🍕 Sync 2025-11-10 00:09:51
This commit is contained in:
actions-user
@@ -2147,24 +2147,6 @@ stop() {
|
||||
rm -rf /tmp/lock/${CONFIG}_socks_auto_switch*
|
||||
rm -rf /tmp/lock/${CONFIG}_lease2hosts*
|
||||
echolog "清空并关闭相关程序和缓存完成。"
|
||||
# 根据分流节点类型自动调整 DNS 过滤模式
|
||||
local _tcp_node=$(config_t_get global tcp_node)
|
||||
if [ -n "$_tcp_node" ]; then
|
||||
local _protocol=$(config_n_get $_tcp_node protocol)
|
||||
if [ "$_protocol" = "_shunt" ]; then
|
||||
local _type=$(config_n_get $_tcp_node type)
|
||||
local _dns_mode=$(config_t_get global dns_mode)
|
||||
local _new_dns_mode
|
||||
[ "$_type" = "Xray" ] && _new_dns_mode="xray"
|
||||
[ "$_type" = "sing-box" ] && _new_dns_mode="sing-box"
|
||||
if [ -n "$_new_dns_mode" ] && [ "$_dns_mode" != "$_new_dns_mode" ]; then
|
||||
uci -q set ${CONFIG}.@global[0].dns_mode="$_new_dns_mode"
|
||||
uci -q set ${CONFIG}.@global[0].v2ray_dns_mode="tcp"
|
||||
uci -q commit ${CONFIG}
|
||||
echolog "* 检测到 TCP 节点为 $_type 分流，强制修改 DNS 过滤模式为 $_type ！"
|
||||
fi
|
||||
fi
|
||||
fi
|
||||
exit 0
|
||||
}
|
||||
|
||||
|
||||
@@ -980,17 +980,20 @@ add_firewall_rule() {
|
||||
$ipt_n -I PREROUTING 1 -j PSW_DNS
|
||||
fi
|
||||
|
||||
$ipt_m -N PSW_DIVERT
|
||||
$ipt_m -A PSW_DIVERT -j MARK --set-mark 1
|
||||
$ipt_m -A PSW_DIVERT -j ACCEPT
|
||||
|
||||
$ipt_m -N PSW_RULE
|
||||
$ipt_m -A PSW_RULE -j CONNMARK --restore-mark
|
||||
$ipt_m -A PSW_RULE -m mark --mark 1 -j RETURN
|
||||
$ipt_m -A PSW_RULE -p tcp -m tcp --syn -j MARK --set-xmark 1
|
||||
$ipt_m -A PSW_RULE -p udp -m conntrack --ctstate NEW,RELATED -j MARK --set-xmark 1
|
||||
$ipt_m -A PSW_RULE -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -j MARK --set-xmark 1
|
||||
$ipt_m -A PSW_RULE -p udp -m conntrack --ctstate NEW -j MARK --set-xmark 1
|
||||
$ipt_m -A PSW_RULE -j CONNMARK --save-mark
|
||||
|
||||
$ipt_m -N PSW
|
||||
$ipt_m -A PSW $(dst $IPSET_LAN) -j RETURN
|
||||
$ipt_m -A PSW $(dst $IPSET_VPS) -j RETURN
|
||||
$ipt_m -A PSW -m conntrack --ctdir REPLY -j RETURN
|
||||
|
||||
[ ! -z "${WAN_IP}" ] && {
|
||||
$ipt_m -A PSW $(comment "WAN_IP_RETURN") -d "${WAN_IP}" -j RETURN
|
||||
@@ -999,11 +1002,11 @@ add_firewall_rule() {
|
||||
unset WAN_IP
|
||||
|
||||
insert_rule_before "$ipt_m" "PREROUTING" "mwan3" "-j PSW"
|
||||
insert_rule_before "$ipt_m" "PREROUTING" "PSW" "-p tcp -m socket -j PSW_DIVERT"
|
||||
|
||||
$ipt_m -N PSW_OUTPUT
|
||||
$ipt_m -A PSW_OUTPUT $(dst $IPSET_LAN) -j RETURN
|
||||
$ipt_m -A PSW_OUTPUT $(dst $IPSET_VPS) -j RETURN
|
||||
$ipt_m -A PSW_OUTPUT -m conntrack --ctdir REPLY -j RETURN
|
||||
|
||||
[ -n "$IPT_APPEND_DNS" ] && {
|
