨 Sync 2026-08-09 00:31:16
This commit is contained in:
github-actions[bot]
@@ -59,51 +59,6 @@ config global_subscribe
|
||||
|
||||
config global_singbox
|
||||
|
||||
config shunt_rules 'China'
|
||||
option remarks 'China'
|
||||
option network 'tcp,udp'
|
||||
option domain_list 'geosite:cn'
|
||||
option ip_list 'geoip:cn'
|
||||
|
||||
config shunt_rules 'Iran'
|
||||
option remarks 'Iran'
|
||||
option network 'tcp,udp'
|
||||
option domain_list 'geosite:ir
|
||||
#rule-set:remote:https://raw.githubusercontent.com/Chocolate4U/Iran-sing-box-rules/rule-set/geosite-ir.srs'
|
||||
option ip_list 'geoip:ir
|
||||
#rule-set:remote:https://raw.githubusercontent.com/Chocolate4U/Iran-sing-box-rules/rule-set/geoip-ir.srs'
|
||||
|
||||
config shunt_rules 'Russia_Block'
|
||||
option remarks 'Russia_Block'
|
||||
option network 'tcp,udp'
|
||||
option domain_list 'geosite:ru-blocked
|
||||
#rule-set:remote:https://raw.githubusercontent.com/runetfreedom/russia-v2ray-rules-dat/refs/heads/release/sing-box/rule-set-geosite/geosite-ru-blocked.srs'
|
||||
option ip_list 'geoip:ru-blocked
|
||||
#rule-set:remote:https://raw.githubusercontent.com/runetfreedom/russia-v2ray-rules-dat/refs/heads/release/sing-box/rule-set-geoip/geoip-ru-blocked.srs'
|
||||
|
||||
config shunt_rules 'Russia'
|
||||
option remarks 'Russia'
|
||||
option network 'tcp,udp'
|
||||
option ip_list 'geoip:ru
|
||||
#rule-set:remote:https://raw.githubusercontent.com/runetfreedom/russia-v2ray-rules-dat/refs/heads/release/sing-box/rule-set-geoip/geoip-ru.srs'
|
||||
|
||||
config shunt_rules 'PrivateIP'
|
||||
option remarks 'PrivateIP'
|
||||
option network 'tcp,udp'
|
||||
option ip_list '10.0.0.0/8
|
||||
127.0.0.0/8
|
||||
198.51.100.0/24
|
||||
192.0.0.0/24
|
||||
169.254.0.0/16
|
||||
224.0.0.0/3
|
||||
192.168.0.0/16
|
||||
192.88.99.0/24
|
||||
100.64.0.0/10
|
||||
172.16.0.0/12
|
||||
0.0.0.0/8
|
||||
192.0.2.0/24
|
||||
203.0.113.0/24'
|
||||
|
||||
config nodes 'examplenode'
|
||||
option remarks 'Example'
|
||||
option type 'Xray'
|
||||
@@ -126,3 +81,151 @@ config nodes 'rulenode'
|
||||
option domainMatcher 'hybrid'
|
||||
option write_ipset_direct '1'
|
||||
option enable_geoview_ip '1'
|
||||
option shunt_group 'CN'
|
||||
|
||||
config shunt_rules 'DirectFront'
|
||||
option remarks 'DirectFront'
|
||||
option network 'tcp,udp'
|
||||
option domain_list 'domain:ip233.cn'
|
||||
option group 'CN'
|
||||
|
||||
config shunt_rules 'ProxyFront'
|
||||
option remarks 'ProxyFront'
|
||||
option network 'tcp,udp'
|
||||
option domain_list 'domain:www.gstatic.com
|
||||
domain:ssl.gstatic.com
|
||||
domain:fonts.gstatic.com'
|
||||
option group 'CN'
|
||||
|
||||
config shunt_rules 'DirectGame'
|
||||
option remarks 'DirectGame'
|
||||
option domain_list '# steam直连域名获取国内CDN走国内线路下载
|
||||
cm.steampowered.com
|
||||
steamserver.net
|
||||
|
||||
# steam国内CDN华为云
|
||||
steampipe.steamcontent.tnkjmec.com
|
||||
# steam国内CDN白山云
|
||||
st.dl.eccdnx.com
|
||||
st.dl.bscstorage.net
|
||||
st.dl.pinyuncloud.com
|
||||
# steam国内CDN新流云(原金山云)(支持ipv6)
|
||||
dl.steam.clngaa.com
|
||||
# steam国内CDN网宿
|
||||
cdn.mileweb.cs.steampowered.com.8686c.com
|
||||
cdn-ws.content.steamchina.com
|
||||
# steam国内CDN腾讯云 (蒸汽中国独占)
|
||||
cdn-qc.content.steamchina.com
|
||||
# steam国内CDN阿里云(支持ipv6)
|
||||
cdn-ali.content.steamchina.com
|
||||
xz.pphimalayanrt.com
|
||||
lv.queniujq.cn
|
||||
alibaba.cdn.steampipe.steamcontent.com
|
||||
|
||||
# 国内游戏geosite域名
|
||||
geosite:category-games@cn'
|
||||
option ip_list '# steam直连IP
|
||||
45.121.184.0/24
|
||||
103.10.124.0/23
|
||||
103.28.54.0/24
|
||||
146.66.152.0/24
|
||||
146.66.155.0/24
|
||||
153.254.86.0/24
|
||||
155.133.224.0/22
|
||||
155.133.230.0/24
|
||||
155.133.232.0/23
|
||||
155.133.234.0/24
|
||||
155.133.236.0/22
|
||||
155.133.240.0/23
|
||||
155.133.244.0/23
|
||||
155.133.246.0/24
|
||||
155.133.248.0/21
|
||||
162.254.192.0/21
|
||||
185.25.182.0/23
|
||||
190.217.32.0/22
|
||||
192.69.96.0/22
|
||||
205.196.6.0/24
|
||||
208.64.200.0/22
|
||||
208.78.164.0/22
|
||||
205.185.194.0/24'
|
||||
option network 'tcp,udp'
|
||||
option group 'CN'
|
||||
|
||||
config shunt_rules 'ProxyGame'
|
||||
option remarks 'ProxyGame'
|
||||
option domain_list '# steam 商店/客服/聊天/网页布局/API/二维码/Google云同步 代理URL
|
||||
steamcommunity.com
|
||||
www.steamcommunity.com
|
||||
store.steampowered.com
|
||||
checkout.steampowered.com
|
||||
api.steampowered.com
|
||||
help.steampowered.com
|
||||
login.steampowered.com
|
||||
store.akamai.steamstatic.com
|
||||
steambroadcast.akamaized.net
|
||||
steamvideo-a.akamaihd.net
|
||||
steamusercontent-a.akamaihd.net
|
||||
steamstore-a.akamaihd.net
|
||||
steamcommunity-a.akamaihd.net
|
||||
steamcdn-a.akamaihd.net
|
||||
steamuserimages-a.akamaihd.net
|
||||
community.akamai.steamstatic.com
|
||||
avatars.akamai.steamstatic.com
|
||||
community.steamstatic.com
|
||||
cdn.akamai.steamstatic.com
|
||||
avatars.steamstatic.com
|
||||
shared.akamai.steamstatic.com
|
||||
clan.akamai.steamstatic.com
|
||||
cdn.cloudflare.steamstatic.com
|
||||
community.cloudflare.steamstatic.com
|
||||
store.cloudflare.steamstatic.com
|
||||
avatars.cloudflare.steamstatic.com
|
||||
clan.cloudflare.steamstatic.com
|
||||
shared.cloudflare.steamstatic.com
|
||||
steam-chat.com
|
||||
steamcloud-ugc.storage.googleapis.com
|
||||
steamcloud-eu-ams.storage.googleapis.com
|
||||
steamcloud-eu-fra.storage.googleapis.com
|
||||
steamcloud-finland.storage.googleapis.com
|
||||
steamcloud-saopaulo.storage.googleapis.com
|
||||
steamcloud-singapore.storage.googleapis.com
|
||||
steamcloud-sydney.storage.googleapis.com
|
||||
steamcloud-taiwan.storage.googleapis.com
|
||||
steamcloud-eu.storage.googleapis.com
|
||||
domain:blizzard.com
|
||||
geosite:category-games'
|
||||
option network 'tcp,udp'
|
||||
option group 'CN'
|
||||
|
||||
config shunt_rules 'CN'
|
||||
option remarks 'CN'
|
||||
option domain_list 'geosite:cn'
|
||||
option ip_list 'geoip:cn'
|
||||
option network 'tcp,udp'
|
||||
option group 'CN'
|
||||
|
||||
config shunt_rules 'Iran'
|
||||
option remarks 'Iran'
|
||||
option network 'tcp,udp'
|
||||
option domain_list 'geosite:ir
|
||||
#rule-set:remote:https://raw.githubusercontent.com/Chocolate4U/Iran-sing-box-rules/rule-set/geosite-ir.srs'
|
||||
