6 IPT4
="iptables -t mangle -w"
7 IPT6
="ip6tables -t mangle -w"
8 LOG
="logger -t mwan3[$$] -p"
9 CONNTRACK_FILE
="/proc/net/nf_conntrack"
11 MWAN3_STATUS_DIR
="/var/run/mwan3track"
13 # mwan3's MARKing mask (at least 3 bits should be set)
16 # counts how many bits are set to 1
17 # n&(n-1) clears the lowest bit set to 1
18 mwan3_count_one_bits
()
23 while [ "$n" -gt "0" ]; do
30 # maps the 1st parameter so it only uses the bits allowed by the bitmask (2nd parameter)
31 # which means spreading the bits of the 1st parameter to only use the bits that are set to 1 in the 2nd parameter
32 # 0 0 0 0 0 1 0 1 (0x05) 1st parameter
33 # 1 0 1 0 1 0 1 0 (0xAA) 2nd parameter
37 local bit_msk bit_val result
40 for bit_msk
in $
(seq 0 31); do
41 if [ $
((($2>>bit_msk
)&1)) = "1" ]; then
42 if [ $
((($1>>bit_val
)&1)) = "1" ]; then
43 result
=$
((result|
(1<<bit_msk)))
45 bit_val=$((bit_val+1))
52 MM_BIT_CNT=$(mwan3_count_one_bits MMX_MASK)
53 MM_DEFAULT=$(((1<<MM_BIT_CNT)-1))
54 MM_BLACKHOLE=$(($MM_DEFAULT-2))
55 MM_UNREACHABLE=$(($MM_DEFAULT-1))
57 # MMX_DEFAULT should equal MMX_MASK
58 MMX_DEFAULT=$(mwan3_id2mask MM_DEFAULT MMX_MASK)
59 MMX_BLACKHOLE=$(mwan3_id2mask MM_BLACKHOLE MMX_MASK)
60 MMX_UNREACHABLE=$(mwan3_id2mask MM_UNREACHABLE MMX_MASK)
63 lock /var/run/mwan3.lock
67 lock -u /var/run/mwan3.lock
71 rm -rf /var/run/mwan3.lock
76 local _tmp _iface _iface_count
83 [ "$1" == "$_iface" ] && _tmp=$_iface_count
85 config_foreach mwan3_get_id interface
89 mwan3_set_connected_iptables()
91 local connected_network_v4 connected_network_v6
93 $IPS -! create mwan3_connected_v4 hash:net
94 $IPS create mwan3_connected_v4_temp hash:net
96 for connected_network_v4 in $($IP4 route | awk '{print $1}' | egrep '[0-9]{1,3}(\.[0-9]{1,3}){3}'); do
97 $IPS -! add mwan3_connected_v4_temp $connected_network_v4
100 for connected_network_v4 in $($IP4 route list table 0 | awk '{print $2}' | egrep '[0-9]{1,3}(\.[0-9]{1,3}){3}'); do
101 $IPS -! add mwan3_connected_v4_temp $connected_network_v4
104 $IPS add mwan3_connected_v4_temp 224.0.0.0/3
106 $IPS swap mwan3_connected_v4_temp mwan3_connected_v4
107 $IPS destroy mwan3_connected_v4_temp
109 $IPS -! create mwan3_connected_v6 hash:net family inet6
110 $IPS create mwan3_connected_v6_temp hash:net family inet6
112 for connected_network_v6 in $($IP6 route | awk '{print $1}' | egrep '([0-9a-fA-F]{1,4}:){7,7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:)|fe80:(:[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}|::(ffff(:0{1,4}){0,1}:){0,1}((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])|([0-9a-fA-F]{1,4}:){1,4}:((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])'); do
113 $IPS -! add mwan3_connected_v6_temp $connected_network_v6
116 $IPS swap mwan3_connected_v6_temp mwan3_connected_v6
117 $IPS destroy mwan3_connected_v6_temp
119 $IPS -! create mwan3_connected list:set
120 $IPS -! add mwan3_connected mwan3_connected_v4
121 $IPS -! add mwan3_connected mwan3_connected_v6
124 mwan3_set_general_rules()
128 for IP in "$IP4" "$IP6"; do
