From b863bb6bc4954f43ad159c3e01c9b160f15e1268 Mon Sep 17 00:00:00 2001 From: juewuy Date: Wed, 16 Nov 2022 19:49:02 +0800 Subject: [PATCH] =?UTF-8?q?v1.6.7=20~=E6=96=B0=E5=A2=9ETproxy=E6=A8=A1?= =?UTF-8?q?=E5=BC=8F=20=20=20=C2=B7tcp=20=20=20=C2=B7MAC=E8=BF=87=E6=BB=A4?= =?UTF-8?q?=20=20=20=C2=B7=E5=B8=B8=E7=94=A8=E7=AB=AF=E5=8F=A3=E8=BF=87?= =?UTF-8?q?=E6=BB=A4=20=20=20=C2=B7CNIP=E7=BB=95=E8=BF=87(=E5=B7=B2?= =?UTF-8?q?=E4=BF=AE=E5=A4=8D)=20=20=20=C2=B7=E5=B1=8F=E8=94=BDQUIC=20=20?= =?UTF-8?q?=20=C2=B7ipv6=E6=94=AF=E6=8C=81=20~=E6=96=B0=E5=A2=9ENftables?= =?UTF-8?q?=E6=94=AF=E6=8C=81=20=20=20=C2=B7tcp&udp=20=20=20=C2=B7MAC?= =?UTF-8?q?=E8=BF=87=E6=BB=A4=20=20=20=C2=B7=E5=B8=B8=E7=94=A8=E7=AB=AF?= =?UTF-8?q?=E5=8F=A3=E8=BF=87=E6=BB=A4=20=20=20=C2=B7CNIP=E7=BB=95?= =?UTF-8?q?=E8=BF=87=20=20=20=C2=B7=E5=B1=8F=E8=94=BDQUIC=20=20=20=C2=B7ip?= =?UTF-8?q?v6=E6=94=AF=E6=8C=81(=E6=9C=AA=E6=B5=8B=E8=AF=95)=20=20=20?= =?UTF-8?q?=C2=B7=E6=9C=AC=E6=9C=BA=E4=BB=A3=E7=90=86=20=20=20=C2=B7docker?= =?UTF-8?q?=E4=BB=A3=E7=90=86(=E6=9C=AA=E6=B5=8B=E8=AF=95)=20~=E7=A7=BB?= =?UTF-8?q?=E9=99=A4=E9=83=A8=E5=88=86=E4=B8=8D=E5=8F=AF=E7=94=A8=E5=AE=89?= =?UTF-8?q?=E8=A3=85=E6=BA=90=20~=E4=BF=AE=E5=A4=8D=E7=89=88=E6=9C=AC?= =?UTF-8?q?=E5=9B=9E=E9=80=80=E5=8A=9F=E8=83=BD=E4=B8=8D=E5=8F=AF=E7=94=A8?= =?UTF-8?q?=E7=9A=84=E9=97=AE=E9=A2=98=20~=E4=BF=AE=E5=A4=8D=E9=83=A8?= =?UTF-8?q?=E5=88=86Linux=E8=AE=BE=E5=A4=87grep=E5=91=BD=E4=BB=A4=E6=8A=A5?= =?UTF-8?q?=E9=94=99=E7=9A=84=E9=97=AE=E9=A2=98=20~=E5=B0=9D=E8=AF=95?= =?UTF-8?q?=E4=BF=AE=E5=A4=8D=E9=83=A8=E5=88=86=E5=8D=8E=E7=A1=95=E8=AE=BE?= =?UTF-8?q?=E5=A4=87=E6=97=A0=E6=B3=95=E6=AD=A3=E5=B8=B8=E5=BC=80=E6=9C=BA?= =?UTF-8?q?=E5=90=AF=E5=8A=A8=E7=9A=84=E9=97=AE=E9=A2=98=20~=E5=B0=9D?= =?UTF-8?q?=E8=AF=95=E4=BF=AE=E5=A4=8D=E9=83=A8=E5=88=86=E8=AE=BE=E5=A4=87?= =?UTF-8?q?=E6=8F=90=E7=A4=BAip6tables=E6=8A=A5=E9=94=99=E7=9A=84=E9=97=AE?= =?UTF-8?q?=E9=A2=98=20~=E4=BF=AE=E5=A4=8D=E9=83=A8=E5=88=86=E6=83=85?= =?UTF-8?q?=E5=86=B5=E4=B8=8Btun=E6=A8=A1=E5=BC=8F=E6=97=A0=E6=B3=95?= =?UTF-8?q?=E6=AD=A3=E5=B8=B8=E4=BB=A3=E7=90=86=E7=9A=84=E9=97=AE=E9=A2=98?