mike
/
AC2100
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Delete firewall.sh

This commit is contained in:
mike 2026-04-26 16:37:52 +08:00
parent cb079c459e
commit b7d76fa1e9
1 changed files with 0 additions and 22 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

22
firewall.sh
View File

@ -1,22 +0,0 @@
#!/bin/sh
ip rule add fwmark 1 table 100 2>/dev/null || true
ip route add local default dev lo table 100 2>/dev/null || true
ip rule add fwmark 2 table main priority 100 2>/dev/null || true
nft add table inet sing-box 2>/dev/null || true
nft flush table inet sing-box
# prerouting
nft add chain inet sing-box prerouting '{ type filter hook prerouting priority mangle; policy accept; }'
nft add rule inet sing-box prerouting iifname != "br-lan" accept
nft add rule inet sing-box prerouting ct mark 0x01 accept
nft add rule inet sing-box prerouting meta mark 0x02 accept
nft add rule inet sing-box prerouting ip daddr { 10.0.0.0/8, 127.0.0.0/8, 169.254.0.0/16, 172.16.0.0/12, 192.168.0.0/16, 224.0.0.0/4, 240.0.0.0/4 } accept
nft add rule inet sing-box prerouting meta l4proto { tcp, udp } tproxy to :7893 meta mark set 0x01
# output：所有 root 进程流量打 mark 2 直连
nft add chain inet sing-box output '{ type route hook output priority mangle; policy accept; }'
nft add rule inet sing-box output ip daddr { 10.0.0.0/8, 127.0.0.0/8, 169.254.0.0/16, 172.16.0.0/12, 192.168.0.0/16, 224.0.0.0/4, 240.0.0.0/4 } accept
nft add rule inet sing-box output meta mark 0x02 accept
nft add rule inet sing-box output meta skuid 0 meta mark set 0x02