mirror of
https://github.com/bol-van/zapret.git
synced 2026-10-26 12:56:47 +09:00
init.d: multiple customs
This commit is contained in:
bol-van committed
1 parent
bd80daad97
commit
e8012ee67f
34 files changed
+436
-272
No files matched your search
@@ -0,0 +1,18 @@
|
||||
# this custom script applies tpws mode as it would be with MODE=tpws
|
||||
|
||||
OVERRIDE=tpws
|
||||
|
||||
zapret_custom_daemons()
|
||||
{
|
||||
# $1 - 1 - run, 0 - stop
|
||||
|
||||
MODE_OVERRIDE=$OVERRIDE zapret_do_daemons $1
|
||||
}
|
||||
zapret_custom_firewall_v4()
|
||||
{
|
||||
MODE_OVERRIDE=$OVERRIDE pf_anchor_zapret_v4
|
||||
}
|
||||
zapret_custom_firewall_v6()
|
||||
{
|
||||
MODE_OVERRIDE=$OVERRIDE pf_anchor_zapret_v6
|
||||
}
|
||||
@@ -0,0 +1,18 @@
|
||||
# this custom script applies tpws-socks mode as it would be with MODE=tpws-socks
|
||||
|
||||
OVERRIDE=tpws-socks
|
||||
|
||||
zapret_custom_daemons()
|
||||
{
|
||||
# $1 - 1 - run, 0 - stop
|
||||
|
||||
MODE_OVERRIDE=$OVERRIDE zapret_do_daemons $1
|
||||
}
|
||||
zapret_custom_firewall_v4()
|
||||
{
|
||||
MODE_OVERRIDE=$OVERRIDE pf_anchor_zapret_v4
|
||||
}
|
||||
zapret_custom_firewall_v6()
|
||||
{
|
||||
MODE_OVERRIDE=$OVERRIDE pf_anchor_zapret_v6
|
||||
}
|
||||
@@ -1,16 +1,20 @@
|
||||
# this script is an example describing how to run tpws on a custom port
|
||||
|
||||
TPPORT_MY=987
|
||||
DNUM=100
|
||||
TPPORT_MY=${TPPORT_MY:-987}
|
||||
TPWS_OPT_MY=${TPWS_OPT_MY:-987}
|
||||
TPWS_OPT_SUFFIX_MY="${TPWS_OPT_SUFFIX_MY:-}"
|
||||
DPORTS_MY=${DPORTS_MY:-20443,20444,30000-30009}
|
||||
|
||||
zapret_custom_daemons()
|
||||
{
|
||||
# $1 - 1 - run, 0 - stop
|
||||
local opt="--user=root --port=$TPPORT_MY"
|
||||
tpws_apply_binds opt
|
||||
opt="$opt $TPWS_OPT"
|
||||
opt="$opt $TPWS_OPT_MY"
|
||||
filter_apply_hostlist_target opt
|
||||
filter_apply_suffix opt "$TPWS_OPT_SUFFIX"
|
||||
do_daemon $1 1 "$TPWS" "$opt"
|
||||
filter_apply_suffix opt "$TPWS_OPT_SUFFIX_MY"
|
||||
do_daemon $1 $DNUM "$TPWS" "$opt"
|
||||
}
|
||||
|
||||
# custom firewall functions echo rules for zapret-v4 and zapret-v6 anchors
|
||||
@@ -18,9 +22,9 @@ zapret_custom_daemons()
|
||||
|
||||
zapret_custom_firewall_v4()
|
||||
{
|
||||
pf_anchor_zapret_v4_tpws $TPPORT_MY
|
||||
pf_anchor_zapret_v4_tpws $TPPORT_MY $(replace_char - : $DPORTS_MY)
|
||||
}
|
||||
zapret_custom_firewall_v6()
|
||||
{
|
||||
pf_anchor_zapret_v6_tpws $TPPORT_MY
|
||||
pf_anchor_zapret_v6_tpws $TPPORT_MY $(replace_char - : $DPORTS_MY)
|
||||
}
|
||||
Whitespace-only changes.
@@ -1,21 +0,0 @@
|
||||
# this script contain your special code to launch daemons and configure firewall
|
||||
# use helpers from "functions" file
|
||||
# in case of upgrade keep this file only, do not modify others
|
||||
|
||||
zapret_custom_daemons()
|
||||
{
|
||||
# $1 - 1 - run, 0 - stop
|
||||
:
|
||||
}
|
||||
|
||||
# custom firewall functions echo rules for zapret-v4 and zapret-v6 anchors
|
||||
# they come after automated table definitions. so you can use <zapret> <zapret6> <zapret-user> ...
|
||||
|
||||
zapret_custom_firewall_v4()
|
||||
{
|
||||
:
|
||||
}
|
||||
zapret_custom_firewall_v6()
|
||||
{
|
||||
:
|
||||
}
|
||||
@@ -7,6 +7,8 @@ ZAPRET_CONFIG=${ZAPRET_CONFIG:-"$ZAPRET_RW/config"}
|
||||
. "$ZAPRET_BASE/common/base.sh"
|
||||
. "$ZAPRET_BASE/common/pf.sh"
|
||||
. "$ZAPRET_BASE/common/list.sh"
|
||||
. "$ZAPRET_BASE/common/custom.sh"
|
||||
CUSTOM_DIR="$ZAPRET_RW/init.d/macos"
|
||||
|
||||
IPSET_DIR=$ZAPRET_BASE/ipset
|
||||
. "$IPSET_DIR/def.sh"
|
||||
@@ -184,7 +186,7 @@ zapret_do_daemons()
|
||||
filter)
|
||||
;;
|
||||
custom)
|
||||
existf zapret_custom_daemons && zapret_custom_daemons $1
|
||||
custom_runner zapret_custom_daemons $1
|
||||
;;
|
||||
*)
|
||||
echo "unsupported MODE=$MODE"
|
||||
|
||||
@@ -1,47 +0,0 @@
|
||||
# this custom script demonstrates how to reuse built-in modes and add something from yourself
|
||||
|
||||
MY_TPPORT=$(($TPPORT + 1))
|
||||
MY_TPWS_OPT="--methodeol --hostcase"
|
||||
MY_DPORT=81
|
||||
|
||||
zapret_custom_daemons()
|
||||
{
|
||||
# stop logic is managed by procd
|
||||
|
||||
local MODE_OVERRIDE=tpws
|
||||
local opt
|
||||
|
||||
start_daemons_procd
|
||||
|
||||
opt="--port=$MY_TPPORT $MY_TPWS_OPT"
|
||||
filter_apply_hostlist_target opt