option ip_list 'geoip:ir
|
||||
#rule-set:remote:https://raw.githubusercontent.com/Chocolate4U/Iran-sing-box-rules/rule-set/geoip-ir.srs'
|
||||
option group 'IR'
|
||||
|
||||
config shunt_rules 'Russia_Block'
|
||||
option remarks 'Russia_Block'
|
||||
option network 'tcp,udp'
|
||||
option domain_list 'geosite:ru-blocked
|
||||
#rule-set:remote:https://raw.githubusercontent.com/runetfreedom/russia-v2ray-rules-dat/refs/heads/release/sing-box/rule-set-geosite/geosite-ru-blocked.srs'
|
||||
option ip_list 'geoip:ru-blocked
|
||||
#rule-set:remote:https://raw.githubusercontent.com/runetfreedom/russia-v2ray-rules-dat/refs/heads/release/sing-box/rule-set-geoip/geoip-ru-blocked.srs'
|
||||
option group 'RU'
|
||||
|
||||
config shunt_rules 'Russia'
|
||||
option remarks 'Russia'
|
||||
option network 'tcp,udp'
|
||||
option ip_list 'geoip:ru
|
||||
#rule-set:remote:https://raw.githubusercontent.com/runetfreedom/russia-v2ray-rules-dat/refs/heads/release/sing-box/rule-set-geoip/geoip-ru.srs'
|
||||
option group 'RU'
|
||||
|
||||
|
||||
@@ -419,7 +419,7 @@ run_socks() {
|
||||
json_add_string "logfile" "${log_file}"
|
||||
}
|
||||
[ -n "$no_run" ] && json_add_string "no_run" "1"
|
||||
json_add_string "flag" "SOCKS_${flag}"
|
||||
json_add_string "flag" "${flag}"
|
||||
json_add_string "local_socks_address" "${bind}"
|
||||
json_add_string "local_socks_port" "${socks_port}"
|
||||
json_add_string "direct_dns_udp_port" "${DIRECT_DNS_UDP_PORT}"
|
||||
@@ -441,7 +441,7 @@ run_socks() {
|
||||
json_add_null "server_port"
|
||||
}
|
||||
[ -n "$no_run" ] && json_add_string "no_run" "1"
|
||||
json_add_string "flag" "SOCKS_${flag}"
|
||||
json_add_string "flag" "${flag}"
|
||||
json_add_string "local_socks_address" "${bind}"
|
||||
json_add_string "local_socks_port" "${socks_port}"
|
||||
json_add_string "direct_dns_udp_port" "${DIRECT_DNS_UDP_PORT}"
|
||||
@@ -535,13 +535,13 @@ socks_node_switch() {
|
||||
local prefix pf filename
|
||||
# Kill the SS plugin process
|
||||
for prefix in "" "HTTP_"; do
|
||||
pf="$TMP_PATH/${prefix}SOCKS_${flag}_plugin.pid"
|
||||
pf="$TMP_PATH/${prefix}${flag}_plugin.pid"
|
||||
[ -s "$pf" ] && kill -9 "$(head -n1 "$pf")" >/dev/null 2>&1
|
||||
done
|
||||
|
||||
busybox pgrep -af "$TMP_BIN_PATH" | awk -v P1="${flag}" 'BEGIN{IGNORECASE=1}$0~P1 && !/acl\/|acl_/{print $1}' | xargs kill -9 >/dev/null 2>&1
|
||||
for prefix in "" "HTTP_" "HTTP2"; do
|
||||
rm -rf "$TMP_PATH/${prefix}SOCKS_${flag}"*
|
||||
rm -rf "$TMP_PATH/${prefix}${flag}"*
|
||||
done
|
||||
|
||||
for filename in $(ls ${TMP_SCRIPT_FUNC_PATH}); do
|
||||
@@ -552,15 +552,15 @@ socks_node_switch() {
|
||||
local bind="0.0.0.0"
|
||||
[ "$bind_local" = "1" ] && bind="127.0.0.1"
|
||||
local port=$(config_n_get $flag port)
|
||||
local config_file="SOCKS_${flag}.json"
|
||||
local log_file="SOCKS_${flag}.log"
|
||||
local config_file="${flag}.json"
|
||||
local log_file="${flag}.log"
|
||||
local log=$(config_n_get $flag log 1)
|
||||
[ "$log" == "0" ] && log_file=""
|
||||
local http_port=$(config_n_get $flag http_port 0)
|
||||
local http_config_file="HTTP2SOCKS_${flag}.json"
|
||||
LOG_FILE="/dev/null"
|
||||
run_socks flag=$flag node=$new_node bind=$bind socks_port=$port config_file=$config_file http_port=$http_port http_config_file=$http_config_file log_file=$log_file
|
||||
set_cache_var "socks_${flag}" "$new_node"
|
||||
set_cache_var "${flag}" "$new_node"
|
||||
local USE_TABLES=$(get_cache_var "USE_TABLES")
|
||||
[ -n "$USE_TABLES" ] && source $APP_PATH/${USE_TABLES}.sh filter_direct_node_list
|
||||
}
|
||||
@@ -764,14 +764,14 @@ start_socks() {
|
||||
local bind="0.0.0.0"
|
||||
[ "$bind_local" = "1" ] && bind="127.0.0.1"
|
||||
local port=$(config_n_get $id port)
|
||||
local config_file="SOCKS_${id}.json"
|
||||
local log_file="SOCKS_${id}.log"
|
||||
local config_file="${id}.json"
|
||||
local log_file="${id}.log"
|
||||
local log=$(config_n_get $id log 1)
|
||||
[ "$log" == "0" ] && log_file=""
|
||||
local http_port=$(config_n_get $id http_port 0)
|
||||
local http_config_file="HTTP2SOCKS_${id}.json"
|
||||
run_socks flag=$id node=$node bind=$bind socks_port=$port config_file=$config_file http_port=$http_port http_config_file=$http_config_file log_file=$log_file
|
||||
set_cache_var "socks_${id}" "$node"
|
||||
set_cache_var "${id}" "$node"
|
||||
|
||||
# Auto switch logic
|
||||
local enable_autoswitch=$(config_n_get $id enable_autoswitch 0)
|
||||
@@ -869,10 +869,9 @@ start_crontab() {
|
||||
for item in $(uci show ${CONFIG} | grep "=subscribe_list" | cut -d '.' -sf 2 | cut -d '=' -sf 1); do
|
||||
sub_update_week_mode=$(config_n_get $item update_week_mode)
|
||||
if [ -n "$sub_update_week_mode" ]; then
|
||||
cfgid=$(uci show ${CONFIG}.$item | head -n 1 | cut -d '.' -sf 2 | cut -d '=' -sf 1)
|
||||
remark=$(config_n_get $item remark)
|
||||
sub_update_time_mode=$(config_n_get $item update_time_mode)
|
||||
echo "$cfgid" >> $TMP_SUB_PATH/${sub_update_week_mode}_${sub_update_time_mode}
|
||||
echo "$item" >> $TMP_SUB_PATH/${sub_update_week_mode}_${sub_update_time_mode}
|
||||
log_i18n 0 "Scheduled tasks: Auto update [%s] subscription." "${remark}"
|
||||
fi
|
||||
done
|
||||
@@ -1010,22 +1009,26 @@ run_ipset_dnsmasq() {
|
||||
|
||||
acl_app() {
|
||||
local items=$(uci show ${CONFIG} | grep "=acl_rule" | cut -d '.' -sf 2 | cut -d '=' -sf 1)
|
||||
[ -n "$items" ] && {
|
||||
if [ -z "$items" ]; then
|
||||
ENABLED_ACLS=0
|
||||
return
|
||||
else
|
||||
local has_enabled
|
||||
local index=0
|
||||
local item
|
||||
local sid
|
||||
local redir_port dns_port dnsmasq_port socks_port
|
||||
local ipt_tmp msg msg2
|
||||
redir_port=11200
|
||||
socks_port=11600
|
||||
dns_port=11300
|
||||
dnsmasq_port=${GLOBAL_DNSMASQ_PORT:-11400}
|
||||
for item in $items; do
|
||||
for sid in $items; do
|
||||
index=$(expr $index + 1)
|
||||
local enabled sid remarks sources interface tcp_no_redir_ports udp_no_redir_ports node direct_dns_query_strategy remote_dns_protocol remote_dns remote_dns_doh remote_dns_client_ip remote_dns_detour remote_fakedns remote_dns_query_strategy log loglevel log_file
|
||||
local _ip _mac _iprange _ipset _ip_or_mac source_list config_file
|
||||
local sid=$(uci -q show "${CONFIG}.${item}" | grep "=acl_rule" | awk -F '=' '{print $1}' | awk -F '.' '{print $2}')
