mirror of
https://github.com/bol-van/zapret.git
synced 2025-04-17 04:22:59 +03:00
sysv init calls : start-fw,stop-fw
This commit is contained in:
bolvan
parent
3b61dbc20f
commit
087c374959
@ -338,6 +338,10 @@ zapret_stop_daemons
|
||||
|
||||
Посмотрите init скрипт /opt/zapret/init.d/sysv/zapret и все поймете сами.
|
||||
|
||||
Есть вариант вызывать готовый скрипт по каким-то событиям :
|
||||
/opt/zapret/init.d/sysv/zapret start-fw
|
||||
/opt/zapret/init.d/sysv/zapret stop-fw
|
||||
|
||||
Пример установки на debian-подобную систему
|
||||
-------------------------------------------
|
||||
|
||||
|
||||
@ -78,7 +78,9 @@ dnat6_target()
|
||||
# get target ip address for DNAT. prefer link locals
|
||||
# tpws should be as inaccessible from outside as possible
|
||||
# link local address can appear not immediately after ifup
|
||||
[ -n "$DNAT6_TARGET" ] || {
|
||||
|
||||
# DNAT6_TARGET=- means attempt was made but address was not found (to avoid multiple re-attempts)
|
||||
[ "$DNAT6_TARGET" = '-' ] || {
|
||||
# no reason to query if its down
|
||||
network_is_up lan || return
|
||||
|
||||
@ -95,9 +97,13 @@ dnat6_target()
|
||||
sleep 1
|
||||
do :; done
|
||||
|
||||
[ -z "$DNAT6_TARGET" ] && {
|
||||
echo no link local. getting global
|
||||
DNAT6_TARGET=$(get_ipv6_global $DEVICE)
|
||||
[ -n "$DNAT6_TARGET" ] || {
|
||||
echo no link local. getting global
|
||||
DNAT6_TARGET=$(get_ipv6_global $DEVICE)
|
||||
[ -n "$DNAT6_TARGET" ] || {
|
||||
echo could not get any address
|
||||
DNAT6_TARGET=-
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@ -161,8 +167,10 @@ __fw_tpws6()
|
||||
done
|
||||
network_get_device DEVICE lan
|
||||
dnat6_target
|
||||
ipt6 PREROUTING -t nat -i $DEVICE $IPT_FILTER_HTTP -j DNAT --to [$DNAT6_TARGET]:$TPPORT_HTTP
|
||||
[ "$1" != "1" ] || ipt6 PREROUTING -t nat -i $DEVICE $IPT_FILTER_HTTPS -j DNAT --to [$DNAT6_TARGET]:$TPPORT_HTTPS
|
||||
[ "$DNAT6_TARGET" != '-' ] && {
|
||||
ipt6 PREROUTING -t nat -i $DEVICE $IPT_FILTER_HTTP -j DNAT --to [$DNAT6_TARGET]:$TPPORT_HTTP
|
||||
[ "$1" != "1" ] || ipt6 PREROUTING -t nat -i $DEVICE $IPT_FILTER_HTTPS -j DNAT --to [$DNAT6_TARGET]:$TPPORT_HTTPS
|
||||
}
|
||||
}
|
||||
fw_tpws6()
|
||||
{
|
||||
@ -177,6 +185,6 @@ fw_tpws_https6()
|
||||
|
||||
create_ipset()
|
||||
{
|
||||
echo "Creating ipset"
|
||||
"$IPSET_CR" $1
|
||||
echo "Creating ipset"
|
||||
"$IPSET_CR" $1
|
||||
}
|
||||
|
||||
@ -48,8 +48,8 @@ run_daemon()
|
||||
|
||||
run_tpws()
|
||||
{
|
||||
[ "$DISABLE_IPV4" != "1" ] && run_daemon $1 $TPWS "$TPWS_OPT_BASE $2"
|
||||
[ "$DISABLE_IPV6" != "1" ] && {
|
||||
