fish/immortalwrt
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

luci-app-passwall: sync with upstream source

Browse Source
This commit is contained in:
CN_SZTL 2020-01-21 13:56:32 +08:00
parent 73b0ad36ae
commit 5861552dfe
No known key found for this signature in database
GPG Key ID: 6850B6345C862176
9 changed files with 250 additions and 161 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
package/lienol/luci-app-passwall/Makefile
View File

@ -7,7 +7,7 @@ include $(TOPDIR)/rules.mk
PKG_NAME:=luci-app-passwall
PKG_VERSION:=3.3
PKG_RELEASE:=30-20200118
PKG_RELEASE:=32-20200121
PKG_BUILD_DIR := $(BUILD_DIR)/$(PKG_NAME)-$(PKG_VERSION)

55
package/lienol/luci-app-passwall/luasrc/model/cbi/passwall/api/gen_v2ray_client_config_file.lua
View File

@ -1,5 +1,6 @@
local ucursor = require"luci.model.uci".cursor()
local json = require "luci.jsonc"
local api = require "luci.model.cbi.passwall.api.api"
local node_section = arg[1]
local proto = arg[2]
local redir_port = arg[3]
@ -7,6 +8,7 @@ local socks5_proxy_port = arg[4]
local node = ucursor:get_all("passwall", node_section)
local inbound_json = {}
local inboundDetour_json = nil
local vnext = {}
if socks5_proxy_port ~= "nil" then
inbound_json = {
@ -43,6 +45,42 @@ if redir_port ~= "nil" then
end
end
if node.v2ray_balancing_node then
local nodes = node.v2ray_balancing_node
local length = #nodes
for i = 1, length do
local id = nodes[i]
local vnext_json = {
address = api.uci_get_type_id(id, "address"),
port = tonumber(api.uci_get_type_id(id, "port")),
users = {
{
id = api.uci_get_type_id(id, "v2ray_VMess_id"),
alterId = tonumber(api.uci_get_type_id(id, "v2ray_VMess_alterId")),
level = tonumber(api.uci_get_type_id(id, "v2ray_VMess_level")),
security = api.uci_get_type_id(id, "v2ray_security")
}
}
}
vnext[i] = vnext_json
end
else
vnext = {
{
address = node.address,
port = tonumber(node.port),
users = {
{
id = node.v2ray_VMess_id,
alterId = tonumber(node.v2ray_VMess_alterId),
level = tonumber(node.v2ray_VMess_level),
security = node.v2ray_security
}
}
}
}
end
local v2ray = {
log = {
-- error = "/var/log/v2ray.log",
@ -95,22 +133,7 @@ local v2ray = {
header = {type = node.v2ray_quic_guise}
} or nil
},
settings = {
vnext = {
{
address = node.address,
port = tonumber(node.port),
users = {
{
id = node.v2ray_VMess_id,
alterId = tonumber(node.v2ray_VMess_alterId),
level = tonumber(node.v2ray_VMess_level),
security = node.v2ray_security
}
}
}
}
}
settings = {vnext = vnext}
}, -- 额外传出连接
{protocol = "freedom", tag = "direct", settings = {keep = ""}}
}

21
package/lienol/luci-app-passwall/luasrc/model/cbi/passwall/global.lua
View File

@ -16,12 +16,15 @@ end
local n = {}
uci:foreach(appname, "nodes", function(e)
if e.type and e.address and e.remarks then
local type = e.type
local address = e.address
if address == nil then address = "" end
if type and address and e.remarks then
if e.use_kcp and e.use_kcp == "1" then
n[e[".name"]] = "%s+%s：[%s] %s" %
{e.type, "Kcptun", e.remarks, e.address}
{translate(type), "Kcptun", e.remarks, address}
else
n[e[".name"]] = "%s：[%s] %s" % {e.type, e.remarks, e.address}
n[e[".name"]] = "%s：[%s] %s" % {translate(type), e.remarks, address}
end
end
end)
@ -153,16 +156,22 @@ if is_installed("pdnsd") or is_installed("pdnsd-alt") or is_finded("pdnsd") then
o:depends("dns_mode", "pdnsd")
end
---- DNS Forward
o = s:option(Value, "dns_forward", translate("DNS Address"))
o = s:option(Value, "dns2socks_forward", translate("DNS Address"))
o.default = "8.8.4.4"
o:value("8.8.4.4", "8.8.4.4 (Google DNS)")
o:value("8.8.8.8", "8.8.8.8 (Google DNS)")
o:value("208.67.222.222", "208.67.222.222 (Open DNS)")
o:value("208.67.220.220", "208.67.220.220 (Open DNS)")
o:depends("dns_mode", "dns2socks")
o:depends("dns_mode", "pdnsd")
o:depends("up_trust_chinadns_ng_dns", "dns2socks")
---- DNS Forward
o = s:option(Value, "dns_forward", translate("DNS Address"))
o.default = "8.8.4.4, 8.8.8.8"
o:value("8.8.4.4, 8.8.8.8", "8.8.4.4, 8.8.8.8 (Google DNS)")
o:value("208.67.222.222", "208.67.222.222 (Open DNS)")
o:value("208.67.220.220", "208.67.220.220 (Open DNS)")
o:depends("dns_mode", "pdnsd")
o:depends("up_trust_chinadns_ng_dns", "pdnsd")
---- DNS Hijack

29
package/lienol/luci-app-passwall/luasrc/model/cbi/passwall/node_config.lua
View File

