luci-app-passwall: sync source
This commit is contained in:
CN_SZTL
parent
578c15877d
commit
90157afd29
@ -7,14 +7,16 @@ include $(TOPDIR)/rules.mk
|
||||
|
||||
PKG_NAME:=luci-app-passwall
|
||||
PKG_VERSION:=2.0
|
||||
PKG_RELEASE:=76-20190731
|
||||
PKG_RELEASE:=78-20190803
|
||||
|
||||
PKG_BUILD_DIR := $(BUILD_DIR)/$(PKG_NAME)-$(PKG_VERSION)
|
||||
PO2LMO:=./po2lmo
|
||||
|
||||
include $(INCLUDE_DIR)/package.mk
|
||||
|
||||
define Package/$(PKG_NAME)/config
|
||||
define Package/$(PKG_NAME)/config
|
||||
menu "Configuration"
|
||||
|
||||
config PACKAGE_$(PKG_NAME)_INCLUDE_Shadowsocks
|
||||
bool "Include Shadowsocks Redir (ss-redir)"
|
||||
default n
|
||||
@ -62,12 +64,14 @@ config PACKAGE_$(PKG_NAME)_INCLUDE_dns2socks
|
||||
config PACKAGE_$(PKG_NAME)_INCLUDE_dns-forwarder
|
||||
bool "Include dns-forwarder"
|
||||
default n
|
||||
|
||||
endmenu
|
||||
endef
|
||||
|
||||
define Package/$(PKG_NAME)
|
||||
SECTION:=luci
|
||||
CATEGORY:=LuCI
|
||||
SUBMENU:=3. Applications
|
||||
SUBMENU:=3. Applications
|
||||
TITLE:=LuCI support for PassWall(fanqiang) By Lienol
|
||||
PKGARCH:=all
|
||||
DEPENDS:=+curl +libcurl +libmbedtls +ca-bundle +ca-certificates +resolveip +iptables-mod-tproxy +kmod-ipt-tproxy +iptables-mod-ipopt +kmod-ipt-ipopt +ip +ipset +coreutils +coreutils-base64 +coreutils-nohup +luci-lib-jsonc +unzip \
|
||||
@ -80,7 +84,7 @@ define Package/$(PKG_NAME)
|
||||
+PACKAGE_$(PKG_NAME)_INCLUDE_Brook:brook \
|
||||
+PACKAGE_$(PKG_NAME)_INCLUDE_kcptun:kcptun-client \
|
||||
+PACKAGE_$(PKG_NAME)_INCLUDE_haproxy:haproxy \
|
||||
+PACKAGE_$(PKG_NAME)_INCLUDE_ChinaDNS:openwrt_chinadns \
|
||||
+PACKAGE_$(PKG_NAME)_INCLUDE_ChinaDNS:ChinaDNS \
|
||||
+PACKAGE_$(PKG_NAME)_INCLUDE_pdnsd:pdnsd-alt \
|
||||
+PACKAGE_$(PKG_NAME)_INCLUDE_dns2socks:dns2socks \
|
||||
+PACKAGE_$(PKG_NAME)_INCLUDE_dns-forwarder:dns-forwarder
|
||||
|
||||
@ -1,5 +1,23 @@
|
||||
local sys = require "luci.sys"
|
||||
local webadmin = require "luci.tools.webadmin"
|
||||
local uci = require"luci.model.uci".cursor()
|
||||
local appname = "passwall"
|
||||
|
||||
local n = {}
|
||||
uci:foreach(appname, "servers", function(e)
|
||||
if e.server_type and e.server and e.remarks then
|
||||
if e.use_kcp and e.use_kcp == "1" then
|
||||
n[e[".name"]] = "%s+%s：[%s]" %
|
||||
{e.server_type, "Kcptun", e.remarks}
|
||||
else
|
||||
n[e[".name"]] = "%s：[%s]" % {e.server_type, e.remarks}
|
||||
end
|
||||
end
|
||||
end)
|
||||
|
||||
local key_table = {}
|
||||
for key, _ in pairs(n) do table.insert(key_table, key) end
|
||||
table.sort(key_table)
|
||||
|
||||
m = Map("passwall")
|
||||
|
||||
@ -38,7 +56,25 @@ for index, key in pairs(ips) do o:value(key, temp[key]) end
|
||||
---- MAC Address
|
||||
o = s:option(Value, "macaddr", translate("MAC Address"))
|
||||
o.rmempty = true
|
||||
sys.net.mac_hints(function(e, t) o:value(e, "%s (%s)" % {e, t}) end)
|
||||
sys.net.mac_hints(function(e, t) o:value(e, "%s " % {e}) end)
|
||||
|
||||
---- TCP Redir Server
|
||||
local tcp_redir_server_num = uci:get(appname, "@global_other[0]",
|
||||
"tcp_redir_server_num")
|
||||
o = s:option(ListValue, "tcp_redir_server", translate("TCP Server"))
|
||||
o:value("1",translate("TCP Redir Server").." 1")
|
||||
if tcp_redir_server_num and tonumber(tcp_redir_server_num) >= 2 then
|
||||
for i = 2, tcp_redir_server_num, 1 do o:value(i,translate("TCP Redir Server").." "..i) end
|
||||
end
|
||||
|
||||
---- UDP Redir Server
|
||||
local udp_redir_server_num = uci:get(appname, "@global_other[0]",
|
||||
"udp_redir_server_num")
|
||||
o = s:option(ListValue, "udp_redir_server", translate("UDP Server"))
|
||||
o:value("1",translate("UDP Redir Server").." 1")
|
||||
if udp_redir_server_num and tonumber(udp_redir_server_num) >= 2 then
|
||||
for i = 2, udp_redir_server_num, 1 do o:value(i,translate("UDP Redir Server").." "..i) end
|
||||
end
|
||||
|
||||
---- Proxy Mode
|
||||
o = s:option(ListValue, "proxy_mode", translate("Proxy Mode"))
|
||||
|
||||
@ -48,6 +48,17 @@ o = s:option(ListValue, "tcp_redir_server", translate("TCP Redir Server"),
|
||||
o:value("nil", translate("Close"))
|
||||
for _, key in pairs(key_table) do o:value(key, n[key]) end
|
||||
|
||||
local tcp_redir_server_num = uci:get(appname, "@global_other[0]",
|
||||
"tcp_redir_server_num")
|
||||
if tcp_redir_server_num and tonumber(tcp_redir_server_num) >= 2 then
|
||||
for i = 2, tcp_redir_server_num, 1 do
|
||||
o = s:option(ListValue, "tcp_redir_server" .. i,
|
||||
translate("TCP Redir Server") .. " " .. i)
|
||||
o:value("nil", translate("Close"))
|
||||
for _, key in pairs(key_table) do o:value(key, n[key]) end
|
||||
end
|
||||
end
|
||||
|
||||
---- UDP Redir Server
|
||||
if has_udp_relay() then
|
||||
o = s:option(ListValue, "udp_redir_server", translate("UDP Redir Server"),
|
||||
@ -56,6 +67,17 @@ if has_udp_relay() then
|
||||
o:value("nil", translate("Close"))
|
||||
o:value("default", translate("Same as the tcp redir server"))
|
||||
for _, key in pairs(key_table) do o:value(key, n[key]) end
|
||||
|
||||
local udp_redir_server_num = uci:get(appname, "@global_other[0]",
|
||||
"udp_redir_server_num")
|
||||
if udp_redir_server_num and tonumber(udp_redir_server_num) >= 2 then
|
||||
for i = 2, udp_redir_server_num, 1 do
|
||||
o = s:option(ListValue, "udp_redir_server" .. i,
|
||||
translate("UDP Redir Server") .. " " .. i)
|
||||
o:value("nil", translate("Close"))
|
||||
for _, key in pairs(key_table) do o:value(key, n[key]) end
|
||||
end
|
||||
end
|
||||
end
|
||||
|
||||
---- Socks5 Proxy Server
|
||||
|
||||
@ -198,6 +198,26 @@ s = m:section(TypedSection, "global_other", translate("Other Settings"))
|
||||
s.anonymous = true
|
||||
s.addremove = false
|
||||
|
||||
---- TCP Servers Number Option
|
||||
o = s:option(ListValue, "tcp_redir_server_num",
|
||||
translate("TCP Redir Server Number"), translate(
|
||||
"You can only set up a maximum of 3 servers for the time being"))
|
||||
o.default = "1"
|
||||
o.rmempty = false
|
||||
o:value("1")
|
||||
o:value("2")
|
||||
o:value("3")
|
||||
|
||||
---- UDP Servers Number Option
|
||||
o = s:option(ListValue, "udp_redir_server_num",
|
||||
translate("UDP Redir Server Number"), translate(
|
||||
"You can only set up a maximum of 3 servers for the time being"))
|
||||
o.default = "1"
|
||||
o.rmempty = false
|
||||
o:value("1")
|
||||
o:value("2")
|
||||
o:value("3")
|
||||
|
||||
---- Hide Menu
|
||||
o = s:option(Button, "hide", translate("Hide Menu"), translate(
|
||||
"After the hidden to the display, type in the address bar enter the admin/vpn/passwall/show, such as: http://192.168.1.1/cgi-bin/luci/admin/vpn/passwall/show"))
|
||||
|
||||
@ -34,6 +34,12 @@ msgstr "使用IPv6"
|
||||
msgid "Parsing IP"
|
||||
msgstr "域名解析IP"
|
||||
|
||||
msgid "TCP Server"
|
||||
msgstr "TCP服务器"
|
||||
|
||||
msgid "UDP Server"
|
||||
msgstr "UDP服务器"
|
||||
|
||||
msgid "Basic Settings"
|
||||
msgstr "基本设置"
|
||||
|
||||
@ -667,6 +673,15 @@ msgstr "<br>none：默认值，不进行伪装，发送的数据是没有特征
|
||||
msgid "A legal file path. This file must not exist before running V2Ray."
