M1rs3m/BFR
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 1 Wiki Activity

adjust: "disable/enable QUIC" using iptables.tproxy rules

Browse Source
This commit is contained in:
sheynsw
2023-03-27 12:40:49 +07:00
parent b336689649
commit b438330a20
1 changed files with 7 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
scripts/src/box.iptables
View File

@@ -412,10 +412,12 @@ start_tproxy() {
${iptables} -t mangle -I PREROUTING -p tcp -m socket -j DIVERT
# # # Disable QUIC
[ "${quic}" = "disable" ] && ${iptables} -A OUTPUT -p udp -m multiport --dport 443,80 -j REJECT
# ${iptables} -A OUTPUT -p udp --dport 443 -j REJECT
# ${iptables} -A OUTPUT -p udp --dport 80 -j REJECT
# # Disable QUIC
if [ "${quic}" = "disable" ]; then
${iptables} -A OUTPUT -p udp --dport 443 -j REJECT
${iptables} -A OUTPUT -p udp --dport 80 -j REJECT
# ${iptables} -A OUTPUT -p udp -m multiport --dport 443,80 -j REJECT
fi
# This rule blocks local access to tproxy-port to prevent traffic loopback.
if [ "${iptables}" != "ip6tables -w 100" ]; then
@@ -480,9 +482,9 @@ stop_tproxy() {
${iptables} -t mangle -X DIVERT
# flush QUIC
${iptables} -D OUTPUT -p udp -m multiport --dport 443,80 -j REJECT
${iptables} -D OUTPUT -p udp --dport 443 -j REJECT
${iptables} -D OUTPUT -p udp --dport 80 -j REJECT
# ${iptables} -D OUTPUT -p udp -m multiport --dport 443,80 -j REJECT
if [ "${iptables}" != "ip6tables -w 100" ]; then
${iptables} -D OUTPUT -d 127.0.0.1 -p tcp -m owner --uid-owner "${box_user}" --gid-owner "${box_group}" -m tcp --dport "${tproxy_port}" -j REJECT