@ -16,17 +16,6 @@ end
local function is_installed(e) return ipkg.installed(e) end
local n = {}
uci:foreach(appname, "nodes", function(e)
if e.type and e.type == "V2ray" and e.remarks and e.port then
n[e[".name"]] = "[%s] %s:%s" % {e.remarks, e.address, e.port}
end
end)
local key_table = {}
for key, _ in pairs(n) do table.insert(key_table, key) end
table.sort(key_table)
local ss_encrypt_method_list = {
"rc4-md5", "aes-128-cfb", "aes-192-cfb", "aes-256-cfb", "aes-128-ctr",
"aes-192-ctr", "aes-256-ctr", "bf-cfb", "camellia-128-cfb",
@ -81,7 +70,7 @@ if is_finded("ss-redir") then type:value("SS", translate("Shadowsocks")) end
if is_finded("ssr-redir") then type:value("SSR", translate("ShadowsocksR")) end
if is_installed("v2ray") or is_finded("v2ray") then
type:value("V2ray", translate("V2ray"))
--type:value("V2ray_balancing", translate("V2ray Balancing"))
type:value("V2ray_balancing", translate("V2ray Balancing"))
end
if is_installed("brook") or is_finded("brook") then
type:value("Brook", translate("Brook"))
@ -94,10 +83,22 @@ v2ray_protocol = s:option(ListValue, "v2ray_protocol",
translate("V2ray Protocol"))
v2ray_protocol:value("vmess", translate("Vmess"))
v2ray_protocol:depends("type", "V2ray")
v2ray_protocol:depends("type", "V2ray_balancing")
local n = {}
uci:foreach(appname, "nodes", function(e)
if e.type and e.type == "V2ray" and e.remarks and e.port then
n[e[".name"]] = "[%s] %s:%s" % {e.remarks, e.address, e.port}
end
end)
local key_table = {}
for key, _ in pairs(n) do table.insert(key_table, key) end
table.sort(key_table)
v2ray_balancing_node = s:option(DynamicList, "v2ray_balancing_node",
translate("List of backup nodes"), translate(
"List of backup nodes, the first of which must be the primary node and the others the standby node."))
translate("Load balancing node list"), translate(
"Load balancing node list, <a target='_blank' href='https://toutyrater.github.io/app/balance.html'>document</a>"))
for _, key in pairs(key_table) do v2ray_balancing_node:value(key, n[key]) end
v2ray_balancing_node:depends("type", "V2ray_balancing")

6
package/lienol/luci-app-passwall/luasrc/model/cbi/passwall/node_list.lua
View File

@ -75,7 +75,7 @@ if api.uci_get_type("global_other", "compact_display_nodes", "0") == "1" then
local type = api.uci_get_type_id(n, "type") or ""
local address = api.uci_get_type_id(n, "address") or ""
local port = api.uci_get_type_id(n, "port") or ""
if is_sub == "" and group == "" then str = str .. type .. "：" end
if is_sub == "" and group == "" then str = str .. translate(type) .. "：" end
str = str .. remarks
if address ~= "" and port ~= "" then
local s = " （" .. address .. ":" .. port .. "）"
@ -103,6 +103,10 @@ else
---- Type
o = s:option(DummyValue, "type", translate("Type"))
o.cfgvalue = function(t, n)
local v = Value.cfgvalue(t, n)
return translate(v)
end
---- Address
o = s:option(DummyValue, "address", translate("Address"))

95
package/lienol/luci-app-passwall/luasrc/view/passwall/node_list/node_list.htm
View File