|
||||
msgstr "一个合法的文件路径。在运行 V2Ray 之前，这个文件必须不存在。"
|
||||
|
||||
msgid "TCP Redir Server Number"
|
||||
msgstr "TCP转发服务器数量"
|
||||
|
||||
msgid "UDP Redir Server Number"
|
||||
msgstr "UDP转发服务器数量"
|
||||
|
||||
msgid "You can only set up a maximum of 3 servers for the time being"
|
||||
msgstr "目前最多只能设置3个服务器"
|
||||
|
||||
msgid "Hide Menu"
|
||||
msgstr "隐藏菜单"
|
||||
|
||||
|
||||
@ -31,14 +31,16 @@ config global_forwarding
|
||||
option process '1'
|
||||
|
||||
config global_proxy
|
||||
option tcp_redir_port '1031'
|
||||
option udp_redir_port '1032'
|
||||
option socks5_port '1033'
|
||||
option tcp_redir_port '1041'
|
||||
option udp_redir_port '1041'
|
||||
option socks5_port '1051'
|
||||
option kcptun_port '11183'
|
||||
option proxy_ipv6 '0'
|
||||
|
||||
config global_other
|
||||
option auto_ping '1'
|
||||
option tcp_redir_server_num '1'
|
||||
option udp_redir_server_num '1'
|
||||
|
||||
config global_rules
|
||||
option gfwlist_update '1'
|
||||
|
||||
@ -87,6 +87,28 @@ TCP_REDIR_SERVER=$(config_t_get global tcp_redir_server nil)
|
||||
UDP_REDIR_SERVER=$(config_t_get global udp_redir_server nil)
|
||||
[ "$UDP_REDIR_SERVER" == "default" ] && UDP_REDIR_SERVER=$TCP_REDIR_SERVER
|
||||
|
||||
TCP_REDIR_SERVER2=
|
||||
TCP_REDIR_SERVER3=
|
||||
UDP_REDIR_SERVER2=
|
||||
UDP_REDIR_SERVER3=
|
||||
TCP_REDIR_SERVER_NUM=$(config_t_get global_other tcp_redir_server_num 1)
|
||||
UDP_REDIR_SERVER_NUM=$(config_t_get global_other udp_redir_server_num 1)
|
||||
|
||||
if [ "$TCP_REDIR_SERVER_NUM" -ge 2 ] ;then
|
||||
for i in $(seq 2 $TCP_REDIR_SERVER_NUM)
|
||||
do
|
||||
eval TCP_REDIR_SERVER$i=$(config_t_get global tcp_redir_server$i nil)
|
||||
done
|
||||
fi
|
||||
|
||||
if [ "$UDP_REDIR_SERVER_NUM" -ge 2 ] ;then
|
||||
for i in $(seq 2 $UDP_REDIR_SERVER_NUM)
|
||||
do
|
||||
eval UDP_REDIR_SERVER$i=$(config_t_get global udp_redir_server$i nil)
|
||||
done
|
||||
fi
|
||||
|
||||
|
||||
TCP_REDIR_SERVER_IP=""
|
||||
UDP_REDIR_SERVER_IP=""
|
||||
SOCKS5_PROXY_SERVER_IP=""
|
||||
@ -136,19 +158,20 @@ load_config() {
|
||||
config_load $CONFIG
|
||||
[ "$TCP_REDIR_SERVER" != "nil" ] && {
|
||||
TCP_REDIR_SERVER_TYPE=`echo $(config_get $TCP_REDIR_SERVER server_type) | tr 'A-Z' 'a-z'`
|
||||
gen_config_file $TCP_REDIR_SERVER TCP
|
||||
gen_config_file $TCP_REDIR_SERVER $TCP_REDIR_PORT TCP $CONFIG_TCP_FILE
|
||||
echo "$TCP_REDIR_SERVER" > $CONFIG_PATH/tcp_server_id
|
||||
}
|
||||
[ "$UDP_REDIR_SERVER" != "nil" ] && {
|
||||
UDP_REDIR_SERVER_TYPE=`echo $(config_get $UDP_REDIR_SERVER server_type) | tr 'A-Z' 'a-z'`
|
||||
gen_config_file $UDP_REDIR_SERVER UDP
|
||||
gen_config_file $UDP_REDIR_SERVER $UDP_REDIR_PORT UDP $CONFIG_UDP_FILE
|
||||
echo "$UDP_REDIR_SERVER" > $CONFIG_PATH/udp_server_id
|
||||
}
|
||||
[ "$SOCKS5_PROXY_SERVER" != "nil" ] && {
|
||||
SOCKS5_PROXY_SERVER_TYPE=`echo $(config_get $SOCKS5_PROXY_SERVER server_type) | tr 'A-Z' 'a-z'`
|
||||
gen_config_file $SOCKS5_PROXY_SERVER Socks5
|
||||
gen_config_file $SOCKS5_PROXY_SERVER $SOCKS5_PROXY_PORT Socks5 $CONFIG_SOCKS5_FILE
|
||||
echo "$SOCKS5_PROXY_SERVER" > $CONFIG_PATH/socks5_server_id
|
||||
}
|
||||
|
||||
return 0
|
||||
}
|
||||
|
||||
@ -193,17 +216,21 @@ gen_ss_ssr_config_file() {
|
||||
}
|
||||
|
||||
gen_config_file() {
|
||||
local server_host server_ip server_port server_type use_ipv6 network_type
|
||||
server_host=$(config_get $1 server)
|
||||
use_ipv6=$(config_get $1 use_ipv6)
|
||||
local server local_port redir_type config_file_path server_host server_ip server_port server_type use_ipv6 network_type
|
||||
server=$1
|
||||
local_port=$2
|
||||
redir_type=$3
|
||||
config_file_path=$4
|
||||
server_host=$(config_get $server server)
|
||||
use_ipv6=$(config_get $server use_ipv6)
|
||||
network_type="ipv4"
|
||||
[ "$use_ipv6" == "1" ] && network_type="ipv6"
|
||||
server_ip=$(get_host_ip $network_type $server_host)
|
||||
server_port=$(config_get $1 server_port)
|
||||
server_type=`echo $(config_get $1 server_type) | tr 'A-Z' 'a-z'`
|
||||
echolog "$2服务器IP地址:$server_ip"
|
||||
server_port=$(config_get $server server_port)
|
||||
server_type=`echo $(config_get $server server_type) | tr 'A-Z' 'a-z'`
|
||||
echolog "$redir_type服务器IP地址:$server_ip"
|
||||
|
||||
if [ "$2" == "Socks5" ]; then
|
||||
if [ "$redir_type" == "Socks5" ]; then
|
||||
if [ "$network_type" == "ipv6" ];then
|
||||
SOCKS5_PROXY_SERVER_IPV6=$server_ip
|
||||
else
|
||||
@ -211,17 +238,17 @@ gen_config_file() {
|
||||
fi
|
||||
SOCKS5_PROXY_SERVER_PORT=$server_port
|
||||
if [ "$server_type" == "ss" -o "$server_type" == "ssr" ]; then
|
||||
gen_ss_ssr_config_file $server_type $SOCKS5_PROXY_PORT 0 $SOCKS5_PROXY_SERVER $CONFIG_SOCKS5_FILE
|
||||
gen_ss_ssr_config_file $server_type $local_port 0 $server $config_file_path
|
||||
fi
|
||||
if [ "$server_type" == "v2ray" ]; then
|
||||
lua /usr/lib/lua/luci/model/cbi/passwall/api/gen_v2ray_client_config_file.lua $SOCKS5_PROXY_SERVER nil nil $SOCKS5_PROXY_PORT > $CONFIG_SOCKS5_FILE
|
||||
lua /usr/lib/lua/luci/model/cbi/passwall/api/gen_v2ray_client_config_file.lua $server nil nil $local_port > $config_file_path
|
||||
fi
|
||||
if [ "$server_type" == "brook" ]; then
|
||||
BROOK_SOCKS5_CMD="client -l 0.0.0.0:$SOCKS5_PROXY_PORT -i 0.0.0.0 -s $server_ip:$server_port -p $(config_get $SOCKS5_PROXY_SERVER password)"
|
||||
BROOK_SOCKS5_CMD="client -l 0.0.0.0:$local_port -i 0.0.0.0 -s $server_ip:$server_port -p $(config_get $server password)"
|
||||
fi
|
||||
fi
|
||||
|
||||
if [ "$2" == "UDP" ]; then
|
||||
if [ "$redir_type" == "UDP" ]; then
|
||||
if [ "$network_type" == "ipv6" ];then
|
||||
UDP_REDIR_SERVER_IPV6=$server_ip
|
||||
else
|
||||
@ -229,17 +256,17 @@ gen_config_file() {
|
||||
fi
|
||||
UDP_REDIR_SERVER_PORT=$server_port
|
||||
if [ "$server_type" == "ss" -o "$server_type" == "ssr" ]; then
|
||||
gen_ss_ssr_config_file $server_type $UDP_REDIR_PORT 0 $UDP_REDIR_SERVER $CONFIG_UDP_FILE
|
||||
gen_ss_ssr_config_file $server_type $local_port 0 $server $config_file_path
|
||||
fi
|
||||
if [ "$server_type" == "v2ray" ]; then
|
