Merge pull request #4962 from diizzyy/patch-96

[feed/packages.git] / net / shadowsocks-libev / README.md

diff --git a/net/shadowsocks-libev/README.md b/net/shadowsocks-libev/README.md
index 75790ea69cb30a71a81d39e80032cf1f48406653..ada71208bf0a9d00f272b47d65e423ce15e80c15 100644 (file)
--- a/net/shadowsocks-libev/README.md
+++ b/net/shadowsocks-libev/README.md
@@ -1,9 +1,9 @@
 ## components
 
-`ss-local` provides SOCKS5 proxy.
+`ss-local` provides SOCKS5 proxy with UDP associate support.
 
         socks5                                     ss              plain
-       --------> tcp:udp:local_address:local_port ----> ss server -------> dest
+       --------> tcp:local_address:local_port ----> ss server -------> dest
 
 `ss-redir`.  The REDIRECT and TPROXY part are to be provided by `ss-rules` script.  REDIRECT only works for tcp traffic (see also darkk/redsocks).  TPROXY is used to proxy udp messages, but it's only available in the PREROUTING chain and as such cannot proxy local out traffic.
 
@@ -39,8 +39,9 @@ We can have multiple instances of component and `server` sections.  The relation
 
        redir_tcp               name of ss_redir section with mode tcp_only or tcp_and_udp
        redir_udp               name of ss_redir section with mode udp_only or tcp_and_udp
+       ifnames                 only apply rules on packets from these ifnames
 
-       --- incoming packets having source address in
+       --- for incoming packets having source address in
 
        src_ips_bypass          will bypass the redir chain
        src_ips_forward         will always go through the redir chain
@@ -50,10 +51,6 @@ We can have multiple instances of component and `server` sections.  The relation
 
        src_default             bypass, forward, [checkdst]
 
-       --- for local out tcp packets, the default action can be specified with
-
-       local_default           [bypass], forward, checkdst
-
        --- if the previous check result is checkdst,
        --- then packets having destination address in
 
@@ -62,6 +59,20 @@ We can have multiple instances of component and `server` sections.  The relation
        dst_ips_forward_file
        dst_ips_forward         will go through the redir chain
 
+       --- otherwise, the default action can be specified with
+
+       dst_default             [bypass], forward
+
+       --- for local out tcp packets, the default action can be specified with
+
+       local_default           [bypass], forward, checkdst
+
+Bool option `dst_forward_recentrst` requires iptables/netfilter `recent` match module (`opkg install iptables-mod-conntrack-extra`).  When enabled, `ss-rules` will setup iptables rules to forward through `ss-redir` those packets whose destination have recently sent to us multiple tcp-rst.
+
+ss-rules uses kernel ipset mechanism for storing addresses/networks.  Those ipsets are also part of the API and can be populated by other programs, e.g. dnsmasq with builtin ipset support.  For more details please read output of `ss-rules --help`
+
+Note also that `src_ips_xx` and `dst_ips_xx` actually also accepts cidr network representation.  Option names are retained in its current form for backward compatibility coniderations
+
 ## notes and faq
 
 Useful paths and commands for debugging