🐶 Sync 2025-11-02 14:26:26
This commit is contained in:
actions-user
788
luci-app-ssr-plus/root/usr/bin/ssr-rules
Executable file
788
luci-app-ssr-plus/root/usr/bin/ssr-rules
Executable file
@@ -0,0 +1,788 @@
|
||||
#!/bin/sh
|
||||
#
|
||||
# Copyright (C) 2017 openwrt-ssr
|
||||
# Copyright (C) 2017 yushi studio <ywb94@qq.com>
|
||||
#
|
||||
# This is free software, licensed under the GNU General Public License v3.
|
||||
# See /LICENSE for more information.
|
||||
#
|
||||
|
||||
# Detect firewall version and set appropriate tools
|
||||
detect_firewall() {
|
||||
if command -v fw4 >/dev/null 2>&1 && [ -f /usr/share/nftables.d/ruleset-post/99-shadowsocksr.nft ]; then
|
||||
USE_NFT=1
|
||||
NFT="nft"
|
||||
elif command -v nft >/dev/null 2>&1 && [ "$(uci get firewall.@defaults[0].syn_flood 2>/dev/null)" != "" ] && [ ! -f /etc/config/firewall3 ]; then
|
||||
USE_NFT=1
|
||||
NFT="nft"
|
||||
else
|
||||
USE_NFT=0
|
||||
IPT="iptables -t nat" # alias of iptables
|
||||
FWI=$(uci get firewall.shadowsocksr.path 2>/dev/null) # firewall include file
|
||||
fi
|
||||
}
|
||||
|
||||
# Initialize firewall detection
|
||||
detect_firewall
|
||||
|
||||
TAG="_SS_SPEC_RULE_" # comment tag
|
||||
usage() {
|
||||
cat <<-EOF
|
||||
Usage: ssr-rules [options]
|
||||
|
||||
Valid options are:
|
||||
|
||||
-s <server_ip> ip address of shadowsocksr remote server
|
||||
-l <local_port> port number of shadowsocksr local server
|
||||
-S <server_ip> ip address of shadowsocksr remote UDP server
|
||||
-L <local_port> port number of shadowsocksr local UDP server
|
||||
-i <ip_list_file> a file content is bypassed ip list
|
||||
-a <lan_ips> lan ip of access control, need a prefix to
|
||||
define access control mode
|
||||
-b <wan_ips> wan ip of will be bypassed
|
||||
-w <wan_ips> wan ip of will be forwarded
|
||||
-B <bp_lan_ips> lan ip of will be bypassed proxy
|
||||
-p <fp_lan_ips> lan ip of will be global proxy
|
||||
-G <gm_lan_ips> lan ip of will be game mode proxy
|
||||
-D <proxy_ports> proxy ports
|
||||
-F shunt mode
|
||||
-N shunt server IP
|
||||
-M shunt proxy mode
|
||||
-m <Interface> Interface name
|
||||
-I <ip_list_file> a file content is bypassed shunt ip list
|
||||
-e <extra_options> extra options for iptables
|
||||
-o apply the rules to the OUTPUT chain
|
||||
-O apply the global rules to the OUTPUT chain
|
||||
-u enable udprelay mode, TPROXY is required
|
||||
-U enable udprelay mode, using different IP
|
||||
and ports for TCP and UDP
|
||||
-f flush the rules
|
||||
-g gfwlist mode
|
||||
-r router mode
|
||||
-c oversea mode
|
||||
-z all mode
|
||||
-h show this help message and exit
|
||||
EOF
|
||||
exit $1
|
||||
}
|
||||
|
||||
loger() {
|
||||
# 1.alert 2.crit 3.err 4.warn 5.notice 6.info 7.debug
|
||||
logger -st ssr-rules[$$] -p$1 $2
|
||||
}
|
||||
|
||||
flush_r() {
|
||||
if [ "$USE_NFT" = "1" ]; then
|
||||
flush_nftables
|
||||
else
|
||||
flush_iptables_legacy
|
||||
fi
|
||||
return 0
|
||||
}
|
||||
|
||||
flush_nftables() {
|
||||
# Remove nftables rules and sets
|
||||
$NFT delete table inet ss_spec 2>/dev/null
|
||||
|
||||
# Clean up routing rules
|
||||
ip rule del fwmark 0x01/0x01 table 100 2>/dev/null
|
||||
ip route del local 0.0.0.0/0 dev lo table 100 2>/dev/null
|
||||
|
||||
return 0
|
||||
}
|
||||
|
||||
flush_iptables_legacy() {
|
||||
flush_iptables() {
|
||||
local ipt="iptables -t $1"
|
||||
local DAT=$(iptables-save -t $1)
|
||||
eval $(echo "$DAT" | grep "$TAG" | sed -e 's/^-A/$ipt -D/' -e 's/$/;/')
|
||||
for chain in $(echo "$DAT" | awk '/^:SS_SPEC/{print $1}'); do
|
||||
$ipt -F ${chain:1} 2>/dev/null && $ipt -X ${chain:1}
|
||||
done
|
||||
}
|
||||
flush_iptables nat
|
||||
flush_iptables mangle
|
||||
ip rule del fwmark 0x01/0x01 table 100 2>/dev/null
|
||||
ip route del local 0.0.0.0/0 dev lo table 100 2>/dev/null
|
||||
ipset -X ss_spec_lan_ac 2>/dev/null
|
||||
ipset -X ss_spec_wan_ac 2>/dev/null
|
||||
ipset -X ssr_gen_router 2>/dev/null
|
||||
ipset -X fplan 2>/dev/null
|
||||
ipset -X bplan 2>/dev/null
|
||||
ipset -X gmlan 2>/dev/null
|
||||
ipset -X oversea 2>/dev/null
|
||||
ipset -X whitelist 2>/dev/null
|
||||
ipset -X blacklist 2>/dev/null
|
||||
ipset -X netflix 2>/dev/null
|
||||
[ -n "$FWI" ] && echo '#!/bin/sh' >$FWI
|
||||
return 0
|
||||
}
|
||||
|
||||
ipset_r() {
|
||||
if [ "$USE_NFT" = "1" ]; then
|
||||
ipset_nft
|
||||
else
|
||||
ipset_iptables
|
||||
fi
|
||||
return $?
