|
|
@@ -6,13 +6,11 @@
|
|
|
# This is free software, licensed under the GNU General Public License v3.
|
|
|
# See /LICENSE for more information.
|
|
|
#
|
|
|
-
|
|
|
TAG="_SS_SPEC_RULE_" # comment tag
|
|
|
IPT="iptables -t nat" # alias of iptables
|
|
|
FWI=$(uci get firewall.shadowsocksr.path 2>/dev/null) # firewall include file
|
|
|
-
|
|
|
usage() {
|
|
|
- cat <<-EOF
|
|
|
+cat <<-EOF
|
|
|
Usage: ssr-rules [options]
|
|
|
|
|
|
Valid options are:
|
|
|
@@ -33,6 +31,7 @@ Valid options are:
|
|
|
-F netflix mode
|
|
|
-N netflix server IP
|
|
|
-M netflix proxy mode
|
|
|
+ -I <ip_list_file> a file content is bypassed netflix ip list
|
|
|
-e <extra_options> extra options for iptables
|
|
|
-o apply the rules to the OUTPUT chain
|
|
|
-O apply the global rules to the OUTPUT chain
|
|
|
@@ -43,8 +42,8 @@ Valid options are:
|
|
|
-g gfw list mode
|
|
|
-r return china mode
|
|
|
-h show this help message and exit
|
|
|
- EOF
|
|
|
- exit $1
|
|
|
+EOF
|
|
|
+exit $1
|
|
|
}
|
|
|
|
|
|
loger() {
|
|
|
@@ -82,7 +81,8 @@ flush_r() {
|
|
|
ipset_r() {
|
|
|
ipset -N gmlan hash:net 2>/dev/null
|
|
|
for ip in $LAN_GM_IP; do ipset -! add gmlan $ip; done
|
|
|
- if [ "$RUNMODE" == "router" ]; then
|
|
|
+ case "$RUNMODE" in
|
|
|
+ router)
|
|
|
ipset -! -R <<-EOF || return 1
|
|
|
create ss_spec_wan_ac hash:net
|
|
|
$(gen_iplist | sed -e "s/^/add ss_spec_wan_ac /")
|
|
|
@@ -92,25 +92,29 @@ ipset_r() {
|
|
|
$IPT -I SS_SPEC_WAN_AC -p tcp ! --dport 53 -d $server -j RETURN
|
|
|
$IPT -A SS_SPEC_WAN_AC -m set --match-set ss_spec_wan_ac dst -j RETURN
|
|
|
$IPT -A SS_SPEC_WAN_AC -j SS_SPEC_WAN_FW
|
|
|
- elif [ "$RUNMODE" == "gfw" ]; then
|
|
|
+ ;;
|
|
|
+ gfw)
|
|
|
ipset -N gfwlist hash:net 2>/dev/null
|
|
|
$IPT -N SS_SPEC_WAN_AC
|
|
|
$IPT -A SS_SPEC_WAN_AC -m set --match-set gfwlist dst -j SS_SPEC_WAN_FW
|
|
|
$IPT -A SS_SPEC_WAN_AC -m set --match-set gmlan src -m set ! --match-set china dst -j SS_SPEC_WAN_FW
|
|
|
$IPT -A SS_SPEC_WAN_AC -m set --match-set china dst -j RETURN
|
|
|
$IPT -I SS_SPEC_WAN_AC -p tcp ! --dport 53 -d $server -j RETURN
|
|
|
- elif [ "$RUNMODE" == "oversea" ]; then
|
|
|
+ ;;
|
|
|
+ oversea)
|
|
|
ipset -N oversea hash:net 2>/dev/null
|
|
|
$IPT -N SS_SPEC_WAN_AC
|
|
|
ipset -N gmlan hash:net 2>/dev/null
|
|
|
for ip in $LAN_GM_IP; do ipset -! add gmlan $ip; done
|
|
|
$IPT -A SS_SPEC_WAN_AC -m set --match-set china dst -j SS_SPEC_WAN_FW