130 RULE_NO=$(($MM_BLACKHOLE+2000))
131 if [ -z "$($IP rule list | awk -v var="$RULE_NO:" '$1 == var')" ]; then
132 $IP rule add pref $RULE_NO fwmark $MMX_BLACKHOLE/$MMX_MASK blackhole
135 RULE_NO=$(($MM_UNREACHABLE+2000))
136 if [ -z "$($IP rule list | awk -v var="$RULE_NO:" '$1 == var')" ]; then
137 $IP rule add pref $RULE_NO fwmark $MMX_UNREACHABLE/$MMX_MASK unreachable
142 mwan3_set_general_iptables()
146 for IPT in "$IPT4" "$IPT6"; do
148 if ! $IPT -S mwan3_ifaces_in &> /dev/null; then
149 $IPT -N mwan3_ifaces_in
152 if ! $IPT -S mwan3_connected &> /dev/null; then
153 $IPT -N mwan3_connected
154 $IPS -! create mwan3_connected list:set
155 $IPT -A mwan3_connected -m set --match-set mwan3_connected dst -j MARK --set-xmark $MMX_DEFAULT/$MMX_MASK
158 if ! $IPT -S mwan3_ifaces_out &> /dev/null; then
159 $IPT -N mwan3_ifaces_out
162 if ! $IPT -S mwan3_rules &> /dev/null; then
166 if ! $IPT -S mwan3_hook &> /dev/null; then
168 $IPT -A mwan3_hook -j CONNMARK --restore-mark --nfmask $MMX_MASK --ctmask $MMX_MASK
169 $IPT -A mwan3_hook -m mark --mark 0x0/$MMX_MASK -j mwan3_ifaces_in
170 $IPT -A mwan3_hook -m mark --mark 0x0/$MMX_MASK -j mwan3_connected
171 $IPT -A mwan3_hook -m mark --mark 0x0/$MMX_MASK -j mwan3_ifaces_out
172 $IPT -A mwan3_hook -m mark --mark 0x0/$MMX_MASK -j mwan3_rules
173 $IPT -A mwan3_hook -j CONNMARK --save-mark --nfmask $MMX_MASK --ctmask $MMX_MASK
174 $IPT -A mwan3_hook -m mark ! --mark $MMX_DEFAULT/$MMX_MASK -j mwan3_connected
177 if ! $IPT -S PREROUTING | grep mwan3_hook &> /dev/null; then
178 $IPT -A PREROUTING -j mwan3_hook
181 if ! $IPT -S OUTPUT | grep mwan3_hook &> /dev/null; then
182 $IPT -A OUTPUT -j mwan3_hook
187 mwan3_create_iface_iptables()
189 local id family src_ip src_ipv6
191 config_get family $1 family ipv4
192 mwan3_get_iface_id id $1
194 [ -n "$id" ] || return 0
196 if [ "$family" == "ipv4" ]; then
198 ubus call network.interface.${1}_4 status &>/dev/null
199 if [ "$?" -eq "0" ]; then
200 network_get_ipaddr src_ip ${1}_4
202 network_get_ipaddr src_ip $1
205 $IPS -! create mwan3_connected list:set
207 if ! $IPT4 -S mwan3_ifaces_in &> /dev/null; then
208 $IPT4 -N mwan3_ifaces_in
211 if ! $IPT4 -S mwan3_ifaces_out &> /dev/null; then
212 $IPT4 -N mwan3_ifaces_out
215 if ! $IPT4 -S mwan3_iface_in_$1 &> /dev/null; then
216 $IPT4 -N mwan3_iface_in_$1
219 if ! $IPT4 -S mwan3_iface_out_$1 &> /dev/null; then
220 $IPT4 -N mwan3_iface_out_$1
223 $IPT4 -F mwan3_iface_in_$1
224 $IPT4 -A mwan3_iface_in_$1 -i $2 -m set --match-set mwan3_connected src -m mark --mark 0x0/$MMX_MASK -m comment --comment "default" -j MARK --set-xmark $MMX_DEFAULT/$MMX_MASK
225 $IPT4 -A mwan3_iface_in_$1 -i $2 -m mark --mark 0x0/$MMX_MASK -m comment --comment "$1" -j MARK --set-xmark $(mwan3_id2mask id MMX_MASK)/$MMX_MASK
227 $IPT4 -D mwan3_ifaces_in -m mark --mark 0x0/$MMX_MASK -j mwan3_iface_in_$1 &> /dev/null
228 $IPT4 -A mwan3_ifaces_in -m mark --mark 0x0/$MMX_MASK -j mwan3_iface_in_$1
230 $IPT4 -F mwan3_iface_out_$1
231 $IPT4 -A mwan3_iface_out_$1 -s $src_ip -m mark --mark 0x0/$MMX_MASK -m comment --comment "$1" -j MARK --set-xmark $(mwan3_id2mask id MMX_MASK)/$MMX_MASK
