6 IPT4="iptables -t mangle -w"
7 IPT6="ip6tables -t mangle -w"
8 LOG="logger -t mwan3 -p"
9 CONNTRACK_FILE="/proc/net/nf_conntrack"
13 local _tmp _iface _iface_count
20 [ "$1" == "$_iface" ] && _tmp=$_iface_count
22 config_foreach mwan3_get_id interface
26 mwan3_set_connected_iptables()
28 local connected_network_v4 connected_network_v6
30 $IPS -! create mwan3_connected_v4 hash:net
31 $IPS create mwan3_connected_v4_temp hash:net
33 for connected_network_v4 in $($IP4 route | awk '{print $1}' | egrep '[0-9]{1,3}(\.[0-9]{1,3}){3}'); do
34 $IPS -! add mwan3_connected_v4_temp $connected_network_v4
37 for connected_network_v4 in $($IP4 route list table 0 | awk '{print $2}' | egrep '[0-9]{1,3}(\.[0-9]{1,3}){3}'); do
38 $IPS -! add mwan3_connected_v4_temp $connected_network_v4
41 $IPS add mwan3_connected_v4_temp 224.0.0.0/3
43 $IPS swap mwan3_connected_v4_temp mwan3_connected_v4
44 $IPS destroy mwan3_connected_v4_temp
46 $IPS -! create mwan3_connected_v6 hash:net family inet6
47 $IPS create mwan3_connected_v6_temp hash:net family inet6
49 for connected_network_v6 in $($IP6 route | awk '{print $1}' | egrep '([0-9a-fA-F]{1,4}:){7,7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:)|fe80:(:[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}|::(ffff(:0{1,4}){0,1}:){0,1}((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])|([0-9a-fA-F]{1,4}:){1,4}:((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])'); do
50 $IPS -! add mwan3_connected_v6_temp $connected_network_v6
53 $IPS swap mwan3_connected_v6_temp mwan3_connected_v6
54 $IPS destroy mwan3_connected_v6_temp
56 $IPS -! create mwan3_connected list:set
57 $IPS -! add mwan3_connected mwan3_connected_v4
58 $IPS -! add mwan3_connected mwan3_connected_v6
61 mwan3_set_general_rules()
65 for IP in "$IP4" "$IP6"; do
67 if [ -z "$($IP rule list | awk '$1 == "2253:"')" ]; then
68 $IP rule add pref 2253 fwmark 0xfd00/0xff00 blackhole
71 if [ -z "$($IP rule list | awk '$1 == "2254:"')" ]; then
72 $IP rule add pref 2254 fwmark 0xfe00/0xff00 unreachable
77 mwan3_set_general_iptables()
81 for IPT in "$IPT4" "$IPT6"; do
83 if ! $IPT -S mwan3_ifaces_in &> /dev/null; then
84 $IPT -N mwan3_ifaces_in
87 if ! $IPT -S mwan3_connected &> /dev/null; then
88 $IPT -N mwan3_connected
89 $IPS -! create mwan3_connected list:set
90 $IPT -A mwan3_connected -m set --match-set mwan3_connected dst -j MARK --set-xmark 0xff00/0xff00
93 if ! $IPT -S mwan3_ifaces_out &> /dev/null; then
94 $IPT -N mwan3_ifaces_out
97 if ! $IPT -S mwan3_rules &> /dev/null; then
101 if ! $IPT -S mwan3_hook &> /dev/null; then
103 $IPT -A mwan3_hook -j CONNMARK --restore-mark --nfmask 0xff00 --ctmask 0xff00
104 $IPT -A mwan3_hook -m mark --mark 0x0/0xff00 -j mwan3_ifaces_in
105 $IPT -A mwan3_hook -m mark --mark 0x0/0xff00 -j mwan3_connected