||||
lua /usr/lib/lua/luci/model/cbi/passwall/api/gen_v2ray_client_config_file.lua $UDP_REDIR_SERVER udp $UDP_REDIR_PORT nil > $CONFIG_UDP_FILE
|
||||
lua /usr/lib/lua/luci/model/cbi/passwall/api/gen_v2ray_client_config_file.lua $server udp $local_port nil > $config_file_path
|
||||
fi
|
||||
if [ "$server_type" == "brook" ]; then
|
||||
BROOK_UDP_CMD="tproxy -l 0.0.0.0:$UDP_REDIR_PORT -s $server_ip:$server_port -p $(config_get $UDP_REDIR_SERVER password)"
|
||||
BROOK_UDP_CMD="tproxy -l 0.0.0.0:$local_port -s $server_ip:$server_port -p $(config_get $server password)"
|
||||
fi
|
||||
fi
|
||||
|
||||
if [ "$2" == "TCP" ]; then
|
||||
if [ "$redir_type" == "TCP" ]; then
|
||||
if [ "$network_type" == "ipv6" ];then
|
||||
TCP_REDIR_SERVER_IPV6=$server_ip
|
||||
else
|
||||
@ -247,13 +274,13 @@ gen_config_file() {
|
||||
fi
|
||||
TCP_REDIR_SERVER_PORT=$server_port
|
||||
if [ "$server_type" == "v2ray" ]; then
|
||||
lua /usr/lib/lua/luci/model/cbi/passwall/api/gen_v2ray_client_config_file.lua $TCP_REDIR_SERVER tcp $TCP_REDIR_PORT nil > $CONFIG_TCP_FILE
|
||||
lua /usr/lib/lua/luci/model/cbi/passwall/api/gen_v2ray_client_config_file.lua $server tcp $local_port nil > $config_file_path
|
||||
else
|
||||
local kcptun_use kcptun_server_host kcptun_port kcptun_config
|
||||
kcptun_use=$(config_get $1 use_kcp)
|
||||
kcptun_server_host=$(config_get $1 kcp_server)
|
||||
kcptun_port=$(config_get $1 kcp_port)
|
||||
kcptun_config=$(config_get $1 kcp_opts)
|
||||
kcptun_use=$(config_get $server use_kcp)
|
||||
kcptun_server_host=$(config_get $server kcp_server)
|
||||
kcptun_port=$(config_get $server kcp_port)
|
||||
kcptun_config=$(config_get $server kcp_opts)
|
||||
kcptun_path=""
|
||||
lbenabled=$(config_t_get global_haproxy balancing_enable 0)
|
||||
if [ "$kcptun_use" == "1" ] && ([ -z "$kcptun_port" ] || [ -z "$kcptun_config" ]); then
|
||||
@ -280,7 +307,7 @@ gen_config_file() {
|
||||
if [ -z "$kcptun_server_host" ]; then
|
||||
start_kcptun "$kcptun_path" $server_ip $kcptun_port "$kcptun_config"
|
||||
else
|
||||
kcptun_use_ipv6=$(config_get $1 kcp_use_ipv6)
|
||||
kcptun_use_ipv6=$(config_get $server kcp_use_ipv6)
|
||||
network_type="ipv4"
|
||||
[ "$kcptun_use_ipv6" == "1" ] && network_type="ipv6"
|
||||
kcptun_server_ip=$(get_host_ip $network_type $kcptun_server_host)
|
||||
@ -290,17 +317,17 @@ gen_config_file() {
|
||||
fi
|
||||
echolog "运行Kcptun..."
|
||||
if [ "$server_type" == "ss" -o "$server_type" == "ssr" ]; then
|
||||
gen_ss_ssr_config_file $server_type $TCP_REDIR_PORT 1 $TCP_REDIR_SERVER $CONFIG_TCP_FILE
|
||||
gen_ss_ssr_config_file $server_type $local_port 1 $server $config_file_path
|
||||
fi
|
||||
if [ "$server_type" == "brook" ]; then
|
||||
BROOK_TCP_CMD="tproxy -l 0.0.0.0:$TCP_REDIR_PORT -s 127.0.0.1:$KCPTUN_REDIR_PORT -p $(config_get $TCP_REDIR_SERVER password)"
|
||||
BROOK_TCP_CMD="tproxy -l 0.0.0.0:$local_port -s 127.0.0.1:$KCPTUN_REDIR_PORT -p $(config_get $server password)"
|
||||
fi
|
||||
else
|
||||
if [ "$server_type" == "ss" -o "$server_type" == "ssr" ]; then
|
||||
gen_ss_ssr_config_file $server_type $TCP_REDIR_PORT 0 $TCP_REDIR_SERVER $CONFIG_TCP_FILE
|
||||
gen_ss_ssr_config_file $server_type $local_port 0 $server $config_file_path
|
||||
fi
|
||||
if [ "$server_type" == "brook" ]; then
|
||||
BROOK_TCP_CMD="tproxy -l 0.0.0.0:$TCP_REDIR_PORT -s $server_ip:$server_port -p $(config_get $TCP_REDIR_SERVER password)"
|
||||
BROOK_TCP_CMD="tproxy -l 0.0.0.0:$local_port -s $server_ip:$server_port -p $(config_get $server password)"
|
||||
fi
|
||||
fi
|
||||
fi
|
||||
@ -317,9 +344,73 @@ start_kcptun() {
|
||||
fi
|
||||
}
|
||||
|
||||
start_tcp_redir_other() {
|
||||
if [ "$TCP_REDIR_SERVER_NUM" -ge 2 ] ;then
|
||||
for i in $(seq 2 $TCP_REDIR_SERVER_NUM)
|
||||
do
|
||||
eval temp_server=\$TCP_REDIR_SERVER$i
|
||||
[ "$temp_server" != "nil" ] && {
|
||||
TYPE=`echo $(config_get $temp_server server_type) | tr 'A-Z' 'a-z'`
|
||||
local config_file=$CONFIG_PATH/TCP$i.json
|
||||
gen_config_file $temp_server 104$i TCP $config_file
|
||||
if [ "$TYPE" == "v2ray" ]; then
|
||||
v2ray_path=$(config_t_get global_v2ray v2ray_client_file)
|
||||
if [ -f "${v2ray_path}/v2ray" ];then
|
||||
${v2ray_path}/v2ray -config=$config_file > /dev/null &
|
||||
else
|
||||
v2ray_bin=$(find_bin V2ray)
|
||||
[ -n "$v2ray_bin" ] && $v2ray_bin -config=$config_file > /dev/null &
|
||||
fi
|
||||
elif [ "$TYPE" == "brook" ]; then
|
||||
brook_bin=$(find_bin Brook)
|
||||
[ -n "$brook_bin" ] && $brook_bin $BROOK_TCP_CMD &>/dev/null &
|
||||
else
|
||||
ss_bin=$(find_bin "$TYPE"-redir)
|
||||
[ -n "$ss_bin" ] && {
|
||||
for k in $(seq 1 $process)
|
||||
do
|
||||
$ss_bin -c $config_file -f $RUN_PID_PATH/tcp_${TYPE}_$k_$i > /dev/null 2>&1 &
|
||||
done
|
||||
}
|
||||
fi
|
||||
}
|
||||
done
|
||||
fi
|
||||
}
|
||||
|
||||
start_udp_redir_other() {
|
||||
if [ "$UDP_REDIR_SERVER_NUM" -ge 2 ] ;then
|
||||
for i in $(seq 2 $UDP_REDIR_SERVER_NUM)
|
||||
do
|
||||
eval temp_server=\$UDP_REDIR_SERVER$i
|
||||
[ "$temp_server" != "nil" ] && {
|
||||
TYPE=`echo $(config_get $temp_server server_type) | tr 'A-Z' 'a-z'`
|
||||
local config_file=$CONFIG_PATH/UDP$i.json
|
||||
gen_config_file $temp_server 104$i UDP $config_file
|
||||
if [ "$TYPE" == "v2ray" ]; then
|
||||
v2ray_path=$(config_t_get global_v2ray v2ray_client_file)
|
||||
if [ -f "${v2ray_path}/v2ray" ];then
|
||||
${v2ray_path}/v2ray -config=$config_file > /dev/null &
|
||||
else
|
||||
v2ray_bin=$(find_bin V2ray)
|
||||
[ -n "$v2ray_bin" ] && $v2ray_bin -config=$config_file > /dev/null &
|
||||
fi
|
||||
elif [ "$TYPE" == "brook" ]; then
|
||||
brook_bin=$(find_bin brook)
|
||||
[ -n "$brook_bin" ] && $brook_bin $BROOK_UDP_CMD &>/dev/null &
|
||||
else
|
||||
ss_bin=$(find_bin "$TYPE"-redir)
|
||||
[ -n "$ss_bin" ] && {
|
||||
$ss_bin -c $config_file -f $RUN_PID_PATH/udp_${TYPE}_1_$i -U > /dev/null 2>&1 &
|
||||
}
|
||||
fi
|
||||
}
|
||||
done
|
||||
fi
|
||||
}
|
||||
|
||||
start_tcp_redir() {
|
||||
if [ "$TCP_REDIR_SERVER" != "nil" ];then
|
||||
echolog "运行TCP透明代理..."