@ -161,56 +161,57 @@ table td, .table .td {
var address = document.getElementById("cbid.passwall." + cbi_id + ".address").value;
var port = document.getElementById("cbid.passwall." + cbi_id + ".port").value;
<% end %>
var json = JSON.stringify(auto_ping_value[index]);
ajax.post('<%=dsp.build_url("admin/vpn/passwall/ping_node")%>', {
index: index,
address: address,
port: port
},
function(x, result) {
if(x && x.status == 200) {
for(var i = 0; i < auto_ping_value.length; i++) {
var obj = auto_ping_value[i];
var obj_cbi_id = obj.getAttribute("cbiid");
<% if compact_display_nodes and tonumber(compact_display_nodes) == 1 then %>
var obj_remarks = document.getElementById("cbid.passwall." + obj_cbi_id + ".remarks").value;
var obj_address = null;
var obj_port = null;
if (obj_remarks.lastIndexOf("（") != -1 && obj_remarks.lastIndexOf("）") != -1) {
var obj_address_full = obj_remarks.substring(obj_remarks.lastIndexOf("（") + 1, obj_remarks.lastIndexOf("）"));
obj_address = obj_address_full.substring(0, obj_address_full.lastIndexOf(":"));
obj_port = obj_address_full.substring(obj_address_full.lastIndexOf(":") + 1);
}
<% else %>
var obj_address = document.getElementById("cbid.passwall." + obj_cbi_id + ".address").value;
var obj_port = document.getElementById("cbid.passwall." + obj_cbi_id + ".port").value;
<% end %>
if (address == obj_address && port == obj_port) {
auto_ping_value[i].setAttribute("ping", "1");
if (result.ping == null || result.ping.trim() == "") {
auto_ping_value[i].innerHTML = "<font style='color:red'><%:Timeout%></font>";
} else {
var ping = parseInt(result.ping);
if (ping < 100)
auto_ping_value[i].innerHTML = "<font style='color:green'>" + result.ping + " ms" + "</font>";
else if (ping < 200)
auto_ping_value[i].innerHTML = "<font style='color:#fb9a05'>" + result.ping + " ms" + "</font>";
else if (ping >= 200)
auto_ping_value[i].innerHTML = "<font style='color:red'>" + result.ping + " ms" + "</font>";
if ((address != null && address != "") && (port != null && port != "")) {
ajax.post('<%=dsp.build_url("admin/vpn/passwall/ping_node")%>', {
index: index,
address: address,
port: port
},
function(x, result) {
if(x && x.status == 200) {
for(var i = 0; i < auto_ping_value.length; i++) {
var obj = auto_ping_value[i];
var obj_cbi_id = obj.getAttribute("cbiid");
<% if compact_display_nodes and tonumber(compact_display_nodes) == 1 then %>
var obj_remarks = document.getElementById("cbid.passwall." + obj_cbi_id + ".remarks").value;
var obj_address = null;
var obj_port = null;
if (obj_remarks.lastIndexOf("（") != -1 && obj_remarks.lastIndexOf("）") != -1) {
var obj_address_full = obj_remarks.substring(obj_remarks.lastIndexOf("（") + 1, obj_remarks.lastIndexOf("）"));
obj_address = obj_address_full.substring(0, obj_address_full.lastIndexOf(":"));
obj_port = obj_address_full.substring(obj_address_full.lastIndexOf(":") + 1);
}
<% else %>
var obj_address = document.getElementById("cbid.passwall." + obj_cbi_id + ".address").value;
var obj_port = document.getElementById("cbid.passwall." + obj_cbi_id + ".port").value;
<% end %>
if (address == obj_address && port == obj_port) {
auto_ping_value[i].setAttribute("ping", "1");
if (result.ping == null || result.ping.trim() == "") {
auto_ping_value[i].innerHTML = "<font style='color:red'><%:Timeout%></font>";
} else {
var ping = parseInt(result.ping);
if (ping < 100)
auto_ping_value[i].innerHTML = "<font style='color:green'>" + result.ping + " ms" + "</font>";
else if (ping < 200)
auto_ping_value[i].innerHTML = "<font style='color:#fb9a05'>" + result.ping + " ms" + "</font>";
else if (ping >= 200)
auto_ping_value[i].innerHTML = "<font style='color:red'>" + result.ping + " ms" + "</font>";
}
}
}
}
}
index++;
auto_ping();
},
function(x) {
auto_ping_value[index].innerHTML = "<font style='color:red'><%:Timeout%></font>";
index++;
auto_ping();
},
);
index++;
auto_ping();
},
function(x) {
auto_ping_value[index].innerHTML = "<font style='color:red'><%:Timeout%></font>";
index++;
auto_ping();
},
);
}
}
else {
index++;

30
package/lienol/luci-app-passwall/po/zh-cn/passwall.po
View File

@ -1,24 +1,6 @@
msgid "Pass Wall"
msgstr "正确上网姿势 √"
msgid "Shadowsocks Server"
msgstr "ShadowSocks 服务器"
msgid "ShadowsocksR Server"
msgstr "ShadowSocksR 服务器"
msgid "Socks5 Server"
msgstr "Socks5 服务器"
msgid "V2ray Server"
msgstr "V2ray 服务器"
msgid "Brook Server"
msgstr "Brook 服务器"
msgid "Trojan Server"
msgstr "Trojan 服务器"
msgid "Auto"
msgstr "自动"
@ -301,6 +283,18 @@ msgstr "添加方式"
msgid "Type"
msgstr "类型"
msgid "V2ray Balancing"
msgstr "V2ray 负载均衡"
msgid "V2ray_balancing"
msgstr "V2ray 负载均衡"
msgid "Load balancing node list"
msgstr "负载均衡节点列表"
msgid "Load balancing node list, <a target='_blank' href='https://toutyrater.github.io/app/balance.html'>document</a>"
msgstr "负载均衡节点列表，<a target='_blank' href='https://toutyrater.github.io/app/balance.html'>文档原理</a>"
msgid "Address"
msgstr "地址"