|
||||
}
|
||||
|
||||
ipset_nft() {
|
||||
[ -f "$IGNORE_LIST" ] && /usr/share/shadowsocksr/chinaipset.sh $IGNORE_LIST
|
||||
|
||||
# Create nftables table and sets
|
||||
$NFT add table inet ss_spec 2>/dev/null
|
||||
$NFT add set inet ss_spec ss_spec_wan_ac { type ipv4_addr\; flags interval\; } 2>/dev/null
|
||||
$NFT add set inet ss_spec gmlan { type ipv4_addr\; flags interval\; } 2>/dev/null
|
||||
$NFT add set inet ss_spec fplan { type ipv4_addr\; flags interval\; } 2>/dev/null
|
||||
$NFT add set inet ss_spec bplan { type ipv4_addr\; flags interval\; } 2>/dev/null
|
||||
$NFT add set inet ss_spec whitelist { type ipv4_addr\; flags interval\; } 2>/dev/null
|
||||
$NFT add set inet ss_spec blacklist { type ipv4_addr\; flags interval\; } 2>/dev/null
|
||||
$NFT add set inet ss_spec netflix { type ipv4_addr\; flags interval\; } 2>/dev/null
|
||||
|
||||
# Add IP addresses to sets
|
||||
for ip in $LAN_GM_IP; do
|
||||
$NFT add element inet ss_spec gmlan { $ip }
|
||||
done
|
||||
for ip in $LAN_FP_IP; do
|
||||
$NFT add element inet ss_spec fplan { $ip }
|
||||
done
|
||||
for ip in $LAN_BP_IP; do
|
||||
$NFT add element inet ss_spec bplan { $ip }
|
||||
done
|
||||
for ip in $WAN_BP_IP; do
|
||||
$NFT add element inet ss_spec whitelist { $ip }
|
||||
done
|
||||
for ip in $WAN_FW_IP; do
|
||||
$NFT add element inet ss_spec blacklist { $ip }
|
||||
done
|
||||
|
||||
# Create main chain for WAN access control
|
||||
$NFT add chain inet ss_spec ss_spec_wan_ac { type nat hook prerouting priority dstnat\; }
|
||||
$NFT add rule inet ss_spec ss_spec_wan_ac tcp dport 53 ip daddr 127.0.0.0/8 return
|
||||
$NFT add rule inet ss_spec ss_spec_wan_ac tcp dport != 53 ip daddr $server return
|
||||
|
||||
# Add special IP ranges to WAN AC set
|
||||
for ip in $(gen_spec_iplist); do
|
||||
$NFT add element inet ss_spec ss_spec_wan_ac { $ip }
|
||||
done
|
||||
|
||||
# Set up mode-specific rules
|
||||
case "$RUNMODE" in
|
||||
router)
|
||||
if command -v ipset >/dev/null 2>&1 && ipset list china -name -quiet >/dev/null 2>&1; then
|
||||
$NFT add rule inet ss_spec ss_spec_wan_ac ip daddr @ss_spec_wan_ac return
|
||||
$NFT add rule inet ss_spec ss_spec_wan_ac ip daddr "@china" return
|
||||
$NFT add rule inet ss_spec ss_spec_wan_ac ip saddr @gmlan ip daddr != "@china" goto ss_spec_wan_fw
|
||||
$NFT add rule inet ss_spec ss_spec_wan_ac goto ss_spec_wan_fw
|
||||
else
|
||||
$NFT add rule inet ss_spec ss_spec_wan_ac ip daddr @ss_spec_wan_ac return
|
||||
$NFT add rule inet ss_spec ss_spec_wan_ac goto ss_spec_wan_fw
|
||||
fi
|
||||
;;
|
||||
gfw)
|
||||
if command -v ipset >/dev/null 2>&1 && ipset list china -name -quiet >/dev/null 2>&1; then
|
||||
$NFT add rule inet ss_spec ss_spec_wan_ac ip daddr "@china" return
|
||||
$NFT add rule inet ss_spec ss_spec_wan_ac ip daddr "@gfwlist" goto ss_spec_wan_fw
|
||||
$NFT add rule inet ss_spec ss_spec_wan_ac ip saddr @gmlan ip daddr != "@china" goto ss_spec_wan_fw
|
||||
fi
|
||||
;;
|
||||
oversea)
|
||||
$NFT add rule inet ss_spec ss_spec_wan_ac ip daddr @oversea goto ss_spec_wan_fw
|
||||
$NFT add rule inet ss_spec ss_spec_wan_ac ip saddr @gmlan goto ss_spec_wan_fw
|
||||
if command -v ipset >/dev/null 2>&1 && ipset list china -name -quiet >/dev/null 2>&1; then
|
||||
$NFT add rule inet ss_spec ss_spec_wan_ac ip daddr "@china" goto ss_spec_wan_fw
|
||||
fi
|
||||
;;
|
||||
all)
|
||||
$NFT add rule inet ss_spec ss_spec_wan_ac goto ss_spec_wan_fw
|
||||
;;
|
||||
esac
|
||||
|
||||
# Access control rules
|
||||
$NFT add rule inet ss_spec ss_spec_wan_ac ip saddr @fplan goto ss_spec_wan_fw
|
||||
$NFT add rule inet ss_spec ss_spec_wan_ac ip saddr @bplan return
|
||||
$NFT add rule inet ss_spec ss_spec_wan_ac ip daddr @blacklist goto ss_spec_wan_fw
|
||||
$NFT add rule inet ss_spec ss_spec_wan_ac ip daddr @whitelist return
|
||||
|
||||
# Music unlocking support
|
||||
if command -v ipset >/dev/null 2>&1 && ipset list music -name -quiet >/dev/null 2>&1; then
|
||||
$NFT add rule inet ss_spec ss_spec_wan_ac ip daddr "@music" return 2>/dev/null