|
|
|
$IPT -I SS_SPEC_WAN_AC -p tcp ! --dport 53 -d $server -j RETURN
|
|
|
- elif [ "$RUNMODE" == "all" ]; then
|
|
|
+ ;;
|
|
|
+ all)
|
|
|
$IPT -N SS_SPEC_WAN_AC
|
|
|
$IPT -A SS_SPEC_WAN_AC -j SS_SPEC_WAN_FW
|
|
|
$IPT -I SS_SPEC_WAN_AC -p tcp ! --dport 53 -d $server -j RETURN
|
|
|
- fi
|
|
|
+ ;;
|
|
|
+ esac
|
|
|
ipset -N fplan hash:net 2>/dev/null
|
|
|
for ip in $LAN_FP_IP; do ipset -! add fplan $ip; done
|
|
|
$IPT -I SS_SPEC_WAN_AC -m set --match-set fplan src -j SS_SPEC_WAN_FW
|
|
|
@@ -123,23 +127,25 @@ ipset_r() {
|
|
|
$IPT -I SS_SPEC_WAN_AC -m set --match-set whitelist dst -j RETURN
|
|
|
for ip in $WAN_BP_IP; do ipset -! add whitelist $ip; done
|
|
|
for ip in $WAN_FW_IP; do ipset -! add blacklist $ip; done
|
|
|
-
|
|
|
- if [ "$NETFLIX" == "1" ]; then
|
|
|
+ if [ "$NETFLIX" != "0" ]; then
|
|
|
+ ipset -N netflix hash:net 2>/dev/null
|
|
|
+ for ip in $(cat ${NETFLIX_LIST:=/dev/null} 2>/dev/null); do ipset -! add netflix $ip; done
|
|
|
+ fi
|
|
|
+ case "$NETFLIX" in
|
|
|
+ 1)
|
|
|
$IPT -I SS_SPEC_WAN_AC -p tcp -m set --match-set netflix dst -j REDIRECT --to-ports 4321
|
|
|
if [ "$NETFLIX_PROXY" == "1" ]; then
|
|
|
$IPT -I SS_SPEC_WAN_AC -p tcp -d $NETFLIX_IP -j REDIRECT --to-ports $local_port
|
|
|
else
|
|
|
ipset -! add whitelist $NETFLIX_IP
|
|
|
fi
|
|
|
- elif [ "$NETFLIX" == "2" ]; then
|
|
|
- $IPT -I SS_SPEC_WAN_AC -p tcp -m set --match-set netflix dst -j REDIRECT --to-ports $local_port
|
|
|
- fi
|
|
|
-
|
|
|
+ ;;
|
|
|
+ 2) $IPT -I SS_SPEC_WAN_AC -p tcp -m set --match-set netflix dst -j REDIRECT --to-ports $local_port ;;
|
|
|
+ esac
|
|
|
return $?
|
|
|
}
|
|
|
|
|
|
fw_rule() {
|
|
|
- ipset -N netflix hash:net 2>/dev/null
|
|
|
$IPT -N SS_SPEC_WAN_FW
|
|
|
$IPT -A SS_SPEC_WAN_FW -d 0.0.0.0/8 -j RETURN
|
|
|
$IPT -A SS_SPEC_WAN_FW -d 10.0.0.0/8 -j RETURN
|
|
|
@@ -216,23 +222,26 @@ tp_rule() {
|
|
|
$ipt -A SS_SPEC_TPROXY -p udp -m set --match-set bplan src -j RETURN
|
|
|
$ipt -A SS_SPEC_TPROXY -p udp $PROXY_PORTS -m set --match-set fplan src \
|
|
|
-j TPROXY --on-port "$LOCAL_PORT" --tproxy-mark 0x01/0x01
|
|
|
- if [ "$RUNMODE" == "router" ]; then
|
|
|
+ case "$RUNMODE" in
|
|
|
+ router)
|
|
|
$ipt -A SS_SPEC_TPROXY -p udp -m set --match-set gmlan src -m set ! --match-set china dst \
|
|
|
-j TPROXY --on-port "$LOCAL_PORT" --tproxy-mark 0x01/0x01
|
|
|
$ipt -A SS_SPEC_TPROXY -p udp $PROXY_PORTS -m set ! --match-set ss_spec_wan_ac dst \
