Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat(init.d): add mask to --mark & --set-mark option in iptables rules #394

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

feat(init.d): add mask to --mark & --set-mark option in iptables rules #394

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
51 changes: 28 additions & 23 deletions public/root/etc/init.d/v2ray
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,9 +28,14 @@ TRANSPARENT_PROXY_EXPECTED=0
TRANSPARENT_PROXY_PORT=
TRANSPARENT_PROXY_USE_TPROXY=
TRANSPARENT_PROXY_ADDITION=
TRANSPARENT_REDIRECT_MARK=255

DNSMASQ_RESTART_EXPECTED=0

IPTABLES_MASK=0xff
IPTABLES_REDIRECT_MARK=0x1
IPTABLES_BYPASS_MARK=0xff

. /usr/share/libubox/jshn.sh

_log() {
Expand Down Expand Up @@ -398,7 +403,7 @@ add_v2ray_redirect_rules() {
iptables-restore --noflush <<-EOF 2>/dev/null
*nat
:V2RAY -
-A V2RAY -p tcp -j RETURN -m mark --mark 0xff
-A V2RAY -p tcp -j RETURN -m mark --mark $IPTABLES_BYPASS_MARK/$IPTABLES_MASK
-A V2RAY -p tcp -j RETURN -m set --match-set $ipset_src_direct src
-A V2RAY -p tcp -j RETURN -m set --match-set $ipset_dst_direct dst
-A V2RAY -p tcp $ext_args -j REDIRECT --to-ports $port
Expand All @@ -417,27 +422,27 @@ add_v2ray_redirect_rules() {
EOF

if [ -n "$addition" ] ; then
ip rule add fwmark 1 lookup 100
ip rule add fwmark $IPTABLES_REDIRECT_MASK/$IPTABLES_MARK pref 100 1ookup 100
ip route add local 0.0.0.0/0 dev lo table 100 2>/dev/null

iptables-restore --noflush <<-EOF 2>/dev/null
*mangle
:V2RAY -
-A V2RAY -p udp -j RETURN -m mark --mark 0xff
-A V2RAY -p udp -j RETURN -m mark --mark $IPTABLES_BYPASS_MARK/$IPTABLES_MASK
$(
if [ -n "$lan_ipaddrs" ] ; then
local ipaddr
for ipaddr in $lan_ipaddrs ; do
echo "-A V2RAY -p udp --dport 53 -d $ipaddr -j TPROXY --on-port $port --tproxy-mark 0x1/0x1"
echo "-A V2RAY -p udp --dport 53 -d $ipaddr -j TPROXY --on-port $port --tproxy-mark $IPTABLES_REDIRECT_MARK/$IPTABLES_MASK"
done
fi
)
-A V2RAY -p udp -j RETURN -m set --match-set $ipset_dst_direct dst
$(
if [ "$addition" = "dns" ] ; then
echo "-A V2RAY -p udp --dport 53 -j TPROXY --on-port $port --tproxy-mark 0x1/0x1"
echo "-A V2RAY -p udp --dport 53 -j TPROXY --on-port $port --tproxy-mark $IPTABLES_REDIRECT_MARK/$IPTABLES_MASK"
else
echo "-A V2RAY -p udp -j TPROXY --on-port $port --tproxy-mark 0x1/0x1"
echo "-A V2RAY -p udp -j TPROXY --on-port $port --tproxy-mark $IPTABLES_REDIRECT_MARK/$IPTABLES_MASK"
fi

if [ -n "$lan_devices" ] ; then
Expand All @@ -446,21 +451,21 @@ add_v2ray_redirect_rules() {
echo "-A PREROUTING -p udp -i $device -j V2RAY"
done

echo "-A PREROUTING -p udp -j V2RAY -m mark --mark 0x1"
echo "-A PREROUTING -p udp -j V2RAY -m mark --mark $IPTABLES_REDIRECT_MARK/$IPTABLES_MASK"
else
echo "-A PREROUTING -p udp -j V2RAY"
fi
)

:V2RAY_MARK -
-A V2RAY_MARK -p udp -j RETURN -m mark --mark 0xff
-A V2RAY_MARK -p udp -j RETURN -m mark --mark $IPTABLES_BYPASS_MARK/$IPTABLES_MASK
-A V2RAY_MARK -p udp -j RETURN -m set --match-set $ipset_src_direct src
-A V2RAY_MARK -p udp -j RETURN -m set --match-set $ipset_dst_direct dst
$(
if [ "$addition" = "dns" ] ; then
echo "-A V2RAY_MARK -p udp --dport 53 -j MARK --set-mark 1"
echo "-A V2RAY_MARK -p udp --dport 53 -j MARK --set-mark $IPTABLES_REDIRECT_MARK/$IPTABLES_MASK"
else
echo "-A V2RAY_MARK -p udp -j MARK --set-mark 1"
echo "-A V2RAY_MARK -p udp -j MARK --set-mark $IPTABLES_REDIRECT_MARK/$IPTABLES_MASK"
fi
)
-A OUTPUT -p udp -j V2RAY_MARK
Expand All @@ -483,30 +488,30 @@ add_v2ray_tproxy_rules() {