|
||||
run_tpws 100 "$opt"
|
||||
}
|
||||
zapret_custom_firewall()
|
||||
{
|
||||
# $1 - 1 - run, 0 - stop
|
||||
|
||||
local MODE_OVERRIDE=tpws
|
||||
local f4 f6
|
||||
|
||||
zapret_do_firewall_rules_ipt $1
|
||||
|
||||
f4="-p tcp --dport $MY_DPORT"
|
||||
f6=$f4
|
||||
filter_apply_ipset_target f4 f6
|
||||
fw_tpws $1 "$f4" "$f6" $MY_TPPORT
|
||||
}
|
||||
zapret_custom_firewall_nft()
|
||||
{
|
||||
# stop logic is not required
|
||||
|
||||
local MODE_OVERRIDE=tpws
|
||||
local f4 f6
|
||||
|
||||
zapret_apply_firewall_rules_nft
|
||||
|
||||
f4="tcp dport $MY_DPORT"
|
||||
f6=$f4
|
||||
nft_filter_apply_ipset_target f4 f6
|
||||
nft_fw_tpws "$f4" "$f6" $MY_TPPORT
|
||||
}
|
||||
@@ -0,0 +1,22 @@
|
||||
# this custom script applies nfqws mode as it would be with MODE=nfqws
|
||||
|
||||
OVERRIDE=nfqws
|
||||
|
||||
zapret_custom_daemons()
|
||||
{
|
||||
# stop logic is managed by procd
|
||||
|
||||
MODE_OVERRIDE=$OVERRIDE start_daemons_procd
|
||||
}
|
||||
zapret_custom_firewall()
|
||||
{
|
||||
# $1 - 1 - run, 0 - stop
|
||||
|
||||
MODE_OVERRIDE=$OVERRIDE zapret_do_firewall_rules_ipt $1
|
||||
}
|
||||
zapret_custom_firewall_nft()
|
||||
{
|
||||
# stop logic is not required
|
||||
|
||||
MODE_OVERRIDE=$OVERRIDE zapret_apply_firewall_rules_nft
|
||||
}
|
||||
@@ -0,0 +1,22 @@
|
||||
# this custom script applies tpws mode as it would be with MODE=tpws
|
||||
|
||||
OVERRIDE=tpws
|
||||
|
||||
zapret_custom_daemons()
|
||||
{
|
||||
# $1 - 1 - run, 0 - stop
|
||||
|
||||
MODE_OVERRIDE=$OVERRIDE start_daemons_procd
|
||||
}
|
||||
zapret_custom_firewall()
|
||||
{
|
||||
# $1 - 1 - run, 0 - stop
|
||||
|
||||
MODE_OVERRIDE=$OVERRIDE zapret_do_firewall_rules_ipt $1
|
||||
}
|
||||
zapret_custom_firewall_nft()
|
||||
{
|
||||
# stop logic is not required
|
||||
|
||||
MODE_OVERRIDE=$OVERRIDE zapret_apply_firewall_rules_nft
|
||||
}
|
||||
@@ -0,0 +1,22 @@
|
||||
# this custom script applies tpws-socks mode as it would be with MODE=tpws-socks
|
||||
|
||||
OVERRIDE=tpws-socks
|
||||
|
||||
zapret_custom_daemons()
|
||||
{
|
||||
# $1 - 1 - run, 0 - stop
|
||||
|
||||
MODE_OVERRIDE=$OVERRIDE start_daemons_procd
|
||||
}
|
||||
zapret_custom_firewall()
|
||||
{
|
||||
# $1 - 1 - run, 0 - stop
|
||||
|
||||
MODE_OVERRIDE=$OVERRIDE zapret_do_firewall_rules_ipt $1
|
||||
}
|
||||
zapret_custom_firewall_nft()
|
||||
{
|
||||
# stop logic is not required
|
||||
|
||||
MODE_OVERRIDE=$OVERRIDE zapret_apply_firewall_rules_nft
|
||||
}
|
||||
@@ -1,31 +1,24 @@
|
||||
# this custom script in addition to MODE=nfqws runs desync to DHT packets with udp payload length 101..399 , without ipset/hostlist filtering
|
||||
# this custom script runs desync to DHT packets with udp payload length 101..399 , without ipset/hostlist filtering
|
||||
# need to add to config : NFQWS_OPT_DESYNC_DHT="--dpi-desync=fake --dpi-desync-ttl=5"
|
||||
|
||||
QNUM2=$(($QNUM+20))
|
||||
DNUM=101
|
||||
QNUM2=$(($DNUM * 5))
|
||||
|
||||
zapret_custom_daemons()
|
||||
{
|
||||
# stop logic is managed by procd
|
||||
|
||||
local MODE_OVERRIDE=nfqws
|
||||
local opt
|
||||
|
||||
zapret_do_daemons $1
|
||||
|
||||
opt="--qnum=$QNUM2 $NFQWS_OPT_BASE $NFQWS_OPT_DESYNC_DHT"
|
||||
do_nfqws $1 100 "$opt"
|
||||
local opt="--qnum=$QNUM2 $NFQWS_OPT_BASE $NFQWS_OPT_DESYNC_DHT"
|
||||
run_daemon $DNUM $NFQWS "$opt"
|
||||
}
|
||||
zapret_custom_firewall()
|
||||
{
|
||||
# $1 - 1 - run, 0 - stop
|
||||
|
||||
local MODE_OVERRIDE=nfqws
|
||||
local f uf4 uf6
|
||||
local first_packet_only="$ipt_connbytes 1:1"
|
||||
local desync="-m mark ! --mark $DESYNC_MARK/$DESYNC_MARK"
|
||||
|
||||
zapret_do_firewall_rules_ipt $1
|
||||
|
||||
f='-p udp -m length --length 109:407 -m u32 --u32'
|
||||
uf4='0>>22&0x3C@8>>16=0x6431'
|
||||
uf6='48>>16=0x6431'
|
||||
@@ -36,13 +29,10 @@ zapret_custom_firewall_nft()
|
||||
{
|
||||
# stop logic is not required
|
||||
|
||||
local MODE_OVERRIDE=nfqws
|
||||
local f
|
||||
local first_packet_only="$nft_connbytes 1"
|
||||
local desync="mark and $DESYNC_MARK == 0"
|
||||
|
||||
zapret_apply_firewall_rules_nft
|
||||
|
||||
f="meta length 109-407 meta l4proto udp @th,64,16 0x6431"
|
||||
nft_fw_nfqws_post "$f $desync $first_packet_only" "$f $desync $first_packet_only" $QNUM2
