update 2026-09-24 16:56:26

2026-11-04 18:03:56 +08:00 · 2026-09-24 16:56:26 +08:00
1 parent b31a5c3878
commit e4cee331e9
@@ -0,0 +1,68 @@
+# Copyright 2017-2018 Stan Grishin (stangri@melmac.net)
+# This is free software, licensed under the GNU General Public License v3.
+
+include $(TOPDIR)/rules.mk
+
+PKG_NAME:=vpn-policy-routing
+PKG_VERSION:=0.3.2
+PKG_RELEASE:=20
+PKG_LICENSE:=GPL-3.0-or-later
+PKG_MAINTAINER:=Stan Grishin <stangri@melmac.net>
+
+include $(INCLUDE_DIR)/package.mk
+
+define Package/vpn-policy-routing
+	SECTION:=net
+	CATEGORY:=Network
+	TITLE:=VPN Policy-Based Routing Service
+	URL:=https://docs.openwrt.melmac.net/vpn-policy-routing/
+	DEPENDS:=+jshn +ipset +iptables +resolveip +kmod-ipt-ipset +iptables-mod-ipopt +ip-full
+	PKGARCH:=all
+endef
+
+define Package/vpn-policy-routing/description
+This service allows policy-based routing for L2TP, Openconnect, OpenVPN, PPTP and Wireguard tunnels and WAN interface.
+Policies can specify domains, local IPs/subnets and ports, as well as remote IPs/subnets and ports.
+endef
+
+define Package/vpn-policy-routing/conffiles
+/etc/config/vpn-policy-routing
+endef
+
+define Build/Configure
+endef
+
+define Build/Compile
+endef
+
+define Package/vpn-policy-routing/install
+	$(INSTALL_DIR) $(1)/etc/init.d $(1)/etc/config $(1)/etc/hotplug.d/firewall $(1)/etc/
+	$(INSTALL_BIN) ./files/vpn-policy-routing.init $(1)/etc/init.d/vpn-policy-routing
+	$(SED) "s|^\(PKG_VERSION\).*|\1='$(PKG_VERSION)-$(PKG_RELEASE)'|" $(1)/etc/init.d/vpn-policy-routing
+	$(INSTALL_CONF) ./files/vpn-policy-routing.conf $(1)/etc/config/vpn-policy-routing
+	$(INSTALL_DATA) ./files/vpn-policy-routing.firewall.hotplug $(1)/etc/hotplug.d/firewall/99-vpn-policy-routing
+	$(INSTALL_DATA) ./files/vpn-policy-routing.aws.user $(1)/etc/vpn-policy-routing.aws.user
+	$(INSTALL_DATA) ./files/vpn-policy-routing.netflix.user $(1)/etc/vpn-policy-routing.netflix.user
+endef
+
+define Package/vpn-policy-routing/postinst
+	#!/bin/sh
+	# check if we are on real system
+	if [ -z "$${IPKG_INSTROOT}" ]; then
+		/etc/init.d/vpn-policy-routing enable
+	fi
+	exit 0
+endef
+
+define Package/vpn-policy-routing/prerm
+	#!/bin/sh
+	# check if we are on real system
+	if [ -z "$${IPKG_INSTROOT}" ]; then
+		echo "Stopping service and removing rc.d symlink for vpn-policy-routing"
+		/etc/init.d/vpn-policy-routing stop || true
+		/etc/init.d/vpn-policy-routing disable || true
+	fi
+	exit 0
+endef
+
+$(eval $(call BuildPackage,vpn-policy-routing))
@@ -0,0 +1,3 @@
+# README
+
+README has been moved to [https://docs.openwrt.melmac.net/vpn-policy-routing/](https://docs.openwrt.melmac.net/vpn-policy-routing/).
