6 IPT4
="iptables -t mangle -w"
7 IPT6
="ip6tables -t mangle -w"
8 LOG
="logger -t mwan3[$$] -p"
9 CONNTRACK_FILE
="/proc/net/nf_conntrack"
11 MWAN3_STATUS_DIR
="/var/run/mwan3track"
13 # mwan3's MARKing mask (at least 3 bits should be set)
14 if [ -e "${MWAN3_STATUS_DIR}/mmx_mask" ]; then
15 MMX_MASK
=$
(cat "${MWAN3_STATUS_DIR}/mmx_mask")
18 config_get MMX_MASK globals mmx_mask
'0xff00'
19 mkdir
-p "${MWAN3_STATUS_DIR}"
20 echo "$MMX_MASK" > "${MWAN3_STATUS_DIR}/mmx_mask"
21 $LOG notice
"Using firewall mask ${MMX_MASK}"
24 # counts how many bits are set to 1
25 # n&(n-1) clears the lowest bit set to 1
26 mwan3_count_one_bits
()
31 while [ "$n" -gt "0" ]; do
38 # maps the 1st parameter so it only uses the bits allowed by the bitmask (2nd parameter)
39 # which means spreading the bits of the 1st parameter to only use the bits that are set to 1 in the 2nd parameter
40 # 0 0 0 0 0 1 0 1 (0x05) 1st parameter
41 # 1 0 1 0 1 0 1 0 (0xAA) 2nd parameter
45 local bit_msk bit_val result
48 for bit_msk
in $
(seq 0 31); do
49 if [ $
((($2>>bit_msk
)&1)) = "1" ]; then
50 if [ $
((($1>>bit_val
)&1)) = "1" ]; then
51 result
=$
((result|
(1<<bit_msk)))
53 bit_val=$((bit_val+1))
60 MM_BIT_CNT=$(mwan3_count_one_bits MMX_MASK)
61 MM_DEFAULT=$(((1<<MM_BIT_CNT)-1))
62 MM_BLACKHOLE=$(($MM_DEFAULT-2))
63 MM_UNREACHABLE=$(($MM_DEFAULT-1))
65 # MMX_DEFAULT should equal MMX_MASK
66 MMX_DEFAULT=$(mwan3_id2mask MM_DEFAULT MMX_MASK)
67 MMX_BLACKHOLE=$(mwan3_id2mask MM_BLACKHOLE MMX_MASK)
68 MMX_UNREACHABLE=$(mwan3_id2mask MM_UNREACHABLE MMX_MASK)
71 lock /var/run/mwan3.lock
75 lock -u /var/run/mwan3.lock
79 rm -rf /var/run/mwan3.lock
84 local _tmp _iface _iface_count
91 [ "$1" == "$_iface" ] && _tmp=$_iface_count
93 config_foreach mwan3_get_id interface
97 mwan3_set_connected_iptables()
99 local connected_network_v4 connected_network_v6
101 $IPS -! create mwan3_connected_v4 hash:net
102 $IPS create mwan3_connected_v4_temp hash:net
104 for connected_network_v4 in $($IP4 route | awk '{print $1}' | egrep '[0-9]{1,3}(\.[0-9]{1,3}){3}'); do
105 $IPS -! add mwan3_connected_v4_temp $connected_network_v4
108 for connected_network_v4 in $($IP4 route list table 0 | awk '{print $2}' | egrep '[0-9]{1,3}(\.[0-9]{1,3}){3}'); do
109 $IPS -! add mwan3_connected_v4_temp $connected_network_v4
112 $IPS add mwan3_connected_v4_temp 224.0.0.0/3
114 $IPS swap mwan3_connected_v4_temp mwan3_connected_v4
115 $IPS destroy mwan3_connected_v4_temp
117 $IPS -! create mwan3_connected_v6 hash:net family inet6
118 $IPS create mwan3_connected_v6_temp hash:net family inet6
120 for connected_network_v6 in $($IP6 route | awk '{print $1}' | egrep '([0-9a-fA-F]{1,4}:){7,7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:)|fe80:(:[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}|::(ffff(:0{1,4}){0,1}:){0,1}((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])|([0-9a-fA-F]{1,4}:){1,4}:((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])'); do
121 $IPS -! add mwan3_connected_v6_temp $connected_network_v6
124 $IPS swap mwan3_connected_v6_temp mwan3_connected_v6
