65 lines
2.2 KiB
Bash
65 lines
2.2 KiB
Bash
#!/bin/sh
|
|
set -eu
|
|
|
|
/bin/sh /root/stopblock.sh >/dev/null 2>&1 || true
|
|
|
|
LAN_IF="br-lan"
|
|
LAN_NET="192.168.2.0/24"
|
|
EXCLUDE_IP="13.244.149.112/32"
|
|
|
|
PORTAL_IP="102.38.126.180"
|
|
PORTAL_HTTP_PORT="8082"
|
|
PORTAL_HTTPS_PORT="8083"
|
|
|
|
# -------------------------
|
|
# NAT CAPTURE
|
|
# -------------------------
|
|
|
|
iptables -t nat -N CAPTIVE 2>/dev/null || true
|
|
iptables -t nat -F CAPTIVE
|
|
|
|
while iptables -t nat -C PREROUTING -i "$LAN_IF" -s "$LAN_NET" -j CAPTIVE 2>/dev/null; do
|
|
iptables -t nat -D PREROUTING -i "$LAN_IF" -s "$LAN_NET" -j CAPTIVE
|
|
done
|
|
iptables -t nat -I PREROUTING 1 -i "$LAN_IF" -s "$LAN_NET" -j CAPTIVE
|
|
|
|
iptables -t nat -A CAPTIVE -d "$EXCLUDE_IP" -j RETURN
|
|
|
|
iptables -t nat -A CAPTIVE -p udp --dport 53 -j REDIRECT --to-ports 53
|
|
iptables -t nat -A CAPTIVE -p tcp --dport 53 -j REDIRECT --to-ports 53
|
|
|
|
iptables -t nat -A CAPTIVE -p tcp --dport 80 -j DNAT --to-destination ${PORTAL_IP}:${PORTAL_HTTP_PORT}
|
|
iptables -t nat -A CAPTIVE -p tcp --dport 443 -j DNAT --to-destination ${PORTAL_IP}:${PORTAL_HTTPS_PORT}
|
|
|
|
# -------------------------
|
|
# FILTER ENFORCEMENT (BLOCK EVERYTHING ELSE)
|
|
# -------------------------
|
|
|
|
iptables -N CAPTIVE_BLOCK 2>/dev/null || true
|
|
iptables -F CAPTIVE_BLOCK
|
|
|
|
# Allow established traffic
|
|
iptables -A CAPTIVE_BLOCK -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
|
|
|
|
# Allow DNS to router itself (client -> router)
|
|
iptables -A CAPTIVE_BLOCK -p udp -d 192.168.2.1 --dport 53 -j ACCEPT
|
|
iptables -A CAPTIVE_BLOCK -p tcp -d 192.168.2.1 --dport 53 -j ACCEPT
|
|
|
|
# Allow access to captive portal server (after DNAT)
|
|
iptables -A CAPTIVE_BLOCK -p tcp -d "$PORTAL_IP" --dport "$PORTAL_HTTP_PORT" -j ACCEPT
|
|
iptables -A CAPTIVE_BLOCK -p tcp -d "$PORTAL_IP" --dport "$PORTAL_HTTPS_PORT" -j ACCEPT
|
|
|
|
# Allow bypass destination fully (optional but usually desired)
|
|
iptables -A CAPTIVE_BLOCK -d "$EXCLUDE_IP" -j ACCEPT
|
|
|
|
# Block everything else from LAN clients
|
|
iptables -A CAPTIVE_BLOCK -j REJECT --reject-with icmp-admin-prohibited
|
|
|
|
# Hook CAPTIVE_BLOCK into FORWARD (ensure single jump)
|
|
while iptables -C FORWARD -i "$LAN_IF" -s "$LAN_NET" -j CAPTIVE_BLOCK 2>/dev/null; do
|
|
iptables -D FORWARD -i "$LAN_IF" -s "$LAN_NET" -j CAPTIVE_BLOCK
|
|
done
|
|
iptables -I FORWARD 1 -i "$LAN_IF" -s "$LAN_NET" -j CAPTIVE_BLOCK
|
|
|
|
echo "OK: filter rules applied"
|