|
||||
}
|
||||
@@ -0,0 +1,69 @@
|
||||
# this custom script in addition to MODE=nfqws runs desync of some udp packets to discord subnets
|
||||
# idea taken from community. not tested and not optimized by author.
|
||||
|
||||
# can override in config :
|
||||
NFQWS_OPT_DESYNC_DISCORD="${NFQWS_OPT_DESYNC_DISCORD:---dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-any-protocol}"
|
||||
DISCORD_PORTS=${DISCORD_PORTS:-50000-65535}
|
||||
DISCORD_SUBNETS="${DISCORD_SUBNETS:-5.200.14.249 18.165.140.0/25 23.227.38.74 34.0.48.0/24 34.0.49.64/26 34.0.50.0/25 34.0.51.0/24 34.0.52.0/22 34.0.56.0/23 34.0.59.0/24 34.0.60.0/24 34.0.62.128/25 34.0.63.228 34.0.64.0/23 34.0.66.130 34.0.82.140 34.0.129.128/25 34.0.130.0/24 34.0.131.130 34.0.132.139 34.0.133.75 34.0.134.0/24 34.0.135.251 34.0.136.51 34.0.137.0/24 34.0.139.0/24 34.0.140.0/23 34.0.142.0/25 34.0.144.0/23 34.0.146.0/24 34.0.148.25 34.0.149.101 34.0.151.0/25 34.0.153.0/24 34.0.155.0/24 34.0.156.101 34.0.157.0/25 34.0.158.247 34.0.159.188 34.0.192.0/25 34.0.193.0/24 34.0.194.0/24 34.0.195.172 34.0.196.200/29 34.0.197.81 34.0.198.25 34.0.199.0/24 34.0.200.0/24 34.0.201.81 34.0.202.34 34.0.203.0/24 34.0.204.0/23 34.0.206.0/25 34.0.207.0/25 34.0.208.195 34.0.209.0/24 34.0.210.20 34.0.211.0/26 34.0.212.0/24 34.0.213.64/26 34.0.215.128/25 34.0.216.238 34.0.217.0/24 34.0.218.83 34.0.220.103 34.0.221.0/24 34.0.222.193 34.0.223.68 34.0.227.0/24 34.0.240.0/21 34.0.248.0/23 34.0.250.0/24 34.0.251.0/25 34.1.216.0/24 34.1.221.166 35.207.64.0/23 35.207.67.116 35.207.71.0/24 35.207.72.32 35.207.73.0/24 35.207.74.0/24 35.207.75.128/25 35.207.76.128/26 35.207.77.0/24 35.207.78.129 35.207.79.0/24 35.207.80.76 35.207.81.248/30 35.207.82.0/23 35.207.84.0/24 35.207.85.160 35.207.86.41 35.207.87.184 35.207.89.188 35.207.91.146 35.207.92.230 35.207.95.0/24 35.207.97.174 35.207.99.134 35.207.100.64/26 35.207.101.130 35.207.103.64/26 35.207.104.0/24 35.207.106.128/26 35.207.107.19 35.207.108.192/27 35.207.109.185 35.207.110.0/24 35.207.111.174 35.207.114.16 35.207.115.163 35.207.116.51 35.207.117.0/24 35.207.121.204 35.207.122.0/25 35.207.124.145 35.207.125.116 35.207.126.30 35.207.129.0/24 35.207.131.128/27 35.207.132.247 35.207.135.147 35.207.136.69 35.207.137.0/24 35.207.139.0/24 35.207.140.241 35.207.141.119 35.207.142.0/24 35.207.143.96/27 35.207.144.0/25 35.207.145.0/24 35.207.146.89 35.207.147.0/24 35.207.149.0/24 35.207.150.0/24 35.207.151.61 35.207.153.117 35.207.154.0/24 35.207.155.128/25 35.207.156.254 35.207.157.7 35.207.158.192 35.207.160.160 35.207.162.239 35.207.163.0/24 35.207.164.0/25 35.207.165.147 35.207.166.0/25 35.207.167.0/24 35.207.168.116 35.207.170.0/23 35.207.172.0/24 35.207.174.55 35.207.176.128/25 35.207.178.0/24 35.207.180.152 35.207.181.76 35.207.182.125 35.207.184.101 35.207.185.192 35.207.186.128/25 35.207.187.228 35.207.188.0/24 35.207.189.0/25 35.207.190.194 35.207.191.64/26 35.207.193.165 35.207.195.75 35.207.196.0/24 35.207.198.0/23 35.207.201.186 35.207.202.169 35.207.205.211 35.207.207.4 35.207.209.0/25 35.207.210.191 35.207.211.253 35.207.213.97 35.207.214.0/24 35.207.220.147 35.207.221.58 35.207.222.105 35.207.224.151 35.207.225.210 35.207.227.0/24 35.207.229.212 35.207.232.26 35.207.234.182 35.207.238.0/24 35.207.240.0/24 35.207.245.0/24 35.207.249.0/24 35.207.250.212 35.207.251.0/27 35.212.4.134 35.212.12.148 35.212.88.11 35.212.102.50 35.212.111.0/26 35.212.117.247 35.212.120.122 35.213.0.0/24 35.213.2.8 35.213.4.185 35.213.6.118 35.213.7.128/25 35.213.8.168 35.213.10.0/24 35.213.11.21 35.213.12.224/27 35.213.13.19 35.213.14.217 35.213.16.67 35.213.17.235 35.213.23.166 35.213.25.164 35.213.26.62 35.213.27.252 35.213.32.0/24 35.213.33.74 35.213.34.204 35.213.37.81 35.213.38.186 35.213.39.253 35.213.42.0/24 35.213.43.79 35.213.45.0/24 35.213.46.136 35.213.49.17 35.213.50.0/24 35.213.51.213 35.213.52.0/25 35.213.53.0/24 35.213.54.0/24 35.213.56.0/25 35.213.59.0/24 35.213.61.58 35.213.65.0/24 35.213.67.0/24 35.213.68.192/26 35.213.70.151 35.213.72.128/25 35.213.73.245 35.213.74.131 35.213.78.0/24 35.213.79.137 35.213.80.0/25 35.213.83.128/25 35.213.84.245 35.213.85.0/24 35.213.88.145 35.213.89.80/28 35.213.90.0/24 35.213.91.195 35.213.92.0/24 35.213.93.254 35.213.94.78 35.213.95.145 35.213.96.87 35.213.98.0/24 35.213.99.126 35.213.101.214 35.213.102.0/24 35.213.105.0/24 35.213.106.128/25 35.213.107.158 35.213.109.0/24 35.213.110.40 35.213.111.0/25 35.213.115.0/25 35.213.120.0/24 35.213.122.0/24 35.213.124.89 35.213.125.40 35.213.126.185 35.213.127.0/24 35.213.128.0/22 35.213.132.0/23 35.213.134.140 35.213.135.0/24 35.213.136.0/23 35.213.138.128/25 35.213.139.0/24 35.213.140.0/25 35.213.141.164 35.213.142.128/25 35.213.143.0/24 35.213.144.0/22 35.213.148.0/23 35.213.150.0/24 35.213.152.0/23 35.213.154.137 35.213.155.134 35.213.156.144 35.213.157.0/24 35.213.158.64/26 35.213.160.90 35.213.161.253 35.213.162.0/25 35.213.163.0/24 35.213.164.0/23 35.213.166.106 35.213.167.160/27 35.213.168.0/24 35.213.169.179 35.213.170.0/24 35.213.171.201 35.213.172.159 35.213.173.0/24 35.213.174.128/25 35.213.175.128/26 35.213.176.0/24 35.213.177.0/25 35.213.179.139 35.213.180.0/24 35.213.181.0/25 35.213.182.0/23 35.213.184.0/23 35.213.186.70 35.213.187.0/24 35.213.188.128/25 35.213.190.158 35.213.191.0/24 35.213.192.240/31 35.213.193.74 35.213.194.0/25 35.213.195.178 35.213.196.38 35.213.197.68 35.213.198.0/23 35.213.200.0/23 35.213.202.0/25 35.213.203.195 35.213.204.32/27 35.213.205.170 35.213.20Line truncated