|
||||
fi
|
||||
|
||||
# Shunt/Netflix rules
|
||||
if [ "$SHUNT_PORT" != "0" ]; then
|
||||
for ip in $(cat ${SHUNT_LIST:=/dev/null} 2>/dev/null); do
|
||||
$NFT add element inet ss_spec netflix { $ip }
|
||||
done
|
||||
case "$SHUNT_PORT" in
|
||||
1)
|
||||
$NFT add rule inet ss_spec ss_spec_wan_ac tcp dport $PROXY_PORTS ip daddr @netflix redirect to :$local_port
|
||||
;;
|
||||
*)
|
||||
$NFT add rule inet ss_spec ss_spec_wan_ac tcp dport $PROXY_PORTS ip daddr @netflix redirect to :$SHUNT_PORT
|
||||
if [ "$SHUNT_PROXY" == "1" ]; then
|
||||
$NFT add rule inet ss_spec ss_spec_wan_ac tcp dport $PROXY_PORTS ip daddr $SHUNT_IP redirect to :$local_port
|
||||
else
|
||||
$NFT add element inet ss_spec whitelist { $SHUNT_IP }
|
||||
fi
|
||||
;;
|
||||
esac
|
||||
fi
|
||||
return 0
|
||||
}
|
||||
|
||||
ipset_iptables() {
|
||||
[ -f "$IGNORE_LIST" ] && /usr/share/shadowsocksr/chinaipset.sh $IGNORE_LIST
|
||||
$IPT -N SS_SPEC_WAN_AC 2>/dev/null
|
||||
$IPT -I SS_SPEC_WAN_AC -p tcp --dport 53 -d 127.0.0.0/8 -j RETURN
|
||||
$IPT -I SS_SPEC_WAN_AC -p tcp ! --dport 53 -d $server -j RETURN
|
||||
ipset -N gmlan hash:net 2>/dev/null
|
||||
for ip in $LAN_GM_IP; do ipset -! add gmlan $ip; done
|
||||
case "$RUNMODE" in
|
||||
router)
|
||||
ipset -! -R <<-EOF || return 1
|
||||
create ss_spec_wan_ac hash:net
|
||||
$(gen_spec_iplist | sed -e "s/^/add ss_spec_wan_ac /")
|
||||
EOF
|
||||
$IPT -A SS_SPEC_WAN_AC -m set --match-set ss_spec_wan_ac dst -j RETURN
|
||||
$IPT -A SS_SPEC_WAN_AC -m set --match-set china dst -j RETURN
|
||||
$IPT -A SS_SPEC_WAN_AC -m set --match-set gmlan src -m set ! --match-set china dst -j SS_SPEC_WAN_FW
|
||||
$IPT -A SS_SPEC_WAN_AC -j SS_SPEC_WAN_FW
|
||||
;;
|
||||
gfw)
|
||||
ipset -N gfwlist hash:net 2>/dev/null
|
||||
$IPT -A SS_SPEC_WAN_AC -m set --match-set china dst -j RETURN
|
||||
$IPT -A SS_SPEC_WAN_AC -m set --match-set gfwlist dst -j SS_SPEC_WAN_FW
|
||||
$IPT -A SS_SPEC_WAN_AC -m set --match-set gmlan src -m set ! --match-set china dst -j SS_SPEC_WAN_FW
|
||||
;;
|
||||
oversea)
|
||||
ipset -N oversea hash:net 2>/dev/null
|
||||
$IPT -I SS_SPEC_WAN_AC -m set --match-set oversea dst -j SS_SPEC_WAN_FW
|
||||
$IPT -A SS_SPEC_WAN_AC -m set --match-set gmlan src -j SS_SPEC_WAN_FW
|
||||
$IPT -A SS_SPEC_WAN_AC -m set --match-set china dst -j SS_SPEC_WAN_FW
|
||||
;;
|
||||
all)
|
||||
$IPT -A SS_SPEC_WAN_AC -j SS_SPEC_WAN_FW
|
||||
;;
|
||||
esac
|
||||
ipset -N fplan hash:net 2>/dev/null
|
||||
for ip in $LAN_FP_IP; do ipset -! add fplan $ip; done
|
||||
$IPT -I SS_SPEC_WAN_AC -m set --match-set fplan src -j SS_SPEC_WAN_FW
|
||||
ipset -N bplan hash:net 2>/dev/null
|
||||
for ip in $LAN_BP_IP; do ipset -! add bplan $ip; done
|
||||
$IPT -I SS_SPEC_WAN_AC -m set --match-set bplan src -j RETURN
|
||||
ipset -N whitelist hash:net 2>/dev/null
|
||||
ipset -N blacklist hash:net 2>/dev/null
|
||||
$IPT -I SS_SPEC_WAN_AC -m set --match-set blacklist dst -j SS_SPEC_WAN_FW
|
||||
$IPT -I SS_SPEC_WAN_AC -m set --match-set whitelist dst -j RETURN
|
||||
if [ $(ipset list music -name -quiet | grep music) ]; then
|
||||
$IPT -I SS_SPEC_WAN_AC -m set --match-set music dst -j RETURN 2>/dev/null
|
||||
fi
|
||||
for ip in $WAN_BP_IP; do ipset -! add whitelist $ip; done
|
||||
for ip in $WAN_FW_IP; do ipset -! add blacklist $ip; done
|
||||
if [ "$SHUNT_PORT" != "0" ]; then
|
||||
ipset -N netflix hash:net 2>/dev/null
|
||||
for ip in $(cat ${SHUNT_LIST:=/dev/null} 2>/dev/null); do ipset -! add netflix $ip; done
|
||||
case "$SHUNT_PORT" in
|
||||
0) ;;
|
||||
1)
|
||||
$IPT -I SS_SPEC_WAN_AC -p tcp -m set --match-set netflix dst -j REDIRECT --to-ports $local_port
|
||||
;;
|
||||
*)
|
||||
$IPT -I SS_SPEC_WAN_AC -p tcp -m set --match-set netflix dst -j REDIRECT --to-ports $SHUNT_PORT
|
||||
if [ "$SHUNT_PROXY" == "1" ]; then
|
||||
$IPT -I SS_SPEC_WAN_AC -p tcp -d $SHUNT_IP -j REDIRECT --to-ports $local_port
|
||||
else
|
||||
ipset -! add whitelist $SHUNT_IP
|
||||
fi
|
||||
;;
|
||||
esac
|
||||
fi
|
||||
return $?
