6 IPT4
="iptables -t mangle -w"
7 IPT6
="ip6tables -t mangle -w"
8 LOG
="logger -t mwan3 -p"
9 CONNTRACK_FILE
="/proc/net/nf_conntrack"
12 lock
/var
/run
/mwan3.lock
16 lock
-u /var
/run
/mwan3.lock
21 local _tmp _iface _iface_count
28 [ "$1" == "$_iface" ] && _tmp
=$_iface_count
30 config_foreach mwan3_get_id interface
34 mwan3_set_connected_iptables
()
36 local connected_network_v4 connected_network_v6
38 $IPS -! create mwan3_connected_v4
hash:net
39 $IPS create mwan3_connected_v4_temp
hash:net
41 for connected_network_v4
in $
($IP4 route |
awk '{print $1}' |
egrep '[0-9]{1,3}(\.[0-9]{1,3}){3}'); do
42 $IPS -! add mwan3_connected_v4_temp
$connected_network_v4
45 for connected_network_v4
in $
($IP4 route list table
0 |
awk '{print $2}' |
egrep '[0-9]{1,3}(\.[0-9]{1,3}){3}'); do
46 $IPS -! add mwan3_connected_v4_temp
$connected_network_v4
49 $IPS add mwan3_connected_v4_temp
224.0.0.0/3
51 $IPS swap mwan3_connected_v4_temp mwan3_connected_v4
52 $IPS destroy mwan3_connected_v4_temp
54 $IPS -! create mwan3_connected_v6
hash:net family inet6
55 $IPS create mwan3_connected_v6_temp
hash:net family inet6
57 for connected_network_v6
in $
($IP6 route |
awk '{print $1}' |
egrep '([0-9a-fA-F]{1,4}:){7,7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:)|fe80:(:[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}|::(ffff(:0{1,4}){0,1}:){0,1}((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])|([0-9a-fA-F]{1,4}:){1,4}:((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])'); do
58 $IPS -! add mwan3_connected_v6_temp
$connected_network_v6
61 $IPS swap mwan3_connected_v6_temp mwan3_connected_v6
62 $IPS destroy mwan3_connected_v6_temp
64 $IPS -! create mwan3_connected list
:set
65 $IPS -! add mwan3_connected mwan3_connected_v4
66 $IPS -! add mwan3_connected mwan3_connected_v6
69 mwan3_set_general_rules
()
73 for IP
in "$IP4" "$IP6"; do
75 if [ -z "$($IP rule list | awk '$1 == "2253:"')" ]; then
76 $IP rule add pref
2253 fwmark
0xfd00/0xff00 blackhole
79 if [ -z "$($IP rule list | awk '$1 == "2254:"')" ]; then
80 $IP rule add pref
2254 fwmark
0xfe00/0xff00 unreachable
85 mwan3_set_general_iptables
()
89 for IPT
in "$IPT4" "$IPT6"; do
91 if ! $IPT -S mwan3_ifaces_in
&> /dev
/null
; then
92 $IPT -N mwan3_ifaces_in
95 if ! $IPT -S mwan3_connected
&> /dev
/null
; then
96 $IPT -N mwan3_connected
97 $IPS -! create mwan3_connected list
:set
98 $IPT -A mwan3_connected
-m set --match-set mwan3_connected dst
-j MARK
--set-xmark 0xff00/0xff00
101 if ! $IPT -S mwan3_ifaces_out
&> /dev
/null
; then
102 $IPT -N mwan3_ifaces_out
105 if ! $IPT -S mwan3_rules
&> /dev
/null
; then
109 if ! $IPT -S mwan3_hook
&> /dev
/null
; then
111 $IPT -A mwan3_hook
-j CONNMARK
--restore-mark --nfmask 0xff00 --ctmask 0xff00
112 $IPT -A mwan3_hook
-m mark
--mark 0x0/0xff00 -j mwan3_ifaces_in
113 $IPT -A mwan3_hook
-m mark
--mark 0x0/0xff00 -j mwan3_connected
114 $IPT -A mwan3_hook
-m mark
--mark 0x0/0xff00 -j mwan3_ifaces_out
115 $IPT -A mwan3_hook
-m mark
--mark 0x0/0xff00 -j mwan3_rules
116 $IPT -A mwan3_hook
-j CONNMARK
--save-mark --nfmask 0xff00 --ctmask 0xff00
117 $IPT -A mwan3_hook
-m mark
! --mark 0xff00/0xff00 -j mwan3_connected
120 if ! $IPT -S PREROUTING |
grep mwan3_hook
&> /dev
/null
; then
121 $IPT -A PREROUTING
-j mwan3_hook
124 if ! $IPT -S OUTPUT |
grep mwan3_hook
&> /dev
/null
; then
125 $IPT -A OUTPUT
-j mwan3_hook
130 mwan3_create_iface_iptables
()
132 local id family src_ip src_ipv6
134 config_get family
$1 family ipv4
135 mwan3_get_iface_id id
$1
137 [ -n "$id" ] ||
return 0
139 if [ "$family" == "ipv4" ]; then
141 ubus call network.interface.
