# some DPIs monitor all requests in http keep-alive session
# so processing of every outgoing packet is necessary
# for https its enough to act on client hello packet. ignore others and save CPU time

# copy this file to custom
# check config :
#  MODE=custom
#  NFQWS_OPT_DESYNC=your choice of nfqws desync options
#  GETLIST=your choice of script in ipset/get_*.sh, or comment if list downloading is not needed
# if hostlist is needed then uncomment run_daemon with --hostlist and comment run_daemon without --hostlist
# if ipset filter is needed then uncomment lines starting with "ipset_zapret" and "ipset_zapret6"
# /etc/init.d/zapret restart
# fw3 restart

zapret_custom_daemons()
{
	run_daemon 1 $NFQWS "$NFQWS_OPT_BASE $NFQWS_OPT_DESYNC"
	#run_daemon 1 $NFQWS "$NFQWS_OPT_BASE $NFQWS_OPT_DESYNC --hostlist=$HOSTLIST"
}
zapret_custom_firewall()
{
	local desync_http="--dport 80 -m mark ! --mark $DESYNC_MARK/$DESYNC_MARK"
	local desync_https="--dport 443 -m connbytes --connbytes-dir=original --connbytes-mode=packets --connbytes 2:4 -m mark ! --mark $DESYNC_MARK/$DESYNC_MARK"
	local ipset_zapret ipset_zapret6
	#ipset_zapret="-m set --match-set zapret dst"
	#ipset_zapret6="-m set --match-set zapret6 dst"
	fw_nfqws_post "$desync_http $ipset_zapret" "$desync_http $ipset_zapret6" $QNUM
	fw_nfqws_post "$desync_https $ipset_zapret" "$desync_https $ipset_zapret6" $QNUM
}