233 $IPT4 -D mwan3_ifaces_out -m mark --mark 0x0/$MMX_MASK -j mwan3_iface_out_$1 &> /dev/null
234 $IPT4 -A mwan3_ifaces_out -m mark --mark 0x0/$MMX_MASK -j mwan3_iface_out_$1
237 if [ "$family" == "ipv6" ]; then
239 ubus call network.interface.${1}_6 status &>/dev/null
240 if [ "$?" -eq "0" ]; then
241 network_get_ipaddr6 src_ipv6 ${1}_6
243 network_get_ipaddr6 src_ipv6 $1
246 $IPS -! create mwan3_connected_v6 hash:net family inet6
248 if ! $IPT6 -S mwan3_ifaces_in &> /dev/null; then
249 $IPT6 -N mwan3_ifaces_in
252 if ! $IPT6 -S mwan3_ifaces_out &> /dev/null; then
253 $IPT6 -N mwan3_ifaces_out
256 if ! $IPT6 -S mwan3_iface_in_$1 &> /dev/null; then
257 $IPT6 -N mwan3_iface_in_$1
260 if ! $IPT6 -S mwan3_iface_out_$1 &> /dev/null; then
261 $IPT6 -N mwan3_iface_out_$1
264 $IPT6 -F mwan3_iface_in_$1
265 $IPT6 -A mwan3_iface_in_$1 -i $2 -m set --match-set mwan3_connected_v6 src -m mark --mark 0x0/$MMX_MASK -m comment --comment "default" -j MARK --set-xmark $MMX_DEFAULT/$MMX_MASK
266 $IPT6 -A mwan3_iface_in_$1 -i $2 -m mark --mark 0x0/$MMX_MASK -m comment --comment "$1" -j MARK --set-xmark $(mwan3_id2mask id MMX_MASK)/$MMX_MASK
268 $IPT6 -D mwan3_ifaces_in -m mark --mark 0x0/$MMX_MASK -j mwan3_iface_in_$1 &> /dev/null
269 $IPT6 -A mwan3_ifaces_in -m mark --mark 0x0/$MMX_MASK -j mwan3_iface_in_$1
271 $IPT6 -F mwan3_iface_out_$1
272 $IPT6 -A mwan3_iface_out_$1 -s $src_ipv6 -m mark --mark 0x0/$MMX_MASK -m comment --comment "$1" -j MARK --set-xmark $(mwan3_id2mask id MMX_MASK)/$MMX_MASK
274 $IPT6 -D mwan3_ifaces_out -m mark --mark 0x0/$MMX_MASK -j mwan3_iface_out_$1 &> /dev/null
275 $IPT6 -A mwan3_ifaces_out -m mark --mark 0x0/$MMX_MASK -j mwan3_iface_out_$1
279 mwan3_delete_iface_iptables()
281 config_get family $1 family ipv4
283 if [ "$family" == "ipv4" ]; then
285 $IPT4 -D mwan3_ifaces_in -m mark --mark 0x0/$MMX_MASK -j mwan3_iface_in_$1 &> /dev/null
286 $IPT4 -F mwan3_iface_in_$1 &> /dev/null
287 $IPT4 -X mwan3_iface_in_$1 &> /dev/null
289 $IPT4 -D mwan3_ifaces_out -m mark --mark 0x0/$MMX_MASK -j mwan3_iface_out_$1 &> /dev/null
290 $IPT4 -F mwan3_iface_out_$1 &> /dev/null
291 $IPT4 -X mwan3_iface_out_$1 &> /dev/null
294 if [ "$family" == "ipv6" ]; then
296 $IPT6 -D mwan3_ifaces_in -m mark --mark 0x0/$MMX_MASK -j mwan3_iface_in_$1 &> /dev/null
297 $IPT6 -F mwan3_iface_in_$1 &> /dev/null
298 $IPT6 -X mwan3_iface_in_$1 &> /dev/null
300 $IPT6 -D mwan3_ifaces_out -m mark --mark 0x0/$MMX_MASK -j mwan3_iface_out_$1 &> /dev/null
301 $IPT6 -F mwan3_iface_out_$1 &> /dev/null
302 $IPT6 -X mwan3_iface_out_$1 &> /dev/null
306 mwan3_create_iface_route()
310 config_get family $1 family ipv4
311 mwan3_get_iface_id id $1
313 [ -n "$id" ] || return 0
315 if [ "$family" == "ipv4" ]; then
316 ubus call network.interface.${1}_4 status &>/dev/null
317 if [ "$?" -eq "0" ]; then
318 network_get_gateway route_args ${1}_4
320 network_get_gateway route_args $1
323 route_args="via $route_args dev $2"
325 $IP4 route flush table $id
