vpnbypass.init (4735B)
1 #!/bin/sh /etc/rc.common 2 PKG_VERSION= 3 4 export START=94 5 export USE_PROCD=1 6 7 readonly __ok__='\033[0;32m[\xe2\x9c\x93]\033[0m' 8 readonly __fail__='\033[0;31m[\xe2\x9c\x97]\033[0m' 9 readonly __pass__='\033[0;33m[-]\033[0m' 10 readonly __error__='\033[0;31mERROR\033[0m' 11 12 export verbosity=2 TID='200' IPSET='vpnbypass' FW_MARK='0x010000' FW_MASK='0xff0000' wan_if4 wan_gw 13 14 output() { [[ $# -ne 1 ]] && { [[ ! $((verbosity & $1)) -gt 0 ]] && return 0 || shift; }; local msg; msg=$(echo -n "${1/$p_name /service }" | sed 's|\\033\[[0-9]\?;\?[0-9]\?[0-9]\?m||g'); [[ -t 1 ]] && echo -e -n "$1"; [[ $(echo -e -n "$msg" | wc -l) -gt 0 ]] && logger -t "${PKG_NAME:-service} [$$]" "$(echo -e -n ${logmsg}${msg})" && logmsg='' || logmsg=${logmsg}${msg}; } 15 PKG_NAME="${PKG_NAME:-vpnbypass}"; p_name="${PKG_NAME} ${PKG_VERSION}" 16 17 is_enabled() { 18 local c=1 enabled 19 config_load $PKG_NAME 20 config_get_bool enabled 'config' 'enabled' 1 21 config_get verbosity 'config' 'verbosity' '2' 22 config_get TID 'config' 'table_number' '200' 23 config_get IPSET 'config' 'ipset' 'vpnbypass' 24 config_get FW_MARK 'config' 'fw_mark' '0x010000' 25 config_get FW_MASK 'config' 'fw_mask' '0xff0000' 26 source /lib/functions/network.sh 27 [[ $enabled -gt 0 ]] || { output "$__error__: $p_name is not enabled.\n"; return 1; } 28 source /lib/functions/network.sh 29 while : ; do 30 network_find_wan wan_if4 31 [ -n "$wan_if4" ] && network_get_gateway wan_gw $wan_if4 32 [[ $c -ge 25 || -n "$wan_gw" ]] && break 33 output "$p_name waiting for wan gateway...\n" 34 sleep 2; network_flush_cache; let "c+=1"; 35 done 36 [ -n "$wan_gw" ] && return 0 || { output "$__error__: $p_name failed to discover WAN gateway.\n"; return 1; } 37 } 38 39 ipt() { 40 local d; d=$(echo "$*" | sed s/-A/-D/g); 41 [ "$d" != "$*" ] && iptables $d >/dev/null 2>&1 42 d=$(echo "$*" | sed s/-I/-D/g) 43 [ "$d" != "$*" ] && iptables $d >/dev/null 2>&1 44 d=$(echo "$*" | sed s/-N/-F/g) 45 [ "$d" != "$*" ] && iptables $d >/dev/null 2>&1 46 d=$(echo "$*" | sed s/-N/-X/g) 47 [ "$d" != "$*" ] && iptables $d >/dev/null 2>&1 48 d="$*" 49 iptables $d >/dev/null 2>&1 || output "\n$__error__: iptables $d\n" 50 } 51 52 start_service() { 53 local ll lports rports routes ranges 54 is_enabled || return 1 55 config_get lports 'config' 'localport' 56 config_get rports 'config' 'remoteport' 57 config_get routes 'config' 'remotesubnet' 58 config_get ranges 'config' 'localsubnet' 59 60 procd_open_instance 61 procd_set_param stdout 1 62 procd_set_param stderr 1 63 procd_close_instance 64 65 iptables -t mangle -D PREROUTING -m mark --mark 0x00/${FW_MASK} -g VPNBYPASS >/dev/null 2>&1 66 ipt -t mangle -N VPNBYPASS; ipt -t mangle -A PREROUTING -m mark --mark 0x00/${FW_MASK} -g VPNBYPASS; 67 ipt -t mangle -A VPNBYPASS -m set --match-set $IPSET dst -j MARK --set-mark ${FW_MARK}/${FW_MASK} 68 ip rule del fwmark "$FW_MARK" table "$TID" >/dev/null 2>&1; ipset -q flush "$IPSET"; ipset -q destroy "$IPSET"; 69 ip route flush table "$TID"; ip route flush cache; 70 ip route add default via "$wan_gw" table "$TID"; ip route flush cache; 71 ipset -q -exist create "$IPSET" hash:ip; ipset -q flush "$IPSET" 72 ip rule add fwmark "$FW_MARK" table "$TID" 73 { modprobe xt_set; modprobe ip_set; modprobe ip_set_hash_ip; } >/dev/null 2>&1 74 for ll in ${ranges}; do ipt -t mangle -I VPNBYPASS 1 -j MARK --set-mark ${FW_MARK}/${FW_MASK} -s "$ll"; done 75 for ll in ${lports}; do ipt -t mangle -I VPNBYPASS 1 -j MARK --set-mark ${FW_MARK}/${FW_MASK} -p tcp -m multiport --sport "${ll//-/:}"; done 76 for ll in ${routes}; do ipt -t mangle -I VPNBYPASS 1 -j MARK --set-mark ${FW_MARK}/${FW_MASK} -d "$ll"; done 77 for ll in ${rports}; do ipt -t mangle -I VPNBYPASS 1 -j MARK --set-mark ${FW_MARK}/${FW_MASK} -p tcp -m multiport --dport "${ll//-/:}"; done 78 output "$p_name started with TID: $TID; FW_MARK: $FW_MARK\n" 79 } 80 81 stop_service() { 82 is_enabled || return 1 83 84 ip rule del fwmark "$FW_MARK" table "$TID" >/dev/null 2>&1; ipset -q flush "$IPSET"; ipset -q destroy "$IPSET"; 85 ip route flush table "$TID"; ip route flush cache; 86 iptables -t mangle -D PREROUTING -m mark --mark 0x00/${FW_MASK} -g VPNBYPASS >/dev/null 2>&1 87 iptables -t mangle -F VPNBYPASS >/dev/null 2>&1; iptables -t mangle -X VPNBYPASS >/dev/null 2>&1; 88 output "$p_name stopped\n" 89 } 90 91 reload_service(){ 92 start_service 93 } 94 95 st_load_interfaces(){ local d; config_get d $1 ifname; [[ "$1" == "$wan_if4" || "$d" != "${d/tun}" || "$d" != "${d/tap}" ]] && ifaces=" ${1} ${ifaces}"; } 96 service_triggers() { 97 local ifaces n 98 procd_add_reload_trigger 'vpnbypass' 99 procd_open_trigger 100 procd_add_config_trigger "config.change" "vpnbypass" /etc/init.d/vpnbypass reload 101 for n in $ifaces; do procd_add_interface_trigger "interface.*" "$n" /etc/init.d/openvpn-policy-routing reload; done; 102 procd_close_trigger 103 }