# this custom script runs desync to all QUIC initial packets, without ipset/hostlist filtering # need to add to config : NFQWS_OPT_DESYNC_QUIC="--dpi-desync=fake" # NOTE : do not use TTL fooling. chromium QUIC engine breaks sessions if TTL expired in transit received DNUM=102 QNUM2=$(($DNUM * 5)) zapret_custom_daemons() { # $1 - 1 - run, 0 - stop local opt="--qnum=$QNUM2 $NFQWS_OPT_BASE $NFQWS_OPT_DESYNC_QUIC" do_nfqws $1 $DNUM "$opt" } zapret_custom_firewall() { # $1 - 1 - run, 0 - stop local f local first_packets_only="$ipt_connbytes 1:3" local desync="-m mark ! --mark $DESYNC_MARK/$DESYNC_MARK" f="-p udp -m multiport --dports $QUIC_PORTS_IPT" fw_nfqws_post $1 "$f $desync $first_packets_only" "$f $desync $first_packets_only" $QNUM2 } zapret_custom_firewall_nft() { # stop logic is not required local f local first_packets_only="$nft_connbytes 1-3" local desync="mark and $DESYNC_MARK == 0" f="udp dport {$QUIC_PORTS}" nft_fw_nfqws_post "$f $desync $first_packets_only" "$f $desync $first_packets_only" $QNUM2 }