From 1f78dd5ed4837a3d9eacebce5597f7dca7a11bec Mon Sep 17 00:00:00 2001 From: CN_SZTL Date: Wed, 19 Feb 2020 00:27:25 +0800 Subject: [PATCH] luci-app-passwall : fix optimize iptables --- package/lienol/luci-app-passwall/Makefile | 2 +- .../root/usr/share/passwall/iptables.sh | 121 +++++++++--------- 2 files changed, 61 insertions(+), 62 deletions(-) diff --git a/package/lienol/luci-app-passwall/Makefile b/package/lienol/luci-app-passwall/Makefile index 102a03a05c..1fe1ef0107 100644 --- a/package/lienol/luci-app-passwall/Makefile +++ b/package/lienol/luci-app-passwall/Makefile @@ -7,7 +7,7 @@ include $(TOPDIR)/rules.mk PKG_NAME:=luci-app-passwall PKG_VERSION:=3.5 -PKG_RELEASE:=14 +PKG_RELEASE:=15 PKG_DATA:=20200218 PKG_BUILD_DIR := $(BUILD_DIR)/$(PKG_NAME)-$(PKG_VERSION) diff --git a/package/lienol/luci-app-passwall/root/usr/share/passwall/iptables.sh b/package/lienol/luci-app-passwall/root/usr/share/passwall/iptables.sh index 58e3ac098a..cba35b4c5b 100755 --- a/package/lienol/luci-app-passwall/root/usr/share/passwall/iptables.sh +++ b/package/lienol/luci-app-passwall/root/usr/share/passwall/iptables.sh @@ -154,13 +154,15 @@ load_acl() { if [ "$TCP_NODE_TYPE" == "brook" ]; then [ "$TCP_NO_REDIR_PORTS" != "disable" ] && $ipt_m -A PSW_ACL $(factor $ip "-s") $(factor $mac "-m mac --mac-source") -p tcp -m multiport --dport $TCP_NO_REDIR_PORTS -j RETURN eval tcp_redir_port=\$TCP_REDIR_PORT$tcp_node - $ipt_m -A PSW_ACL $(factor $ip "-s") $(factor $mac "-m mac --mac-source") -p tcp $(dst $IPSET_BLACKLIST) -m comment --comment "$remarks" -j TPROXY --tproxy-mark 0x1/0x1 --on-port $tcp_redir_port + $ipt_m -A PSW_ACL $(factor $ip "-s") $(factor $mac "-m mac --mac-source") -p tcp $(dst $IPSET_BLACKLIST) $(factor $tcp_redir_ports "-m multiport --dport") -m comment --comment "$remarks" -j TPROXY --tproxy-mark 0x1/0x1 --on-port $tcp_redir_port $ipt_m -A PSW_ACL $(factor $ip "-s") $(factor $mac "-m mac --mac-source") -p tcp $(factor $tcp_redir_ports "-m multiport --dport") -m comment --comment "$remarks" -$(get_jump_mode $proxy_mode) $(get_action_chain $proxy_mode)$tcp_node + $ipt_m -A PSW_ACL $(factor $ip "-s") $(factor $mac "-m mac --mac-source") -p tcp -m comment --comment "$remarks" -j RETURN else [ "$TCP_NO_REDIR_PORTS" != "disable" ] && $ipt_n -A PSW_ACL $(factor $ip "-s") $(factor $mac "-m mac --mac-source") -p tcp -m multiport --dport $TCP_NO_REDIR_PORTS -j RETURN eval tcp_redir_port=\$TCP_REDIR_PORT$tcp_node - $ipt_n -A PSW_ACL $(factor $ip "-s") $(factor $mac "-m mac --mac-source") -p tcp $(dst $IPSET_BLACKLIST) -m comment --comment "$remarks" -j REDIRECT --to-ports $tcp_redir_port + $ipt_n -A PSW_ACL $(factor $ip "-s") $(factor $mac "-m mac --mac-source") -p tcp $(dst $IPSET_BLACKLIST) $(factor $tcp_redir_ports "-m multiport --dport") -m comment --comment "$remarks" -j REDIRECT --to-ports $tcp_redir_port $ipt_n -A PSW_ACL $(factor $ip "-s") $(factor $mac "-m mac --mac-source") -p tcp $(factor $tcp_redir_ports "-m multiport --dport") -m comment --comment "$remarks" -$(get_jump_mode $proxy_mode) $(get_action_chain $proxy_mode)$tcp_node + $ipt_n -A PSW_ACL $(factor $ip "-s") $(factor $mac "-m mac --mac-source") -p tcp -m comment --comment "$remarks" -j RETURN fi } [ "$UDP_NODE" != "nil" ] && { @@ -168,6 +170,7 @@ load_acl() { eval udp_redir_port=\$UDP_REDIR_PORT$udp_node $ipt_m -A PSW_ACL $(factor $ip "-s") $(factor $mac "-m mac --mac-source") -p udp $(dst $IPSET_BLACKLIST) -m comment --comment "$remarks" -j TPROXY --on-port $udp_redir_port --tproxy-mark 0x1/0x1 $ipt_m -A PSW_ACL $(factor $ip "-s") $(factor $mac "-m mac --mac-source") -p udp $(factor $udp_redir_ports "-m multiport --dport") -m comment --comment "$remarks" -$(get_jump_mode $proxy_mode) $(get_action_chain $proxy_mode)$udp_node + $ipt_m -A PSW_ACL $(factor $ip "-s") $(factor $mac "-m mac --mac-source") -p udp -m comment --comment "$remarks" -j RETURN } fi [ -z "$ip" ] && { @@ -240,6 +243,9 @@ add_firewall_rule() { $ipt_n -A PSW $(dst $IPSET_WHITELIST) -j RETURN $ipt_n -N PSW_ACL $ipt_n -N PSW_OUTPUT + $ipt_n -A PSW_OUTPUT $(dst $IPSET_LANIPLIST) -j RETURN + $ipt_n -A PSW_OUTPUT $(dst $IPSET_VPSIPLIST) -j RETURN + $ipt_n -A PSW_OUTPUT $(dst $IPSET_WHITELIST) -j RETURN $ipt_m -N PSW $ipt_m -A PSW $(dst $IPSET_LANIPLIST) -j RETURN @@ -247,6 +253,9 @@ add_firewall_rule() { $ipt_m -A PSW $(dst $IPSET_WHITELIST) -j RETURN $ipt_m -N PSW_ACL $ipt_m -N PSW_OUTPUT + $ipt_m -A PSW_OUTPUT $(dst $IPSET_LANIPLIST) -j RETURN + $ipt_m -A PSW_OUTPUT $(dst $IPSET_VPSIPLIST) -j RETURN + $ipt_m -A PSW_OUTPUT $(dst $IPSET_WHITELIST) -j RETURN if [[ "$TCP_NODE_NUM" -ge 1 ]] || [[ "$UDP_NODE_NUM" -ge 1 ]]; then local max_num=1 @@ -300,7 +309,6 @@ add_firewall_rule() { if [ "$TCP_NODE_TYPE" == "brook" ]; then $ipt_m -A PSW_ACL -p tcp -m socket -j MARK --set-mark 1 - # $ipt_m -A PSW$k -p tcp $(dst $IPSET_BLACKLIST) -j TPROXY --tproxy-mark 0x1/0x1 --on-port $local_port # 全局模式 $ipt_m -A PSW_GLO$k -p tcp -j