mirror of
https://github.com/bol-van/zapret.git
synced 2025-05-24 22:32:58 +03:00
init scripts: multiple LAN/WAN interfaces
This commit is contained in:
bol-van
@@ -31,11 +31,6 @@ TPWS_WAIT_SOCKS6="$TPWS_WAIT --bind-wait-ip-linklocal=30"
|
||||
# first wait for lan to ifup, then wait for bind-wait-ip-linklocal seconds for link local address and bind-wait-ip for any ipv6 as the worst case
|
||||
TPWS_OPT_BASE6_PRE="--bind-linklocal=prefer $TPWS_WAIT --bind-wait-ip-linklocal=3"
|
||||
|
||||
|
||||
[ -n "$IFACE_WAN" ] && IPT_OWAN="-o $IFACE_WAN"
|
||||
[ -n "$IFACE_WAN" ] && IPT_IWAN="-i $IFACE_WAN"
|
||||
[ -n "$IFACE_LAN" ] && IPT_ILAN="-i $IFACE_LAN"
|
||||
|
||||
[ -n "$DESYNC_MARK" ] || DESYNC_MARK=0x40000000
|
||||
|
||||
# max wait time for the link local ipv6 on the LAN interface
|
||||
@@ -72,11 +67,11 @@ on_off_function()
|
||||
|
||||
ipt()
|
||||
{
|
||||
iptables -C "$@" 2>/dev/null || iptables -I "$@"
|
||||
iptables -C "$@" >/dev/null 2>/dev/null || iptables -I "$@"
|
||||
}
|
||||
ipt_del()
|
||||
{
|
||||
iptables -C "$@" 2>/dev/null && iptables -D "$@"
|
||||
iptables -C "$@" >/dev/null 2>/dev/null && iptables -D "$@"
|
||||
}
|
||||
ipt_add_del()
|
||||
{
|
||||
@@ -84,11 +79,11 @@ ipt_add_del()
|
||||
}
|
||||
ipt6()
|
||||
{
|
||||
ip6tables -C "$@" 2>/dev/null || ip6tables -I "$@"
|
||||
ip6tables -C "$@" >/dev/null 2>/dev/null || ip6tables -I "$@"
|
||||
}
|
||||
ipt6_del()
|
||||
{
|
||||
ip6tables -C "$@" 2>/dev/null && ip6tables -D "$@"
|
||||
ip6tables -C "$@" >/dev/null 2>/dev/null && ip6tables -D "$@"
|
||||
}
|
||||
ipt6_add_del()
|
||||
{
|
||||
@@ -141,31 +136,39 @@ wait_ifup()
|
||||
|
||||
dnat6_target()
|
||||
{
|
||||
# $1 - lan network name
|
||||
# $2 - var to store target ip6
|
||||
# get target ip address for DNAT. prefer link locals
|
||||
# tpws should be as inaccessible from outside as possible
|
||||
# link local address can appear not immediately after ifup
|
||||
|
||||
# DNAT6_TARGET=- means attempt was made but address was not found (to avoid multiple re-attempts)
|
||||
|
||||
local DNAT6_TARGET DVAR=DNAT6_TARGET_$1
|
||||
DVAR=$(echo $DVAR | sed 's/[^a-zA-Z0-9_]/_/g')
|
||||
eval DNAT6_TARGET="\$$DVAR"
|
||||
[ -n "$2" ] && eval $2=''
|
||||
[ -n "$DNAT6_TARGET" ] || {
|
||||
local ct=0
|
||||
while
|
||||
DNAT6_TARGET=$(get_ipv6_linklocal $IFACE_LAN)
|
||||
DNAT6_TARGET=$(get_ipv6_linklocal $1)
|
||||
[ -n "$DNAT6_TARGET" ] && break
|
||||
[ "$ct" -ge "$LINKLOCAL_WAIT_SEC" ] && break
|
||||
echo waiting for the link local for another $(($LINKLOCAL_WAIT_SEC - $ct)) seconds ...