125 $IPS destroy mwan3_connected_v6_temp
127 $IPS -! create mwan3_connected list:set
128 $IPS -! add mwan3_connected mwan3_connected_v4
129 $IPS -! add mwan3_connected mwan3_connected_v6
132 mwan3_set_general_rules()
136 for IP in "$IP4" "$IP6"; do
138 RULE_NO=$(($MM_BLACKHOLE+2000))
139 if [ -z "$($IP rule list | awk -v var="$RULE_NO:" '$1 == var')" ]; then
140 $IP rule add pref $RULE_NO fwmark $MMX_BLACKHOLE/$MMX_MASK blackhole
143 RULE_NO=$(($MM_UNREACHABLE+2000))
144 if [ -z "$($IP rule list | awk -v var="$RULE_NO:" '$1 == var')" ]; then
145 $IP rule add pref $RULE_NO fwmark $MMX_UNREACHABLE/$MMX_MASK unreachable
150 mwan3_set_general_iptables()
154 for IPT in "$IPT4" "$IPT6"; do
156 if ! $IPT -S mwan3_ifaces_in &> /dev/null; then
157 $IPT -N mwan3_ifaces_in
160 if ! $IPT -S mwan3_connected &> /dev/null; then
161 $IPT -N mwan3_connected
162 $IPS -! create mwan3_connected list:set
163 $IPT -A mwan3_connected -m set --match-set mwan3_connected dst -j MARK --set-xmark $MMX_DEFAULT/$MMX_MASK
166 if ! $IPT -S mwan3_ifaces_out &> /dev/null; then
167 $IPT -N mwan3_ifaces_out
170 if ! $IPT -S mwan3_rules &> /dev/null; then
174 if ! $IPT -S mwan3_hook &> /dev/null; then
176 $IPT -A mwan3_hook -j CONNMARK --restore-mark --nfmask $MMX_MASK --ctmask $MMX_MASK
177 $IPT -A mwan3_hook -m mark --mark 0x0/$MMX_MASK -j mwan3_ifaces_in
178 $IPT -A mwan3_hook -m mark --mark 0x0/$MMX_MASK -j mwan3_connected
179 $IPT -A mwan3_hook -m mark --mark 0x0/$MMX_MASK -j mwan3_ifaces_out
180 $IPT -A mwan3_hook -m mark --mark 0x0/$MMX_MASK -j mwan3_rules
181 $IPT -A mwan3_hook -j CONNMARK --save-mark --nfmask $MMX_MASK --ctmask $MMX_MASK
182 $IPT -A mwan3_hook -m mark ! --mark $MMX_DEFAULT/$MMX_MASK -j mwan3_connected
185 if ! $IPT -S PREROUTING | grep mwan3_hook &> /dev/null; then
186 $IPT -A PREROUTING -j mwan3_hook
189 if ! $IPT -S OUTPUT | grep mwan3_hook &> /dev/null; then
190 $IPT -A OUTPUT -j mwan3_hook
195 mwan3_create_iface_iptables()
197 local id family src_ip src_ipv6
199 config_get family $1 family ipv4
200 mwan3_get_iface_id id $1
202 [ -n "$id" ] || return 0
204 if [ "$family" == "ipv4" ]; then
206 ubus call network.interface.${1}_4 status &>/dev/null
207 if [ "$?" -eq "0" ]; then
208 network_get_ipaddr src_ip ${1}_4
210 network_get_ipaddr src_ip $1
213 $IPS -! create mwan3_connected list:set
215 if ! $IPT4 -S mwan3_ifaces_in &> /dev/null; then
216 $IPT4 -N mwan3_ifaces_in
219 if ! $IPT4 -S mwan3_ifaces_out &> /dev/null; then
220 $IPT4 -N mwan3_ifaces_out
223 if ! $IPT4 -S mwan3_iface_in_$1 &> /dev/null; then
224 $IPT4 -N mwan3_iface_in_$1
227 if ! $IPT4 -S mwan3_iface_out_$1 &> /dev/null; then
228 $IPT4 -N mwan3_iface_out_$1
231 $IPT4 -F mwan3_iface_in_$1
232 $IPT4 -A mwan3_iface_in_$1 -i $2 -m set --match-set mwan3_connected src -m mark --mark 0x0/$MMX_MASK -m comment --comment "default" -j MARK --set-xmark $MMX_DEFAULT/$MMX_MASK
233 $IPT4 -A mwan3_iface_in_$1 -i $2 -m mark --mark 0x0/$MMX_MASK -m comment --comment "$1" -j MARK --set-xmark $(mwan3_id2mask id MMX_MASK)/$MMX_MASK
235 $IPT4 -D mwan3_ifaces_in -m mark --mark 0x0/$MMX_MASK -j mwan3_iface_in_$1 &> /dev/null