|
||||
|
||||
DNUM=105
|
||||
QNUM_DISCORD=$(($DNUM * 5))
|
||||
DISCORD_SET_NAME=discord
|
||||
|
||||
zapret_custom_daemons()
|
||||
{
|
||||
# $1 - 1 - run, 0 - stop
|
||||
|
||||
local opt="--qnum=$QNUM_DISCORD $NFQWS_OPT_BASE $NFQWS_OPT_DESYNC_DISCORD"
|
||||
run_daemon $DNUM $NFQWS "$opt"
|
||||
}
|
||||
|
||||
zapret_custom_firewall()
|
||||
{
|
||||
# $1 - 1 - run, 0 - stop
|
||||
|
||||
local f
|
||||
local first_packets_only="$ipt_connbytes 1:3"
|
||||
local desync="-m mark ! --mark $DESYNC_MARK/$DESYNC_MARK"
|
||||
local DISCORD_PORTS_IPT=$(replace_char - : $DISCORD_PORTS)
|
||||
local dest_set="-m set --match-set $DISCORD_SET_NAME dst"
|
||||
local subnet
|
||||
|
||||
local DISABLE_IPV6=1
|
||||
|
||||
[ "$1" = 1 ] && {
|
||||
ipset create $DISCORD_SET_NAME hash:net hashsize 8192 maxelem 4096 2>/dev/null
|
||||
ipset flush $DISCORD_SET_NAME
|
||||
for subnet in $DISCORD_SUBNETS; do
|
||||
echo add $DISCORD_SET_NAME $subnet
|
||||
done | ipset -! restore
|
||||
}
|
||||
|
||||
f="-p udp -m multiport --dports $DISCORD_PORTS_IPT"
|
||||
fw_nfqws_post $1 "$f $desync $first_packets_only $dest_set" "" $QNUM_DISCORD
|
||||
|
||||
[ "$1" = 1 ] || {
|
||||
ipset destroy $DISCORD_SET_NAME
|
||||
}
|
||||
}
|
||||
|
||||
zapret_custom_firewall_nft()
|
||||
{
|
||||
# stop logic is not required
|
||||
|
||||
local f
|
||||
local first_packets_only="$nft_connbytes 1-3"
|
||||
local desync="mark and $DESYNC_MARK == 0"
|
||||
local dest_set="ip daddr @$DISCORD_SET_NAME"
|
||||
local subnets
|
||||
|
||||
local DISABLE_IPV6=1
|
||||
|
||||
make_comma_list subnets $DISCORD_SUBNETS
|
||||
nft_create_set $DISCORD_SET_NAME "type ipv4_addr; size 4096; auto-merge; flags interval;"
|
||||
nft_flush_set $DISCORD_SET_NAME
|
||||
nft_add_set_element $DISCORD_SET_NAME "$subnets"
|
||||
|
||||
f="udp dport {$DISCORD_PORTS}"
|
||||
nft_fw_nfqws_post "$f $desync $first_packets_only $dest_set" "" $QNUM_DISCORD
|
||||
}
|
||||
@@ -1,32 +1,25 @@
|
||||
# this custom script in addition to MODE=nfqws runs desync to all QUIC initial packets, without ipset/hostlist filtering
|
||||
# this custom script runs desync to all QUIC initial packets, without ipset/hostlist filtering
|
||||
# need to add to config : NFQWS_OPT_DESYNC_QUIC="--dpi-desync=fake"
|
||||
# NOTE : do not use TTL fooling. chromium QUIC engine breaks sessions if TTL expired in transit received
|
||||
|
||||
QNUM2=$(($QNUM+10))
|
||||
DNUM=102
|
||||
QNUM2=$(($DNUM * 5))
|
||||
|
||||
zapret_custom_daemons()
|
||||
{
|
||||
# $1 - 1 - run, 0 - stop
|
||||
|
||||
local MODE_OVERRIDE=nfqws
|
||||
local opt
|
||||
|
||||
zapret_do_daemons $1
|
||||
|
||||
opt="--qnum=$QNUM2 $NFQWS_OPT_BASE $NFQWS_OPT_DESYNC_QUIC"
|
||||
do_nfqws $1 100 "$opt"
|
||||
local opt="--qnum=$QNUM2 $NFQWS_OPT_BASE $NFQWS_OPT_DESYNC_QUIC"
|
||||
run_daemon $DNUM $NFQWS "$opt"
|
||||
}
|
||||
zapret_custom_firewall()
|
||||
{
|
||||
# $1 - 1 - run, 0 - stop
|
||||
|
||||
local MODE_OVERRIDE=nfqws
|
||||
local f
|
||||
local first_packets_only="$ipt_connbytes 1:3"
|
||||
local desync="-m mark ! --mark $DESYNC_MARK/$DESYNC_MARK"
|
||||
|
||||
zapret_do_firewall_rules_ipt $1
|
||||
|
||||
f="-p udp -m multiport --dports $QUIC_PORTS_IPT"
|
||||
fw_nfqws_post $1 "$f $desync $first_packets_only" "$f $desync $first_packets_only" $QNUM2
|
||||
|
||||
@@ -35,13 +28,10 @@ zapret_custom_firewall_nft()
|
||||
{
|
||||
# stop logic is not required
|
||||
|
||||
local MODE_OVERRIDE=nfqws
|
||||
local f
|
||||
local first_packets_only="$nft_connbytes 1-3"
|
||||
local desync="mark and $DESYNC_MARK == 0"
|
||||
|
||||
zapret_apply_firewall_rules_nft
|
||||
|
||||
f="udp dport {$QUIC_PORTS}"
|
||||
nft_fw_nfqws_post "$f $desync $first_packets_only" "$f $desync $first_packets_only" $QNUM2
|
||||
}
|
||||
+4
-2
@@ -3,7 +3,7 @@
|
||||
|
||||
zapret_custom_daemons()
|
||||
{
|
||||
# stop logic is managed by procd
|
||||
# $1 - 1 - run, 0 - stop
|
||||
|
||||
local opt
|
||||
|
||||
@@ -15,7 +15,7 @@ zapret_custom_daemons()
|
||||
}
|
||||
|
||||
[ "$MODE_HTTPS" = "1" ] && {
|
||||
opt="--qnum=$QNUM $NFQWS_OPT_BASE $NFQWS_OPT_DESYNC_HTTPS"
|
||||
opt="--qnum=$QNUM $NFQWS_OPT_DESYNC_HTTPS"
|
||||
filter_apply_hostlist_target opt
|
||||
filter_apply_suffix opt "$NFQWS_OPT_DESYNC_HTTPS_SUFFIX"
|
||||
run_daemon 2 $NFQWS "$opt"
|
||||
@@ -41,6 +41,8 @@ zapret_custom_firewall()
|
||||
f6=$f4
|
||||
filter_apply_ipset_target f4 f6
|
||||
fw_nfqws_post $1 "$f4 $desync" "$f6 $desync" $QNUM
|
||||
# for modes that require incoming traffic
|
||||
fw_reverse_nfqws_rule $1 "$f4" "$f6" $QNUM
|
||||
}
|
||||
}
|
||||
zapret_custom_firewall_nft()
|
||||
Whitespace-only changes.