326 $IP4 route add table $id default $route_args
329 if [ "$family" == "ipv6" ]; then
331 ubus call network.interface.${1}_6 status &>/dev/null
332 if [ "$?" -eq "0" ]; then
333 network_get_gateway6 route_args ${1}_6
335 network_get_gateway6 route_args $1
338 route_args="via $route_args dev $2"
340 $IP6 route flush table $id
341 $IP6 route add table $id default $route_args
345 mwan3_delete_iface_route()
349 config_get family $1 family ipv4
350 mwan3_get_iface_id id $1
352 [ -n "$id" ] || return 0
354 if [ "$family" == "ipv4" ]; then
355 $IP4 route flush table $id
358 if [ "$family" == "ipv6" ]; then
359 $IP6 route flush table $id
363 mwan3_create_iface_rules()
367 config_get family $1 family ipv4
368 mwan3_get_iface_id id $1
370 [ -n "$id" ] || return 0
372 if [ "$family" == "ipv4" ]; then
374 while [ -n "$($IP4 rule list | awk '$1 == "'$(($id+1000)):'"')" ]; do
375 $IP4 rule del pref $(($id+1000))
378 while [ -n "$($IP4 rule list | awk '$1 == "'$(($id+2000)):'"')" ]; do
379 $IP4 rule del pref $(($id+2000))
382 $IP4 rule add pref $(($id+1000)) iif $2 lookup main
383 $IP4 rule add pref $(($id+2000)) fwmark $(mwan3_id2mask id MMX_MASK)/$MMX_MASK lookup $id
386 if [ "$family" == "ipv6" ]; then
388 while [ -n "$($IP6 rule list | awk '$1 == "'$(($id+1000)):'"')" ]; do
389 $IP6 rule del pref $(($id+1000))
392 while [ -n "$($IP6 rule list | awk '$1 == "'$(($id+2000)):'"')" ]; do
393 $IP6 rule del pref $(($id+2000))
396 $IP6 rule add pref $(($id+1000)) iif $2 lookup main
397 $IP6 rule add pref $(($id+2000)) fwmark $(mwan3_id2mask id MMX_MASK)/$MMX_MASK lookup $id
401 mwan3_delete_iface_rules()
405 config_get family $1 family ipv4
406 mwan3_get_iface_id id $1
408 [ -n "$id" ] || return 0
410 if [ "$family" == "ipv4" ]; then
412 while [ -n "$($IP4 rule list | awk '$1 == "'$(($id+1000)):'"')" ]; do
413 $IP4 rule del pref $(($id+1000))
416 while [ -n "$($IP4 rule list | awk '$1 == "'$(($id+2000)):'"')" ]; do
417 $IP4 rule del pref $(($id+2000))
421 if [ "$family" == "ipv6" ]; then
423 while [ -n "$($IP6 rule list | awk '$1 == "'$(($id+1000)):'"')" ]; do
424 $IP6 rule del pref $(($id+1000))
427 while [ -n "$($IP6 rule list | awk '$1 == "'$(($id+2000)):'"')" ]; do
428 $IP6 rule del pref $(($id+2000))
433 mwan3_delete_iface_ipset_entries()
435 local id setname entry
437 mwan3_get_iface_id id $1
439 [ -n "$id" ] || return 0
441 for setname in $(ipset -n list | grep ^mwan3_sticky_); do
442 for entry in $(ipset list $setname | grep "$(echo $(mwan3_id2mask id MMX_MASK) | awk '{ printf "0x%08x", $1; }')" | cut -d ' ' -f 1); do
443 $IPS del $setname $entry
450 local track_ip track_ips
452 mwan3_list_track_ips()
454 track_ips="$1 $track_ips"
456 config_list_foreach $1 track_ip mwan3_list_track_ips
458 kill $(pgrep -f "mwan3track $1 $2") &> /dev/null
459 if [ -n "$track_ips" ]; then
460 [ -x /usr/sbin/mwan3track ] && /usr/sbin/mwan3track "$1" "$2" "$3" $track_ips &
468 pid="$(pgrep -f "mwan3track $1 $2")"
469 if [ "${pid}" != "" ]; then
472 $LOG warn "Unable to send signal USR1 to mwan3track on interface $1 with pid ${pid}"