236 $IPT4 -A mwan3_ifaces_in -m mark --mark 0x0/$MMX_MASK -j mwan3_iface_in_$1
238 $IPT4 -F mwan3_iface_out_$1
239 $IPT4 -A mwan3_iface_out_$1 -s $src_ip -m mark --mark 0x0/$MMX_MASK -m comment --comment "$1" -j MARK --set-xmark $(mwan3_id2mask id MMX_MASK)/$MMX_MASK
241 $IPT4 -D mwan3_ifaces_out -m mark --mark 0x0/$MMX_MASK -j mwan3_iface_out_$1 &> /dev/null
242 $IPT4 -A mwan3_ifaces_out -m mark --mark 0x0/$MMX_MASK -j mwan3_iface_out_$1
245 if [ "$family" == "ipv6" ]; then
247 ubus call network.interface.${1}_6 status &>/dev/null
248 if [ "$?" -eq "0" ]; then
249 network_get_ipaddr6 src_ipv6 ${1}_6
251 network_get_ipaddr6 src_ipv6 $1
254 $IPS -! create mwan3_connected_v6 hash:net family inet6
256 if ! $IPT6 -S mwan3_ifaces_in &> /dev/null; then
257 $IPT6 -N mwan3_ifaces_in
260 if ! $IPT6 -S mwan3_ifaces_out &> /dev/null; then
261 $IPT6 -N mwan3_ifaces_out
264 if ! $IPT6 -S mwan3_iface_in_$1 &> /dev/null; then
265 $IPT6 -N mwan3_iface_in_$1
268 if ! $IPT6 -S mwan3_iface_out_$1 &> /dev/null; then
269 $IPT6 -N mwan3_iface_out_$1
272 $IPT6 -F mwan3_iface_in_$1
273 $IPT6 -A mwan3_iface_in_$1 -i $2 -m set --match-set mwan3_connected_v6 src -m mark --mark 0x0/$MMX_MASK -m comment --comment "default" -j MARK --set-xmark $MMX_DEFAULT/$MMX_MASK
274 $IPT6 -A mwan3_iface_in_$1 -i $2 -m mark --mark 0x0/$MMX_MASK -m comment --comment "$1" -j MARK --set-xmark $(mwan3_id2mask id MMX_MASK)/$MMX_MASK
276 $IPT6 -D mwan3_ifaces_in -m mark --mark 0x0/$MMX_MASK -j mwan3_iface_in_$1 &> /dev/null
277 $IPT6 -A mwan3_ifaces_in -m mark --mark 0x0/$MMX_MASK -j mwan3_iface_in_$1
279 $IPT6 -F mwan3_iface_out_$1
280 $IPT6 -A mwan3_iface_out_$1 -s $src_ipv6 -m mark --mark 0x0/$MMX_MASK -m comment --comment "$1" -j MARK --set-xmark $(mwan3_id2mask id MMX_MASK)/$MMX_MASK
282 $IPT6 -D mwan3_ifaces_out -m mark --mark 0x0/$MMX_MASK -j mwan3_iface_out_$1 &> /dev/null
283 $IPT6 -A mwan3_ifaces_out -m mark --mark 0x0/$MMX_MASK -j mwan3_iface_out_$1
287 mwan3_delete_iface_iptables()
289 config_get family $1 family ipv4
291 if [ "$family" == "ipv4" ]; then
293 $IPT4 -D mwan3_ifaces_in -m mark --mark 0x0/$MMX_MASK -j mwan3_iface_in_$1 &> /dev/null
294 $IPT4 -F mwan3_iface_in_$1 &> /dev/null
295 $IPT4 -X mwan3_iface_in_$1 &> /dev/null
297 $IPT4 -D mwan3_ifaces_out -m mark --mark 0x0/$MMX_MASK -j mwan3_iface_out_$1 &> /dev/null
298 $IPT4 -F mwan3_iface_out_$1 &> /dev/null
299 $IPT4 -X mwan3_iface_out_$1 &> /dev/null
302 if [ "$family" == "ipv6" ]; then
304 $IPT6 -D mwan3_ifaces_in -m mark --mark 0x0/$MMX_MASK -j mwan3_iface_in_$1 &> /dev/null
305 $IPT6 -F mwan3_iface_in_$1 &> /dev/null
306 $IPT6 -X mwan3_iface_in_$1 &> /dev/null
308 $IPT6 -D mwan3_ifaces_out -m mark --mark 0x0/$MMX_MASK -j mwan3_iface_out_$1 &> /dev/null
309 $IPT6 -F mwan3_iface_out_$1 &> /dev/null
310 $IPT6 -X mwan3_iface_out_$1 &> /dev/null
314 mwan3_create_iface_route()
318 config_get family $1 family ipv4
319 mwan3_get_iface_id id $1
321 [ -n "$id" ] || return 0
323 if [ "$family" == "ipv4" ]; then
324 ubus call network.interface.${1}_4 status &>/dev/null