53
package/lienol/luci-app-passwall/root/usr/share/passwall/app.sh
View File

@ -273,15 +273,17 @@ gen_start_config() {
local_port=$2
redir_type=$3
config_file=$4
type=$(echo $(config_n_get $node type) | tr 'A-Z' 'a-z')
remarks=$(config_n_get $node remarks)
server_host=$(config_n_get $node address)
use_ipv6=$(config_n_get $node use_ipv6)
network_type="ipv4"
[ "$use_ipv6" == "1" ] && network_type="ipv6"
server_ip=$(get_host_ip $network_type $server_host)
port=$(config_n_get $node port)
type=$(echo $(config_n_get $node type) | tr 'A-Z' 'a-z')
echolog "$redir_type节点：$remarks，节点地址端口：${server_ip}:${port}"
[ -n "$server_host" -a -n "$port" ] && {
use_ipv6=$(config_n_get $node use_ipv6)
network_type="ipv4"
[ "$use_ipv6" == "1" ] && network_type="ipv6"
server_ip=$(get_host_ip $network_type $server_host)
echolog "$redir_type节点：$remarks，节点地址端口：${server_ip}:${port}"
}
if [ "$redir_type" == "SOCKS5" ]; then
if [ "$network_type" == "ipv6" ]; then
@ -450,6 +452,28 @@ gen_start_config() {
else
echolog "找不到V2ray客户端主程序，无法启用！"
fi
elif [ "$type" == "v2ray_balancing" ]; then
local balancing_node=$(config_n_get $node v2ray_balancing_node)
balancing_node_address=""
for node_id in $balancing_node
do
local address=$(config_n_get $node_id address)
local port=$(config_n_get $node_id port)
local temp=""
if [ -z "$balancing_node_address" ]; then
temp="${address}:${port}"
else
temp="${balancing_node_address}\n${address}:${port}"
fi
balancing_node_address="$temp"
done
lua $API_GEN_V2RAY $node tcp $local_port nil >$config_file
v2ray_path=$(config_t_get global_app v2ray_file $(find_bin v2ray))
if [ -f "${v2ray_path}/v2ray" ]; then
${v2ray_path}/v2ray -config=$config_file >/dev/null &
else
echolog "找不到V2ray客户端主程序，无法启用！"
fi
elif [ "$type" == "trojan" ]; then
lua $API_GEN_TROJAN $node nat "0.0.0.0" $local_port >$config_file
trojan_bin=$(find_bin trojan)
@ -659,7 +683,8 @@ start_dns() {
if [ -n "$SOCKS5_NODE1" -a "$SOCKS5_NODE1" != "nil" ]; then
dns2socks_bin=$(find_bin dns2socks)
[ -n "$dns2socks_bin" ] && {
nohup $dns2socks_bin 127.0.0.1:$SOCKS5_PROXY_PORT1 ${DNS_FORWARD}:53 127.0.0.1:$DNS_PORT >/dev/null 2>&1 &
DNS2SOCKS_FORWARD=$(config_t_get global dns2socks_forward 8.8.4.4)
nohup $dns2socks_bin 127.0.0.1:$SOCKS5_PROXY_PORT1 $DNS2SOCKS_FORWARD 127.0.0.1:$DNS_PORT >/dev/null 2>&1 &
echolog "运行DNS转发模式：dns2socks..."
}
else
@ -671,6 +696,7 @@ start_dns() {
pdnsd_bin=$(find_bin pdnsd)
[ -n "$pdnsd_bin" ] && {
gen_pdnsd_config $DNS_PORT "cache"
DNS_FORWARD=$(echo $DNS_FORWARD | sed 's/,/ /g')
nohup $pdnsd_bin --daemon -c $pdnsd_dir/pdnsd.conf -d >/dev/null 2>&1 &
echolog "运行DNS转发模式：pdnsd..."
}
@ -693,18 +719,20 @@ start_dns() {
gen_pdnsd_config $other_port
pdnsd_bin=$(find_bin pdnsd)
[ -n "$pdnsd_bin" ] && {
DNS_FORWARD=$(echo $DNS_FORWARD | sed 's/,/ /g')
nohup $pdnsd_bin --daemon -c $pdnsd_dir/pdnsd.conf -d >/dev/null 2>&1 &
nohup $chinadns_ng_bin -l $DNS_PORT -c $UP_CHINA_DNS -t 127.0.0.1#$other_port $gfwlist_param $chnlist_param >/dev/null 2>&1 &
echolog "运行DNS转发模式：ChinaDNS-NG + pdnsd(${DNS_FORWARD}:53)，国内DNS：$UP_CHINA_DNS"
echolog "运行DNS转发模式：ChinaDNS-NG + pdnsd($DNS_FORWARD)，国内DNS：$UP_CHINA_DNS"
}
fi
elif [ "$up_trust_chinadns_ng_dns" == "dns2socks" ]; then
if [ -n "$SOCKS5_NODE1" -a "$SOCKS5_NODE1" != "nil" ]; then
dns2socks_bin=$(find_bin dns2socks)
[ -n "$dns2socks_bin" ] && {
nohup $dns2socks_bin 127.0.0.1:$SOCKS5_PROXY_PORT1 ${DNS_FORWARD}:53 127.0.0.1:$other_port >/dev/null 2>&1 &
DNS2SOCKS_FORWARD=$(config_t_get global dns2socks_forward 8.8.4.4)
nohup $dns2socks_bin 127.0.0.1:$SOCKS5_PROXY_PORT1 $DNS2SOCKS_FORWARD 127.0.0.1:$other_port >/dev/null 2>&1 &
nohup $chinadns_ng_bin -l $DNS_PORT -c $UP_CHINA_DNS -t 127.0.0.1#$other_port $gfwlist_param $chnlist_param >/dev/null 2>&1 &
echolog "运行DNS转发模式：ChinaDNS-NG + dns2socks(${DNS_FORWARD}:53)，国内DNS：$UP_CHINA_DNS"
echolog "运行DNS转发模式：ChinaDNS-NG + dns2socks($DNS2SOCKS_FORWARD)，国内DNS：$UP_CHINA_DNS"
}
else
echolog "dns2socks模式需要使用Socks5代理节点，请开启！"
@ -874,7 +902,7 @@ gen_pdnsd_config() {
max_ttl = 1w;
timeout = 10;
tcp_qtimeout = 1;
par_queries = 2;
par_queries = 1;
neg_domain_pol = on;
udpbufsize = 1024;
}
@ -892,7 +920,6 @@ gen_pdnsd_config() {
interval = 60;
uptest = none;
purge_cache = off;
caching = on;
}
EOF
@ -909,7 +936,6 @@ gen_pdnsd_config() {
interval = 60;
uptest = none;
purge_cache = off;
caching = on;
}
server {
label = "opendns";
@ -920,7 +946,6 @@ gen_pdnsd_config() {
interval = 60;
uptest = none;
purge_cache = off;
caching = on;
}
source {
ttl = 86400;

120
package/lienol/luci-app-passwall/root/usr/share/passwall/iptables.sh
View File