478 local iface_count id iface family metric probability weight
480 config_get iface $1 interface
481 config_get metric $1 metric 1
482 config_get weight $1 weight 1
484 [ -n "$iface" ] || return 0
486 mwan3_get_iface_id id $iface
488 [ -n "$id" ] || return 0
490 config_get family $iface family ipv4
492 if [ "$family" == "ipv4" ]; then
494 if [ -n "$($IP4 route list table $id)" ]; then
495 if [ "$metric" -lt "$lowest_metric_v4" ]; then
497 total_weight_v4=$weight
498 $IPT4 -F mwan3_policy_$policy
499 $IPT4 -A mwan3_policy_$policy -m mark --mark 0x0/$MMX_MASK -m comment --comment "$iface $weight $weight" -j MARK --set-xmark $(mwan3_id2mask id MMX_MASK)/$MMX_MASK
501 lowest_metric_v4=$metric
503 elif [ "$metric" -eq "$lowest_metric_v4" ]; then
505 total_weight_v4=$(($total_weight_v4+$weight))
506 probability=$(($weight*1000/$total_weight_v4))
508 if [ "$probability" -lt 10 ]; then
509 probability="0.00$probability"
510 elif [ $probability -lt 100 ]; then
511 probability="0.0$probability"
512 elif [ $probability -lt 1000 ]; then
513 probability="0.$probability"
518 probability="-m statistic --mode random --probability $probability"
520 $IPT4 -I mwan3_policy_$policy -m mark --mark 0x0/$MMX_MASK $probability -m comment --comment "$iface $weight $total_weight_v4" -j MARK --set-xmark $(mwan3_id2mask id MMX_MASK)/$MMX_MASK
525 if [ "$family" == "ipv6" ]; then
527 if [ -n "$($IP6 route list table $id)" ]; then
528 if [ "$metric" -lt "$lowest_metric_v6" ]; then
530 total_weight_v6=$weight
531 $IPT6 -F mwan3_policy_$policy
532 $IPT6 -A mwan3_policy_$policy -m mark --mark 0x0/$MMX_MASK -m comment --comment "$iface $weight $weight" -j MARK --set-xmark $(mwan3_id2mask id MMX_MASK)/$MMX_MASK
534 lowest_metric_v6=$metric
536 elif [ "$metric" -eq "$lowest_metric_v6" ]; then
538 total_weight_v6=$(($total_weight_v6+$weight))
539 probability=$(($weight*1000/$total_weight_v6))
541 if [ "$probability" -lt 10 ]; then
542 probability="0.00$probability"
543 elif [ $probability -lt 100 ]; then
544 probability="0.0$probability"
545 elif [ $probability -lt 1000 ]; then
546 probability="0.$probability"
551 probability="-m statistic --mode random --probability $probability"
553 $IPT6 -I mwan3_policy_$policy -m mark --mark 0x0/$MMX_MASK $probability -m comment --comment "$iface $weight $total_weight_v6" -j MARK --set-xmark $(mwan3_id2mask id MMX_MASK)/$MMX_MASK
559 mwan3_create_policies_iptables()
561 local last_resort lowest_metric_v4 lowest_metric_v6 total_weight_v4 total_weight_v6 policy IPT
565 config_get last_resort $1 last_resort unreachable
567 if [ "$1" != $(echo "$1" | cut -c1-15) ]; then
568 $LOG warn "Policy $1 exceeds max of 15 chars. Not setting policy" && return 0
571 for IPT in "$IPT4" "$IPT6"; do
573 if ! $IPT -S mwan3_policy_$1 &> /dev/null; then
574 $IPT -N mwan3_policy_$1
577 $IPT -F mwan3_policy_$1
579 case "$last_resort" in
581 $IPT -A mwan3_policy_$1 -m mark --mark 0x0/$MMX_MASK -m comment --comment "blackhole" -j MARK --set-xmark $MMX_BLACKHOLE/$MMX_MASK