|
||||
if [ "$TCP_REDIR_SERVER_TYPE" == "v2ray" ]; then
|
||||
v2ray_path=$(config_t_get global_v2ray v2ray_client_file)
|
||||
if [ -f "${v2ray_path}/v2ray" ];then
|
||||
@ -345,7 +436,6 @@ start_tcp_redir() {
|
||||
|
||||
start_udp_redir() {
|
||||
if [ "$UDP_REDIR_SERVER" != "nil" ];then
|
||||
echolog "运行UDP透明代理..."
|
||||
if [ "$UDP_REDIR_SERVER_TYPE" == "v2ray" ]; then
|
||||
v2ray_path=$(config_t_get global_v2ray v2ray_client_file)
|
||||
if [ -f "${v2ray_path}/v2ray" ];then
|
||||
@ -368,7 +458,6 @@ start_udp_redir() {
|
||||
|
||||
start_socks5_proxy() {
|
||||
if [ "$SOCKS5_PROXY_SERVER" != "nil" ];then
|
||||
echolog "运行Socks5代理..."
|
||||
if [ "$SOCKS5_PROXY_SERVER_TYPE" == "v2ray" ]; then
|
||||
v2ray_path=$(config_t_get global_v2ray v2ray_client_file)
|
||||
if [ -f "${v2ray_path}/v2ray" ];then
|
||||
@ -939,6 +1028,8 @@ start() {
|
||||
start_tcp_redir
|
||||
start_udp_redir
|
||||
start_socks5_proxy
|
||||
start_tcp_redir_other
|
||||
start_udp_redir_other
|
||||
start_dns
|
||||
add_dnsmasq
|
||||
source $APP_PATH/iptables.sh start
|
||||
@ -957,8 +1048,9 @@ stop() {
|
||||
clean_log
|
||||
source $APP_PATH/iptables.sh stop
|
||||
del_vps_port
|
||||
kill_all pdnsd Pcap_DNSProxy brook dns2socks haproxy dns-forwarder chinadns dnsproxy redsocks2
|
||||
kill_all pdnsd Pcap_DNSProxy brook dns2socks haproxy dns-forwarder chinadns dnsproxy
|
||||
ps -w | grep -E "$CONFIG_TCP_FILE|$CONFIG_UDP_FILE|$CONFIG_SOCKS5_FILE" | grep -v "grep" | awk '{print $1}' | xargs kill -9 >/dev/null 2>&1 &
|
||||
ps -w | grep -E "$CONFIG_PATH" | grep -v "grep" | awk '{print $1}' | xargs kill -9 >/dev/null 2>&1 &
|
||||
ps -w | grep "kcptun_client" | grep "$KCPTUN_REDIR_PORT" | grep -v "grep" | awk '{print $1}' | xargs kill -9 >/dev/null 2>&1 &
|
||||
rm -rf /var/pdnsd/pdnsd.cache
|
||||
rm -rf $TMP_DNSMASQ_PATH
|
||||
|
||||
@ -105,6 +105,8 @@ load_acl(){
|
||||
local ipaddr
|
||||
local macaddr
|
||||
local proxy_mode
|
||||
local tcp_redir_server
|
||||
local udp_redir_server
|
||||
local tcp_redir_ports
|
||||
local udp_redir_ports
|
||||
config_get enabled $1 enabled
|
||||
@ -112,6 +114,8 @@ load_acl(){
|
||||
config_get ipaddr $1 ipaddr
|
||||
config_get macaddr $1 macaddr
|
||||
config_get proxy_mode $1 proxy_mode
|
||||
config_get tcp_redir_server $1 tcp_redir_server
|
||||
config_get udp_redir_server $1 udp_redir_server
|
||||
config_get tcp_redir_ports $1 tcp_redir_ports
|
||||
config_get udp_redir_ports $1 udp_redir_ports
|
||||
[ -z "$proxy_mode" -o "$proxy_mode" = "default" ] && proxy_mode=$PROXY_MODE
|
||||
@ -126,8 +130,14 @@ load_acl(){
|
||||
[ -n "$ipaddr" ] && echolog "访问控制：IP：$ipaddr，代理模式：$(get_action_chain_name $proxy_mode)"
|
||||
[ -n "$macaddr" ] && echolog "访问控制：MAC：$macaddr，代理模式：$(get_action_chain_name $proxy_mode)"
|
||||
fi
|
||||
$iptables_mangle -A SS_ACL $(factor $ipaddr "-s") -p tcp $(factor $macaddr "-m mac --mac-source") $(factor $tcp_redir_ports "-m multiport --dport") -m comment --comment "$aclremarks" -$(get_jump_mode $proxy_mode) $(get_action_chain $proxy_mode)
|
||||
[ "$UDP_REDIR_SERVER" != "nil" ] && $iptables_mangle -A SS_ACL $(factor $ipaddr "-s") -p udp $(factor $macaddr "-m mac --mac-source") $(factor $udp_redir_ports "-m multiport --dport") -m comment --comment "$aclremarks" -$(get_jump_mode $proxy_mode) $(get_action_chain $proxy_mode)
|
||||
[ "$tcp_redir_server" != "nil" ] && {
|
||||
$iptables_mangle -A SS_ACL $(factor $ipaddr "-s") -p tcp -m set --match-set $IPSET_BLACKLIST dst -m comment --comment "$aclremarks" -j TTL --ttl-set 14$tcp_redir_server
|
||||
$iptables_mangle -A SS_ACL $(factor $ipaddr "-s") -p tcp $(factor $macaddr "-m mac --mac-source") $(factor $tcp_redir_ports "-m multiport --dport") -m comment --comment "$aclremarks" -$(get_jump_mode $proxy_mode) $(get_action_chain $proxy_mode)$tcp_redir_server
|
||||
}
|
||||
[ "$udp_redir_server" != "nil" ] && {
|
||||
$iptables_mangle -A SS_ACL $(factor $ipaddr "-s") -p udp -m set --match-set $IPSET_BLACKLIST dst -m comment --comment "$aclremarks" -j TPROXY --on-port 104$udp_redir_server --tproxy-mark 0x1/0x1
|
||||
$iptables_mangle -A SS_ACL $(factor $ipaddr "-s") -p udp $(factor $macaddr "-m mac --mac-source") $(factor $udp_redir_ports "-m multiport --dport") -m comment --comment "$aclremarks" -$(get_jump_mode $proxy_mode) $(get_action_chain $proxy_mode)$udp_redir_server
|
||||
}
|
||||
[ -z "$ipaddr" ] && {
|
||||
lower_macaddr=`echo $macaddr | tr '[A-Z]' '[a-z]'`
|
||||
ipaddr=`ip neigh show | grep -E "([0-9]{1,3}[\.]){3}[0-9]{1,3}" | grep $lower_macaddr | awk '{print $1}'`
|
||||
@ -201,199 +211,249 @@ EOF
|
||||
done
|
||||
}
|
||||
|
||||
# 忽略特殊IP段
|
||||
# 忽略特殊IP段
|
||||
lan_ip=`ifconfig br-lan | grep "inet addr" | awk '{print $2}' | awk -F : '{print $2}'` #路由器lan IP
|
||||
lan_ipv4=`ip address show br-lan | grep -w "inet" |awk '{print $2}'` #当前LAN IPv4段
|
||||
[ -n "$lan_ipv4" ] && ipset add $IPSET_LANIPLIST $lan_ipv4 >/dev/null 2>&1 &
|
||||
|
||||
# 过滤所有节点IP
|
||||
config_foreach filter_vpsip "servers"
|
||||
config_foreach filter_vpsip "servers"
|
||||
|
||||
$iptables_mangle -N SS
|
||||
$iptables_mangle -A SS -m set --match-set $IPSET_LANIPLIST dst -j RETURN
|
||||
$iptables_mangle -A SS -m set --match-set $IPSET_VPSIPLIST dst -j RETURN
|
||||
$iptables_mangle -A SS -m set --match-set $IPSET_WHITELIST dst -j RETURN
|
||||
$iptables_mangle -N SS_ACL
|
||||
$iptables_mangle -N SS_GLO
|
||||
$iptables_mangle -N SS_GFW
|
||||
$iptables_mangle -N SS_CHN
|
||||
$iptables_mangle -N SS_HOME
|
||||
$iptables_mangle -N SS_GAME
|
||||
|
||||
ip rule add fwmark 1 lookup 100
|
||||
ip route add local 0.0.0.0/0 dev lo table 100
|
||||
|
||||
# 生成TCP转发规则
|
||||
if [ "$TCP_REDIR_SERVER" != "nil" ];then
|
||||
[ -n "$SOCKS5_PROXY_SERVER_IP" -a -n "$SOCKS5_PROXY_SERVER_PORT" ] && $iptables_mangle -A SS -p tcp -d $SOCKS5_PROXY_SERVER_IP -m multiport --dports $SOCKS5_PROXY_SERVER_PORT -j RETURN