@ -40,7 +40,7 @@ get_ip_mark() {
fi
}
get_dst_list() {
dst() {
echo "-m set --match-set $1 dst"
}
@ -148,13 +148,13 @@ load_acl() {
[ "$TCP_NODE" != "nil" ] && {
#local TCP_NODE_TYPE=$(echo $(config_get $TCP_NODE type) | tr 'A-Z' 'a-z')
eval tcp_redir_port=\$TCP_REDIR_PORT$tcp_node
$iptables_nat -A PSW_ACL $(factor $ip "-s") $(factor $mac "-m mac --mac-source") -p tcp $(get_dst_list $IPSET_BLACKLIST) -m comment --comment "$remarks" -j REDIRECT --to-ports $tcp_redir_port
$iptables_nat -A PSW_ACL $(factor $ip "-s") $(factor $mac "-m mac --mac-source") -p tcp $(dst $IPSET_BLACKLIST) -m comment --comment "$remarks" -j REDIRECT --to-ports $tcp_redir_port
$iptables_nat -A PSW_ACL $(factor $ip "-s") $(factor $mac "-m mac --mac-source") -p tcp $(factor $tcp_redir_ports "-m multiport --dport") -m comment --comment "$remarks" -$(get_jump_mode $proxy_mode) $(get_action_chain $proxy_mode)$tcp_node
}
[ "$UDP_NODE" != "nil" ] && {
#local UDP_NODE_TYPE=$(echo $(config_get $UDP_NODE type) | tr 'A-Z' 'a-z')
eval udp_redir_port=\$UDP_REDIR_PORT$udp_node
$iptables_mangle -A PSW_ACL $(factor $ip "-s") $(factor $mac "-m mac --mac-source") -p udp $(get_dst_list $IPSET_BLACKLIST) -m comment --comment "$remarks" -j TPROXY --on-port $udp_redir_port --tproxy-mark 0x1/0x1
$iptables_mangle -A PSW_ACL $(factor $ip "-s") $(factor $mac "-m mac --mac-source") -p udp $(dst $IPSET_BLACKLIST) -m comment --comment "$remarks" -j TPROXY --on-port $udp_redir_port --tproxy-mark 0x1/0x1
$iptables_mangle -A PSW_ACL $(factor $ip "-s") $(factor $mac "-m mac --mac-source") -p udp $(factor $udp_redir_ports "-m multiport --dport") -m comment --comment "$remarks" -$(get_jump_mode $proxy_mode) $(get_action_chain $proxy_mode)$udp_node
}
fi
@ -240,15 +240,15 @@ add_firewall_rule() {
config_foreach filter_vpsip "nodes"
$iptables_nat -N PSW
$iptables_nat -A PSW $(get_dst_list $IPSET_LANIPLIST) -j RETURN
$iptables_nat -A PSW $(get_dst_list $IPSET_VPSIPLIST) -j RETURN
$iptables_nat -A PSW $(get_dst_list $IPSET_WHITELIST) -j RETURN
$iptables_nat -A PSW $(dst $IPSET_LANIPLIST) -j RETURN
$iptables_nat -A PSW $(dst $IPSET_VPSIPLIST) -j RETURN
$iptables_nat -A PSW $(dst $IPSET_WHITELIST) -j RETURN
$iptables_nat -N PSW_ACL
$iptables_mangle -N PSW
$iptables_mangle -A PSW $(get_dst_list $IPSET_LANIPLIST) -j RETURN
$iptables_mangle -A PSW $(get_dst_list $IPSET_VPSIPLIST) -j RETURN
$iptables_mangle -A PSW $(get_dst_list $IPSET_WHITELIST) -j RETURN
$iptables_mangle -A PSW $(dst $IPSET_LANIPLIST) -j RETURN
$iptables_mangle -A PSW $(dst $IPSET_VPSIPLIST) -j RETURN
$iptables_mangle -A PSW $(dst $IPSET_WHITELIST) -j RETURN
$iptables_mangle -N PSW_ACL
if [[ "$TCP_NODE_NUM" -ge 1 ]] || [[ "$UDP_NODE_NUM" -ge 1 ]]; then
@ -303,48 +303,56 @@ add_firewall_rule() {
if [ "$TCP_NODE_TYPE" == "brook" ]; then
$iptables_mangle -A PSW_ACL -p tcp -m socket -j MARK --set-mark 1
# $iptables_mangle -A PSW$k -p tcp $(get_dst_list $IPSET_BLACKLIST) -j TPROXY --tproxy-mark 0x1/0x1 --on-port $local_port
# $iptables_mangle -A PSW$k -p tcp $(dst $IPSET_BLACKLIST) -j TPROXY --tproxy-mark 0x1/0x1 --on-port $local_port
# 全局模式
$iptables_mangle -A PSW_GLO$k -p tcp -j TPROXY --tproxy-mark 0x1/0x1 --on-port $local_port
# GFWLIST模式
$iptables_mangle -A PSW_GFW$k -p tcp $(get_dst_list $IPSET_GFW) -j TPROXY --tproxy-mark 0x1/0x1 --on-port $local_port
$iptables_mangle -A PSW_GFW$k -p tcp $(dst $IPSET_GFW) -j TPROXY --tproxy-mark 0x1/0x1 --on-port $local_port
# 大陆白名单模式
$iptables_mangle -A PSW_CHN$k -p tcp $(get_dst_list $IPSET_CHN) -j RETURN
$iptables_mangle -A PSW_CHN$k -p tcp $(dst $IPSET_CHN) -j RETURN