@@ -0,0 +1,19 @@
+#!/bin/sh
+# This file is heavily based on code from https://github.com/Xentrk/netflix-vpn-bypass/blob/master/IPSET_Netflix.sh
+
+TARGET_IPSET='wan'
+
+TARGET_URL="https://ip-ranges.amazonaws.com/ip-ranges.json"
+TARGET_FNAME="/var/vpn-policy-routing_tmp_aws_ip_ranges"
+
+_ret=1
+
+if [ ! -s "$TARGET_FNAME" ]; then
+	curl "$TARGET_URL" 2>/dev/null | grep "ip_prefix" | sed 's/^.*\"ip_prefix\": \"//; s/\",//' > "$TARGET_FNAME"
+fi
+if [ -s "$TARGET_FNAME" ]; then
+	awk -v ipset="$TARGET_IPSET" '{print "add " ipset " " $1}' "$TARGET_FNAME" | ipset restore -! && _ret=0
+fi
+rm -f "$TARGET_FNAME"
+
+return $_ret
@@ -0,0 +1,30 @@
+config vpn-policy-routing 'config'
+	option enabled '0'
+	option verbosity '2'
+	option strict_enforcement '1'
+	option src_ipset '0'
+	option dest_ipset '0'
+	option resolver_ipset 'dnsmasq.ipset'
+	option ipv6_enabled '0'
+	list ignored_interface 'vpnserver wgserver'
+	option boot_timeout '30'
+	option iptables_rule_option 'append'
+	option procd_reload_delay '1'
+	option webui_enable_column '0'
+	option webui_protocol_column '0'
+	option webui_chain_column '0'
+	option webui_show_ignore_target '0'
+	option webui_sorting '1'
+	list webui_supported_protocol 'tcp'
+	list webui_supported_protocol 'udp'
+	list webui_supported_protocol 'tcp udp'
+	list webui_supported_protocol 'icmp'
+	list webui_supported_protocol 'all'
+
+config include
+	option path '/etc/vpn-policy-routing.netflix.user'
+	option enabled 0
+
+config include
+	option path '/etc/vpn-policy-routing.aws.user'
+	option enabled 0
@@ -0,0 +1,6 @@
+#!/bin/sh
+
+[ "$ACTION" = "reload" ] || exit 0
+
+logger -t "vpn-policy-routing" "Reloading vpn-policy-routing due to $ACTION of firewall"
+/etc/init.d/vpn-policy-routing reload
@@ -0,0 +1,37 @@
+#!/bin/sh
+# This file is heavily based on code from https://github.com/Xentrk/netflix-vpn-bypass/blob/master/IPSET_Netflix.sh
+# Credits to https://forum.openwrt.org/u/dscpl for api.hackertarget.com code.
+# Credits to https://github.com/kkeker and https://github.com/tophirsch for api.bgpview.io code.
+
+TARGET_IPSET='wan'
+TARGET_ASN='2906'
+TARGET_FNAME="/var/vpn-policy-routing_tmp_AS${TARGET_ASN}"
+#DB_SOURCE='ipinfo.io'
+#DB_SOURCE='api.hackertarget.com'
+DB_SOURCE='api.bgpview.io'
+
+_ret=1
+
+if [ ! -s "$TARGET_FNAME" ]; then
+	if [ "$DB_SOURCE" = "ipinfo.io" ]; then
+		TARGET_URL="https://ipinfo.io/AS${TARGET_ASN}"
+		curl "$TARGET_URL" 2>/dev/null | grep -E "a href.*${TARGET_ASN}\/" | grep -v ":" | sed "s/^.*<a href=\"\/AS${TARGET_ASN}\///; s/\" >//" > "$TARGET_FNAME"
+	fi
+
+	if [ "$DB_SOURCE" = "api.hackertarget.com" ]; then
+		TARGET_URL="https://api.hackertarget.com/aslookup/?q=AS${TARGET_ASN}"
+		curl "$TARGET_URL" 2>/dev/null | sed '1d' > "$TARGET_FNAME"
+	fi
+
+	if [ "$DB_SOURCE" = "api.bgpview.io" ]; then
+		TARGET_URL="https://api.bgpview.io/asn/${TARGET_ASN}/prefixes"
+		curl -s "$TARGET_URL" 2>/dev/null | jsonfilter -e '@.data.ipv4_prefixes[*].prefix' > "$TARGET_FNAME"
+	fi
+fi
+
+if [ -s "$TARGET_FNAME" ]; then
+	awk -v ipset="$TARGET_IPSET" '{print "add " ipset " " $1}' "$TARGET_FNAME" | ipset restore -! && _ret=0
+fi
+rm -f "$TARGET_FNAME"
+
+return $_ret
@@ -0,0 +1,3 @@
+#!/bin/sh
+
+/etc/init.d/"$1" version 2>&1 | grep "$2"