${1}_4 status
&>/dev
/null
142 if [ "$?" -eq "0" ]; then
143 network_get_ipaddr src_ip
${1}_4
145 network_get_ipaddr src_ip
$1
148 $IPS -! create mwan3_connected list
:set
150 if ! $IPT4 -S mwan3_ifaces_in
&> /dev
/null
; then
151 $IPT4 -N mwan3_ifaces_in
154 if ! $IPT4 -S mwan3_ifaces_out
&> /dev
/null
; then
155 $IPT4 -N mwan3_ifaces_out
158 if ! $IPT4 -S mwan3_iface_in_
$1 &> /dev
/null
; then
159 $IPT4 -N mwan3_iface_in_
$1
162 if ! $IPT4 -S mwan3_iface_out_
$1 &> /dev
/null
; then
163 $IPT4 -N mwan3_iface_out_
$1
166 $IPT4 -F mwan3_iface_in_
$1
167 $IPT4 -A mwan3_iface_in_
$1 -i $2 -m set --match-set mwan3_connected src
-m mark
--mark 0x0/0xff00 -m comment
--comment "default" -j MARK
--set-xmark 0xff00/0xff00
168 $IPT4 -A mwan3_iface_in_
$1 -i $2 -m mark
--mark 0x0/0xff00 -m comment
--comment "$1" -j MARK
--set-xmark $
(($id*256))/0xff00
170 $IPT4 -D mwan3_ifaces_in
-m mark
--mark 0x0/0xff00 -j mwan3_iface_in_
$1 &> /dev
/null
171 $IPT4 -A mwan3_ifaces_in
-m mark
--mark 0x0/0xff00 -j mwan3_iface_in_
$1
173 $IPT4 -F mwan3_iface_out_
$1
174 $IPT4 -A mwan3_iface_out_
$1 -s $src_ip -m mark
--mark 0x0/0xff00 -m comment
--comment "$1" -j MARK
--set-xmark $
(($id*256))/0xff00
176 $IPT4 -D mwan3_ifaces_out
-m mark
--mark 0x0/0xff00 -j mwan3_iface_out_
$1 &> /dev
/null
177 $IPT4 -A mwan3_ifaces_out
-m mark
--mark 0x0/0xff00 -j mwan3_iface_out_
$1
180 if [ "$family" == "ipv6" ]; then
182 ubus call network.interface.
