You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

103 lines
4.6 KiB

  1. #!/bin/sh /etc/rc.common
  2. PKG_VERSION=
  3. export START=94
  4. export USE_PROCD=1
  5. readonly __ok__='\033[0;32m[\xe2\x9c\x93]\033[0m'
  6. readonly __fail__='\033[0;31m[\xe2\x9c\x97]\033[0m'
  7. readonly __pass__='\033[0;33m[-]\033[0m'
  8. readonly __error__='\033[0;31mERROR\033[0m'
  9. export verbosity=2 TID='200' IPSET='vpnbypass' FW_MARK='0x010000' FW_MASK='0xff0000' wan_if4 wan_gw
  10. output() { [[ $# -ne 1 ]] && { [[ ! $((verbosity & $1)) -gt 0 ]] && return 0 || shift; }; local msg; msg=$(echo -n "${1/$p_name /service }" | sed 's|\\033\[[0-9]\?;\?[0-9]\?[0-9]\?m||g'); [[ -t 1 ]] && echo -e -n "$1"; [[ $(echo -e -n "$msg" | wc -l) -gt 0 ]] && logger -t "${PKG_NAME:-service} [$$]" "$(echo -e -n ${logmsg}${msg})" && logmsg='' || logmsg=${logmsg}${msg}; }
  11. PKG_NAME="${PKG_NAME:-vpnbypass}"; p_name="${PKG_NAME} ${PKG_VERSION}"
  12. is_enabled() {
  13. local c=1 enabled
  14. config_load $PKG_NAME
  15. config_get_bool enabled 'config' 'enabled' 1
  16. config_get verbosity 'config' 'verbosity' '2'
  17. config_get TID 'config' 'table_number' '200'
  18. config_get IPSET 'config' 'ipset' 'vpnbypass'
  19. config_get FW_MARK 'config' 'fw_mark' '0x010000'
  20. config_get FW_MASK 'config' 'fw_mask' '0xff0000'
  21. source /lib/functions/network.sh
  22. [[ $enabled -gt 0 ]] || { output "$__error__: $p_name is not enabled.\n"; return 1; }
  23. source /lib/functions/network.sh
  24. while : ; do
  25. network_find_wan wan_if4
  26. [ -n "$wan_if4" ] && network_get_gateway wan_gw $wan_if4
  27. [[ $c -ge 25 || -n "$wan_gw" ]] && break
  28. output "$p_name waiting for wan gateway...\n"
  29. sleep 2; network_flush_cache; let "c+=1";
  30. done
  31. [ -n "$wan_gw" ] && return 0 || { output "$__error__: $p_name failed to discover WAN gateway.\n"; return 1; }
  32. }
  33. ipt() {
  34. local d; d=$(echo "$*" | sed s/-A/-D/g);
  35. [ "$d" != "$*" ] && iptables $d >/dev/null 2>&1
  36. d=$(echo "$*" | sed s/-I/-D/g)
  37. [ "$d" != "$*" ] && iptables $d >/dev/null 2>&1
  38. d=$(echo "$*" | sed s/-N/-F/g)
  39. [ "$d" != "$*" ] && iptables $d >/dev/null 2>&1
  40. d=$(echo "$*" | sed s/-N/-X/g)
  41. [ "$d" != "$*" ] && iptables $d >/dev/null 2>&1
  42. d="$*"
  43. iptables $d >/dev/null 2>&1 || output "\n$__error__: iptables $d\n"
  44. }
  45. start_service() {
  46. local ll lports rports routes ranges
  47. is_enabled || return 1
  48. config_get lports 'config' 'localport'
  49. config_get rports 'config' 'remoteport'
  50. config_get routes 'config' 'remotesubnet'
  51. config_get ranges 'config' 'localsubnet'
  52. procd_open_instance
  53. procd_set_param stdout 1
  54. procd_set_param stderr 1
  55. procd_close_instance
  56. iptables -t mangle -D PREROUTING -m mark --mark 0x00/${FW_MASK} -g VPNBYPASS >/dev/null 2>&1
  57. ipt -t mangle -N VPNBYPASS; ipt -t mangle -A PREROUTING -m mark --mark 0x00/${FW_MASK} -g VPNBYPASS;
  58. ipt -t mangle -A VPNBYPASS -m set --match-set $IPSET dst -j MARK --set-mark ${FW_MARK}/${FW_MASK}
  59. ip rule del fwmark "$FW_MARK" table "$TID" >/dev/null 2>&1; ipset -q flush "$IPSET"; ipset -q destroy "$IPSET";
  60. ip route flush table "$TID"; ip route flush cache;
  61. ip route add default via "$wan_gw" table "$TID"; ip route flush cache;
  62. ipset -q -exist create "$IPSET" hash:ip; ipset -q flush "$IPSET"
  63. ip rule add fwmark "$FW_MARK" table "$TID"
  64. { modprobe xt_set; modprobe ip_set; modprobe ip_set_hash_ip; } >/dev/null 2>&1
  65. for ll in ${ranges}; do ipt -t mangle -I VPNBYPASS 1 -j MARK --set-mark ${FW_MARK}/${FW_MASK} -s "$ll"; done
  66. for ll in ${lports}; do ipt -t mangle -I VPNBYPASS 1 -j MARK --set-mark ${FW_MARK}/${FW_MASK} -p tcp -m multiport --sport "${ll//-/:}"; done
  67. for ll in ${routes}; do ipt -t mangle -I VPNBYPASS 1 -j MARK --set-mark ${FW_MARK}/${FW_MASK} -d "$ll"; done
  68. for ll in ${rports}; do ipt -t mangle -I VPNBYPASS 1 -j MARK --set-mark ${FW_MARK}/${FW_MASK} -p tcp -m multiport --dport "${ll//-/:}"; done
  69. output "$p_name started with TID: $TID; FW_MARK: $FW_MARK\n"
  70. }
  71. stop_service() {
  72. is_enabled || return 1
  73. ip rule del fwmark "$FW_MARK" table "$TID" >/dev/null 2>&1; ipset -q flush "$IPSET"; ipset -q destroy "$IPSET";
  74. ip route flush table "$TID"; ip route flush cache;
  75. iptables -t mangle -D PREROUTING -m mark --mark 0x00/${FW_MASK} -g VPNBYPASS >/dev/null 2>&1
  76. iptables -t mangle -F VPNBYPASS >/dev/null 2>&1; iptables -t mangle -X VPNBYPASS >/dev/null 2>&1;
  77. output "$p_name stopped\n"
  78. }
  79. reload_service(){
  80. start_service
  81. }
  82. st_load_interfaces(){ local d; config_get d $1 ifname; [[ "$1" == "$wan_if4" || "$d" != "${d/tun}" || "$d" != "${d/tap}" ]] && ifaces=" ${1} ${ifaces}"; }
  83. service_triggers() {
  84. local ifaces n
  85. procd_add_reload_trigger 'vpnbypass'
  86. procd_open_trigger
  87. procd_add_config_trigger "config.change" "vpnbypass" /etc/init.d/vpnbypass reload
  88. for n in $ifaces; do procd_add_interface_trigger "interface.*" "$n" /etc/init.d/openvpn-policy-routing reload; done;
  89. procd_close_trigger
  90. }