You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
76 lines
3.4 KiB
76 lines
3.4 KiB
#!/bin/sh /etc/rc.common
|
|
|
|
START=92
|
|
USE_PROCD=1
|
|
|
|
TID="200"; FW_MARK="0x010000"; IPSET="vpnbypass";
|
|
|
|
output() {
|
|
[ -z "$verbosity" ] && config_get verbosity 'config' 'verbosity' '2'
|
|
[ -n "$2" -a $((verbosity)) -ne $(($2)) ] && return 0;
|
|
[ -t 1 ] && echo -e -n "$1"
|
|
[ $(echo -e -n "$1" | wc -l) -gt 0 ] && logger -t "vpnbypass[$$]" "$(echo -e -n ${logmsg}${1})" && logmsg='' || logmsg=${logmsg}${1}
|
|
}
|
|
|
|
vpnbypass_enabled() {
|
|
config_get_bool enabled 'config' 'enabled' 0
|
|
[ $((enabled)) -gt 0 ] && return 0 || { output "VPNBypass is not enabled in the config file!\nTo enable, run 'uci set vpnbypass.config.enabled=1; uci commit vpnbypass'\n"; return 1; }
|
|
}
|
|
|
|
boot() { ubus -t 30 wait_for network.interface.wan && rc_procd start_service || output 'ERROR: Failed to settle network interface!\n'; }
|
|
|
|
start_service() {
|
|
local ll c=1
|
|
config_load vpnbypass
|
|
vpnbypass_enabled || return 1
|
|
config_get lports 'config' 'localport'
|
|
config_get rports 'config' 'remoteport'
|
|
config_get routes 'config' 'remotesubnet'
|
|
config_get ranges 'config' 'localsubnet'
|
|
config_get domains 'config' 'domain'
|
|
|
|
procd_open_instance
|
|
procd_set_param stdout 1
|
|
procd_set_param stderr 1
|
|
procd_close_instance
|
|
|
|
source /lib/functions/network.sh
|
|
while : ; do network_get_ipaddr wanip wan; network_get_gateway gwip wan; [ $c -ge 5 ] && break || let "c+=1"; [ -n "$wanip" -a -n "$gwip" ] && break || sleep 5; done
|
|
[ -z "$wanip" -o -z "$gwip" ] && output 'ERROR: Could not get WAN interface IP: $wanip or Gateway: $gwip\n' && exit 0
|
|
|
|
for ll in ${routes}; do { [ "$ll" = "${ll#*\/*}" ] && ll="${ll}/32"; ip route del $ll; ip route add $ll via $gwip; } >/dev/null 2>&1; done
|
|
{ ip rule del fwmark $FW_MARK table $TID; iptables -t mangle -F; ipset -F $IPSET; ipset -X $IPSET; } >/dev/null 2>&1
|
|
{ ip route flush table $TID; ip route flush cache; } >/dev/null 2>&1
|
|
{ ip route add default via $gwip table $TID; ip route flush cache; } >/dev/null 2>&1
|
|
{ modprobe xt_set || modprobe ip_set; insmod ip_set_hash_ip; } >/dev/null 2>&1
|
|
{ ipset -N $IPSET iphash -q; ipset -F $IPSET; } >/dev/null 2>&1
|
|
for ll in ${lports}; do iptables -t mangle -A PREROUTING -p tcp -m multiport --sport $ll -j MARK --set-mark $FW_MARK/$FW_MARK -m comment --comment "vpnbypass"; done
|
|
for ll in ${rports}; do iptables -t mangle -A PREROUTING -p tcp -m multiport --dport $ll -j MARK --set-mark $FW_MARK/$FW_MARK -m comment --comment "vpnbypass"; done
|
|
for ll in ${ranges}; do [ "$ll" = "${ll#*\/*}" ] && ll="${ll}/32"; iptables -t mangle -I PREROUTING -s $ll -j MARK --set-mark $FW_MARK/$FW_MARK -m comment --comment "vpnbypass"; done
|
|
iptables -t mangle -A PREROUTING -m set --match-set $IPSET dst -j MARK --set-mark $FW_MARK/$FW_MARK -m comment --comment "vpnbypass"
|
|
ip rule add fwmark $FW_MARK table $TID
|
|
output "vpnbypass started with TID: $TID; FW_MARK: $FW_MARK\n"
|
|
}
|
|
|
|
stop_service() {
|
|
local ll
|
|
config_load vpnbypass
|
|
vpnbypass_enabled || return 1
|
|
config_get routes 'config' 'remotesubnet'
|
|
|
|
for ll in ${routes}; do [ "$ll" = "${ll#*\/*}" ] && ll="${ll}/32"; ip route del $ll >/dev/null 2>&1; done
|
|
# iptables-save | grep -Fv -- "vpnbypass" | iptables-restore
|
|
{ ip rule del fwmark $FW_MARK table $TID; iptables -t mangle -F; ipset -F $IPSET; ipset -X $IPSET; } >/dev/null 2>&1
|
|
{ ip route flush table $TID; ip route flush cache; } >/dev/null 2>&1
|
|
output "vpnbypass stopped\n"
|
|
}
|
|
|
|
reload_service()
|
|
{
|
|
start_service
|
|
}
|
|
|
|
service_triggers() {
|
|
procd_add_reload_trigger 'vpnbypass'
|
|
procd_add_reload_interface_trigger 'wan'
|
|
}
|