${1}_6 status
&>/dev
/null
183 if [ "$?" -eq "0" ]; then
184 network_get_ipaddr6 src_ipv6
${1}_6
186 network_get_ipaddr6 src_ipv6
$1
189 $IPS -! create mwan3_connected_v6
hash:net family inet6
191 if ! $IPT6 -S mwan3_ifaces_in
&> /dev
/null
; then
192 $IPT6 -N mwan3_ifaces_in
195 if ! $IPT6 -S mwan3_ifaces_out
&> /dev
/null
; then
196 $IPT6 -N mwan3_ifaces_out
199 if ! $IPT6 -S mwan3_iface_in_
$1 &> /dev
/null
; then
200 $IPT6 -N mwan3_iface_in_
$1
203 if ! $IPT6 -S mwan3_iface_out_
$1 &> /dev
/null
; then
204 $IPT6 -N mwan3_iface_out_
$1
207 $IPT6 -F mwan3_iface_in_
$1
208 $IPT6 -A mwan3_iface_in_
$1 -i $2 -m set --match-set mwan3_connected_v6 src
-m mark
--mark 0x0/0xff00 -m comment
--comment "default" -j MARK
--set-xmark 0xff00/0xff00
209 $IPT6 -A mwan3_iface_in_
$1 -i $2 -m mark
--mark 0x0/0xff00 -m comment
--comment "$1" -j MARK
--set-xmark $
(($id*256))/0xff00
211 $IPT6 -D mwan3_ifaces_in
-m mark
--mark 0x0/0xff00 -j mwan3_iface_in_
$1 &> /dev
/null
212 $IPT6 -A mwan3_ifaces_in
-m mark
--mark 0x0/0xff00 -j mwan3_iface_in_
$1
214 $IPT6 -F mwan3_iface_out_
$1
215 $IPT6 -A mwan3_iface_out_
$1 -s $src_ipv6 -m mark
--mark 0x0/0xff00 -m comment
--comment "$1" -j MARK
--set-xmark $
(($id*256))/0xff00
217 $IPT6 -D mwan3_ifaces_out
-m mark
--mark 0x0/0xff00 -j mwan3_iface_out_
$1 &> /dev
/null
218 $IPT6 -A mwan3_ifaces_out
-m mark
--mark 0x0/0xff00 -j mwan3_iface_out_
$1
222 mwan3_delete_iface_iptables
()
224 config_get family
$1 family ipv4
226 if [ "$family" == "ipv4" ]; then
228 $IPT4 -D mwan3_ifaces_in
-m mark
--mark 0x0/0xff00 -j mwan3_iface_in_
$1 &> /dev
/null
229 $IPT4 -F mwan3_iface_in_
$1 &> /dev
/null
230 $IPT4 -X mwan3_iface_in_
$1 &> /dev
/null
232 $IPT4 -D mwan3_ifaces_out
-m mark
--mark 0x0/0xff00 -j mwan3_iface_out_
$1 &> /dev
/null
233 $IPT4 -F mwan3_iface_out_
$1 &> /dev
/null
234 $IPT4 -X mwan3_iface_out_
$1 &> /dev
/null
237 if [ "$family" == "ipv6" ]; then
239 $IPT6 -D mwan3_ifaces_in
-m mark
--mark 0x0/0xff00 -j mwan3_iface_in_
$1 &> /dev
/null
240 $IPT6 -F mwan3_iface_in_
$1 &> /dev
/null
241 $IPT6 -X mwan3_iface_in_
$1 &> /dev
/null
243 $IPT6 -D mwan3_ifaces_out
-m mark
--mark 0x0/0xff00 -j mwan3_iface_out_
$1 &> /dev
/null
244 $IPT6 -F mwan3_iface_out_
$1 &> /dev
/null
245 $IPT6 -X mwan3_iface_out_
$1 &> /dev
/null
249 mwan3_create_iface_route
()
253 config_get family
$1 family ipv4
254 mwan3_get_iface_id id
$1
256 [ -n "$id" ] ||
return 0
258 if [ "$family" == "ipv4" ]; then
259 ubus call network.interface.
${1}_4 status
&>/dev
/null
260 if [ "$?" -eq "0" ]; then
261 network_get_gateway route_args
${1}_4
263 network_get_gateway route_args
$1
266 route_args
="via $route_args dev $2"
268 $IP4 route flush table
$id
269 $IP4 route add table
$id default
$route_args
272 if [ "$family" == "ipv6" ]; then
274 ubus call network.interface.