|
||||
echo $1: waiting for the link local for another $(($LINKLOCAL_WAIT_SEC - $ct)) seconds ...
|
||||
ct=$(($ct+1))
|
||||
sleep 1
|
||||
do :; done
|
||||
|
||||
[ -n "$DNAT6_TARGET" ] || {
|
||||
echo no link local. getting global
|
||||
DNAT6_TARGET=$(get_ipv6_global $IFACE_LAN)
|
||||
echo $1: no link local. getting global
|
||||
DNAT6_TARGET=$(get_ipv6_global $1)
|
||||
[ -n "$DNAT6_TARGET" ] || {
|
||||
echo could not get any address
|
||||
echo $1: could not get any address
|
||||
DNAT6_TARGET=-
|
||||
}
|
||||
}
|
||||
eval $DVAR="$DNAT6_TARGET"
|
||||
}
|
||||
[ -n "$2" ] && eval $2="$DNAT6_TARGET"
|
||||
}
|
||||
|
||||
prepare_tpws_fw4()
|
||||
@@ -173,26 +176,25 @@ prepare_tpws_fw4()
|
||||
# otherwise linux kernel will treat 127.0.0.0/8 as "martian" ip and refuse routing to it
|
||||
# NOTE : kernels <3.6 do not have this feature. consider upgrading or change DNAT to REDIRECT and do not bind to 127.0.0.0/8
|
||||
[ -n "$IFACE_LAN" ] && {
|
||||
iptables -C INPUT -i $IFACE_LAN -j input_lan_rule_zapret 2>/dev/null || {
|
||||
# allow localnet route only to special tpws IP
|
||||
iptables -N input_lan_rule_zapret 2>/dev/null
|
||||
iptables -F input_lan_rule_zapret
|
||||
iptables -A input_lan_rule_zapret -d $TPWS_LOCALHOST4 -j RETURN
|
||||
iptables -A input_lan_rule_zapret -d 127.0.0.0/8 -j DROP
|
||||
iptables -I INPUT -i $IFACE_LAN -j input_lan_rule_zapret
|
||||
}
|
||||
sysctl -qw net.ipv4.conf.$IFACE_LAN.route_localnet=1
|
||||
iptables -N input_rule_zapret 2>/dev/null
|
||||
iptables -F input_rule_zapret
|
||||
iptables -A input_rule_zapret -d $TPWS_LOCALHOST4 -j RETURN
|
||||
iptables -A input_rule_zapret -d 127.0.0.0/8 -j DROP
|
||||
for lan in $IFACE_LAN ; do
|
||||
ipt INPUT -i $lan -j input_rule_zapret
|
||||
sysctl -qw net.ipv4.conf.$lan.route_localnet=1
|
||||
done
|
||||
}
|
||||
}
|
||||
unprepare_tpws_fw4()
|
||||
{
|
||||
[ -n "$IFACE_LAN" ] && {
|
||||
iptables -C INPUT -i $IFACE_LAN -j input_lan_rule_zapret 2>/dev/null && {
|
||||
sysctl -qw net.ipv4.conf.$IFACE_LAN.route_localnet=0
|
||||
iptables -D INPUT -i $IFACE_LAN -j input_lan_rule_zapret
|
||||
iptables -F input_lan_rule_zapret
|
||||
iptables -X input_lan_rule_zapret
|
||||
}
|
||||
for lan in $IFACE_LAN ; do
|
||||
ipt_del INPUT -i $lan -j input_rule_zapret
|
||||
sysctl -qw net.ipv4.conf.$lan.route_localnet=0
|
||||
done
|
||||
