mirror of
https://github.com/bol-van/zapret.git
synced 2024-12-23 14:53:18 +00:00
34 lines
1.8 KiB
Plaintext
34 lines
1.8 KiB
Plaintext
For window size changing :
|
|
|
|
iptables -t raw -I PREROUTING -p tcp --sport 80 --tcp-flags SYN,ACK SYN,ACK -j NFQUEUE --queue-num 200 --queue-bypass
|
|
iptables -t raw -I PREROUTING -p tcp --sport 80 --tcp-flags SYN,ACK SYN,ACK -m set --match-set zapret src -j NFQUEUE --queue-num 200 --queue-bypass
|
|
|
|
For outgoing data manipulation ("Host:" case changing) :
|
|
|
|
iptables -t mangle -I POSTROUTING -p tcp --dport 80 -j NFQUEUE --queue-num 200 --queue-bypass
|
|
iptables -t mangle -I POSTROUTING -p tcp --dport 80 -m set --match-set zapret dst -j NFQUEUE --queue-num 200 --queue-bypass
|
|
iptables -t mangle -I POSTROUTING -p tcp --dport 80 -m set --match-set zapret dst -m connbytes --connbytes-dir=original --connbytes-mode=packets --connbytes 1:5 -j NFQUEUE --queue-num 200 --queue-bypass
|
|
|
|
|
|
For TPROXY :
|
|
|
|
sysctl -w net.ipv4.ip_forward=1
|
|
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
|
|
|
|
ip -f inet rule add fwmark 1 lookup 100
|
|
ip -f inet route add local default dev lo table 100
|
|
# prevent loop
|
|
iptables -t filter -I INPUT -p tcp --dport 1188 -j REJECT
|
|
iptables -t mangle -A PREROUTING -i eth1 -p tcp --dport 80 -j MARK --set-mark 1
|
|
iptables -t mangle -A PREROUTING -i eth1 -p tcp --dport 80 -j TPROXY --tproxy-mark 0x1/0x1 --on-port 1188
|
|
|
|
iptables -t mangle -A PREROUTING -i eth1 -p tcp --dport 80 -m set --match-set zapret dst -j MARK --set-mark 1
|
|
iptables -t mangle -A PREROUTING -i eth1 -p tcp --dport 80 -m mark --mark 0x1/0x1 -j TPROXY --tproxy-mark 0x1/0x1 --on-port 1188
|
|
|
|
For DNAT :
|
|
|
|
# run tpws as user "tpws". its required to avoid loops.
|
|
sysctl -w net.ipv4.conf.eth1.route_localnet=1
|
|
iptables -t nat -I PREROUTING -p tcp --dport 80 -j DNAT --to 127.0.0.1:1188
|
|
iptables -t nat -I OUTPUT -p tcp --dport 80 -m owner ! --uid-owner tpws -j DNAT --to 127.0.0.1:1188
|