@@ -1,33 +0,0 @@
|
||||
# this script contain your special code to launch daemons and configure firewall
|
||||
# use helpers from "functions" file and "zapret" init script
|
||||
# in case of upgrade keep this file only, do not modify others
|
||||
|
||||
zapret_custom_daemons()
|
||||
{
|
||||
# stop logic is managed by procd
|
||||
|
||||
# PLACEHOLDER
|
||||
echo !!! NEED ATTENTION !!!
|
||||
echo Start daemon\(s\)
|
||||
echo Study how other sections work
|
||||
|
||||
run_daemon 1 /bin/sleep 20
|
||||
}
|
||||
zapret_custom_firewall()
|
||||
{
|
||||
# $1 - 1 - run, 0 - stop
|
||||
|
||||
# PLACEHOLDER
|
||||
echo !!! NEED ATTENTION !!!
|
||||
echo Configure iptables for required actions
|
||||
echo Study how other sections work
|
||||
}
|
||||
zapret_custom_firewall_nft()
|
||||
{
|
||||
# stop logic is not required
|
||||
|
||||
# PLACEHOLDER
|
||||
echo !!! NEED ATTENTION !!!
|
||||
echo Configure nftables for required actions
|
||||
echo Study how other sections work
|
||||
}
|
||||
@@ -12,6 +12,8 @@ ZAPRET_CONFIG=${ZAPRET_CONFIG:-"$ZAPRET_RW/config"}
|
||||
. "$ZAPRET_BASE/common/nft.sh"
|
||||
. "$ZAPRET_BASE/common/linux_fw.sh"
|
||||
. "$ZAPRET_BASE/common/list.sh"
|
||||
. "$ZAPRET_BASE/common/custom.sh"
|
||||
CUSTOM_DIR="$ZAPRET_RW/init.d/openwrt"
|
||||
|
||||
[ -n "$QNUM" ] || QNUM=200
|
||||
[ -n "$TPPORT" ] || TPPORT=988
|
||||
@@ -27,9 +29,6 @@ LINKLOCAL_WAIT_SEC=5
|
||||
|
||||
IPSET_CR="$ZAPRET_BASE/ipset/create_ipset.sh"
|
||||
|
||||
CUSTOM_SCRIPT="$ZAPRET_BASE/init.d/openwrt/custom"
|
||||
[ -f "$CUSTOM_SCRIPT" ] && . "$CUSTOM_SCRIPT"
|
||||
|
||||
IPSET_EXCLUDE="-m set ! --match-set nozapret"
|
||||
IPSET_EXCLUDE6="-m set ! --match-set nozapret6"
|
||||
|
||||
|
||||
@@ -173,7 +173,7 @@ start_daemons_procd()
|
||||
}
|
||||
;;
|
||||
custom)
|
||||
existf zapret_custom_daemons && zapret_custom_daemons $1
|
||||
custom_runner zapret_custom_daemons $1
|
||||
;;
|
||||
esac
|
||||
|
||||
|
||||
@@ -1,47 +0,0 @@
|
||||
# this custom script demonstrates how to reuse built-in modes and add something from yourself
|
||||
|
||||
MY_TPPORT=$(($TPPORT + 1))
|
||||
MY_TPWS_OPT="--methodeol --hostcase"
|
||||
MY_DPORT=81
|
||||
|
||||
zapret_custom_daemons()
|
||||
{
|
||||
# $1 - 1 - run, 0 - stop
|
||||
|
||||
local MODE_OVERRIDE=tpws
|
||||
local opt
|
||||
|
||||
zapret_do_daemons $1
|
||||
|
||||
opt="--port=$MY_TPPORT $MY_TPWS_OPT"
|
||||
filter_apply_hostlist_target opt
|
||||
do_tpws $1 100 "$opt"
|
||||
}
|
||||
zapret_custom_firewall()
|
||||
{
|
||||
# $1 - 1 - run, 0 - stop
|
||||
|
||||
local MODE_OVERRIDE=tpws
|
||||
local f4 f6
|
||||
|
||||
zapret_do_firewall_rules_ipt $1
|
||||
|
||||
f4="-p tcp --dport $MY_DPORT"
|
||||
f6=$f4
|
||||
filter_apply_ipset_target f4 f6
|
||||
fw_tpws $1 "$f4" "$f6" $MY_TPPORT
|
||||
}
|
||||
zapret_custom_firewall_nft()
|
||||
{
|
||||
# stop logic is not required
|
||||
|
||||
local MODE_OVERRIDE=tpws
|
||||
local f4 f6
|
||||
|
||||
zapret_apply_firewall_rules_nft
|
||||
|
||||
f4="tcp dport $MY_DPORT"
|
||||
f6=$f4
|
||||
nft_filter_apply_ipset_target f4 f6
|
||||
nft_fw_tpws "$f4" "$f6" $MY_TPPORT
|
||||
}
|
||||
@@ -0,0 +1,22 @@
|
||||
# this custom script applies nfqws mode as it would be with MODE=nfqws
|
||||
|
||||
OVERRIDE=nfqws
|
||||
|
||||
zapret_custom_daemons()
|
||||
{
|
||||
# $1 - 1 - run, 0 - stop
|
||||
|
||||
MODE_OVERRIDE=$OVERRIDE zapret_do_daemons $1
|
||||
}
|
||||
zapret_custom_firewall()
|
||||
{
|
||||
# $1 - 1 - run, 0 - stop
|
||||
|
||||
MODE_OVERRIDE=$OVERRIDE zapret_do_firewall_rules_ipt $1
|
||||
}
|
||||
zapret_custom_firewall_nft()
|
||||
{
|
||||
# stop logic is not required
|
||||
|
||||
MODE_OVERRIDE=$OVERRIDE zapret_apply_firewall_rules_nft
|
||||
}
|
||||
@@ -0,0 +1,22 @@
|
||||
# this custom script applies tpws mode as it would be with MODE=tpws
|
||||
|
||||
OVERRIDE=tpws
|
||||
|
||||
zapret_custom_daemons()
|
||||
{
|
||||
# $1 - 1 - run, 0 - stop
|
||||
|
||||
MODE_OVERRIDE=$OVERRIDE zapret_do_daemons $1
|
||||
}
|
||||
zapret_custom_firewall()
|
||||
{
|
||||
# $1 - 1 - run, 0 - stop
|
||||
|
||||
MODE_OVERRIDE=$OVERRIDE zapret_do_firewall_rules_ipt $1
|
||||
}
|
||||
zapret_custom_firewall_nft()
|
||||
{
|
||||
# stop logic is not required
|
||||
|
||||
MODE_OVERRIDE=$OVERRIDE zapret_apply_firewall_rules_nft
|
||||
}
|
||||
@@ -0,0 +1,22 @@
|
||||
# this custom script applies tpws-socks mode as it would be with MODE=tpws-socks
|
||||
|
||||
OVERRIDE=tpws-socks
|
||||
|
||||
zapret_custom_daemons()
|
||||
{
|
||||
# $1 - 1 - run, 0 - stop
|