${1}_6 status
&>/dev
/null
275 if [ "$?" -eq "0" ]; then
276 network_get_gateway6 route_args
${1}_6
278 network_get_gateway6 route_args
$1
281 route_args
="via $route_args dev $2"
283 $IP6 route flush table
$id
284 $IP6 route add table
$id default
$route_args
288 mwan3_delete_iface_route
()
292 config_get family
$1 family ipv4
293 mwan3_get_iface_id id
$1
295 [ -n "$id" ] ||
return 0
297 if [ "$family" == "ipv4" ]; then
298 $IP4 route flush table
$id
301 if [ "$family" == "ipv6" ]; then
302 $IP6 route flush table
$id
306 mwan3_create_iface_rules
()
310 config_get family
$1 family ipv4
311 mwan3_get_iface_id id
$1
313 [ -n "$id" ] ||
return 0
315 if [ "$family" == "ipv4" ]; then
317 while [ -n "$($IP4 rule list | awk '$1 == "'$(($id+1000)):'"')" ]; do
318 $IP4 rule del pref $
(($id+1000))
321 while [ -n "$($IP4 rule list | awk '$1 == "'$(($id+2000)):'"')" ]; do
322 $IP4 rule del pref $
(($id+2000))
325 $IP4 rule add pref $
(($id+1000)) iif
$2 lookup main
326 $IP4 rule add pref $
(($id+2000)) fwmark $
(($id*256))/0xff00 lookup
$id
329 if [ "$family" == "ipv6" ]; then
331 while [ -n "$($IP6 rule list | awk '$1 == "'$(($id+1000)):'"')" ]; do
332 $IP6 rule del pref $
(($id+1000))
335 while [ -n "$($IP6 rule list | awk '$1 == "'$(($id+2000)):'"')" ]; do
336 $IP6 rule del pref $
(($id+2000))
339 $IP6 rule add pref $
(($id+1000)) iif
$2 lookup main
340 $IP6 rule add pref $
(($id+2000)) fwmark $
(($id*256))/0xff00 lookup
$id
344 mwan3_delete_iface_rules
()
348 config_get family
$1 family ipv4
349 mwan3_get_iface_id id
$1
351 [ -n "$id" ] ||
return 0
353 if [ "$family" == "ipv4" ]; then
355 while [ -n "$($IP4 rule list | awk '$1 == "'$(($id+1000)):'"')" ]; do
356 $IP4 rule del pref $
(($id+1000))
359 while [ -n "$($IP4 rule list | awk '$1 == "'$(($id+2000)):'"')" ]; do
360 $IP4 rule del pref $
(($id+2000))
364 if [ "$family" == "ipv6" ]; then
366 while [ -n "$($IP6 rule list | awk '$1 == "'$(($id+1000)):'"')" ]; do
367 $IP6 rule del pref $
(($id+1000))
370 while [ -n "$($IP6 rule list | awk '$1 == "'$(($id+2000)):'"')" ]; do
371 $IP6 rule del pref $
(($id+2000))
376 mwan3_delete_iface_ipset_entries
()
378 local id setname entry
380 mwan3_get_iface_id id
$1
382 [ -n "$id" ] ||
return 0
384 for setname
in $
(ipset
-n list |
grep ^mwan3_sticky_
); do
385 for entry
in $
(ipset list
$setname |
grep "$(echo $(($id*256)) | awk '{ printf "0x
%08x
", $1; }')" | cut
-d ' ' -f 1); do
386 $IPS del
$setname $entry
393 local track_ip track_ips
395 mwan3_list_track_ips
()
397 track_ips
="$1 $track_ips"
399 config_list_foreach
$1 track_ip mwan3_list_track_ips
401 kill $
(pgrep
-f "mwan3track $1") &> /dev
/null
402 if [ -n "$track_ips" ]; then
403 [ -x /usr
/sbin
/mwan3track
] && /usr
/sbin
/mwan3track
$1 $2 $track_ips &
411 pid
="$(pgrep -f "mwan3track
$1")"
412 if [ "${pid}" != "" ]; then
415 $LOG warn
"Unable to send signal USR1 to mwan3track on interface $1 with pid ${pid}"
421 local iface_count id iface family metric probability weight