|
||||
[ "$(config_n_get $sid enabled)" = "1" ] || continue
|
||||
eval $(uci -q show "${CONFIG}.${item}" | cut -d'.' -sf 3-)
|
||||
has_enabled=1
|
||||
eval $(uci -q show "${CONFIG}.${sid}" | cut -d'.' -sf 3-)
|
||||
log=${log:-0}
|
||||
loglevel=${loglevel:-warn}
|
||||
log_file="/dev/null"
|
||||
@@ -1150,7 +1153,8 @@ acl_app() {
|
||||
unset _ip _mac _iprange _ipset _ip_or_mac source_list config_file
|
||||
done
|
||||
unset redir_port dns_port dnsmasq_port
|
||||
}
|
||||
[ -n "${has_enabled}" ] || ENABLED_ACLS=0
|
||||
fi
|
||||
}
|
||||
|
||||
start() {
|
||||
@@ -1209,8 +1213,7 @@ start() {
|
||||
local cfgids item
|
||||
for item in $(uci show ${CONFIG} | grep "=subscribe_list" | cut -d '.' -sf 2 | cut -d '=' -sf 1); do
|
||||
if [ "$(config_n_get "$item" boot_update 0)" = "1" ]; then
|
||||
local cfgid=$(uci show ${CONFIG}.$item | head -n 1 | cut -d '.' -sf 2 | cut -d '=' -sf 1)
|
||||
cfgids="${cfgids:+$cfgids,}$cfgid"
|
||||
cfgids="${cfgids:+$cfgids,}$item"
|
||||
fi
|
||||
done
|
||||
[ -n "$cfgids" ] && {
|
||||
@@ -1298,9 +1301,6 @@ get_config() {
|
||||
[ -n "$NODE" ] && [ "$(config_get_type $NODE)" == "nodes" ] && ENABLED_DEFAULT_ACL=1
|
||||
}
|
||||
ENABLED_ACLS=$(config_t_get global acl_enable 0)
|
||||
[ "$ENABLED_ACLS" == 1 ] && {
|
||||
[ "$(uci show ${CONFIG} | grep "@acl_rule" | grep "enabled='1'" | wc -l)" == 0 ] && ENABLED_ACLS=0
|
||||
}
|
||||
SOCKS_ENABLED=$(config_t_get global socks_enabled 0)
|
||||
REDIR_PORT=$(echo $(get_new_port 1041 tcp,udp))
|
||||
TCP_PROXY_WAY=$(config_t_get global_forwarding tcp_proxy_way redirect)
|
||||
|
||||
@@ -189,7 +189,9 @@ gen_shunt_list() {
|
||||
local default_outbound="redirect"
|
||||
[ "$default_node" = "_direct" ] && default_outbound="direct"
|
||||
local shunt_ids=$(uci show $CONFIG | grep "=shunt_rules" | awk -F '.' '{print $2}' | awk -F '=' '{print $1}')
|
||||
local shunt_group=$(config_n_get $node shunt_group)
|
||||
for shunt_id in $shunt_ids; do
|
||||
[ "${shunt_group}" != "$(config_n_get ${shunt_id} group)" ] && continue
|
||||
local shunt_node=$(config_n_get ${node} "${shunt_id}")
|
||||
[ -n "$shunt_node" ] && {
|
||||
local ipset_v4="psw2_${node}_${shunt_id}"
|
||||
@@ -702,15 +704,13 @@ add_firewall_rule() {
|
||||
fi
|
||||
|
||||
$ipt_n -N PSW2
|
||||
$ipt_n -A PSW2 $(dst $IPSET_DIRECT) -j RETURN
|
||||
$ipt_n -A PSW2 $(dst $IPSET_VPS) -j RETURN
|
||||
$ipt_n -A PSW2 $(comment "WAN_IP_RETURN") $(dst $IPSET_WAN) -j RETURN
|
||||
|
||||
[ "$accept_icmp" = "1" ] && insert_rule_after "$ipt_n" "PREROUTING" "prerouting_rule" "-p icmp -j PSW2"
|
||||
[ -z "${is_tproxy}" ] && insert_rule_after "$ipt_n" "PREROUTING" "prerouting_rule" "-p tcp -j PSW2"
|
||||
[ "$accept_icmp" = "1" ] && insert_rule_after "$ipt_n" "PREROUTING" "prerouting_rule" "$(dst $IPSET_DIRECT !) -p icmp -j PSW2"
|
||||
[ -z "${is_tproxy}" ] && insert_rule_after "$ipt_n" "PREROUTING" "prerouting_rule" "$(dst $IPSET_DIRECT !) -p tcp -j PSW2"
|
||||
|
||||
$ipt_n -N PSW2_OUTPUT
|
||||
$ipt_n -A PSW2_OUTPUT $(dst $IPSET_DIRECT) -j RETURN
|
||||
$ipt_n -A PSW2_OUTPUT $(dst $IPSET_VPS) -j RETURN
|
||||
$ipt_n -A PSW2_OUTPUT -m mark --mark 255 -j RETURN
|
||||
|
||||
@@ -722,10 +722,6 @@ add_firewall_rule() {
|
||||
$ipt_n -I PREROUTING -m set --match-set $IPSET_DIRECT src -j PSW2_DNS
|
||||
fi
|
||||
|
||||
$ipt_m -N PSW2_DIVERT
|
||||
$ipt_m -A PSW2_DIVERT -j MARK --set-mark ${FWMARK}
|
||||
$ipt_m -A PSW2_DIVERT -j ACCEPT
|
||||
|
||||
$ipt_m -N PSW2_RULE
|
||||
$ipt_m -A PSW2_RULE -j CONNMARK --restore-mark
|
||||
$ipt_m -A PSW2_RULE -m mark --mark ${FWMARK} -j RETURN
|
||||
@@ -734,17 +730,16 @@ add_firewall_rule() {
|
||||
$ipt_m -A PSW2_RULE -j CONNMARK --save-mark
|
||||
|
||||
$ipt_m -N PSW2
|
||||
$ipt_m -A PSW2 $(dst $IPSET_DIRECT) -j RETURN
|
||||
# Socket Only TCP, UDP Invalid.
|
||||
$ipt_m -A PSW2 -p tcp -m socket -j MARK --set-mark ${FWMARK}
|
||||
$ipt_m -A PSW2 -p tcp -m socket -j ACCEPT
|
||||
$ipt_m -A PSW2 $(dst $IPSET_VPS) -j RETURN
|
||||
$ipt_m -A PSW2 $(comment "WAN_IP_RETURN") $(dst $IPSET_WAN) -j RETURN
|
||||
$ipt_m -A PSW2 -m conntrack --ctdir REPLY -j RETURN
|
||||
|
||||
insert_rule_before "$ipt_m" "PREROUTING" "mwan3" "-j PSW2"
|
||||
# Only TCP, UDP Invalid.
|
||||
insert_rule_before "$ipt_m" "PREROUTING" "PSW2" "-p tcp -m socket -j PSW2_DIVERT"
|
||||
insert_rule_before "$ipt_m" "PREROUTING" "mwan3" "$(dst $IPSET_DIRECT !) -j PSW2"
|
||||
|
||||
$ipt_m -N PSW2_OUTPUT
|
||||
$ipt_m -A PSW2_OUTPUT $(dst $IPSET_DIRECT) -j RETURN
|
||||
$ipt_m -A PSW2_OUTPUT $(dst $IPSET_VPS) -j RETURN
|
||||
$ipt_m -A PSW2_OUTPUT -m conntrack --ctdir REPLY -j RETURN
|
||||
$ipt_m -A PSW2_OUTPUT -m mark --mark 255 -j RETURN
|
||||
@@ -754,12 +749,10 @@ add_firewall_rule() {
|
||||
|
||||
[ "$accept_icmpv6" = "1" ] && {
|
||||
$ip6t_n -N PSW2
|
||||
$ip6t_n -A PSW2 $(dst $IPSET_DIRECT6) -j RETURN
|
||||
$ip6t_n -A PSW2 $(dst $IPSET_VPS6) -j RETURN
|
||||
$ip6t_n -A PREROUTING -p ipv6-icmp -j PSW2
|
||||
$ip6t_n -A PREROUTING $(dst $IPSET_DIRECT6 !) -p ipv6-icmp -j PSW2
|
||||
|
||||
$ip6t_n -N PSW2_OUTPUT
|
||||
$ip6t_n -A PSW2_OUTPUT $(dst $IPSET_DIRECT6) -j RETURN
|
||||
$ip6t_n -A PSW2_OUTPUT $(dst $IPSET_VPS6) -j RETURN
|
||||
$ip6t_n -A PSW2_OUTPUT -m mark --mark 255 -j RETURN
|
||||
}
|
||||
@@ -772,10 +765,6 @@ add_firewall_rule() {
|
||||
$ip6t_n -I PREROUTING -m set --match-set $IPSET_DIRECT6 src -j PSW2_DNS
|
||||
fi
|
||||
|
||||
$ip6t_m -N PSW2_DIVERT
|
||||
$ip6t_m -A PSW2_DIVERT -j MARK --set-mark ${FWMARK}
|
||||
$ip6t_m -A PSW2_DIVERT -j ACCEPT
|
||||
|
||||
$ip6t_m -N PSW2_RULE
|
||||
$ip6t_m -A PSW2_RULE -j CONNMARK --restore-mark
|
||||
$ip6t_m -A PSW2_RULE -m mark --mark ${FWMARK} -j RETURN
|
||||
@@ -784,18 +773,17 @@ add_firewall_rule() {
|
||||
$ip6t_m -A PSW2_RULE -j CONNMARK --save-mark
|
||||
|
||||
$ip6t_m -N PSW2
|
||||
$ip6t_m -A PSW2 $(dst $IPSET_DIRECT6) -j RETURN
|
||||
# Socket Only TCP, UDP Invalid.
|
||||
$ip6t_m -A PSW2 -p tcp -m socket -j MARK --set-mark ${FWMARK}
|
||||
$ip6t_m -A PSW2 -p tcp -m socket -j ACCEPT
|
||||
$ip6t_m -A PSW2 $(dst $IPSET_VPS6) -j RETURN
|
||||
$ip6t_m -A PSW2 $(comment "WAN6_IP_RETURN") $(dst $IPSET_WAN6) -j RETURN
|
||||
$ip6t_m -A PSW2 -m conntrack --ctdir REPLY -j RETURN
|
||||
|
||||
insert_rule_before "$ip6t_m" "PREROUTING" "mwan3" "-j PSW2"