TPROXY --tproxy-mark 0x1/0x1 --on-port $local_port @@ -343,7 +351,6 @@ add_firewall_rule() { $ipt_m -A PSW_OUTPUT -p tcp -d $TCP_NODE_IP --dport $TCP_NODE_PORT -j RETURN } - $ipt_m -A PSW_OUTPUT -p tcp $(dst $IPSET_LANIPLIST) -j RETURN [ "$use_tcp_node_resolve_dns" == 1 -a -n "$DNS_FORWARD" ] && { for dns in $DNS_FORWARD do @@ -353,53 +360,48 @@ add_firewall_rule() { $ipt_m -I PSW 2 -p tcp -d $dns_ip --dport $dns_port -j TPROXY --tproxy-mark 0x1/0x1 --on-port $local_port done } - $ipt_m -A PSW_OUTPUT -p tcp $(dst $IPSET_VPSIPLIST) -j RETURN - $ipt_m -A PSW_OUTPUT -p tcp $(dst $IPSET_WHITELIST) -j RETURN # 用于本机流量转发 [ "$TCP_NO_REDIR_PORTS" != "disable" ] && $ipt_m -A PSW_OUTPUT -p tcp -m multiport --dport $TCP_NO_REDIR_PORTS -j RETURN - $ipt_m -A PSW_OUTPUT -p tcp -m multiport --dport $TCP_REDIR_PORTS $(dst $IPSET_ROUTER) -j MARK --set-mark 1 - $ipt_m -A PSW_OUTPUT -p tcp -m multiport --dport $TCP_REDIR_PORTS $(dst $IPSET_GFW) -j MARK --set-mark 1 - fi - - [ -n "$TCP_NODE_IP" -a -n "$TCP_NODE_PORT" ] && { - $ipt_n -A PSW -p tcp -d $TCP_NODE_IP --dport $TCP_NODE_PORT -j RETURN - $ipt_n -A PSW_OUTPUT -p tcp -d $TCP_NODE_IP --dport $TCP_NODE_PORT -j RETURN - } - PRE_INDEX=1 - KP_INDEX=$($ipt_n -L PREROUTING --line-numbers | grep "KOOLPROXY" | sed -n '$p' | awk '{print $1}') - ADBYBY_INDEX=$($ipt_n -L PREROUTING --line-numbers | grep "ADBYBY" | sed -n '$p' | awk '{print $1}') - if [ -n "$KP_INDEX" -a -z "$ADBYBY_INDEX" ]; then - PRE_INDEX=$(expr $KP_INDEX + 1) - elif [ -z "$KP_INDEX" -a -n "$ADBYBY_INDEX" ]; then - PRE_INDEX=$(expr $ADBYBY_INDEX + 1) - elif [ -z "$KP_INDEX" -a -z "$ADBYBY_INDEX" ]; then - PR_INDEX=$($ipt_n -L PREROUTING --line-numbers | grep "prerouting_rule" | sed -n '$p' | awk '{print $1}') - [ -n "$PR_INDEX" ] && { - PRE_INDEX=$(expr $PR_INDEX + 1) + $ipt_m -A PSW_OUTPUT -p tcp -m multiport --dport $TCP_REDIR_PORTS $(dst $IPSET_BLACKLIST) $(factor $TCP_REDIR_PORTS "-m multiport --dport") -j MARK --set-mark 1 + $ipt_m -A PSW_OUTPUT -p tcp -m multiport --dport $TCP_REDIR_PORTS $(dst $IPSET_ROUTER) $(factor $TCP_REDIR_PORTS "-m multiport --dport") -j MARK --set-mark 1 + [ "$LOCALHOST_PROXY_MODE" == "global" ] && $ipt_m -A PSW_OUTPUT -p tcp $(factor $TCP_REDIR_PORTS "-m multiport --dport") -j MARK --set-mark 1 + [ "$LOCALHOST_PROXY_MODE" == "gfwlist" ] && $ipt_m -A PSW_OUTPUT -p tcp $(dst $IPSET_GFW) $(factor $TCP_REDIR_PORTS "-m multiport --dport") -j MARK --set-mark 1 + [ "$LOCALHOST_PROXY_MODE" == "chnroute" ] && $ipt_m -A PSW_OUTPUT -p tcp -m set ! --match-set $IPSET_CHN dst $(factor $TCP_REDIR_PORTS "-m multiport --dport") -j MARK --set-mark 1 + else + [ -n "$TCP_NODE_IP" -a -n "$TCP_NODE_PORT" ] && { + $ipt_n -A PSW -p tcp -d $TCP_NODE_IP --dport $TCP_NODE_PORT -j RETURN + $ipt_n -A PSW_OUTPUT -p tcp -d $TCP_NODE_IP --dport $TCP_NODE_PORT -j RETURN } + PRE_INDEX=1 + KP_INDEX=$($ipt_n -L PREROUTING --line-numbers | grep "KOOLPROXY" | sed -n '$p' | awk '{print $1}') + ADBYBY_INDEX=$($ipt_n -L PREROUTING --line-numbers | grep "ADBYBY" | sed -n '$p' | awk '{print $1}') + if [ -n "$KP_INDEX" -a -z "$ADBYBY_INDEX" ]; then + PRE_INDEX=$(expr $KP_INDEX + 1) + elif [ -z "$KP_INDEX" -a -n "$ADBYBY_INDEX" ]; then + PRE_INDEX=$(expr $ADBYBY_INDEX + 1) + elif [ -z "$KP_INDEX" -a -z "$ADBYBY_INDEX" ]; then + PR_INDEX=$($ipt_n -L PREROUTING --line-numbers | grep "prerouting_rule" | sed -n '$p' | awk '{print $1}') + [ -n "$PR_INDEX" ] && { + PRE_INDEX=$(expr $PR_INDEX + 1) + } + fi + + # 用于本机流量转发 + $ipt_n -A OUTPUT -j PSW_OUTPUT + [ "$use_tcp_node_resolve_dns" == 1 -a -n "$DNS_FORWARD" ] && { + for dns in $DNS_FORWARD + do + local dns_ip=$(echo $dns | awk -F "#" '{print $1}') + local dns_port=$(echo $dns | awk -F "#" '{print $2}') + [ -z "$dns_port" ] && dns_port=53 + $ipt_n -I PSW_OUTPUT 2 -p tcp -d $dns_ip --dport $dns_port -j REDIRECT --to-ports $TCP_REDIR_PORT1 + done + } + [ "$TCP_NO_REDIR_PORTS" != "disable" ] && $ipt_n -A PSW_OUTPUT -p tcp -m multiport --dport $TCP_NO_REDIR_PORTS -j RETURN + $ipt_n -A PSW_OUTPUT -p tcp $(dst $IPSET_BLACKLIST) $(factor $TCP_REDIR_PORTS "-m multiport --dport") -j REDIRECT --to-ports $TCP_REDIR_PORT1 + $ipt_n -A PSW_OUTPUT -p tcp $(dst $IPSET_ROUTER) $(factor $TCP_REDIR_PORTS "-m multiport --dport") -j REDIRECT --to-ports $TCP_REDIR_PORT1 + $ipt_n -A PSW_OUTPUT -p tcp $(factor $TCP_REDIR_PORTS "-m multiport --dport") -j $(get_action_chain $LOCALHOST_PROXY_MODE)1 fi - $ipt_n -I PREROUTING $PRE_INDEX -j PSW - - # 用于本机流量转发 - $ipt_n -A OUTPUT -j PSW_OUTPUT - $ipt_n -A PSW_OUTPUT $(dst $IPSET_LANIPLIST) -j RETURN - [ "$use_tcp_node_resolve_dns" == 1 -a -n "$DNS_FORWARD" ] && { - for dns in $DNS_FORWARD - do - local dns_ip=$(echo $dns | awk -F "#" '{print $1}') - local dns_port=$(echo $dns | awk -F "#" '{print $2}') - [ -z "$dns_port" ] && dns_port=53 - $ipt_n -A PSW_OUTPUT -p tcp -d $dns_ip --dport $dns_port -j REDIRECT --to-ports $TCP_REDIR_PORT1 - done - } - $ipt_n -A PSW_OUTPUT $(dst $IPSET_VPSIPLIST) -j