||||
|
||||
MODE_OVERRIDE=$OVERRIDE zapret_do_daemons $1
|
||||
}
|
||||
zapret_custom_firewall()
|
||||
{
|
||||
# $1 - 1 - run, 0 - stop
|
||||
|
||||
MODE_OVERRIDE=$OVERRIDE zapret_do_firewall_rules_ipt $1
|
||||
}
|
||||
zapret_custom_firewall_nft()
|
||||
{
|
||||
# stop logic is not required
|
||||
|
||||
MODE_OVERRIDE=$OVERRIDE zapret_apply_firewall_rules_nft
|
||||
}
|
||||
@@ -1,47 +1,39 @@
|
||||
# this custom script in addition to MODE=nfqws runs desync to DHT packets with udp payload length 101..399 , without ipset/hostlist filtering
|
||||
# this custom script runs desync to DHT packets with udp payload length 101..399 , without ipset/hostlist filtering
|
||||
# need to add to config : NFQWS_OPT_DESYNC_DHT="--dpi-desync=fake --dpi-desync-ttl=5"
|
||||
|
||||
QNUM2=$(($QNUM+20))
|
||||
DNUM=101
|
||||
QNUM2=$(($DNUM * 5))
|
||||
|
||||
zapret_custom_daemons()
|
||||
{
|
||||
# stop logic is managed by procd
|
||||
|
||||
local MODE_OVERRIDE=nfqws
|
||||
local opt
|
||||
|
||||
start_daemons_procd
|
||||
|
||||
opt="--qnum=$QNUM2 $NFQWS_OPT_BASE $NFQWS_OPT_DESYNC_DHT"
|
||||
run_daemon 100 $NFQWS "$opt"
|
||||
local opt="--qnum=$QNUM2 $NFQWS_OPT_BASE $NFQWS_OPT_DESYNC_DHT"
|
||||
do_nfqws $1 $DNUM "$opt"
|
||||
}
|
||||
zapret_custom_firewall()
|
||||
{
|
||||
# $1 - 1 - run, 0 - stop
|
||||
|
||||
local MODE_OVERRIDE=nfqws
|
||||
local f uf4 uf6
|
||||
local first_packet_only="$ipt_connbytes 1:1"
|
||||
local desync="-m mark ! --mark $DESYNC_MARK/$DESYNC_MARK"
|
||||
|
||||
zapret_do_firewall_rules_ipt $1
|
||||
|
||||
f='-p udp -m length --length 109:407 -m u32 --u32'
|
||||
uf4='0>>22&0x3C@8>>16=0x6431'
|
||||
uf6='48>>16=0x6431'
|
||||
fw_nfqws_post $1 "$f $uf4 $desync $first_packet_only" "$f $uf6 $desync $first_packet_only" $QNUM2
|
||||
|
||||
}
|
||||
zapret_custom_firewall_nft()
|
||||
{
|
||||
# stop logic is not required
|
||||
|
||||
local MODE_OVERRIDE=nfqws
|
||||
local f
|
||||
local first_packet_only="$nft_connbytes 1"
|
||||
local desync="mark and $DESYNC_MARK == 0"
|
||||
|
||||
zapret_apply_firewall_rules_nft
|
||||
|
||||
f="meta length 109-407 meta l4proto udp @th,64,16 0x6431"
|
||||
nft_fw_nfqws_post "$f $desync $first_packet_only" "$f $desync $first_packet_only" $QNUM2
|
||||
}
|
||||
|
||||
@@ -0,0 +1,69 @@
|
||||
# this custom script in addition to MODE=nfqws runs desync of some udp packets to discord subnets
|
||||
# idea taken from community. not tested and not optimized by author.
|
||||
|
||||
# can override in config :
|
||||
NFQWS_OPT_DESYNC_DISCORD="${NFQWS_OPT_DESYNC_DISCORD:---dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-any-protocol}"
|
||||
DISCORD_PORTS=${DISCORD_PORTS:-50000-65535}
|
||||
DISCORD_SUBNETS="${DISCORD_SUBNETS:-5.200.14.249 18.165.140.0/25 23.227.38.74 34.0.48.0/24 34.0.49.64/26 34.0.50.0/25 34.0.51.0/24 34.0.52.0/22 34.0.56.0/23 34.0.59.0/24 34.0.60.0/24 34.0.62.128/25 34.0.63.228 34.0.64.0/23 34.0.66.130 34.0.82.140 34.0.129.128/25 34.0.130.0/24 34.0.131.130 34.0.132.139 34.0.133.75 34.0.134.0/24 34.0.135.251 34.0.136.51 34.0.137.0/24 34.0.139.0/24 34.0.140.0/23 34.0.142.0/25 34.0.144.0/23 34.0.146.0/24 34.0.148.25 34.0.149.101 34.0.151.0/25 34.0.153.0/24 34.0.155.0/24 34.0.156.101 34.0.157.0/25 34.0.158.247 34.0.159.188 34.0.192.0/25 34.0.193.0/24 34.0.194.0/24 34.0.195.172 34.0.196.200/29 34.0.197.81 34.0.198.25 34.0.199.0/24 34.0.200.0/24 34.0.201.81 34.0.202.34 34.0.203.0/24 34.0.204.0/23 34.0.206.0/25 34.0.207.0/25 34.0.208.195 34.0.209.0/24 34.0.210.20 34.0.211.0/26 34.0.212.0/24 34.0.213.64/26 34.0.215.128/25 34.0.216.238 34.0.217.0/24 34.0.218.83 34.0.220.103 34.0.221.0/24 34.0.222.193 34.0.223.68 34.0.227.0/24 34.0.240.0/21 34.0.248.0/23 34.0.250.0/24 34.0.251.0/25 34.1.216.0/24 34.1.221.166 35.207.64.0/23 35.207.67.116 35.207.71.0/24 35.207.72.32 35.207.73.0/24 35.207.74.0/24 35.207.75.128/25 35.207.76.128/26 35.207.77.0/24 35.207.78.129 35.207.79.0/24 35.207.80.76 35.207.81.248/30 35.207.82.0/23 35.207.84.0/24 35.207.85.160 35.207.86.41 35.207.87.184 35.207.89.188 35.207.91.146 35.207.92.230 35.207.95.0/24 35.207.97.174 35.207.99.134 35.207.100.64/26 35.207.101.130 35.207.103.64/26 35.207.104.0/24 35.207.106.128/26 35.207.107.19 35.207.108.192/27 35.207.109.185 35.207.110.0/24 35.207.111.174 35.207.114.16 35.207.115.163 35.207.116.51 35.207.117.0/24 35.207.121.204 35.207.122.0/25 35.207.124.145 35.207.125.116 35.207.126.30 35.207.129.0/24 35.207.131.128/27 35.207.132.247 35.207.135.147 35.207.136.69 35.207.137.0/24 35.207.139.0/24 35.207.140.241 