update 2026-08-28 02:44:45

luci-app-passwall/root/usr/share/passwall/iptables.sh

@@ -44,6 +44,7 @@ FAKE_IP="198.18.0.0/15"
 FAKE_IP_6="fc00::/18"
 
 USE_GEOVIEW=0
+EXCLUDE_VPSIP="^(0\.0\.0\.0|127\.0\.0\.1|1\.1\.1\.1|1\.1\.1\.2|8\.8\.8\.8|8\.8\.4\.4|9\.9\.9\.9)$"
 
 factor() {
 	if [ -z "$1" ] || [ -z "$2" ]; then
@@ -746,15 +747,14 @@ load_acl() {
 }
 
 filter_haproxy() {
-	for item in ${haproxy_items}; do
-		local ip=$(get_host_ip ipv4 $(echo $item | awk -F ":" '{print $1}') 1)
-		ipset -q add $IPSET_VPS $ip
+	for item in $(uci show $CONFIG | grep ".lbss=" | cut -d "'" -f 2); do
+		local ip=$(get_host_ip "ipv4" "$(echo $item | awk -F ":" '{print $1}')" 1)
+		[ -n "$ip" ] && ! echo "$ip" | grep -Eq "$EXCLUDE_VPSIP" && ipset -q add $IPSET_VPS $ip
 	done
 	echolog "  - [$?]加入负载均衡的节点到ipset[$IPSET_VPS]直连完成"
 }
 
 filter_vpsip() {
-	local EXCLUDE_VPSIP="^(0\.0\.0\.0|127\.0\.0\.1|1\.1\.1\.1|1\.1\.1\.2|8\.8\.8\.8|8\.8\.4\.4|9\.9\.9\.9)$"
 	uci show $CONFIG | grep -E "(\.address=|\.download_address=|\.domain_resolver_dns=|\.domain_resolver_dns_https=)" | cut -d "'" -f 2 | grep -Eo "([0-9]{1,3}\.){3}[0-9]{1,3}" | grep -Ev "$EXCLUDE_VPSIP" | sed "s/^/add $IPSET_VPS /" | awk '1; END{print "COMMIT"}' | ipset -! -R
 	echolog "  - [$?]加入所有IPv4节点到ipset[$IPSET_VPS]直连完成"
 	uci show $CONFIG | grep -E "(\.address=|\.download_address=|\.domain_resolver_dns=|\.domain_resolver_dns_https=)" | cut -d "'" -f 2 | grep -Eo "\[?[A-Fa-f0-9:]*:[A-Fa-f0-9:]+\]?" | sed "s/^/add $IPSET_VPS6 /" | awk '1; END{print "COMMIT"}' | ipset -! -R
@@ -802,7 +802,9 @@ filter_node() {
 	local port=$(config_n_get "$node" port)
 	local hop=$(config_n_get "$node" hysteria2_hop)
 	[ -n "$hop" ] && port="${port:+$port,}$hop" 
-	[ -z "$address" ] || [ -z "$port" ] && return 1
+	[ -z "$address" ] && return 1
+	echo "$address" | grep -Eq "$EXCLUDE_VPSIP" && return 1
+	[ -z "$port" ] && return 1
 	filter_server_port "$address" "$port" "$stream"
 }
 

luci-app-passwall/root/usr/share/passwall/nftables.sh

@@ -50,6 +50,7 @@ FAKE_IP="198.18.0.0/15"
 FAKE_IP_6="fc00::/18"
 
 USE_GEOVIEW=0
+EXCLUDE_VPSIP="^(0\.0\.0\.0|127\.0\.0\.1|1\.1\.1\.1|1\.1\.1\.2|8\.8\.8\.8|8\.8\.4\.4|9\.9\.9\.9)$"
 
 factor() {
 	local ports="$1"
@@ -809,24 +810,23 @@ load_acl() {
 }
 
 filter_haproxy() {
-	for item in ${haproxy_items}; do
-		get_host_ip ipv4 $(echo $item | awk -F ":" '{print $1}') 1
-	done | insert_nftset $NFTSET_VPS
+	for item in $(uci show $CONFIG | grep ".lbss=" | cut -d "'" -f 2); do
+		get_host_ip "ipv4" "$(echo $item | awk -F ":" '{print $1}')" 1
+	done | grep -Ev "$EXCLUDE_VPSIP" | insert_nftset $NFTSET_VPS
 	echolog "  - [$?]加入负载均衡的节点到nftset[$NFTSET_VPS]直连完成"
 }
 