||||
local local_dns dns_address dns_port
|
||||
@@ -1050,29 +1053,32 @@ add_firewall_rule() {
|
||||
$ip6t_n -I PREROUTING 1 -j PSW_DNS
|
||||
fi
|
||||
|
||||
$ip6t_m -N PSW_DIVERT
|
||||
$ip6t_m -A PSW_DIVERT -j MARK --set-mark 1
|
||||
$ip6t_m -A PSW_DIVERT -j ACCEPT
|
||||
|
||||
$ip6t_m -N PSW_RULE
|
||||
$ip6t_m -A PSW_RULE -j CONNMARK --restore-mark
|
||||
$ip6t_m -A PSW_RULE -m mark --mark 1 -j RETURN
|
||||
$ip6t_m -A PSW_RULE -p tcp -m tcp --syn -j MARK --set-xmark 1
|
||||
$ip6t_m -A PSW_RULE -p udp -m conntrack --ctstate NEW,RELATED -j MARK --set-xmark 1
|
||||
$ip6t_m -A PSW_RULE -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -j MARK --set-xmark 1
|
||||
$ip6t_m -A PSW_RULE -p udp -m conntrack --ctstate NEW -j MARK --set-xmark 1
|
||||
$ip6t_m -A PSW_RULE -j CONNMARK --save-mark
|
||||
|
||||
$ip6t_m -N PSW
|
||||
$ip6t_m -A PSW $(dst $IPSET_LAN6) -j RETURN
|
||||
$ip6t_m -A PSW $(dst $IPSET_VPS6) -j RETURN
|
||||
$ip6t_m -A PSW -m conntrack --ctdir REPLY -j RETURN
|
||||
|
||||
WAN6_IP=$(get_wan6_ip)
|
||||
[ ! -z "${WAN6_IP}" ] && $ip6t_m -A PSW $(comment "WAN6_IP_RETURN") -d ${WAN6_IP} -j RETURN
|
||||
unset WAN6_IP
|
||||
|
||||
insert_rule_before "$ip6t_m" "PREROUTING" "mwan3" "-j PSW"
|
||||
insert_rule_before "$ip6t_m" "PREROUTING" "PSW" "-p tcp -m socket -j PSW_DIVERT"
|
||||
|
||||
$ip6t_m -N PSW_OUTPUT
|
||||
$ip6t_m -A PSW_OUTPUT -m mark --mark 0xff -j RETURN
|
||||
$ip6t_m -A PSW_OUTPUT $(dst $IPSET_LAN6) -j RETURN
|
||||
$ip6t_m -A PSW_OUTPUT $(dst $IPSET_VPS6) -j RETURN
|
||||
$ip6t_m -A PSW_OUTPUT -m conntrack --ctdir REPLY -j RETURN
|
||||
[ "${USE_BLOCK_LIST}" = "1" ] && $ip6t_m -A PSW_OUTPUT $(dst $IPSET_BLOCK6) -j DROP
|
||||
[ "${USE_DIRECT_LIST}" = "1" ] && $ip6t_m -A PSW_OUTPUT $(dst $IPSET_WHITE6) -j RETURN
|
||||
|
||||
@@ -1309,7 +1315,7 @@ del_firewall_rule() {
|
||||
$ipt -D $chain $index 2>/dev/null
|
||||
done
|
||||
done
|
||||
for chain in "PSW" "PSW_OUTPUT" "PSW_DNS" "PSW_RULE"; do
|
||||
for chain in "PSW" "PSW_OUTPUT" "PSW_DIVERT" "PSW_DNS" "PSW_RULE"; do
|
||||
$ipt -F $chain 2>/dev/null
|
||||
$ipt -X $chain 2>/dev/null
|
||||
done
|
||||
@@ -1363,7 +1369,7 @@ gen_include() {
|
||||
[ -z "${_ipt}" ] && return
|
||||
|
||||
echo "*$2"
|
||||
${_ipt}-save -t $2 | grep "PSW" | grep -v "\-j PSW$" | sed -e "s/^-A \(OUTPUT\|PREROUTING\)/-I \1 1/"
|
||||
${_ipt}-save -t $2 | grep "PSW" | grep -v "\-j PSW$" | grep -v "mangle\-OUTPUT\-PSW" | grep -v "socket \-j PSW_DIVERT$" | sed -e "s/^-A \(OUTPUT\|PREROUTING\)/-I \1 1/"
|
||||
echo 'COMMIT'
|
||||
}
|
||||
local __ipt=""
|
||||
@@ -1384,6 +1390,7 @@ gen_include() {
|
