ONE NOTE

#!/bin/bash

# error break
set -e
# line-number for debug
set -x

lan_ipaddr="192.168.1.5"	# 局域网路由器IP地址
dns_port="5354"				# DNS转发服务端口
redir_port="7892"				# 透明代理转发端口
tproxy_port="7893"			# tproxy

# ip rule add fwmark 1 table 100
# ip route add local 0.0.0.0/0 dev lo table 100
clearAllRules() {
		# 这里是清除所有规则回到默认状态
		iptables-save | awk '/^[*]/ { print $1 } /^:[A-Z]+ [^-]/ { print $1 " ACCEPT" ; } /COMMIT/ { print $0; }' | iptables-restore
}
setProxy() {
		# 转发DNS请求到端口 dns_port 解析
		iptables -t nat -N CLASH_DNS
		iptables -t nat -F CLASH_DNS
		iptables -t nat -A CLASH_DNS -p udp -j REDIRECT --to-ports ${dns_port}
		iptables -t nat -A PREROUTING -p udp --dport 53 -j CLASH_DNS

		# tcp代理 redirect 实现
		iptables -t nat -N CLASH_TCP
		iptables -t nat -F CLASH_TCP
		iptables -t nat -A CLASH_TCP -d 0.0.0.0/8 -j RETURN
		iptables -t nat -A CLASH_TCP -d 10.0.0.0/8 -j RETURN
		iptables -t nat -A CLASH_TCP -d 127.0.0.0/8 -j RETURN
		iptables -t nat -A CLASH_TCP -d 169.254.0.0/16 -j RETURN
		iptables -t nat -A CLASH_TCP -d 172.16.0.0/12 -j RETURN
		iptables -t nat -A CLASH_TCP -d 192.168.0.0/16 -j RETURN
		iptables -t nat -A CLASH_TCP -d 224.0.0.0/4 -j RETURN
		iptables -t nat -A CLASH_TCP -d 240.0.0.0/4 -j RETURN
		iptables -t nat -A CLASH_TCP -p tcp -j REDIRECT --to-ports ${redir_port}
		iptables -t nat -A PREROUTING -p tcp -j CLASH_TCP

		# udp代理 tproxy实现
		iptables -t mangle -N CLASH_UDP
		iptables -t mangle -F CLASH_UDP
		iptables -t mangle -A CLASH_UDP -d 0.0.0.0/8 -j RETURN
		iptables -t mangle -A CLASH_UDP -d 10.0.0.0/8 -j RETURN
		iptables -t mangle -A CLASH_UDP -d 127.0.0.0/8 -j RETURN
		iptables -t mangle -A CLASH_UDP -d 169.254.0.0/16 -j RETURN
		iptables -t mangle -A CLASH_UDP -d 172.16.0.0/12 -j RETURN
		iptables -t mangle -A CLASH_UDP -d 192.168.0.0/16 -j RETURN
		iptables -t mangle -A CLASH_UDP -d 224.0.0.0/4 -j RETURN
		iptables -t mangle -A CLASH_UDP -d 240.0.0.0/4 -j RETURN
		iptables -t mangle -A CLASH_UDP -p udp --dport 53 -j RETURN
		iptables -t mangle -A CLASH_UDP -p udp -j TPROXY --on-port ${tproxy_port} --tproxy-mark 1
		iptables -t mangle -A PREROUTING -p udp -j CLASH_UDP # 应用规则
}

case "$1" in
clear)
		clearAllRules
		echo "delete rules successfully"
		;;
set)
		clearAllRules
		setProxy
		echo "set rules successfully"
		;;
*)
		echo "usage: $0 clear|set"
		exit 0
		;;
esac
exit

systemctl stop systemd-resolved
systemctl disable systemd-resolved
systemctl mask systemd-resolved

# 实现nat
iptables -t nat -A POSTROUTING -o enp4s0 -j MASQUERADE

#!/bin/bash
#!/bin/bash

dns_port=0
redir_port=0
tproxy_port=0

udp_enable=1
nat_enable=0
slient_wan=0

inbound=enp3s0
outbound=enp4s0

config_dir="/var/local/clash"
converter_dir="/home/chlen/converter"
LEASE_FILE="/var/lib/misc/dnsmasq.leases"

# error break
# set -e
# line-number for debug
# set -x
init() {
	# route rules
	ip rule add fwmark 1 table 100
	ip route add local 0.0.0.0/0 dev lo table 100

	# not global addresses
	ipset create local hash:net
	ipset add local 0.0.0.0/8
	ipset add local 10.0.0.0/8
	ipset add local 100.64.0.0/10
	ipset add local 127.0.0.0/8
	ipset add local 169.254.0.0/16
	ipset add local 172.16.0.0/12
	ipset add local 192.168.0.0/16
	ipset add local 224.0.0.0/4
	ipset add local 240.0.0.0/4

	setRules
}

clearAllRules() {
	# recovery rules
	iptables-save | awk '/^[*]/ { print $1 } /^:[A-Z]+ [^-]/ { print $1 " ACCEPT" ; } /COMMIT/ { print $0; }' | iptables-restore

