Skip to content

Commit

Permalink
allow tun device forward
Browse files Browse the repository at this point in the history
  • Loading branch information
@whalechoi
whalechoi committed Jul 2, 2024
1 parent 916e56c commit 04ff577
Show file tree
Hide file tree
Showing 2 changed files with 42 additions and 20 deletions.
23 changes: 23 additions & 0 deletions main/proxies/tools/tools.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -52,3 +52,26 @@ func CleanRedirectDNS(port string) {
_ = common.Ipt.Delete("nat", "OUTPUT", "-p", "udp", "-m", "owner", "!", "--gid-owner", common.CoreGid, "--dport", "53", "-j", "DNAT", "--to-destination", "127.0.0.1:"+port)
EnableIPV6DNS()
}

func EnableForward(device string) error {
if err := common.Ipt.Insert("filter", "FORWARD", 1, "-i", device, "-j", "ACCEPT"); err != nil {
return e.New("enable ipv4 forward for "+device+" incoming failed, ", err).WithPrefix(tagTools)
}
if err := common.Ipt.Insert("filter", "FORWARD", 1, "-o", device, "-j", "ACCEPT"); err != nil {
return e.New("enable ipv4 forward for "+device+" outgoing failed, ", err).WithPrefix(tagTools)
}
if err := common.Ipt6.Insert("filter", "FORWARD", 1, "-i", device, "-j", "ACCEPT"); err != nil {
return e.New("enable ipv6 forward for "+device+" incoming failed, ", err).WithPrefix(tagTools)
}
if err := common.Ipt6.Insert("filter", "FORWARD", 1, "-o", device, "-j", "ACCEPT"); err != nil {
return e.New("enable ipv6 forward for "+device+" outgoing failed, ", err).WithPrefix(tagTools)
}
return nil
}

func DisableForward(device string) {
_ = common.Ipt.Delete("filter", "FORWARD", "-i", device, "-j", "ACCEPT")
_ = common.Ipt.Delete("filter", "FORWARD", "-o", device, "-j", "ACCEPT")
_ = common.Ipt6.Delete("filter", "FORWARD", "-i", device, "-j", "ACCEPT")
_ = common.Ipt6.Delete("filter", "FORWARD", "-o", device, "-j", "ACCEPT")
}
39 changes: 19 additions & 20 deletions main/proxies/tun/tun.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -78,6 +78,11 @@ func (this *Tun) Enable() error {
return e.New("cannot find your tun device " + builds.Config.Proxy.TunDevice + " did you configure core correctly?").WithPrefix(tagTun).WithPathObj(*this)
}
}
// allow tun device forward
if err := tools.EnableForward(builds.Config.Proxy.TunDevice); err != nil {
this.Disable()
return err
}
return nil
}

Expand All @@ -94,6 +99,7 @@ func (this *Tun) Disable() {
tools.CleanRedirectDNS(builds.Config.Clash.DNSPort)
tools.CleanRedirectDNS(builds.Config.AdgHome.DNSPort)
}
tools.DisableForward(builds.Config.Proxy.TunDevice)
}