 filter_vps_addr() {
 	for server_host in "$@"; do
-		get_host_ip "ipv4" ${server_host}
-	done | insert_nftset $NFTSET_VPS
+		get_host_ip "ipv4" "${server_host}"
+	done | grep -Ev "$EXCLUDE_VPSIP" | insert_nftset $NFTSET_VPS
 
 	for server_host in "$@"; do
-		get_host_ip "ipv6" ${server_host}
+		get_host_ip "ipv6" "${server_host}"
 	done | insert_nftset $NFTSET_VPS6
 }
 
 filter_vpsip() {
-	local EXCLUDE_VPSIP="^(0\.0\.0\.0|127\.0\.0\.1|1\.1\.1\.1|1\.1\.1\.2|8\.8\.8\.8|8\.8\.4\.4|9\.9\.9\.9)$"
 	uci show $CONFIG | grep -E "(\.address=|\.download_address=|\.domain_resolver_dns=|\.domain_resolver_dns_https=)" | cut -d "'" -f 2 | grep -Eo "([0-9]{1,3}\.){3}[0-9]{1,3}" | grep -Ev "$EXCLUDE_VPSIP" | insert_nftset $NFTSET_VPS
 	echolog "  - [$?]加入所有IPv4节点到nftset[$NFTSET_VPS]直连完成"
 	uci show $CONFIG | grep -E "(\.address=|\.download_address=|\.domain_resolver_dns=|\.domain_resolver_dns_https=)" | cut -d "'" -f 2 | grep -Eo "\[?[A-Fa-f0-9:]*:[A-Fa-f0-9:]+\]?" | insert_nftset $NFTSET_VPS6
@@ -864,7 +864,9 @@ filter_node() {
 	local port=$(config_n_get "$node" port)
 	local hop=$(config_n_get "$node" hysteria2_hop)
 	[ -n "$hop" ] && port="${port:+$port,}$hop" 
-	[ -z "$address" ] || [ -z "$port" ] && return 1
+	[ -z "$address" ] && return 1
+	echo "$address" | grep -Eq "$EXCLUDE_VPSIP" && return 1
+	[ -z "$port" ] && return 1
 	filter_server_port "$address" "$port" "$stream"
 }
 
@@ -877,7 +879,6 @@ filter_direct_node_list() {
 	done
 }
 
-
 del_script_mwan3() {
 	[ -s "/etc/init.d/mwan3" ] && sed -i "/${CONFIG}/d" /etc/init.d/mwan3 >/dev/null 2>&1
 }

luci-app-passwall/root/usr/share/passwall/rule_update.lua

@@ -726,13 +726,21 @@ if geo2rule == "1" then
 	end
 
 	-- 如果是手动更新(arg2存在)始终生成规则
-	if arg2 then geoip_update_ok, geosite_update_ok = true, true end
-	chnroute_update, chnroute6_update, gfwlist_update, chnlist_update = "1", "1", "1", "1"
+	if arg2 then
+		geoip_update_ok, geosite_update_ok = true, true
+	end
+	if not rollback then
+		chnroute_update, chnroute6_update, gfwlist_update, chnlist_update = "1", "1", "1", "1"
+	end
 
 	if geoip_update_ok then
 		if fs.access(asset_location .. "geoip.dat") then
-			safe_call(fetch_chnroute, "生成chnroute发生错误...")
-			safe_call(fetch_chnroute6, "生成chnroute6发生错误...")
+			if chnroute_update == "1" then
+				safe_call(fetch_chnroute, "生成chnroute发生错误...")
+			end
+			if chnroute6_update == "1" then
+				safe_call(fetch_chnroute6, "生成chnroute6发生错误...")
+			end
 		else
 			log("geoip.dat 文件不存在,跳过规则生成。")
 		end
@@ -740,8 +748,12 @@ if geo2rule == "1" then
 
 	if geosite_update_ok then
 		if fs.access(asset_location .. "geosite.dat") then
-			safe_call(fetch_gfwlist, "生成gfwlist发生错误...")
-			safe_call(fetch_chnlist, "生成chnlist发生错误...")
+			if gfwlist_update == "1" then
+				safe_call(fetch_gfwlist, "生成gfwlist发生错误...")
+			end
+			if chnlist_update == "1" then
+				safe_call(fetch_chnlist, "生成chnlist发生错误...")
+			end
 		else
 			log("geosite.dat 文件不存在,跳过规则生成。")
 		end