[ "$DISABLE_IPV4" = "1" ] || run_daemon $1 $TPWS "$TPWS_OPT_BASE $2"
|
||||
[ "$DISABLE_IPV6" = "1" ] || {
|
||||
run_daemon $((60+$1)) $TPWS "$TPWS_OPT_BASE6 $2"
|
||||
network_get_device DEVICE lan
|
||||
[ -n "$DEVICE" ] && run_daemon $((660+$1)) $TPWS "$TPWS_OPT_BASE6_PRE --bind-iface6=$DEVICE $2"
|
||||
@ -57,8 +57,8 @@ run_tpws()
|
||||
}
|
||||
stop_tpws()
|
||||
{
|
||||
[ "$DISABLE_IPV4" != "1" ] && stop_daemon $1 $TPWS
|
||||
[ "$DISABLE_IPV6" != "1" ] && {
|
||||
[ "$DISABLE_IPV4" = "1" ] || stop_daemon $1 $TPWS
|
||||
[ "$DISABLE_IPV6" = "1" ] || {
|
||||
stop_daemon $((60+$1)) $TPWS
|
||||
stop_daemon $((660+$1)) $TPWS
|
||||
}
|
||||
|
||||
@ -103,8 +103,9 @@ dnat6_target()
|
||||
# get target ip address for DNAT. prefer link locals
|
||||
# tpws should be as inaccessible from outside as possible
|
||||
# link local address can appear not immediately after ifup
|
||||
[ -n "$DNAT6_TARGET" ] || {
|
||||
|
||||
|
||||
# DNAT6_TARGET=- means attempt was made but address was not found (to avoid multiple re-attempts)
|
||||
[ "$DNAT6_TARGET" = '-' ] || {
|
||||
local ct=0
|
||||
while
|
||||
DNAT6_TARGET=$(get_ipv6_linklocal $IFACE_LAN)
|
||||
@ -115,9 +116,13 @@ dnat6_target()
|
||||
sleep 1
|
||||
do :; done
|
||||
|
||||
[ -z "$DNAT6_TARGET" ] && {
|
||||
[ -n "$DNAT6_TARGET" ] || {
|
||||
echo no link local. getting global
|
||||
DNAT6_TARGET=$(get_ipv6_global $IFACE_LAN)
|
||||
[ -n "$DNAT6_TARGET" ] || {
|
||||
echo could not get any address
|
||||
DNAT6_TARGET=-
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@ -127,18 +132,18 @@ fw_tpws_add()
|
||||
# $1 - iptable filter for ipv4
|
||||
# $2 - iptable filter for ipv6
|
||||
# $3 - tpws port
|
||||
[ "$DISABLE_IPV4" != "1" ] && {
|
||||
[ "$DISABLE_IPV4" = "1" ] || {
|
||||
echo "Adding iptables rule for tpws : $1"
|
||||
[ -n "$IFACE_LAN" ] && {
|
||||
ipt PREROUTING -t nat $IPT_ILAN -p tcp $1 -j DNAT --to 127.0.0.1:$3
|
||||
}
|
||||
ipt OUTPUT -t nat $IPT_OWAN -m owner ! --uid-owner $TPWS_USER -p tcp $1 -j DNAT --to 127.0.0.1:$3
|
||||
}
|
||||
[ "$DISABLE_IPV6" != "1" ] && {
|
||||
[ "$DISABLE_IPV6" = "1" ] || {
|
||||
echo "Adding ip6tables rule for tpws : $2"
|
||||
[ -n "$IFACE_LAN" ] && {
|
||||
dnat6_target
|
||||
ipt6 PREROUTING -t nat $IPT_ILAN -p tcp $2 -j DNAT --to [$DNAT6_TARGET]:$3
|
||||
[ "$DNAT6_TARGET" != '-' ] && ipt6 PREROUTING -t nat $IPT_ILAN -p tcp $2 -j DNAT --to [$DNAT6_TARGET]:$3
|
||||
}
|
||||
ipt6 OUTPUT -t nat $IPT_OWAN -m owner ! --uid-owner $TPWS_USER -p tcp $2 -j DNAT --to [::1]:$3
|
||||
}
|
||||
@ -148,18 +153,18 @@ fw_tpws_del()
|
||||
# $1 - iptable filter for ipv4
|
||||
# $2 - iptable filter for ipv6
|