325 if [ "$?" -eq "0" ]; then
326 network_get_gateway route_args ${1}_4
328 network_get_gateway route_args $1
331 route_args="via $route_args dev $2"
333 $IP4 route flush table $id
334 $IP4 route add table $id default $route_args
337 if [ "$family" == "ipv6" ]; then
339 ubus call network.interface.${1}_6 status &>/dev/null
340 if [ "$?" -eq "0" ]; then
341 network_get_gateway6 route_args ${1}_6
343 network_get_gateway6 route_args $1
346 route_args="via $route_args dev $2"
348 $IP6 route flush table $id
349 $IP6 route add table $id default $route_args
353 mwan3_delete_iface_route()
357 config_get family $1 family ipv4
358 mwan3_get_iface_id id $1
360 [ -n "$id" ] || return 0
362 if [ "$family" == "ipv4" ]; then
363 $IP4 route flush table $id
366 if [ "$family" == "ipv6" ]; then
367 $IP6 route flush table $id
371 mwan3_create_iface_rules()
375 config_get family $1 family ipv4
376 mwan3_get_iface_id id $1
378 [ -n "$id" ] || return 0
380 if [ "$family" == "ipv4" ]; then
382 while [ -n "$($IP4 rule list | awk '$1 == "'$(($id+1000)):'"')" ]; do
383 $IP4 rule del pref $(($id+1000))
386 while [ -n "$($IP4 rule list | awk '$1 == "'$(($id+2000)):'"')" ]; do
387 $IP4 rule del pref $(($id+2000))
390 $IP4 rule add pref $(($id+1000)) iif $2 lookup main
391 $IP4 rule add pref $(($id+2000)) fwmark $(mwan3_id2mask id MMX_MASK)/$MMX_MASK lookup $id
394 if [ "$family" == "ipv6" ]; then
396 while [ -n "$($IP6 rule list | awk '$1 == "'$(($id+1000)):'"')" ]; do
397 $IP6 rule del pref $(($id+1000))
400 while [ -n "$($IP6 rule list | awk '$1 == "'$(($id+2000)):'"')" ]; do
401 $IP6 rule del pref $(($id+2000))
404 $IP6 rule add pref $(($id+1000)) iif $2 lookup main
405 $IP6 rule add pref $(($id+2000)) fwmark $(mwan3_id2mask id MMX_MASK)/$MMX_MASK lookup $id
409 mwan3_delete_iface_rules()
413 config_get family $1 family ipv4
414 mwan3_get_iface_id id $1
416 [ -n "$id" ] || return 0
418 if [ "$family" == "ipv4" ]; then
420 while [ -n "$($IP4 rule list | awk '$1 == "'$(($id+1000)):'"')" ]; do
421 $IP4 rule del pref $(($id+1000))
424 while [ -n "$($IP4 rule list | awk '$1 == "'$(($id+2000)):'"')" ]; do
425 $IP4 rule del pref $(($id+2000))
429 if [ "$family" == "ipv6" ]; then
431 while [ -n "$($IP6 rule list | awk '$1 == "'$(($id+1000)):'"')" ]; do
432 $IP6 rule del pref $(($id+1000))
435 while [ -n "$($IP6 rule list | awk '$1 == "'$(($id+2000)):'"')" ]; do
436 $IP6 rule del pref $(($id+2000))
441 mwan3_delete_iface_ipset_entries()
443 local id setname entry
445 mwan3_get_iface_id id $1
447 [ -n "$id" ] || return 0
449 for setname in $(ipset -n list | grep ^mwan3_sticky_); do
450 for entry in $(ipset list $setname | grep "$(echo $(mwan3_id2mask id MMX_MASK) | awk '{ printf "0x%08x", $1; }')" | cut -d ' ' -f 1); do
451 $IPS del $setname $entry
458 local track_ip track_ips
460 mwan3_list_track_ips()
462 track_ips="$1 $track_ips"
464 config_list_foreach $1 track_ip mwan3_list_track_ips
466 kill $(pgrep -f "mwan3track $1 $2") &> /dev/null
467 if [ -n "$track_ips" ]; then
468 [ -x /usr/sbin/mwan3track ] && /usr/sbin/mwan3track "$1" "$2" "$3" "$4" $track_ips &