584 $IPT -A mwan3_policy_$1 -m mark --mark 0x0/$MMX_MASK -m comment --comment "default" -j MARK --set-xmark $MMX_DEFAULT/$MMX_MASK
587 $IPT -A mwan3_policy_$1 -m mark --mark 0x0/$MMX_MASK -m comment --comment "unreachable" -j MARK --set-xmark $MMX_UNREACHABLE/$MMX_MASK
598 config_list_foreach $1 use_member mwan3_set_policy
601 mwan3_set_policies_iptables()
603 config_foreach mwan3_create_policies_iptables policy
606 mwan3_set_sticky_iptables()
610 for iface in $($IPT4 -S $policy | cut -s -d'"' -f2 | awk '{print $1}'); do
612 if [ "$iface" == "$1" ]; then
614 mwan3_get_iface_id id $1
616 [ -n "$id" ] || return 0
618 for IPT in "$IPT4" "$IPT6"; do
619 if [ -n "$($IPT -S mwan3_iface_in_$1 2> /dev/null)" -a -n "$($IPT -S mwan3_iface_out_$1 2> /dev/null)" ]; then
620 $IPT -I mwan3_rule_$rule -m mark --mark $(mwan3_id2mask id MMX_MASK)/$MMX_MASK -m set ! --match-set mwan3_sticky_$rule src,src -j MARK --set-xmark 0x0/$MMX_MASK
621 $IPT -I mwan3_rule_$rule -m mark --mark 0/$MMX_MASK -j MARK --set-xmark $(mwan3_id2mask id MMX_MASK)/$MMX_MASK
628 mwan3_set_user_iptables_rule()
630 local ipset family proto policy src_ip src_port sticky dest_ip dest_port use_policy timeout rule policy IPT
634 config_get sticky $1 sticky 0
635 config_get timeout $1 timeout 600
636 config_get ipset $1 ipset
637 config_get proto $1 proto all
638 config_get src_ip $1 src_ip 0.0.0.0/0
639 config_get src_port $1 src_port 0:65535
640 config_get dest_ip $1 dest_ip 0.0.0.0/0
641 config_get dest_port $1 dest_port 0:65535
642 config_get use_policy $1 use_policy
643 config_get family $1 family any
645 if [ "$1" != $(echo "$1" | cut -c1-15) ]; then
646 $LOG warn "Rule $1 exceeds max of 15 chars. Not setting rule" && return 0
649 if [ -n "$ipset" ]; then
650 ipset="-m set --match-set $ipset dst"
653 if [ -n "$use_policy" ]; then
654 if [ "$use_policy" == "default" ]; then
655 policy="MARK --set-xmark $MMX_DEFAULT/$MMX_MASK"
656 elif [ "$use_policy" == "unreachable" ]; then
657 policy="MARK --set-xmark $MMX_UNREACHABLE/$MMX_MASK"
658 elif [ "$use_policy" == "blackhole" ]; then
659 policy="MARK --set-xmark $MMX_BLACKHOLE/$MMX_MASK"
661 if [ "$sticky" -eq 1 ]; then
663 policy="mwan3_policy_$use_policy"
665 for IPT in "$IPT4" "$IPT6"; do
666 if ! $IPT -S $policy &> /dev/null; then
670 if ! $IPT -S mwan3_rule_$1 &> /dev/null; then
671 $IPT -N mwan3_rule_$1
674 $IPT -F mwan3_rule_$1
677 $IPS -! create mwan3_sticky_v4_$rule hash:ip,mark markmask $MMX_MASK timeout $timeout
678 $IPS -! create mwan3_sticky_v6_$rule hash:ip,mark markmask $MMX_MASK timeout $timeout family inet6
679 $IPS -! create mwan3_sticky_$rule list:set
680 $IPS -! add mwan3_sticky_$rule mwan3_sticky_v4_$rule
681 $IPS -! add mwan3_sticky_$rule mwan3_sticky_v6_$rule
683 config_foreach mwan3_set_sticky_iptables interface
685 for IPT in "$IPT4" "$IPT6"; do
686 $IPT -A mwan3_rule_$1 -m mark --mark 0/$MMX_MASK -j $policy
687 $IPT -A mwan3_rule_$1 -m mark ! --mark 0xfc00/0xfc00 -j SET --del-set mwan3_sticky_$rule src,src
688 $IPT -A mwan3_rule_$1 -m mark ! --mark 0xfc00/0xfc00 -j SET --add-set mwan3_sticky_$rule src,src