func tunDeviceReady(checkDev string) bool {
Expand Down Expand Up @@ -291,10 +297,10 @@ func createProxyChain(ipv6 bool) error {
// start processing proxy rules
// if PkgList has no package, should proxy everything
if len(builds.Config.Proxy.PkgList) == 0 {
if err := currentIpt.Append("mangle", "XT", "-p", "tcp", "-j", "TUN2SOCKS"); err != nil {
if err := currentIpt.Append("mangle", "XT", "-p", "tcp", "-j", "MARK", "--set-xmark", common.TunMarkId); err != nil {
return e.New("create local applications proxy on "+currentProto+" tcp mangle chain XT failed, ", err).WithPrefix(tagTun)
}
if err := currentIpt.Append("mangle", "XT", "-p", "udp", "-j", "TUN2SOCKS"); err != nil {
if err := currentIpt.Append("mangle", "XT", "-p", "udp", "-j", "MARK", "--set-xmark", common.TunMarkId); err != nil {
return e.New("create local applications proxy on "+currentProto+" udp mangle chain XT failed, ", err).WithPrefix(tagTun)
}
} else if builds.Config.Proxy.Mode == "blacklist" {
Expand All @@ -308,37 +314,37 @@ func createProxyChain(ipv6 bool) error {
}
}
// allow others
if err := currentIpt.Append("mangle", "XT", "-p", "tcp", "-j", "TUN2SOCKS"); err != nil {
if err := currentIpt.Append("mangle", "XT", "-p", "tcp", "-j", "MARK", "--set-xmark", common.TunMarkId); err != nil {
return e.New("create local applications proxy on "+currentProto+" tcp mangle chain XT failed, ", err).WithPrefix(tagTun)
}
if err := currentIpt.Append("mangle", "XT", "-p", "udp", "-j", "TUN2SOCKS"); err != nil {
if err := currentIpt.Append("mangle", "XT", "-p", "udp", "-j", "MARK", "--set-xmark", common.TunMarkId); err != nil {
return e.New("create local applications proxy on "+currentProto+" udp mangle chain XT failed, ", err).WithPrefix(tagTun)
}
} else if builds.Config.Proxy.Mode == "whitelist" {
// allow PkgList
for _, pkg := range builds.Config.Proxy.PkgList {
uidSlice := tools.GetUid(pkg)
for _, uid := range uidSlice {
if err := currentIpt.Append("mangle", "XT", "-p", "tcp", "-m", "owner", "--uid-owner", uid, "-j", "TUN2SOCKS"); err != nil {
if err := currentIpt.Append("mangle", "XT", "-p", "tcp", "-m", "owner", "--uid-owner", uid, "-j", "MARK", "--set-xmark", common.TunMarkId); err != nil {
return e.New("create package "+pkg+" proxy on "+currentProto+" tcp mangle chain XT failed, ", err).WithPrefix(tagTun)
}
if err := currentIpt.Append("mangle", "XT", "-p", "udp", "-m", "owner", "--uid-owner", uid, "-j", "TUN2SOCKS"); err != nil {
if err := currentIpt.Append("mangle", "XT", "-p", "udp", "-m", "owner", "--uid-owner", uid, "-j", "MARK", "--set-xmark", common.TunMarkId); err != nil {
return e.New("create package "+pkg+" proxy on "+currentProto+" udp mangle chain XT failed, ", err).WithPrefix(tagTun)
}
}
}
// allow root user(eg: magisk, ksud, netd...)
if err := currentIpt.Append("mangle", "XT", "-p", "tcp", "-m", "owner", "--uid-owner", "0", "-j", "TUN2SOCKS"); err != nil {
if err := currentIpt.Append("mangle", "XT", "-p", "tcp", "-m", "owner", "--uid-owner", "0", "-j", "MARK", "--set-xmark", common.TunMarkId); err != nil {
return e.New("create root user proxy on "+currentProto+" tcp mangle chain XT failed, ", err).WithPrefix(tagTun)
}
if err := currentIpt.Append("mangle", "XT", "-p", "udp", "-m", "owner", "--uid-owner", "0", "-j", "TUN2SOCKS"); err != nil {
if err := currentIpt.Append("mangle", "XT", "-p", "udp", "-m", "owner", "--uid-owner", "0", "-j", "MARK", "--set-xmark", common.TunMarkId); err != nil {