	# nat
	if [ $nat_enable -eq 1 ]; then
		iptables -t nat -A POSTROUTING -o $outbound -j MASQUERADE
	fi

	# drop initiative package from wan
	if [ $slient_wan -eq 1 ]; then
		iptables -A INPUT -i $outbound -m state --state NEW -j DROP
	fi
}

setRules() {
	clearAllRules

	# udp tproxy
	iptables -t mangle -N PROXY_UDP
	iptables -t mangle -F PROXY_UDP
	iptables -t mangle -A PROXY_UDP -p udp --dport 53 -j ACCEPT
	iptables -t mangle -A PROXY_UDP -p udp -j TPROXY --on-port ${tproxy_port} --tproxy-mark 1

	# DNS redirect
	iptables -t nat -N PROXY_DNS
	iptables -t nat -F PROXY_DNS
	iptables -t nat -A PROXY_DNS -p udp -j REDIRECT --to-ports ${dns_port}

	# tcp redirect
	iptables -t nat -N PROXY_TCP
	iptables -t nat -F PROXY_TCP
	iptables -t nat -A PROXY_TCP -p tcp -j REDIRECT --to-ports ${redir_port}

	# apply rules
	if [ $udp_enable -eq 1 ]; then
		if [ $nat_enable -eq 1 ]; then
			iptables -t mangle -A PREROUTING -s 192.168.1.128/25 -j ACCEPT
		fi
		iptables -t mangle -A PREROUTING -m set --match-set local dst -j ACCEPT
		iptables -t mangle -A PREROUTING -p udp -j PROXY_UDP
	fi

	# apply rules
	if [ $nat_enable -eq 1 ]; then
		iptables -t nat -A PREROUTING -s 192.168.1.128/25 -j ACCEPT
	fi
	iptables -t nat -A PREROUTING -p udp --dport 53 -j PROXY_DNS
	iptables -t nat -A PREROUTING -m set --match-set local dst -j ACCEPT
	iptables -t nat -A PREROUTING -p tcp -j PROXY_TCP
}

setSelf() {
	iptables -t nat -A OUTPUT -m mark --mark 6666 -j ACCEPT
	iptables -t nat -A OUTPUT -p udp --dport 53 -j REDIRECT --to-ports ${dns_port}
	iptables -t nat -A OUTPUT -m set --match-set local dst -j ACCEPT
	iptables -t nat -A OUTPUT -p tcp -j REDIRECT --to-ports ${redir_port}
}

update() {
	cd $converter_dir
	cat $config_dir/config.yaml >$config_dir/past.yaml

	./converter

	diffConfig

	read -p "Press Enter to continue..."

	cat $config_dir/target.yaml >$config_dir/config.yaml
	# setRules
	systemctl restart clash
}

lease() {
	# show dnsmasq lease
	while read line; do
		timestamp=$(echo "$line" | awk '{print $1}')
		mac=$(echo "$line" | awk '{print $2}')
		ip=$(echo "$line" | awk '{print $3}')
		host=$(echo "$line" | awk '{print $4}')

		# Convert the timestamp to a human-readable date
		date=$(date -d @$timestamp +"%m-%d %H:%M:%S")

		# Output the result
		echo "$mac	$date	$ip	$host"
	done <"$LEASE_FILE"
}

ban() {
	iptables -t mangle -I PREROUTING -s $1 -j DROP
	# iptables -A INPUT -s $1 -j DROP
	# iptables -I FORWARD -s $1 -j DROP
	# iptables -I FORWARD -s $1 -p tcp --dport 443 -j ACCEPT
	# iptables -I FORWARD -s $1 -p tcp --dport 80 -j ACCEPT
}

diffConfig() {
	# diff $config_dir/config.yaml $config_dir/target.yaml -C 3 --color | less
	diff $config_dir/config.yaml $config_dir/target.yaml -C 3 --color
}

recovery() {
	cat $config_dir/past.yaml >$config_dir/config.yaml
	systemctl restart clash
}

case "$1" in
init)
	init
	;;
set)
	setRules
	;;
del)
	clearAllRules
	;;
update)
	update
	;;
lease)
	lease
	;;
recovery)
	recovery
	;;
diff)
	diffConfig
	;;
ban)
	ban $2
	;;
*)
	echo "HELLO IT'S ME"
	exit 0
	;;
esac
exit

sudo useradd -d /var/local/clash -s /usr/bin/nologin -r clash

vim /etc/systemd/system/clash.service

systemctl start clash.service
systemctl enable clash.service

iptables-save > /etc/iptables