drygdryg/zapret
1
0
Fork 0
mirror of https://github.com/bol-van/zapret.git synced 2025-04-19 05:22:58 +03:00
Code Issues Packages Projects Releases Wiki Activity

openwrt : move to the single firewall include

Browse Source
This commit is contained in:
bolvan 2019-05-16 13:35:07 +03:00
parent a8aeee6f2e
commit 80d42f5d44
25 changed files with 138 additions and 230 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

24
docs/readme.txt
View File

@ -616,11 +616,8 @@ ipset можно выкинуть, если не будем пользовать
может быть критично, они не запустятся после перезагрузки.
Cкрипт из /etc/hotplug.d/iface запустит недостающие службы при поднятии интерфейса lan.
Если не включен параметр DISABLE_IPV4 :
В зависимости от выбранного в файле config MODE создать ссылку на нужный файл настроек фаервола :
ln -fs /opt/zapret/init.d/openwrt/firewall.zapret.$MODE /etc/firewall.zapret
Например :
ln -fs /opt/zapret/init.d/openwrt/firewall.zapret.tpws_ipset_https /etc/firewall.zapret
Создать ссылку на firewall include :
ln -fs /opt/zapret/init.d/openwrt/firewall.zapret /etc/firewall.zapret
Проверить была ли создана ранее запись о firewall include :
uci show firewall | grep firewall.zapret
Если firewall.zapret нет, значит добавить :
@ -631,21 +628,6 @@ Cкрипт из /etc/hotplug.d/iface запустит недостающие с
Перезапустить фаервол :
fw3 restart
Если не включен параметр DISABLE_IPV6 :
В зависимости от выбранного в файле config MODE создать ссылку на нужный файл настроек фаервола :
ln -fs /opt/zapret/init.d/openwrt/firewall.zapret.${MODE}6 /etc/firewall.zapret6
Например :
ln -fs /opt/zapret/init.d/openwrt/firewall.zapret.tpws_ipset_https6 /etc/firewall.zapret6
Проверить была ли создана ранее запись о firewall include :
uci show firewall | grep firewall.zapret6
Если firewall.zapret6 нет, значит добавить :
uci add firewall include
uci set firewall.@include[-1].path="/etc/firewall.zapret6"
uci set firewall.@include[-1].reload="1"
uci commit firewall
Перезапустить фаервол :
fw3 restart
Посмотреть через iptables -nL, ip6tables -nL или через luci вкладку "firewall" появились ли нужные правила.
ЭКОНОМИЯ МЕСТА : если его мало, то можно оставить в директории zapret лишь подкаталог ipset, файл config и init.d/openwrt.
@ -656,7 +638,7 @@ Cкрипт из /etc/hotplug.d/iface запустит недостающие с
ЕСЛИ ВСЕ ПЛОХО С МЕСТОМ : откажитесь от работы со списком РКН. используйте только get_user.sh
ЕСЛИ СОВСЕМ ВСЕ УЖАСНО С МЕСТОМ : не надо устанавливать дополнительные пакеты через opkg.
оставьте лишь /opt/zapret/tpws/tpws, /opt/zapret/config, /etc/init.d/zapret, /etc/firewall.zapret
оставьте лишь /opt/zapret/tpws/tpws, /opt/zapret/config, /opt/zapret/init.d/openwrt
используйте MODE=tpws_all или tpws_all_https
такой вариант потребует около 100 кб места и полностью статичен.
отсутствуют любые загрузки, обновления, изменения файлов.

3
init.d/openwrt/firewall.zapret.ipset → init.d/openwrt/firewall.zapret
View File

@ -1,4 +1,3 @@
. /opt/zapret/init.d/openwrt/functions
create_ipset no-update
zapret_apply_firewall

1
init.d/openwrt/firewall.zapret.ipset6
View File

@ -1 +0,0 @@
firewall.zapret.ipset

6
init.d/openwrt/firewall.zapret.nfqws_all
View File

@ -1,6 +0,0 @@
IPT_FILTER_PRE="-p tcp --tcp-flags SYN,ACK SYN,ACK --sport 80"
IPT_FILTER_POST="-p tcp --dport 80"
. /opt/zapret/init.d/openwrt/functions
fw_nfqws

6
init.d/openwrt/firewall.zapret.nfqws_all6
View File

@ -1,6 +0,0 @@
IPT_FILTER_PRE="-p tcp --tcp-flags SYN,ACK SYN,ACK --sport 80"
IPT_FILTER_POST="-p tcp --dport 80"
. /opt/zapret/init.d/openwrt/functions
fw_nfqws6