423 config_get iface
$1 interface
424 config_get metric
$1 metric
1
425 config_get weight
$1 weight
1
427 [ -n "$iface" ] ||
return 0
429 mwan3_get_iface_id id
$iface
431 [ -n "$id" ] ||
return 0
433 config_get family
$iface family ipv4
435 if [ "$family" == "ipv4" ]; then
437 if [ -n "$($IP4 route list table $id)" ]; then
438 if [ "$metric" -lt "$lowest_metric_v4" ]; then
440 total_weight_v4
=$weight
441 $IPT4 -F mwan3_policy_
$policy
442 $IPT4 -A mwan3_policy_
$policy -m mark
--mark 0x0/0xff00 -m comment
--comment "$iface $weight $weight" -j MARK
--set-xmark $
(($id*256))/0xff00
444 lowest_metric_v4
=$metric
446 elif [ "$metric" -eq "$lowest_metric_v4" ]; then
448 total_weight_v4
=$
(($total_weight_v4+$weight))
449 probability
=$
(($weight*1000/$total_weight_v4))
451 if [ "$probability" -lt 10 ]; then
452 probability
="0.00$probability"
453 elif [ $probability -lt 100 ]; then
454 probability
="0.0$probability"
455 elif [ $probability -lt 1000 ]; then
456 probability
="0.$probability"
461 probability
="-m statistic --mode random --probability $probability"
463 $IPT4 -I mwan3_policy_
$policy -m mark
--mark 0x0/0xff00 $probability -m comment
--comment "$iface $weight $total_weight_v4" -j MARK
--set-xmark $
(($id*256))/0xff00
468 if [ "$family" == "ipv6" ]; then
470 if [ -n "$($IP6 route list table $id)" ]; then
471 if [ "$metric" -lt "$lowest_metric_v6" ]; then
473 total_weight_v6
=$weight
474 $IPT6 -F mwan3_policy_
$policy
475 $IPT6 -A mwan3_policy_
$policy -m mark
--mark 0x0/0xff00 -m comment
--comment "$iface $weight $weight" -j MARK
--set-xmark $
(($id*256))/0xff00
477 lowest_metric_v6
=$metric
479 elif [ "$metric" -eq "$lowest_metric_v6" ]; then
481 total_weight_v6
=$
(($total_weight_v6+$weight))
482 probability
=$
(($weight*1000/$total_weight_v6))
484 if [ "$probability" -lt 10 ]; then
485 probability
="0.00$probability"
486 elif [ $probability -lt 100 ]; then
487 probability
="0.0$probability"
488 elif [ $probability -lt 1000 ]; then
489 probability
="0.$probability"
494 probability
="-m statistic --mode random --probability $probability"
496 $IPT6 -I mwan3_policy_
$policy -m mark
--mark 0x0/0xff00 $probability -m comment
--comment "$iface $weight $total_weight_v6" -j MARK
--set-xmark $
(($id*256))/0xff00
502 mwan3_create_policies_iptables
()
504 local last_resort lowest_metric_v4 lowest_metric_v6 total_weight_v4 total_weight_v6 policy IPT
508 config_get last_resort
$1 last_resort unreachable
510 if [ "$1" != $
(echo "$1" | cut
-c1-15) ]; then
511 $LOG warn
"Policy $1 exceeds max of 15 chars. Not setting policy" && return 0
514 for IPT
in "$IPT4" "$IPT6"; do
516 if ! $IPT -S mwan3_policy_
$1 &> /dev
/null
; then
517 $IPT -N mwan3_policy_
$1
520 $IPT -F mwan3_policy_
$1
522 case "$last_resort" in
524 $IPT -A mwan3_policy_
$1 -m mark
--mark 0x0/0xff00 -m comment
--comment "blackhole" -j MARK
--set-xmark 0xfd00/0xff00
527 $IPT -A mwan3_policy_
$1 -m mark
--mark 0x0/0xff00 -m comment
