xm/ShellCrash
1
0
Fork 0
mirror of https://github.com/juewuy/ShellCrash.git synced 2026-03-11 07:51:45 +00:00
Code Issues Packages Projects Releases Wiki Activity

~增加单独指定dns劫持端口的功能(用于搭配第三方DNS服务)

Browse Source
This commit is contained in:
juewuy
2026-01-07 11:11:17 +08:00
parent 27dfc69f50
commit 22cd7766cd
4 changed files with 14 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
scripts/starts/fw_iptables.sh
View File

@@ -108,18 +108,18 @@ start_ipt_dns() { #iptables-dns通用工具
if [ "$2" = 'PREROUTING' ] && [ "$3" != 'shellcrash_vm_dns' ] && [ "$macfilter_type" = "白名单" ] && [ -n "$(cat $CRASHDIR/configs/mac $CRASHDIR/configs/ip_filter 2>/dev/null)" ]; then
[ -s "$CRASHDIR"/configs/mac ] &&
for mac in $(cat "$CRASHDIR"/configs/mac); do
"$1" $w -t nat -A "$3" -p tcp -m mac --mac-source $mac -j REDIRECT --to-ports $dns_port
"$1" $w -t nat -A "$3" -p udp -m mac --mac-source $mac -j REDIRECT --to-ports $dns_port
"$1" $w -t nat -A "$3" -p tcp -m mac --mac-source $mac -j REDIRECT --to-ports "$dns_redir_port"
"$1" $w -t nat -A "$3" -p udp -m mac --mac-source $mac -j REDIRECT --to-ports "$dns_redir_port"
done
[ -s "$CRASHDIR"/configs/ip_filter ] && [ "$1" = 'iptables' ] &&
for ip in $(cat "$CRASHDIR"/configs/ip_filter); do
"$1" $w -t nat -A "$3" -p tcp -s $ip -j REDIRECT --to-ports $dns_port
"$1" $w -t nat -A "$3" -p udp -s $ip -j REDIRECT --to-ports $dns_port
"$1" $w -t nat -A "$3" -p tcp -s $ip -j REDIRECT --to-ports "$dns_redir_port"
"$1" $w -t nat -A "$3" -p udp -s $ip -j REDIRECT --to-ports "$dns_redir_port"
done
else
for ip in $HOST_IP; do #仅限指定网段流量
"$1" $w -t nat -A "$3" -p tcp -s $ip -j REDIRECT --to-ports $dns_port
"$1" $w -t nat -A "$3" -p udp -s $ip -j REDIRECT --to-ports $dns_port
"$1" $w -t nat -A "$3" -p tcp -s $ip -j REDIRECT --to-ports "$dns_redir_port"
"$1" $w -t nat -A "$3" -p udp -s $ip -j REDIRECT --to-ports "$dns_redir_port"
done
fi
[ "$1" = 'ip6tables' ] && { #屏蔽外部请求
@@ -258,7 +258,7 @@ start_iptables() { #iptables配置总入口
start_ipt_route iptables nat PREROUTING shellcrash_vm tcp #ipv4-局域网tcp转发
}
#启动DNS劫持
[ "$dns_no" != "已禁用" -a "$dns_redir" != "ON" -a "$firewall_area" -le 3 ] && {
[ "$firewall_area" -le 3 ] && {
[ "$lan_proxy" = true ] && {
start_ipt_dns iptables PREROUTING shellcrash_dns #ipv4-局域网dns转发
if $ip6table -j REDIRECT -h 2>/dev/null | grep -q '\--to-ports'; then

6
scripts/starts/fw_nftables.sh
View File

@@ -129,8 +129,8 @@ start_nft_dns() { #nftables-dns
nft add rule inet shellcrash "$1"_dns ether saddr != {$MAC} return
fi
}
nft add rule inet shellcrash "$1"_dns udp dport 53 redirect to ${dns_port}
nft add rule inet shellcrash "$1"_dns tcp dport 53 redirect to ${dns_port}
nft add rule inet shellcrash "$1"_dns udp dport 53 redirect to "$dns_redir_port"
nft add rule inet shellcrash "$1"_dns tcp dport 53 redirect to "$dns_redir_port"
}
start_nft_wan() { #nftables公网防火墙
HOST_IP=$(echo $host_ipv4 | sed 's/ /, /g')
@@ -163,7 +163,7 @@ start_nftables() { #nftables配置总入口
#公网访问防火墙
[ "$fw_wan" != OFF ] && [ "$systype" != 'container' ] && start_nft_wan
#启动DNS劫持
[ "$dns_no" != "已禁用" -a "$dns_redir" != "ON" -a "$firewall_area" -le 3 ] && {
[ "$firewall_area" -le 3 ] && {
[ "$lan_proxy" = true ] && start_nft_dns prerouting prerouting #局域网dns转发
[ "$local_proxy" = true ] && start_nft_dns output output #本机dns转发
}