drygdryg/zapret
1
0
Fork 0
mirror of https://github.com/bol-van/zapret.git synced 2025-05-24 22:32:58 +03:00
Code Issues Packages Projects Releases Wiki Activity

sysv init calls : start-fw,stop-fw

Browse Source
This commit is contained in:
bolvan
2019-05-14 23:14:14 +03:00
parent 3b61dbc20f
commit 087c374959
5 changed files with 66 additions and 42 deletions
Download Patch File Download Diff File Expand all files Collapse all files

47
init.d/sysv/functions
View File

@@ -103,8 +103,9 @@ dnat6_target()
# get target ip address for DNAT. prefer link locals
# tpws should be as inaccessible from outside as possible
# link local address can appear not immediately after ifup
[ -n "$DNAT6_TARGET" ] || {
# DNAT6_TARGET=- means attempt was made but address was not found (to avoid multiple re-attempts)
[ "$DNAT6_TARGET" = '-' ] || {
local ct=0
while
DNAT6_TARGET=$(get_ipv6_linklocal $IFACE_LAN)
@@ -115,9 +116,13 @@ dnat6_target()
sleep 1
do :; done
[ -z "$DNAT6_TARGET" ] && {
[ -n "$DNAT6_TARGET" ] || {
echo no link local. getting global
DNAT6_TARGET=$(get_ipv6_global $IFACE_LAN)
[ -n "$DNAT6_TARGET" ] || {
echo could not get any address
DNAT6_TARGET=-
}
}
}
}
@@ -127,18 +132,18 @@ fw_tpws_add()
# $1 - iptable filter for ipv4
# $2 - iptable filter for ipv6
# $3 - tpws port
[ "$DISABLE_IPV4" != "1" ] && {
[ "$DISABLE_IPV4" = "1" ] || {
echo "Adding iptables rule for tpws : $1"
[ -n "$IFACE_LAN" ] && {
ipt PREROUTING -t nat $IPT_ILAN -p tcp $1 -j DNAT --to 127.0.0.1:$3
}
ipt OUTPUT -t nat $IPT_OWAN -m owner ! --uid-owner $TPWS_USER -p tcp $1 -j DNAT --to 127.0.0.1:$3
}
[ "$DISABLE_IPV6" != "1" ] && {
[ "$DISABLE_IPV6" = "1" ] || {
echo "Adding ip6tables rule for tpws : $2"
[ -n "$IFACE_LAN" ] && {
dnat6_target
ipt6 PREROUTING -t nat $IPT_ILAN -p tcp $2 -j DNAT --to [$DNAT6_TARGET]:$3
[ "$DNAT6_TARGET" != '-' ] && ipt6 PREROUTING -t nat $IPT_ILAN -p tcp $2 -j DNAT --to [$DNAT6_TARGET]:$3
}
ipt6 OUTPUT -t nat $IPT_OWAN -m owner ! --uid-owner $TPWS_USER -p tcp $2 -j DNAT --to [::1]:$3
}
@@ -148,18 +153,18 @@ fw_tpws_del()
# $1 - iptable filter for ipv4
# $2 - iptable filter for ipv6
# $3 - tpws port
[ "$DISABLE_IPV4" != "1" ] && {
[ "$DISABLE_IPV4" = "1" ] || {
echo "Deleting iptables rule for tpws : $1"
[ -n "$IFACE_LAN" ] && {
ipt_del PREROUTING -t nat $IPT_ILAN -p tcp $1 -j DNAT --to 127.0.0.1:$3
}
ipt_del OUTPUT -t nat $IPT_OWAN -m owner ! --uid-owner $TPWS_USER -p tcp $1 -j DNAT --to 127.0.0.1:$3
}
[ "$DISABLE_IPV6" != "1" ] && {
[ "$DISABLE_IPV6" = "1" ] || {
echo "Deleting ip6tables rule for tpws : $2"
[ -n "$IFACE_LAN" ] && {
dnat6_target
ipt6_del PREROUTING -t nat $IPT_ILAN -p tcp $2 -j DNAT --to [$DNAT6_TARGET]:$3
[ "$DNAT6_TARGET" != '-' ] && ipt6_del PREROUTING -t nat $IPT_ILAN -p tcp $2 -j DNAT --to [$DNAT6_TARGET]:$3
}
ipt6_del OUTPUT -t nat $IPT_OWAN -m owner ! --uid-owner $TPWS_USER -p tcp $2 -j DNAT --to [::1]:$3
}