6
init.d/openwrt/firewall.zapret.nfqws_all_https
View File

@ -1,6 +0,0 @@
IPT_FILTER_PRE="-p tcp --tcp-flags SYN,ACK SYN,ACK -m multiport --sports 80,443"
IPT_FILTER_POST="-p tcp --dport 80"
. /opt/zapret/init.d/openwrt/functions
fw_nfqws

6
init.d/openwrt/firewall.zapret.nfqws_all_https6
View File

@ -1,6 +0,0 @@
IPT_FILTER_PRE="-p tcp --tcp-flags SYN,ACK SYN,ACK -m multiport --sports 80,443"
IPT_FILTER_POST="-p tcp --dport 80"
. /opt/zapret/init.d/openwrt/functions
fw_nfqws6

7
init.d/openwrt/firewall.zapret.nfqws_ipset
View File

@ -1,7 +0,0 @@
IPT_FILTER_PRE="-p tcp --tcp-flags SYN,ACK SYN,ACK --sport 80 -m set --match-set zapret src"
IPT_FILTER_POST="-p tcp --dport 80 -m set --match-set zapret dst"
. /opt/zapret/init.d/openwrt/functions
create_ipset no-update
fw_nfqws

7
init.d/openwrt/firewall.zapret.nfqws_ipset6
View File

@ -1,7 +0,0 @@
IPT_FILTER_PRE="-p tcp --tcp-flags SYN,ACK SYN,ACK --sport 80 -m set --match-set zapret6 src"
IPT_FILTER_POST="-p tcp --dport 80 -m set --match-set zapret6 dst"
. /opt/zapret/init.d/openwrt/functions
create_ipset no-update
fw_nfqws6

7
init.d/openwrt/firewall.zapret.nfqws_ipset_https
View File

@ -1,7 +0,0 @@
IPT_FILTER_PRE="-p tcp --tcp-flags SYN,ACK SYN,ACK -m multiport --sports 80,443 -m set --match-set zapret src"
IPT_FILTER_POST="-p tcp --dport 80 -m set --match-set zapret dst"
. /opt/zapret/init.d/openwrt/functions
create_ipset no-update
fw_nfqws

7
init.d/openwrt/firewall.zapret.nfqws_ipset_https6
View File

@ -1,7 +0,0 @@
IPT_FILTER_PRE="-p tcp --tcp-flags SYN,ACK SYN,ACK -m multiport --sports 80,443 -m set --match-set zapret6 src"
IPT_FILTER_POST="-p tcp --dport 80 -m set --match-set zapret6 dst"
. /opt/zapret/init.d/openwrt/functions
create_ipset no-update
fw_nfqws6

5
init.d/openwrt/firewall.zapret.tpws_all
View File

@ -1,5 +0,0 @@
IPT_FILTER_HTTP="-p tcp --dport 80"
. /opt/zapret/init.d/openwrt/functions
fw_tpws

5
init.d/openwrt/firewall.zapret.tpws_all6
View File

@ -1,5 +0,0 @@
IPT_FILTER_HTTP="-p tcp --dport 80"
. /opt/zapret/init.d/openwrt/functions
fw_tpws6

6
init.d/openwrt/firewall.zapret.tpws_all_https
View File

@ -1,6 +0,0 @@
IPT_FILTER_HTTP="-p tcp --dport 80"
IPT_FILTER_HTTPS="-p tcp --dport 443"
. /opt/zapret/init.d/openwrt/functions
fw_tpws_https

6
init.d/openwrt/firewall.zapret.tpws_all_https6
View File

@ -1,6 +0,0 @@
IPT_FILTER_HTTP="-p tcp --dport 80"
IPT_FILTER_HTTPS="-p tcp --dport 443"
. /opt/zapret/init.d/openwrt/functions
fw_tpws_https6

1
init.d/openwrt/firewall.zapret.tpws_hostlist
View File

@ -1 +0,0 @@
firewall.zapret.tpws_all

1
init.d/openwrt/firewall.zapret.tpws_hostlist6
View File

@ -1 +0,0 @@
firewall.zapret.tpws_all6

6
init.d/openwrt/firewall.zapret.tpws_ipset
View File

@ -1,6 +0,0 @@
IPT_FILTER_HTTP="-p tcp --dport 80 -m set --match-set zapret dst"
. /opt/zapret/init.d/openwrt/functions
create_ipset no-update
fw_tpws

6
init.d/openwrt/firewall.zapret.tpws_ipset6
View File

@ -1,6 +0,0 @@
IPT_FILTER_HTTP="-p tcp --dport 80 -m set --match-set zapret6 dst"
. /opt/zapret/init.d/openwrt/functions
create_ipset no-update
fw_tpws6