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- scripts/clash.sh | 41 +++++++++++++++++++++------------- scripts/start.sh | 57 ++++++++++++++++++++++++++---------------------- 2 files changed, 57 insertions(+), 41 deletions(-) diff --git a/scripts/clash.sh b/scripts/clash.sh index ca9adb9..3935f8d 100644 --- a/scripts/clash.sh +++ b/scripts/clash.sh @@ -28,7 +28,7 @@ getconfig(){ [ ! -f $clashdir/mac ] && touch $clashdir/mac #获取本机host地址 [ -z "$host" ] && host=$(ubus call network.interface.lan status 2>&1 | grep \"address\" | grep -oE '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}';) - [ -z "$host" ] && host=$(ip a 2>&1 | grep -w 'inet' | grep 'global' | grep -E '\ 1(92|0|72)\.' | sed 's/.*inet.//g' | sed 's/\/[0-9][0-9].*$//g' | head -n 1) + [ -z "$host" ] && host=$(ip a 2>&1 | grep -w 'inet' | grep 'global' | grep -E ' 1(92|0|72)\.' | sed 's/.*inet.//g' | sed 's/\/[0-9][0-9].*$//g' | head -n 1) [ -z "$host" ] && host=127.0.0.1 #dashboard目录位置 [ -d $clashdir/ui ] && dbdir=$clashdir/ui && hostdir=":$db_port/ui" @@ -369,7 +369,7 @@ setdns(){ } checkport(){ for portx in $dns_port $mix_port $redir_port $db_port ;do - if [ -n "$(netstat -ntul 2>&1 |grep \:$portx\ )" ];then + if [ -n "$(netstat -ntul 2>&1 |grep '\:$portx ')" ];then echo ----------------------------------------------- echo -e "检测到端口【$portx】被以下进程占用！clash可能无法正常启动！\033[33m" echo $(netstat -ntul | grep :$portx | head -n 1) @@ -524,7 +524,7 @@ localproxy(){ echo -e " 1 \033[36m$proxy_set本机代理\033[0m" echo -e " 2 使用\033[32m环境变量\033[0m方式配置(部分应用可能无法使用)" [ -n "$(lsmod | grep ^xt_owner)" ] && echo -e " 3 使用\033[32miptables增强模式\033[0m配置(支持docker)" - type nft 2> /dev/null && echo -e " 4 使用\033[32mnftables增强模式\033[0m配置(支持docker)" + type nft &> /dev/null && echo -e " 4 使用\033[32mnftables增强模式\033[0m配置(支持docker)" echo -e " 0 返回上级菜单" echo ----------------------------------------------- read -p "请输入对应数字 > " num @@ -604,20 +604,20 @@ clashcfg(){ echo -e "\033[36m已设为 $redir_mod ！！\033[0m" } [ -n "$(iptables -j TPROXY 2>&1 | grep 'on-port')" ] && sup_tp=1 - [ -n "$(lsmod | grep '^tun')" ] && sup_tun=1 - type nft 2> /dev/null && sup_nft=1 - [ -n "$sup_nft" -a -n "$(lsmod | grep 'nft_tproxy')" ] && sup_nft=2 + #[ -n "$(lsmod | grep '^tun')" ] || ip tuntap &>/dev/null && sup_tun=1 + type nft &> /dev/null && sup_nft=1 + #[ -n "$(lsmod | grep 'nft_tproxy')" ] && sup_nft=2 echo ----------------------------------------------- echo -e "当前代理模式为：\033[47;30m $redir_mod \033[0m；Clash核心为：\033[47;30m $clashcore \033[0m" echo -e "\033[33m切换模式后需要手动重启clash服务以生效！