476 pid="$(pgrep -f "mwan3track $1 $2")"
477 if [ "${pid}" != "" ]; then
480 $LOG warn "Unable to send signal USR1 to mwan3track on interface $1 with pid ${pid}"
486 local iface_count id iface family metric probability weight
488 config_get iface $1 interface
489 config_get metric $1 metric 1
490 config_get weight $1 weight 1
492 [ -n "$iface" ] || return 0
494 mwan3_get_iface_id id $iface
496 [ -n "$id" ] || return 0
498 config_get family $iface family ipv4
500 if [ "$family" == "ipv4" ]; then
502 if [ -n "$($IP4 route list table $id)" ]; then
503 if [ "$metric" -lt "$lowest_metric_v4" ]; then
505 total_weight_v4=$weight
506 $IPT4 -F mwan3_policy_$policy
507 $IPT4 -A mwan3_policy_$policy -m mark --mark 0x0/$MMX_MASK -m comment --comment "$iface $weight $weight" -j MARK --set-xmark $(mwan3_id2mask id MMX_MASK)/$MMX_MASK
509 lowest_metric_v4=$metric
511 elif [ "$metric" -eq "$lowest_metric_v4" ]; then
513 total_weight_v4=$(($total_weight_v4+$weight))
514 probability=$(($weight*1000/$total_weight_v4))
516 if [ "$probability" -lt 10 ]; then
517 probability="0.00$probability"
518 elif [ $probability -lt 100 ]; then
519 probability="0.0$probability"
520 elif [ $probability -lt 1000 ]; then
521 probability="0.$probability"
526 probability="-m statistic --mode random --probability $probability"
528 $IPT4 -I mwan3_policy_$policy -m mark --mark 0x0/$MMX_MASK $probability -m comment --comment "$iface $weight $total_weight_v4" -j MARK --set-xmark $(mwan3_id2mask id MMX_MASK)/$MMX_MASK
533 if [ "$family" == "ipv6" ]; then
535 if [ -n "$($IP6 route list table $id)" ]; then
536 if [ "$metric" -lt "$lowest_metric_v6" ]; then
538 total_weight_v6=$weight
539 $IPT6 -F mwan3_policy_$policy
540 $IPT6 -A mwan3_policy_$policy -m mark --mark 0x0/$MMX_MASK -m comment --comment "$iface $weight $weight" -j MARK --set-xmark $(mwan3_id2mask id MMX_MASK)/$MMX_MASK
542 lowest_metric_v6=$metric
544 elif [ "$metric" -eq "$lowest_metric_v6" ]; then
546 total_weight_v6=$(($total_weight_v6+$weight))
547 probability=$(($weight*1000/$total_weight_v6))
549 if [ "$probability" -lt 10 ]; then
550 probability="0.00$probability"
551 elif [ $probability -lt 100 ]; then
552 probability="0.0$probability"
553 elif [ $probability -lt 1000 ]; then
554 probability="0.$probability"
559 probability="-m statistic --mode random --probability $probability"
561 $IPT6 -I mwan3_policy_$policy -m mark --mark 0x0/$MMX_MASK $probability -m comment --comment "$iface $weight $total_weight_v6" -j MARK --set-xmark $(mwan3_id2mask id MMX_MASK)/$MMX_MASK
567 mwan3_create_policies_iptables()
569 local last_resort lowest_metric_v4 lowest_metric_v6 total_weight_v4 total_weight_v6 policy IPT
573 config_get last_resort $1 last_resort unreachable
575 if [ "$1" != $(echo "$1" | cut -c1-15) ]; then
576 $LOG warn "Policy $1 exceeds max of 15 chars. Not setting policy" && return 0
579 for IPT in "$IPT4" "$IPT6"; do
581 if ! $IPT -S mwan3_policy_$1 &> /dev/null; then
582 $IPT -N mwan3_policy_$1
585 $IPT -F mwan3_policy_$1
587 case "$last_resort" in
