8ce1000cbcadad262d454a24ec4cef3fee21f728
5 Usage: ss-rules [options]
9 -s <server_host> hostname or ip of shadowsocks remote server
10 -l <local_port> port number of shadowsocks local server
11 -i <ip_list_file> a file content is bypassed ip list
12 -a <lan_ips> lan ip of access control, need a prefix to
13 define access control mode
14 -b <wan_ips> wan ip of will be bypassed
15 -w <wan_ips> wan ip of will be forwarded
16 -e <extra_options> extra options for iptables
17 -o apply the rules to the OUTPUT chain
18 -u enable udprelay mode, TPROXY is required
19 -U enable udprelay mode, using different IP
20 and ports for TCP and UDP
26 # 1.alert 2.crit 3.err 4.warn 5.notice 6.info 7.debug
27 logger
-st ss-rules
[$$
] -p$1 $2
30 ipt_n
="iptables -t nat"
31 ipt_m
="iptables -t mangle"
36 IPT
=$
(iptables-save
-t nat
)
37 eval $
(echo "$IPT" |
grep "_SS_SPEC_RULE_" | \
38 sed -e 's/^-A/$ipt_n -D/' -e 's/$/;/')
40 for chain
in $
(echo "$IPT" |
awk '/^:SS_SPEC/{print $1}'); do
41 $ipt_n -F ${chain:1} 2>/dev
/null
&& $ipt_n -X ${chain:1}
44 IPT
=$
(iptables-save
-t mangle
)
45 eval $
(echo "$IPT" |
grep "_SS_SPEC_RULE_" | \
46 sed -e 's/^-A/$ipt_m -D/' -e 's/$/;/')
48 for chain
in $
(echo "$IPT" |
awk '/^:SS_SPEC/{print $1}'); do
49 $ipt_m -F ${chain:1} 2>/dev
/null
&& $ipt_m -X ${chain:1}
52 ip rule del fwmark
0x01/0x01 table
100 2>/dev
/null
53 ip route del
local 0.0.0.0/0 dev lo table
100 2>/dev
/null
54 ipset
-X ss_spec_lan_ac
2>/dev
/null
55 ipset
-X ss_spec_wan_ac
2>/dev
/null
60 ipset
-! -R <<-EOF || return 1
61 create ss_spec_wan_ac hash:net
62 $(echo -e "$IPLIST" | sed -e "s/^/add ss_spec_wan_ac /")
63 $(for ip in $WAN_FW_IP; do echo "add ss_spec_wan_ac $ip nomatch"; done)
65 $ipt_n -N SS_SPEC_WAN_AC
&& \
66 $ipt_n -A SS_SPEC_WAN_AC
-m set --match-set ss_spec_wan_ac dst
-j RETURN
&& \
67 $ipt_n -A SS_SPEC_WAN_AC
-j SS_SPEC_WAN_FW
72 $ipt_n -N SS_SPEC_WAN_FW
&& \
73 $ipt_n -A SS_SPEC_WAN_FW
-p tcp \
74 -j REDIRECT
--to-ports $local_port 2>/dev
/null ||
{
75 loger
3 "Can't redirect, please check the iptables."
84 if [ -n "$LAN_AC_IP" ]; then
85 if [ "${LAN_AC_IP:0:1}" = "w" ]; then
88 if [ "${LAN_AC_IP:0:1}" != "b" ]; then
89 loger
3 "Bad argument \`-a $LAN_AC_IP\`."
96 if iptables-save
-t nat |
grep -q "^:zone_lan_prerouting"; then
97 ROUTECHAIN
=zone_lan_prerouting
100 ipset
-! -R <<-EOF || return 1
101 create ss_spec_lan_ac hash:net
102 $(for ip in ${LAN_AC_IP:1}; do echo "add ss_spec_lan_ac $ip $TAG"; done)
104 $ipt_n -A $ROUTECHAIN -p tcp
$EXT_ARGS \
105 -m set ! --match-set ss_spec_lan_ac src \
106 -m comment
--comment "_SS_SPEC_RULE_" -j SS_SPEC_WAN_AC
108 if [ "$OUTPUT" = 1 ]; then
109 $ipt_n -A OUTPUT
-p tcp
$EXT_ARGS \
110 -m comment
--comment "_SS_SPEC_RULE_" -j SS_SPEC_WAN_AC
116 [ -n "$TPROXY" ] ||
return 0
117 ip rule add fwmark
0x01/0x01 table
100
118 ip route add
local 0.0.0.0/0 dev lo table
100
119 $ipt_m -N SS_SPEC_TPROXY
120 $ipt_m -A SS_SPEC_TPROXY
-p udp
-m set ! --match-set ss_spec_wan_ac dst \
121 -j TPROXY
--on-port $LOCAL_PORT --tproxy-mark 0x01/0x01
122 $ipt_m -A PREROUTING
-p udp
$EXT_ARGS \
123 -m set ! --match-set ss_spec_lan_ac src \
124 -m comment
--comment "_SS_SPEC_RULE_" -j SS_SPEC_TPROXY
128 while getopts ":s:l:S:L:i:e:a:b:w:ouUf" arg
; do
152 WAN_BP_IP
=$
(for ip
in $OPTARG; do echo $ip; done)
173 if [ -z "$server" -o -z "$local_port" ]; then
178 if [ "$TPROXY" = 1 ]; then
180 LOCAL_PORT
=$local_port
183 if [ "$TPROXY" = 2 ]; then
184 if [ -z "$SERVER" -o -z "$LOCAL_PORT" ]; then
185 loger
3 "Please use -S and -L specifies IP and port for UDP."
189 if [ -f "$IGNORE" ]; then
190 IGNORE_IP
=$
(cat $IGNORE 2>/dev
/null
)
193 IPLIST
=$
(cat <<-EOF | grep -E "^([0-9]{1,3}\.){3}[0-9]{1,3}"
217 flush_r
&& fw_rule
&& ipset_r
&& ac_rule
&& tp_rule