\033[0m" echo ----------------------------------------------- echo -e " 1 \033[32mRedir模式\033[0m： Redir转发TCP，不转发UDP" - [ -n "$sup_tun" ] && echo -e " 2 \033[36m混合模式\033[0m： Redir转发TCP，Tun转发UDP" + echo -e " 2 \033[36m混合模式\033[0m： Redir转发TCP，Tun转发UDP" [ -n "$sup_tp" ] && echo -e " 3 \033[32mTproxy混合\033[0m： Redir转发TCP，Tproxy转发UDP" - [ -n "$sup_tun" ] && echo -e " 4 \033[33mTun模式\033[0m： 使用Tun转发TCP&UDP(占用高)" + echo -e " 4 \033[33mTun模式\033[0m： 使用Tun转发TCP&UDP(占用高)" [ -n "$sup_tp" ] && echo -e " 5 \033[32mTproxy模式\033[0m： 使用Tproxy转发TCP&UDP" [ -n "$sup_nft" ] && echo -e " 6 \033[36mNft基础\033[0m： 使用nftables转发TCP，不转发UDP" - [ "$sup_nft" = '2' ] && echo -e " 7 \033[32mNft混合\033[0m： 使用nft_tproxy转发TCP&UDP" + [ -n "$sup_nft" ] && echo -e " 7 \033[32mNft混合\033[0m： 使用nft_tproxy转发TCP&UDP" echo -e " 8 \033[36m纯净模式\033[0m： 不设置流量转发" echo " 0 返回上级菜单" read -p "请输入对应数字 > " num @@ -639,8 +639,13 @@ clashcfg(){ set_redir_config elif [ "$num" = 4 ]; then - redir_mod=Tun模式 - dns_mod=fake-ip + if modprobe tun &>/dev/null;then + redir_mod=Tun模式 + dns_mod=fake-ip + else + read -p "未检测到Tun模块，是否强制开启？可能导致无法联网！(1/0)" res + [ "$res" = '1' ] && redir_mod=Tun模式 && dns_mod=fake-ip + fi set_redir_config elif [ "$num" = 5 ]; then @@ -652,7 +657,12 @@ clashcfg(){ set_redir_config elif [ "$num" = 7 ]; then - redir_mod=Nft混合 + if modprobe nft_tproxy &>/dev/null;then + redir_mod=Nft混合 + else + read -p "未检测到Tproxy模块，是否强制开启？可能导致无法联网！(1/0)" res + [ "$res" = '1' ] && redir_mod=Nft混合 + fi set_redir_config elif [ "$num" = 8 ]; then @@ -956,11 +966,12 @@ clashadv(){ elif [ "$num" = 5 ]; then if [ "$public_support" = "未开启" ]; then - echo -e "\033[32m已开启公网访问Dashboard端口及Http/Sock5代理端口！！\033[0m" - echo -e "\033[33m安全起见建议设置相关访问密码！！\033[0m" + echo -e "\033[32m已开启公网访问Dashboard端口，安全起见建议设置面板访问密码！！\033[0m" + echo -e "\033[33m如需访问Http/Sock5代理，请在端口设置中修改默认端口并设置访问密码！\033[0m" + echo -e "\033[31m如未设置密码或仍使用默认端口，将自动拒绝连接！！！\033[0m" public_support=已开启 setconfig public_support $public_support - sleep 1 + sleep 3 else echo -e "\033[32m已禁止公网访问Dashboard端口及Http/Sock5代理端口！！\033[0m" echo -e "\033[33m如果你的防火墙默认放行公网流量，可能禁用失败！\033[0m" diff --git a/scripts/start.sh b/scripts/start.sh index 259fdf8..c55b567 100644 --- a/scripts/start.sh +++ b/scripts/start.sh @@ -235,7 +235,7 @@ EOF` exit 1 fi #检测不支持的加密协议 - if cat $yamlnew | grep 'cipher:\ chacha20,' >/dev/null;then + if cat $yamlnew | grep 'cipher: chacha20,' >/dev/null;then echo ----------------------------------------------- logger "已停止支持chacha20加密，请更换更安全的节点加密协议！" 31 echo ----------------------------------------------- @@ -259,7 +259,7 @@ EOF` fi #检测并去除无效节点组 [ -n "$url_type" ] && type xargs >/dev/null 2>&1 && { - cat $yamlnew | grep -A 8 "\-\ name:" | xargs | sed 's/- name: /\n/g' | sed 's/ type: .