|
||||
# Only TCP, UDP Invalid.
|
||||
insert_rule_before "$ip6t_m" "PREROUTING" "PSW2" "-p tcp -m socket -j PSW2_DIVERT"
|
||||
insert_rule_before "$ip6t_m" "PREROUTING" "mwan3" "$(dst $IPSET_DIRECT6 !) -j PSW2"
|
||||
|
||||
$ip6t_m -N PSW2_OUTPUT
|
||||
$ip6t_m -A PSW2_OUTPUT -m mark --mark 255 -j RETURN
|
||||
$ip6t_m -A PSW2_OUTPUT $(dst $IPSET_DIRECT6) -j RETURN
|
||||
$ip6t_m -A PSW2_OUTPUT $(dst $IPSET_VPS6) -j RETURN
|
||||
$ip6t_m -A PSW2_OUTPUT -m conntrack --ctdir REPLY -j RETURN
|
||||
|
||||
@@ -860,14 +848,14 @@ add_firewall_rule() {
|
||||
# Loading local router proxy TCP
|
||||
if [ -n "$NODE" ] && [ "$TCP_LOCALHOST_PROXY" = "1" ]; then
|
||||
[ "$accept_icmp" = "1" ] && {
|
||||
$ipt_n -A OUTPUT -p icmp -j PSW2_OUTPUT
|
||||
$ipt_n -A OUTPUT $(dst $IPSET_DIRECT !) -p icmp -j PSW2_OUTPUT
|
||||
$ipt_n -A PSW2_OUTPUT -p icmp -d $FAKE_IP $(REDIRECT)
|
||||
add_shunt_t_rule "${SHUNT_LIST4}" "$ipt_n -A PSW2_OUTPUT -p icmp" "$(REDIRECT)"
|
||||
$ipt_n -A PSW2_OUTPUT -p icmp $(REDIRECT)
|
||||
}
|
||||
|
||||
[ "$accept_icmpv6" = "1" ] && {
|
||||
$ip6t_n -A OUTPUT -p ipv6-icmp -j PSW2_OUTPUT
|
||||
$ip6t_n -A OUTPUT $(dst $IPSET_DIRECT6 !) -p ipv6-icmp -j PSW2_OUTPUT
|
||||
$ip6t_n -A PSW2_OUTPUT -p ipv6-icmp -d $FAKE_IP_6 $(REDIRECT)
|
||||
add_shunt_t_rule "${SHUNT_LIST6}" "$ip6t_n -A PSW2_OUTPUT -p ipv6-icmp" "$(REDIRECT)"
|
||||
$ip6t_n -A PSW2_OUTPUT -p ipv6-icmp $(REDIRECT)
|
||||
@@ -882,11 +870,11 @@ add_firewall_rule() {
|
||||
$ipt_tmp -A PSW2_OUTPUT -p tcp -d $FAKE_IP ${ipt_j}
|
||||
add_shunt_t_rule "${SHUNT_LIST4}" "$ipt_tmp -A PSW2_OUTPUT -p tcp" "${ipt_j}" $TCP_REDIR_PORTS
|
||||
add_port_rules "$ipt_tmp -A PSW2_OUTPUT -p tcp" $TCP_REDIR_PORTS "${ipt_j}"
|
||||
[ -z "${is_tproxy}" ] && $ipt_n -A OUTPUT -p tcp -j PSW2_OUTPUT
|
||||
[ -z "${is_tproxy}" ] && $ipt_n -A OUTPUT $(dst $IPSET_DIRECT !) -p tcp -j PSW2_OUTPUT
|
||||
[ -n "${is_tproxy}" ] && {
|
||||
$ipt_m -A PSW2 $(comment "${comment_l}") -p tcp -i lo $(REDIRECT $REDIR_PORT TPROXY)
|
||||
$ipt_m -A PSW2 $(comment "${comment_l}") -p tcp -i lo -j RETURN
|
||||
insert_rule_before "$ipt_m" "OUTPUT" "mwan3" "$(comment mangle-OUTPUT-PSW2) -p tcp -j PSW2_OUTPUT"
|
||||
insert_rule_before "$ipt_m" "OUTPUT" "mwan3" "$(comment mangle-OUTPUT-PSW2) $(dst $IPSET_DIRECT !) -p tcp -j PSW2_OUTPUT"
|
||||
}
|
||||
|
||||
[ "$PROXY_IPV6" == "1" ] && {
|
||||
@@ -895,7 +883,7 @@ add_firewall_rule() {
|
||||
add_port_rules "$ip6t_m -A PSW2_OUTPUT -p tcp" $TCP_REDIR_PORTS "-j PSW2_RULE"
|
||||
$ip6t_m -A PSW2 $(comment "${comment_l}") -p tcp -i lo $(REDIRECT $REDIR_PORT TPROXY)
|
||||
$ip6t_m -A PSW2 $(comment "${comment_l}") -p tcp -i lo -j RETURN
|
||||
insert_rule_before "$ip6t_m" "OUTPUT" "mwan3" "$(comment mangle-OUTPUT-PSW2) -p tcp -j PSW2_OUTPUT"
|
||||
insert_rule_before "$ip6t_m" "OUTPUT" "mwan3" "$(comment mangle-OUTPUT-PSW2) $(dst $IPSET_DIRECT6 !) -p tcp -j PSW2_OUTPUT"
|
||||
}
|
||||
|
||||
[ -d "${TMP_IFACE_PATH}" ] && {
|
||||
@@ -913,7 +901,7 @@ add_firewall_rule() {
|
||||
add_port_rules "$ipt_m -A PSW2_OUTPUT -p udp" $UDP_REDIR_PORTS "-j PSW2_RULE"
|
||||
$ipt_m -A PSW2 $(comment "${comment_l}") -p udp -i lo $(REDIRECT $REDIR_PORT TPROXY)
|
||||
$ipt_m -A PSW2 $(comment "${comment_l}") -p udp -i lo -j RETURN
|
||||
insert_rule_before "$ipt_m" "OUTPUT" "mwan3" "$(comment mangle-OUTPUT-PSW2) -p udp -j PSW2_OUTPUT"
|
||||
insert_rule_before "$ipt_m" "OUTPUT" "mwan3" "$(comment mangle-OUTPUT-PSW2) $(dst $IPSET_DIRECT !) -p udp -j PSW2_OUTPUT"
|
||||
|
||||
[ "$PROXY_IPV6" == "1" ] && {
|
||||
$ip6t_m -A PSW2_OUTPUT -p udp -d $FAKE_IP_6 -j PSW2_RULE
|
||||
@@ -921,7 +909,7 @@ add_firewall_rule() {
|
||||
add_port_rules "$ip6t_m -A PSW2_OUTPUT -p udp" $UDP_REDIR_PORTS "-j PSW2_RULE"
|
||||
$ip6t_m -A PSW2 $(comment "${comment_l}") -p udp -i lo $(REDIRECT $REDIR_PORT TPROXY)
|
||||
$ip6t_m -A PSW2 $(comment "${comment_l}") -p udp -i lo -j RETURN
|
||||
insert_rule_before "$ip6t_m" "OUTPUT" "mwan3" "$(comment mangle-OUTPUT-PSW2) -p udp -j PSW2_OUTPUT"
|
||||
insert_rule_before "$ip6t_m" "OUTPUT" "mwan3" "$(comment mangle-OUTPUT-PSW2) $(dst $IPSET_DIRECT6 !) -p udp -j PSW2_OUTPUT"
|
||||
}
|
||||
|
||||
[ -d "${TMP_IFACE_PATH}" ] && {
|
||||
@@ -938,8 +926,10 @@ add_firewall_rule() {
|
||||
$ip6t_m -I OUTPUT $(comment "mangle-OUTPUT-PSW2") -o lo -j RETURN
|
||||
insert_rule_before "$ip6t_m" "OUTPUT" "mwan3" "$(comment mangle-OUTPUT-PSW2) -m mark --mark ${FWMARK} -j RETURN"
|
||||
|
||||
$ipt_m -A PSW2 -p udp --dport 53 -j RETURN
|
||||
$ip6t_m -A PSW2 -p udp --dport 53 -j RETURN
|
||||
$ipt_m -A PSW2 -p tcp --dport 53 -j ACCEPT
|
||||
$ipt_m -A PSW2 -p udp --dport 53 -j ACCEPT
|
||||
$ip6t_m -A PSW2 -p tcp --dport 53 -j ACCEPT
|
||||
$ip6t_m -A PSW2 -p udp --dport 53 -j ACCEPT
|
||||
}
|
||||
|
||||
load_acl
|
||||
@@ -970,7 +960,7 @@ del_firewall_rule() {
|
||||
$ipt -D $chain $index 2>/dev/null
|
||||
done
|
||||
done
|
||||
for chain in "PSW2" "PSW2_OUTPUT" "PSW2_DIVERT" "PSW2_DNS" "PSW2_RULE"; do
|
||||
for chain in "PSW2" "PSW2_OUTPUT" "PSW2_DNS" "PSW2_RULE"; do
|
||||
$ipt -F $chain 2>/dev/null
|
||||
$ipt -X $chain 2>/dev/null
|
||||
done
|
||||
@@ -1004,7 +994,7 @@ gen_include() {
|
||||
[ -z "${_ipt}" ] && return
|
||||
|
||||
echo "*$2"
|
||||
${_ipt}-save -t $2 | grep "PSW2" | grep -v "\-j PSW2$" | grep -v "socket \-j PSW2_DIVERT$" | sed -e "s/^-A \(OUTPUT\|PREROUTING\)/-I \1 1/"
|
||||
${_ipt}-save -t $2 | grep "PSW2" | grep -v "\-j PSW2$" | sed -e "s/^-A \(OUTPUT\|PREROUTING\)/-I \1 1/"
|
||||
echo 'COMMIT'
|
||||
}
|
||||
local __ipt=""
|
||||
@@ -1017,11 +1007,10 @@ gen_include() {
|
||||
$(extract_rules 4 mangle)