|
||||
[ -n "$TCP_REDIR_SERVER_IP" -a -n "$TCP_REDIR_SERVER_PORT" ] && $iptables_mangle -A SS -p tcp -d $TCP_REDIR_SERVER_IP -m multiport --dports $TCP_REDIR_SERVER_PORT -j RETURN
|
||||
if [ "$TCP_REDIR_SERVER_TYPE" == "brook" ]; then
|
||||
$iptables_mangle -A PREROUTING -p tcp -m socket -j MARK --set-mark 1
|
||||
$iptables_mangle -A PREROUTING -p tcp -j SS
|
||||
|
||||
$iptables_mangle -A SS -p tcp -m set --match-set $IPSET_BLACKLIST dst -j TPROXY --on-port $TCP_REDIR_PORT --tproxy-mark 0x1/0x1
|
||||
# 全局模式
|
||||
$iptables_mangle -A SS_GLO -p tcp -j TPROXY --tproxy-mark 0x1/0x1 --on-port $TCP_REDIR_PORT
|
||||
|
||||
# GFWLIST模式
|
||||
$iptables_mangle -A SS_GFW -p tcp -m set --match-set $IPSET_GFW dst -j TPROXY --on-port $TCP_REDIR_PORT --tproxy-mark 0x1/0x1
|
||||
$iptables_mangle -A SS_GFW -p tcp -m set --match-set $IPSET_ROUTER dst -j TPROXY --on-port $TCP_REDIR_PORT --tproxy-mark 0x1/0x1
|
||||
|
||||
# 大陆白名单模式
|
||||
$iptables_mangle -A SS_CHN -p tcp -m set --match-set $IPSET_CHN dst -j RETURN
|
||||
$iptables_mangle -A SS_CHN -p tcp -j TPROXY --on-port $TCP_REDIR_PORT --tproxy-mark 0x1/0x1
|
||||
|
||||
# 回国模式
|
||||
$iptables_mangle -A SS_HOME -p tcp -m set --match-set $IPSET_CHN dst -j TPROXY --on-port $TCP_REDIR_PORT --tproxy-mark 0x1/0x1
|
||||
|
||||
# 游戏模式
|
||||
$iptables_mangle -A SS_GAME -p tcp -m set --match-set $IPSET_CHN dst -j RETURN
|
||||
|
||||
# 用于本机流量转发，默认只走router
|
||||
$iptables_mangle -A SS -s $lan_ip -p tcp -m set --match-set $IPSET_ROUTER dst -j TPROXY --on-port $TCP_REDIR_PORT --tproxy-mark 0x1/0x1
|
||||
$iptables_mangle -A OUTPUT -p tcp -m multiport --dport $TCP_REDIR_PORTS -m set --match-set $IPSET_ROUTER dst -j MARK --set-mark 1
|
||||
else
|
||||
$iptables_mangle -A PREROUTING -j SS
|
||||
$iptables_mangle -A SS -p tcp -m set --match-set $IPSET_BLACKLIST dst -j TTL --ttl-set 188
|
||||
# 全局模式
|
||||
$iptables_mangle -A SS_GLO -p tcp -j TTL --ttl-set 188
|
||||
|
||||
# GFWLIST模式
|
||||
$iptables_mangle -A SS_GFW -p tcp -m set --match-set $IPSET_GFW dst -j TTL --ttl-set 188
|
||||
$iptables_mangle -A SS_GFW -p tcp -m set --match-set $IPSET_ROUTER dst -j TTL --ttl-set 188
|
||||
|
||||
# 大陆白名单模式
|
||||
$iptables_mangle -A SS_CHN -p tcp -m set --match-set $IPSET_CHN dst -j RETURN
|
||||
#$iptables_mangle -A SS_CHN -p tcp -m geoip ! --destination-country CN -j TTL --ttl-set 188
|
||||
$iptables_mangle -A SS_CHN -p tcp -j TTL --ttl-set 188
|
||||
|
||||
# 回国模式
|
||||
#$iptables_mangle -A SS_HOME -p tcp -m geoip --destination-country CN -j TTL --ttl-set 188
|
||||
$iptables_mangle -A SS_HOME -p tcp -m set --match-set $IPSET_CHN dst -j TTL --ttl-set 188
|
||||
|
||||
# 游戏模式
|
||||
$iptables_mangle -A SS_GAME -p tcp -m set --match-set $IPSET_CHN dst -j RETURN
|
||||
|
||||
# 重定所有流量到透明代理端口
|
||||
$iptables_nat -N SS
|
||||
$iptables_nat -A SS -p tcp -m ttl --ttl-eq 188 -j REDIRECT --to $TCP_REDIR_PORT
|
||||
|
||||
is_add_prerouting=0
|
||||
|
||||
KP_INDEX=`$iptables_nat -L PREROUTING|tail -n +3|sed -n -e '/^KOOLPROXY/='`
|
||||
if [ -n "$KP_INDEX" ]; then
|
||||
let KP_INDEX+=1
|
||||
#确保添加到KOOLPROXY规则之后
|
||||
$iptables_nat -I PREROUTING $KP_INDEX -j SS
|
||||
is_add_prerouting=1
|
||||
fi
|
||||
|
||||
ADBYBY_INDEX=`$iptables_nat -L PREROUTING|tail -n +3|sed -n -e '/^ADBYBY/='`
|
||||
if [ -n "$ADBYBY_INDEX" ]; then
|
||||
let ADBYBY_INDEX+=1
|
||||
#确保添加到ADBYBY规则之后
|
||||
$iptables_nat -I PREROUTING $ADBYBY_INDEX -j SS
|
||||
is_add_prerouting=1
|
||||
fi
|
||||
|
||||
if [ "$is_add_prerouting" == 0 ]; then
|
||||
#如果去广告没有运行，确保添加到prerouting_rule规则之后
|
||||
PR_INDEX=`$iptables_nat -L PREROUTING|tail -n +3|sed -n -e '/^prerouting_rule/='`
|
||||
if [ -z "$PR_INDEX" ]; then
|
||||
PR_INDEX=1
|
||||
else
|
||||
let PR_INDEX+=1
|
||||
fi
|
||||
$iptables_nat -I PREROUTING $PR_INDEX -j SS
|
||||
fi
|
||||
|
||||
# 用于本机流量转发，默认只走router
|
||||
#$iptables_nat -I OUTPUT -j SS
|
||||
$iptables_nat -A OUTPUT -m set --match-set $IPSET_LANIPLIST dst -j RETURN
|
||||
$iptables_nat -A OUTPUT -m set --match-set $IPSET_VPSIPLIST dst -j RETURN
|
||||
$iptables_nat -A OUTPUT -m set --match-set $IPSET_WHITELIST dst -j RETURN
|
||||
$iptables_nat -A OUTPUT -p tcp -m multiport --dport $TCP_REDIR_PORTS -m set --match-set $IPSET_ROUTER dst -j REDIRECT --to-ports $TCP_REDIR_PORT
|
||||
$iptables_nat -A OUTPUT -p tcp -m multiport --dport $TCP_REDIR_PORTS -m set --match-set $IPSET_BLACKLIST dst -j REDIRECT --to-ports $TCP_REDIR_PORT
|
||||
|
||||
[ "$LOCALHOST_PROXY_MODE" == "global" ] && $iptables_nat -A OUTPUT -p tcp -m multiport --dport $TCP_REDIR_PORTS -j REDIRECT --to-ports $TCP_REDIR_PORT
|
||||
[ "$LOCALHOST_PROXY_MODE" == "gfwlist" ] && $iptables_nat -A OUTPUT -p tcp -m multiport --dport $TCP_REDIR_PORTS -m set --match-set $IPSET_GFW dst -j REDIRECT --to-ports $TCP_REDIR_PORT
|
||||
[ "$LOCALHOST_PROXY_MODE" == "chnroute" ] && {
|
||||
$iptables_nat -A OUTPUT -p tcp -m multiport --dport $TCP_REDIR_PORTS -m set --match-set $IPSET_CHN dst -j RETURN
|
||||
$iptables_nat -A OUTPUT -p tcp -m multiport --dport $TCP_REDIR_PORTS -j REDIRECT --to-ports $TCP_REDIR_PORT
|
||||
}
|
||||
|
||||
echolog "IPv4 防火墙TCP转发规则加载完成！"
|
||||
if [[ "$TCP_REDIR_SERVER_NUM" -ge 1 ]] || [[ "$UDP_REDIR_SERVER_NUM" -ge 1 ]] ;then
|
||||
local max_num=1
|
||||
[ "$TCP_REDIR_SERVER_NUM" -ge "$UDP_REDIR_SERVER_NUM" ] && max_num=$TCP_REDIR_SERVER_NUM
|
||||
if [ "$max_num" -ge 1 ] ;then
|
||||
for i in $(seq 1 $max_num)
|
||||
do
|
||||
$iptables_mangle -N SS_GLO$i
|
||||
$iptables_mangle -N SS_GFW$i
|
||||
$iptables_mangle -N SS_CHN$i
|
||||
$iptables_mangle -N SS_HOME$i
|
||||
$iptables_mangle -N SS_GAME$i
|
||||
|
||||
ip rule add fwmark 1 lookup 100
|
||||
ip route add local 0.0.0.0/0 dev lo table 100
|
||||
done
|
||||
fi
|
||||
fi
|
||||
|
||||
if [ "$TCP_REDIR_SERVER_NUM" -ge 1 ] ;then