*proxies: /#/g' | sed 's/ rules:.*//g' | sed 's/- //g' | grep -E '#DIRECT\ $' | awk -F '#' '{print $1}' > /tmp/clash_proxies_$USER + cat $yamlnew | grep -A 8 "\- name:" | xargs | sed 's/- name: /\n/g' | sed 's/ type: .*proxies: /#/g' | sed 's/ rules:.*//g' | sed 's/- //g' | grep -E '#DIRECT $' | awk -F '#' '{print $1}' > /tmp/clash_proxies_$USER while read line ;do sed -i "/- $line/d" $yamlnew sed -i "/- name: $line/,/- DIRECT/d" $yamlnew @@ -377,12 +377,12 @@ EOF cut -c 1- $tmpdir/set.yaml $yaml_hosts $yaml_user $yaml_proxy > $tmpdir/config.yaml #插入自定义规则 sed -i "/#自定义规则/d" $tmpdir/config.yaml - space_rules=$(sed -n '/^rules/{n;p}' $tmpdir/proxy.yaml | grep -oE '^\ *') #获取空格数 + space_rules=$(sed -n '/^rules/{n;p}' $tmpdir/proxy.yaml | grep -oE '^ *') #获取空格数 if [ -f $clashdir/rules.yaml ];then sed -i '/^$/d' $clashdir/rules.yaml && echo >> $clashdir/rules.yaml #处理换行 while read line;do [ -z "$(echo "$line" | grep '#')" ] && \ - [ -n "$(echo "$line" | grep '\-\ ')" ] && \ + [ -n "$(echo "$line" | grep '\- ')" ] && \ line=$(echo "$line" | sed 's#/#\\/#') && \ sed -i "/^rules:/a\\$space_rules$line #自定义规则" $tmpdir/config.yaml done < $clashdir/rules.yaml @@ -390,13 +390,13 @@ EOF #插入自定义代理 sed -i "/#自定义代理/d" $tmpdir/config.yaml - space=$(sed -n '/^proxies:/{n;p}' $tmpdir/config.yaml | grep -oE '^\ *') #获取空格数 + space=$(sed -n '/^proxies:/{n;p}' $tmpdir/config.yaml | grep -oE '^ *') #获取空格数 if [ -f $clashdir/proxies.yaml ];then sed -i '/^$/d' $clashdir/proxies.yaml && echo >> $clashdir/proxies.yaml #处理换行 while read line;do [ -z "$(echo "$line" | grep '^proxies:')" ] && \ [ -z "$(echo "$line" | grep '#')" ] && \ - [ -n "$(echo "$line" | grep '\-\ ')" ] && \ + [ -n "$(echo "$line" | grep '\- ')" ] && \ line=$(echo "$line" | sed 's#/#\\/#') && \ sed -i "/^proxies:/a\\$space$line #自定义代理" $tmpdir/config.yaml done < $clashdir/proxies.yaml @@ -404,9 +404,9 @@ EOF #插入自定义策略组 sed -i "/#自定义策略组/d" $tmpdir/config.yaml - space=$(sed -n '/^proxy-groups:/{n;p}' $tmpdir/config.yaml | grep -oE '^\ *') #获取原始配置空格数 + space=$(sed -n '/^proxy-groups:/{n;p}' $tmpdir/config.yaml | grep -oE '^ *') #获取原始配置空格数 if [ -f $clashdir/proxy-groups.yaml ];then - c_space=$(sed -n '/^proxy-groups:/{n;p}' $clashdir/proxy-groups.yaml | grep -oE '^\ *') #获取自定义配置空格数 + c_space=$(sed -n '/^proxy-groups:/{n;p}' $clashdir/proxy-groups.yaml | grep -oE '^ *') #获取自定义配置空格数 [ -n "$c_space" ] && sed -i "s/$c_space/$space/g" $clashdir/proxy-groups.yaml && echo >> $clashdir/proxy-groups.yaml #处理缩进空格数 sed -i '/^$/d' $clashdir/proxy-groups.yaml && echo >> $clashdir/proxy-groups.yaml #处理换行 cat $clashdir/proxy-groups.yaml | awk '{array[NR]=$0} END { for(i=NR;i>0;i--){print array[i];} }' | while IFS= read line;do @@ -433,7 +433,7 @@ EOF } #设置路由规则 cn_ip_route(){ - if [ ! -f $bindir/cn_ip.txt ];then + [ ! -f $bindir/cn_ip.txt ] && { if [ -f $clashdir/cn_ip.txt ];then mv $clashdir/cn_ip.txt $bindir/cn_ip.txt else @@ -441,7 +441,14 @@ cn_ip_route(){ $0 webget $bindir/cn_ip.txt "$update_url/bin/china_ip_list.txt" [ "$?" = "1" ] && rm -rf $bindir/cn_ip.txt && logger "列表下载失败！" 31 fi - fi + } + [ "$dns_mod" = "redir_host" -a "$cn_ip_route" = "已开启" -a -f $bindir/cn_ip.txt -a -z "$(echo $redir_mod|grep -o 'Ntf')" ] && { + echo "create cn_ip hash:net family inet hashsize 1024 maxelem 65536" > /tmp/cn_$USER.ipset + awk '!/^$/&&!/^#/{printf("add cn_ip %s'" "'\n",$0)}' $bindir/cn_ip.txt >> /tmp/cn_$USER.ipset + ipset -! flush cn_ip 2>/dev/null + ipset -! restore < /tmp/cn_$USER.ipset + rm -rf cn_$USER.ipset + } } start_redir(){ #获取局域网host地址 @@ -459,14 +466,7 @@ start_redir(){ iptables -t nat -A clash -d 240.0.0.0/4 -j RETURN [ -n "$host_lan" ] && iptables -t nat -A clash -d $host_lan -j RETURN #绕过CN_IP - [ "$dns_mod" = "redir_host" -a "$cn_ip_route" = "已开启" -a -f $bindir/cn_ip.txt ] && { - echo "create cn_ip hash:net family inet hashsize 1024 maxelem 65536" > /tmp/cn_$USER.ipset - awk '!/^$/&&!/^#/{printf("add cn_ip %s'" "'\n",$0)}' $bindir/cn_ip.txt >> /tmp/cn_$USER.ipset - ipset -! flush cn_ip 2>/dev/null - ipset -! restore < /tmp/cn_$USER.ipset - rm -rf cn_$USER.ipset - iptables -t nat -A clash -m set --match-set cn_ip dst -j RETURN >/dev/null 2>&1 - } + [ "$dns_mod" = "redir_host" -a "$cn_ip_route" = "已开启" ] && iptables -t nat -A clash -m set --match-set cn_ip dst -j RETURN 2>/dev/null if [ "$macfilter_type" = "白名单" -a -n "$(cat $clashdir/mac)" ];then #mac白名单 for mac in $(cat $clashdir/mac); do @@ -547,6 +547,7 @@ start_dns_redir(){ } start_tproxy(){ + modprobe xt_TPROXY & >/dev/null #获取局域网host地址 host_lan ip rule add fwmark 1 table 100 @@ -563,7 +564,7 @@ start_tproxy(){ iptables -t mangle -A clash -d 224.0.0.0/4 -j RETURN iptables -t mangle -A clash -d 240.0.0.0/4 -j RETURN [ -n "$host_lan" ] && iptables -t mangle -A clash -d $host_lan -j RETURN - [ "$dns_mod" = "redir_host" -a "$cn_ip_route" = "已开启" ] && iptables -t mangle -A clash -m set --match-set cn_ip dst -j RETURN >/dev/null 2>&1 #绕过大陆IP + [ "$dns_mod" = "redir_host" -a "$cn_ip_route" = "已开启" ] && iptables -t mangle -A clash -m set --match-set cn_ip dst -j RETURN 2>/dev/null tproxy_set(){ if [ "$macfilter_type" = "白名单" -a -n "$(cat $clashdir/mac)" ];then #mac白名单 @@ -653,12 +654,13 @@ start_output(){ } } start_tun(){ + modprobe tun &> /dev/null + iptables -I FORWARD -o utun -j ACCEPT + #ip6tables -I FORWARD -o utun -j ACCEPT > /dev/null 2>&1 if [ "$quic_rj" = 已启用 ];then [ "$dns_mod" = "redir_host" -a "$cn_ip_route" = "已开启" ] && set_cn_ip='-m set ! --match-set cn_ip dst' - iptables -I FORWARD -p udp --dport 443 -o utun -m comment --comment "ShellClash QUIC REJECT" $set_cn_ip -j REJECT >/dev/null 2>&1 + iptables -I FORWARD -p udp --dport 443 -o utun -m comment --comment "ShellClash-QUIC-REJECT" $set_cn_ip -j REJECT >/dev/null 2>&1 fi - iptables -A FORWARD -o utun -j ACCEPT - #ip6tables -A FORWARD -o utun -j ACCEPT > /dev/null 2>&1 } start_nft(){ [ "$common_ports" = "已开启" ] && PORTS=$(echo $multiport | sed 's/,/, /g') @@ -674,7 +676,10 @@ start_nft(){ nft add table shellclash 2> /dev/null nft flush table shellclash 2> /dev/null [ "$redir_mod" = "Nft基础" ] && nft add chain shellclash prerouting { type nat hook prerouting priority -100 \; } - [ "$redir_mod" = "Nft混合" ] && nft add chain shellclash prerouting { type filter hook prerouting priority 0 \; } + [ "$redir_mod" = "Nft混合" ] && { + modprobe nft_tproxy &> /dev/null + nft add chain shellclash prerouting { type filter hook prerouting priority 0 \; } + } [ -n "$(echo $redir_mod|grep Nft)" ] && { #设置DNS转发 nft add chain shellclash dns { type nat hook prerouting priority -100 \; } @@ -886,7 +891,7 @@ catpac(){ #获取本机host地址 [ -n "$host" ] && host_pac=$host [ -z "$host_pac" ] && host_pac=$(ubus call network.interface.lan status 2>&1 | grep \"address\" | grep -oE '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}';) - [ -z "$host_pac" ] && host_pac=$(ip a 2>&1 | grep -w 'inet' | grep 'global' | grep -E '\ 1(92|0|72)\.' | sed 's/.*inet.//g' | sed 's/\/[0-9][0-9].*$//g' | head -n 1) + [ -z "$host_pac" ] && host_pac=$(ip a 2>&1 | grep -w 'inet' | grep 'global' | grep -E ' 1(92|0|72)\.' | sed 's/.*inet.//g' | sed 's/\/[0-9][0-9].*$//g' | head -n 1) cat > /tmp/clash_pac </dev/null fi fi