--comment "default" -j MARK
--set-xmark 0xff00/0xff00
530 $IPT -A mwan3_policy_
$1 -m mark
--mark 0x0/0xff00 -m comment
--comment "unreachable" -j MARK
--set-xmark 0xfe00/0xff00
541 config_list_foreach
$1 use_member mwan3_set_policy
544 mwan3_set_policies_iptables
()
546 config_foreach mwan3_create_policies_iptables policy
549 mwan3_set_sticky_iptables
()
553 for iface
in $
($IPT4 -S $policy | cut
-s -d'"' -f2 |
awk '{print $1}'); do
555 if [ "$iface" == "$1" ]; then
557 mwan3_get_iface_id id
$1
559 [ -n "$id" ] ||
return 0
561 for IPT
in "$IPT4" "$IPT6"; do
562 if [ -n "$($IPT -S mwan3_iface_in_$1 2> /dev/null)" -a -n "$($IPT -S mwan3_iface_out_$1 2> /dev/null)" ]; then
563 $IPT -I mwan3_rule_
$rule -m mark
--mark $
(($id*256))/0xff00 -m set ! --match-set mwan3_sticky_
$rule src
,src
-j MARK
--set-xmark 0x0/0xff00
564 $IPT -I mwan3_rule_
$rule -m mark
--mark 0/0xff00 -j MARK
--set-xmark $
(($id*256))/0xff00
571 mwan3_set_user_iptables_rule
()
573 local ipset family proto policy src_ip src_port sticky dest_ip dest_port use_policy timeout rule policy IPT
577 config_get sticky
$1 sticky
0
578 config_get timeout
$1 timeout
600
579 config_get ipset
$1 ipset
580 config_get proto
$1 proto all
581 config_get src_ip
$1 src_ip
0.0.0.0/0
582 config_get src_port
$1 src_port
0:65535
583 config_get dest_ip
$1 dest_ip
0.0.0.0/0
584 config_get dest_port
$1 dest_port
0:65535
585 config_get use_policy
$1 use_policy
586 config_get family
$1 family any
588 if [ "$1" != $
(echo "$1" | cut
-c1-15) ]; then
589 $LOG warn
"Rule $1 exceeds max of 15 chars. Not setting rule" && return 0
592 if [ -n "$ipset" ]; then
593 ipset
="-m set --match-set $ipset dst"
596 if [ -n "$use_policy" ]; then
597 if [ "$use_policy" == "default" ]; then
598 policy
="MARK --set-xmark 0xff00/0xff00"
599 elif [ "$use_policy" == "unreachable" ]; then
600 policy
="MARK --set-xmark 0xfe00/0xff00"
601 elif [ "$use_policy" == "blackhole" ]; then
602 policy
="MARK --set-xmark 0xfd00/0xff00"
604 if [ "$sticky" -eq 1 ]; then
606 policy
="mwan3_policy_$use_policy"
608 for IPT
in "$IPT4" "$IPT6"; do
609 if ! $IPT -S $policy &> /dev
/null
; then
613 if ! $IPT -S mwan3_rule_
$1 &> /dev
/null
; then
614 $IPT -N mwan3_rule_
$1
617 $IPT -F mwan3_rule_
$1
620 $IPS -! create mwan3_sticky_v4_
$rule hash:ip
,mark markmask
0xff00 timeout
$timeout
621 $IPS -! create mwan3_sticky_v6_
$rule hash:ip
,mark markmask
0xff00 timeout
$timeout family inet6
622 $IPS -! create mwan3_sticky_
$rule list
:set
623 $IPS -! add mwan3_sticky_
$rule mwan3_sticky_v4_
$rule
624 $IPS -! add mwan3_sticky_
$rule mwan3_sticky_v6_
$rule
626 config_foreach mwan3_set_sticky_iptables interface
628 for IPT
in "$IPT4" "$IPT6"; do
629 $IPT -A mwan3_rule_
$1 -m mark
--mark 0/0xff00 -j $policy
630 $IPT -A mwan3_rule_
$1 -m mark
! --mark 0xfc00/0xfc00 -j SET
--del-set mwan3_sticky_
$rule src
,src
631 $IPT -A mwan3_rule_
$1 -m mark
! --mark 0xfc00/0xfc00 -j SET
--add-set mwan3_sticky_
$rule src
,src
634 policy