||||
# $3 - tpws port
|
||||
[ "$DISABLE_IPV4" != "1" ] && {
|
||||
[ "$DISABLE_IPV4" = "1" ] || {
|
||||
echo "Deleting iptables rule for tpws : $1"
|
||||
[ -n "$IFACE_LAN" ] && {
|
||||
ipt_del PREROUTING -t nat $IPT_ILAN -p tcp $1 -j DNAT --to 127.0.0.1:$3
|
||||
}
|
||||
ipt_del OUTPUT -t nat $IPT_OWAN -m owner ! --uid-owner $TPWS_USER -p tcp $1 -j DNAT --to 127.0.0.1:$3
|
||||
}
|
||||
[ "$DISABLE_IPV6" != "1" ] && {
|
||||
[ "$DISABLE_IPV6" = "1" ] || {
|
||||
echo "Deleting ip6tables rule for tpws : $2"
|
||||
[ -n "$IFACE_LAN" ] && {
|
||||
dnat6_target
|
||||
ipt6_del PREROUTING -t nat $IPT_ILAN -p tcp $2 -j DNAT --to [$DNAT6_TARGET]:$3
|
||||
[ "$DNAT6_TARGET" != '-' ] && ipt6_del PREROUTING -t nat $IPT_ILAN -p tcp $2 -j DNAT --to [$DNAT6_TARGET]:$3
|
||||
}
|
||||
ipt6_del OUTPUT -t nat $IPT_OWAN -m owner ! --uid-owner $TPWS_USER -p tcp $2 -j DNAT --to [::1]:$3
|
||||
}
|
||||
@ -169,11 +174,11 @@ fw_nfqws_add_pre()
|
||||
{
|
||||
# $1 - iptable filter for ipv4
|
||||
# $2 - iptable filter for ipv6
|
||||
[ "$DISABLE_IPV4" != "1" ] && {
|
||||
[ "$DISABLE_IPV4" = "1" ] || {
|
||||
echo "Adding iptables rule for nfqws prerouting : $1"
|
||||
ipt PREROUTING -t raw $IPT_IWAN -p tcp --tcp-flags SYN,ACK SYN,ACK $1 -j NFQUEUE --queue-num $QNUM --queue-bypass
|
||||
}
|
||||
[ "$DISABLE_IPV6" != "1" ] && {
|
||||
[ "$DISABLE_IPV6" = "1" ] || {
|
||||
echo "Adding ip6tables rule for nfqws prerouting : $2"
|
||||
ipt6 PREROUTING -t raw $IPT_IWAN -p tcp --tcp-flags SYN,ACK SYN,ACK $2 -j NFQUEUE --queue-num $QNUM --queue-bypass
|
||||
}
|
||||
@ -182,11 +187,11 @@ fw_nfqws_del_pre()
|
||||
{
|
||||
# $1 - iptable filter for ipv4
|
||||
# $2 - iptable filter for ipv6
|
||||
[ "$DISABLE_IPV4" != "1" ] && {
|
||||
[ "$DISABLE_IPV4" = "1" ] || {
|
||||
echo "Deleting iptables rule for nfqws prerouting : $1"
|
||||
ipt_del PREROUTING -t raw $IPT_IWAN -p tcp --tcp-flags SYN,ACK SYN,ACK $1 -j NFQUEUE --queue-num $QNUM --queue-bypass
|
||||
}
|
||||
[ "$DISABLE_IPV6" != "1" ] && {
|
||||
[ "$DISABLE_IPV6" = "1" ] || {
|
||||
echo "Deleting ip6tables rule for nfqws prerouting : $2"
|
||||
ipt6_del PREROUTING -t raw $IPT_IWAN -p tcp --tcp-flags SYN,ACK SYN,ACK $2 -j NFQUEUE --queue-num $QNUM --queue-bypass
|
||||
}
|
||||
@ -195,11 +200,11 @@ fw_nfqws_add_post()
|
||||
{
|
||||
# $1 - iptable filter for ipv4
|
||||
# $2 - iptable filter for ipv6
|
||||
[ "$DISABLE_IPV4" != "1" ] && {
|
||||
[ "$DISABLE_IPV4" = "1" ] || {
|
||||
echo "Adding iptables rule for nfqws postrouting : $1"
|
||||
ipt POSTROUTING -t mangle $IPT_OWAN -p tcp $1 -j NFQUEUE --queue-num $QNUM --queue-bypass