|
||||
for i in $(seq 1 $TCP_REDIR_SERVER_NUM)
|
||||
do
|
||||
local k=$i
|
||||
local local_port=104$k
|
||||
local ttl=14$k
|
||||
eval temp_server=\$TCP_REDIR_SERVER$k
|
||||
[ "$k" == 1 ] && {
|
||||
local_port=$TCP_REDIR_PORT
|
||||
temp_server=$TCP_REDIR_SERVER
|
||||
}
|
||||
# 生成TCP转发规则
|
||||
if [ "$temp_server" != "nil" ];then
|
||||
local server_host=$(config_get $temp_server server)
|
||||
local TCP_REDIR_SERVER_PORT=$(config_get $temp_server server_port)
|
||||
local TCP_REDIR_SERVER_IP=$(get_host_ip "ipv4" $server_host)
|
||||
[ -n "$SOCKS5_PROXY_SERVER_IP" -a -n "$SOCKS5_PROXY_SERVER_PORT" ] && $iptables_mangle -A SS -p tcp -d $SOCKS5_PROXY_SERVER_IP -m multiport --dports $SOCKS5_PROXY_SERVER_PORT -j RETURN
|
||||
[ -n "$TCP_REDIR_SERVER_IP" -a -n "$TCP_REDIR_SERVER_PORT" ] && $iptables_mangle -A SS -p tcp -d $TCP_REDIR_SERVER_IP -m multiport --dports $TCP_REDIR_SERVER_PORT -j RETURN
|
||||
if [ "$TCP_REDIR_SERVER_TYPE" == "brook" ]; then
|
||||
$iptables_mangle -A PREROUTING -p tcp -m socket -j MARK --set-mark 1
|
||||
$iptables_mangle -A PREROUTING -p tcp -j SS$k
|
||||
|
||||
$iptables_mangle -A SS$k -p tcp -m set --match-set $IPSET_BLACKLIST dst -j TPROXY --on-port $local_port --tproxy-mark 0x1/0x1
|
||||
# 全局模式
|
||||
$iptables_mangle -A SS_GLO$k -p tcp -j TPROXY --tproxy-mark 0x1/0x1 --on-port $local_port
|
||||
|
||||
# GFWLIST模式
|
||||
$iptables_mangle -A SS_GFW$k -p tcp -m set --match-set $IPSET_GFW dst -j TPROXY --on-port $local_port --tproxy-mark 0x1/0x1
|
||||
$iptables_mangle -A SS_GFW$k -p tcp -m set --match-set $IPSET_ROUTER dst -j TPROXY --on-port $local_port --tproxy-mark 0x1/0x1
|
||||
|
||||
# 大陆白名单模式
|
||||
$iptables_mangle -A SS_CHN$k -p tcp -m set --match-set $IPSET_CHN dst -j RETURN
|
||||
$iptables_mangle -A SS_CHN$k -p tcp -j TPROXY --on-port $local_port --tproxy-mark 0x1/0x1
|
||||
|
||||
# 回国模式
|
||||
$iptables_mangle -A SS_HOME$k -p tcp -m set --match-set $IPSET_CHN dst -j TPROXY --on-port $local_port --tproxy-mark 0x1/0x1
|
||||
|
||||
# 游戏模式
|
||||
$iptables_mangle -A SS_GAME$k -p tcp -m set --match-set $IPSET_CHN dst -j RETURN
|
||||
|
||||
# 用于本机流量转发，默认只走router
|
||||
$iptables_mangle -A SS$k -s $lan_ip -p tcp -m set --match-set $IPSET_ROUTER dst -j TPROXY --on-port $local_port --tproxy-mark 0x1/0x1
|
||||
$iptables_mangle -A OUTPUT -p tcp -m multiport --dport $TCP_REDIR_PORTS -m set --match-set $IPSET_ROUTER dst -j MARK --set-mark 1
|
||||
else
|
||||
#$iptables_mangle -I SS_ACL 1 -p tcp -m set --match-set $IPSET_BLACKLIST dst -j TTL --ttl-set $ttl
|
||||
# 全局模式
|
||||
$iptables_mangle -A SS_GLO$k -p tcp -j TTL --ttl-set $ttl
|
||||
|
||||
# GFWLIST模式
|
||||
$iptables_mangle -A SS_GFW$k -p tcp -m set --match-set $IPSET_GFW dst -j TTL --ttl-set $ttl
|
||||
$iptables_mangle -A SS_GFW$k -p tcp -m set --match-set $IPSET_ROUTER dst -j TTL --ttl-set $ttl
|
||||
|
||||
# 大陆白名单模式
|
||||
$iptables_mangle -A SS_CHN$k -p tcp -m set --match-set $IPSET_CHN dst -j RETURN
|
||||
#$iptables_mangle -A SS_CHN$k -p tcp -m geoip ! --destination-country CN -j TTL --ttl-set $ttl
|
||||
$iptables_mangle -A SS_CHN$k -p tcp -j TTL --ttl-set $ttl
|
||||
|
||||
# 回国模式
|
||||
#$iptables_mangle -A SS_HOME$k -p tcp -m geoip --destination-country CN -j TTL --ttl-set $ttl
|
||||
$iptables_mangle -A SS_HOME$k -p tcp -m set --match-set $IPSET_CHN dst -j TTL --ttl-set $ttl
|
||||
|
||||
# 游戏模式
|
||||
$iptables_mangle -A SS_GAME$k -p tcp -m set --match-set $IPSET_CHN dst -j RETURN
|
||||
|
||||
[ "$k" == 1 ] && {
|
||||
$iptables_nat -N SS
|
||||
|
||||
is_add_prerouting=0
|
||||
|
||||
KP_INDEX=`$iptables_nat -L PREROUTING|tail -n +3|sed -n -e '/^KOOLPROXY/='`
|
||||
if [ -n "$KP_INDEX" ]; then
|
||||
let KP_INDEX+=1
|
||||
#确保添加到KOOLPROXY规则之后
|
||||
$iptables_nat -I PREROUTING $KP_INDEX -j SS
|
||||
is_add_prerouting=1
|
||||
fi
|
||||
|
||||
ADBYBY_INDEX=`$iptables_nat -L PREROUTING|tail -n +3|sed -n -e '/^ADBYBY/='`
|
||||
if [ -n "$ADBYBY_INDEX" ]; then
|
||||
let ADBYBY_INDEX+=1
|
||||
#确保添加到ADBYBY规则之后
|
||||
$iptables_nat -I PREROUTING $ADBYBY_INDEX -j SS
|
||||
is_add_prerouting=1
|
||||
fi
|
||||
|
||||
if [ "$is_add_prerouting" == 0 ]; then
|
||||
#如果去广告没有运行，确保添加到prerouting_rule规则之后
|
||||
PR_INDEX=`$iptables_nat -L PREROUTING|tail -n +3|sed -n -e '/^prerouting_rule/='`
|
||||
if [ -z "$PR_INDEX" ]; then
|
||||
PR_INDEX=1
|
||||
else
|
||||
let PR_INDEX+=1
|
||||
fi
|
||||
$iptables_nat -I PREROUTING $PR_INDEX -j SS
|
||||
fi
|
||||
# 用于本机流量转发，默认只走router
|
||||
#$iptables_nat -I OUTPUT -j SS
|
||||
$iptables_nat -A OUTPUT -m set --match-set $IPSET_LANIPLIST dst -j RETURN
|
||||
$iptables_nat -A OUTPUT -m set --match-set $IPSET_VPSIPLIST dst -j RETURN
|
||||
$iptables_nat -A OUTPUT -m set --match-set $IPSET_WHITELIST dst -j RETURN
|
||||
$iptables_nat -A OUTPUT -p tcp -m multiport --dport $TCP_REDIR_PORTS -m set --match-set $IPSET_ROUTER dst -j REDIRECT --to-ports $TCP_REDIR_PORT
|
||||
$iptables_nat -A OUTPUT -p tcp -m multiport --dport $TCP_REDIR_PORTS -m set --match-set $IPSET_BLACKLIST dst -j REDIRECT --to-ports $TCP_REDIR_PORT
|
||||
|
||||
[ "$LOCALHOST_PROXY_MODE" == "global" ] && $iptables_nat -A OUTPUT -p tcp -m multiport --dport $TCP_REDIR_PORTS -j REDIRECT --to-ports $TCP_REDIR_PORT
|
||||
[ "$LOCALHOST_PROXY_MODE" == "gfwlist" ] && $iptables_nat -A OUTPUT -p tcp -m multiport --dport $TCP_REDIR_PORTS -m set --match-set $IPSET_GFW dst -j REDIRECT --to-ports $TCP_REDIR_PORT
|
||||
[ "$LOCALHOST_PROXY_MODE" == "chnroute" ] && {
|
||||
$iptables_nat -A OUTPUT -p tcp -m multiport --dport $TCP_REDIR_PORTS -m set --match-set $IPSET_CHN dst -j RETURN
|
||||
$iptables_nat -A OUTPUT -p tcp -m multiport --dport $TCP_REDIR_PORTS -j REDIRECT --to-ports $TCP_REDIR_PORT
|
||||
}
|
||||
}
|
||||
# 重定所有流量到透明代理端口
|
||||
$iptables_nat -A SS -p tcp -m ttl --ttl-eq $ttl -j REDIRECT --to $local_port
|
||||