|
||||
EOT
|
||||
|
||||
[ "$accept_icmp" = "1" ] && \$(${MY_PATH} insert_rule_after "$ipt_n" "PREROUTING" "prerouting_rule" "-p icmp -j PSW2")
|
||||
[ -z "${is_tproxy}" ] && \$(${MY_PATH} insert_rule_after "$ipt_n" "PREROUTING" "prerouting_rule" "-p tcp -j PSW2")
|
||||
[ "$accept_icmp" = "1" ] && \$(${MY_PATH} insert_rule_after "$ipt_n" "PREROUTING" "prerouting_rule" "$(dst $IPSET_DIRECT !) -p icmp -j PSW2")
|
||||
[ -z "${is_tproxy}" ] && \$(${MY_PATH} insert_rule_after "$ipt_n" "PREROUTING" "prerouting_rule" "$(dst $IPSET_DIRECT !) -p tcp -j PSW2")
|
||||
|
||||
\$(${MY_PATH} insert_rule_before "$ipt_m" "PREROUTING" "mwan3" "-j PSW2")
|
||||
\$(${MY_PATH} insert_rule_before "$ipt_m" "PREROUTING" "PSW2" "-p tcp -m socket -j PSW2_DIVERT")
|
||||
\$(${MY_PATH} insert_rule_before "$ipt_m" "PREROUTING" "mwan3" "$(dst $IPSET_DIRECT !) -j PSW2")
|
||||
EOF
|
||||
)
|
||||
}
|
||||
@@ -1035,10 +1024,9 @@ gen_include() {
|
||||
$(extract_rules 6 mangle)
|
||||
EOT
|
||||
|
||||
[ "$accept_icmpv6" = "1" ] && $ip6t_n -A PREROUTING -p ipv6-icmp -j PSW2
|
||||
[ "$accept_icmpv6" = "1" ] && $ip6t_n -A PREROUTING $(dst $IPSET_DIRECT6 !) -p ipv6-icmp -j PSW2
|
||||
|
||||
\$(${MY_PATH} insert_rule_before "$ip6t_m" "PREROUTING" "mwan3" "-j PSW2")
|
||||
\$(${MY_PATH} insert_rule_before "$ip6t_m" "PREROUTING" "PSW2" "-p tcp -m socket -j PSW2_DIVERT")
|
||||
\$(${MY_PATH} insert_rule_before "$ip6t_m" "PREROUTING" "mwan3" "$(dst $IPSET_DIRECT6 !) -j PSW2")
|
||||
EOF
|
||||
)
|
||||
}
|
||||
|
||||
@@ -231,7 +231,9 @@ gen_shunt_list() {
|
||||
local default_outbound="redirect"
|
||||
[ "$default_node" = "_direct" ] && default_outbound="direct"
|
||||
local shunt_ids=$(uci show $CONFIG | grep "=shunt_rules" | awk -F '.' '{print $2}' | awk -F '=' '{print $1}')
|
||||
local shunt_group=$(config_n_get $node shunt_group)
|
||||
for shunt_id in $shunt_ids; do
|
||||
[ "${shunt_group}" != "$(config_n_get ${shunt_id} group)" ] && continue
|
||||
local shunt_node=$(config_n_get ${node} "${shunt_id}")
|
||||
[ -n "$shunt_node" ] && {
|
||||
local nftset_v4="psw2_${node}_${shunt_id}"
|
||||
@@ -700,13 +702,13 @@ add_firewall_rule() {
|
||||
|
||||
for ip in $(cat /usr/share/passwall2/direct_ip | tr -s "\r\n" "\n" | grep -v "^#" | sed -e "/^$/d"); do
|
||||
if [[ "$ip" == *::* ]]; then
|
||||
echo "$ip" | insert_nftset $NFTSET_DIRECT6 0
|
||||
echo "$ip" | insert_nftset $NFTSET_DIRECT6 "-1"
|
||||
elif [[ "$ip" == "geoip:"* ]]; then
|
||||
local _geoip_code=$(echo $ip | awk -F ':' '{print $2}')
|
||||
get_geoip $_geoip_code ipv4 | grep -E "(\.((2(5[0-5]|[0-4][0-9]))|[0-1]?[0-9]{1,2})){3}" | insert_nftset $NFTSET_DIRECT "0"
|
||||
get_geoip $_geoip_code ipv6 | grep -E "([A-Fa-f0-9]{1,4}::?){1,7}[A-Fa-f0-9]{1,4}" | insert_nftset $NFTSET_DIRECT6 "0"
|
||||
get_geoip $_geoip_code ipv4 | grep -E "(\.((2(5[0-5]|[0-4][0-9]))|[0-1]?[0-9]{1,2})){3}" | insert_nftset $NFTSET_DIRECT "-1"
|
||||
get_geoip $_geoip_code ipv6 | grep -E "([A-Fa-f0-9]{1,4}::?){1,7}[A-Fa-f0-9]{1,4}" | insert_nftset $NFTSET_DIRECT6 "-1"
|
||||
else
|
||||
echo "$ip" | insert_nftset $NFTSET_DIRECT 0
|
||||
echo "$ip" | insert_nftset $NFTSET_DIRECT "-1"
|
||||
fi
|
||||
done
|
||||
|
||||
@@ -726,14 +728,14 @@ add_firewall_rule() {
|
||||
update_wan_sets
|
||||
|
||||
[ -n "$ISP_DNS" ] && {
|
||||
echo "$ISP_DNS" | insert_nftset $NFTSET_DIRECT 0
|
||||
echo "$ISP_DNS" | insert_nftset $NFTSET_DIRECT "-1"
|
||||
for ispip in $ISP_DNS; do
|
||||
log_i18n 1 "$(i18n "Add ISP %s DNS to the whitelist: %s" "IPv4" "${ispip}")"
|
||||
done
|
||||
}
|
||||
|
||||
[ -n "$ISP_DNS6" ] && {
|
||||
echo $ISP_DNS6 | insert_nftset $NFTSET_DIRECT6 0
|
||||
echo $ISP_DNS6 | insert_nftset $NFTSET_DIRECT6 "-1"
|
||||
for ispip6 in $ISP_DNS6; do
|
||||
log_i18n 1 "$(i18n "Add ISP %s DNS to the whitelist: %s" "IPv6" "${ispip6}")"
|
||||
done
|
||||
@@ -762,11 +764,6 @@ add_firewall_rule() {
|
||||
nft_output_chain="PSW2_OUTPUT_MANGLE"
|
||||
fi
|
||||
|
||||
nft "add chain $NFTABLE_NAME PSW2_DIVERT"
|
||||
nft "flush chain $NFTABLE_NAME PSW2_DIVERT"
|
||||
# Only TCP, UDP Invalid.
|
||||
nft "add rule $NFTABLE_NAME PSW2_DIVERT meta l4proto tcp socket transparent 1 mark set ${FWMARK} counter accept"
|
||||
|
||||
nft "add chain $NFTABLE_NAME PSW2_DNS"
|
||||
nft "flush chain $NFTABLE_NAME PSW2_DNS"
|
||||
if [ $(config_t_get global dns_redirect "1") = "0" ]; then
|
||||
@@ -790,33 +787,29 @@ add_firewall_rule() {
|
||||
#ipv4 tproxy mode and udp
|
||||
nft "add chain $NFTABLE_NAME PSW2_MANGLE"
|
||||
nft "flush chain $NFTABLE_NAME PSW2_MANGLE"
|
||||
nft "add rule $NFTABLE_NAME PSW2_MANGLE ip daddr @$NFTSET_DIRECT counter return"
|
||||
nft "add rule $NFTABLE_NAME PSW2_MANGLE ip daddr @$NFTSET_VPS counter return"
|
||||
nft "add rule $NFTABLE_NAME PSW2_MANGLE ct direction reply counter return"
|
||||
|
||||
nft "add chain $NFTABLE_NAME PSW2_OUTPUT_MANGLE"
|
||||
nft "flush chain $NFTABLE_NAME PSW2_OUTPUT_MANGLE"
|
||||
nft "add rule $NFTABLE_NAME PSW2_OUTPUT_MANGLE ip daddr @$NFTSET_DIRECT counter return"
|
||||
nft "add rule $NFTABLE_NAME PSW2_OUTPUT_MANGLE ip daddr @$NFTSET_VPS counter return"
|
||||
nft "add rule $NFTABLE_NAME PSW2_OUTPUT_MANGLE ct direction reply counter return"
|
||||
nft "add rule $NFTABLE_NAME PSW2_OUTPUT_MANGLE meta mark 255 counter return"
|
||||
|
||||
# jump chains
|
||||
nft "add rule $NFTABLE_NAME mangle_prerouting counter jump PSW2_DIVERT"
|
||||
nft "add rule $NFTABLE_NAME mangle_prerouting ip protocol udp counter jump PSW2_MANGLE"
|
||||
[ -n "${is_tproxy}" ] && nft "add rule $NFTABLE_NAME mangle_prerouting ip protocol tcp counter jump PSW2_MANGLE"
