lou
b55c0cb7bb
- LICENSE: MIT © 2026 edgevoid - README: 三层架构/逐字段伪装对照/部署/验证/安全边界/看门狗自启 - 脱敏(filter-repo 全历史): 8.136.202.225→203.0.113.10, .zjipc.cn→.internal.example, 学校DNS→192.0.2.53 - hook.sh 更新为安全形态(FORWARD-only 绑 WAN, 去掉 OUTPUT 全挂断网形态) - router_deploy.sh: SSHPASS 改环境变量注入(明文密码清除) - watchdog.sh 纳入 deploy/(接口变量化) - 内部语境泛化(认证网关/学校DNS/寝室部署备注)
46 lines
2.2 KiB
Bash
Executable File
46 lines
2.2 KiB
Bash
Executable File
#!/bin/sh
|
|
# L2/L1 hook - 网关规则(OpenWrt / 任意 iptables 网关, 部署时按实际接口调整)
|
|
# 安全形态(断网事故复盘定稿):
|
|
# - L1 伪装只挂 FORWARD 且 -o 绑 WAN 口; 网关自身 OUTPUT 零规则
|
|
# - NFQUEUE 必带 --queue-bypass(worker 不在 = 放行, 绝不悬挂)
|
|
# - HTTP 劫持只挂 PREROUTING 入站 + 内网目标放行(认证/内网站点绝不能走通道)
|
|
#
|
|
# 用法: sh hook.sh add | del
|
|
# 部署前先确认: ① 接口名(LAN_IF/WAN_IF) ② 内网放行段 ③ 本地代理已起
|
|
|
|
LAN_IF=${LAN_IF:-br-lan}
|
|
WAN_IF=${WAN_IF:-eth0}
|
|
HTTP_PORT=8080
|
|
QUEUE_NUM=100
|
|
# 内网/认证目标段(按部署环境调整; 这些目标的明文流量直接放行, 绝不进套壳通道)
|
|
INTERNAL_NETS="10.0.0.0/8 172.16.0.0/12 192.168.0.0/16 127.0.0.0/8"
|
|
|
|
add_rules() {
|
|
for net in $INTERNAL_NETS; do
|
|
iptables -t nat -C PREROUTING -i "$LAN_IF" -p tcp --dport 80 -d "$net" -j ACCEPT 2>/dev/null ||
|
|
iptables -t nat -A PREROUTING -i "$LAN_IF" -p tcp --dport 80 -d "$net" -j ACCEPT
|
|
done
|
|
iptables -t nat -C PREROUTING -i "$LAN_IF" -p tcp --dport 80 -j REDIRECT --to-ports "$HTTP_PORT" 2>/dev/null ||
|
|
iptables -t nat -A PREROUTING -i "$LAN_IF" -p tcp --dport 80 -j REDIRECT --to-ports "$HTTP_PORT"
|
|
echo "[hook] HTTP 80 -> $HTTP_PORT (仅 $LAN_IF 入站, 内网段放行)"
|
|
# L1 伪装器: FORWARD 出 WAN 的 SYN 送 NFQUEUE(--queue-bypass: worker 不在时放行)
|
|
iptables -t mangle -C FORWARD -o "$WAN_IF" -p tcp --syn -j NFQUEUE --queue-num "$QUEUE_NUM" --queue-bypass 2>/dev/null ||
|
|
iptables -t mangle -A FORWARD -o "$WAN_IF" -p tcp --syn -j NFQUEUE --queue-num "$QUEUE_NUM" --queue-bypass
|
|
echo "[hook] L1 NFQUEUE: FORWARD -o $WAN_IF SYN -> queue $QUEUE_NUM (bypass 兜底)"
|
|
}
|
|
|
|
del_rules() {
|
|
iptables -t mangle -D FORWARD -o "$WAN_IF" -p tcp --syn -j NFQUEUE --queue-num "$QUEUE_NUM" --queue-bypass 2>/dev/null
|
|
iptables -t nat -D PREROUTING -i "$LAN_IF" -p tcp --dport 80 -j REDIRECT --to-ports "$HTTP_PORT" 2>/dev/null
|
|
for net in $INTERNAL_NETS; do
|
|
iptables -t nat -D PREROUTING -i "$LAN_IF" -p tcp --dport 80 -d "$net" -j ACCEPT 2>/dev/null
|
|
done
|
|
echo "[hook] 规则已清"
|
|
}
|
|
|
|
case "$1" in
|
|
add) add_rules ;;
|
|
del) del_rules ;;
|
|
*) echo "usage: $0 add|del"; exit 1 ;;
|
|
esac
|