echolog "IPv4 防火墙TCP转发规则加载完成！"
|
||||
fi
|
||||
fi
|
||||
done
|
||||
else
|
||||
echolog "主服务器未选择，无法转发TCP！"
|
||||
fi
|
||||
|
||||
# 生成UDP转发规则
|
||||
if [ "$UDP_REDIR_SERVER" != "nil" ];then
|
||||
[ -n "$UDP_REDIR_SERVER_IP" -a -n "$UDP_REDIR_SERVER_PORT" ] && $iptables_mangle -A SS -p udp -d $UDP_REDIR_SERVER_IP -m multiport --dports $UDP_REDIR_SERVER_PORT -j RETURN
|
||||
if [ "$UDP_REDIR_SERVER_TYPE" == "brook" ]; then
|
||||
$iptables_mangle -A PREROUTING -p udp -m socket -j MARK --set-mark 1
|
||||
$iptables_mangle -A PREROUTING -p udp -j SS
|
||||
fi
|
||||
$iptables_mangle -A SS -p udp -m set --match-set $IPSET_BLACKLIST dst -j TPROXY --on-port $UDP_REDIR_PORT --tproxy-mark 0x1/0x1
|
||||
# 全局模式
|
||||
$iptables_mangle -A SS_GLO -p udp -j TPROXY --on-port $UDP_REDIR_PORT --tproxy-mark 0x1/0x1
|
||||
|
||||
# GFWLIST模式
|
||||
$iptables_mangle -A SS_GFW -p udp -m set --match-set $IPSET_GFW dst -j TPROXY --on-port $UDP_REDIR_PORT --tproxy-mark 0x1/0x1
|
||||
$iptables_mangle -A SS_GFW -p udp -m set --match-set $IPSET_ROUTER dst -j TPROXY --on-port $UDP_REDIR_PORT --tproxy-mark 0x1/0x1
|
||||
|
||||
# 大陆白名单模式
|
||||
$iptables_mangle -A SS_CHN -p udp -m set --match-set $IPSET_CHN dst -j RETURN
|
||||
$iptables_mangle -A SS_CHN -p udp -j TPROXY --on-port $UDP_REDIR_PORT --tproxy-mark 0x1/0x1
|
||||
|
||||
# 回国模式
|
||||
$iptables_mangle -A SS_HOME -p udp -m set --match-set $IPSET_CHN dst -j TPROXY --on-port $UDP_REDIR_PORT --tproxy-mark 0x1/0x1
|
||||
|
||||
# 游戏模式
|
||||
$iptables_mangle -A SS_GAME -p udp -m set --match-set $IPSET_CHN dst -j RETURN
|
||||
$iptables_mangle -A SS_GAME -p udp -j TPROXY --on-port $UDP_REDIR_PORT --tproxy-mark 0x1/0x1
|
||||
#$iptables_mangle -A SS_GAME -p udp -m geoip ! --destination-country CN -j TTL --ttl-set 188
|
||||
|
||||
echolog "IPv4 防火墙UDP转发规则加载完成！"
|
||||
if [ "$UDP_REDIR_SERVER_NUM" -ge 1 ] ;then
|
||||
for i in $(seq 1 $UDP_REDIR_SERVER_NUM)
|
||||
do
|
||||
local k=$i
|
||||
local local_port=104$k
|
||||
local ttl=14$k
|
||||
eval temp_server=\$UDP_REDIR_SERVER$k
|
||||
[ "$k" == 1 ] && {
|
||||
local_port=$UDP_REDIR_PORT
|
||||
temp_server=$UDP_REDIR_SERVER
|
||||
}
|
||||
# 生成UDP转发规则
|
||||
if [ "$temp_server" != "nil" ];then
|
||||
local server_host=$(config_get $temp_server server)
|
||||
local UDP_REDIR_SERVER_PORT=$(config_get $temp_server server_port)
|
||||
local UDP_REDIR_SERVER_IP=$(get_host_ip "ipv4" $server_host)
|
||||
[ -n "$UDP_REDIR_SERVER_IP" -a -n "$UDP_REDIR_SERVER_PORT" ] && $iptables_mangle -A SS -p udp -d $UDP_REDIR_SERVER_IP -m multiport --dports $UDP_REDIR_SERVER_PORT -j RETURN
|
||||
if [ "$UDP_REDIR_SERVER_TYPE" == "brook" ]; then
|
||||
$iptables_mangle -A PREROUTING -p udp -m socket -j MARK --set-mark 1
|
||||
$iptables_mangle -A PREROUTING -p udp -j SS
|
||||
fi
|
||||
#$iptables_mangle -I SS_ACL$k 1 -p udp -m set --match-set $IPSET_BLACKLIST dst -j TPROXY --on-port $local_port --tproxy-mark 0x1/0x1
|
||||
# 全局模式
|
||||
$iptables_mangle -A SS_GLO$k -p udp -j TPROXY --on-port $local_port --tproxy-mark 0x1/0x1
|
||||
|
||||
# GFWLIST模式
|
||||
$iptables_mangle -A SS_GFW$k -p udp -m set --match-set $IPSET_GFW dst -j TPROXY --on-port $local_port --tproxy-mark 0x1/0x1
|
||||
$iptables_mangle -A SS_GFW$k -p udp -m set --match-set $IPSET_ROUTER dst -j TPROXY --on-port $local_port --tproxy-mark 0x1/0x1
|
||||
|
||||
# 大陆白名单模式
|
||||
$iptables_mangle -A SS_CHN$k -p udp -m set --match-set $IPSET_CHN dst -j RETURN
|
||||
$iptables_mangle -A SS_CHN$k -p udp -j TPROXY --on-port $local_port --tproxy-mark 0x1/0x1
|
||||
|
||||
# 回国模式
|
||||
$iptables_mangle -A SS_HOME$k -p udp -m set --match-set $IPSET_CHN dst -j TPROXY --on-port $local_port --tproxy-mark 0x1/0x1
|
||||
|
||||
# 游戏模式
|
||||
$iptables_mangle -A SS_GAME$k -p udp -m set --match-set $IPSET_CHN dst -j RETURN
|
||||
$iptables_mangle -A SS_GAME$k -p udp -j TPROXY --on-port $local_port --tproxy-mark 0x1/0x1
|
||||
|
||||
echolog "IPv4 防火墙UDP转发规则加载完成！"
|
||||
fi
|
||||
done
|
||||
else
|
||||
echolog "UDP服务器未选择，无法转发UDP！"
|
||||
fi
|
||||
|
||||
# 加载ACLS
|
||||
$iptables_mangle -A SS -j SS_ACL
|
||||
config_foreach load_acl "acl_rule"
|
||||
|
||||
# 加载默认代理模式
|
||||
if [ "$PROXY_MODE" == "disable" ];then
|
||||
[ "$TCP_REDIR_SERVER" != "nil" ] && $iptables_mangle -A SS_ACL -p tcp -m comment --comment "Default" -j $(get_action_chain $PROXY_MODE)
|
||||
[ "$UDP_REDIR_SERVER" != "nil" ] && $iptables_mangle -A SS_ACL -p udp -m comment --comment "Default" -j $(get_action_chain $PROXY_MODE)
|
||||
else
|
||||
[ "$PROXY_MODE" == "gfwlist" ] && dns_hijack "force"
|
||||
[ "$TCP_REDIR_SERVER" != "nil" ] && $iptables_mangle -A SS_ACL -p tcp -m multiport --dport $TCP_REDIR_PORTS -m comment --comment "Default" -j $(get_action_chain $PROXY_MODE)
|
||||
[ "$UDP_REDIR_SERVER" != "nil" ] && $iptables_mangle -A SS_ACL -p udp -m multiport --dport $UDP_REDIR_PORTS -m comment --comment "Default" -j $(get_action_chain $PROXY_MODE)
|
||||
fi
|
||||
|
||||
if [ "$PROXY_IPV6" == "1" ];then
|
||||
lan_ipv6=`ip address show br-lan | grep -w "inet6" |awk '{print $2}'` #当前LAN IPv6段
|
||||
$ip6tables_nat -N SS
|
||||
$ip6tables_nat -N SS_ACL
|
||||
$ip6tables_nat -A PREROUTING -j SS
|
||||
[ -n "$lan_ipv6" ] && {
|
||||
for ip in $lan_ipv6
|
||||
do
|
||||
$ip6tables_nat -A SS -d $ip -j RETURN
|
||||
done
|
||||
}
|
||||
[ "$use_ipv6" == "1" -a -n "$server_ip" ] && $ip6tables_nat -A SS -d $server_ip -j RETURN
|
||||
$ip6tables_nat -N SS_GLO
|
||||
$ip6tables_nat -N SS_GFW
|
||||
$ip6tables_nat -N SS_CHN
|
||||
$ip6tables_nat -N SS_HOME
|
||||
$ip6tables_nat -A SS_GLO -p tcp -j REDIRECT --to $TCP_REDIR_PORT
|
||||
$ip6tables_nat -A SS -j SS_GLO
|
||||
$ip6tables_nat -I OUTPUT -p tcp -j SS
|
||||
echolog "IPv6防火墙规则加载完成！"
|
||||
$iptables_mangle -A PREROUTING -j SS
|
||||
$iptables_mangle -A SS -j SS_ACL
|
||||
|
||||
local max_num=1
|
||||