="mwan3_rule_$1"
636 policy
="mwan3_policy_$use_policy"
638 for IPT
in "$IPT4" "$IPT6"; do
639 if ! $IPT -S $policy &> /dev
/null
; then
647 if [ "$family" == "any" ]; then
649 for IPT
in "$IPT4" "$IPT6"; do
652 $IPT -A mwan3_rules
-p $proto -s $src_ip -d $dest_ip $ipset -m multiport
--sports $src_port -m multiport
--dports $dest_port -m mark
--mark 0/0xff00 -m comment
--comment "$1" -j $policy &> /dev
/null
655 $IPT -A mwan3_rules
-p $proto -s $src_ip -d $dest_ip $ipset -m mark
--mark 0/0xff00 -m comment
--comment "$1" -j $policy &> /dev
/null
660 elif [ "$family" == "ipv4" ]; then
664 $IPT4 -A mwan3_rules
-p $proto -s $src_ip -d $dest_ip $ipset -m multiport
--sports $src_port -m multiport
--dports $dest_port -m mark
--mark 0/0xff00 -m comment
--comment "$1" -j $policy &> /dev
/null
667 $IPT4 -A mwan3_rules
-p $proto -s $src_ip -d $dest_ip $ipset -m mark
--mark 0/0xff00 -m comment
--comment "$1" -j $policy &> /dev
/null
671 elif [ "$family" == "ipv6" ]; then
675 $IPT6 -A mwan3_rules
-p $proto -s $src_ip -d $dest_ip $ipset -m multiport
--sports $src_port -m multiport
--dports $dest_port -m mark
--mark 0/0xff00 -m comment
--comment "$1" -j $policy &> /dev
/null
678 $IPT6 -A mwan3_rules
-p $proto -s $src_ip -d $dest_ip $ipset -m mark
--mark 0/0xff00 -m comment
--comment "$1" -j $policy &> /dev
/null
685 mwan3_set_user_rules
()
689 for IPT
in "$IPT4" "$IPT6"; do
691 if ! $IPT -S mwan3_rules
&> /dev
/null
; then
698 config_foreach mwan3_set_user_iptables_rule rule
701 mwan3_report_iface_status
()
703 local device result track_ips tracking IP IPT
705 mwan3_get_iface_id id
$1
706 network_get_device device
$1
707 config_get enabled
"$1" enabled
0
708 config_get family
"$1" family ipv4
710 if [ "$family" == "ipv4" ]; then
715 if [ "$family" == "ipv6" ]; then
720 if [ -z "$id" -o -z "$device" ]; then
722 elif [ -n "$($IP rule | awk '$1 == "'$(($id+1000)):'"')"i
-a -n "$($IP rule | awk '$1 == "'$(($id+2000)):'"')" -a -n "$($IPT -S mwan3_iface_in_$1 2> /dev/null)" -a -n "$($IPT -S mwan3_iface_out_$1 2> /dev/null)" -a -n "$($IP route list table $id default dev $device 2> /dev/null)" ]; then
724 elif [ -n "$($IP rule | awk '$1 == "'$(($id+1000)):'"')" -o -n "$($IP rule | awk '$1 == "'$(($id+2000)):'"')" -o -n "$($IPT -S mwan3_iface_in_$1 2> /dev/null)" -o -n "$($IPT -S mwan3_iface_out_$1 2> /dev/null)" -o -n "$($IP route list table $id default dev $device 2> /dev/null)" ]; then
727 if [ "$enabled" == "1" ]; then
734 mwan3_list_track_ips
()
736 track_ips
="$1 $track_ips"
738 config_list_foreach
$1 track_ip mwan3_list_track_ips
740 if [ -n "$track_ips" ]; then
741 if [ -n "$(pgrep -f "mwan3track
$1")" ]; then
747 tracking
="not enabled"
750 echo " interface $1 is $result and tracking is $tracking"
753 mwan3_report_policies_v4
()
755 local percent policy share total_weight weight iface
757 for policy
in $
($IPT4 -S |
awk '{print $2}' |
grep mwan3_policy_ |
sort -u); do
758 echo "$policy:" |
sed 's/mwan3_policy_//'