691 policy="mwan3_rule_$1"
693 policy="mwan3_policy_$use_policy"
695 for IPT in "$IPT4" "$IPT6"; do
696 if ! $IPT -S $policy &> /dev/null; then
704 if [ "$family" == "any" ]; then
706 for IPT in "$IPT4" "$IPT6"; do
709 $IPT -A mwan3_rules -p $proto -s $src_ip -d $dest_ip $ipset -m multiport --sports $src_port -m multiport --dports $dest_port -m mark --mark 0/$MMX_MASK -m comment --comment "$1" -j $policy &> /dev/null
712 $IPT -A mwan3_rules -p $proto -s $src_ip -d $dest_ip $ipset -m mark --mark 0/$MMX_MASK -m comment --comment "$1" -j $policy &> /dev/null
717 elif [ "$family" == "ipv4" ]; then
721 $IPT4 -A mwan3_rules -p $proto -s $src_ip -d $dest_ip $ipset -m multiport --sports $src_port -m multiport --dports $dest_port -m mark --mark 0/$MMX_MASK -m comment --comment "$1" -j $policy &> /dev/null
724 $IPT4 -A mwan3_rules -p $proto -s $src_ip -d $dest_ip $ipset -m mark --mark 0/$MMX_MASK -m comment --comment "$1" -j $policy &> /dev/null
728 elif [ "$family" == "ipv6" ]; then
732 $IPT6 -A mwan3_rules -p $proto -s $src_ip -d $dest_ip $ipset -m multiport --sports $src_port -m multiport --dports $dest_port -m mark --mark 0/$MMX_MASK -m comment --comment "$1" -j $policy &> /dev/null
735 $IPT6 -A mwan3_rules -p $proto -s $src_ip -d $dest_ip $ipset -m mark --mark 0/$MMX_MASK -m comment --comment "$1" -j $policy &> /dev/null
742 mwan3_set_user_rules()
746 for IPT in "$IPT4" "$IPT6"; do
748 if ! $IPT -S mwan3_rules &> /dev/null; then
755 config_foreach mwan3_set_user_iptables_rule rule
758 mwan3_report_iface_status()
760 local device result track_ips tracking IP IPT
762 mwan3_get_iface_id id $1
763 network_get_device device $1
764 config_get enabled "$1" enabled 0
765 config_get family "$1" family ipv4
767 if [ "$family" == "ipv4" ]; then
772 if [ "$family" == "ipv6" ]; then
777 if [ -z "$id" -o -z "$device" ]; then
779 elif [ -n "$($IP rule | awk '$1 == "'$(($id+1000)):'"')"i -a -n "$($IP rule | awk '$1 == "'$(($id+2000)):'"')" -a -n "$($IPT -S mwan3_iface_in_$1 2> /dev/null)" -a -n "$($IPT -S mwan3_iface_out_$1 2> /dev/null)" -a -n "$($IP route list table $id default dev $device 2> /dev/null)" ]; then
781 elif [ -n "$($IP rule | awk '$1 == "'$(($id+1000)):'"')" -o -n "$($IP rule | awk '$1 == "'$(($id+2000)):'"')" -o -n "$($IPT -S mwan3_iface_in_$1 2> /dev/null)" -o -n "$($IPT -S mwan3_iface_out_$1 2> /dev/null)" -o -n "$($IP route list table $id default dev $device 2> /dev/null)" ]; then
784 if [ "$enabled" == "1" ]; then
791 mwan3_list_track_ips()
793 track_ips="$1 $track_ips"
795 config_list_foreach $1 track_ip mwan3_list_track_ips
797 if [ -n "$track_ips" ]; then
798 if [ -n "$(pgrep -f "mwan3track $1 $device")" ]; then
804 tracking="not enabled"
807 echo " interface $1 is $result and tracking is $tracking"
810 mwan3_report_policies_v4()
812 local percent policy share total_weight weight iface
814 for policy in $($IPT4 -S | awk '{print $2}' | grep mwan3_policy_ | sort -u); do
815 echo "$policy:" | sed 's/mwan3_policy_//'
817 [ -n "$total_weight" ] || total_weight=$($IPT4 -S $policy | cut -s -d'"' -f2 | head -1 | awk '{print $3}')