106 $IPT -A mwan3_hook -m mark --mark 0x0/0xff00 -j mwan3_ifaces_out
107 $IPT -A mwan3_hook -m mark --mark 0x0/0xff00 -j mwan3_rules
108 $IPT -A mwan3_hook -j CONNMARK --save-mark --nfmask 0xff00 --ctmask 0xff00
109 $IPT -A mwan3_hook -m mark ! --mark 0xff00/0xff00 -j mwan3_connected
112 if ! $IPT -S PREROUTING | grep mwan3_hook &> /dev/null; then
113 $IPT -A PREROUTING -j mwan3_hook
116 if ! $IPT -S OUTPUT | grep mwan3_hook &> /dev/null; then
117 $IPT -A OUTPUT -j mwan3_hook
122 mwan3_create_iface_iptables()
124 local id family src_ip src_ipv6
126 config_get family $1 family ipv4
127 mwan3_get_iface_id id $1
129 [ -n "$id" ] || return 0
131 if [ "$family" == "ipv4" ]; then
133 ubus call network.interface.${1}_4 status &>/dev/null
134 if [ "$?" -eq "0" ]; then
135 network_get_ipaddr src_ip ${1}_4
137 network_get_ipaddr src_ip $1
140 $IPS -! create mwan3_connected list:set
142 if ! $IPT4 -S mwan3_ifaces_in &> /dev/null; then
143 $IPT4 -N mwan3_ifaces_in
146 if ! $IPT4 -S mwan3_ifaces_out &> /dev/null; then
147 $IPT4 -N mwan3_ifaces_out
150 if ! $IPT4 -S mwan3_iface_in_$1 &> /dev/null; then
151 $IPT4 -N mwan3_iface_in_$1
154 if ! $IPT4 -S mwan3_iface_out_$1 &> /dev/null; then
155 $IPT4 -N mwan3_iface_out_$1
158 $IPT4 -F mwan3_iface_in_$1
159 $IPT4 -A mwan3_iface_in_$1 -i $2 -m set --match-set mwan3_connected src -m mark --mark 0x0/0xff00 -m comment --comment "default" -j MARK --set-xmark 0xff00/0xff00
160 $IPT4 -A mwan3_iface_in_$1 -i $2 -m mark --mark 0x0/0xff00 -m comment --comment "$1" -j MARK --set-xmark $(($id*256))/0xff00
162 $IPT4 -D mwan3_ifaces_in -m mark --mark 0x0/0xff00 -j mwan3_iface_in_$1 &> /dev/null
163 $IPT4 -A mwan3_ifaces_in -m mark --mark 0x0/0xff00 -j mwan3_iface_in_$1
165 $IPT4 -F mwan3_iface_out_$1
166 $IPT4 -A mwan3_iface_out_$1 -s $src_ip -m mark --mark 0x0/0xff00 -m comment --comment "$1" -j MARK --set-xmark $(($id*256))/0xff00
168 $IPT4 -D mwan3_ifaces_out -m mark --mark 0x0/0xff00 -j mwan3_iface_out_$1 &> /dev/null
169 $IPT4 -A mwan3_ifaces_out -m mark --mark 0x0/0xff00 -j mwan3_iface_out_$1
172 if [ "$family" == "ipv6" ]; then
174 ubus call network.interface.${1}_6 status &>/dev/null
175 if [ "$?" -eq "0" ]; then
176 network_get_ipaddr6 src_ipv6 ${1}_6
178 network_get_ipaddr6 src_ipv6 $1
181 $IPS -! create mwan3_connected_v6 hash:net family inet6
183 if ! $IPT6 -S mwan3_ifaces_in &> /dev/null; then
184 $IPT6 -N mwan3_ifaces_in
187 if ! $IPT6 -S mwan3_ifaces_out &> /dev/null; then
188 $IPT6 -N mwan3_ifaces_out
191 if ! $IPT6 -S mwan3_iface_in_$1 &> /dev/null; then
192 $IPT6 -N mwan3_iface_in_$1
195 if ! $IPT6 -S mwan3_iface_out_$1 &> /dev/null; then
196 $IPT6 -N mwan3_iface_out_$1
199 $IPT6 -F mwan3_iface_in_$1
200 $IPT6 -A mwan3_iface_in_$1 -i $2 -m set --match-set mwan3_connected_v6 src -m mark --mark 0x0/0xff00 -m comment --comment "default" -j MARK --set-xmark 0xff00/0xff00
