From b438330a20829426c1849e081bf0bd4e5b606172 Mon Sep 17 00:00:00 2001 From: sheynsw Date: Mon, 27 Mar 2023 12:40:49 +0700 Subject: [PATCH] adjust: "disable/enable QUIC" using iptables.tproxy rules --- scripts/src/box.iptables | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/scripts/src/box.iptables b/scripts/src/box.iptables index 274ad5a..f2a5a19 100755 --- a/scripts/src/box.iptables +++ b/scripts/src/box.iptables @@ -412,10 +412,12 @@ start_tproxy() { ${iptables} -t mangle -I PREROUTING -p tcp -m socket -j DIVERT - # # # Disable QUIC - [ "${quic}" = "disable" ] && ${iptables} -A OUTPUT -p udp -m multiport --dport 443,80 -j REJECT - # ${iptables} -A OUTPUT -p udp --dport 443 -j REJECT - # ${iptables} -A OUTPUT -p udp --dport 80 -j REJECT + # # Disable QUIC + if [ "${quic}" = "disable" ]; then + ${iptables} -A OUTPUT -p udp --dport 443 -j REJECT + ${iptables} -A OUTPUT -p udp --dport 80 -j REJECT + # ${iptables} -A OUTPUT -p udp -m multiport --dport 443,80 -j REJECT + fi # This rule blocks local access to tproxy-port to prevent traffic loopback. if [ "${iptables}" != "ip6tables -w 100" ]; then @@ -480,9 +482,9 @@ stop_tproxy() { ${iptables} -t mangle -X DIVERT # flush QUIC - ${iptables} -D OUTPUT -p udp -m multiport --dport 443,80 -j REJECT ${iptables} -D OUTPUT -p udp --dport 443 -j REJECT ${iptables} -D OUTPUT -p udp --dport 80 -j REJECT + # ${iptables} -D OUTPUT -p udp -m multiport --dport 443,80 -j REJECT if [ "${iptables}" != "ip6tables -w 100" ]; then ${iptables} -D OUTPUT -d 127.0.0.1 -p tcp -m owner --uid-owner "${box_user}" --gid-owner "${box_group}" -m tcp --dport "${tproxy_port}" -j REJECT