drygdryg/zapret
1
0
Fork 0
mirror of https://github.com/bol-van/zapret.git synced 2025-05-24 22:32:58 +03:00
Code Issues Packages Projects Releases Wiki Activity

autottl, datanoack, oob, postnat

Browse Source
This commit is contained in:
bol-van
2024-03-02 17:53:37 +03:00
parent 2157fed592
commit 8a161f1f49
48 changed files with 597 additions and 249 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
init.d/openwrt/custom-nfqws-dht4all
View File

@@ -21,7 +21,7 @@ zapret_custom_firewall()
local MODE_OVERRIDE=nfqws
local f uf4 uf6
local first_packet_only="-m connbytes --connbytes-dir=original --connbytes-mode=packets --connbytes 1:1"
local first_packet_only="$ipt_connbytes 1:1"
local desync="-m mark ! --mark $DESYNC_MARK/$DESYNC_MARK"
zapret_do_firewall_rules_ipt $1
@@ -37,7 +37,7 @@ zapret_custom_firewall_nft()
local MODE_OVERRIDE=nfqws
local f
local first_packet_only="ct original packets 1"
local first_packet_only="$nft_connbytes 1"
local desync="mark and $DESYNC_MARK == 0"
zapret_apply_firewall_rules_nft

5
init.d/openwrt/custom-nfqws-quic4all
View File

@@ -1,6 +1,5 @@
# this custom script in addition to MODE=nfqws runs desync to all QUIC initial packets, without ipset/hostlist filtering
# need to add to config : NFQWS_OPT_DESYNC_QUIC="--dpi-desync=fake"
# russian TSPU version : NFQWS_OPT_DESYNC_QUIC="--dpi-desync=fake --dpi-desync-fake-quic=/opt/zapret/files/fake/quic_short_header.bin"
# NOTE : do not use TTL fooling. chromium QUIC engine breaks sessions if TTL expired in transit received
QNUM2=$(($QNUM+10))
@@ -23,7 +22,7 @@ zapret_custom_firewall()
local MODE_OVERRIDE=nfqws
local f
local first_packets_only="-m connbytes --connbytes-dir=original --connbytes-mode=packets --connbytes 1:3"
local first_packets_only="$ipt_connbytes 1:3"
local desync="-m mark ! --mark $DESYNC_MARK/$DESYNC_MARK"
zapret_do_firewall_rules_ipt $1
@@ -38,7 +37,7 @@ zapret_custom_firewall_nft()
local MODE_OVERRIDE=nfqws
local f
local first_packets_only="ct original packets 1-3"
local first_packets_only="$nft_connbytes 1-3"
local desync="mark and $DESYNC_MARK == 0"
zapret_apply_firewall_rules_nft

8
init.d/openwrt/custom-tpws4http-nfqws4https
View File

@@ -24,7 +24,7 @@ zapret_custom_firewall()
# $1 - 1 - run, 0 - stop
local f4 f6
local first_packet_only="-m connbytes --connbytes-dir=original --connbytes-mode=packets --connbytes 1:4"
local first_packet_only="$ipt_connbytes 1:$(first_packets_for_mode)"
local desync="-m mark ! --mark $DESYNC_MARK/$DESYNC_MARK"
[ "$MODE_HTTP" = "1" ] && {
@@ -45,8 +45,10 @@ zapret_custom_firewall_nft()
{
# stop logic is not required
# do not use POSTNAT for udp first packet desync !
local POSTNAT=1
local f4 f6
local first_packet_only="ct original packets 1-4"
local first_packet_only="$nft_connbytes 1-$(first_packets_for_mode)"
local desync="mark and $DESYNC_MARK == 0"
[ "$MODE_HTTP" = "1" ] && {
@@ -61,5 +63,7 @@ zapret_custom_firewall_nft()
f6=$f4
nft_filter_apply_ipset_target f4 f6
nft_fw_nfqws_post "$f4 $desync" "$f6 $desync" $QNUM
# for modes that require incoming traffic
nft_fw_reverse_nfqws_rule "$f4" "$f6" $QNUM
}
}

1
init.d/openwrt/functions
View File

@@ -15,6 +15,7 @@
[ -n "$TPPORT" ] || TPPORT=988
[ -n "$WS_USER" ] || WS_USER=daemon
[ -n "$DESYNC_MARK" ] || DESYNC_MARK=0x40000000
[ -n "$DESYNC_MARK_POSTNAT" ] || DESYNC_MARK_POSTNAT=0x20000000
[ -n "$OPENWRT_LAN" ] || OPENWRT_LAN=lan
TPWS_LOCALHOST4=127.0.0.127