diff --git a/init.d/custom.d.examples.linux/50-discord b/init.d/custom.d.examples.linux/50-discord deleted file mode 100644 index d21655e..0000000 --- a/init.d/custom.d.examples.linux/50-discord +++ /dev/null @@ -1,75 +0,0 @@ -# this custom script runs desync of some udp packets to discord subnets -# idea taken from community. not tested and not optimized by author. - -# can override in config : -NFQWS_OPT_DESYNC_DISCORD="${NFQWS_OPT_DESYNC_DISCORD:---dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-any-protocol}" -DISCORD_PORTS=${DISCORD_PORTS:-50000-50099} -DISCORD_SUBNETS="${DISCORD_SUBNETS:-34.0.48.0/21 34.0.56.0/23 34.0.59.0/24 34.0.60.0/24 34.0.62.0/23 34.0.64.0/23 34.0.66.0/24 34.0.82.140/24 34.0.129.0/24 34.0.130.0/23 34.0.132.0/22 34.0.136.0/23 34.0.139.0/24 34.0.140.0/23 34.0.142.0/24 34.0.144.0/23 34.0.146.0/24 34.0.148.0/23 34.0.151.0/24 34.0.153.0/24 34.0.155.0/24 34.0.156.0/22 34.0.192.0/20 34.0.208.0/22 34.0.212.0/23 34.0.215.0/24 34.0.216.0/23 34.0.218.0/24 34.0.220.0/22 34.0.227.0/24 34.0.240.0/21 34.0.248.0/22 34.1.216.0/24 34.1.221.166/24 35.207.64.0/23 35.207.67.116/24 35.207.71.0/24 35.207.72.0/21 35.207.80.0/21 35.207.89.188/24 35.207.91.0/24 35.207.92.0/24 35.207.95.0/24 35.207.97.174/24 35.207.99.0/24 35.207.100.0/23 35.207.103.0/24 35.207.104.0/24 35.207.106.0/23 35.207.108.0/22 35.207.114.0/23 35.207.116.0/23 35.207.121.0/24 35.207.122.0/24 35.207.124.0/23 35.207.126.0/24 35.207.129.0/24 35.207.131.0/24 35.207.132.0/24 35.207.135.0/24 35.207.136.0/23 35.207.139.0/24 35.207.140.0/22 35.207.144.0/22 35.207.149.0/24 35.207.150.0/23 35.207.153.0/24 35.207.154.0/23 35.207.156.0/23 35.207.158.0/24 35.207.160.160/24 35.207.162.0/23 35.207.164.0/22 35.207.168.0/24 35.207.170.0/23 35.207.172.0/24 35.207.174.55/24 35.207.176.0/24 35.207.178.0/24 35.207.180.0/23 35.207.182.0/24 35.207.184.0/21 35.207.193.165/24 35.207.195.0/24 35.207.196.0/24 35.207.198.0/23 35.207.201.0/24 35.207.202.0/24 35.207.205.211/24 35.207.207.4/24 35.207.209.0/24 35.207.210.0/23 35.207.213.0/24 35.207.214.0/24 35.207.220.0/23 35.207.222.0/24 35.207.224.0/23 35.207.227.0/24 35.207.229.212/24 35.207.232.26/24 35.207.234.182/24 35.207.238.0/24 35.207.240.0/24 35.207.245.0/24 35.207.249.0/24 35.207.250.0/23 35.212.4.134/24 35.212.12.148/24 35.212.39.46/24 35.212.88.11/24 35.212.102.50/24 35.212.111.0/24 35.212.117.247/24 35.212.120.122/24 35.213.0.0/24 35.213.2.8/24 35.213.4.185/24 35.213.6.0/23 35.213.8.0/24 35.213.10.0/23 35.213.12.0/23 35.213.14.0/24 35.213.16.0/23 35.213.23.166/24 35.213.25.0/24 35.213.26.0/23 35.213.32.0/23 35.213.34.0/24 35.213.37.0/24 35.213.38.0/23 35.213.42.0/23 35.213.45.0/24 35.213.46.0/24 35.213.49.0/24 35.213.50.0/23 35.213.52.0/23 35.213.54.0/24 35.213.56.0/24 35.213.59.0/24 35.213.61.58/24 35.213.65.0/24 35.213.67.0/24 35.213.68.0/24 35.213.70.151/24 35.213.72.0/23 35.213.74.0/24 35.213.78.0/23 35.213.80.0/24 35.213.83.0/24 35.213.84.0/23 35.213.88.0/21 35.213.96.0/24 35.213.98.0/23 35.213.101.0/24 35.213.102.0/24 35.213.105.0/24 35.213.106.0/23 35.213.109.0/24 35.213.110.0/23 35.213.115.0/24 35.213.120.0/24 35.213.122.0/24 35.213.124.0/22 35.213.128.0/20 35.213.144.0/22 35.213.148.0/23 35.213.150.0/24 35.213.152.0/22 35.213.156.0/23 35.213.158.0/24 35.213.160.0/20 35.213.176.0/23 35.213.179.0/24 