iptables -F input_rule_zapret 2>/dev/null
|
||||
iptables -X input_rule_zapret 2>/dev/null
|
||||
}
|
||||
}
|
||||
unprepare_tpws_fw()
|
||||
@@ -218,10 +220,16 @@ fw_tpws4()
|
||||
[ "$DISABLE_IPV4" = "1" ] || {
|
||||
[ "$1" = 1 ] && prepare_tpws_fw4
|
||||
print_op $1 "$2" "tpws (port $3)"
|
||||
[ -n "$IFACE_LAN" ] && {
|
||||
ipt_add_del $1 PREROUTING -t nat $IPT_ILAN -p tcp $2 $IPSET_EXCLUDE dst -j DNAT --to $TPWS_LOCALHOST4:$3
|
||||
}
|
||||
ipt_add_del $1 OUTPUT -t nat $IPT_OWAN -m owner ! --uid-owner $WS_USER -p tcp $2 $IPSET_EXCLUDE dst -j DNAT --to $TPWS_LOCALHOST4:$3
|
||||
for lan in $IFACE_LAN ; do
|
||||
ipt_add_del $1 PREROUTING -t nat -i $lan -p tcp $2 $IPSET_EXCLUDE dst -j DNAT --to $TPWS_LOCALHOST4:$3
|
||||
done
|
||||
if [ -n "$IFACE_WAN" ]; then
|
||||
for wan in $IFACE_WAN; do
|
||||
ipt_add_del $1 OUTPUT -t nat -o $wan -m owner ! --uid-owner $WS_USER -p tcp $2 $IPSET_EXCLUDE dst -j DNAT --to $TPWS_LOCALHOST4:$3
|
||||
done
|
||||
else
|
||||
ipt_add_del $1 OUTPUT -t nat -m owner ! --uid-owner $WS_USER -p tcp $2 $IPSET_EXCLUDE dst -j DNAT --to $TPWS_LOCALHOST4:$3
|
||||
fi
|
||||
}
|
||||
}
|
||||
fw_tpws6()
|
||||
@@ -231,11 +239,18 @@ fw_tpws6()
|
||||
# $3 - tpws port
|
||||
[ "$DISABLE_IPV6" = "1" ] || {
|
||||
print_op $1 "$2" "tpws (port $3)" 6
|
||||
[ -n "$IFACE_LAN" ] && {
|
||||
dnat6_target
|
||||
[ "$DNAT6_TARGET" != "-" ] && ipt6_add_del $1 PREROUTING -t nat $IPT_ILAN -p tcp $2 $IPSET_EXCLUDE6 dst -j DNAT --to [$DNAT6_TARGET]:$3
|
||||
}
|
||||
ipt6_add_del $1 OUTPUT -t nat $IPT_OWAN -m owner ! --uid-owner $WS_USER -p tcp $2 $IPSET_EXCLUDE6 dst -j DNAT --to [::1]:$3
|
||||
local DNAT6
|
||||
for lan in $IFACE_LAN ; do
|
||||
dnat6_target $lan DNAT6
|
||||
[ "$DNAT6" != "-" ] && ipt6_add_del $1 PREROUTING -t nat -i $lan -p tcp $2 $IPSET_EXCLUDE6 dst -j DNAT --to [$DNAT6]:$3
|
||||
done
|
||||
if [ -n "$IFACE_WAN" ]; then
|
||||
for wan in $IFACE_WAN; do
|
||||
ipt6_add_del $1 OUTPUT -t nat -o $wan -m owner ! --uid-owner $WS_USER -p tcp $2 $IPSET_EXCLUDE6 dst -j DNAT --to [::1]:$3
|
||||
done
|
||||
else
|
||||
ipt6_add_del $1 OUTPUT -t nat -m owner ! --uid-owner $WS_USER -p tcp $2 $IPSET_EXCLUDE6 dst -j DNAT --to [::1]:$3
|
||||
fi
|
||||
}
|
||||
}
|
||||
fw_tpws()
|
||||
@@ -256,7 +271,13 @@ fw_nfqws_pre4()
|
||||
# $3 - queue number
|
||||
[ "$DISABLE_IPV4" = "1" ] || {
|
||||