201 $IPT6 -A mwan3_iface_in_$1 -i $2 -m mark --mark 0x0/0xff00 -m comment --comment "$1" -j MARK --set-xmark $(($id*256))/0xff00
203 $IPT6 -D mwan3_ifaces_in -m mark --mark 0x0/0xff00 -j mwan3_iface_in_$1 &> /dev/null
204 $IPT6 -A mwan3_ifaces_in -m mark --mark 0x0/0xff00 -j mwan3_iface_in_$1
206 $IPT6 -F mwan3_iface_out_$1
207 $IPT6 -A mwan3_iface_out_$1 -s $src_ipv6 -m mark --mark 0x0/0xff00 -m comment --comment "$1" -j MARK --set-xmark $(($id*256))/0xff00
209 $IPT6 -D mwan3_ifaces_out -m mark --mark 0x0/0xff00 -j mwan3_iface_out_$1 &> /dev/null
210 $IPT6 -A mwan3_ifaces_out -m mark --mark 0x0/0xff00 -j mwan3_iface_out_$1
214 mwan3_delete_iface_iptables()
216 config_get family $1 family ipv4
218 if [ "$family" == "ipv4" ]; then
220 $IPT4 -D mwan3_ifaces_in -m mark --mark 0x0/0xff00 -j mwan3_iface_in_$1 &> /dev/null
221 $IPT4 -F mwan3_iface_in_$1 &> /dev/null
222 $IPT4 -X mwan3_iface_in_$1 &> /dev/null
224 $IPT4 -D mwan3_ifaces_out -m mark --mark 0x0/0xff00 -j mwan3_iface_out_$1 &> /dev/null
225 $IPT4 -F mwan3_iface_out_$1 &> /dev/null
226 $IPT4 -X mwan3_iface_out_$1 &> /dev/null
229 if [ "$family" == "ipv6" ]; then
231 $IPT6 -D mwan3_ifaces_in -m mark --mark 0x0/0xff00 -j mwan3_iface_in_$1 &> /dev/null
232 $IPT6 -F mwan3_iface_in_$1 &> /dev/null
233 $IPT6 -X mwan3_iface_in_$1 &> /dev/null
235 $IPT6 -D mwan3_ifaces_out -m mark --mark 0x0/0xff00 -j mwan3_iface_out_$1 &> /dev/null
236 $IPT6 -F mwan3_iface_out_$1 &> /dev/null
237 $IPT6 -X mwan3_iface_out_$1 &> /dev/null
241 mwan3_create_iface_route()
245 config_get family $1 family ipv4
246 mwan3_get_iface_id id $1
248 [ -n "$id" ] || return 0
250 if [ "$family" == "ipv4" ]; then
251 ubus call network.interface.${1}_4 status &>/dev/null
252 if [ "$?" -eq "0" ]; then
253 network_get_gateway route_args ${1}_4
255 network_get_gateway route_args $1
258 route_args="via $route_args dev $2"
260 $IP4 route flush table $id
261 $IP4 route add table $id default $route_args
264 if [ "$family" == "ipv6" ]; then
266 ubus call network.interface.${1}_6 status &>/dev/null
267 if [ "$?" -eq "0" ]; then
268 network_get_gateway6 route_args ${1}_6
270 network_get_gateway6 route_args $1
273 route_args="via $route_args dev $2"
275 $IP6 route flush table $id
276 $IP6 route add table $id default $route_args
280 mwan3_delete_iface_route()
284 config_get family $1 family ipv4
285 mwan3_get_iface_id id $1
287 [ -n "$id" ] || return 0
289 if [ "$family" == "ipv4" ]; then
290 $IP4 route flush table $id
293 if [ "$family" == "ipv6" ]; then
294 $IP6 route flush table $id
298 mwan3_create_iface_rules()
302 config_get family $1 family ipv4
303 mwan3_get_iface_id id $1
305 [ -n "$id" ] || return 0
307 if [ "$family" == "ipv4" ]; then
309 while [ -n "$($IP4 rule list | awk '$1 == "'$(($id+1000)):'"')" ]; do