35.213.180.0/22 35.213.184.0/22 35.213.188.0/24 35.213.190.0/23 35.213.192.0/21 35.213.200.0/22 35.213.204.0/23 35.213.207.0/24 35.213.208.0/24 35.213.210.0/23 35.213.212.0/22 35.213.217.0/24 35.213.218.0/23 35.213.220.0/22 35.213.225.0/24 35.213.227.227/24 35.213.229.0/24 35.213.230.0/23 35.213.233.0/24 35.213.234.0/24 35.213.236.0/23 35.213.238.0/24 35.213.240.0/21 35.213.249.0/24 35.213.250.0/23 35.213.252.0/23 35.213.254.0/24 35.214.128.0/22 35.214.132.0/23 35.214.134.0/24 35.214.137.0/24 35.214.138.0/24 35.214.140.0/24 35.214.142.0/23 35.214.144.0/22 35.214.148.0/23 35.214.151.0/24 35.214.152.0/24 35.214.156.115/24 35.214.158.0/23 35.214.160.0/22 35.214.165.102/24 35.214.167.77/24 35.214.169.0/24 35.214.170.0/23 35.214.172.0/23 35.214.175.0/24 35.214.177.183/24 35.214.179.0/24 35.214.180.0/23 35.214.184.0/22 35.214.191.0/24 35.214.192.0/21 35.214.201.0/24 35.214.203.0/24 35.214.204.0/23 35.214.207.0/24 35.214.208.0/20 35.214.224.0/22 35.214.228.0/23 35.214.231.187/24 35.214.233.8/24 35.214.235.38/24 35.214.237.0/24 35.214.238.0/23 35.214.240.0/23 35.214.243.0/24 35.214.244.0/23 35.214.246.0/24 35.214.248.0/22 35.214.252.0/23 35.214.255.154/24 35.215.72.0/23 35.215.79.31/24 35.215.83.0/24 35.215.85.208/24 35.215.93.85/24 35.215.97.70/24 35.215.108.111/24 35.215.115.120/24 35.215.118.138/24 35.215.120.129/24 35.215.126.0/23 35.215.128.0/20 35.215.144.0/21 35.215.152.0/22 35.215.156.0/24 35.215.158.0/23 35.215.160.0/23 35.215.163.0/24 35.215.164.0/22 35.215.168.0/21 35.215.176.0/20 35.215.192.0/20 35.215.208.0/21 35.215.216.0/22 35.215.221.0/24 35.215.222.0/23 35.215.224.0/21 35.215.232.0/22 35.215.238.0/23 35.215.240.0/20 35.217.0.0/22 35.217.4.0/23 35.217.6.0/24 35.217.8.0/23 35.217.11.0/24 35.217.12.0/22 35.217.16.0/20 35.217.32.0/23 35.217.35.0/24 35.217.36.0/22 35.217.40.0/21 35.217.48.0/20 35.219.225.0/24 35.219.226.0/23 35.219.228.0/22 35.219.235.0/24 35.219.236.0/24 35.219.238.0/23 35.219.241.0/24 35.219.242.0/23 35.219.244.0/22 35.219.248.0/23 35.219.251.0/24 35.219.252.0/23 35.219.254.0/24 66.22.196.0/22 66.22.200.0/24 66.22.202.0/24 66.22.204.0/24 66.22.206.0/24 66.22.208.0/24 66.22.210.0/24 66.22.212.0/24 66.22.214.0/24 66.22.220.0/22 66.22.224.0/21 66.22.233.0/24 66.22.234.0/24 66.22.236.0/23 66.22.238.0/24 66.22.240.0/22 66.22.244.0/24 66.22.248.0/24 138.128.140.0/24 162.159.130.234/24 162.159.133.0/24 162.159.134.0/23 162.159.136.0/24 172.65.202.19/24 172.65.247.52/24}" - -alloc_dnum DNUM_DISCORD -alloc_qnum QNUM_DISCORD -DISCORD_SET_NAME=discord - -zapret_custom_daemons() -{ - # $1 - 1 - run, 0 - stop - - local opt="--qnum=$QNUM_DISCORD $NFQWS_OPT_DESYNC_DISCORD" - do_nfqws $1 $DNUM_DISCORD "$opt" -} - -zapret_custom_firewall() -{ - # $1 - 1 - run, 0 - stop - - local f - local first_packets_only="$ipt_connbytes 1:3" - local DISCORD_PORTS_IPT=$(replace_char - : $DISCORD_PORTS) - local dest_set="-m set --match-set $DISCORD_SET_NAME dst" - local subnet - - local DISABLE_IPV6=1 - - [ "$1" = 1 ] && { - ipset create $DISCORD_SET_NAME hash:net hashsize 8192 maxelem 4096 2>/dev/null - ipset flush $DISCORD_SET_NAME - for subnet in $DISCORD_SUBNETS; do - echo add $DISCORD_SET_NAME $subnet - done | ipset -! restore - } - - f="-p udp -m multiport --dports $DISCORD_PORTS_IPT" - fw_nfqws_post $1 "$f $first_packets_only $dest_set" "" $QNUM_DISCORD - - [ "$1" = 1 ] || { - ipset destroy $DISCORD_SET_NAME 2>/dev/null - } -} - -zapret_custom_firewall_nft() -{ - # stop logic is not required - - local f - local first_packets_only="$nft_connbytes 1-3" - local dest_set="ip daddr @$DISCORD_SET_NAME" - local subnets - - local DISABLE_IPV6=1 - - make_comma_list subnets $DISCORD_SUBNETS - nft_create_set $DISCORD_SET_NAME "type ipv4_addr; size 4096; auto-merge; flags interval;" - nft_flush_set $DISCORD_SET_NAME - nft_add_set_element $DISCORD_SET_NAME "$subnets" - - f="udp dport {$DISCORD_PORTS}" - nft_fw_nfqws_post "$f $first_packets_only $dest_set" "" $QNUM_DISCORD -} - -zapret_custom_firewall_nft_flush() -{ - # this function is called after all nft fw rules are deleted - # however sets are not deleted. it's desired to clear sets here. - - nft_del_set $DISCORD_SET_NAME 2>/dev/null -} diff --git a/init.d/custom.d.examples.linux/50-nfqws-ipset b/init.d/custom.d.examples.linux/50-nfqws-ipset new file mode 100644 index 0000000..2fc8bb7 --- /dev/null +++ b/init.d/custom.d.examples.linux/50-nfqws-ipset @@ -0,0 +1,74 @@ +# this custom script demonstrates how to launch extra nfqws instance limited by ipset. ipv4 only. + +# can override in config : +NFQWS_OPT_DESYNC_NFQWS_MY1="${NFQWS_OPT_DESYNC_NFQWS_MY1:---dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-any-protocol}" +NFQWS_MY1_PORTS=${NFQWS_MY1_PORTS:-6000-6009} +NFQWS_MY1_SUBNETS="${NFQWS_MY1_SUBNETS:-34.0.48.0/21 34.0.56.0/23 34.0.59.0/24 34.0.60.0/24 34.0.62.0/23}" + +alloc_dnum DNUM_NFQWS_MY1 +alloc_qnum QNUM_NFQWS_MY1 +NFQWS_MY1_SET_NAME=my1nfqws4 + +zapret_custom_daemons() +{ + # $1 - 1 - run, 0 - stop + + local opt="--qnum=$QNUM_NFQWS_MY1 $NFQWS_OPT_DESYNC_NFQWS_MY1" + do_nfqws $1 $DNUM_NFQWS_MY1 "$opt" +} + +zapret_custom_firewall() +{ + # $1 - 1 - run, 0 - stop + + local f + local first_packets_only="$ipt_connbytes 1:3" + local NFQWS_MY1_PORTS_IPT=$(replace_char - : $NFQWS_MY1_PORTS) + local dest_set="-m set --match-set $NFQWS_MY1_SET_NAME dst" + local subnet + + local DISABLE_IPV6=1 + + [ "$1" = 1 ] && { + ipset create $NFQWS_MY1_SET_NAME hash:net hashsize 8192 maxelem 4096 2>/dev/null + ipset flush $NFQWS_MY1_SET_NAME + for subnet in $NFQWS_MY1_SUBNETS; do + echo add $NFQWS_MY1_SET_NAME $subnet + done | ipset -! restore + } + + f="-p udp -m multiport --dports $NFQWS_MY1_PORTS_IPT" + fw_nfqws_post $1 "$f $first_packets_only $dest_set" "" $QNUM_NFQWS_MY1 + + [ "$1" = 1 ] || { + ipset destroy $NFQWS_MY1_SET_NAME 2>/dev/null + } +} + +zapret_custom_firewall_nft() +{ + # stop logic is not required + + local f + local first_packets_only="$nft_connbytes 1-3" + local dest_set="ip daddr @$NFQWS_MY1_SET_NAME" + local subnets + + local DISABLE_IPV6=1 + + make_comma_list subnets $NFQWS_MY1_SUBNETS + nft_create_set $NFQWS_MY1_SET_NAME "type ipv4_addr; size 4096; auto-merge; flags interval;" + nft_flush_set $NFQWS_MY1_SET_NAME + nft_add_set_element $NFQWS_MY1_SET_NAME "$subnets" + + f="udp dport {$NFQWS_MY1_PORTS}" + nft_fw_nfqws_post "$f $first_packets_only $dest_set" "" $QNUM_NFQWS_MY1 +} + +zapret_custom_firewall_nft_flush() +{ + # this function is called after all nft fw rules are deleted + # however sets are not deleted. it's desired to clear sets here. + + nft_del_set $NFQWS_MY1_SET_NAME 2>/dev/null +}