print_op $1 "$2" "nfqws prerouting (qnum $3)"
|
||||
ipt_add_del $1 PREROUTING -t mangle $IPT_IWAN -p tcp $2 $IPSET_EXCLUDE src -j NFQUEUE --queue-num $3 --queue-bypass
|
||||
if [ -n "$IFACE_WAN" ]; then
|
||||
for wan in $IFACE_WAN; do
|
||||
ipt_add_del $1 PREROUTING -t mangle -i $wan -p tcp $2 $IPSET_EXCLUDE src -j NFQUEUE --queue-num $3 --queue-bypass
|
||||
done
|
||||
else
|
||||
ipt_add_del $1 PREROUTING -t mangle -p tcp $2 $IPSET_EXCLUDE src -j NFQUEUE --queue-num $3 --queue-bypass
|
||||
fi
|
||||
}
|
||||
}
|
||||
fw_nfqws_pre6()
|
||||
@@ -266,7 +287,13 @@ fw_nfqws_pre6()
|
||||
# $3 - queue number
|
||||
[ "$DISABLE_IPV6" = "1" ] || {
|
||||
print_op $1 "$2" "nfqws prerouting (qnum $3)" 6
|
||||
ipt6_add_del $1 PREROUTING -t mangle $IPT_IWAN -p tcp $2 $IPSET_EXCLUDE6 src -j NFQUEUE --queue-num $3 --queue-bypass
|
||||
if [ -n "$IFACE_WAN" ]; then
|
||||
for wan in $IFACE_WAN; do
|
||||
ipt6_add_del $1 PREROUTING -t mangle -i $wan -p tcp $2 $IPSET_EXCLUDE6 src -j NFQUEUE --queue-num $3 --queue-bypass
|
||||
done
|
||||
else
|
||||
ipt6_add_del $1 PREROUTING -t mangle -p tcp $2 $IPSET_EXCLUDE6 src -j NFQUEUE --queue-num $3 --queue-bypass
|
||||
fi
|
||||
}
|
||||
}
|
||||
fw_nfqws_pre()
|
||||
@@ -285,7 +312,13 @@ fw_nfqws_post4()
|
||||
# $3 - queue number
|
||||
[ "$DISABLE_IPV4" = "1" ] || {
|
||||
print_op $1 "$2" "nfqws postrouting (qnum $3)"
|
||||
ipt_add_del $1 POSTROUTING -t mangle $IPT_OWAN -p tcp $2 $IPSET_EXCLUDE dst -j NFQUEUE --queue-num $3 --queue-bypass
|
||||
if [ -n "$IFACE_WAN" ]; then
|
||||
for wan in $IFACE_WAN; do
|
||||
ipt_add_del $1 POSTROUTING -t mangle -o $wan -p tcp $2 $IPSET_EXCLUDE dst -j NFQUEUE --queue-num $3 --queue-bypass
|
||||
done
|
||||
else
|
||||
ipt_add_del $1 POSTROUTING -t mangle -p tcp $2 $IPSET_EXCLUDE dst -j NFQUEUE --queue-num $3 --queue-bypass
|
||||
fi
|
||||
}
|
||||
}
|
||||
fw_nfqws_post6()
|
||||
@@ -295,7 +328,13 @@ fw_nfqws_post6()
|
||||
# $3 - queue number
|
||||
[ "$DISABLE_IPV6" = "1" ] || {
|
||||
print_op $1 "$2" "nfqws postrouting (qnum $3)" 6
|
||||
ipt6_add_del $1 POSTROUTING -t mangle $IPT_OWAN -p tcp $2 $IPSET_EXCLUDE6 dst -j NFQUEUE --queue-num $3 --queue-bypass
|
||||
if [ -n "$IFACE_WAN" ]; then
|
||||
for wan in $IFACE_WAN; do
|
||||
ipt6_add_del $1 POSTROUTING -t mangle -o $wan -p tcp $2 $IPSET_EXCLUDE6 dst -j NFQUEUE --queue-num $3 --queue-bypass