589 $IPT -A mwan3_policy_$1 -m mark --mark 0x0/$MMX_MASK -m comment --comment "blackhole" -j MARK --set-xmark $MMX_BLACKHOLE/$MMX_MASK
592 $IPT -A mwan3_policy_$1 -m mark --mark 0x0/$MMX_MASK -m comment --comment "default" -j MARK --set-xmark $MMX_DEFAULT/$MMX_MASK
595 $IPT -A mwan3_policy_$1 -m mark --mark 0x0/$MMX_MASK -m comment --comment "unreachable" -j MARK --set-xmark $MMX_UNREACHABLE/$MMX_MASK
606 config_list_foreach $1 use_member mwan3_set_policy
609 mwan3_set_policies_iptables()
611 config_foreach mwan3_create_policies_iptables policy
614 mwan3_set_sticky_iptables()
618 for iface in $($IPT4 -S $policy | cut -s -d'"' -f2 | awk '{print $1}'); do
620 if [ "$iface" == "$1" ]; then
622 mwan3_get_iface_id id $1
624 [ -n "$id" ] || return 0
626 for IPT in "$IPT4" "$IPT6"; do
627 if [ -n "$($IPT -S mwan3_iface_in_$1 2> /dev/null)" -a -n "$($IPT -S mwan3_iface_out_$1 2> /dev/null)" ]; then
628 $IPT -I mwan3_rule_$rule -m mark --mark $(mwan3_id2mask id MMX_MASK)/$MMX_MASK -m set ! --match-set mwan3_sticky_$rule src,src -j MARK --set-xmark 0x0/$MMX_MASK
629 $IPT -I mwan3_rule_$rule -m mark --mark 0/$MMX_MASK -j MARK --set-xmark $(mwan3_id2mask id MMX_MASK)/$MMX_MASK
636 mwan3_set_user_iptables_rule()
638 local ipset family proto policy src_ip src_port sticky dest_ip dest_port use_policy timeout rule policy IPT
642 config_get sticky $1 sticky 0
643 config_get timeout $1 timeout 600
644 config_get ipset $1 ipset
645 config_get proto $1 proto all
646 config_get src_ip $1 src_ip 0.0.0.0/0
647 config_get src_port $1 src_port 0:65535
648 config_get dest_ip $1 dest_ip 0.0.0.0/0
649 config_get dest_port $1 dest_port 0:65535
650 config_get use_policy $1 use_policy
651 config_get family $1 family any
653 if [ "$1" != $(echo "$1" | cut -c1-15) ]; then
654 $LOG warn "Rule $1 exceeds max of 15 chars. Not setting rule" && return 0
657 if [ -n "$ipset" ]; then
658 ipset="-m set --match-set $ipset dst"
661 if [ -n "$use_policy" ]; then
662 if [ "$use_policy" == "default" ]; then
663 policy="MARK --set-xmark $MMX_DEFAULT/$MMX_MASK"
664 elif [ "$use_policy" == "unreachable" ]; then
665 policy="MARK --set-xmark $MMX_UNREACHABLE/$MMX_MASK"
666 elif [ "$use_policy" == "blackhole" ]; then
667 policy="MARK --set-xmark $MMX_BLACKHOLE/$MMX_MASK"
669 if [ "$sticky" -eq 1 ]; then
671 policy="mwan3_policy_$use_policy"
673 for IPT in "$IPT4" "$IPT6"; do
674 if ! $IPT -S $policy &> /dev/null; then
678 if ! $IPT -S mwan3_rule_$1 &> /dev/null; then
679 $IPT -N mwan3_rule_$1
682 $IPT -F mwan3_rule_$1
685 $IPS -! create mwan3_sticky_v4_$rule hash:ip,mark markmask $MMX_MASK timeout $timeout
686 $IPS -! create mwan3_sticky_v6_$rule hash:ip,mark markmask $MMX_MASK timeout $timeout family inet6
687 $IPS -! create mwan3_sticky_$rule list:set
688 $IPS -! add mwan3_sticky_$rule mwan3_sticky_v4_$rule
689 $IPS -! add mwan3_sticky_$rule mwan3_sticky_v6_$rule
691 config_foreach mwan3_set_sticky_iptables interface
693 for IPT in "$IPT4" "$IPT6"; do
694 $IPT -A mwan3_rule_$1 -m mark --mark 0/$MMX_MASK -j $policy
695 $IPT -A mwan3_rule_$1 -m mark ! --mark 0xfc00/0xfc00 -j SET --del-set mwan3_sticky_$rule src,src
