him411/UA3F
1
0
Fork 0
mirror of https://github.com/SunBK201/UA3F.git synced 2025-12-19 02:08:32 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix: update SKIP_PORTS to include port 53 and add NftRuleIgnorePorts in nftables

Browse Source
This commit is contained in:
SunBK201 2025-12-08 21:26:45 +08:00
parent 004a568b30
commit 02bb6f343d
3 changed files with 18 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
src/internal/netfilter/firewall.go
View File

@ -25,7 +25,7 @@ const (
const ( const (
LANSET = "UA3F_LAN" LANSET = "UA3F_LAN"
SKIP_IPSET = "UA3F_SKIP_IPSET" SKIP_IPSET = "UA3F_SKIP_IPSET"
SKIP_PORTS = "22,51080,51090" SKIP_PORTS = "22,53,51080,51090"
FAKEIP_RANGE = "198.18.0.0/16,198.18.0.1/15,28.0.0.1/8" FAKEIP_RANGE = "198.18.0.0/16,198.18.0.1/15,28.0.0.1/8"
HELPER_QUEUE = 10301 HELPER_QUEUE = 10301
DESYNC_QUEUE = 10901 DESYNC_QUEUE = 10901

14
src/internal/server/desync/nftables.go
View File

@ -6,6 +6,7 @@ import (
"context" "context"
"fmt" "fmt"
"github.com/sunbk201/ua3f/internal/netfilter"
"sigs.k8s.io/knftables" "sigs.k8s.io/knftables"
) )
@ -49,7 +50,13 @@ func (s *Server) NftSetDesync(tx *knftables.Transaction, table *knftables.Table)
Hook: knftables.PtrTo(knftables.PostroutingHook), Hook: knftables.PtrTo(knftables.PostroutingHook),
Priority: knftables.PtrTo(knftables.BaseChainPriority("mangle - 30")), Priority: knftables.PtrTo(knftables.BaseChainPriority("mangle - 30")),
} }
rule := &knftables.Rule{ tx.Add(chain)
tx.Add(&knftables.Rule{
Chain: chain.Name,
Rule: netfilter.NftRuleIgnorePorts,
})
tx.Add(&knftables.Rule{
Chain: chain.Name, Chain: chain.Name,
Rule: knftables.Concat( Rule: knftables.Concat(
"ip length > 41", "ip length > 41",
@ -60,7 +67,6 @@ func (s *Server) NftSetDesync(tx *knftables.Transaction, table *knftables.Table)
fmt.Sprintf("ct packets < %d", s.CtPackets), fmt.Sprintf("ct packets < %d", s.CtPackets),
fmt.Sprintf("counter queue num %d bypass", s.nfqServer.QueueNum), fmt.Sprintf("counter queue num %d bypass", s.nfqServer.QueueNum),
), ),
} })
tx.Add(chain)
tx.Add(rule)
} }

11
src/internal/server/netlink/nftables.go
View File

@ -121,15 +121,18 @@ func (s *Server) NftHookTCPSyn(tx *knftables.Transaction, table *knftables.Table
Priority: knftables.PtrTo(knftables.ManglePriority), Priority: knftables.PtrTo(knftables.ManglePriority),
} }
tx.Add(chain) tx.Add(chain)
var rule *knftables.Rule
rule = &knftables.Rule{ tx.Add(&knftables.Rule{
Chain: chain.Name,
Rule: netfilter.NftRuleIgnorePorts,
})
tx.Add(&knftables.Rule{
Chain: chain.Name, Chain: chain.Name,
Rule: knftables.Concat( Rule: knftables.Concat(
"tcp flags syn", "tcp flags syn",
fmt.Sprintf("counter queue num %d bypass", s.nfqServer.QueueNum), fmt.Sprintf("counter queue num %d bypass", s.nfqServer.QueueNum),
), ),
} })
tx.Add(rule)
} }
func (s *Server) NftSetIP(tx *knftables.Transaction, table *knftables.Table) { func (s *Server) NftSetIP(tx *knftables.Transaction, table *knftables.Table) {