310 $IP4 rule del pref $(($id+1000))
313 while [ -n "$($IP4 rule list | awk '$1 == "'$(($id+2000)):'"')" ]; do
314 $IP4 rule del pref $(($id+2000))
317 $IP4 rule add pref $(($id+1000)) iif $2 lookup main
318 $IP4 rule add pref $(($id+2000)) fwmark $(($id*256))/0xff00 lookup $id
321 if [ "$family" == "ipv6" ]; then
323 while [ -n "$($IP6 rule list | awk '$1 == "'$(($id+1000)):'"')" ]; do
324 $IP6 rule del pref $(($id+1000))
327 while [ -n "$($IP6 rule list | awk '$1 == "'$(($id+2000)):'"')" ]; do
328 $IP6 rule del pref $(($id+2000))
331 $IP6 rule add pref $(($id+1000)) iif $2 lookup main
332 $IP6 rule add pref $(($id+2000)) fwmark $(($id*256))/0xff00 lookup $id
336 mwan3_delete_iface_rules()
340 config_get family $1 family ipv4
341 mwan3_get_iface_id id $1
343 [ -n "$id" ] || return 0
345 if [ "$family" == "ipv4" ]; then
347 while [ -n "$($IP4 rule list | awk '$1 == "'$(($id+1000)):'"')" ]; do
348 $IP4 rule del pref $(($id+1000))
351 while [ -n "$($IP4 rule list | awk '$1 == "'$(($id+2000)):'"')" ]; do
352 $IP4 rule del pref $(($id+2000))
356 if [ "$family" == "ipv6" ]; then
358 while [ -n "$($IP6 rule list | awk '$1 == "'$(($id+1000)):'"')" ]; do
359 $IP6 rule del pref $(($id+1000))
362 while [ -n "$($IP6 rule list | awk '$1 == "'$(($id+2000)):'"')" ]; do
363 $IP6 rule del pref $(($id+2000))
368 mwan3_delete_iface_ipset_entries()
370 local id setname entry
372 mwan3_get_iface_id id $1
374 [ -n "$id" ] || return 0
376 for setname in $(ipset -n list | grep ^mwan3_sticky_); do
377 for entry in $(ipset list $setname | grep "$(echo $(($id*256)) | awk '{ printf "0x%08x", $1; }')" | cut -d ' ' -f 1); do
378 $IPS del $setname $entry
385 local track_ip track_ips
387 mwan3_list_track_ips()
389 track_ips="$1 $track_ips"
391 config_list_foreach $1 track_ip mwan3_list_track_ips
393 kill $(pgrep -f "mwan3track $1") &> /dev/null
394 if [ -n "$track_ips" ]; then
395 [ -x /usr/sbin/mwan3track ] && /usr/sbin/mwan3track $1 $2 $track_ips &
403 pid="$(pgrep -f "mwan3track $1")"
404 if [ "${pid}" != "" ]; then
407 $LOG warn "Unable to send signal USR1 to mwan3track on interface $1 with pid ${pid}"
413 local iface_count id iface family metric probability weight
415 config_get iface $1 interface
416 config_get metric $1 metric 1
417 config_get weight $1 weight 1
419 [ -n "$iface" ] || return 0
421 mwan3_get_iface_id id $iface
423 [ -n "$id" ] || return 0
425 config_get family $iface family ipv4
427 if [ "$family" == "ipv4" ]; then
429 if [ -n "$($IP4 route list table $id)" ]; then
430 if [ "$metric" -lt "$lowest_metric_v4" ]; then
432 total_weight_v4=$weight
433 $IPT4 -F mwan3_policy_$policy
434 $IPT4 -A mwan3_policy_$policy -m mark --mark 0x0/0xff00 -m comment --comment "$iface $weight $weight" -j MARK --set-xmark $(($id*256))/0xff00
