mirror of https://github.com/bol-van/zapret/
NewUse
10 months ago
committed by
GitHub
GitHub
23 changed files with 232 additions and 4 deletions
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
@ -0,0 +1,54 @@ |
|||
Minimal tpws startup script for low storage openwrt. |
|||
|
|||
--- openwrt with NFTABLES (22+) |
|||
|
|||
Make sure you are running openwrt with nftables, not iptables. |
|||
No opkg dependencies required ! |
|||
|
|||
* install : |
|||
|
|||
Copy everything from tpws directory to the root of the router. |
|||
Copy tpws binary for your architecture to /usr/bin/tpws |
|||
Set proper access rights : chmod 755 /etc/init.d/tpws /usr/bin/tpws |
|||
EDIT /etc/config/tpws |
|||
If you don't want ipv6 : edit /etc/nftables.d and comment lines with ipv6 redirect |
|||
/etc/init.d/tpws enable |
|||
/etc/init.d/tpws start |
|||
fw4 restart |
|||
|
|||
* full uninstall : |
|||
|
|||
/etc/init.d/tpws disable |
|||
/etc/init.d/tpws stop |
|||
rm -f /etc/nftables.d/90-tpws.nft /etc/firewall.user /etc/init.d/tpws |
|||
fw4 restart |
|||
|
|||
--- openwrt with IPTABLES (21-) |
|||
|
|||
Make sure you are running openwrt with iptables, not nftables. |
|||
Make sure you do not have anything valuable in /etc/firewall.user. |
|||
If you have - do not blindly follow instruction in firewall.user part. |
|||
Merge the code instead or setup your own firewall include in /etc/config/firewall. |
|||
|
|||
opkg update |
|||
opkg install iptables-mod-extra |
|||
IPV6 ONLY : opkg install ip6tables-mod-nat |
|||
|
|||
* install : |
|||
|
|||
Copy everything from tpws directory to the root of the router. |
|||
Copy tpws binary for your architecture to /usr/bin/tpws |
|||
Set proper access rights : chmod 755 /etc/init.d/tpws /usr/bin/tpws |
|||
EDIT /etc/config/tpws |
|||
If you don't want ipv6 : edit /etc/firewall.user and set DISABLE_IPV6=1 |
|||
/etc/init.d/tpws enable |
|||
/etc/init.d/tpws start |
|||
fw3 restart |
|||
|
|||
* full uninstall : |
|||
|
|||
/etc/init.d/tpws disable |
|||
/etc/init.d/tpws stop |
|||
rm -f /etc/nftables.d/90-tpws.nft /etc/firewall.user /etc/init.d/tpws |
|||
touch /etc/firewall.user |
|||
fw3 restart |
|||
@ -0,0 +1,12 @@ |
|||
config global defaults |
|||
option user daemon |
|||
option tpws /usr/bin/tpws |
|||
|
|||
config tpws |
|||
option port 900 |
|||
option opt '--split-pos=2 --oob' |
|||
option enabled 1 |
|||
config tpws |
|||
option port 901 |
|||
option opt '--split-tls=sni --disorder' |
|||
option enabled 0 |
|||
@ -0,0 +1,49 @@ |
|||
DISABLE_IPV6=0 |
|||
TP_PORT=900 |
|||
TP_USER=daemon |
|||
|
|||
EXCLUDE4="10.0.0.0/8 172.16.0.0/12 192.168.0.0/16 169.254.0.0/16 127.0.0.0/8" |
|||
EXCLUDE6="fc00::/7 fe80::/10 ::1" |
|||
IPTS="iptables ip6tables" |
|||
[ "$DISABLE_IPV6" = 1 ] && IPTS=iptables |
|||
|
|||
exists() |
|||
{ |
|||
which "$1" >/dev/null 2>/dev/null |
|||
} |
|||
|
|||
ipt() |
|||
{ |
|||
$IPTABLES -C "$@" >/dev/null 2>/dev/null || $IPTABLES -I "$@" |
|||
} |
|||
|
|||
redirect_port() |
|||
{ |
|||
ipt tpws -t nat -p tcp --dport $1 -j REDIRECT --to-port $2 |
|||
} |
|||
|
|||
redirect() |
|||
{ |
|||
redirect_port 80 $TP_PORT |
|||
redirect_port 443 $TP_PORT |
|||
} |
|||
|
|||
for IPTABLES in $IPTS; do |
|||
$IPTABLES -t nat -N tpws 2>/dev/null |
|||
$IPTABLES -t nat -F tpws |
|||
redirect |
|||
done |
|||
|
|||
for net in $EXCLUDE4; do |
|||
iptables -t nat -I tpws -d $net -j RETURN |
|||
done |
|||
[ "$DISABLE_IPV6" = 1 ] || { |
|||
for net in $EXCLUDE6; do |
|||
ip6tables -t nat -I tpws -d $net -j RETURN |
|||
done |
|||
} |
|||
|
|||
for IPTABLES in $IPTS; do |
|||
ipt PREROUTING -t nat -j tpws |
|||
ipt OUTPUT -t nat -m owner ! --uid-owner $TP_USER -j tpws |
|||
done |
|||
@ -0,0 +1,34 @@ |
|||
#!/bin/sh /etc/rc.common |
|||
|
|||
TPWS_DEFAULT=/usr/bin/tpws |
|||
TPWS_USER_DEFAULT=daemon |
|||
|
|||
START=99 |
|||
STOP=01 |
|||
USE_PROCD=1 |
|||
|
|||
tpws_instance() |
|||
{ |
|||
config_get "$@" |
|||
|
|||
local enabled port opt |
|||
|
|||
config_get_bool enabled "$1" enabled 0 |
|||
[ "$enabled" -eq 1 ] || return 1 |
|||
|
|||
config_get port "$1" port |
|||
config_get opt "$1" opt |
|||
|
|||
local COMMAND="$TPWS --user=$TPWS_USER --port=$port $opt" |
|||
procd_open_instance |
|||
procd_set_param command $COMMAND |
|||
procd_close_instance |
|||
} |
|||
|
|||
start_service() |
|||
{ |
|||
config_load tpws |
|||
config_get TPWS_USER defaults user $TPWS_USER_DEFAULT |
|||
config_get TPWS defaults tpws $TPWS_DEFAULT |
|||
config_foreach tpws_instance tpws |
|||
} |
|||
@ -0,0 +1,18 @@ |
|||
set tpws_exclude4 { |
|||
type ipv4_addr; flags interval; auto-merge; |
|||
elements = { 10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,169.254.0.0/16,127.0.0.0/8 } |
|||
} |
|||
set tpws_exclude6 { |
|||
type ipv6_addr; flags interval; auto-merge; |
|||
elements = { fc00::/7, fe80::/10, ::1 } |
|||
} |
|||
chain tpws_pre { |
|||
type nat hook prerouting priority dstnat; policy accept; |
|||
tcp dport {80,443} ip daddr != @tpws_exclude4 redirect to :900 |
|||
tcp dport {80,443} ip6 daddr != @tpws_exclude6 redirect to :900 |
|||
} |
|||
chain tpws_out { |
|||
type nat hook output priority -100; policy accept; |
|||
tcp dport {80,443} skuid != daemon ip daddr != @tpws_exclude4 redirect to :900 |
|||
tcp dport {80,443} skuid != daemon ip6 daddr != @tpws_exclude6 redirect to :900 |
|||
} |
|||
Loading…
Reference in new issue