|
|
|
-j TPROXY --on-port "$LOCAL_PORT" --tproxy-mark 0x01/0x01
|
|
|
- elif [ "$RUNMODE" == "gfw" ]; then
|
|
|
+ ;;
|
|
|
+ gfw)
|
|
|
$ipt -A SS_SPEC_TPROXY -p udp -m set --match-set china dst -j RETURN
|
|
|
$ipt -A SS_SPEC_TPROXY -p udp -m set --match-set gmlan src -m set ! --match-set china dst \
|
|
|
-j TPROXY --on-port "$LOCAL_PORT" --tproxy-mark 0x01/0x01
|
|
|
$ipt -A SS_SPEC_TPROXY -p udp -m set $PROXY_PORTS --match-set gfwlist dst \
|
|
|
-j TPROXY --on-port "$LOCAL_PORT" --tproxy-mark 0x01/0x01
|
|
|
- elif [ "$RUNMODE" == "oversea" ]; then
|
|
|
+ ;;
|
|
|
+ oversea)
|
|
|
$ipt -A SS_SPEC_TPROXY -p udp $PROXY_PORTS -m set --match-set china dst \
|
|
|
-j TPROXY --on-port "$LOCAL_PORT" --tproxy-mark 0x01/0x01
|
|
|
- elif [ "$RUNMODE" == "all" ]; then
|
|
|
- $ipt -A SS_SPEC_TPROXY -p udp $PROXY_PORTS -j TPROXY --on-port "$LOCAL_PORT" --tproxy-mark 0x01/0x01
|
|
|
- fi
|
|
|
+ ;;
|
|
|
+ all) $ipt -A SS_SPEC_TPROXY -p udp $PROXY_PORTS -j TPROXY --on-port "$LOCAL_PORT" --tproxy-mark 0x01/0x01 ;;
|
|
|
+ esac
|
|
|
$ipt -I PREROUTING 1 ${IFNAME:+-i $IFNAME} -p udp $EXT_ARGS $MATCH_SET \
|
|
|
-m comment --comment "$TAG" -j SS_SPEC_TPROXY
|
|
|
return $?
|
|
|
@@ -309,7 +318,7 @@ gen_include() {
|
|
|
return 0
|
|
|
}
|
|
|
|
|
|
-while getopts ":s:l:S:L:i:e:a:B:b:w:p:G:D:F:N:M:oOuUfgrczh" arg; do
|
|
|
+while getopts ":s:l:S:L:i:e:a:B:b:w:p:G:D:F:N:M:I:oOuUfgrczh" arg; do
|
|
|
case "$arg" in
|
|
|
s)
|
|
|
server=$OPTARG
|
|
|
@@ -359,6 +368,9 @@ while getopts ":s:l:S:L:i:e:a:B:b:w:p:G:D:F:N:M:oOuUfgrczh" arg; do
|
|
|
M)
|
|
|
NETFLIX_PROXY=$OPTARG
|
|
|
;;
|
|
|
+ I)
|
|
|
+ NETFLIX_LIST=$OPTARG
|
|
|
+ ;;
|
|
|
o)
|
|
|
OUTPUT=1
|
|
|
;;
|
|
|
@@ -390,9 +402,11 @@ while getopts ":s:l:S:L:i:e:a:B:b:w:p:G:D:F:N:M:oOuUfgrczh" arg; do
|
|
|
h) usage 0 ;;
|
|
|
esac
|
|
|
done
|
|
|
+
|
|
|
if [ -z "$server" -o -z "$local_port" ]; then
|
|
|
usage 2
|
|
|
fi
|
|
|
+
|
|
|
if [ "$TPROXY" == 1 ]; then
|
|
|
SERVER=$server
|
|
|
LOCAL_PORT=$local_port
|
|
|
@@ -400,7 +414,7 @@ elif [ "$TPROXY" == 2 ]; then
|
|
|
: ${SERVER:?"You must assign an ip for the udp relay server."}
|
|
|
: ${LOCAL_PORT:?"You must assign a port for the udp relay server."}
|
|
|
fi
|
|
|
+
|
|
|
flush_r && fw_rule && ipset_r && ac_rule && tp_rule && gen_include
|
|
|
[ "$?" == 0 ] || loger 3 "Start failed!"
|
|
|
exit $?
|
|
|
-
|
fw876