436 lowest_metric_v4=$metric
438 elif [ "$metric" -eq "$lowest_metric_v4" ]; then
440 total_weight_v4=$(($total_weight_v4+$weight))
441 probability=$(($weight*1000/$total_weight_v4))
443 if [ "$probability" -lt 10 ]; then
444 probability="0.00$probability"
445 elif [ $probability -lt 100 ]; then
446 probability="0.0$probability"
447 elif [ $probability -lt 1000 ]; then
448 probability="0.$probability"
453 probability="-m statistic --mode random --probability $probability"
455 $IPT4 -I mwan3_policy_$policy -m mark --mark 0x0/0xff00 $probability -m comment --comment "$iface $weight $total_weight_v4" -j MARK --set-xmark $(($id*256))/0xff00
460 if [ "$family" == "ipv6" ]; then
462 if [ -n "$($IP6 route list table $id)" ]; then
463 if [ "$metric" -lt "$lowest_metric_v6" ]; then
465 total_weight_v6=$weight
466 $IPT6 -F mwan3_policy_$policy
467 $IPT6 -A mwan3_policy_$policy -m mark --mark 0x0/0xff00 -m comment --comment "$iface $weight $weight" -j MARK --set-xmark $(($id*256))/0xff00
469 lowest_metric_v6=$metric
471 elif [ "$metric" -eq "$lowest_metric_v6" ]; then
473 total_weight_v6=$(($total_weight_v6+$weight))
474 probability=$(($weight*1000/$total_weight_v6))
476 if [ "$probability" -lt 10 ]; then
477 probability="0.00$probability"
478 elif [ $probability -lt 100 ]; then
479 probability="0.0$probability"
480 elif [ $probability -lt 1000 ]; then
481 probability="0.$probability"
486 probability="-m statistic --mode random --probability $probability"
488 $IPT6 -I mwan3_policy_$policy -m mark --mark 0x0/0xff00 $probability -m comment --comment "$iface $weight $total_weight_v6" -j MARK --set-xmark $(($id*256))/0xff00
494 mwan3_create_policies_iptables()
496 local last_resort lowest_metric_v4 lowest_metric_v6 total_weight_v4 total_weight_v6 policy IPT
500 config_get last_resort $1 last_resort unreachable
502 if [ "$1" != $(echo "$1" | cut -c1-15) ]; then
503 $LOG warn "Policy $1 exceeds max of 15 chars. Not setting policy" && return 0
506 for IPT in "$IPT4" "$IPT6"; do
508 if ! $IPT -S mwan3_policy_$1 &> /dev/null; then
509 $IPT -N mwan3_policy_$1
512 $IPT -F mwan3_policy_$1
514 case "$last_resort" in
516 $IPT -A mwan3_policy_$1 -m mark --mark 0x0/0xff00 -m comment --comment "blackhole" -j MARK --set-xmark 0xfd00/0xff00
519 $IPT -A mwan3_policy_$1 -m mark --mark 0x0/0xff00 -m comment --comment "default" -j MARK --set-xmark 0xff00/0xff00
522 $IPT -A mwan3_policy_$1 -m mark --mark 0x0/0xff00 -m comment --comment "unreachable" -j MARK --set-xmark 0xfe00/0xff00
533 config_list_foreach $1 use_member mwan3_set_policy
536 mwan3_set_policies_iptables()
538 config_foreach mwan3_create_policies_iptables policy
541 mwan3_set_sticky_iptables()
545 for iface in $($IPT4 -S $policy | cut -s -d'"' -f2 | awk '{print $1}'); do
547 if [ "$iface" == "$1" ]; then
549 mwan3_get_iface_id id $1