7
init.d/openwrt/firewall.zapret.tpws_ipset_https
View File

@ -1,7 +0,0 @@
IPT_FILTER_HTTP="-p tcp --dport 80 -m set --match-set zapret dst"
IPT_FILTER_HTTPS="-p tcp --dport 443 -m set --match-set zapret dst"
. /opt/zapret/init.d/openwrt/functions
create_ipset no-update
fw_tpws_https

7
init.d/openwrt/firewall.zapret.tpws_ipset_https6
View File

@ -1,7 +0,0 @@
IPT_FILTER_HTTP="-p tcp --dport 80 -m set --match-set zapret6 dst"
IPT_FILTER_HTTPS="-p tcp --dport 443 -m set --match-set zapret6 dst"
. /opt/zapret/init.d/openwrt/functions
create_ipset no-update
fw_tpws_https6

147
init.d/openwrt/functions
View File

@ -82,6 +82,7 @@ dnat6_target()
# link local address can appear not immediately after ifup
# DNAT6_TARGET=- means attempt was made but address was not found (to avoid multiple re-attempts)
[ -n "$DNAT6_TARGET" ] || {
# no reason to query if its down
network_is_up lan || return
@ -111,86 +112,138 @@ dnat6_target()
}
fw_nfqws()
fw_nfqws_pre()
{
[ "$DISABLE_IPV4" = "1" ] && return
# $1 - filter ipv4
# $2 - filter ipv6
local DEVICE wan_iface
[ "$DISABLE_IPV4" = "1" ] || {
network_find_wan_all wan_iface
for ext_iface in $wan_iface; do
network_get_device DEVICE $ext_iface
ipt POSTROUTING -t mangle -o $DEVICE $IPT_FILTER_POST -j NFQUEUE --queue-num $QNUM --queue-bypass
ipt PREROUTING -t raw -i $DEVICE $IPT_FILTER_PRE -j NFQUEUE --queue-num $QNUM --queue-bypass
ipt PREROUTING -t raw -i $DEVICE -p tcp $1 -j NFQUEUE --queue-num $QNUM --queue-bypass
done
}
fw_nfqws6()
{
[ "$DISABLE_IPV6" = "1" ] && return
local DEVICE wan_iface
[ "$DISABLE_IPV6" = "1" ] || {
network_find_wan6_all wan_iface
for ext_iface in $wan_iface; do
network_get_device DEVICE $ext_iface
ipt6 POSTROUTING -t mangle -o $DEVICE $IPT_FILTER_POST -j NFQUEUE --queue-num $QNUM --queue-bypass
ipt6 PREROUTING -t raw -i $DEVICE $IPT_FILTER_PRE -j NFQUEUE --queue-num $QNUM --queue-bypass
ipt6 PREROUTING -t raw -i $DEVICE -p tcp $2 -j NFQUEUE --queue-num $QNUM --queue-bypass
done
}
}
fw_nfqws_post()
{
# $1 - filter ipv4
# $2 - filter ipv6
local DEVICE wan_iface
[ "$DISABLE_IPV4" = "1" ] || {
network_find_wan_all wan_iface
for ext_iface in $wan_iface; do
network_get_device DEVICE $ext_iface
ipt POSTROUTING -t mangle -o $DEVICE -p tcp $1 -j NFQUEUE --queue-num $QNUM --queue-bypass
done
}
[ "$DISABLE_IPV6" = "1" ] || {
network_find_wan6_all wan_iface
for ext_iface in $wan_iface; do
network_get_device DEVICE $ext_iface
ipt6 POSTROUTING -t mangle -o $DEVICE -p tcp $2 -j NFQUEUE --queue-num $QNUM --queue-bypass
done
}
}
IPT_OWNER="-m owner ! --uid-owner $TPWS_USER"
__fw_tpws()
fw_tpws()
{
# $1 - use https
[ "$DISABLE_IPV4" = "1" ] && return
# $1 - filter ipv4
# $2 - filter ipv6
# $3 - tpws port
local DEVICE wan_iface
[ "$DISABLE_IPV4" = "1" ] || {
network_find_wan_all wan_iface
for ext_iface in $wan_iface; do
network_get_device DEVICE $ext_iface
ipt OUTPUT -t nat -o $DEVICE $IPT_OWNER $IPT_FILTER_HTTP -j DNAT --to 127.0.0.1:$TPPORT_HTTP
[ "$1" != "1" ] || ipt OUTPUT -t nat -o $DEVICE $IPT_OWNER $IPT_FILTER_HTTPS -j DNAT --to 127.0.0.1:$TPPORT_HTTPS
ipt OUTPUT -t nat -o $DEVICE $IPT_OWNER -p tcp $1 -j DNAT --to 127.0.0.1:$3