|
||||
# Only TCP, UDP Invalid.
|
||||
nft "add rule $NFTABLE_NAME mangle_prerouting meta nfproto ipv4 meta l4proto tcp socket transparent 1 mark set ${FWMARK} counter accept"
|
||||
nft "add rule $NFTABLE_NAME mangle_prerouting ip daddr != @$NFTSET_DIRECT ip protocol udp counter jump PSW2_MANGLE"
|
||||
[ -n "${is_tproxy}" ] && nft "add rule $NFTABLE_NAME mangle_prerouting ip daddr != @$NFTSET_DIRECT ip protocol tcp counter jump PSW2_MANGLE"
|
||||
|
||||
#ipv4 tcp redirect mode
|
||||
[ -z "${is_tproxy}" ] && {
|
||||
nft "add chain $NFTABLE_NAME PSW2_NAT"
|
||||
nft "flush chain $NFTABLE_NAME PSW2_NAT"
|
||||
nft "add rule $NFTABLE_NAME PSW2_NAT ip daddr @$NFTSET_DIRECT counter return"
|
||||
nft "add rule $NFTABLE_NAME PSW2_NAT ip daddr @$NFTSET_VPS counter return"
|
||||
nft "add rule $NFTABLE_NAME dstnat ip protocol tcp counter jump PSW2_NAT"
|
||||
nft "add rule $NFTABLE_NAME dstnat ip daddr != @$NFTSET_DIRECT ip protocol tcp counter jump PSW2_NAT"
|
||||
|
||||
nft "add chain $NFTABLE_NAME PSW2_OUTPUT_NAT"
|
||||
nft "flush chain $NFTABLE_NAME PSW2_OUTPUT_NAT"
|
||||
nft "add rule $NFTABLE_NAME PSW2_OUTPUT_NAT ip daddr @$NFTSET_DIRECT counter return"
|
||||
nft "add rule $NFTABLE_NAME PSW2_OUTPUT_NAT ip daddr @$NFTSET_VPS counter return"
|
||||
nft "add rule $NFTABLE_NAME PSW2_OUTPUT_NAT meta mark 255 counter return"
|
||||
}
|
||||
@@ -825,16 +818,16 @@ add_firewall_rule() {
|
||||
if [ "$accept_icmp" = "1" ]; then
|
||||
nft "add chain $NFTABLE_NAME PSW2_ICMP_REDIRECT"
|
||||
nft "flush chain $NFTABLE_NAME PSW2_ICMP_REDIRECT"
|
||||
nft "add rule $NFTABLE_NAME PSW2_ICMP_REDIRECT ip daddr @$NFTSET_DIRECT counter return"
|
||||
nft "add rule $NFTABLE_NAME PSW2_ICMP_REDIRECT ip daddr @$NFTSET_VPS counter return"
|
||||
|
||||
[ "$accept_icmpv6" = "1" ] && {
|
||||
nft "add rule $NFTABLE_NAME PSW2_ICMP_REDIRECT ip6 daddr @$NFTSET_DIRECT6 counter return"
|
||||
nft "add rule $NFTABLE_NAME PSW2_ICMP_REDIRECT ip6 daddr @$NFTSET_VPS6 counter return"
|
||||
}
|
||||
|
||||
nft "add rule $NFTABLE_NAME dstnat meta l4proto {icmp,icmpv6} counter jump PSW2_ICMP_REDIRECT"
|
||||
nft "add rule $NFTABLE_NAME nat_output meta l4proto {icmp,icmpv6} counter jump PSW2_ICMP_REDIRECT"
|
||||
nft "add rule $NFTABLE_NAME dstnat ip daddr != @$NFTSET_DIRECT meta l4proto icmp counter jump PSW2_ICMP_REDIRECT"
|
||||
nft "add rule $NFTABLE_NAME dstnat ip6 daddr != @$NFTSET_DIRECT6 meta l4proto icmpv6 counter jump PSW2_ICMP_REDIRECT"
|
||||
nft "add rule $NFTABLE_NAME nat_output ip daddr != @$NFTSET_DIRECT meta l4proto icmp counter jump PSW2_ICMP_REDIRECT"
|
||||
nft "add rule $NFTABLE_NAME nat_output ip6 daddr != @$NFTSET_DIRECT6 meta l4proto icmpv6 counter jump PSW2_ICMP_REDIRECT"
|
||||
fi
|
||||
|
||||
#ipv4 wan_ip
|
||||
@@ -847,13 +840,11 @@ add_firewall_rule() {
|
||||
#ipv6 tproxy mode and udp
|
||||
nft "add chain $NFTABLE_NAME PSW2_MANGLE_V6"
|
||||
nft "flush chain $NFTABLE_NAME PSW2_MANGLE_V6"
|
||||
nft "add rule $NFTABLE_NAME PSW2_MANGLE_V6 ip6 daddr @$NFTSET_DIRECT6 counter return"
|
||||
nft "add rule $NFTABLE_NAME PSW2_MANGLE_V6 ip6 daddr @$NFTSET_VPS6 counter return"
|
||||
nft "add rule $NFTABLE_NAME PSW2_MANGLE_V6 ct direction reply counter return"
|
||||
|
||||
nft "add chain $NFTABLE_NAME PSW2_OUTPUT_MANGLE_V6"
|
||||
nft "flush chain $NFTABLE_NAME PSW2_OUTPUT_MANGLE_V6"
|
||||
nft "add rule $NFTABLE_NAME PSW2_OUTPUT_MANGLE_V6 ip6 daddr @$NFTSET_DIRECT6 counter return"
|
||||
nft "add rule $NFTABLE_NAME PSW2_OUTPUT_MANGLE_V6 ip6 daddr @$NFTSET_VPS6 counter return"
|
||||
nft "add rule $NFTABLE_NAME PSW2_OUTPUT_MANGLE_V6 ct direction reply counter return"
|
||||
nft "add rule $NFTABLE_NAME PSW2_OUTPUT_MANGLE_V6 meta mark 255 counter return"
|
||||
@@ -874,8 +865,10 @@ add_firewall_rule() {
|
||||
|
||||
# jump chains
|
||||
[ "$PROXY_IPV6" == "1" ] && {
|
||||
nft "add rule $NFTABLE_NAME mangle_prerouting meta nfproto {ipv6} counter jump PSW2_MANGLE_V6"
|
||||
nft "add rule $NFTABLE_NAME mangle_output meta nfproto {ipv6} counter jump PSW2_OUTPUT_MANGLE_V6 comment \"PSW2_OUTPUT_MANGLE\""