551 [ -n "$id" ] || return 0
553 for IPT in "$IPT4" "$IPT6"; do
554 if [ -n "$($IPT -S mwan3_iface_in_$1 2> /dev/null)" -a -n "$($IPT -S mwan3_iface_out_$1 2> /dev/null)" ]; then
555 $IPT -I mwan3_rule_$rule -m mark --mark $(($id*256))/0xff00 -m set ! --match-set mwan3_sticky_$rule src,src -j MARK --set-xmark 0x0/0xff00
556 $IPT -I mwan3_rule_$rule -m mark --mark 0/0xff00 -j MARK --set-xmark $(($id*256))/0xff00
563 mwan3_set_user_iptables_rule()
565 local ipset family proto policy src_ip src_port sticky dest_ip dest_port use_policy timeout rule policy IPT
569 config_get sticky $1 sticky 0
570 config_get timeout $1 timeout 600
571 config_get ipset $1 ipset
572 config_get proto $1 proto all
573 config_get src_ip $1 src_ip 0.0.0.0/0
574 config_get src_port $1 src_port 0:65535
575 config_get dest_ip $1 dest_ip 0.0.0.0/0
576 config_get dest_port $1 dest_port 0:65535
577 config_get use_policy $1 use_policy
578 config_get family $1 family any
580 if [ "$1" != $(echo "$1" | cut -c1-15) ]; then
581 $LOG warn "Rule $1 exceeds max of 15 chars. Not setting rule" && return 0
584 if [ -n "$ipset" ]; then
585 ipset="-m set --match-set $ipset dst"
588 if [ -n "$use_policy" ]; then
589 if [ "$use_policy" == "default" ]; then
590 policy="MARK --set-xmark 0xff00/0xff00"
591 elif [ "$use_policy" == "unreachable" ]; then
592 policy="MARK --set-xmark 0xfe00/0xff00"
593 elif [ "$use_policy" == "blackhole" ]; then
594 policy="MARK --set-xmark 0xfd00/0xff00"
596 if [ "$sticky" -eq 1 ]; then
598 policy="mwan3_policy_$use_policy"
600 for IPT in "$IPT4" "$IPT6"; do
601 if ! $IPT -S $policy &> /dev/null; then
605 if ! $IPT -S mwan3_rule_$1 &> /dev/null; then
606 $IPT -N mwan3_rule_$1
609 $IPT -F mwan3_rule_$1
612 $IPS -! create mwan3_sticky_v4_$rule hash:ip,mark markmask 0xff00 timeout $timeout
613 $IPS -! create mwan3_sticky_v6_$rule hash:ip,mark markmask 0xff00 timeout $timeout family inet6
614 $IPS -! create mwan3_sticky_$rule list:set
615 $IPS -! add mwan3_sticky_$rule mwan3_sticky_v4_$rule
616 $IPS -! add mwan3_sticky_$rule mwan3_sticky_v6_$rule
618 config_foreach mwan3_set_sticky_iptables interface
620 for IPT in "$IPT4" "$IPT6"; do
621 $IPT -A mwan3_rule_$1 -m mark --mark 0/0xff00 -j $policy
622 $IPT -A mwan3_rule_$1 -m mark ! --mark 0xfc00/0xfc00 -j SET --del-set mwan3_sticky_$rule src,src
623 $IPT -A mwan3_rule_$1 -m mark ! --mark 0xfc00/0xfc00 -j SET --add-set mwan3_sticky_$rule src,src
626 policy="mwan3_rule_$1"
628 policy="mwan3_policy_$use_policy"
630 for IPT in "$IPT4" "$IPT6"; do
631 if ! $IPT -S $policy &> /dev/null; then
639 if [ "$family" == "any" ]; then
641 for IPT in "$IPT4" "$IPT6"; do
644 $IPT -A mwan3_rules -p $proto -s $src_ip -d $dest_ip $ipset -m multiport --sports $src_port -m multiport --dports $dest_port -m mark --mark 0/0xff00 -m comment --comment "$1" -j $policy &> /dev/null