||||
[ -z "${is_tproxy}" ] && \$(${MY_PATH} insert_rule_after "$ipt_n" "PREROUTING" "prerouting_rule" "-p tcp -j PSW")
|
||||
|
||||
\$(${MY_PATH} insert_rule_before "$ipt_m" "PREROUTING" "mwan3" "-j PSW")
|
||||
\$(${MY_PATH} insert_rule_before "$ipt_m" "PREROUTING" "PSW" "-p tcp -m socket -j PSW_DIVERT")
|
||||
|
||||
WAN_IP=\$(${MY_PATH} get_wan_ip)
|
||||
|
||||
@@ -1416,6 +1423,7 @@ gen_include() {
|
||||
[ "$accept_icmpv6" = "1" ] && $ip6t_n -A PREROUTING -p ipv6-icmp -j PSW
|
||||
|
||||
\$(${MY_PATH} insert_rule_before "$ip6t_m" "PREROUTING" "mwan3" "-j PSW")
|
||||
\$(${MY_PATH} insert_rule_before "$ip6t_m" "PREROUTING" "PSW" "-p tcp -m socket -j PSW_DIVERT")
|
||||
|
||||
PR_INDEX=\$(${MY_PATH} RULE_LAST_INDEX "$ip6t_m" PSW WAN6_IP_RETURN -1)
|
||||
if [ \$PR_INDEX -ge 0 ]; then
|
||||
|
||||
@@ -986,6 +986,10 @@ add_firewall_rule() {
|
||||
nft_output_chain="PSW_OUTPUT_MANGLE"
|
||||
fi
|
||||
|
||||
nft "add chain $NFTABLE_NAME PSW_DIVERT"
|
||||
nft "flush chain $NFTABLE_NAME PSW_DIVERT"
|
||||
nft "add rule $NFTABLE_NAME PSW_DIVERT meta l4proto tcp socket transparent 1 mark set 1 counter accept"
|
||||
|
||||
nft "add chain $NFTABLE_NAME PSW_DNS"
|
||||
nft "flush chain $NFTABLE_NAME PSW_DNS"
|
||||
if [ $(config_t_get global dns_redirect "1") = "0" ]; then
|
||||
@@ -1001,8 +1005,8 @@ add_firewall_rule() {
|
||||
nft "flush chain $NFTABLE_NAME PSW_RULE"
|
||||
nft "add rule $NFTABLE_NAME PSW_RULE meta mark set ct mark counter"
|
||||
nft "add rule $NFTABLE_NAME PSW_RULE meta mark 1 counter return"
|
||||
nft "add rule $NFTABLE_NAME PSW_RULE tcp flags syn meta mark set mark and 0x0 xor 0x1 counter"
|
||||
nft "add rule $NFTABLE_NAME PSW_RULE meta l4proto udp ct state new,related meta mark set mark and 0x0 xor 0x1 counter"
|
||||
nft "add rule $NFTABLE_NAME PSW_RULE tcp flags &(fin|syn|rst|ack) == syn meta mark set mark and 0x0 xor 0x1 counter"
|
||||
nft "add rule $NFTABLE_NAME PSW_RULE meta l4proto udp ct state new meta mark set mark and 0x0 xor 0x1 counter"
|
||||
nft "add rule $NFTABLE_NAME PSW_RULE ct mark set mark counter"
|
||||
|
||||
#ipv4 tproxy mode and udp
|
||||
@@ -1010,13 +1014,11 @@ add_firewall_rule() {
|
||||
nft "flush chain $NFTABLE_NAME PSW_MANGLE"
|
||||
nft "add rule $NFTABLE_NAME PSW_MANGLE ip daddr @$NFTSET_LAN counter return"
|
||||
nft "add rule $NFTABLE_NAME PSW_MANGLE ip daddr @$NFTSET_VPS counter return"
|
||||
nft "add rule $NFTABLE_NAME PSW_MANGLE ct direction reply counter return"
|
||||
|
||||
nft "add chain $NFTABLE_NAME PSW_OUTPUT_MANGLE"
|
||||
nft "flush chain $NFTABLE_NAME PSW_OUTPUT_MANGLE"
|
||||