35.207.141.119 35.207.142.0/24 35.207.143.96/27 35.207.144.0/25 35.207.145.0/24 35.207.146.89 35.207.147.0/24 35.207.149.0/24 35.207.150.0/24 35.207.151.61 35.207.153.117 35.207.154.0/24 35.207.155.128/25 35.207.156.254 35.207.157.7 35.207.158.192 35.207.160.160 35.207.162.239 35.207.163.0/24 35.207.164.0/25 35.207.165.147 35.207.166.0/25 35.207.167.0/24 35.207.168.116 35.207.170.0/23 35.207.172.0/24 35.207.174.55 35.207.176.128/25 35.207.178.0/24 35.207.180.152 35.207.181.76 35.207.182.125 35.207.184.101 35.207.185.192 35.207.186.128/25 35.207.187.228 35.207.188.0/24 35.207.189.0/25 35.207.190.194 35.207.191.64/26 35.207.193.165 35.207.195.75 35.207.196.0/24 35.207.198.0/23 35.207.201.186 35.207.202.169 35.207.205.211 35.207.207.4 35.207.209.0/25 35.207.210.191 35.207.211.253 35.207.213.97 35.207.214.0/24 35.207.220.147 35.207.221.58 35.207.222.105 35.207.224.151 35.207.225.210 35.207.227.0/24 35.207.229.212 35.207.232.26 35.207.234.182 35.207.238.0/24 35.207.240.0/24 35.207.245.0/24 35.207.249.0/24 35.207.250.212 35.207.251.0/27 35.212.4.134 35.212.12.148 35.212.88.11 35.212.102.50 35.212.111.0/26 35.212.117.247 35.212.120.122 35.213.0.0/24 35.213.2.8 35.213.4.185 35.213.6.118 35.213.7.128/25 35.213.8.168 35.213.10.0/24 35.213.11.21 35.213.12.224/27 35.213.13.19 35.213.14.217 35.213.16.67 35.213.17.235 35.213.23.166 35.213.25.164 35.213.26.62 35.213.27.252 35.213.32.0/24 35.213.33.74 35.213.34.204 35.213.37.81 35.213.38.186 35.213.39.253 35.213.42.0/24 35.213.43.79 35.213.45.0/24 35.213.46.136 35.213.49.17 35.213.50.0/24 35.213.51.213 35.213.52.0/25 35.213.53.0/24 35.213.54.0/24 35.213.56.0/25 35.213.59.0/24 35.213.61.58 35.213.65.0/24 35.213.67.0/24 35.213.68.192/26 35.213.70.151 35.213.72.128/25 35.213.73.245 35.213.74.131 35.213.78.0/24 35.213.79.137 35.213.80.0/25 35.213.83.128/25 35.213.84.245 35.213.85.0/24 35.213.88.145 35.213.89.80/28 35.213.90.0/24 35.213.91.195 35.213.92.0/24 35.213.93.254 35.213.94.78 35.213.95.145 35.213.96.87 35.213.98.0/24 35.213.99.126 35.213.101.214 35.213.102.0/24 35.213.105.0/24 35.213.106.128/25 35.213.107.158 35.213.109.0/24 35.213.110.40 35.213.111.0/25 35.213.115.0/25 35.213.120.0/24 35.213.122.0/24 35.213.124.89 35.213.125.40 35.213.126.185 35.213.127.0/24 35.213.128.0/22 35.213.132.0/23 35.213.134.140 35.213.135.0/24 35.213.136.0/23 35.213.138.128/25 35.213.139.0/24 35.213.140.0/25 35.213.141.164 35.213.142.128/25 35.213.143.0/24 35.213.144.0/22 35.213.148.0/23 35.213.150.0/24 35.213.152.0/23 35.213.154.137 35.213.155.134 35.213.156.144 35.213.157.0/24 35.213.158.64/26 35.213.160.90 35.213.161.253 35.213.162.0/25 35.213.163.0/24 35.213.164.0/23 35.213.166.106 35.213.167.160/27 35.213.168.0/24 35.213.169.179 35.213.170.0/24 35.213.171.201 35.213.172.159 35.213.173.0/24 35.213.174.128/25 35.213.175.128/26 35.213.176.0/24 35.213.177.0/25 35.213.179.139 35.213.180.0/24 35.213.181.0/25 35.213.182.0/23 35.213.184.0/23 35.213.186.70 35.213.187.0/24 35.213.188.128/25 35.213.190.158 35.213.191.0/24 35.213.192.240/31 35.213.193.74 35.213.194.0/25 35.213.195.178 35.213.196.38 35.213.197.68 35.213.198.0/23 35.213.200.0/23 35.213.202.0/25 35.213.203.195 35.213.204.32/27 35.213.205.170 35.213.20Line truncated
|
||||
|
||||
DNUM=105
|
||||
QNUM_DISCORD=$(($DNUM * 5))
|
||||
DISCORD_SET_NAME=discord
|
||||
|
||||
zapret_custom_daemons()
|
||||
{
|
||||
# $1 - 1 - run, 0 - stop
|
||||
|
||||
local opt="--qnum=$QNUM_DISCORD $NFQWS_OPT_BASE $NFQWS_OPT_DESYNC_DISCORD"
|
||||
do_nfqws $1 $DNUM "$opt"
|
||||
}
|
||||
|
||||
zapret_custom_firewall()
|
||||
{
|
||||
# $1 - 1 - run, 0 - stop
|
||||
|
||||
local f
|
||||
local first_packets_only="$ipt_connbytes 1:3"
|
||||
local desync="-m mark ! --mark $DESYNC_MARK/$DESYNC_MARK"
|
||||
local DISCORD_PORTS_IPT=$(replace_char - : $DISCORD_PORTS)
|
||||
local dest_set="-m set --match-set $DISCORD_SET_NAME dst"
|
||||
local subnet
|
||||
|
||||
local DISABLE_IPV6=1
|
||||
|
||||
[ "$1" = 1 ] && {
|
||||
ipset create $DISCORD_SET_NAME hash:net hashsize 8192 maxelem 4096 2>/dev/null
|
||||
ipset flush $DISCORD_SET_NAME
|
||||
for subnet in $DISCORD_SUBNETS; do
|
||||
echo add $DISCORD_SET_NAME $subnet
|
||||
done | ipset -! restore
|
||||
}
|
||||
|
||||
f="-p udp -m multiport --dports $DISCORD_PORTS_IPT"
|
||||
fw_nfqws_post $1 "$f $desync $first_packets_only $dest_set" "" $QNUM_DISCORD
|
||||
|
||||
[ "$1" = 1 ] || {
|
||||
ipset destroy $DISCORD_SET_NAME
|
||||
}
|
||||
}
|
||||
|
||||
zapret_custom_firewall_nft()
|
||||
{
|
||||
# stop logic is not required
|
||||
|
||||
local f