696 $IPT -A mwan3_rule_$1 -m mark ! --mark 0xfc00/0xfc00 -j SET --add-set mwan3_sticky_$rule src,src
699 policy="mwan3_rule_$1"
701 policy="mwan3_policy_$use_policy"
703 for IPT in "$IPT4" "$IPT6"; do
704 if ! $IPT -S $policy &> /dev/null; then
712 if [ "$family" == "any" ]; then
714 for IPT in "$IPT4" "$IPT6"; do
717 $IPT -A mwan3_rules -p $proto -s $src_ip -d $dest_ip $ipset -m multiport --sports $src_port -m multiport --dports $dest_port -m mark --mark 0/$MMX_MASK -m comment --comment "$1" -j $policy &> /dev/null
720 $IPT -A mwan3_rules -p $proto -s $src_ip -d $dest_ip $ipset -m mark --mark 0/$MMX_MASK -m comment --comment "$1" -j $policy &> /dev/null
725 elif [ "$family" == "ipv4" ]; then
729 $IPT4 -A mwan3_rules -p $proto -s $src_ip -d $dest_ip $ipset -m multiport --sports $src_port -m multiport --dports $dest_port -m mark --mark 0/$MMX_MASK -m comment --comment "$1" -j $policy &> /dev/null
732 $IPT4 -A mwan3_rules -p $proto -s $src_ip -d $dest_ip $ipset -m mark --mark 0/$MMX_MASK -m comment --comment "$1" -j $policy &> /dev/null
736 elif [ "$family" == "ipv6" ]; then
740 $IPT6 -A mwan3_rules -p $proto -s $src_ip -d $dest_ip $ipset -m multiport --sports $src_port -m multiport --dports $dest_port -m mark --mark 0/$MMX_MASK -m comment --comment "$1" -j $policy &> /dev/null
743 $IPT6 -A mwan3_rules -p $proto -s $src_ip -d $dest_ip $ipset -m mark --mark 0/$MMX_MASK -m comment --comment "$1" -j $policy &> /dev/null
750 mwan3_set_user_rules()
754 for IPT in "$IPT4" "$IPT6"; do
756 if ! $IPT -S mwan3_rules &> /dev/null; then
763 config_foreach mwan3_set_user_iptables_rule rule
766 mwan3_report_iface_status()
768 local device result track_ips tracking IP IPT
770 mwan3_get_iface_id id $1
771 network_get_device device $1
772 config_get enabled "$1" enabled 0
773 config_get family "$1" family ipv4
775 if [ "$family" == "ipv4" ]; then
780 if [ "$family" == "ipv6" ]; then
785 if [ -z "$id" -o -z "$device" ]; then
787 elif [ -n "$($IP rule | awk '$1 == "'$(($id+1000)):'"')"i -a -n "$($IP rule | awk '$1 == "'$(($id+2000)):'"')" -a -n "$($IPT -S mwan3_iface_in_$1 2> /dev/null)" -a -n "$($IPT -S mwan3_iface_out_$1 2> /dev/null)" -a -n "$($IP route list table $id default dev $device 2> /dev/null)" ]; then
789 elif [ -n "$($IP rule | awk '$1 == "'$(($id+1000)):'"')" -o -n "$($IP rule | awk '$1 == "'$(($id+2000)):'"')" -o -n "$($IPT -S mwan3_iface_in_$1 2> /dev/null)" -o -n "$($IPT -S mwan3_iface_out_$1 2> /dev/null)" -o -n "$($IP route list table $id default dev $device 2> /dev/null)" ]; then
792 if [ "$enabled" == "1" ]; then
799 mwan3_list_track_ips()
801 track_ips="$1 $track_ips"
803 config_list_foreach $1 track_ip mwan3_list_track_ips
805 if [ -n "$track_ips" ]; then
806 if [ -n "$(pgrep -f "mwan3track $1 $device")" ]; then
812 tracking="not enabled"
815 echo " interface $1 is $result and tracking is $tracking"
818 mwan3_report_policies_v4()
820 local percent policy share total_weight weight iface
822 for policy in $($IPT4 -S | awk '{print $2}' | grep mwan3_policy_ | sort -u); do
823 echo "$policy:" | sed 's/mwan3_policy_//'