|
||||
}
|
||||
[ "$DISABLE_IPV6" != "1" ] && {
|
||||
[ "$DISABLE_IPV6" = "1" ] || {
|
||||
echo "Adding ip6tables rule for nfqws postrouting : $2"
|
||||
ipt6 POSTROUTING -t mangle $IPT_OWAN -p tcp $2 -j NFQUEUE --queue-num $QNUM --queue-bypass
|
||||
}
|
||||
@ -208,11 +213,11 @@ fw_nfqws_del_post()
|
||||
{
|
||||
# $1 - iptable filter for ipv4
|
||||
# $2 - iptable filter for ipv6
|
||||
[ "$DISABLE_IPV4" != "1" ] && {
|
||||
[ "$DISABLE_IPV4" = "1" ] || {
|
||||
echo "Deleting iptables rule for nfqws postrouting : $1"
|
||||
ipt_del POSTROUTING -t mangle $IPT_OWAN -p tcp $1 -j NFQUEUE --queue-num $QNUM --queue-bypass
|
||||
}
|
||||
[ "$DISABLE_IPV6" != "1" ] && {
|
||||
[ "$DISABLE_IPV6" = "1" ] || {
|
||||
echo "Deleting ip6tables rule for nfqws postrouting : $2"
|
||||
ipt6_del POSTROUTING -t mangle $IPT_OWAN -p tcp $2 -j NFQUEUE --queue-num $QNUM --queue-bypass
|
||||
}
|
||||
@ -280,16 +285,16 @@ prepare_tpws()
|
||||
run_tpws()
|
||||
{
|
||||
prepare_tpws
|
||||
[ "$DISABLE_IPV4" != "1" ] && run_daemon $1 $TPWS "$TPWS_OPT_BASE $2"
|
||||
[ "$DISABLE_IPV6" != "1" ] && {
|
||||
[ "$DISABLE_IPV4" = "1" ] || run_daemon $1 $TPWS "$TPWS_OPT_BASE $2"
|
||||
[ "$DISABLE_IPV6" = "1" ] || {
|
||||
run_daemon $((60+$1)) $TPWS "$TPWS_OPT_BASE6 $2"
|
||||
[ -n "$IFACE_LAN" ] && run_daemon $((660+$1)) $TPWS "$TPWS_OPT_BASE6_PRE --bind-iface6=$IFACE_LAN $2"
|
||||
}
|
||||
}
|
||||
stop_tpws()
|
||||
{
|
||||
[ "$DISABLE_IPV4" != "1" ] && stop_daemon $1 $TPWS
|
||||
[ "$DISABLE_IPV6" != "1" ] && {
|
||||
[ "$DISABLE_IPV4" = "1" ] || stop_daemon $1 $TPWS
|
||||
[ "$DISABLE_IPV6" = "1" ] || {
|
||||
stop_daemon $((60+$1)) $TPWS
|
||||
[ -n "$IFACE_LAN" ] && stop_daemon $((660+$1)) $TPWS
|
||||
}
|
||||
|
||||
@ -14,19 +14,26 @@ NAME=zapret
|
||||
DESC=anti-zapret
|
||||
|
||||
case "$1" in
|
||||
start)
|
||||
zapret_run_daemons
|
||||
[ "$INIT_APPLY_FW" = "1" ] && zapret_apply_firewall
|
||||
;;
|
||||
start)
|
||||
zapret_run_daemons
|
||||
[ "$INIT_APPLY_FW" != "1" ] || zapret_apply_firewall
|
||||
;;
|
||||
|
||||
stop)
|
||||
zapret_stop_daemons
|
||||
[ "$INIT_APPLY_FW" = "1" ] && zapret_unapply_firewall
|
||||
;;
|
||||
stop)
|
||||
zapret_stop_daemons
|
||||
[ "$INIT_APPLY_FW" != "1" ] || zapret_unapply_firewall
|
||||
;;
|
||||
|
||||
start-fw)
|
||||
zapret_apply_firewall
|
||||
;;
|
||||
stop-fw)
|
||||
zapret_unapply_firewall
|
||||
;;
|
||||
|
||||
*)
|
||||
N=/etc/init.d/$NAME
|
||||
echo "Usage: $N {start|stop}" >&2
|
||||
echo "Usage: $N {start|stop|start-fw|stop-fw}" >&2
|
||||
exit 1
|
||||
;;
|
||||
esac
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user