$iptables_mangle -A PSW_CHN$k -p tcp -j TPROXY --tproxy-mark 0x1/0x1 --on-port $local_port
# 回国模式
$iptables_mangle -A PSW_HOME$k -p tcp $(get_dst_list $IPSET_CHN) -j TPROXY --tproxy-mark 0x1/0x1 --on-port $local_port
$iptables_mangle -A PSW_HOME$k -p tcp $(dst $IPSET_CHN) -j TPROXY --tproxy-mark 0x1/0x1 --on-port $local_port
# 游戏模式
$iptables_mangle -A PSW_GAME$k -p tcp $(get_dst_list $IPSET_CHN) -j RETURN
$iptables_mangle -A PSW_GAME$k -p tcp $(dst $IPSET_CHN) -j RETURN
# 用于本机流量转发，默认只走router
$iptables_mangle -A PSW -s $lan_ip -p tcp $(get_dst_list $IPSET_ROUTER) -j TPROXY --tproxy-mark 0x1/0x1 --on-port $local_port
$iptables_mangle -A OUTPUT -p tcp -m multiport --dport $TCP_REDIR_PORTS $(get_dst_list $IPSET_ROUTER) $iptables_comment -j MARK --set-mark 1
$iptables_mangle -A PSW -s $lan_ip -p tcp $(dst $IPSET_ROUTER) -j TPROXY --tproxy-mark 0x1/0x1 --on-port $local_port
$iptables_mangle -A OUTPUT -p tcp -m multiport --dport $TCP_REDIR_PORTS $(dst $IPSET_ROUTER) $iptables_comment -j MARK --set-mark 1
else
# 全局模式
$iptables_nat -A PSW_GLO$k -p tcp -j REDIRECT --to-ports $local_port
# GFWLIST模式
$iptables_nat -A PSW_GFW$k -p tcp $(get_dst_list $IPSET_ROUTER) -j REDIRECT --to-ports $local_port
$iptables_nat -A PSW_GFW$k -p tcp $(get_dst_list $IPSET_GFW) -j REDIRECT --to-ports $local_port
$iptables_nat -A PSW_GFW$k -p tcp $(dst $IPSET_ROUTER) -j REDIRECT --to-ports $local_port
$iptables_nat -A PSW_GFW$k -p tcp $(dst $IPSET_GFW) -j REDIRECT --to-ports $local_port
# 大陆白名单模式
$iptables_nat -A PSW_CHN$k -p tcp $(get_dst_list $IPSET_CHN) -j RETURN
$iptables_nat -A PSW_CHN$k -p tcp $(dst $IPSET_CHN) -j RETURN
#$iptables_nat -A PSW_CHN$k -p tcp -m geoip ! --destination-country CN -j REDIRECT --to-ports $local_port
$iptables_nat -A PSW_CHN$k -p tcp -j REDIRECT --to-ports $local_port
# 回国模式
#$iptables_nat -A PSW_HOME$k -p tcp -m geoip --destination-country CN -j REDIRECT --to-ports $local_port
$iptables_nat -A PSW_HOME$k -p tcp $(get_dst_list $IPSET_CHN) -j REDIRECT --to-ports $local_port
$iptables_nat -A PSW_HOME$k -p tcp $(dst $IPSET_CHN) -j REDIRECT --to-ports $local_port
# 游戏模式
$iptables_nat -A PSW_GAME$k -p tcp $(get_dst_list $IPSET_CHN) -j RETURN
$iptables_nat -A PSW_GAME$k -p tcp $(dst $IPSET_CHN) -j RETURN
[ "$k" == 1 ] && {
[ "$use_tcp_node_resolve_dns" == 1 -a -n "$DNS_FORWARD" ] && $iptables_nat -I PSW 2 -p tcp -d $DNS_FORWARD -m multiport --dport 1:65535 -j REDIRECT --to-ports $local_port
[ "$use_tcp_node_resolve_dns" == 1 -a -n "$DNS_FORWARD" ] && {
for dns in $DNS_FORWARD
do
local dns_ip=$(echo $dns | awk -F "#" '{print $1}')
local dns_port=$(echo $dns | awk -F "#" '{print $2}')
[ -z "$dns_port" ] && dns_port=53
$iptables_nat -I PSW 2 -p tcp -d $dns_ip --dport $dns_port -j REDIRECT --to-ports $local_port
done
}
is_add_prerouting=0
@ -376,15 +384,23 @@ add_firewall_rule() {
fi
# 用于本机流量转发，默认只走router
#$iptables_nat -I OUTPUT -j PSW
$iptables_nat -A OUTPUT $(get_dst_list $IPSET_LANIPLIST) $iptables_comment -j RETURN
[ "$use_tcp_node_resolve_dns" == 1 -a -n "$DNS_FORWARD" ] && $iptables_nat -A OUTPUT -p tcp -d $DNS_FORWARD -m multiport --dport 1:65535 $iptables_comment -j REDIRECT --to-ports $TCP_REDIR_PORT1
$iptables_nat -A OUTPUT $(get_dst_list $IPSET_VPSIPLIST) $iptables_comment -j RETURN
$iptables_nat -A OUTPUT $(get_dst_list $IPSET_WHITELIST) $iptables_comment -j RETURN
$iptables_nat -A OUTPUT -p tcp -m multiport --dport $TCP_REDIR_PORTS $(get_dst_list $IPSET_ROUTER) $iptables_comment -j REDIRECT --to-ports $TCP_REDIR_PORT1
$iptables_nat -A OUTPUT -p tcp -m multiport --dport $TCP_REDIR_PORTS $(get_dst_list $IPSET_BLACKLIST) $iptables_comment -j REDIRECT --to-ports $TCP_REDIR_PORT1