|
||||
}
|
||||
|
||||
fw_rule() {
|
||||
if [ "$USE_NFT" = "1" ]; then
|
||||
fw_rule_nft
|
||||
else
|
||||
fw_rule_iptables
|
||||
fi
|
||||
return $?
|
||||
}
|
||||
|
||||
fw_rule_nft() {
|
||||
# Create forward chain for nftables
|
||||
$NFT add chain inet ss_spec ss_spec_wan_fw
|
||||
$NFT add rule inet ss_spec ss_spec_wan_fw ip daddr 0.0.0.0/8 return
|
||||
$NFT add rule inet ss_spec ss_spec_wan_fw ip daddr 10.0.0.0/8 return
|
||||
$NFT add rule inet ss_spec ss_spec_wan_fw ip daddr 127.0.0.0/8 return
|
||||
$NFT add rule inet ss_spec ss_spec_wan_fw ip daddr 169.254.0.0/16 return
|
||||
$NFT add rule inet ss_spec ss_spec_wan_fw ip daddr 172.16.0.0/12 return
|
||||
$NFT add rule inet ss_spec ss_spec_wan_fw ip daddr 192.168.0.0/16 return
|
||||
$NFT add rule inet ss_spec ss_spec_wan_fw ip daddr 224.0.0.0/4 return
|
||||
$NFT add rule inet ss_spec ss_spec_wan_fw ip daddr 240.0.0.0/4 return
|
||||
|
||||
if [ -n "$PROXY_PORTS" ]; then
|
||||
$NFT add rule inet ss_spec ss_spec_wan_fw tcp $PROXY_PORTS redirect to :$local_port 2>/dev/null || {
|
||||
loger 3 "Can't redirect, please check nftables."
|
||||
exit 1
|
||||
}
|
||||
else
|
||||
$NFT add rule inet ss_spec ss_spec_wan_fw tcp dport != 22 redirect to :$local_port 2>/dev/null || {
|
||||
loger 3 "Can't redirect, please check nftables."
|
||||
exit 1
|
||||
}
|
||||
fi
|
||||
return 0
|
||||
}
|
||||
|
||||
fw_rule_iptables() {
|
||||
$IPT -N SS_SPEC_WAN_FW
|
||||
$IPT -A SS_SPEC_WAN_FW -d 0.0.0.0/8 -j RETURN
|
||||
$IPT -A SS_SPEC_WAN_FW -d 10.0.0.0/8 -j RETURN
|
||||
$IPT -A SS_SPEC_WAN_FW -d 127.0.0.0/8 -j RETURN
|
||||
$IPT -A SS_SPEC_WAN_FW -d 169.254.0.0/16 -j RETURN
|
||||
$IPT -A SS_SPEC_WAN_FW -d 172.16.0.0/12 -j RETURN
|
||||
$IPT -A SS_SPEC_WAN_FW -d 192.168.0.0/16 -j RETURN
|
||||
$IPT -A SS_SPEC_WAN_FW -d 224.0.0.0/4 -j RETURN
|
||||
$IPT -A SS_SPEC_WAN_FW -d 240.0.0.0/4 -j RETURN
|
||||
$IPT -A SS_SPEC_WAN_FW -p tcp $PROXY_PORTS -j REDIRECT --to-ports $local_port 2>/dev/null || {
|
||||
loger 3 "Can't redirect, please check the iptables."
|
||||
exit 1
|
||||
}
|
||||
return $?
|
||||
}
|
||||
|
||||
ac_rule() {
|
||||
if [ "$USE_NFT" = "1" ]; then
|
||||
ac_rule_nft
|
||||
else
|
||||
ac_rule_iptables
|
||||
fi
|
||||
return $?
|
||||
}
|
||||
|
||||
ac_rule_nft() {
|
||||
local MATCH_SET_CONDITION=""
|
||||
if [ -n "$LAN_AC_IP" ]; then
|
||||
# Create LAN access control set
|
||||
$NFT add set inet ss_spec ss_spec_lan_ac { type ipv4_addr\; flags interval\; } 2>/dev/null
|
||||
for ip in ${LAN_AC_IP:1}; do
|
||||
$NFT add element inet ss_spec ss_spec_lan_ac { $ip }
|
||||
done
|
||||
|
||||
case "${LAN_AC_IP:0:1}" in
|
||||
w | W)
|
||||
MATCH_SET_CONDITION="ip saddr @ss_spec_lan_ac"
|
||||
;;
|
||||
b | B)
|
||||
MATCH_SET_CONDITION="ip saddr != @ss_spec_lan_ac"
|
||||
;;
|
||||
*)
|
||||
loger 3 "Bad argument \`-a $LAN_AC_IP\`."