|
||||
local first_packets_only="$nft_connbytes 1-3"
|
||||
local desync="mark and $DESYNC_MARK == 0"
|
||||
local dest_set="ip daddr @$DISCORD_SET_NAME"
|
||||
local subnets
|
||||
|
||||
local DISABLE_IPV6=1
|
||||
|
||||
make_comma_list subnets $DISCORD_SUBNETS
|
||||
nft_create_set $DISCORD_SET_NAME "type ipv4_addr; size 4096; auto-merge; flags interval;"
|
||||
nft_flush_set $DISCORD_SET_NAME
|
||||
nft_add_set_element $DISCORD_SET_NAME "$subnets"
|
||||
|
||||
f="udp dport {$DISCORD_PORTS}"
|
||||
nft_fw_nfqws_post "$f $desync $first_packets_only $dest_set" "" $QNUM_DISCORD
|
||||
}
|
||||
@@ -1,32 +1,25 @@
|
||||
# this custom script in addition to MODE=nfqws runs desync to all QUIC initial packets, without ipset/hostlist filtering
|
||||
# this custom script runs desync to all QUIC initial packets, without ipset/hostlist filtering
|
||||
# need to add to config : NFQWS_OPT_DESYNC_QUIC="--dpi-desync=fake"
|
||||
# NOTE : do not use TTL fooling. chromium QUIC engine breaks sessions if TTL expired in transit received
|
||||
|
||||
QNUM2=$(($QNUM+10))
|
||||
DNUM=102
|
||||
QNUM2=$(($DNUM * 5))
|
||||
|
||||
zapret_custom_daemons()
|
||||
{
|
||||
# stop logic is managed by procd
|
||||
# $1 - 1 - run, 0 - stop
|
||||
|
||||
local MODE_OVERRIDE=nfqws
|
||||
local opt
|
||||
|
||||
start_daemons_procd
|
||||
|
||||
opt="--qnum=$QNUM2 $NFQWS_OPT_BASE $NFQWS_OPT_DESYNC_QUIC"
|
||||
run_daemon 100 $NFQWS "$opt"
|
||||
local opt="--qnum=$QNUM2 $NFQWS_OPT_BASE $NFQWS_OPT_DESYNC_QUIC"
|
||||
do_nfqws $1 $DNUM "$opt"
|
||||
}
|
||||
zapret_custom_firewall()
|
||||
{
|
||||
# $1 - 1 - run, 0 - stop
|
||||
|
||||
local MODE_OVERRIDE=nfqws
|
||||
local f
|
||||
local first_packets_only="$ipt_connbytes 1:3"
|
||||
local desync="-m mark ! --mark $DESYNC_MARK/$DESYNC_MARK"
|
||||
|
||||
zapret_do_firewall_rules_ipt $1
|
||||
|
||||
f="-p udp -m multiport --dports $QUIC_PORTS_IPT"
|
||||
fw_nfqws_post $1 "$f $desync $first_packets_only" "$f $desync $first_packets_only" $QNUM2
|
||||
|
||||
@@ -35,13 +28,10 @@ zapret_custom_firewall_nft()
|
||||
{
|
||||
# stop logic is not required
|
||||
|
||||
local MODE_OVERRIDE=nfqws
|
||||
local f
|
||||
local first_packets_only="$nft_connbytes 1-3"
|
||||
local desync="mark and $DESYNC_MARK == 0"
|
||||
|
||||
zapret_apply_firewall_rules_nft
|
||||
|
||||
f="udp dport {$QUIC_PORTS}"
|
||||
nft_fw_nfqws_post "$f $desync $first_packets_only" "$f $desync $first_packets_only" $QNUM2
|
||||
}
|
||||
File renamed without changes.
Whitespace-only changes.
@@ -1,34 +0,0 @@
|
||||
# this script contain your special code to launch daemons and configure firewall
|
||||
# use helpers from "functions" file
|
||||
# in case of upgrade keep this file only, do not modify others
|
||||
|
||||
zapret_custom_daemons()
|
||||
{
|
||||
# $1 - 1 - run, 0 - stop
|
||||
|
||||
# PLACEHOLDER
|
||||
echo !!! NEED ATTENTION !!!
|
||||
echo Start daemon\(s\)
|
||||
echo Study how other sections work
|
||||
|
||||
do_daemon $1 1 /bin/sleep 20
|
||||
}
|
||||
zapret_custom_firewall()
|
||||
{
|
||||
# $1 - 1 - run, 0 - stop
|
||||
|
||||
# PLACEHOLDER
|
||||
echo !!! NEED ATTENTION !!!
|
||||
echo Configure iptables for required actions
|
||||
echo Study how other sections work
|
||||
}
|
||||
|
||||
zapret_custom_firewall_nft()
|
||||
{
|
||||
# stop logic is not required
|
||||
|
||||
# PLACEHOLDER
|
||||
echo !!! NEED ATTENTION !!!
|
||||
echo Configure nftables for required actions
|
||||
echo Study how other sections work
|
||||
}
|
||||
@@ -12,6 +12,8 @@ ZAPRET_CONFIG=${ZAPRET_CONFIG:-"$ZAPRET_RW/config"}
|
||||
. "$ZAPRET_BASE/common/nft.sh"
|
||||
. "$ZAPRET_BASE/common/linux_fw.sh"
|
||||
. "$ZAPRET_BASE/common/list.sh"
|
||||
. "$ZAPRET_BASE/common/custom.sh"
|
||||
CUSTOM_DIR="$ZAPRET_RW/init.d/sysv"
|
||||
|
||||
|
||||
user_exists()
|
||||
@@ -91,9 +93,6 @@ TPWS_OPT_BASE6_PRE="--bind-linklocal=prefer $TPWS_WAIT --bind-wait-ip-linklocal=
|
||||
# max wait time for the link local ipv6 on the LAN interface
|
||||
LINKLOCAL_WAIT_SEC=5
|
||||
|
||||
CUSTOM_SCRIPT="$ZAPRET_BASE/init.d/sysv/custom"
|
||||
[ -f "$CUSTOM_SCRIPT" ] && . "$CUSTOM_SCRIPT"
|
||||
|
||||
IPSET_EXCLUDE="-m set ! --match-set nozapret"
|
||||
IPSET_EXCLUDE6="-m set ! --match-set nozapret6"
|
||||
|
||||
@@ -341,7 +340,7 @@ zapret_do_daemons()
|
||||
}
|
||||
;;
|
||||
custom)
|
||||
existf zapret_custom_daemons && zapret_custom_daemons $1
|
||||
custom_runner zapret_custom_daemons $1
|
||||
;;
|
||||
esac
|
||||
|
||||
|
||||
Reference in new issue
Block a user