$iptables_nat -A OUTPUT $(dst $IPSET_LANIPLIST) $iptables_comment -j RETURN
[ "$use_tcp_node_resolve_dns" == 1 -a -n "$DNS_FORWARD" ] && {
for dns in $DNS_FORWARD
do
local dns_ip=$(echo $dns | awk -F "#" '{print $1}')
local dns_port=$(echo $dns | awk -F "#" '{print $2}')
[ -z "$dns_port" ] && dns_port=53
$iptables_nat -A OUTPUT -p tcp -d $dns_ip --dport $dns_port $iptables_comment -j REDIRECT --to-ports $TCP_REDIR_PORT1
done
}
$iptables_nat -A OUTPUT $(dst $IPSET_VPSIPLIST) $iptables_comment -j RETURN
$iptables_nat -A OUTPUT $(dst $IPSET_WHITELIST) $iptables_comment -j RETURN
$iptables_nat -A OUTPUT -p tcp -m multiport --dport $TCP_REDIR_PORTS $(dst $IPSET_ROUTER) $iptables_comment -j REDIRECT --to-ports $TCP_REDIR_PORT1
$iptables_nat -A OUTPUT -p tcp -m multiport --dport $TCP_REDIR_PORTS $(dst $IPSET_BLACKLIST) $iptables_comment -j REDIRECT --to-ports $TCP_REDIR_PORT1
[ "$LOCALHOST_PROXY_MODE" == "global" ] && $iptables_nat -A OUTPUT -p tcp -m multiport --dport $TCP_REDIR_PORTS $iptables_comment -j REDIRECT --to-ports $TCP_REDIR_PORT1
[ "$LOCALHOST_PROXY_MODE" == "gfwlist" ] && $iptables_nat -A OUTPUT -p tcp -m multiport --dport $TCP_REDIR_PORTS $(get_dst_list $IPSET_GFW) $iptables_comment -j REDIRECT --to-ports $TCP_REDIR_PORT1
[ "$LOCALHOST_PROXY_MODE" == "gfwlist" ] && $iptables_nat -A OUTPUT -p tcp -m multiport --dport $TCP_REDIR_PORTS $(dst $IPSET_GFW) $iptables_comment -j REDIRECT --to-ports $TCP_REDIR_PORT1
[ "$LOCALHOST_PROXY_MODE" == "chnroute" ] && {
$iptables_nat -A OUTPUT -p tcp -m multiport --dport $TCP_REDIR_PORTS -m set ! --match-set $IPSET_CHN dst $iptables_comment -j REDIRECT --to-ports $TCP_REDIR_PORT1
}
@ -437,36 +453,39 @@ add_firewall_rule() {
$iptables_mangle -A PSW_GLO$k -p udp -j TPROXY --tproxy-mark 0x1/0x1 --on-port $local_port
# GFWLIST模式
$iptables_mangle -A PSW_GFW$k -p udp $(get_dst_list $IPSET_ROUTER) -j TPROXY --tproxy-mark 0x1/0x1 --on-port $local_port
$iptables_mangle -A PSW_GFW$k -p udp $(get_dst_list $IPSET_GFW) -j TPROXY --tproxy-mark 0x1/0x1 --on-port $local_port
$iptables_mangle -A PSW_GFW$k -p udp $(dst $IPSET_ROUTER) -j TPROXY --tproxy-mark 0x1/0x1 --on-port $local_port
$iptables_mangle -A PSW_GFW$k -p udp $(dst $IPSET_GFW) -j TPROXY --tproxy-mark 0x1/0x1 --on-port $local_port
# 大陆白名单模式
$iptables_mangle -A PSW_CHN$k -p udp $(get_dst_list $IPSET_CHN) -j RETURN
$iptables_mangle -A PSW_CHN$k -p udp $(dst $IPSET_CHN) -j RETURN
$iptables_mangle -A PSW_CHN$k -p udp -j TPROXY --tproxy-mark 0x1/0x1 --on-port $local_port
# 回国模式
$iptables_mangle -A PSW_HOME$k -p udp $(get_dst_list $IPSET_CHN) -j TPROXY --tproxy-mark 0x1/0x1 --on-port $local_port
$iptables_mangle -A PSW_HOME$k -p udp $(dst $IPSET_CHN) -j TPROXY --tproxy-mark 0x1/0x1 --on-port $local_port
# 游戏模式
$iptables_mangle -A PSW_GAME$k -p udp $(get_dst_list $IPSET_CHN) -j RETURN
$iptables_mangle -A PSW_GAME$k -p udp $(dst $IPSET_CHN) -j RETURN
$iptables_mangle -A PSW_GAME$k -p udp -j TPROXY --tproxy-mark 0x1/0x1 --on-port $local_port
# 用于本机流量转发，默认只走router
$iptables_mangle -A OUTPUT -p udp $(get_dst_list $IPSET_LANIPLIST) $iptables_comment -j RETURN
$iptables_mangle -A OUTPUT -p udp $(dst $IPSET_LANIPLIST) $iptables_comment -j RETURN
[ "$use_udp_node_resolve_dns" == 1 -a -n "$DNS_FORWARD" ] && {
for dns in $DNS_FORWARD
do
$iptables_mangle -A OUTPUT -p udp -d $dns $iptables_comment -j MARK --set-mark 1
$iptables_mangle -I PSW 2 -p udp -d $dns $iptables_comment -j TPROXY --tproxy-mark 0x1/0x1 --on-port $local_port
local dns_ip=$(echo $dns | awk -F "#" '{print $1}')
local dns_port=$(echo $dns | awk -F "#" '{print $2}')
[ -z "$dns_port" ] && dns_port=53