|
||||
return 2
|
||||
;;
|
||||
esac
|
||||
fi
|
||||
|
||||
# Create prerouting rules
|
||||
if [ -z "$Interface" ]; then
|
||||
if [ -n "$MATCH_SET_CONDITION" ]; then
|
||||
$NFT add rule inet ss_spec ss_spec_wan_ac tcp dport $EXT_ARGS $MATCH_SET_CONDITION comment "\"$TAG\"" goto ss_spec_wan_ac
|
||||
else
|
||||
$NFT add rule inet ss_spec ss_spec_wan_ac tcp dport $EXT_ARGS comment "\"$TAG\"" goto ss_spec_wan_ac
|
||||
fi
|
||||
else
|
||||
for name in $Interface; do
|
||||
local IFNAME=$(uci -P /var/state get network.$name.ifname 2>/dev/null)
|
||||
[ -z "$IFNAME" ] && IFNAME=$(uci -P /var/state get network.$name.device 2>/dev/null)
|
||||
if [ -n "$IFNAME" ]; then
|
||||
if [ -n "$MATCH_SET_CONDITION" ]; then
|
||||
$NFT add rule inet ss_spec ss_spec_wan_ac iifname $IFNAME tcp dport $EXT_ARGS $MATCH_SET_CONDITION comment "\"$TAG\"" goto ss_spec_wan_ac
|
||||
else
|
||||
$NFT add rule inet ss_spec ss_spec_wan_ac iifname $IFNAME tcp dport $EXT_ARGS comment "\"$TAG\"" goto ss_spec_wan_ac
|
||||
fi
|
||||
fi
|
||||
done
|
||||
fi
|
||||
|
||||
case "$OUTPUT" in
|
||||
1)
|
||||
# Add output rules
|
||||
$NFT add chain inet ss_spec ss_spec_output { type nat hook output priority dstnat\; }
|
||||
$NFT add rule inet ss_spec ss_spec_output tcp dport $EXT_ARGS comment "\"$TAG\"" goto ss_spec_wan_ac
|
||||
;;
|
||||
2)
|
||||
# Router mode output rules
|
||||
$NFT add set inet ss_spec ssr_gen_router { type ipv4_addr\; flags interval\; } 2>/dev/null
|
||||
for ip in $(gen_spec_iplist); do
|
||||
$NFT add element inet ss_spec ssr_gen_router { $ip }
|
||||
done
|
||||
$NFT add chain inet ss_spec ss_spec_router
|
||||
$NFT add rule inet ss_spec ss_spec_router ip daddr @ssr_gen_router return
|
||||
$NFT add rule inet ss_spec ss_spec_router goto ss_spec_wan_fw
|
||||
$NFT add chain inet ss_spec ss_spec_output { type nat hook output priority dstnat\; }
|
||||
$NFT add rule inet ss_spec ss_spec_output tcp dport comment "\"$TAG\"" goto ss_spec_router
|
||||
;;
|
||||
esac
|
||||
return 0
|
||||
}
|
||||
|
||||
ac_rule_iptables() {
|
||||
if [ -n "$LAN_AC_IP" ]; then
|
||||
case "${LAN_AC_IP:0:1}" in
|
||||
w | W)
|
||||
MATCH_SET="-m set --match-set ss_spec_lan_ac src"
|
||||
;;
|
||||
b | B)
|
||||
MATCH_SET="-m set ! --match-set ss_spec_lan_ac src"
|
||||
;;
|
||||
*)
|
||||
loger 3 "Bad argument \`-a $LAN_AC_IP\`."
|
||||
return 2
|
||||
;;
|
||||
esac
|
||||
fi
|
||||
ipset -! -R <<-EOF || return 1
|
||||
create ss_spec_lan_ac hash:net
|
||||
$(for ip in ${LAN_AC_IP:1}; do echo "add ss_spec_lan_ac $ip"; done)
|
||||
EOF
|
||||
if [ -z "$Interface" ]; then
|
||||
$IPT -I PREROUTING 1 -p tcp $EXT_ARGS $MATCH_SET -m comment --comment "$TAG" -j SS_SPEC_WAN_AC
|
||||
else
|
||||
for name in $Interface; do
|
||||
local IFNAME=$(uci -P /var/state get network.$name.ifname 2>/dev/null)
|
||||
[ -z "$IFNAME" ] && IFNAME=$(uci -P /var/state get network.$name.device 2>/dev/null)
|
||||
[ -n "$IFNAME" ] && $IPT -I PREROUTING 1 ${IFNAME:+-i $IFNAME} -p tcp $EXT_ARGS $MATCH_SET -m comment --comment "$TAG" -j SS_SPEC_WAN_AC
|
||||
done
|
||||
fi
|
||||
|
||||
case "$OUTPUT" in
|
||||
1)
|
||||
$IPT -I OUTPUT 1 -p tcp $EXT_ARGS -m comment --comment "$TAG" -j SS_SPEC_WAN_AC
|
||||
;;
|
||||
2)
|
||||
ipset -! -R <<-EOF || return 1
|
||||
create ssr_gen_router hash:net
|
||||
$(gen_spec_iplist | sed -e "s/^/add ssr_gen_router /")
|
||||
EOF
|
||||
$IPT -N SS_SPEC_ROUTER && \
|
||||
$IPT -A SS_SPEC_ROUTER -m set --match-set ssr_gen_router dst -j RETURN && \
|
||||
$IPT -A SS_SPEC_ROUTER -j SS_SPEC_WAN_FW
|
||||
$IPT -I OUTPUT 1 -p tcp -m comment --comment "$TAG" -j SS_SPEC_ROUTER
|
||||
;;
|
||||
esac
|
||||
return $?
|
||||
}
|
||||
|
||||
tp_rule() {
|
||||
[ -n "$TPROXY" ] || return 0
|
||||
if [ "$USE_NFT" = "1" ]; then
|
||||
tp_rule_nft
|
||||
else
|
||||
tp_rule_iptables
|
||||
fi
|
||||
return $?