|
||||
done
|
||||
else
|
||||
ipt6_add_del $1 POSTROUTING -t mangle -p tcp $2 $IPSET_EXCLUDE6 dst -j NFQUEUE --queue-num $3 --queue-bypass
|
||||
fi
|
||||
}
|
||||
}
|
||||
fw_nfqws_post()
|
||||
@@ -385,11 +424,30 @@ do_tpws()
|
||||
[ "$DISABLE_IPV4" = "1" ] || OPT="$OPT $TPWS_OPT_BASE4"
|
||||
[ "$DISABLE_IPV6" = "1" ] || {
|
||||
OPT="$OPT $TPWS_OPT_BASE6"
|
||||
[ -n "$IFACE_LAN" ] && OPT="$OPT --bind-iface6=$IFACE_LAN $TPWS_OPT_BASE6_PRE"
|
||||
for lan in $IFACE_LAN; do
|
||||
OPT="$OPT --bind-iface6=$lan $TPWS_OPT_BASE6_PRE"
|
||||
done
|
||||
}
|
||||
|
||||
do_daemon $1 $2 "$TPWS" "$OPT $3"
|
||||
}
|
||||
do_tpws_socks()
|
||||
{
|
||||
# $1 : 1 - run, 0 - stop
|
||||
# $2 : daemon number
|
||||
# $3 : daemon args
|
||||
|
||||
[ "$1" = "1" ] && prepare_user
|
||||
|
||||
[ "$DISABLE_IPV4" = "1" ] && [ "$DISABLE_IPV6" = "1" ] && return 0
|
||||
|
||||
local opt="$TPWS_OPT_BASE --socks"
|
||||
|
||||
tpws_apply_socks_binds opt
|
||||
|
||||
do_daemon $1 $2 "$TPWS" "$opt $3"
|
||||
}
|
||||
|
||||
do_nfqws()
|
||||
{
|
||||
# $1 : 1 - run, 0 - stop
|
||||
@@ -434,14 +492,13 @@ tpws_apply_socks_binds()
|
||||
{
|
||||
local o
|
||||
|
||||
[ "$DISABLE_IPV4" = "1" ] || {
|
||||
o="--bind-addr=127.0.0.1"
|
||||
[ -n "$IFACE_LAN" ] && o="$o --bind-iface4=$IFACE_LAN $TPWS_WAIT"
|
||||
}
|
||||
[ "$DISABLE_IPV6" = "1" ] || {
|
||||
o="$o --bind-addr=::1"
|
||||
[ -n "$IFACE_LAN" ] && o="$o --bind-iface6=$IFACE_LAN --bind-linklocal=unwanted $TPWS_WAIT_SOCKS6"
|
||||
}
|
||||
[ "$DISABLE_IPV4" = "1" ] || o="--bind-addr=127.0.0.1"
|
||||
[ "$DISABLE_IPV6" = "1" ] || o="$o --bind-addr=::1"
|
||||
|
||||
for lan in $IFACE_LAN; do
|
||||
[ "$DISABLE_IPV4" = "1" ] || o="$o --bind-iface4=$lan $TPWS_WAIT"
|
||||
[ "$DISABLE_IPV6" = "1" ] || o="$o --bind-iface6=$lan --bind-linklocal=unwanted $TPWS_WAIT_SOCKS6"
|
||||
done
|
||||
eval $1="\"\$$1 $o\""
|
||||
}
|
||||
|
||||
@@ -535,10 +592,9 @@ zapret_do_daemons()
|
||||
do_tpws $1 1 "$opt"
|
||||
;;
|
||||
tpws-socks)
|
||||
opt="--port=$TPPORT $TPWS_OPT_BASE --socks $TPWS_OPT"
|
||||
tpws_apply_socks_binds opt
|
||||
opt="--port=$TPPORT $TPWS_OPT"
|
||||
filter_apply_hostlist_target opt
|
||||
do_daemon $1 1 "$TPWS" "$opt"
|
||||
do_tpws_socks $1 1 "$opt"
|
||||
;;
|
||||
nfqws)
|
||||
opt="--qnum=$QNUM $NFQWS_OPT_DESYNC_HTTP"
|
||||
|
||||
Reference in New Issue
Block a user