$iptables_mangle -A OUTPUT -p udp -d $dns_ip --dport $dns_port $iptables_comment -j MARK --set-mark 1
$iptables_mangle -I PSW 2 -p udp -d $dns_ip --dport $dns_port $iptables_comment -j TPROXY --tproxy-mark 0x1/0x1 --on-port $local_port
done
}
$iptables_mangle -A OUTPUT -p udp $(get_dst_list $IPSET_VPSIPLIST) $iptables_comment -j RETURN
$iptables_mangle -A OUTPUT -p udp $(get_dst_list $IPSET_WHITELIST) $iptables_comment -j RETURN
$iptables_mangle -A OUTPUT -p udp -m multiport --dport $UDP_REDIR_PORTS $(get_dst_list $IPSET_ROUTER) $iptables_comment -j MARK --set-mark 1
$iptables_mangle -A OUTPUT -p udp -m multiport --dport $UDP_REDIR_PORTS $(get_dst_list $IPSET_BLACKLIST) $iptables_comment -j MARK --set-mark 1
$iptables_mangle -A OUTPUT -p udp $(dst $IPSET_VPSIPLIST) $iptables_comment -j RETURN
$iptables_mangle -A OUTPUT -p udp $(dst $IPSET_WHITELIST) $iptables_comment -j RETURN
$iptables_mangle -A OUTPUT -p udp -m multiport --dport $UDP_REDIR_PORTS $(dst $IPSET_ROUTER) $iptables_comment -j MARK --set-mark 1
$iptables_mangle -A OUTPUT -p udp -m multiport --dport $UDP_REDIR_PORTS $(dst $IPSET_BLACKLIST) $iptables_comment -j MARK --set-mark 1
[ "$LOCALHOST_PROXY_MODE" == "global" ] && $iptables_mangle -A OUTPUT -p udp -m multiport --dport $UDP_REDIR_PORTS $iptables_comment -j MARK --set-mark 1
[ "$LOCALHOST_PROXY_MODE" == "gfwlist" ] && $iptables_mangle -A OUTPUT -p udp -m multiport --dport $UDP_REDIR_PORTS $(get_dst_list $IPSET_GFW) $iptables_comment -j MARK --set-mark 1
[ "$LOCALHOST_PROXY_MODE" == "gfwlist" ] && $iptables_mangle -A OUTPUT -p udp -m multiport --dport $UDP_REDIR_PORTS $(dst $IPSET_GFW) $iptables_comment -j MARK --set-mark 1
[ "$LOCALHOST_PROXY_MODE" == "chnroute" ] && {
$iptables_mangle -A OUTPUT -p udp -m multiport --dport $UDP_REDIR_PORTS -m set ! --match-set $IPSET_CHN dst $iptables_comment -j MARK --set-mark 1
}
@ -478,6 +497,19 @@ add_firewall_rule() {
else
echolog "UDP节点未选择，无法转发UDP！"
fi
if [ -n "$balancing_node_address" ]; then
balancing_node_address=$(echo -e $balancing_node_address)
for balancing_node in $balancing_node_address
do
local ip=$(echo $balancing_node | awk -F ":" '{print $1}')
local port=$(echo $balancing_node | awk -F ":" '{print $2}')
$iptables_nat -I PSW 2 -p tcp -d $ip --dport $port -j RETURN
$iptables_nat -I OUTPUT 2 -p tcp -d $ip --dport $port $iptables_comment -j RETURN
$iptables_mangle -I PSW 2 -p udp -d $ip --dport $port -j RETURN
$iptables_mangle -I OUTPUT 2 -p udp -d $ip --dport $port $iptables_comment -j RETURN
done
fi
$iptables_mangle -A PREROUTING -j PSW
@ -490,11 +522,11 @@ add_firewall_rule() {
[ "$UDP_NODE1" != "nil" ] && $iptables_mangle -A PSW_ACL -p udp -m comment --comment "Default" -j $(get_action_chain $PROXY_MODE)
else
[ "$TCP_NODE1" != "nil" ] && {
$iptables_nat -A PSW_ACL -p tcp $(get_dst_list $IPSET_BLACKLIST) -m comment --comment "Default" -j REDIRECT --to-ports $TCP_REDIR_PORT1
$iptables_nat -A PSW_ACL -p tcp $(dst $IPSET_BLACKLIST) -m comment --comment "Default" -j REDIRECT --to-ports $TCP_REDIR_PORT1
$iptables_nat -A PSW_ACL -p tcp -m multiport --dport $TCP_REDIR_PORTS -m comment --comment "Default" -j $(get_action_chain $PROXY_MODE)1
}
[ "$UDP_NODE1" != "nil" ] && {
$iptables_mangle -A PSW_ACL -p udp $(get_dst_list $IPSET_BLACKLIST) -m comment --comment "Default" -j TPROXY --on-port $UDP_REDIR_PORT1 --tproxy-mark 0x1/0x1
$iptables_mangle -A PSW_ACL -p udp $(dst $IPSET_BLACKLIST) -m comment --comment "Default" -j TPROXY --on-port $UDP_REDIR_PORT1 --tproxy-mark 0x1/0x1
$iptables_mangle -A PSW_ACL -p udp -m multiport --dport $UDP_REDIR_PORTS -m comment --comment "Default" -j $(get_action_chain $PROXY_MODE)1
}
fi