# https://www.kernel.org/doc/Documentation/networking/tproxy.txt

ip rule add fwmark 1 lookup 100
ip rule add fwmark $IPTABLES_REDIRECT_MARK/$IPTABLES_MASK pref 100 lookup 100
ip route add local 0.0.0.0/0 dev lo table 100 2>/dev/null

iptables-restore --noflush <<-EOF 2>/dev/null
*mangle
:V2RAY -
-A V2RAY -j RETURN -m mark --mark 0xff
-A V2RAY -j RETURN -m mark --mark $IPTABLES_BYPASS_MARK/$IPTABLES_MASK
$(
if [ -n "$addition" ] && [ -n "$lan_ipaddrs" ] ; then
local ipaddr
for ipaddr in $lan_ipaddrs ; do
echo "-A V2RAY -p udp --dport 53 -d $ipaddr -j TPROXY --on-port $port --tproxy-mark 0x1/0x1"
echo "-A V2RAY -p udp --dport 53 -d $ipaddr -j TPROXY --on-port $port --tproxy-mark $IPTABLES_REDIRECT_MARK/$IPTABLES_MASK"
done
fi
)
-A V2RAY -j RETURN -m set --match-set $ipset_src_direct src
-A V2RAY -j RETURN -m set --match-set $ipset_dst_direct dst
-A V2RAY -p tcp $ext_args -j TPROXY --on-port $port --tproxy-mark 0x1/0x1
-A V2RAY -p tcp $ext_args -j TPROXY --on-port $port --tproxy-mark $IPTABLES_REDIRECT_MARK/$IPTABLES_MASK
$(
if [ -n "$addition" ] ; then
if [ "$addition" = "dns" ] ; then
echo "-A V2RAY -p udp --dport 53 -j TPROXY --on-port $port --tproxy-mark 0x1/0x1"
echo "-A V2RAY -p udp --dport 53 -j TPROXY --on-port $port --tproxy-mark $IPTABLES_REDIRECT_MARK/$IPTABLES_MASK"
else
echo "-A V2RAY -p udp -j TPROXY --on-port $port --tproxy-mark 0x1/0x1"
echo "-A V2RAY -p udp -j TPROXY --on-port $port --tproxy-mark $IPTABLES_REDIRECT_MARK/$IPTABLES_MASK"
fi
fi

Expand All @@ -516,23 +521,23 @@ add_v2ray_tproxy_rules() {
echo "-A PREROUTING -i $device -j V2RAY"
done

echo "-A PREROUTING -j V2RAY -m mark --mark 0x1"
echo "-A PREROUTING -j V2RAY -m mark --mark $IPTABLES_REDIRECT_MARK/$IPTABLES_MASK"
else
echo "-A PREROUTING -j V2RAY"
fi
)

:V2RAY_MASK -
-A V2RAY_MASK -j RETURN -m mark --mark 0xff
-A V2RAY_MASK -j RETURN -m mark --mark $IPTABLES_BYPASS_MARK/$IPTABLES_MASK
-A V2RAY_MASK -j RETURN -m set --match-set $ipset_src_direct src
-A V2RAY_MASK -j RETURN -m set --match-set $ipset_dst_direct dst
-A V2RAY_MASK -p tcp $ext_args -j MARK --set-mark 1
-A V2RAY_MASK -p tcp $ext_args -j MARK --set-mark $IPTABLES_REDIRECT_MARK/$IPTABLES_MASK
$(
if [ -n "$addition" ] ; then
if [ "$addition" = "dns" ] ; then
echo "-A V2RAY_MASK -p udp --dport 53 -j MARK --set-mark 1"
echo "-A V2RAY_MASK -p udp --dport 53 -j MARK --set-mark $IPTABLES_REDIRECT_MARK/$IPTABLES_MASK"
else
echo "-A V2RAY_MASK -p udp -j MARK --set-mark 1"
echo "-A V2RAY_MASK -p udp -j MARK --set-mark $IPTABLES_REDIRECT_MARK/$IPTABLES_MASK"
fi
fi
)
Expand All @@ -544,7 +549,7 @@ add_v2ray_tproxy_rules() {
clear_v2ray_rules() {
iptables-save --counters | grep -v "V2RAY" | iptables-restore --counters

while ip rule del fwmark 1 lookup 100 2>/dev/null ; do true ; done
while ip rule del fwmark $IPTABLES_REDIRECT_MARK/$IPTABLES_MASK pref 100 lookup 100 2>/dev/null ; do true ; done

ip route flush table 100
ip route del local 0.0.0.0/0 dev lo table 100 2>/dev/null
Expand Down Expand Up @@ -1858,7 +1863,7 @@ add_outbound_setting() {
json_add_object "sockopt"

if [ -n "$TRANSPARENT_PROXY_PORT" ] ; then
json_add_int "mark" "255"
json_add_int "mark" "$TRANSPARENT_REDIRECT_MARK"
else
test -n "$ss_sockopt_mark" && \
json_add_int "mark" "$ss_sockopt_mark"
Expand Down