[ "$TCP_REDIR_SERVER_NUM" -ge "$UDP_REDIR_SERVER_NUM" ] && max_num=$TCP_REDIR_SERVER_NUM
|
||||
if [ "$max_num" -ge 1 ] ;then
|
||||
for i in $(seq 1 $max_num)
|
||||
do
|
||||
local k=$i
|
||||
# 加载ACLS
|
||||
[ "$k" == 1 ] && config_foreach load_acl "acl_rule"
|
||||
|
||||
# 加载默认代理模式
|
||||
if [ "$PROXY_MODE" == "disable" ];then
|
||||
[ "$TCP_REDIR_SERVER" != "nil" ] && $iptables_mangle -A SS_ACL -p tcp -m comment --comment "Default" -j $(get_action_chain $PROXY_MODE)
|
||||
[ "$UDP_REDIR_SERVER" != "nil" ] && $iptables_mangle -A SS_ACL -p udp -m comment --comment "Default" -j $(get_action_chain $PROXY_MODE)
|
||||
else
|
||||
[ "$PROXY_MODE" == "gfwlist" ] && dns_hijack "force"
|
||||
[ "$TCP_REDIR_SERVER" != "nil" ] && $iptables_mangle -A SS_ACL -p tcp -m multiport --dport $TCP_REDIR_PORTS -m comment --comment "Default" -j $(get_action_chain $PROXY_MODE)$k
|
||||
[ "$UDP_REDIR_SERVER" != "nil" ] && $iptables_mangle -A SS_ACL -p udp -m multiport --dport $UDP_REDIR_PORTS -m comment --comment "Default" -j $(get_action_chain $PROXY_MODE)$k
|
||||
fi
|
||||
|
||||
if [ "$PROXY_IPV6" == "1" ];then
|
||||
lan_ipv6=`ip address show br-lan | grep -w "inet6" |awk '{print $2}'` #当前LAN IPv6段
|
||||
$ip6tables_nat -N SS
|
||||
$ip6tables_nat -N SS_ACL
|
||||
$ip6tables_nat -A PREROUTING -j SS
|
||||
[ -n "$lan_ipv6" ] && {
|
||||
for ip in $lan_ipv6
|
||||
do
|
||||
$ip6tables_nat -A SS -d $ip -j RETURN
|
||||
done
|
||||
}
|
||||
[ "$use_ipv6" == "1" -a -n "$server_ip" ] && $ip6tables_nat -A SS -d $server_ip -j RETURN
|
||||
$ip6tables_nat -N SS_GLO$k
|
||||
$ip6tables_nat -N SS_GFW$k
|
||||
$ip6tables_nat -N SS_CHN$k
|
||||
$ip6tables_nat -N SS_HOME$k
|
||||
$ip6tables_nat -A SS_GLO$k -p tcp -j REDIRECT --to $TCP_REDIR_PORT
|
||||
$ip6tables_nat -A SS -j SS_GLO$k
|
||||
#$ip6tables_nat -I OUTPUT -p tcp -j SS
|
||||
echolog "IPv6防火墙规则加载完成！"
|
||||
fi
|
||||
done
|
||||
fi
|
||||
}
|
||||
|
||||
@ -426,6 +486,7 @@ del_firewall_rule() {
|
||||
ipv6_output_ss_exist=`expr $ipv6_output_ss_exist - 1`
|
||||
done
|
||||
}
|
||||
|
||||
$iptables_mangle -D PREROUTING -p tcp -m socket -j MARK --set-mark 1 2>/dev/null
|
||||
$iptables_mangle -D PREROUTING -p udp -m socket -j MARK --set-mark 1 2>/dev/null
|
||||
$iptables_mangle -D OUTPUT -p tcp -m multiport --dport $TCP_REDIR_PORTS -m set --match-set $IPSET_ROUTER dst -j MARK --set-mark 1 2>/dev/null
|
||||
@ -434,31 +495,42 @@ del_firewall_rule() {
|
||||
|
||||
$iptables_nat -D PREROUTING -j SS 2> /dev/null
|
||||
$iptables_nat -F SS 2>/dev/null && $iptables_nat -X SS 2>/dev/null
|
||||
$iptables_mangle -D PREROUTING -j SS 2>/dev/null
|
||||
$iptables_mangle -D PREROUTING -j SS$k 2>/dev/null
|
||||
$iptables_mangle -F SS 2>/dev/null && $iptables_mangle -X SS 2>/dev/null
|
||||
$iptables_mangle -F SS_ACL 2>/dev/null && $iptables_mangle -X SS_ACL 2>/dev/null
|
||||
$iptables_mangle -F SS_GLO 2>/dev/null && $iptables_mangle -X SS_GLO 2>/dev/null
|
||||
$iptables_mangle -F SS_GFW 2>/dev/null && $iptables_mangle -X SS_GFW 2>/dev/null
|
||||
$iptables_mangle -F SS_CHN 2>/dev/null && $iptables_mangle -X SS_CHN 2>/dev/null
|
||||
$iptables_mangle -F SS_GAME 2>/dev/null && $iptables_mangle -X SS_GAME 2>/dev/null
|
||||
$iptables_mangle -F SS_HOME 2>/dev/null && $iptables_mangle -X SS_HOME 2>/dev/null
|
||||
|
||||
$ip6tables_nat -D PREROUTING -j SS 2>/dev/null
|
||||
$ip6tables_nat -F SS 2>/dev/null && $ip6tables_nat -X SS 2>/dev/null
|
||||
$ip6tables_nat -F SS_ACL 2>/dev/null && $ip6tables_nat -X SS_ACL 2>/dev/null
|
||||
$ip6tables_nat -F SS_GLO 2>/dev/null && $ip6tables_nat -X SS_GLO 2>/dev/null
|
||||
$ip6tables_nat -F SS_GFW 2>/dev/null && $ip6tables_nat -X SS_GFW 2>/dev/null
|
||||
$ip6tables_nat -F SS_CHN 2>/dev/null && $ip6tables_nat -X SS_CHN 2>/dev/null
|
||||
$ip6tables_nat -F SS_HOME 2>/dev/null && $ip6tables_nat -X SS_HOME 2>/dev/null
|
||||
ip_rule_exist=`ip rule show | grep "from all fwmark 0x1 lookup 100" | grep -c 100`
|
||||
if [ ! -z "$ip_rule_exist" ];then
|
||||
until [ "$ip_rule_exist" = 0 ]
|
||||
do
|
||||
ip rule del fwmark 1 lookup 100
|
||||
ip_rule_exist=`expr $ip_rule_exist - 1`
|
||||
|
||||
local max_num=1
|
||||
[ "$TCP_REDIR_SERVER_NUM" -ge "$UDP_REDIR_SERVER_NUM" ] && max_num=$TCP_REDIR_SERVER_NUM
|
||||
if [ "$max_num" -ge 1 ] ;then
|
||||
for i in $(seq 1 $max_num)
|
||||
do
|
||||
local k=$i
|
||||
$iptables_mangle -F SS_GLO$k 2>/dev/null && $iptables_mangle -X SS_GLO$k 2>/dev/null
|
||||
$iptables_mangle -F SS_GFW$k 2>/dev/null && $iptables_mangle -X SS_GFW$k 2>/dev/null
|
||||
$iptables_mangle -F SS_CHN$k 2>/dev/null && $iptables_mangle -X SS_CHN$k 2>/dev/null
|
||||
$iptables_mangle -F SS_GAME$k 2>/dev/null && $iptables_mangle -X SS_GAME$k 2>/dev/null
|
||||
$iptables_mangle -F SS_HOME$k 2>/dev/null && $iptables_mangle -X SS_HOME$k 2>/dev/null
|
||||
|
||||
$ip6tables_nat -F SS_GLO$k 2>/dev/null && $ip6tables_nat -X SS_GLO$k 2>/dev/null
|
||||
$ip6tables_nat -F SS_GFW$k 2>/dev/null && $ip6tables_nat -X SS_GFW$k 2>/dev/null
|
||||
$ip6tables_nat -F SS_CHN$k 2>/dev/null && $ip6tables_nat -X SS_CHN$k 2>/dev/null
|
||||
$ip6tables_nat -F SS_HOME$k 2>/dev/null && $ip6tables_nat -X SS_HOME$k 2>/dev/null
|
||||
|
||||
ip_rule_exist=`ip rule show | grep "from all fwmark 0x1 lookup 100" | grep -c 100`
|
||||
if [ ! -z "$ip_rule_exist" ];then
|
||||
until [ "$ip_rule_exist" = 0 ]
|
||||
do
|
||||
ip rule del fwmark 1 lookup 100
|
||||
ip_rule_exist=`expr $ip_rule_exist - 1`
|
||||
done
|
||||
fi
|
||||
ip route del local 0.0.0.0/0 dev lo table 100 2>/dev/null
|
||||
done
|
||||
fi
|
||||
ip route del local 0.0.0.0/0 dev lo table 100 2>/dev/null
|
||||
|
||||
ipset -F $IPSET_ROUTER >/dev/null 2>&1 && ipset -X $IPSET_ROUTER >/dev/null 2>&1 &
|
||||
ipset -F $IPSET_GFW >/dev/null 2>&1 && ipset -X $IPSET_GFW >/dev/null 2>&1 &
|
||||
|
||||
Loading…
Reference in New Issue
Block a user