819 if [ ! -z "${total_weight##*[!0-9]*}" ]; then
820 for iface in $($IPT4 -S $policy | cut -s -d'"' -f2 | awk '{print $1}'); do
821 weight=$($IPT4 -S $policy | cut -s -d'"' -f2 | awk '$1 == "'$iface'"' | awk '{print $2}')
822 percent=$(($weight*100/$total_weight))
823 echo " $iface ($percent%)"
826 echo " $($IPT4 -S $policy | sed '/.*--comment \([^ ]*\) .*$/!d;s//\1/;q')"
835 mwan3_report_policies_v6()
837 local percent policy share total_weight weight iface
839 for policy in $($IPT6 -S | awk '{print $2}' | grep mwan3_policy_ | sort -u); do
840 echo "$policy:" | sed 's/mwan3_policy_//'
842 [ -n "$total_weight" ] || total_weight=$($IPT6 -S $policy | cut -s -d'"' -f2 | head -1 | awk '{print $3}')
844 if [ ! -z "${total_weight##*[!0-9]*}" ]; then
845 for iface in $($IPT6 -S $policy | cut -s -d'"' -f2 | awk '{print $1}'); do
846 weight=$($IPT6 -S $policy | cut -s -d'"' -f2 | awk '$1 == "'$iface'"' | awk '{print $2}')
847 percent=$(($weight*100/$total_weight))
848 echo " $iface ($percent%)"
851 echo " $($IPT6 -S $policy | sed '/.*--comment \([^ ]*\) .*$/!d;s//\1/;q')"
860 mwan3_report_connected_v4()
864 if [ -n "$($IPT4 -S mwan3_connected 2> /dev/null)" ]; then
865 for address in $($IPS list mwan3_connected_v4 | egrep '[0-9]{1,3}(\.[0-9]{1,3}){3}'); do
871 mwan3_report_connected_v6()
875 if [ -n "$($IPT6 -S mwan3_connected 2> /dev/null)" ]; then
876 for address in $($IPS list mwan3_connected_v6 | egrep '([0-9a-fA-F]{1,4}:){7,7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:)|fe80:(:[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}|::(ffff(:0{1,4}){0,1}:){0,1}((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])|([0-9a-fA-F]{1,4}:){1,4}:((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])'); do
882 mwan3_report_rules_v4()
884 if [ -n "$($IPT4 -S mwan3_rules 2> /dev/null)" ]; then
885 $IPT4 -L mwan3_rules -n -v 2> /dev/null | tail -n+3 | sed 's/mark.*//' | sed 's/mwan3_policy_/- /' | sed 's/mwan3_rule_/S /'
889 mwan3_report_rules_v6()
891 if [ -n "$($IPT6 -S mwan3_rules 2> /dev/null)" ]; then
892 $IPT6 -L mwan3_rules -n -v 2> /dev/null | tail -n+3 | sed 's/mark.*//' | sed 's/mwan3_policy_/- /' | sed 's/mwan3_rule_/S /'
896 mwan3_flush_conntrack()
898 local flush_conntrack
900 config_get flush_conntrack $1 flush_conntrack never
902 if [ -e "$CONNTRACK_FILE" ]; then
903 case $flush_conntrack in
905 [ "$3" = "ifup" ] && {
906 echo f > ${CONNTRACK_FILE}
907 $LOG info "connection tracking flushed on interface $1 ($2) $3"
911 [ "$3" = "ifdown" ] && {
912 echo f > ${CONNTRACK_FILE}
913 $LOG info "connection tracking flushed on interface $1 ($2) $3"
917 echo f > ${CONNTRACK_FILE}
918 $LOG info "connection tracking flushed on interface $1 ($2) $3"
921 $LOG info "connection tracking not flushed on interface $1 ($2) $3"
925 $LOG warning "connection tracking not enabled"
931 rm -rf "$MWAN3_STATUS_DIR/${1}" &> /dev/null
932 [ -d "$MWAN3_STATUS_DIR" ] && {
933 if [ -z "$(ls -A "$MWAN3_STATUS_DIR")" ]; then
934 rm -rf "$MWAN3_STATUS_DIR"