done
ipt prerouting_lan_rule -t nat -p tcp $1 -j DNAT --to 127.0.0.1:$3
network_get_device DEVICE lan
sysctl -w net.ipv4.conf.$DEVICE.route_localnet=1
ipt prerouting_lan_rule -t nat $IPT_FILTER_HTTP -j DNAT --to 127.0.0.1:$TPPORT_HTTP
[ "$1" != "1" ] || ipt prerouting_lan_rule -t nat $IPT_FILTER_HTTPS -j DNAT --to 127.0.0.1:$TPPORT_HTTPS
sysctl -qw net.ipv4.conf.$DEVICE.route_localnet=1
}
fw_tpws()
{
__fw_tpws 0
}
fw_tpws_https()
{
__fw_tpws 1
}
__fw_tpws6()
{
# $1 - use https
[ "$DISABLE_IPV6" = "1" ] && return
local DEVICE wan_iface ip6
[ "$DISABLE_IPV6" = "1" ] || {
network_find_wan6_all wan_iface
for ext_iface in $wan_iface; do
network_get_device DEVICE $ext_iface
ipt6 OUTPUT -t nat -o $DEVICE $IPT_OWNER $IPT_FILTER_HTTP -j DNAT --to [::1]:$TPPORT_HTTP
[ "$1" != "1" ] || ipt6 OUTPUT -t nat -o $DEVICE $IPT_OWNER $IPT_FILTER_HTTPS -j DNAT --to [::1]:$TPPORT_HTTPS
ipt6 OUTPUT -t nat -o $DEVICE $IPT_OWNER -p tcp $2 -j DNAT --to [::1]:$3
done
network_get_device DEVICE lan
dnat6_target
[ "$DNAT6_TARGET" != "-" ] && {
ipt6 PREROUTING -t nat -i $DEVICE $IPT_FILTER_HTTP -j DNAT --to [$DNAT6_TARGET]:$TPPORT_HTTP
[ "$1" != "1" ] || ipt6 PREROUTING -t nat -i $DEVICE $IPT_FILTER_HTTPS -j DNAT --to [$DNAT6_TARGET]:$TPPORT_HTTPS
[ "$DNAT6_TARGET" != "-" ] && ipt6 PREROUTING -t nat -i $DEVICE -p tcp $2 -j DNAT --to [$DNAT6_TARGET]:$3
}
}
fw_tpws6()
{
__fw_tpws6 0
}
fw_tpws_https6()
{
__fw_tpws6 1
}
create_ipset()
{
echo "Creating ipset"
"$IPSET_CR" $1
"$IPSET_CR" "$@"
}
zapret_apply_firewall()
{
case "${MODE}" in
tpws_hostlist)
fw_tpws "--dport 80" "--dport 80" $TPPORT_HTTP
;;
tpws_ipset)
create_ipset no-update
fw_tpws "--dport 80 -m set --match-set zapret dst" "--dport 80 -m set --match-set zapret6 dst" $TPPORT_HTTP
;;
tpws_ipset_https)
create_ipset no-update
fw_tpws "--dport 80 -m set --match-set zapret dst" "--dport 80 -m set --match-set zapret6 dst" $TPPORT_HTTP
fw_tpws "--dport 443 -m set --match-set zapret dst" "--dport 443 -m set --match-set zapret6 dst" $TPPORT_HTTPS
;;
tpws_all)
fw_tpws "--dport 80" "--dport 80" $TPPORT_HTTP
;;
tpws_all_https)
fw_tpws "--dport 80" "--dport 80" $TPPORT_HTTP
fw_tpws "--dport 443" "--dport 443" $TPPORT_HTTPS
;;
nfqws_ipset)
create_ipset no-update
fw_nfqws_pre "--sport 80 -m set --match-set zapret src" "--sport 80 -m set --match-set zapret6 src"
fw_nfqws_post "--dport 80 -m set --match-set zapret dst" "--dport 80 -m set --match-set zapret6 dst"
;;
nfqws_ipset_https)
create_ipset no-update
fw_nfqws_pre "-m multiport --sports 80,443 -m set --match-set zapret src" "-m multiport --sports 80,443 -m set --match-set zapret6 src"
fw_nfqws_post "--dport 80 -m set --match-set zapret dst" "--dport 80 -m set --match-set zapret6 dst"
;;
nfqws_all)
fw_nfqws_pre "--sport 80" "--sport 80"
fw_nfqws_post "--dport 80" "--dport 80"
;;
nfqws_all_https)
fw_nfqws_pre "-m multiport --sports 80,443" "-m multiport --sports 80,443"
fw_nfqws_post "--dport 80" "--dport 80"
;;
ipset)
create_ipset no-update
;;
custom)
# PLACEHOLDER
echo !!! NEED ATTENTION !!!
echo Configure iptables for required actions
echo Study how other sections work
;;
esac
}