760 [ -n "$total_weight" ] || total_weight
=$
($IPT4 -S $policy | cut
-s -d'"' -f2 |
head -1 |
awk '{print $3}')
762 if [ ! -z "${total_weight##*[!0-9]*}" ]; then
763 for iface
in $
($IPT4 -S $policy | cut
-s -d'"' -f2 |
awk '{print $1}'); do
764 weight
=$
($IPT4 -S $policy | cut
-s -d'"' -f2 |
awk '$1 == "'$iface'"' |
awk '{print $2}')
765 percent
=$
(($weight*100/$total_weight))
766 echo " $iface ($percent%)"
769 echo " $($IPT4 -S $policy | sed '/.*--comment \([^ ]*\) .*$/!d;s//\1/;q')"
778 mwan3_report_policies_v6
()
780 local percent policy share total_weight weight iface
782 for policy
in $
($IPT6 -S |
awk '{print $2}' |
grep mwan3_policy_ |
sort -u); do
783 echo "$policy:" |
sed 's/mwan3_policy_//'
785 [ -n "$total_weight" ] || total_weight
=$
($IPT6 -S $policy | cut
-s -d'"' -f2 |
head -1 |
awk '{print $3}')
787 if [ ! -z "${total_weight##*[!0-9]*}" ]; then
788 for iface
in $
($IPT6 -S $policy | cut
-s -d'"' -f2 |
awk '{print $1}'); do
789 weight
=$
($IPT6 -S $policy | cut
-s -d'"' -f2 |
awk '$1 == "'$iface'"' |
awk '{print $2}')
790 percent
=$
(($weight*100/$total_weight))
791 echo " $iface ($percent%)"
794 echo " $($IPT6 -S $policy | sed '/.*--comment \([^ ]*\) .*$/!d;s//\1/;q')"
803 mwan3_report_connected_v4
()
807 if [ -n "$($IPT4 -S mwan3_connected 2> /dev/null)" ]; then
808 for address
in $
($IPS list mwan3_connected_v4 |
egrep '[0-9]{1,3}(\.[0-9]{1,3}){3}'); do
814 mwan3_report_connected_v6
()
818 if [ -n "$($IPT6 -S mwan3_connected 2> /dev/null)" ]; then
819 for address
in $
($IPS list mwan3_connected_v6 |
egrep '([0-9a-fA-F]{1,4}:){7,7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:)|fe80:(:[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}|::(ffff(:0{1,4}){0,1}:){0,1}((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])|([0-9a-fA-F]{1,4}:){1,4}:((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])'); do
825 mwan3_report_rules_v4
()
827 if [ -n "$($IPT4 -S mwan3_rules 2> /dev/null)" ]; then
828 $IPT4 -L mwan3_rules
-n -v 2> /dev
/null |
tail -n+3 |
sed 's/mark.*//' |
sed 's/mwan3_policy_/- /' |
sed 's/mwan3_rule_/S /'
832 mwan3_report_rules_v6
()
834 if [ -n "$($IPT6 -S mwan3_rules 2> /dev/null)" ]; then
835 $IPT6 -L mwan3_rules
-n -v 2> /dev
/null |
tail -n+3 |
sed 's/mark.*//' |
sed 's/mwan3_policy_/- /' |
sed 's/mwan3_rule_/S /'
839 mwan3_flush_conntrack
()
841 local flush_conntrack
843 config_get flush_conntrack
$1 flush_conntrack never
845 if [ -e "$CONNTRACK_FILE" ]; then
846 case $flush_conntrack in
848 [ "$3" = "ifup" ] && {
849 echo f
> ${CONNTRACK_FILE}
850 $LOG info
"connection tracking flushed on interface $1 ($2) $3"
854 [ "$3" = "ifdown" ] && {
855 echo f
> ${CONNTRACK_FILE}
856 $LOG info
"connection tracking flushed on interface $1 ($2) $3"
860 echo f
> ${CONNTRACK_FILE}
861 $LOG info
"connection tracking flushed on interface $1 ($2) $3"
864 $LOG info
"connection tracking not flushed on interface $1 ($2) $3"
868 $LOG warning
"connection tracking not enabled"