You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
84 lines
3.8 KiB
84 lines
3.8 KiB
#!/bin/sh /etc/rc.common
|
|
PKG_VERSION=
|
|
|
|
START=94
|
|
USE_PROCD=1
|
|
|
|
readonly TID="200" FW_MARK="0x010000" IPSET="vpnbypass"
|
|
|
|
output() {
|
|
[ -n "$2" ] && [ ! $(($verbosity & $2)) -gt 0 ] && return 0;
|
|
[ -t 1 ] && echo -e -n "$1"
|
|
[ $(echo -e -n "$1" | wc -l) -gt 0 ] && logger -t "${PKG_NAME:-service} [$$]" "$(echo -e -n ${logmsg}${1})" && logmsg='' || logmsg=${logmsg}${1}
|
|
}
|
|
|
|
vpnbypass_enabled() {
|
|
config_load vpnbypass
|
|
config_get_bool enabled 'config' 'enabled' 0
|
|
config_get verbosity 'config' 'verbosity' '2'
|
|
PKG_NAME="${PKG_NAME:-vpnbypass}"
|
|
[ -n "$PKG_VERSION" ] && p_name="$PKG_NAME $PKG_VERSION" || p_name="$PKG_NAME"
|
|
[ -t 1 ] || p_name='service'
|
|
source /lib/functions/network.sh
|
|
[ "$enabled" -ne "0" ] && return 0
|
|
output "$p_name is not enabled in the config file!\n"
|
|
output "To enable, run 'uci set $PKG_NAME.config.enabled=1; uci commit $PKG_NAME'\n"
|
|
return 1
|
|
}
|
|
|
|
iptables_reset(){ [ -z "$PKG_NAME" ] && return 1; iptables-save | grep -Fv -- "$PKG_NAME" | iptables-restore; lsmod | grep -q ip6table_nat && ip6tables-save | grep -Fv -- "$PKG_NAME" | ip6tables-restore; }
|
|
|
|
boot() { ubus -t 30 wait_for network.interface.wan && { rc_procd start_service; rc_procd service_triggers; } || output "ERROR: $p_name failed to settle network interface!\n"; }
|
|
|
|
start_service() {
|
|
local ll c=1
|
|
config_load vpnbypass
|
|
vpnbypass_enabled || return 1
|
|
config_get lports 'config' 'localport'
|
|
config_get rports 'config' 'remoteport'
|
|
config_get routes 'config' 'remotesubnet'
|
|
config_get ranges 'config' 'localsubnet'
|
|
config_get domains 'config' 'domain'
|
|
|
|
procd_open_instance
|
|
procd_set_param stdout 1
|
|
procd_set_param stderr 1
|
|
procd_close_instance
|
|
|
|
while : ; do network_get_ipaddr wanip wan; network_get_gateway gwip wan; [ $c -ge 15 ] && break || let "c+=1"; [ -n "$wanip" -a -n "$gwip" ] && break || output "$p_name waiting for wan gateway...\n"; sleep 2; network_flush_cache; done
|
|
[ -z "$wanip" -o -z "$gwip" ] && output "ERROR: $p_name could not get wan interface IP: $wanip or gateway: $gwip!\n" && exit 0
|
|
|
|
for ll in ${routes}; do ip route del $ll; ip route add $ll via $gwip; done
|
|
ip rule del fwmark "$FW_MARK" table "$TID" >/dev/null 2>&1; iptables_reset; ipset -q flush "$IPSET"; ipset -q destroy "$IPSET";
|
|
ip route flush table "$TID"; ip route flush cache;
|
|
ip route add default via "$gwip" table "$TID"; ip route flush cache;
|
|
{ modprobe xt_set; modprobe ip_set; modprobe ip_set_hash_ip; } >/dev/null 2>&1
|
|
ipset -q -exist create "$IPSET" hash:ip; ipset -q flush "$IPSET"
|
|
for ll in ${lports}; do iptables -t mangle -A PREROUTING -p tcp -m multiport --sport "${ll//-/:}" -j MARK --set-mark "$FW_MARK/$FW_MARK" -m comment --comment "$PKG_NAME"; done
|
|
for ll in ${rports}; do iptables -t mangle -A PREROUTING -p tcp -m multiport --dport "${ll//-/:}" -j MARK --set-mark "$FW_MARK/$FW_MARK" -m comment --comment "$PKG_NAME"; done
|
|
for ll in ${ranges}; do iptables -t mangle -I PREROUTING -s "$ll" -j MARK --set-mark "$FW_MARK/$FW_MARK" -m comment --comment "$PKG_NAME"; done
|
|
iptables -t mangle -A PREROUTING -m set --match-set "$IPSET" dst -j MARK --set-mark "$FW_MARK/$FW_MARK" -m comment --comment "$PKG_NAME"
|
|
ip rule add fwmark "$FW_MARK" table "$TID"
|
|
output "$p_name started with TID: $TID; FW_MARK: $FW_MARK\n"
|
|
}
|
|
|
|
stop_service() {
|
|
local ll
|
|
vpnbypass_enabled || return 1
|
|
config_get routes 'config' 'remotesubnet'
|
|
|
|
for ll in ${routes}; do ip route del "$ll"; done
|
|
ip rule del fwmark "$FW_MARK" table "$TID" >/dev/null 2>&1; iptables_reset; ipset -q flush "$IPSET"; ipset -q destroy "$IPSET";
|
|
ip route flush table "$TID"; ip route flush cache;
|
|
output "$p_name stopped\n"
|
|
}
|
|
|
|
reload_service() { start_service; }
|
|
|
|
service_triggers() {
|
|
procd_add_reload_trigger 'vpnbypass'
|
|
procd_open_trigger
|
|
procd_add_config_trigger "config.change" "vpnbypass" /etc/init.d/vpnbypass reload
|
|
procd_add_interface_trigger "interface.*" "wan" /etc/init.d/vpnbypass reload
|
|
procd_close_trigger
|
|
}
|