return e.New("create root user proxy on "+currentProto+" udp mangle chain XT failed, ", err).WithPrefix(tagTun)
}
// allow dns_tether user(eg: dnsmasq...)
if err := currentIpt.Append("mangle", "XT", "-p", "tcp", "-m", "owner", "--uid-owner", "1052", "-j", "TUN2SOCKS"); err != nil {
if err := currentIpt.Append("mangle", "XT", "-p", "tcp", "-m", "owner", "--uid-owner", "1052", "-j", "MARK", "--set-xmark", common.TunMarkId); err != nil {
return e.New("create dns_tether user proxy on "+currentProto+" tcp mangle chain XT failed, ", err).WithPrefix(tagTun)
}
if err := currentIpt.Append("mangle", "XT", "-p", "udp", "-m", "owner", "--uid-owner", "1052", "-j", "TUN2SOCKS"); err != nil {
if err := currentIpt.Append("mangle", "XT", "-p", "udp", "-m", "owner", "--uid-owner", "1052", "-j", "MARK", "--set-xmark", common.TunMarkId); err != nil {
return e.New("create dns_tether user proxy on "+currentProto+" udp mangle chain XT failed, ", err).WithPrefix(tagTun)
}
} else {
Expand All @@ -347,17 +353,17 @@ func createProxyChain(ipv6 bool) error {
// allow IntraList
for _, intra := range builds.Config.Proxy.IntraList {
if (currentProto == "ipv4" && !common.IsIPv6(intra)) || (currentProto == "ipv6" && common.IsIPv6(intra)) {
if err := currentIpt.Insert("mangle", "XT", 1, "-p", "tcp", "-d", intra, "-j", "TUN2SOCKS"); err != nil {
if err := currentIpt.Insert("mangle", "XT", 1, "-p", "tcp", "-d", intra, "-j", "MARK", "--set-xmark", common.TunMarkId); err != nil {
return e.New("allow intra "+intra+" on "+currentProto+" tcp mangle chain XT failed, ", err).WithPrefix(tagTun)
}
if err := currentIpt.Insert("mangle", "XT", 1, "-p", "udp", "-d", intra, "-j", "TUN2SOCKS"); err != nil {
if err := currentIpt.Insert("mangle", "XT", 1, "-p", "udp", "-d", intra, "-j", "MARK", "--set-xmark", common.TunMarkId); err != nil {
return e.New("allow intra "+intra+" on "+currentProto+" udp mangle chain XT failed, ", err).WithPrefix(tagTun)
}
}
}
// mark all dns request(except mihomo/hysteria2)
if builds.Config.XrayHelper.CoreType != "mihomo" && builds.Config.XrayHelper.CoreType != "hysteria2" {
if err := currentIpt.Insert("mangle", "XT", 1, "-p", "udp", "-m", "owner", "!", "--gid-owner", common.CoreGid, "--dport", "53", "-j", "TUN2SOCKS"); err != nil {
if err := currentIpt.Insert("mangle", "XT", 1, "-p", "udp", "-m", "owner", "!", "--gid-owner", common.CoreGid, "--dport", "53", "-j", "MARK", "--set-xmark", common.TunMarkId); err != nil {
return e.New("mark all dns request on "+currentProto+" udp mangle chain XT failed, ", err).WithPrefix(tagTun)
}
} else {
Expand Down Expand Up @@ -412,13 +418,6 @@ func createMangleChain(ipv6 bool) error {
}
}
}
// mark all traffic
if err := currentIpt.Append("mangle", "TUN2SOCKS", "-p", "tcp", "-j", "MARK", "--set-xmark", common.TunMarkId); err != nil {
return e.New("create all traffic proxy on "+currentProto+" tcp mangle chain TUN2SOCKS failed, ", err).WithPrefix(tagTun)
}
if err := currentIpt.Append("mangle", "TUN2SOCKS", "-p", "udp", "-j", "MARK", "--set-xmark", common.TunMarkId); err != nil {
return e.New("create all traffic proxy on "+currentProto+" udp mangle chain TUN2SOCKS failed, ", err).WithPrefix(tagTun)
}
// trans ApList to chain XRAY
for _, ap := range builds.Config.Proxy.ApList {
// allow ApList to IntraList
Expand Down

0 comments on commit 04ff577

Please sign in to comment.