RETURN - $ipt_n -A PSW_OUTPUT $(dst $IPSET_WHITELIST) -j RETURN - - [ "$TCP_NO_REDIR_PORTS" != "disable" ] && $ipt_n -A PSW_OUTPUT -p tcp -m multiport --dport $TCP_NO_REDIR_PORTS -j RETURN - - $ipt_n -A PSW_OUTPUT -p tcp -m multiport --dport $TCP_REDIR_PORTS $(dst $IPSET_BLACKLIST) -j REDIRECT --to-ports $TCP_REDIR_PORT1 - $ipt_n -A PSW_OUTPUT -p tcp -m multiport --dport $TCP_REDIR_PORTS $(dst $IPSET_ROUTER) -j REDIRECT --to-ports $TCP_REDIR_PORT1 - $ipt_n -A PSW_OUTPUT -p tcp -m multiport --dport $TCP_REDIR_PORTS -j $(get_action_chain $LOCALHOST_PROXY_MODE)1 } # 重定所有流量到透明代理端口 @@ -429,6 +431,7 @@ add_firewall_rule() { fi done $ipt_n -A PSW -j PSW_ACL + $ipt_n -I PREROUTING $PRE_INDEX -j PSW else echolog "主节点未选择，无法转发TCP！" fi @@ -469,22 +472,18 @@ add_firewall_rule() { [ "$k" == 1 ] && { # 用于本机流量转发 $ipt_m -A OUTPUT -j PSW_OUTPUT - $ipt_m -A PSW_OUTPUT -p udp $(dst $IPSET_LANIPLIST) -j RETURN [ "$use_udp_node_resolve_dns" == 1 -a -n "$DNS_FORWARD" ] && { for dns in $DNS_FORWARD do local dns_ip=$(echo $dns | awk -F "#" '{print $1}') local dns_port=$(echo $dns | awk -F "#" '{print $2}') [ -z "$dns_port" ] && dns_port=53 - $ipt_m -A PSW_OUTPUT -p udp -d $dns_ip --dport $dns_port -j MARK --set-mark 1 $ipt_m -I PSW 2 -p udp -d $dns_ip --dport $dns_port -j TPROXY --tproxy-mark 0x1/0x1 --on-port $local_port + $ipt_m -I PSW_OUTPUT 2 -p udp -d $dns_ip --dport $dns_port -j MARK --set-mark 1 done } - $ipt_m -A PSW_OUTPUT -p udp $(dst $IPSET_VPSIPLIST) -j RETURN - $ipt_m -A PSW_OUTPUT -p udp $(dst $IPSET_WHITELIST) -j RETURN [ "$UDP_NO_REDIR_PORTS" != "disable" ] && $ipt_m -A PSW_OUTPUT -p udp -m multiport --dport $UDP_NO_REDIR_PORTS -j RETURN - $ipt_m -A PSW_OUTPUT -p udp -m multiport --dport $UDP_REDIR_PORTS $(dst $IPSET_BLACKLIST) -j MARK --set-mark 1 $ipt_m -A PSW_OUTPUT -p udp -m multiport --dport $UDP_REDIR_PORTS $(dst $IPSET_ROUTER) -j MARK --set-mark 1 [ "$LOCALHOST_PROXY_MODE" == "global" ] && $ipt_m -A PSW_OUTPUT -p udp -m multiport --dport $UDP_REDIR_PORTS -j MARK --set-mark 1 @@ -496,6 +495,7 @@ add_firewall_rule() { fi done $ipt_m -A PSW -j PSW_ACL + $ipt_m -A PREROUTING -j PSW else echolog "UDP节点未选择，无法转发UDP！" fi @@ -512,8 +512,6 @@ add_firewall_rule() { $ipt_m -I PSW_OUTPUT 2 -p udp -d $ip --dport $port -j RETURN done fi - - $ipt_m -A PREROUTING -j PSW # 加载ACLS config_foreach load_acl "acl_rule" @@ -527,17 +525,18 @@ add_firewall_rule() { local TCP_NODE_TYPE1=$(echo $(config_get $TCP_NODE1 type) | tr 'A-Z' 'a-z') if [ "$TCP_NODE_TYPE1" == "brook" ]; then [ "$TCP_NO_REDIR_PORTS" != "disable" ] && $ipt_m -A PSW_ACL -p tcp -m multiport --dport $TCP_NO_REDIR_PORTS -m comment --comment "Default" -j RETURN - $ipt_m -A PSW_ACL -p tcp $(dst $IPSET_BLACKLIST) -m comment --comment "Default" -j TPROXY --tproxy-mark 0x1/0x1 --on-port $local_port - $ipt_m -A PSW_ACL -p tcp -m multiport --dport $TCP_REDIR_PORTS -m comment --comment "Default" -j $(get_action_chain $PROXY_MODE)1 + $ipt_m -A PSW_ACL -p tcp $(dst $IPSET_BLACKLIST) $(factor $TCP_REDIR_PORTS "-m multiport --dport") -m comment --comment "Default" -j TPROXY --tproxy-mark 0x1/0x1 --on-port $TCP_REDIR_PORT1 + $ipt_m -A PSW_ACL -p tcp $(factor $TCP_REDIR_PORTS "-m multiport --dport") -m comment --comment "Default" -j $(get_action_chain $PROXY_MODE)1 + else + [ "$TCP_NO_REDIR_PORTS" != "disable" ] && $ipt_n -A PSW_ACL -p tcp -m multiport --dport $TCP_NO_REDIR_PORTS -m comment --comment "Default" -j RETURN + $ipt_n -A PSW_ACL -p tcp $(dst $IPSET_BLACKLIST) $(factor $TCP_REDIR_PORTS "-m multiport --dport") -m comment --comment "Default" -j REDIRECT --to-ports $TCP_REDIR_PORT1 + $ipt_n -A PSW_ACL -p tcp $(factor $TCP_REDIR_PORTS "-m multiport --dport") -m comment --comment "Default" -j $(get_action_chain $PROXY_MODE)1 fi - [ "$TCP_NO_REDIR_PORTS" != "disable" ] && $ipt_n -A PSW_ACL -p tcp -m multiport --dport $TCP_NO_REDIR_PORTS -m comment --comment "Default" -j RETURN - $ipt_n -A PSW_ACL -p tcp $(dst $IPSET_BLACKLIST) -m comment --comment "Default" -j REDIRECT --to-ports $TCP_REDIR_PORT1 - $ipt_n -A PSW_ACL -p tcp -m multiport --dport $TCP_REDIR_PORTS -m comment --comment "Default" -j $(get_action_chain $PROXY_MODE)1 } [ "$UDP_NODE1" != "nil" ] && { [ "$UDP_NO_REDIR_PORTS" != "disable" ] && $ipt_m -A PSW_ACL -p udp -m multiport --dport $UDP_NO_REDIR_PORTS -m comment --comment "Default" -j RETURN - $ipt_m -A PSW_ACL -p udp $(dst $IPSET_BLACKLIST) -m comment --comment "Default" -j TPROXY --on-port $UDP_REDIR_PORT1 --tproxy-mark 0x1/0x1 - $ipt_m -A PSW_ACL -p udp -m multiport --dport $UDP_REDIR_PORTS -m comment --comment "Default" -j $(get_action_chain $PROXY_MODE)1 + $ipt_m -A PSW_ACL -p udp $(dst $IPSET_BLACKLIST) $(factor $UDP_REDIR_PORTS "-m multiport --dport") -m comment --comment "Default" -j TPROXY --on-port $UDP_REDIR_PORT1 --tproxy-mark 0x1/0x1 + $ipt_m -A PSW_ACL -p udp $(factor $UDP_REDIR_PORTS "-m multiport --dport") -m comment --comment "Default" -j $(get_action_chain $PROXY_MODE)1 } fi