|
||||
# Only TCP, UDP Invalid.
|
||||
nft "add rule $NFTABLE_NAME mangle_prerouting meta nfproto ipv6 meta l4proto tcp socket transparent 1 mark set ${FWMARK} counter accept"
|
||||
nft "add rule $NFTABLE_NAME mangle_prerouting ip6 daddr != @$NFTSET_DIRECT6 meta nfproto {ipv6} counter jump PSW2_MANGLE_V6"
|
||||
nft "add rule $NFTABLE_NAME mangle_output ip6 daddr != @$NFTSET_DIRECT6 meta nfproto {ipv6} counter jump PSW2_OUTPUT_MANGLE_V6 comment \"PSW2_OUTPUT_MANGLE\""
|
||||
|
||||
nft "add rule $NFTABLE_NAME PSW2_MANGLE_V6 ip6 daddr @$NFTSET_WAN6 counter return comment \"WAN6_IP_RETURN\""
|
||||
|
||||
@@ -948,11 +941,11 @@ add_firewall_rule() {
|
||||
nft "add rule $NFTABLE_NAME $nft_chain ip protocol tcp ip daddr $FAKE_IP ${nft_j}"
|
||||
add_shunt_t_rule "${SHUNT_LIST4}" "nft add rule $NFTABLE_NAME $nft_chain ip protocol tcp $(factor $TCP_REDIR_PORTS "tcp dport") ip daddr" "${nft_j}"
|
||||
nft "add rule $NFTABLE_NAME $nft_chain ip protocol tcp $(factor $TCP_REDIR_PORTS "tcp dport") ${nft_j}"
|
||||
[ -z "${is_tproxy}" ] && nft "add rule $NFTABLE_NAME nat_output ip protocol tcp counter jump PSW2_OUTPUT_NAT"
|
||||
[ -z "${is_tproxy}" ] && nft "add rule $NFTABLE_NAME nat_output ip daddr != @$NFTSET_DIRECT ip protocol tcp counter jump PSW2_OUTPUT_NAT"
|
||||
[ -n "${is_tproxy}" ] && {
|
||||
nft "add rule $NFTABLE_NAME PSW2_MANGLE ip protocol tcp iif lo $(REDIRECT $REDIR_PORT TPROXY4) comment \"${comment_l}\""
|
||||
nft "add rule $NFTABLE_NAME PSW2_MANGLE ip protocol tcp iif lo counter return comment \"${comment_l}\""
|
||||
nft "add rule $NFTABLE_NAME mangle_output ip protocol tcp counter jump PSW2_OUTPUT_MANGLE comment \"PSW2_OUTPUT_MANGLE\""
|
||||
nft "add rule $NFTABLE_NAME mangle_output ip daddr != @$NFTSET_DIRECT ip protocol tcp counter jump PSW2_OUTPUT_MANGLE comment \"PSW2_OUTPUT_MANGLE\""
|
||||
}
|
||||
|
||||
[ "$PROXY_IPV6" == "1" ] && {
|
||||
@@ -978,7 +971,7 @@ add_firewall_rule() {
|
||||
nft "add rule $NFTABLE_NAME PSW2_OUTPUT_MANGLE ip protocol udp $(factor $UDP_REDIR_PORTS "udp dport") counter jump PSW2_RULE"
|
||||
nft "add rule $NFTABLE_NAME PSW2_MANGLE ip protocol udp iif lo $(REDIRECT $REDIR_PORT TPROXY4) comment \"${comment_l}\""
|
||||
nft "add rule $NFTABLE_NAME PSW2_MANGLE ip protocol udp iif lo counter return comment \"${comment_l}\""
|
||||
nft "add rule $NFTABLE_NAME mangle_output ip protocol udp counter jump PSW2_OUTPUT_MANGLE comment \"PSW2_OUTPUT_MANGLE\""
|
||||
nft "add rule $NFTABLE_NAME mangle_output ip daddr != @$NFTSET_DIRECT ip protocol udp counter jump PSW2_OUTPUT_MANGLE comment \"PSW2_OUTPUT_MANGLE\""
|
||||
|
||||
[ "$PROXY_IPV6" == "1" ] && {
|
||||
nft "add rule $NFTABLE_NAME PSW2_OUTPUT_MANGLE_V6 meta l4proto udp ip6 daddr $FAKE_IP_6 jump PSW2_RULE"
|
||||
@@ -996,11 +989,13 @@ add_firewall_rule() {
|
||||
}
|
||||
fi
|
||||
|
||||
nft "add rule $NFTABLE_NAME mangle_output oif lo counter return comment \"PSW2_OUTPUT_MANGLE\""
|
||||
nft "add rule $NFTABLE_NAME mangle_output meta mark ${FWMARK} counter return comment \"PSW2_OUTPUT_MANGLE\""
|
||||
nft "add rule $NFTABLE_NAME mangle_output ip daddr != @$NFTSET_DIRECT oif lo counter return comment \"PSW2_OUTPUT_MANGLE\""
|
||||
nft "add rule $NFTABLE_NAME mangle_output ip daddr != @$NFTSET_DIRECT meta mark ${FWMARK} counter return comment \"PSW2_OUTPUT_MANGLE\""
|
||||
|
||||
nft "add rule $NFTABLE_NAME PSW2_MANGLE ip protocol udp udp dport 53 counter return"
|
||||
nft "add rule $NFTABLE_NAME PSW2_MANGLE_V6 meta l4proto udp udp dport 53 counter return"
|
||||
nft "add rule $NFTABLE_NAME PSW2_MANGLE ip protocol tcp tcp dport 53 counter accept"
|
||||
nft "add rule $NFTABLE_NAME PSW2_MANGLE ip protocol udp udp dport 53 counter accept"
|
||||
nft "add rule $NFTABLE_NAME PSW2_MANGLE_V6 meta l4proto tcp tcp dport 53 counter accept"
|
||||
nft "add rule $NFTABLE_NAME PSW2_MANGLE_V6 meta l4proto udp udp dport 53 counter accept"
|
||||
}
|
||||
|
||||
load_acl
|
||||
|
||||
@@ -85,7 +85,7 @@ local function fetch_geofile(geo_name, geo_type, url)
|
||||
local tmp_path = "/tmp/" .. geo_name
|
||||
local asset_path = asset_location .. geo_name
|
||||
local down_filename = url:match("^.*/([^/?#]+)")
|
||||
local sha_url = url:gsub(down_filename, down_filename .. ".sha256sum")
|
||||
local sha_url = url:gsub((down_filename:gsub("(%W)", "%%%1")), down_filename .. ".sha256sum")
|
||||
local sha_path = tmp_path .. ".sha256sum"
|
||||
|
||||
local function verify_sha256(sha_file)
|
||||
|
||||
@@ -77,8 +77,8 @@ test_auto_switch() {
|
||||
local b_nodes=$1
|
||||
local now_node=$2
|
||||
[ -z "$now_node" ] && {
|
||||
if [ -n "$(get_cache_var "socks_${id}")" ]; then
|
||||
now_node=$(get_cache_var "socks_${id}")
|
||||
if [ -n "$(get_cache_var "${id}")" ]; then
|
||||
now_node=$(get_cache_var "${id}")
|
||||
else
|
||||
#log_i18n 0 "Socks switch detection: Unknown error."
|
||||
return 1
|
||||
@@ -126,7 +126,11 @@ test_auto_switch() {
|
||||
# If the current node is not found, or if the current node is the last node, then take the first node.
|
||||
[ -z "$new_node" ] && new_node="$first_node"
|
||||
local msg2="$(i18n "next backup node")"
|
||||
[ "$now_node" = "$main_node" ] && msg2="$(i18n "backup node")"
|
||||
if [ "$new_node" = "$main_node" ]; then
|
||||
msg2="$(i18n "main node")"
|
||||
else
|
||||
[ "$now_node" = "$main_node" ] && msg2="$(i18n "backup node")"
|
||||
fi
|
||||
msg="$(i18n "switch to %s test detect!" "${msg2}")"
|
||||
else
|
||||
# When there is only one backup node, poll with the primary node.
|
||||
@@ -138,11 +142,6 @@ test_auto_switch() {
|
||||
log_i18n 0 "Socks switch detection: %s 【%s:[%s]】 abnormal, %s" "${id}" "$(config_n_get $now_node type)" "$(config_n_get $now_node remarks)" "${msg}"
|
||||
test_node ${new_node}
|
||||
if [ $? -eq 0 ]; then
|
||||
# [ "$restore_switch" = "0" ] && {
|
||||
# uci set $CONFIG.${id}.node=$new_node
|
||||
# [ -z "$(echo $b_nodes | grep $main_node)" ] && uci add_list $CONFIG.${id}.autoswitch_backup_node=$main_node
|
||||
# uci commit $CONFIG
|
||||
# }
|
||||
check_process
|
||||
log_i18n 0 "Socks switch detection: %s 【%s:[%s]】 normal, switch to this node!" "${id}" "$(config_n_get $new_node type)" "$(config_n_get $new_node remarks)"
|
||||
$APP_FILE socks_node_switch flag=${id} new_node=${new_node}
|
||||
@@ -171,6 +170,10 @@ start() {
|
||||
backup_node_num=$(printf "%s\n" "$backup_node" | wc -w)
|
||||
if [ "$backup_node_num" -eq 1 ]; then
|
||||
[ "$main_node" = "$backup_node" ] && return
|
||||
elif [ "$backup_node_num" -gt 1 ]; then
|
||||
[ "$restore_switch" != "1" ] && {
|
||||
[ -z "$(echo $backup_node | grep -F "$main_node")" ] && backup_node="${backup_node} ${main_node}"
|
||||
}
|
||||
fi
|
||||
else
|
||||
return
|
||||
|
||||
@@ -168,10 +168,10 @@ do
|
||||
local flag = i18n.translatef("Socks node list [%s]", i) .. " " .. i18n.translatef("Backup node list")
|
||||
local currentNodes = {}
|
||||
local newNodes = {}
|
||||
for k, node_id in ipairs(t.autoswitch_backup_node) do
|
||||
if node_id then
|
||||
local currentNode = uci:get_all(appname, node_id) or nil
|
||||
if currentNode then
|
||||
for k, asb_node in ipairs(t.autoswitch_backup_node) do
|
||||
if asb_node then
|
||||
local currentNode = uci:get_all(appname, asb_node) or {}
|
||||
if currentNode[".type"] == "nodes" then
|
||||
currentNodes[#currentNodes + 1] = {
|
||||
log = true,
|
||||
remarks = flag .. "[" .. k .. "]",
|
||||
@@ -276,36 +276,39 @@ do
|
||||
|
||||
for k, e in pairs(rules) do
|
||||
local _node_id = node[e[".name"]] or nil
|
||||
if _node_id and not _node_id:find("Socks_") then
|
||||
CONFIG[#CONFIG + 1] = {
|
||||
log = false,
|
||||
currentNode = _node_id and uci:get_all(appname, _node_id) or nil,
|
||||
remarks = i18n.translatef("Shunt [%s] node", e.remarks),
|
||||
set = function(o, server)
|
||||
if not server then server = "" end
|
||||
uci:set(appname, node_id, e[".name"], server)
|
||||
o.newNodeId = server
|
||||
end
|
||||
}
|