@@ -169,11 +174,11 @@ fw_nfqws_add_pre()
{
# $1 - iptable filter for ipv4
# $2 - iptable filter for ipv6
[ "$DISABLE_IPV4" != "1" ] && {
[ "$DISABLE_IPV4" = "1" ] || {
echo "Adding iptables rule for nfqws prerouting : $1"
ipt PREROUTING -t raw $IPT_IWAN -p tcp --tcp-flags SYN,ACK SYN,ACK $1 -j NFQUEUE --queue-num $QNUM --queue-bypass
}
[ "$DISABLE_IPV6" != "1" ] && {
[ "$DISABLE_IPV6" = "1" ] || {
echo "Adding ip6tables rule for nfqws prerouting : $2"
ipt6 PREROUTING -t raw $IPT_IWAN -p tcp --tcp-flags SYN,ACK SYN,ACK $2 -j NFQUEUE --queue-num $QNUM --queue-bypass
}
@@ -182,11 +187,11 @@ fw_nfqws_del_pre()
{
# $1 - iptable filter for ipv4
# $2 - iptable filter for ipv6
[ "$DISABLE_IPV4" != "1" ] && {
[ "$DISABLE_IPV4" = "1" ] || {
echo "Deleting iptables rule for nfqws prerouting : $1"
ipt_del PREROUTING -t raw $IPT_IWAN -p tcp --tcp-flags SYN,ACK SYN,ACK $1 -j NFQUEUE --queue-num $QNUM --queue-bypass
}
[ "$DISABLE_IPV6" != "1" ] && {
[ "$DISABLE_IPV6" = "1" ] || {
echo "Deleting ip6tables rule for nfqws prerouting : $2"
ipt6_del PREROUTING -t raw $IPT_IWAN -p tcp --tcp-flags SYN,ACK SYN,ACK $2 -j NFQUEUE --queue-num $QNUM --queue-bypass
}
@@ -195,11 +200,11 @@ fw_nfqws_add_post()
{
# $1 - iptable filter for ipv4
# $2 - iptable filter for ipv6
[ "$DISABLE_IPV4" != "1" ] && {
[ "$DISABLE_IPV4" = "1" ] || {
echo "Adding iptables rule for nfqws postrouting : $1"
ipt POSTROUTING -t mangle $IPT_OWAN -p tcp $1 -j NFQUEUE --queue-num $QNUM --queue-bypass
}
[ "$DISABLE_IPV6" != "1" ] && {
[ "$DISABLE_IPV6" = "1" ] || {
echo "Adding ip6tables rule for nfqws postrouting : $2"
ipt6 POSTROUTING -t mangle $IPT_OWAN -p tcp $2 -j NFQUEUE --queue-num $QNUM --queue-bypass
}
@@ -208,11 +213,11 @@ fw_nfqws_del_post()
{
# $1 - iptable filter for ipv4
# $2 - iptable filter for ipv6
[ "$DISABLE_IPV4" != "1" ] && {
[ "$DISABLE_IPV4" = "1" ] || {
echo "Deleting iptables rule for nfqws postrouting : $1"
ipt_del POSTROUTING -t mangle $IPT_OWAN -p tcp $1 -j NFQUEUE --queue-num $QNUM --queue-bypass
}
[ "$DISABLE_IPV6" != "1" ] && {
[ "$DISABLE_IPV6" = "1" ] || {
echo "Deleting ip6tables rule for nfqws postrouting : $2"
ipt6_del POSTROUTING -t mangle $IPT_OWAN -p tcp $2 -j NFQUEUE --queue-num $QNUM --queue-bypass
}
@@ -280,16 +285,16 @@ prepare_tpws()
run_tpws()
{
prepare_tpws
[ "$DISABLE_IPV4" != "1" ] && run_daemon $1 $TPWS "$TPWS_OPT_BASE $2"
[ "$DISABLE_IPV6" != "1" ] && {
[ "$DISABLE_IPV4" = "1" ] || run_daemon $1 $TPWS "$TPWS_OPT_BASE $2"
[ "$DISABLE_IPV6" = "1" ] || {
run_daemon $((60+$1)) $TPWS "$TPWS_OPT_BASE6 $2"
[ -n "$IFACE_LAN" ] && run_daemon $((660+$1)) $TPWS "$TPWS_OPT_BASE6_PRE --bind-iface6=$IFACE_LAN $2"
}
}
stop_tpws()
{
[ "$DISABLE_IPV4" != "1" ] && stop_daemon $1 $TPWS
[ "$DISABLE_IPV6" != "1" ] && {
[ "$DISABLE_IPV4" = "1" ] || stop_daemon $1 $TPWS
[ "$DISABLE_IPV6" = "1" ] || {
stop_daemon $((60+$1)) $TPWS
[ -n "$IFACE_LAN" ] && stop_daemon $((660+$1)) $TPWS
}