2
init.d/sysv/functions
View File

@ -292,7 +292,7 @@ do_tpws()
create_ipset()
{
echo "Creating ipset"
"$IPSET_CR"
"$IPSET_CR" "$@"
}

53
install_easy.sh
View File

@ -559,32 +559,29 @@ openwrt_fw_section_find()
false
return
}
openwrt_fw_section_add()
{
# $1 - fw include postfix
# echoes section number
openwrt_fw_section_find $1 ||
{
uci add firewall include >/dev/null || return
echo -1
}
}
openwrt_fw_section_del()
{
# $1 - fw include postfix
local id=$(openwrt_fw_section_find $1)
[ -n "$id" ] && {
uci delete firewall.@include[$id] && uci commit firewall
rm -f "$OPENWRT_FW_INCLUDE$1"
}
}
openwrt_fw_section_add()
{
openwrt_fw_section_find ||
{
uci add firewall include >/dev/null || return
echo -1
}
}
openwrt_fw_section_configure()
{
# $1 - fw include postfix
local id=$(openwrt_fw_section_add $1)
[ -z "$id" ] ||
! uci set firewall.@include[$id].path="$OPENWRT_FW_INCLUDE$1" ||
! uci set firewall.@include[$id].path="$OPENWRT_FW_INCLUDE" ||
! uci set firewall.@include[$id].reload="1" ||
! uci commit firewall &&
{
@ -595,8 +592,6 @@ openwrt_fw_section_configure()
install_openwrt_firewall()
{
# $1 - fw include postfix
echo \* installing firewall script $1
[ -n "MODE" ] || {
@ -604,31 +599,12 @@ install_openwrt_firewall()
exitp 7
}
local FW_SCRIPT_SRC="$FW_SCRIPT_SRC_DIR.$MODE$1"
[ -f "$FW_SCRIPT_SRC" ] || {
echo firewall script $FW_SCRIPT_SRC not found. removing firewall include
openwrt_fw_section_del
return
}
echo "linking : $FW_SCRIPT_SRC => $OPENWRT_FW_INCLUDE$1"
ln -fs "$FW_SCRIPT_SRC" "$OPENWRT_FW_INCLUDE$1"
echo "linking : $FW_SCRIPT_SRC => $OPENWRT_FW_INCLUDE"
ln -fs "$FW_SCRIPT_SRC" "$OPENWRT_FW_INCLUDE"
openwrt_fw_section_configure $1
}
install_openwrt_firewall_all()
{
if [ "$DISABLE_IPV4" = "1" ] ; then
openwrt_fw_section_del
else
install_openwrt_firewall
fi
if [ "$DISABLE_IPV6" = "1" ] ; then
openwrt_fw_section_del 6
else
install_openwrt_firewall 6
fi
}
restart_openwrt_firewall()
{
@ -645,6 +621,7 @@ remove_openwrt_firewall()
echo \* removing firewall script
openwrt_fw_section_del
# from old zapret versions. now we use single include
openwrt_fw_section_del 6
}
@ -683,7 +660,7 @@ service_start_sysv()
install_openwrt()
{
INIT_SCRIPT_SRC=$EXEDIR/init.d/openwrt/zapret
FW_SCRIPT_SRC_DIR=$EXEDIR/init.d/openwrt/firewall.zapret
FW_SCRIPT_SRC=$EXEDIR/init.d/openwrt/firewall.zapret
OPENWRT_FW_INCLUDE=/etc/firewall.zapret
OPENWRT_IFACE_HOOK=$EXEDIR/init.d/openwrt/90-zapret
@ -701,7 +678,7 @@ install_openwrt()
crontab_add 0 6
service_start_sysv
install_openwrt_iface_hook
install_openwrt_firewall_all
install_openwrt_firewall
restart_openwrt_firewall
}

2
uninstall_easy.sh
View File

@ -121,7 +121,6 @@ remove_systemd()
openwrt_fw_section_find()
{
# $1 - fw include postfix
@ -157,6 +156,7 @@ remove_openwrt_firewall()
echo \* removing firewall script
openwrt_fw_section_del
# from old zapret versions. now we use single include
openwrt_fw_section_del 6
}