647 $IPT -A mwan3_rules -p $proto -s $src_ip -d $dest_ip $ipset -m mark --mark 0/0xff00 -m comment --comment "$1" -j $policy &> /dev/null
652 elif [ "$family" == "ipv4" ]; then
656 $IPT4 -A mwan3_rules -p $proto -s $src_ip -d $dest_ip $ipset -m multiport --sports $src_port -m multiport --dports $dest_port -m mark --mark 0/0xff00 -m comment --comment "$1" -j $policy &> /dev/null
659 $IPT4 -A mwan3_rules -p $proto -s $src_ip -d $dest_ip $ipset -m mark --mark 0/0xff00 -m comment --comment "$1" -j $policy &> /dev/null
663 elif [ "$family" == "ipv6" ]; then
667 $IPT6 -A mwan3_rules -p $proto -s $src_ip -d $dest_ip $ipset -m multiport --sports $src_port -m multiport --dports $dest_port -m mark --mark 0/0xff00 -m comment --comment "$1" -j $policy &> /dev/null
670 $IPT6 -A mwan3_rules -p $proto -s $src_ip -d $dest_ip $ipset -m mark --mark 0/0xff00 -m comment --comment "$1" -j $policy &> /dev/null
677 mwan3_set_user_rules()
681 for IPT in "$IPT4" "$IPT6"; do
683 if ! $IPT -S mwan3_rules &> /dev/null; then
690 config_foreach mwan3_set_user_iptables_rule rule
693 mwan3_report_iface_status()
695 local device result track_ips tracking IP IPT
697 mwan3_get_iface_id id $1
698 network_get_device device $1
699 config_get enabled "$1" enabled 0
700 config_get family "$1" family ipv4
702 if [ "$family" == "ipv4" ]; then
707 if [ "$family" == "ipv6" ]; then
712 if [ -z "$id" -o -z "$device" ]; then
714 elif [ -n "$($IP rule | awk '$1 == "'$(($id+1000)):'"')"i -a -n "$($IP rule | awk '$1 == "'$(($id+2000)):'"')" -a -n "$($IPT -S mwan3_iface_in_$1 2> /dev/null)" -a -n "$($IPT -S mwan3_iface_out_$1 2> /dev/null)" -a -n "$($IP route list table $id default dev $device 2> /dev/null)" ]; then
716 elif [ -n "$($IP rule | awk '$1 == "'$(($id+1000)):'"')" -o -n "$($IP rule | awk '$1 == "'$(($id+2000)):'"')" -o -n "$($IPT -S mwan3_iface_in_$1 2> /dev/null)" -o -n "$($IPT -S mwan3_iface_out_$1 2> /dev/null)" -o -n "$($IP route list table $id default dev $device 2> /dev/null)" ]; then
719 if [ "$enabled" == "1" ]; then
726 mwan3_list_track_ips()
728 track_ips="$1 $track_ips"
730 config_list_foreach $1 track_ip mwan3_list_track_ips
732 if [ -n "$track_ips" ]; then
733 if [ -n "$(ps -w | grep mwan3track | grep -v grep | sed '/.*\/usr\/sbin\/mwan3track \([^ ]*\) .*$/!d;s//\1/' | awk '$1 == "'$1'"')" ]; then
739 tracking="not enabled"
742 echo " interface $1 is $result and tracking is $tracking"
745 mwan3_report_policies_v4()
747 local percent policy share total_weight weight iface
749 for policy in $($IPT4 -S | awk '{print $2}' | grep mwan3_policy_ | sort -u); do
750 echo "$policy:" | sed 's/mwan3_policy_//'
752 [ -n "$total_weight" ] || total_weight=$($IPT4 -S $policy | cut -s -d'"' -f2 | head -1 | awk '{print $3}')
754 if [ ! -z "${total_weight##*[!0-9]*}" ]; then
