Upload files to "/"

config.json

@@ -0,0 +1,152 @@
+{
+  "log": {
+    "level": "error",
+    "timestamp": true
+  },
+
+  "dns": {
+    "servers": [
+      {
+        "tag": "dns_proxy",
+        "address": "https://1.1.1.1/dns-query",
+        "address_resolver": "dns_direct",
+        "detour": "proxy"
+      },
+      {
+        "tag": "dns_direct",
+        "address": "223.5.5.5",
+        "detour": "direct"
+      },
+      {
+        "tag": "dns_block",
+        "address": "rcode://success"
+      }
+    ],
+    "rules": [
+      {
+        "outbound": "any",
+        "server": "dns_direct"
+      },
+      {
+        "rule_set": "geosite-cn",
+        "server": "dns_direct"
+      },
+      {
+        "rule_set": "geosite-category-ads-all",
+        "server": "dns_block",
+        "disable_cache": true
+      }
+    ],
+    "final": "dns_proxy",
+    "independent_cache": true
+  },
+
+  "inbounds": [
+    {
+      "tag": "tproxy_in",
+      "type": "tproxy",
+      "listen": "0.0.0.0",
+      "listen_port": 7893,
+      "sniff": true,
+      "sniff_override_destination": true
+    }
+  ],
+
+  "outbounds": [
+    {
+      "tag": "proxy",
+      "type": "vless",
+      "server": "boss.google-helper.com",
+      "server_port": 2036,
+      "uuid": "0ad7d003-8e79-4529-8b55-09610947c09b",
+      "tls": {
+        "enabled": true,
+        "server_name": "baidu.stickrouter.com",
+        "utls": {
+          "enabled": true,
+          "fingerprint": "chrome"
+        }
+      },
+      "transport": {
+        "type": "ws",
+        "path": "/stickrouter",
+        "headers": {
+          "Host": "baidu.stickrouter.com"
+        }
+      }
+    },
+    {
+      "tag": "direct",
+      "type": "direct"
+    },
+    {
+      "tag": "block",
+      "type": "block"
+    },
+    {
+      "tag": "dns_out",
+      "type": "dns"
+    },
+    {
+      "tag": "auto",
+      "type": "urltest",
+      "outbounds": ["proxy"],
+      "url": "https://www.gstatic.com/generate_204",
+      "interval": "30s",
+      "tolerance": 50
+    }
+  ],
+
+  "route": {
+    "rules": [
+      {
+        "rule_set": "geosite-category-ads-all",
+        "outbound": "block"
+      },
+      {
+        "protocol": "dns",
+        "outbound": "dns_out"
+      },
+      {
+        "ip_is_private": true,
+        "outbound": "direct"
+      },
+      {
+        "rule_set": "geosite-cn",
+        "outbound": "direct"
+      },
+      {
+        "rule_set": "geoip-cn",
+        "outbound": "direct"
+      }
+    ],
+    "rule_set": [
+      {
+        "tag": "geosite-cn",
+        "type": "remote",
+        "format": "binary",
+        "url": "https://raw.githubusercontent.com/SagerNet/sing-geosite/rule-set/geosite-cn.srs",
+        "download_detour": "proxy",
+        "update_interval": "7d"
+      },
+      {
+        "tag": "geosite-category-ads-all",
+        "type": "remote",
+        "format": "binary",
+        "url": "https://raw.githubusercontent.com/SagerNet/sing-geosite/rule-set/geosite-category-ads-all.srs",
+        "download_detour": "proxy",
+        "update_interval": "7d"
+      },
+      {
+        "tag": "geoip-cn",
+        "type": "remote",
+        "format": "binary",
+        "url": "https://raw.githubusercontent.com/SagerNet/sing-geoip/rule-set/geoip-cn.srs",
+        "download_detour": "proxy",
+        "update_interval": "7d"
+      }
+    ],
+    "final": "auto",
+    "auto_detect_interface": true
+  }
+}

firewall.sh

@@ -0,0 +1,22 @@
+#!/bin/sh
+
+ip rule add fwmark 1 table 100 2>/dev/null || true
+ip route add local default dev lo table 100 2>/dev/null || true
+ip rule add fwmark 2 table main priority 100 2>/dev/null || true
+
+nft add table inet sing-box 2>/dev/null || true
+nft flush table inet sing-box
+
+# prerouting
+nft add chain inet sing-box prerouting '{ type filter hook prerouting priority mangle; policy accept; }'
+nft add rule inet sing-box prerouting iifname != "br-lan" accept
+nft add rule inet sing-box prerouting ct mark 0x01 accept
+nft add rule inet sing-box prerouting meta mark 0x02 accept
+nft add rule inet sing-box prerouting ip daddr { 10.0.0.0/8, 127.0.0.0/8, 169.254.0.0/16, 172.16.0.0/12, 192.168.0.0/16, 224.0.0.0/4, 240.0.0.0/4 } accept
+nft add rule inet sing-box prerouting meta l4proto { tcp, udp } tproxy to :7893 meta mark set 0x01
+
+# output：所有 root 进程流量打 mark 2 直连
+nft add chain inet sing-box output '{ type route hook output priority mangle; policy accept; }'
+nft add rule inet sing-box output ip daddr { 10.0.0.0/8, 127.0.0.0/8, 169.254.0.0/16, 172.16.0.0/12, 192.168.0.0/16, 224.0.0.0/4, 240.0.0.0/4 } accept
+nft add rule inet sing-box output meta mark 0x02 accept
+nft add rule inet sing-box output meta skuid 0 meta mark set 0x02