nft "add rule $NFTABLE_NAME PSW_OUTPUT_MANGLE ip daddr @$NFTSET_LAN counter return"
|
||||
nft "add rule $NFTABLE_NAME PSW_OUTPUT_MANGLE ip daddr @$NFTSET_VPS counter return"
|
||||
nft "add rule $NFTABLE_NAME PSW_OUTPUT_MANGLE ct direction reply counter return"
|
||||
|
||||
[ "${USE_BLOCK_LIST}" = "1" ] && nft "add rule $NFTABLE_NAME PSW_OUTPUT_MANGLE ip daddr @$NFTSET_BLOCK counter drop"
|
||||
[ "${USE_DIRECT_LIST}" = "1" ] && nft "add rule $NFTABLE_NAME PSW_OUTPUT_MANGLE ip daddr @$NFTSET_WHITE counter return"
|
||||
@@ -1025,6 +1027,7 @@ add_firewall_rule() {
|
||||
# jump chains
|
||||
nft "add rule $NFTABLE_NAME mangle_prerouting ip protocol udp counter jump PSW_MANGLE"
|
||||
[ -n "${is_tproxy}" ] && nft "add rule $NFTABLE_NAME mangle_prerouting ip protocol tcp counter jump PSW_MANGLE"
|
||||
insert_rule_before "$NFTABLE_NAME" "mangle_prerouting" "PSW_MANGLE" "counter jump PSW_DIVERT"
|
||||
|
||||
#ipv4 tcp redirect mode
|
||||
[ -z "${is_tproxy}" ] && {
|
||||
@@ -1075,13 +1078,11 @@ add_firewall_rule() {
|
||||
nft "flush chain $NFTABLE_NAME PSW_MANGLE_V6"
|
||||
nft "add rule $NFTABLE_NAME PSW_MANGLE_V6 ip6 daddr @$NFTSET_LAN6 counter return"
|
||||
nft "add rule $NFTABLE_NAME PSW_MANGLE_V6 ip6 daddr @$NFTSET_VPS6 counter return"
|
||||
nft "add rule $NFTABLE_NAME PSW_MANGLE_V6 ct direction reply counter return"
|
||||
|
||||
nft "add chain $NFTABLE_NAME PSW_OUTPUT_MANGLE_V6"
|
||||
nft "flush chain $NFTABLE_NAME PSW_OUTPUT_MANGLE_V6"
|
||||
nft "add rule $NFTABLE_NAME PSW_OUTPUT_MANGLE_V6 ip6 daddr @$NFTSET_LAN6 counter return"
|
||||
nft "add rule $NFTABLE_NAME PSW_OUTPUT_MANGLE_V6 ip6 daddr @$NFTSET_VPS6 counter return"
|
||||
nft "add rule $NFTABLE_NAME PSW_OUTPUT_MANGLE_V6 ct direction reply counter return"
|
||||
[ "${USE_BLOCK_LIST}" = "1" ] && nft "add rule $NFTABLE_NAME PSW_OUTPUT_MANGLE_V6 ip6 daddr @$NFTSET_BLOCK6 counter drop"
|
||||
[ "${USE_DIRECT_LIST}" = "1" ] && nft "add rule $NFTABLE_NAME PSW_OUTPUT_MANGLE_V6 ip6 daddr @$NFTSET_WHITE6 counter return"
|
||||
nft "add rule $NFTABLE_NAME PSW_OUTPUT_MANGLE_V6 meta mark 0xff counter return"
|
||||
@@ -1397,7 +1398,7 @@ gen_include() {
|
||||
|
||||
local __nft=" "
|
||||
__nft=$(cat <<- EOF
|
||||
[ -z "\$(nft list chain $NFTABLE_NAME mangle_prerouting | grep PSW)" ] && nft -f ${nft_chain_file}
|
||||
[ -z "\$(nft list chain $NFTABLE_NAME mangle_prerouting | grep PSW_DIVERT)" ] && nft -f ${nft_chain_file}
|
||||
[ -z "${is_tproxy}" ] && {
|
||||
PR_INDEX=\$(sh ${MY_PATH} RULE_LAST_INDEX "$NFTABLE_NAME" PSW_NAT WAN_IP_RETURN -1)
|
||||
if [ \$PR_INDEX -ge 0 ]; then
|
||||
|
||||
Reference in New Issue
Block a user