825 [ -n "$total_weight" ] || total_weight=$($IPT4 -S $policy | cut -s -d'"' -f2 | head -1 | awk '{print $3}')
827 if [ ! -z "${total_weight##*[!0-9]*}" ]; then
828 for iface in $($IPT4 -S $policy | cut -s -d'"' -f2 | awk '{print $1}'); do
829 weight=$($IPT4 -S $policy | cut -s -d'"' -f2 | awk '$1 == "'$iface'"' | awk '{print $2}')
830 percent=$(($weight*100/$total_weight))
831 echo " $iface ($percent%)"
834 echo " $($IPT4 -S $policy | sed '/.*--comment \([^ ]*\) .*$/!d;s//\1/;q')"
843 mwan3_report_policies_v6()
845 local percent policy share total_weight weight iface
847 for policy in $($IPT6 -S | awk '{print $2}' | grep mwan3_policy_ | sort -u); do
848 echo "$policy:" | sed 's/mwan3_policy_//'
850 [ -n "$total_weight" ] || total_weight=$($IPT6 -S $policy | cut -s -d'"' -f2 | head -1 | awk '{print $3}')
852 if [ ! -z "${total_weight##*[!0-9]*}" ]; then
853 for iface in $($IPT6 -S $policy | cut -s -d'"' -f2 | awk '{print $1}'); do
854 weight=$($IPT6 -S $policy | cut -s -d'"' -f2 | awk '$1 == "'$iface'"' | awk '{print $2}')
855 percent=$(($weight*100/$total_weight))
856 echo " $iface ($percent%)"
859 echo " $($IPT6 -S $policy | sed '/.*--comment \([^ ]*\) .*$/!d;s//\1/;q')"
868 mwan3_report_connected_v4()
872 if [ -n "$($IPT4 -S mwan3_connected 2> /dev/null)" ]; then
873 for address in $($IPS list mwan3_connected_v4 | egrep '[0-9]{1,3}(\.[0-9]{1,3}){3}'); do
879 mwan3_report_connected_v6()
883 if [ -n "$($IPT6 -S mwan3_connected 2> /dev/null)" ]; then
884 for address in $($IPS list mwan3_connected_v6 | egrep '([0-9a-fA-F]{1,4}:){7,7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:)|fe80:(:[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}|::(ffff(:0{1,4}){0,1}:){0,1}((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])|([0-9a-fA-F]{1,4}:){1,4}:((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])'); do
890 mwan3_report_rules_v4()
892 if [ -n "$($IPT4 -S mwan3_rules 2> /dev/null)" ]; then
893 $IPT4 -L mwan3_rules -n -v 2> /dev/null | tail -n+3 | sed 's/mark.*//' | sed 's/mwan3_policy_/- /' | sed 's/mwan3_rule_/S /'
897 mwan3_report_rules_v6()
899 if [ -n "$($IPT6 -S mwan3_rules 2> /dev/null)" ]; then
900 $IPT6 -L mwan3_rules -n -v 2> /dev/null | tail -n+3 | sed 's/mark.*//' | sed 's/mwan3_policy_/- /' | sed 's/mwan3_rule_/S /'
904 mwan3_flush_conntrack()
906 local flush_conntrack
908 config_get flush_conntrack $1 flush_conntrack never
910 if [ -e "$CONNTRACK_FILE" ]; then
911 case $flush_conntrack in
913 [ "$3" = "ifup" ] && {
914 echo f > ${CONNTRACK_FILE}
915 $LOG info "connection tracking flushed on interface $1 ($2) $3"
919 [ "$3" = "ifdown" ] && {
920 echo f > ${CONNTRACK_FILE}
921 $LOG info "connection tracking flushed on interface $1 ($2) $3"
925 echo f > ${CONNTRACK_FILE}
926 $LOG info "connection tracking flushed on interface $1 ($2) $3"
929 $LOG info "connection tracking not flushed on interface $1 ($2) $3"
933 $LOG warning "connection tracking not enabled"
939 rm -rf "$MWAN3_STATUS_DIR/${1}" &> /dev/null
940 [ -d "$MWAN3_STATUS_DIR" ] && {
941 if [ -z "$(ls -A "$MWAN3_STATUS_DIR")" ]; then
942 rm -rf "$MWAN3_STATUS_DIR"