|
||||
}
|
||||
|
||||
tp_rule_nft() {
|
||||
# Set up routing for TPROXY
|
||||
ip rule add fwmark 0x01/0x01 table 100
|
||||
ip route add local 0.0.0.0/0 dev lo table 100
|
||||
|
||||
# Create TPROXY chain in mangle table
|
||||
$NFT add table ip ss_spec_mangle 2>/dev/null
|
||||
$NFT add chain ip ss_spec_mangle ss_spec_tproxy { type filter hook prerouting priority mangle\; }
|
||||
|
||||
# Add basic return rules
|
||||
$NFT add rule ip ss_spec_mangle ss_spec_tproxy udp dport 53 return
|
||||
$NFT add rule ip ss_spec_mangle ss_spec_tproxy udp ip daddr 0.0.0.0/8 return
|
||||
$NFT add rule ip ss_spec_mangle ss_spec_tproxy udp ip daddr 10.0.0.0/8 return
|
||||
$NFT add rule ip ss_spec_mangle ss_spec_tproxy udp ip daddr 127.0.0.0/8 return
|
||||
$NFT add rule ip ss_spec_mangle ss_spec_tproxy udp ip daddr 169.254.0.0/16 return
|
||||
$NFT add rule ip ss_spec_mangle ss_spec_tproxy udp ip daddr 172.16.0.0/12 return
|
||||
$NFT add rule ip ss_spec_mangle ss_spec_tproxy udp ip daddr 192.168.0.0/16 return
|
||||
$NFT add rule ip ss_spec_mangle ss_spec_tproxy udp ip daddr 224.0.0.0/4 return
|
||||
$NFT add rule ip ss_spec_mangle ss_spec_tproxy udp ip daddr 240.0.0.0/4 return
|
||||
$NFT add rule ip ss_spec_mangle ss_spec_tproxy udp dport != 53 ip daddr $SERVER return
|
||||
|
||||
# Handle different UDP server
|
||||
if [ "$server" != "$SERVER" ]; then
|
||||
$NFT add element inet ss_spec whitelist { $SERVER }
|
||||
fi
|
||||
|
||||
# Access control rules
|
||||
$NFT add rule ip ss_spec_mangle ss_spec_tproxy udp ip saddr @bplan return
|
||||
if [ -n "$PROXY_PORTS" ]; then
|
||||
$NFT add rule ip ss_spec_mangle ss_spec_tproxy udp $PROXY_PORTS ip saddr @fplan tproxy to :$LOCAL_PORT meta mark set 0x01
|
||||
else
|
||||
$NFT add rule ip ss_spec_mangle ss_spec_tproxy udp ip saddr @fplan tproxy to :$LOCAL_PORT meta mark set 0x01
|
||||
fi
|
||||
|
||||
# Handle different run modes for nftables
|
||||
case "$RUNMODE" in
|
||||
router)
|
||||
$NFT add rule ip ss_spec_mangle ss_spec_tproxy udp ip daddr @ss_spec_wan_ac return
|
||||
$NFT add rule ip ss_spec_mangle ss_spec_tproxy udp ip daddr @china return
|
||||
$NFT add rule ip ss_spec_mangle ss_spec_tproxy udp dport 80 drop
|
||||
$NFT add rule ip ss_spec_mangle ss_spec_tproxy udp ip saddr @gmlan ip daddr != @china tproxy to :$LOCAL_PORT meta mark set 0x01
|
||||
if [ -n "$PROXY_PORTS" ]; then
|
||||
$NFT add rule ip ss_spec_mangle ss_spec_tproxy udp $PROXY_PORTS ip daddr != @ss_spec_wan_ac tproxy to :$LOCAL_PORT meta mark set 0x01
|
||||
else
|
||||
$NFT add rule ip ss_spec_mangle ss_spec_tproxy udp ip daddr != @ss_spec_wan_ac tproxy to :$LOCAL_PORT meta mark set 0x01
|
||||
fi
|
||||
;;
|
||||
gfw)
|
||||
$NFT add rule ip ss_spec_mangle ss_spec_tproxy udp ip daddr @china return
|
||||
$NFT add rule ip ss_spec_mangle ss_spec_tproxy udp dport 80 drop
|
||||
if [ -n "$PROXY_PORTS" ]; then
|
||||
$NFT add rule ip ss_spec_mangle ss_spec_tproxy udp $PROXY_PORTS ip daddr @gfwlist tproxy to :$LOCAL_PORT meta mark set 0x01
|
||||
fi
|
||||
$NFT add rule ip ss_spec_mangle ss_spec_tproxy udp ip saddr @gmlan ip daddr != @china tproxy to :$LOCAL_PORT meta mark set 0x01
|
||||
;;
|
||||
oversea)
|
||||
if [ -n "$PROXY_PORTS" ]; then
|
||||
$NFT add rule ip ss_spec_mangle ss_spec_tproxy udp $PROXY_PORTS ip saddr @oversea tproxy to :$LOCAL_PORT meta mark set 0x01
|
||||
$NFT add rule ip ss_spec_mangle ss_spec_tproxy udp $PROXY_PORTS ip daddr @china tproxy to :$LOCAL_PORT meta mark set 0x01
|
||||
fi
|
||||
$NFT add rule ip ss_spec_mangle ss_spec_tproxy udp ip saddr @gmlan tproxy to :$LOCAL_PORT meta mark set 0x01