||||
if _node_id then
|
||||
local section = uci:get_all(appname, node_id) or {}
|
||||
if section[".type"] == "nodes" then
|
||||
CONFIG[#CONFIG + 1] = {
|
||||
log = false,
|
||||
currentNode = section,
|
||||
remarks = i18n.translatef("Shunt [%s] node", e.remarks),
|
||||
set = function(o, server)
|
||||
if not server then server = "" end
|
||||
uci:set(appname, node_id, e[".name"], server)
|
||||
o.newNodeId = server
|
||||
end
|
||||
}
|
||||
end
|
||||
end
|
||||
|
||||
end
|
||||
elseif node.protocol and node.protocol == '_balancing' then
|
||||
local flag = i18n.translatef("Xray Load Balancing node [%s] list", node_id)
|
||||
local currentNodes = {}
|
||||
local newNodes = {}
|
||||
if node.balancing_node then
|
||||
for k, node in pairs(node.balancing_node) do
|
||||
for k, b_node_id in pairs(node.balancing_node) do
|
||||
currentNodes[#currentNodes + 1] = {
|
||||
log = true,
|
||||
node = node,
|
||||
node = b_node_id,
|
||||
currentNode = (function()
|
||||
if node and node:find("Socks_") then
|
||||
return { Socks = node }
|
||||
local section = uci:get_all(appname, b_node_id) or {}
|
||||
if section[".type"] == "socks" then
|
||||
return { Socks = b_node_id }
|
||||
end
|
||||
return node and uci:get_all(appname, node) or nil
|
||||
return section
|
||||
end)(),
|
||||
remarks = node,
|
||||
remarks = b_node_id,
|
||||
set = function(o, server)
|
||||
if o and server and server ~= "nil" then
|
||||
table.insert(o.newNodes, server)
|
||||
@@ -328,37 +331,41 @@ do
|
||||
|
||||
-- Backup Node
|
||||
local currentNode = uci:get_all(appname, node_id) or nil
|
||||
if currentNode and currentNode.fallback_node and not currentNode.fallback_node:find("Socks_") then
|
||||
CONFIG[#CONFIG + 1] = {
|
||||
log = true,
|
||||
id = node_id,
|
||||
remarks = i18n.translatef("Xray Load Balancing node [%s] backup node", node_id),
|
||||
currentNode = uci:get_all(appname, currentNode.fallback_node) or nil,
|
||||
set = function(o, server)
|
||||
uci:set(appname, node_id, "fallback_node", server)
|
||||
o.newNodeId = server
|
||||
end,
|
||||
delete = function(o)
|
||||
uci:delete(appname, node_id, "fallback_node")
|
||||
end
|
||||
}
|
||||
if currentNode and currentNode.fallback_node then
|
||||
local section = uci:get_all(appname, currentNode.fallback_node) or {}
|
||||
if section[".type"] == "nodes" then
|
||||
CONFIG[#CONFIG + 1] = {
|
||||
log = true,
|
||||
id = node_id,
|
||||
remarks = i18n.translatef("Xray Load Balancing node [%s] backup node", node_id),
|
||||
currentNode = section,
|
||||
set = function(o, server)
|
||||
uci:set(appname, node_id, "fallback_node", server)
|
||||
o.newNodeId = server
|
||||
end,
|
||||
delete = function(o)
|
||||
uci:delete(appname, node_id, "fallback_node")
|
||||
end
|
||||
}
|
||||
end
|
||||
end
|
||||
elseif node.protocol and node.protocol == '_urltest' then
|
||||
local flag = i18n.translatef("Sing-Box URLTest node [%s] list", node_id)
|
||||
local currentNodes = {}
|
||||
local newNodes = {}
|
||||
if node.urltest_node then
|
||||
for k, node in pairs(node.urltest_node) do
|
||||
for k, u_node_id in pairs(node.urltest_node) do
|
||||
currentNodes[#currentNodes + 1] = {
|
||||
log = true,
|
||||
node = node,
|
||||
node = u_node_id,
|
||||
currentNode = (function()
|
||||
if node and node:find("Socks_") then
|
||||
return { Socks = node }
|
||||
local section = uci:get_all(appname, u_node_id) or {}
|
||||
if section[".type"] == "socks" then
|
||||
return { Socks = u_node_id }
|
||||
end
|
||||
return node and uci:get_all(appname, node) or nil
|
||||
return section
|
||||
end)(),
|
||||
remarks = node,
|
||||
remarks = u_node_id,
|
||||
set = function(o, server)
|
||||
if o and server and server ~= "nil" then
|
||||
table.insert(o.newNodes, server)
|
||||
@@ -381,37 +388,43 @@ do
|
||||
else
|
||||
-- Preproxy Node
|
||||
local currentNode = uci:get_all(appname, node_id) or nil
|
||||
if currentNode and currentNode.preproxy_node and not currentNode.preproxy_node:find("Socks_") then
|
||||
CONFIG[#CONFIG + 1] = {
|
||||
log = true,
|
||||
id = node_id,
|
||||
remarks = i18n.translatef("Node [%s] preproxy node", node_id),
|
||||
currentNode = uci:get_all(appname, currentNode.preproxy_node) or nil,
|
||||
set = function(o, server)
|
||||
uci:set(appname, node_id, "preproxy_node", server)
|
||||
o.newNodeId = server
|
||||
end,
|
||||
delete = function(o)
|
||||
uci:delete(appname, node_id, "preproxy_node")
|
||||
end
|
||||
}
|
||||
if currentNode and currentNode.preproxy_node then
|
||||
local section = uci:get_all(appname, currentNode.preproxy_node) or {}
|
||||
if section[".type"] == "nodes" then
|
||||
CONFIG[#CONFIG + 1] = {
|
||||
log = true,
|
||||
id = node_id,
|
||||
remarks = i18n.translatef("Node [%s] preproxy node", node_id),
|
||||
currentNode = uci:get_all(appname, currentNode.preproxy_node) or nil,
|
||||
set = function(o, server)
|
||||
uci:set(appname, node_id, "preproxy_node", server)
|
||||
o.newNodeId = server
|
||||
end,
|
||||
delete = function(o)
|
||||
uci:delete(appname, node_id, "preproxy_node")
|
||||
end
|
||||
}
|
||||
end
|
||||
end
|
||||
-- Landing node
|
||||
local currentNode = uci:get_all(appname, node_id) or nil
|
||||
if currentNode and currentNode.to_node and not currentNode.to_node:find("Socks_") then
|
||||
CONFIG[#CONFIG + 1] = {
|
||||
log = true,
|
||||
id = node_id,
|
||||
remarks = i18n.translatef("Node [%s] landing node", node_id),
|
||||
currentNode = uci:get_all(appname, currentNode.to_node) or nil,
|
||||
set = function(o, server)
|
||||
uci:set(appname, node_id, "to_node", server)
|
||||
o.newNodeId = server
|
||||
end,
|
||||
delete = function(o)
|
||||
uci:delete(appname, node_id, "to_node")
|
||||
end
|
||||
}
|
||||
if currentNode and currentNode.to_node then
|
||||
local section = uci:get_all(appname, currentNode.to_node) or {}
|
||||
if section[".type"] == "nodes" then
|
||||
CONFIG[#CONFIG + 1] = {
|
||||
log = true,
|
||||
id = node_id,
|
||||
remarks = i18n.translatef("Node [%s] landing node", node_id),
|
||||
currentNode = uci:get_all(appname, currentNode.to_node) or nil,
|
||||
set = function(o, server)
|
||||
uci:set(appname, node_id, "to_node", server)
|
||||
o.newNodeId = server
|
||||
end,
|
||||
delete = function(o)
|
||||
uci:delete(appname, node_id, "to_node")
|
||||
end
|
||||
}
|
||||
end
|
||||
end
|
||||
end
|
||||
end)
|
||||
@@ -768,6 +781,9 @@ local function parseClashNode(node, add_mode, group, sub_cfg)
|
||||
result.reality_publicKey = node["reality-opts"]["public-key"]
|
||||
result.reality_shortId = node["reality-opts"]["short-id"]
|
||||
end
|
||||
if node["disable-reuse"] then
|
||||
result.anytls_disable_reuse = "1"
|
||||
end
|
||||
end
|
||||
if not result.remarks or result.remarks == "" then
|
||||
if result.address and result.port then
|
||||
@@ -1865,7 +1881,7 @@ local function processData(szType, content, add_mode, group, sub_cfg)
|
||||
end
|
||||
if params.security == "tls" or params.security == "reality" then
|
||||
result.tls = "1"
|
||||
result.tls_serverName = params.sni
|
||||
result.tls_serverName = params.sni or params.peer
|
||||
result.alpn = params.alpn
|
||||
if params.fp and params.fp ~= "" then
|
||||
result.utls = "1"
|
||||
|
||||
@@ -40,10 +40,9 @@ do
|
||||
for item in $(uci show ${CONFIG} | grep "=subscribe_list" | cut -d '.' -sf 2 | cut -d '=' -sf 1); do
|
||||
sub_update_week_mode=$(config_n_get $item update_week_mode)
|
||||
if [ -n "$sub_update_week_mode" ]; then
|
||||
cfgid=$(uci show ${CONFIG}.$item | head -n 1 | cut -d '.' -sf 2 | cut -d '=' -sf 1)
|
||||
remark=$(config_n_get $item remark)
|
||||
sub_update_interval_mode=$(config_n_get $item update_interval_mode)
|
||||
echo "$cfgid" >> $TMP_SUB_PATH/${sub_update_week_mode}_${sub_update_interval_mode}
|
||||
echo "$item" >> $TMP_SUB_PATH/${sub_update_week_mode}_${sub_update_interval_mode}
|
||||
fi
|
||||
done
|
||||
|
||||
|
||||
Reference in New Issue
Block a user