755 for iface in $($IPT4 -S $policy | cut -s -d'"' -f2 | awk '{print $1}'); do
756 weight=$($IPT4 -S $policy | cut -s -d'"' -f2 | awk '$1 == "'$iface'"' | awk '{print $2}')
757 percent=$(($weight*100/$total_weight))
758 echo " $iface ($percent%)"
761 echo " $($IPT4 -S $policy | sed '/.*--comment \([^ ]*\) .*$/!d;s//\1/;q')"
770 mwan3_report_policies_v6()
772 local percent policy share total_weight weight iface
774 for policy in $($IPT6 -S | awk '{print $2}' | grep mwan3_policy_ | sort -u); do
775 echo "$policy:" | sed 's/mwan3_policy_//'
777 [ -n "$total_weight" ] || total_weight=$($IPT6 -S $policy | cut -s -d'"' -f2 | head -1 | awk '{print $3}')
779 if [ ! -z "${total_weight##*[!0-9]*}" ]; then
780 for iface in $($IPT6 -S $policy | cut -s -d'"' -f2 | awk '{print $1}'); do
781 weight=$($IPT6 -S $policy | cut -s -d'"' -f2 | awk '$1 == "'$iface'"' | awk '{print $2}')
782 percent=$(($weight*100/$total_weight))
783 echo " $iface ($percent%)"
786 echo " $($IPT6 -S $policy | sed '/.*--comment \([^ ]*\) .*$/!d;s//\1/;q')"
795 mwan3_report_connected_v4()
799 if [ -n "$($IPT4 -S mwan3_connected 2> /dev/null)" ]; then
800 for address in $($IPS list mwan3_connected_v4 | egrep '[0-9]{1,3}(\.[0-9]{1,3}){3}'); do
806 mwan3_report_connected_v6()
810 if [ -n "$($IPT6 -S mwan3_connected 2> /dev/null)" ]; then
811 for address in $($IPS list mwan3_connected_v6 | egrep '([0-9a-fA-F]{1,4}:){7,7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:)|fe80:(:[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}|::(ffff(:0{1,4}){0,1}:){0,1}((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])|([0-9a-fA-F]{1,4}:){1,4}:((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])'); do
817 mwan3_report_rules_v4()
819 if [ -n "$($IPT4 -S mwan3_rules 2> /dev/null)" ]; then
820 $IPT4 -L mwan3_rules -n -v 2> /dev/null | tail -n+3 | sed 's/mark.*//' | sed 's/mwan3_policy_/- /' | sed 's/mwan3_rule_/S /'
824 mwan3_report_rules_v6()
826 if [ -n "$($IPT6 -S mwan3_rules 2> /dev/null)" ]; then
827 $IPT6 -L mwan3_rules -n -v 2> /dev/null | tail -n+3 | sed 's/mark.*//' | sed 's/mwan3_policy_/- /' | sed 's/mwan3_rule_/S /'
831 mwan3_flush_conntrack()
833 local flush_conntrack
835 config_get flush_conntrack $1 flush_conntrack never
837 if [ -e "$CONNTRACK_FILE" ]; then
838 case $flush_conntrack in
840 [ "$3" = "ifup" ] && {
841 echo f > ${CONNTRACK_FILE}
842 $LOG info "connection tracking flushed on interface $1 ($2) $3"
846 [ "$3" = "ifdown" ] && {
847 echo f > ${CONNTRACK_FILE}
848 $LOG info "connection tracking flushed on interface $1 ($2) $3"
852 echo f > ${CONNTRACK_FILE}
853 $LOG info "connection tracking flushed on interface $1 ($2) $3"
856 $LOG info "connection tracking not flushed on interface $1 ($2) $3"
860 $LOG warning "connection tracking not enabled"