|
||||
;;
|
||||
all)
|
||||
if [ -n "$PROXY_PORTS" ]; then
|
||||
$NFT add rule ip ss_spec_mangle ss_spec_tproxy udp $PROXY_PORTS tproxy to :$LOCAL_PORT meta mark set 0x01
|
||||
else
|
||||
$NFT add rule ip ss_spec_mangle ss_spec_tproxy udp tproxy to :$LOCAL_PORT meta mark set 0x01
|
||||
fi
|
||||
;;
|
||||
esac
|
||||
}
|
||||
|
||||
tp_rule_iptables() {
|
||||
ip rule add fwmark 0x01/0x01 table 100
|
||||
ip route add local 0.0.0.0/0 dev lo table 100
|
||||
local ipt="iptables -t mangle"
|
||||
$ipt -N SS_SPEC_TPROXY
|
||||
$ipt -A SS_SPEC_TPROXY -p udp --dport 53 -j RETURN
|
||||
$ipt -A SS_SPEC_TPROXY -p udp -d 0.0.0.0/8 -j RETURN
|
||||
$ipt -A SS_SPEC_TPROXY -p udp -d 10.0.0.0/8 -j RETURN
|
||||
$ipt -A SS_SPEC_TPROXY -p udp -d 127.0.0.0/8 -j RETURN
|
||||
$ipt -A SS_SPEC_TPROXY -p udp -d 169.254.0.0/16 -j RETURN
|
||||
$ipt -A SS_SPEC_TPROXY -p udp -d 172.16.0.0/12 -j RETURN
|
||||
$ipt -A SS_SPEC_TPROXY -p udp -d 192.168.0.0/16 -j RETURN
|
||||
$ipt -A SS_SPEC_TPROXY -p udp -d 224.0.0.0/4 -j RETURN
|
||||
$ipt -A SS_SPEC_TPROXY -p udp -d 240.0.0.0/4 -j RETURN
|
||||
$ipt -A SS_SPEC_TPROXY -p udp ! --dport 53 -d $SERVER -j RETURN
|
||||
[ "$server" != "$SERVER" ] && ipset -! add whitelist $SERVER
|
||||
$ipt -A SS_SPEC_TPROXY -p udp -m set --match-set bplan src -j RETURN
|
||||
$ipt -A SS_SPEC_TPROXY -p udp $PROXY_PORTS -m set --match-set fplan src -j TPROXY --on-port "$LOCAL_PORT" --tproxy-mark 0x01/0x01
|
||||
case "$RUNMODE" in
|
||||
router)
|
||||
$ipt -A SS_SPEC_TPROXY -p udp -m set --match-set ss_spec_wan_ac dst -j RETURN
|
||||
$ipt -A SS_SPEC_TPROXY -p udp -m set --match-set china dst -j RETURN
|
||||
$ipt -A SS_SPEC_TPROXY -p udp --dport 80 -j DROP
|
||||
$ipt -A SS_SPEC_TPROXY -p udp -m set --match-set gmlan src -m set ! --match-set china dst -j TPROXY --on-port "$LOCAL_PORT" --tproxy-mark 0x01/0x01
|
||||
$ipt -A SS_SPEC_TPROXY -p udp $PROXY_PORTS -m set ! --match-set ss_spec_wan_ac dst -j TPROXY --on-port "$LOCAL_PORT" --tproxy-mark 0x01/0x01
|
||||
;;
|
||||
gfw)
|
||||
$ipt -A SS_SPEC_TPROXY -p udp -m set --match-set china dst -j RETURN
|
||||
$ipt -A SS_SPEC_TPROXY -p udp --dport 80 -j DROP
|
||||
$ipt -A SS_SPEC_TPROXY -p udp $PROXY_PORTS -m set --match-set gfwlist dst -j TPROXY --on-port "$LOCAL_PORT" --tproxy-mark 0x01/0x01
|
||||
$ipt -A SS_SPEC_TPROXY -p udp -m set --match-set gmlan src -m set ! --match-set china dst -j TPROXY --on-port "$LOCAL_PORT" --tproxy-mark 0x01/0x01
|
||||
;;
|
||||
oversea)
|
||||
$ipt -A SS_SPEC_TPROXY -p udp $PROXY_PORTS -m set --match-set oversea src -m dst -j TPROXY --on-port "$LOCAL_PORT" --tproxy-mark 0x01/0x01
|
||||
$ipt -A SS_SPEC_TPROXY -p udp -m set --match-set gmlan src -m set -j TPROXY --on-port "$LOCAL_PORT" --tproxy-mark 0x01/0x01
|
||||
$ipt -A SS_SPEC_TPROXY -p udp $PROXY_PORTS -m set --match-set china dst -j TPROXY --on-port "$LOCAL_PORT" --tproxy-mark 0x01/0x01
|
||||
;;
|
||||
all)
|
||||
$ipt -A SS_SPEC_TPROXY -p udp $PROXY_PORTS -j TPROXY --on-port "$LOCAL_PORT" --tproxy-mark 0x01/0x01
|
||||
;;
|
||||
esac
|
||||
if [ -z "$Interface" ]; then
|
||||
$ipt -I PREROUTING 1 -p udp $EXT_ARGS $MATCH_SET -m comment --comment "$TAG" -j SS_SPEC_TPROXY
|
||||
else
|
||||
for name in $Interface; do
|
||||
local IFNAME=$(uci -P /var/state get network.$name.ifname 2>/dev/null)
|
||||
[ -z "$IFNAME" ] && IFNAME=$(uci -P /var/state get network.$name.device 2>/dev/null)
|
||||
[ -n "$IFNAME" ] && $ipt -I PREROUTING 1 ${IFNAME:+-i $IFNAME} -p udp $EXT_ARGS $MATCH_SET -m comment --comment "$TAG" -j SS_SPEC_TPROXY
|
||||
done
|
||||
fi
|
||||
return $?
|
||||
}
|
||||
|
||||
get_wan_ip() {
|
||||
cat <<-EOF | grep -E "^([0-9]{1,3}\.){3}[0-9]{1,3}"
|
||||
$server
|
||||
$SERVER
|
||||
$WAN_BP_IP
|
||||
EOF
|
||||
}
|
||||
|
||||
gen_spec_iplist() {
|
||||
cat <<-EOF
|
||||
0.0.0.0/8
|
||||
10.0.0.0/8
|
||||
100.64.0.0/10
|
||||
127.0.0.0/8
|
||||
169.254.0.0/16
|
||||
172.16.0.0/12
|
||||
192.0.0.0/24
|
||||
192.0.2.0/24
|
||||
192.88.99.0/24
|
||||
192.168.0.0/16
|
||||
198.18.0.0/15
|
||||
198.51.100.0/24
|
||||
203.0.113.0/24
|
||||
224.0.0.0/4
|
||||
240.0.0.0/4
|
||||
255.255.255.255
|
||||
$(get_wan_ip)
|
||||
EOF
|
||||
}
|
||||
|
||||
gen_include() {
|
||||
[ -n "$FWI" ] || return 0
|
||||
if [ "$USE_NFT" = "1" ]; then
|
||||
gen_include_nft
|
||||
else
|
||||
gen_include_iptables
|
||||
fi
|
||||
return $?
|
||||
}
|
||||
|
||||
gen_include_nft() {
|
||||
# Generate nftables include file for firewall4
|
||||
cat <<-EOF >>$FWI
|
||||
# Clear existing ss_spec tables
|
||||
nft delete table inet ss_spec 2>/dev/null
|
||||
nft delete table ip ss_spec 2>/dev/null
|
||||
nft delete table ip ss_spec_mangle 2>/dev/null
|
||||
|
||||
# Restore shadowsocks nftables rules
|
||||
$(nft list ruleset | grep -A 1000 "table inet ss_spec\|table ip ss_spec")
|
||||
EOF
|
||||
}
|
||||
|
||||
gen_include_iptables() {
|
||||
extract_rules() {
|
||||
echo "*$1"
|
||||
iptables-save -t $1 | grep SS_SPEC_ | sed -e "s/^-A \(OUTPUT\|PREROUTING\)/-I \1 1/"
|
||||
echo 'COMMIT'
|
||||
}
|
||||
cat <<-EOF >>$FWI
|
||||
iptables-save -c | grep -v "SS_SPEC" | iptables-restore -c
|
||||
iptables-restore -n <<-EOT
|
||||
$(extract_rules nat)
|
||||
$(extract_rules mangle)
|
||||
EOT
|
||||
EOF
|
||||
}
|
||||
|
||||
while getopts ":m:s:l:S:L:i:e:a:B:b:w:p:G:D:F:N:M:I:oOuUfgrczh" arg; do
|
||||
case "$arg" in
|
||||
m)
|
||||
Interface=$OPTARG
|
||||
;;
|
||||
s)
|
||||
server=$OPTARG
|
||||
;;
|
||||
l)
|
||||
local_port=$OPTARG
|
||||
;;
|
||||
S)
|
||||
SERVER=$OPTARG
|
||||
;;
|
||||
L)
|
||||
LOCAL_PORT=$OPTARG
|
||||
;;
|
||||
i)
|
||||
IGNORE_LIST=$OPTARG
|
||||
;;
|
||||
e)
|
||||
EXT_ARGS=$OPTARG
|
||||
;;
|
||||
a)
|
||||
LAN_AC_IP=$OPTARG
|
||||
;;
|
||||
B)
|
||||
LAN_BP_IP=$OPTARG
|
||||
;;
|
||||
b)
|
||||
WAN_BP_IP=$(for ip in $OPTARG; do echo $ip; done)
|
||||
;;
|
||||
w)
|
||||
WAN_FW_IP=$OPTARG
|
||||
;;
|
||||
p)
|
||||
LAN_FP_IP=$OPTARG
|
||||
;;
|
||||
G)
|
||||
LAN_GM_IP=$OPTARG
|
||||
;;
|
||||
D)
|
||||
PROXY_PORTS=$OPTARG
|
||||
;;
|
||||
F)
|
||||
SHUNT_PORT=$OPTARG
|
||||
;;
|
||||
N)
|
||||
SHUNT_IP=$OPTARG
|
||||
;;
|
||||
M)
|
||||
SHUNT_PROXY=$OPTARG
|
||||
;;
|
||||
I)
|
||||
SHUNT_LIST=$OPTARG
|
||||
;;
|
||||
o)
|
||||
OUTPUT=1
|
||||
;;
|
||||
O)
|
||||
OUTPUT=2
|
||||
;;
|
||||
u)
|
||||
TPROXY=1
|
||||
;;
|
||||
U)
|
||||
TPROXY=2
|
||||
;;
|
||||
g)
|
||||
RUNMODE=gfw
|
||||
;;
|
||||
r)
|
||||
RUNMODE=router
|
||||
;;
|
||||
c)
|
||||
RUNMODE=oversea
|
||||
;;
|
||||
z)
|
||||
RUNMODE=all
|
||||
;;
|
||||
f)
|
||||
flush_r
|
||||
exit 0
|
||||
;;
|
||||
h) usage 0 ;;
|
||||
esac
|
||||
done
|
||||
|
||||
if [ -z "$server" -o -z "$local_port" ]; then
|
||||
usage 2
|
||||
fi
|
||||
|
||||
case "$TPROXY" in
|
||||
1)
|
||||
SERVER=$server
|
||||
LOCAL_PORT=$local_port
|
||||
;;
|
||||
2)
|
||||
: ${SERVER:?"You must assign an ip for the udp relay server."}
|
||||
: ${LOCAL_PORT:?"You must assign a port for the udp relay server."}
|
||||
;;
|
||||
esac
|
||||
|
||||
flush_r && fw_rule && ipset_r && ac_rule && tp_rule && gen_include
|
||||
RET=$?
|
||||
[ "$RET" = 0 ] || loger 3 "Start failed!"
|
||||
exit $RET
|
||||
Reference in New Issue
Block a user